diff --git a/README.md b/README.md
index 1f46bad3013..981421ea761 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,8 @@ for large scale TypeScript monorepos.
 - [API Documenter](https://api-extractor.com/pages/setup/generating_docs/) - use TSDoc comments to publish an API documentation website
 - [Lockfile Explorer](https://lfx.rushstack.io/) - investigate and solve version conflicts for PNPM lockfiles
 - [TSDoc](https://tsdoc.org/) - the standard for doc comments in TypeScript code
+- [Dogfooding the Rush daemon](./docs/rush/dogfooding-rush-daemon.md) - contributor guide for building this repo
+  with the opt-in `rush-client` daemon, built from source
 
 ## Related Repos
 
diff --git a/apps/heft/src/cli/HeftCommandLineParser.test.ts b/apps/heft/src/cli/HeftCommandLineParser.test.ts
new file mode 100644
index 00000000000..7be596af5ee
--- /dev/null
+++ b/apps/heft/src/cli/HeftCommandLineParser.test.ts
@@ -0,0 +1,140 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+jest.setTimeout(30_000);
+
+const HEFT_START_PATH: string = path.resolve(__dirname, '../start.js');
+
+// A project with one task. The task sets process.exitCode to FIXTURE_EXIT_CODE in the Heft process, the
+// way a test that Jest runs in band can, and then fails if FIXTURE_FAIL is set.
+const FIXTURE_FILES: Record<string, string> = {
+  'package.json': JSON.stringify({ name: 'heft-exit-code-fixture', version: '1.0.0', private: true }),
+  'heft-plugin.json': JSON.stringify({
+    taskPlugins: [{ pluginName: 'exit-code-fixture-plugin', entryPoint: './plugin.js' }]
+  }),
+  'config/heft.json': JSON.stringify({
+    phasesByName: {
+      test: { tasksByName: { fixture: { taskPlugin: { pluginPackage: 'heft-exit-code-fixture' } } } }
+    }
+  }),
+  'plugin.js': `module.exports = class {
+  apply(taskSession) {
+    taskSession.hooks.run.tapPromise('exit-code-fixture-plugin', async () => {
+      process.exitCode = Number(process.env.FIXTURE_EXIT_CODE);
+      if (process.env.FIXTURE_FAIL) {
+        throw new Error('The fixture task failed on purpose');
+      }
+    });
+  }
+};
+`
+};
+
+// The same project, but its heft.json declares an alias with the name of the "test" phase's action, so Heft fails
+// before any task runs, with an error that nothing has reported yet.
+const ALIAS_CLASH_FIXTURE_FILES: Record<string, string> = {
+  ...FIXTURE_FILES,
+  'config/heft.json': JSON.stringify({
+    ...JSON.parse(FIXTURE_FILES['config/heft.json']),
+    aliasesByName: { test: { actionName: 'test' } }
+  })
+};
+
+function createFixtureFolder(files: Record<string, string>): string {
+  const fixtureFolderPath: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-exit-code-'));
+  for (const [relativePath, contents] of Object.entries(files)) {
+    const filePath: string = path.join(fixtureFolderPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, contents);
+  }
+  return fixtureFolderPath;
+}
+
+interface IHeftResult {
+  exitCode: number | undefined;
+  output: string;
+}
+
+describe('HeftCommandLineParser', () => {
+  let fixtureFolderPath: string;
+  let aliasClashFixtureFolderPath: string;
+
+  beforeAll(() => {
+    fixtureFolderPath = createFixtureFolder(FIXTURE_FILES);
+    aliasClashFixtureFolderPath = createFixtureFolder(ALIAS_CLASH_FIXTURE_FILES);
+  });
+
+  afterAll(() => {
+    fs.rmSync(fixtureFolderPath, { recursive: true, force: true });
+    fs.rmSync(aliasClashFixtureFolderPath, { recursive: true, force: true });
+  });
+
+  async function runHeftTestAsync(
+    taskExitCode: number,
+    taskFails: boolean,
+    folderPath: string = fixtureFolderPath
+  ): Promise<IHeftResult> {
+    const env: NodeJS.ProcessEnv = { ...process.env, FIXTURE_EXIT_CODE: String(taskExitCode) };
+    delete env.FIXTURE_FAIL;
+    delete env._RUSH_REPORTER_CHILD_FD;
+    delete env._RUSH_REPORTER_CHILD_ACK_FD;
+    if (taskFails) {
+      env.FIXTURE_FAIL = '1';
+    }
+
+    const child: childProcess.ChildProcess = childProcess.spawn(process.execPath, [HEFT_START_PATH, 'test'], {
+      cwd: folderPath,
+      env,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let output: string = '';
+    const appendOutput: (chunk: string) => void = (chunk: string) => {
+      output += chunk;
+    };
+    child.stdout?.setEncoding('utf8').on('data', appendOutput);
+    child.stderr?.setEncoding('utf8').on('data', appendOutput);
+    const exitCode: number | null = await new Promise((resolve, reject) => {
+      child.once('error', reject);
+      child.once('close', resolve);
+    });
+
+    return { exitCode: exitCode ?? undefined, output };
+  }
+
+  it('exits with 1 when a task fails after code in the Heft process set process.exitCode to 0', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(0, true);
+    expect(output).toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(1);
+  });
+
+  it('exits with 1 when a task fails after code in the Heft process set a negative process.exitCode', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(-1, true);
+    expect(output).toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(1);
+  });
+
+  it('keeps a positive process.exitCode when a task fails', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(3, true);
+    expect(output).toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(3);
+  });
+
+  it('exits with 0 when the task succeeds after code in the Heft process set process.exitCode to 0', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(0, false);
+    expect(output).not.toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(0);
+  });
+
+  it('writes an error that nothing reported before it exits, and exits with 1', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(0, false, aliasClashFixtureFolderPath);
+    expect(output).toContain(
+      'The alias "test" specified in heft.json cannot be used because an action with that name already exists.'
+    );
+    expect(exitCode).toBe(1);
+  });
+});
diff --git a/apps/heft/src/cli/HeftCommandLineParser.ts b/apps/heft/src/cli/HeftCommandLineParser.ts
index 6b7ada39707..7aec0c77f7c 100644
--- a/apps/heft/src/cli/HeftCommandLineParser.ts
+++ b/apps/heft/src/cli/HeftCommandLineParser.ts
@@ -26,7 +26,7 @@ import { PhaseAction } from './actions/PhaseAction';
 import { RunAction } from './actions/RunAction';
 import type { IHeftActionOptions } from './actions/IHeftAction';
 import { AliasAction } from './actions/AliasAction';
-import { getToolParameterNamesFromArgs } from '../utilities/CliUtilities';
+import { getErrorExitCode, getToolParameterNamesFromArgs } from '../utilities/CliUtilities';
 import { Constants } from '../utilities/Constants';
 import { HeftChildReporter } from '../pluginFramework/logging/HeftChildReporter';
 
@@ -271,11 +271,6 @@ export class HeftCommandLineParser extends CommandLineParser {
       this.globalTerminal.writeErrorLine(error.stack!);
     }
 
-    const exitCode: string | number | undefined = process.exitCode;
-    if (!exitCode || typeof exitCode !== 'number' || exitCode > 0) {
-      process.exit(exitCode);
-    } else {
-      process.exit(1);
-    }
+    process.exit(getErrorExitCode(process.exitCode));
   }
 }
diff --git a/apps/heft/src/index.ts b/apps/heft/src/index.ts
index 0c6006dfc8c..7ccd112e96b 100644
--- a/apps/heft/src/index.ts
+++ b/apps/heft/src/index.ts
@@ -63,6 +63,13 @@ export type {
   IReaddirOptions
 } from './utilities/WatchFileSystemAdapter';
 
+export {
+  type IWatchpackPendingEventState as _IWatchpackPendingEventState,
+  type IWatchpackPendingFileEvent as _IWatchpackPendingFileEvent,
+  _tryGetWatchpackPendingEventState,
+  _waitForWatchpackPendingEventsAsync
+} from './utilities/WatchpackUtilities';
+
 export {
   type IHeftRecordMetricsHookOptions,
   type IMetricsData,
diff --git a/apps/heft/src/utilities/CliUtilities.ts b/apps/heft/src/utilities/CliUtilities.ts
index d322dc45e1f..d2a0b1e4fb1 100644
--- a/apps/heft/src/utilities/CliUtilities.ts
+++ b/apps/heft/src/utilities/CliUtilities.ts
@@ -20,3 +20,15 @@ export function getToolParameterNamesFromArgs(argv: string[] = process.argv): Se
   }
   return toolParameters;
 }
+
+/**
+ * Get the exit code for a Heft process that is exiting because of an error. This is `exitCode` if it
+ * is a positive integer, and 1 otherwise, so it is never 0.
+ *
+ * @param exitCode - The current value of `process.exitCode`. Code that ran in the Heft process, such as
+ * a test that Jest ran in band, may have set it to 0.
+ */
+export function getErrorExitCode(exitCode: string | number | undefined): number {
+  const numericExitCode: number = Number(exitCode);
+  return Number.isInteger(numericExitCode) && numericExitCode > 0 ? numericExitCode : 1;
+}
diff --git a/apps/heft/src/utilities/WatchFileSystemAdapter.ts b/apps/heft/src/utilities/WatchFileSystemAdapter.ts
index cc886e24a27..25ef14692ab 100644
--- a/apps/heft/src/utilities/WatchFileSystemAdapter.ts
+++ b/apps/heft/src/utilities/WatchFileSystemAdapter.ts
@@ -6,6 +6,8 @@ import * as path from 'node:path';
 
 import Watchpack from 'watchpack';
 
+import { _tryGetWatchpackPendingEventState } from './WatchpackUtilities';
+
 /**
  * Options for `fs.readdir`
  * @public
@@ -129,6 +131,96 @@ interface ITimeEntry {
   safeTime: number;
 }
 
+/**
+ * What a run read. The run's watcher checks the changes that it reports against this.
+ */
+interface IRunInputs {
+  /**
+   * When the run started. The watcher reports files whose times are close to this time, or later.
+   */
+  baseline: number | undefined;
+  /**
+   * The time of each file that the run read, as the run recorded it
+   */
+  files: ReadonlyMap<string, number>;
+  /**
+   * The folders that the run read
+   */
+  contexts: ReadonlyMap<string, number>;
+  /**
+   * The times that the previous watcher had when the run started
+   */
+  times: ReadonlyMap<string, ITimeEntry> | undefined;
+}
+
+const OUTDATED_ON_ATTACH_EXPLANATION: string = 'watch (outdated on attach)';
+// A new watcher's first scan reports each file whose mtime is later than the watcher's start time, less the file
+// system's accuracy. A watcher that attaches to the watcher of a folder that has already scanned reports the
+// folder in the same way. Watchpack's other explanations are for events from the file system.
+const SCAN_EXPLANATIONS: ReadonlySet<string> = new Set(['scan (file)', OUTDATED_ON_ATTACH_EXPLANATION]);
+
+function tryLstatSync(filePath: string): fs.Stats | undefined {
+  try {
+    return fs.lstatSync(filePath, { throwIfNoEntry: false });
+  } catch {
+    return undefined;
+  }
+}
+
+function getTimestamp(stats: fs.Stats): number {
+  return stats.mtime.getTime() || stats.ctime.getTime() || Date.now();
+}
+
+/**
+ * Watchpack records a file's new time only when its `fs.lstat()` after the file system's event finishes. If a
+ * run starts before then, the previous watcher's time for the file is from before the change. Read the time
+ * again, so that the run sees the change, and so that the run's watcher knows that the run saw it.
+ */
+function refreshPendingTimes(watcher: Watchpack, times: Map<string, ITimeEntry>): void {
+  const pendingEventState: ReturnType<typeof _tryGetWatchpackPendingEventState> =
+    _tryGetWatchpackPendingEventState(watcher);
+  if (!pendingEventState) {
+    return;
+  }
+
+  for (const { filePath } of pendingEventState.pendingFileEvents) {
+    const stats: fs.Stats | undefined = tryLstatSync(filePath);
+    if (!stats) {
+      times.delete(filePath);
+    } else if (!stats.isDirectory()) {
+      const timestamp: number = getTimestamp(stats);
+      times.set(filePath, { timestamp, safeTime: timestamp });
+    }
+  }
+}
+
+/**
+ * Returns false if the watcher reported the path only because the path's time is close to the run's start, and
+ * the run has already read the path as it is now.
+ */
+function isReportedChangeNew(filePath: string, explanation: string, inputs: IRunInputs): boolean {
+  if (!SCAN_EXPLANATIONS.has(explanation) || inputs.baseline === undefined) {
+    return true;
+  }
+
+  const stats: fs.Stats | undefined = tryLstatSync(filePath);
+  if (!stats) {
+    return true;
+  }
+
+  if (stats.isDirectory()) {
+    // The watcher of a folder that the run read reports the folder's files one by one
+    return explanation !== OUTDATED_ON_ATTACH_EXPLANATION || !inputs.contexts.has(filePath);
+  }
+
+  if (stats.ctimeMs >= inputs.baseline) {
+    return true;
+  }
+
+  const readTime: number | undefined = inputs.files.get(filePath) ?? inputs.times?.get(filePath)?.timestamp;
+  return readTime !== getTimestamp(stats);
+}
+
 /**
  * A filesystem adapter for use with the "fast-glob" package. This adapter tracks file system accesses
  * to initialize `watchpack`.
@@ -261,11 +353,21 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
   public setBaseline(): void {
     this.#lastQueryTime = Date.now();
 
-    if (this.#watcher) {
-      const times: Map<string, { timestamp: number; safeTime: number }> = new Map();
-      this.#watcher.pause();
-      this.#watcher.collectTimeInfoEntries(times, times);
+    const watcher: Watchpack | undefined = this.#watcher;
+    if (watcher) {
+      this.#watcher = undefined;
+      const times: Map<string, ITimeEntry> = new Map();
+      watcher.collectTimeInfoEntries(times, times);
+      refreshPendingTimes(watcher, times);
+      // Close the previous watcher instead of only pausing it. A paused watcher keeps its directory watchers,
+      // so every run would leak another set of them. A kept watcher also keeps its OS watch on a folder that
+      // was deleted and recreated, and later watchers on that folder would share the dead watch, so edits in
+      // the recreated folder would be reported one run late.
+      watcher.close();
       this.#times = times;
+    } else {
+      // Nothing is watching, so times collected for an earlier run may be out of date.
+      this.#times = undefined;
     }
   }
 
@@ -277,11 +379,39 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
       return;
     }
 
+    const inputs: IRunInputs = {
+      baseline: this.#lastQueryTime,
+      files: this.#files,
+      contexts: this.#contexts,
+      times: this.#times
+    };
+
     const watcher: Watchpack = new Watchpack({
       aggregateTimeout: 0,
       followSymlinks: false
     });
 
+    // A file that changed just before the run started is reported again when the watcher starts, although the
+    // run has read the change. Call onChange only for a change that the run may not have seen.
+    let hasNewChange: boolean = false;
+    const onReportedChange = (filePath: string, modifiedTime: number, explanation: string): void => {
+      hasNewChange ||= isReportedChangeNew(filePath, explanation, inputs);
+    };
+    const onReportedRemove = (): void => {
+      hasNewChange = true;
+    };
+    const onAggregated = (): void => {
+      if (hasNewChange) {
+        watcher.off('change', onReportedChange);
+        watcher.off('remove', onReportedRemove);
+        watcher.off('aggregated', onAggregated);
+        onChange();
+      }
+    };
+    watcher.on('change', onReportedChange);
+    watcher.on('remove', onReportedRemove);
+    watcher.on('aggregated', onAggregated);
+
     this.#watcher = watcher;
     watcher.watch({
       files: this.#files.keys(),
@@ -290,12 +420,11 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
       startTime: this.#lastQueryTime
     });
 
+    // The watcher checks its reports against `inputs`, so the next run records into new maps
     this.#lastFiles = this.#files;
     this.#files = new Map();
-    this.#contexts.clear();
+    this.#contexts = new Map();
     this.#missing.clear();
-
-    watcher.once('aggregated', onChange);
   }
 
   /**
diff --git a/apps/heft/src/utilities/WatchpackUtilities.ts b/apps/heft/src/utilities/WatchpackUtilities.ts
new file mode 100644
index 00000000000..cdebaeab639
--- /dev/null
+++ b/apps/heft/src/utilities/WatchpackUtilities.ts
@@ -0,0 +1,168 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+/**
+ * The longest time that {@link _waitForWatchpackPendingEventsAsync} waits for watchpack to finish recording
+ * the file system events that it has received.
+ */
+const MAX_PENDING_EVENTS_WAIT_MS: number = 1000;
+const PENDING_EVENTS_POLL_INTERVAL_MS: number = 1;
+
+/**
+ * A file system event that watchpack has received but has not finished recording.
+ *
+ * @internal
+ */
+export interface IWatchpackPendingFileEvent {
+  /**
+   * The full path of the file whose event is still being recorded.
+   */
+  filePath: string;
+}
+
+/**
+ * The state of watchpack's pending file system events.
+ *
+ * @internal
+ */
+export interface IWatchpackPendingEventState {
+  /**
+   * True if any directory watcher is scanning, or if any file system event is still being recorded.
+   */
+  hasPendingEvents: boolean;
+
+  /**
+   * The file system events that watchpack has received but has not finished recording.
+   */
+  pendingFileEvents: ReadonlyArray<IWatchpackPendingFileEvent>;
+}
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that show whether it is still recording a change.
+ * They aren't part of watchpack's public API, so they are all optional.
+ */
+interface IDirectoryWatcherInternals {
+  /**
+   * The watched folder.
+   */
+  path?: string;
+
+  /**
+   * True while the watcher reads the directory. Changes that the scan finds are recorded as it goes.
+   */
+  scanning?: boolean;
+
+  /**
+   * The names of the files that have an OS event whose `fs.lstat()` hasn't finished yet. The change is
+   * recorded only when the `fs.lstat()` finishes.
+   */
+  _activeEvents?: Map<string, boolean>;
+}
+
+/**
+ * A watchpack instance with the internal state that this module inspects.
+ */
+interface IWatchpackWithInternals {
+  watcherManager?: {
+    directoryWatchers?: Map<string, IDirectoryWatcherInternals>;
+  };
+}
+
+/**
+ * Gets the file system events that watchpack has received but has not finished recording.
+ *
+ * @remarks
+ * This helper centralizes the dependency on watchpack's internal `directoryWatchers` map and the `path`,
+ * `scanning` and `_activeEvents` fields of each directory watcher. It returns `undefined` if any of them cannot
+ * be recognized, so callers that must not miss a change can choose a conservative fallback.
+ *
+ * @internal
+ */
+export function _tryGetWatchpackPendingEventState(
+  watcher: object | undefined
+): IWatchpackPendingEventState | undefined {
+  if (!watcher) {
+    return {
+      hasPendingEvents: false,
+      pendingFileEvents: []
+    };
+  }
+
+  const directoryWatchers: Map<string, IDirectoryWatcherInternals> | undefined = (
+    watcher as IWatchpackWithInternals
+  ).watcherManager?.directoryWatchers;
+  if (!(directoryWatchers instanceof Map)) {
+    return undefined;
+  }
+
+  let hasAnyPendingEvents: boolean = false;
+  const pendingFileEvents: IWatchpackPendingFileEvent[] = [];
+  for (const { path: folderPath, scanning, _activeEvents: pendingNames } of directoryWatchers.values()) {
+    if (typeof folderPath !== 'string' || typeof scanning !== 'boolean' || !(pendingNames instanceof Map)) {
+      return undefined;
+    }
+
+    if (scanning || pendingNames.size > 0) {
+      hasAnyPendingEvents = true;
+    }
+
+    for (const name of pendingNames.keys()) {
+      pendingFileEvents.push({
+        filePath: path.join(folderPath, name)
+      });
+    }
+  }
+
+  return {
+    hasPendingEvents: hasAnyPendingEvents,
+    pendingFileEvents
+  };
+}
+
+/**
+ * Waits for watchpack to finish recording the file system events that it has already received.
+ *
+ * @remarks
+ * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a caller can miss a
+ * change if it reads aggregated changes before that `fs.lstat()` finishes. This method waits until the
+ * directory watchers have no events or scans in progress, for up to 1 second. If watchpack's internals have an
+ * unrecognized shape, this method waits for the same maximum instead of assuming that no events are pending.
+ *
+ * @internal
+ */
+export async function _waitForWatchpackPendingEventsAsync(
+  getWatcher: () => object | undefined,
+  hasChanges: () => boolean
+): Promise<void> {
+  // Let the event loop reach its poll phase, which delivers the OS events that were already queued when this
+  // method was called. If this method was called during a poll phase, the first check phase comes before the
+  // next poll phase, so it takes two turns.
+  await setImmediateAsync();
+  await setImmediateAsync();
+
+  const deadline: number = performance.now() + MAX_PENDING_EVENTS_WAIT_MS;
+  while (hasPendingEvents(getWatcher()) && performance.now() < deadline) {
+    await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+  }
+
+  if (hasChanges()) {
+    const recordedTime: number = Date.now();
+    while (Date.now() <= recordedTime) {
+      await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+    }
+  }
+}
+
+function hasPendingEvents(watcher: object | undefined): boolean {
+  if (!watcher) {
+    return false;
+  }
+
+  const pendingEventState: IWatchpackPendingEventState | undefined =
+    _tryGetWatchpackPendingEventState(watcher);
+  return pendingEventState ? pendingEventState.hasPendingEvents : true;
+}
diff --git a/apps/heft/src/utilities/test/CliUtilities.test.ts b/apps/heft/src/utilities/test/CliUtilities.test.ts
new file mode 100644
index 00000000000..ef2fcf633dc
--- /dev/null
+++ b/apps/heft/src/utilities/test/CliUtilities.test.ts
@@ -0,0 +1,26 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getErrorExitCode } from '../CliUtilities';
+
+describe(getErrorExitCode.name, () => {
+  const cases: [string | number | undefined, number][] = [
+    [undefined, 1],
+    [0, 1],
+    ['0', 1],
+    ['', 1],
+    [-1, 1],
+    [1.5, 1],
+    ['abc', 1],
+    [1, 1],
+    [2, 2],
+    ['3', 3]
+  ];
+
+  it.each(cases)(
+    'maps an exit code of %p to %p',
+    (exitCode: string | number | undefined, expected: number) => {
+      expect(getErrorExitCode(exitCode)).toBe(expected);
+    }
+  );
+});
diff --git a/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
new file mode 100644
index 00000000000..19b869c4118
--- /dev/null
+++ b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
@@ -0,0 +1,588 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import Watchpack from 'watchpack';
+
+import { Async } from '@rushstack/node-core-library';
+
+import { watchGlobAsync } from '../../plugins/FileGlobSpecifier';
+import { type IWatchedFileState, type StatCallback, WatchFileSystemAdapter } from '../WatchFileSystemAdapter';
+
+const RUN_REQUEST_TIMEOUT_MS: number = 5000;
+// Long enough for a watcher to finish its first scan, and for events to arrive
+const SETTLE_MS: number = 250;
+const TEST_TIMEOUT_MS: number = 30000;
+// An hour ago, plus some milliseconds so that watchpack sees the file system's timestamps are precise. Files get
+// old mtimes so that a new watcher doesn't report a file as changed just because it was written right before
+// the watcher started.
+const BASE_MTIME_MS: number = Math.floor(Date.now() / 1000) * 1000 - 3600 * 1000 + 123;
+// A new watcher reports a file whose mtime is later than the watcher's start time. A file that gets an mtime in
+// the future is reported by the next run's watcher for certain.
+const FUTURE_MTIME_OFFSET_MS: number = 60 * 1000;
+// Long enough for file timestamps to show which of two events came first, even where they are coarse
+const TIMESTAMP_GAP_MS: number = 20;
+// A file that the glob doesn't match, in a folder that the glob reads
+const NOTES_PATH: string = 'src/sub/notes.txt';
+
+// Watchpack calls fs.lstat() through this graceful-fs instance
+const watcherFs: typeof fs = jest.requireActual(
+  require.resolve('graceful-fs', { paths: [path.dirname(require.resolve('watchpack/package.json'))] })
+);
+// The adapter's calls to fs.lstatSync() look up the function on this module when they are made
+const nodeFs: typeof fs = jest.requireActual('node:fs');
+
+interface IRunOptions {
+  watch?: boolean;
+  // The glob that the run reads. The default reads every folder under src.
+  pattern?: string;
+  beforeWatch?: () => Promise<void> | void;
+}
+
+interface IRun {
+  changed: string[];
+  isRunRequested(): boolean;
+  waitForRunRequestAsync(): Promise<boolean>;
+  /**
+   * Waits until the run's watcher has reported the path with the explanation, and has passed the report on
+   * in an 'aggregated' event. Then waits SETTLE_MS more, so that later events can arrive. Returns false if the
+   * watcher doesn't report the path.
+   */
+  waitForReportAsync(relativePath: string, explanation: string): Promise<boolean>;
+}
+
+describe(WatchFileSystemAdapter.name, () => {
+  let rootFolder: string;
+  let writeCount: number;
+  let adapter: WatchFileSystemAdapter;
+  let watchSpy: jest.SpyInstance;
+  let collectSpy: jest.SpyInstance;
+  let closeSpy: jest.SpyInstance;
+
+  function writeFile(relativePath: string, mtimeMs?: number): void {
+    const filePath: string = path.join(rootFolder, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    writeCount++;
+    fs.writeFileSync(filePath, `export const value: number = ${writeCount};\n`);
+    const mtime: Date = new Date(mtimeMs ?? BASE_MTIME_MS + writeCount * 1000);
+    fs.utimesSync(filePath, mtime, mtime);
+  }
+
+  // Drives the adapter the way TaskOperationRunner does in watch mode
+  async function runAsync(options: IRunOptions = {}): Promise<IRun> {
+    const { watch = true, pattern = 'src/**/*.ts', beforeWatch } = options;
+    adapter.setBaseline();
+    const states: Map<string, IWatchedFileState> = await watchGlobAsync(pattern, {
+      cwd: rootFolder,
+      fs: adapter
+    });
+    const changed: string[] = [];
+    for (const [file, state] of states) {
+      if (state.changed) {
+        changed.push(file);
+      }
+    }
+    changed.sort();
+
+    await beforeWatch?.();
+
+    let requested: boolean = false;
+    let onRequest: (() => void) | undefined;
+    const watcherCount: number = watchSpy.mock.contexts.length;
+    if (watch) {
+      adapter.watch(() => {
+        requested = true;
+        onRequest?.();
+      });
+    }
+
+    // The reports of the run's watcher, as of its last 'aggregated' event
+    const reports: Set<string> = new Set();
+    let onReports: (() => void) | undefined;
+    const watcher: Watchpack | undefined = watchSpy.mock.contexts[watcherCount];
+    if (watcher) {
+      let newReports: string[] = [];
+      watcher.on('change', (filePath: string, modifiedTime: number, explanation: string) => {
+        newReports.push(`${explanation}: ${filePath}`);
+      });
+      watcher.on('remove', (filePath: string, explanation: string) => {
+        newReports.push(`${explanation}: ${filePath}`);
+      });
+      // Runs after the adapter's listener, which the adapter added first
+      watcher.on('aggregated', () => {
+        for (const report of newReports) {
+          reports.add(report);
+        }
+        newReports = [];
+        onReports?.();
+      });
+    }
+
+    return {
+      changed,
+      isRunRequested: () => requested,
+      waitForRunRequestAsync: () =>
+        new Promise<boolean>((resolve: (value: boolean) => void) => {
+          if (requested) {
+            resolve(true);
+            return;
+          }
+          const timeout: NodeJS.Timeout = setTimeout(() => resolve(false), RUN_REQUEST_TIMEOUT_MS);
+          onRequest = () => {
+            clearTimeout(timeout);
+            resolve(true);
+          };
+        }),
+      waitForReportAsync: async (relativePath: string, explanation: string): Promise<boolean> => {
+        const report: string = `${explanation}: ${path.join(rootFolder, relativePath)}`;
+        const isReported: boolean = await new Promise<boolean>((resolve: (value: boolean) => void) => {
+          const timeout: NodeJS.Timeout = setTimeout(() => resolve(false), RUN_REQUEST_TIMEOUT_MS);
+          onReports = () => {
+            if (reports.has(report)) {
+              clearTimeout(timeout);
+              resolve(true);
+            }
+          };
+          onReports();
+        });
+        await Async.sleepAsync(SETTLE_MS);
+        return isReported;
+      }
+    };
+  }
+
+  // The first run's watcher may request a run just because the folders are new, so tests only use it to start
+  async function startAsync(): Promise<void> {
+    writeFile('src/a.ts');
+    writeFile('src/sub/b.ts');
+    const run: IRun = await runAsync();
+    expect(run.changed).toEqual(['src/a.ts', 'src/sub/b.ts']);
+    await Async.sleepAsync(SETTLE_MS);
+  }
+
+  // Also writes the file at NOTES_PATH. Returns the second run, whose watcher has scanned the files without
+  // requesting a run. The next run collects that watcher's times.
+  async function startWatchingAsync(): Promise<IRun> {
+    writeFile(NOTES_PATH);
+    await startAsync();
+    const run2: IRun = await runAsync();
+    expect(run2.changed).toEqual([]);
+    await Async.sleepAsync(SETTLE_MS);
+    expect(run2.isRunRequested()).toBe(false);
+    return run2;
+  }
+
+  // Gives the file a future mtime, and waits until the run's watcher has recorded the change. Returns the mtime.
+  async function changeBeforeNextRunAsync(run: IRun, relativePath: string): Promise<number> {
+    const mtimeMs: number = Date.now() + FUTURE_MTIME_OFFSET_MS;
+    writeFile(relativePath, mtimeMs);
+    expect(await run.waitForRunRequestAsync()).toBe(true);
+    await Async.sleepAsync(SETTLE_MS);
+    return mtimeMs;
+  }
+
+  // From now on, the adapter sees a ctime for the file that is earlier than the run's start. A file that changed
+  // after the run started can have such a ctime where timestamps are coarse, or where the clock that sets them
+  // lags Date.now().
+  function backdateCtime(relativePath: string): void {
+    const backdatedPath: string = path.join(rootFolder, relativePath);
+    const lstatSync: typeof fs.lstatSync = nodeFs.lstatSync;
+    jest.spyOn(nodeFs, 'lstatSync').mockImplementation(((
+      filePath: fs.PathLike,
+      options?: fs.StatSyncOptions
+    ) => {
+      const stats: fs.Stats | undefined = lstatSync(filePath, options) as fs.Stats | undefined;
+      if (stats && filePath === backdatedPath) {
+        stats.ctimeMs = BASE_MTIME_MS;
+      }
+      return stats;
+    }) as unknown as typeof fs.lstatSync);
+  }
+
+  // Replaces watchpack's fs.lstat(). The handler calls lstatAsync() to do the fs.lstat() and give watchpack the
+  // result.
+  function interceptWatcherLstat(handler: (filePath: string, lstatAsync: () => Promise<void>) => void): void {
+    const lstat: (filePath: string, callback: StatCallback) => void = watcherFs.lstat;
+    jest.spyOn(watcherFs, 'lstat').mockImplementation(((filePath: string, callback: StatCallback) => {
+      handler(filePath, async () => {
+        await new Promise<void>((resolve: () => void) => {
+          lstat(filePath, (error, stats) => {
+            callback(error, stats);
+            resolve();
+          });
+        });
+      });
+    }) as unknown as typeof watcherFs.lstat);
+  }
+
+  // Holds watchpack's next fs.lstat() of the file, as a slow file system can. Resolves when watchpack calls it,
+  // with a function that finishes it.
+  function holdNextWatcherLstatAsync(relativePath: string): Promise<(() => void) | undefined> {
+    const heldPath: string = path.join(rootFolder, relativePath);
+    return new Promise((resolve: (finish: (() => void) | undefined) => void) => {
+      const timeout: NodeJS.Timeout = setTimeout(() => resolve(undefined), RUN_REQUEST_TIMEOUT_MS);
+      let isHolding: boolean = false;
+      interceptWatcherLstat((filePath: string, lstatAsync: () => Promise<void>) => {
+        if (filePath === heldPath && !isHolding) {
+          isHolding = true;
+          clearTimeout(timeout);
+          resolve(() => {
+            void lstatAsync();
+          });
+        } else {
+          void lstatAsync();
+        }
+      });
+    });
+  }
+
+  // Holds watchpack's fs.lstat() of the folder until watchpack has finished its fs.lstat() of each of the files
+  function holdWatcherFolderLstat(relativeFolderPath: string, fileNames: string[]): void {
+    const folderPath: string = path.join(rootFolder, relativeFolderPath);
+    const unreadFiles: Set<string> = new Set(fileNames.map((name: string) => path.join(folderPath, name)));
+    let finishFolderLstat: (() => Promise<void>) | undefined;
+    const finishWhenFilesAreRead = (): void => {
+      if (finishFolderLstat && unreadFiles.size === 0) {
+        void finishFolderLstat();
+        finishFolderLstat = undefined;
+      }
+    };
+    interceptWatcherLstat((filePath: string, lstatAsync: () => Promise<void>) => {
+      if (filePath === folderPath) {
+        finishFolderLstat = lstatAsync;
+        finishWhenFilesAreRead();
+      } else {
+        void lstatAsync().then(() => {
+          unreadFiles.delete(filePath);
+          finishWhenFilesAreRead();
+        });
+      }
+    });
+  }
+
+  beforeEach(() => {
+    rootFolder = fs.mkdtempSync(path.join(fs.realpathSync.native(os.tmpdir()), 'heft-watch-fs-'));
+    writeCount = 0;
+    watchSpy = jest.spyOn(Watchpack.prototype, 'watch');
+    collectSpy = jest.spyOn(Watchpack.prototype, 'collectTimeInfoEntries');
+    closeSpy = jest.spyOn(Watchpack.prototype, 'close');
+    adapter = new WatchFileSystemAdapter();
+  });
+
+  afterEach(() => {
+    for (const watcher of watchSpy.mock.contexts) {
+      (watcher as Watchpack).close();
+    }
+    jest.restoreAllMocks();
+    fs.rmSync(rootFolder, { recursive: true, force: true });
+  });
+
+  it(
+    'requests a run when a watched file changes, and reports the file in that run',
+    async () => {
+      await startAsync();
+
+      const run2: IRun = await runAsync();
+      expect(run2.changed).toEqual([]);
+      await Async.sleepAsync(SETTLE_MS);
+      expect(run2.isRunRequested()).toBe(false);
+
+      writeFile('src/sub/b.ts');
+      expect(await run2.waitForRunRequestAsync()).toBe(true);
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests another run for a file that changes while a run is in progress',
+    async () => {
+      await startAsync();
+
+      // The file changes after the glob has read it, and before the run starts watching
+      const run2: IRun = await runAsync({
+        beforeWatch: () => writeFile('src/sub/b.ts', Date.now())
+      });
+      expect(run2.changed).toEqual([]);
+      expect(await run2.waitForRunRequestAsync()).toBe(true);
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'closes the previous watcher, after collecting its times, when the next run starts',
+    async () => {
+      writeFile('src/a.ts');
+      await runAsync();
+      expect(watchSpy).toHaveBeenCalledTimes(1);
+      const watcher1: Watchpack = watchSpy.mock.contexts[0];
+      expect(closeSpy).not.toHaveBeenCalled();
+
+      await runAsync();
+      expect(watchSpy).toHaveBeenCalledTimes(2);
+      const watcher2: Watchpack = watchSpy.mock.contexts[1];
+      expect(watcher2).not.toBe(watcher1);
+      expect(collectSpy).toHaveBeenCalledTimes(1);
+      expect(collectSpy.mock.contexts[0]).toBe(watcher1);
+      expect(closeSpy).toHaveBeenCalledTimes(1);
+      expect(closeSpy.mock.contexts[0]).toBe(watcher1);
+      expect(collectSpy.mock.invocationCallOrder[0]).toBeLessThan(closeSpy.mock.invocationCallOrder[0]);
+
+      await runAsync();
+      expect(closeSpy).toHaveBeenCalledTimes(2);
+      expect(closeSpy.mock.contexts[1]).toBe(watcher2);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'reports a file that changed after a run that did not start watching',
+    async () => {
+      await startAsync();
+
+      // Like a run in which copying files fails, so that TaskOperationRunner never calls watch()
+      const run2: IRun = await runAsync({ watch: false });
+      expect(run2.changed).toEqual([]);
+
+      writeFile('src/sub/b.ts');
+      await Async.sleepAsync(SETTLE_MS);
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  // On Linux, a watch stays on the deleted folder. Windows doesn't let a watched folder be recreated.
+  (process.platform === 'linux' ? it : it.skip)(
+    'reports a change in a folder that was deleted and recreated, in the run after the change',
+    async () => {
+      await startAsync();
+
+      const run2: IRun = await runAsync();
+      expect(run2.changed).toEqual([]);
+      await Async.sleepAsync(SETTLE_MS);
+
+      // Delete and recreate the folder, as switching branches can
+      fs.rmSync(path.join(rootFolder, 'src/sub'), { recursive: true });
+      writeFile('src/sub/b.ts');
+      expect(await run2.waitForRunRequestAsync()).toBe(true);
+      await Async.sleepAsync(SETTLE_MS);
+
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      await Async.sleepAsync(SETTLE_MS);
+      expect(run3.isRunRequested()).toBe(false);
+
+      writeFile('src/sub/b.ts');
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+      const run4: IRun = await runAsync();
+      expect(run4.changed).toEqual(['src/sub/b.ts']);
+      await Async.sleepAsync(SETTLE_MS);
+
+      const run5: IRun = await runAsync();
+      expect(run5.changed).toEqual([]);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request a run for a file that changed before the run, but does for a later change',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      // The new watcher reports the file, because of its mtime. The glob doesn't match it, but the previous
+      // watcher's times show that it hasn't changed since the run started.
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+
+      writeFile('src/sub/b.ts');
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+      const run4: IRun = await runAsync();
+      expect(run4.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request another run for a watched file that changed before the run started',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, 'src/sub/b.ts');
+
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      expect(await run3.waitForReportAsync('src/sub/b.ts', 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request another run for a file that the first run read',
+    async () => {
+      writeFile('src/b.ts', Date.now() + FUTURE_MTIME_OFFSET_MS);
+      await Async.sleepAsync(TIMESTAMP_GAP_MS);
+
+      // There is no previous watcher, so only the time that the run read is known
+      const run1: IRun = await runAsync();
+      expect(run1.changed).toEqual(['src/b.ts']);
+      expect(await run1.waitForReportAsync('src/b.ts', 'scan (file)')).toBe(true);
+      expect(run1.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a file that is written again during the run, with the same mtime',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      const mtimeMs: number = await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      const run3: IRun = await runAsync({
+        // The wait makes the file's ctime later than the run's start
+        beforeWatch: () => Async.sleepAsync(TIMESTAMP_GAP_MS).then(() => writeFile(NOTES_PATH, mtimeMs))
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a watched file whose mtime moves back after the run read it',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      const mtimeMs: number = await changeBeforeNextRunAsync(run2, 'src/sub/b.ts');
+
+      const run3: IRun = await runAsync({
+        beforeWatch: () => {
+          // Earlier than the mtime that the run read, but later than the watcher's start, so that the watcher
+          // reports the file
+          writeFile('src/sub/b.ts', mtimeMs - FUTURE_MTIME_OFFSET_MS / 2);
+          backdateCtime('src/sub/b.ts');
+        }
+      });
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      expect(await run3.waitForReportAsync('src/sub/b.ts', 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request a run for a file whose change the previous watcher had not finished reading',
+    async () => {
+      await startWatchingAsync();
+      const lstatHeld: Promise<(() => void) | undefined> = holdNextWatcherLstatAsync(NOTES_PATH);
+      writeFile(NOTES_PATH, Date.now() + FUTURE_MTIME_OFFSET_MS);
+      const finishLstat: (() => void) | undefined = await lstatHeld;
+      expect(finishLstat).toBeDefined();
+      await Async.sleepAsync(TIMESTAMP_GAP_MS);
+
+      // The run starts while the previous watcher still has the file's old time
+      const run3: IRun = await runAsync();
+      finishLstat?.();
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'reports a watched file whose change the previous watcher had not finished reading, in that run',
+    async () => {
+      await startWatchingAsync();
+      const lstatHeld: Promise<(() => void) | undefined> = holdNextWatcherLstatAsync('src/sub/b.ts');
+      writeFile('src/sub/b.ts', Date.now() + FUTURE_MTIME_OFFSET_MS);
+      const finishLstat: (() => void) | undefined = await lstatHeld;
+      expect(finishLstat).toBeDefined();
+      await Async.sleepAsync(TIMESTAMP_GAP_MS);
+
+      const run3: IRun = await runAsync();
+      finishLstat?.();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      expect(await run3.waitForReportAsync('src/sub/b.ts', 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request a run when a folder that the run read is reported as its watcher is attached',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      // The watcher of src attaches to the watcher of src/sub when its fs.lstat() of src/sub finishes. If
+      // src/sub's watcher has read a file with a new time by then, the watcher reports src/sub.
+      const run3: IRun = await runAsync({
+        beforeWatch: () => holdWatcherFolderLstat('src/sub', ['b.ts', 'notes.txt'])
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync('src/sub', 'watch (outdated on attach)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run when a folder that the run did not read is reported as its watcher is attached',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      // The run reads src and src/sub/b.ts, but not src/sub, so the watcher doesn't report the files in src/sub
+      // one by one. The watcher of src attaches to the watcher that src/sub has for b.ts, and reports src/sub.
+      const run3: IRun = await runAsync({
+        pattern: 'src/*.ts',
+        beforeWatch: () => {
+          adapter.getStateAndTrack(path.join(rootFolder, 'src/sub/b.ts'));
+          holdWatcherFolderLstat('src/sub', ['b.ts', 'notes.txt']);
+        }
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync('src/sub', 'watch (outdated on attach)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a file system event, even if the file looks unchanged',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      const mtimeMs: number = await changeBeforeNextRunAsync(run2, NOTES_PATH);
+      const run3: IRun = await runAsync();
+      expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
+
+      backdateCtime(NOTES_PATH);
+      writeFile(NOTES_PATH, mtimeMs);
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a watched file that is deleted during the run',
+    async () => {
+      await startWatchingAsync();
+
+      const run3: IRun = await runAsync({
+        beforeWatch: () => fs.unlinkSync(path.join(rootFolder, 'src/sub/b.ts'))
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+});
diff --git a/apps/heft/src/utilities/test/WatchpackUtilities.test.ts b/apps/heft/src/utilities/test/WatchpackUtilities.test.ts
new file mode 100644
index 00000000000..37690cc77f4
--- /dev/null
+++ b/apps/heft/src/utilities/test/WatchpackUtilities.test.ts
@@ -0,0 +1,87 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+
+import Watchpack from 'watchpack';
+
+import {
+  type IWatchpackPendingEventState,
+  _tryGetWatchpackPendingEventState,
+  _waitForWatchpackPendingEventsAsync
+} from '../WatchpackUtilities';
+
+const FOLDER_PATH: string = path.resolve('temp/test/WatchpackUtilities/src');
+
+describe('WatchpackUtilities', () => {
+  it('reports active file events and scans from watchpack internals', () => {
+    const pendingEventState: IWatchpackPendingEventState | undefined = _tryGetWatchpackPendingEventState({
+      watcherManager: {
+        directoryWatchers: new Map([
+          [
+            FOLDER_PATH,
+            {
+              path: FOLDER_PATH,
+              scanning: true,
+              _activeEvents: new Map([['index.ts', true]])
+            }
+          ]
+        ])
+      }
+    });
+
+    expect(pendingEventState).toEqual({
+      hasPendingEvents: true,
+      pendingFileEvents: [
+        {
+          filePath: path.join(FOLDER_PATH, 'index.ts')
+        }
+      ]
+    });
+  });
+
+  it.each([
+    { field: 'path', directoryWatcher: { scanning: false, _activeEvents: new Map() } },
+    { field: 'scanning', directoryWatcher: { path: FOLDER_PATH, _activeEvents: new Map() } },
+    { field: '_activeEvents', directoryWatcher: { path: FOLDER_PATH, scanning: false } }
+  ])('does not recognize a directory watcher without $field', ({ directoryWatcher }) => {
+    expect(
+      _tryGetWatchpackPendingEventState({
+        watcherManager: { directoryWatchers: new Map([[FOLDER_PATH, directoryWatcher]]) }
+      })
+    ).toBeUndefined();
+  });
+
+  it('recognizes the directory watchers of a real watchpack watcher', () => {
+    const folderPath: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-watchpack-utilities-'));
+    const watcher: Watchpack = new Watchpack({});
+    try {
+      watcher.watch({ directories: [folderPath], startTime: Date.now() });
+      // watch() creates the folder's directory watcher, so the probe checks that watcher's fields.
+      const { directoryWatchers } = (
+        watcher as unknown as { watcherManager: { directoryWatchers: Map<string, object> } }
+      ).watcherManager;
+      expect(directoryWatchers.size).toBeGreaterThan(0);
+      expect(_tryGetWatchpackPendingEventState(watcher)?.pendingFileEvents).toEqual([]);
+    } finally {
+      watcher.close();
+      fs.rmSync(folderPath, { recursive: true, force: true });
+    }
+  });
+
+  it('waits for the full pending-event window when watchpack internals are not recognized', async () => {
+    const startTime: number = performance.now();
+
+    await _waitForWatchpackPendingEventsAsync(
+      () => ({}),
+      () => false
+    );
+
+    const elapsedMs: number = performance.now() - startTime;
+    expect(elapsedMs).toBeGreaterThanOrEqual(999);
+    expect(elapsedMs).toBeLessThan(3000);
+  });
+});
diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 66d54e7f3b8..712ccb9fdbd 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -3,6 +3,9 @@
 Separate `rush-client` and `rushx-client` binaries, opt-in until cutover. Existing
 `rush`, `rushx`, and their reporter entrypoints are unchanged.
 
+To try the daemon on the rushstack repository itself before a release contains it, follow the
+[contributor dogfooding guide](../../docs/rush/dogfooding-rush-daemon.md).
+
 ## Native frontend dependency
 
 The dependency on `@microsoft/rush` is intentional: it is the version-selecting
@@ -34,11 +37,73 @@ reporter behavior without duplicating or relocating bootstrap code.
 
 Routing precedence:
 
-1. `--no-daemon` before `--`, help, never-daemonize commands, and Rushx with any TTY stdio stay in-process.
+1. `--no-daemon` before `--`, help, never-daemonize commands, an option before the command other than
+   `--quiet`/`-q` (such as `--debug`), and Rushx with any TTY stdio stay in-process. `--quiet` and `-q` only hide
+   native Rush's startup banner, which a daemon request never prints, so `rush -q build` is sent to the daemon
+   without them.
 2. CI stays in-process unless `RUSH_DAEMON=1` explicitly opts in, even if config enables the daemon.
 3. `RUSH_DAEMON` overrides `rush.json`'s `daemon.enabled`; the default is false.
 4. Auto-start is considered only after selecting daemon execution.
 
+A command that routing keeps in-process shows no progress line. It says why in one stderr line before native
+Rush starts, in agent mode (see [Output modes](#output-modes)) and, in legacy mode, when `RUSH_DAEMON=1` asked
+for the daemon. Rushx uses the `rushx-client:` prefix. `--no-daemon` and help print nothing. The lines are:
+
+- `rush-client: RUSH_LOG_LEVEL selects the native reporter; using in-process Rush.` The same line names
+  `RUSH_REPORTER=<value>`, `--reporter`, `--output`, `--log-level` or `useRushReporter in experiments.json`
+  (see below).
+- `rush-client: the daemon does not support "--debug"; using in-process Rush.`
+- `rush-client: the daemon does not run "check"; using in-process Rush.`
+- `rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.`
+- `rush-client: RUSH_DAEMON=0 turns the daemon off; using in-process Rush.`
+- `rush-client: the daemon is not enabled for this repo; using in-process Rush.` To enable it, set `daemon.enabled`
+  to `true` in `rush.json`, or set `RUSH_DAEMON=1` in the environment.
+- `rush-client: CI is set, so the daemon is off unless RUSH_DAEMON=1; using in-process Rush.` The line names
+  the first CI marker that is set: `CI`, `TF_BUILD`, `GITHUB_ACTIONS`, `JENKINS_URL` or `TEAMCITY_VERSION`.
+
+When the selected daemon cannot be reached or started, an ordinary invocation prints the reason and runs
+in-process (`rush-client: <reason>; using in-process Rush.`). A startup failure while a live process can
+still make the daemon ready is the exception: a process that listens at the endpoint but does not
+complete hello/ping in time, a startup helper that still waits for its daemon, or another client that
+holds the start mutex, as in a burst of clients that all find no daemon. In-process Rush would take the
+repository lock, and the requests that the daemon serves would then wait for it, or fail when their wait
+timeout ends (see below). Instead, the client keeps trying for one more startup deadline
+(15 seconds, so about 30 seconds in all) and uses the daemon once it is ready. It says so when it starts
+waiting (`rush-client: The daemon is not ready yet. <live process>, so this command waits up to 15 s more
+for it instead of running Rush in-process.`; agent output shows "rushd is still starting; waiting for it"
+as the progress phase, and on a pipe writes it as a progress line that ends with `because <live process>`). If the daemon is still not ready, the command exits with code 1. The message
+gives the startup error with its `--no-daemon` hint, then the process that is still live, "so Rush was
+not run in-process", and a pointer to `rush-client daemon status`. When the process that the daemon's
+ownership record names still runs but does not answer (on Linux, for example because a signal stopped
+it), the message instead says what that process is doing, then on a line of its own that Rush was not
+run in-process, and its last line says what to do, for example `Resume it with "kill -CONT <pid>"; it
+then serves the next command.` On Linux, when that process has this workspace's ownership record open, as the daemon that
+wrote it does, and stays stopped (state T or t) while the client samples it for 1.5 s, the command does
+not wait for either deadline: it exits with code 1 and that message once the 1.5 s have passed. It names
+a signal to send only to a Rush daemon that has that record open; for any other process it says to end
+that process if it is this workspace's daemon, and else to delete the ownership record, and that until
+then each command that uses the daemon first waits 15 s for a daemon to answer. Such a Rush
+daemon that still runs after its socket file was deleted also fails the command this way, with code 1
+and without running Rush in-process, once the client has waited 15 seconds for it to exit; its last line
+says that it may exit once its running requests finish. When the process that the ownership record names
+has exited but is not reaped yet (on Linux, state Z), nothing live can make the daemon ready, so the
+command runs Rush in-process once its startup deadline (15 s) has passed. The last line of its message
+names the parent that has not reaped that process, and says that until then each command that uses the
+daemon first waits 15 s for a daemon to answer.
+
+When the client runs Rush in-process after it tried the daemon, because it could not reach one or because the
+daemon handed the request back, and another Rush process holds the repository's lock, such as the daemon while it
+builds for another request, Rush waits for the lock instead of failing at once with "Another Rush command is
+already running in this repository." It waits only for what is left of the request's wait timeout (see below),
+counted from when the client sent the request, or from when it gave up on the daemon if it could not reach one;
+the built-in 30-second default applies. It writes one stderr line when it starts to wait (`Waiting up to 28 s for
+the Rush daemon (PID 4242) to release this repository's lock.`). If the lock is still held at the deadline, the
+command fails as before, and the error names the holder (`The Rush daemon (PID 4242) still holds this repository's
+lock.`). With `--no-wait` or a zero timeout, Rush tries once and names the holder. On Windows the lock file does not
+name a process, so Rush says "another Rush process". Rush that routing keeps in-process (such as `--no-daemon`,
+`RUSH_DAEMON=0` or CI), `rushx-client`, and a workspace that selects another Rush release than the one the client
+bundles fail at once, as native Rush does.
+
 `--no-wait` fails immediately when daemon admission is unavailable.
 `--wait-timeout SECONDS` (or `--wait-timeout=SECONDS`) overrides the configured queue
 timeout; finite nonnegative decimal seconds up to 2147483.647 are accepted and
@@ -46,20 +111,62 @@ rounded down to milliseconds. These controls are mutually exclusive and are
 consumed before forwarding, never appended to a project script. Arguments after
 `--` remain literal script arguments.
 
-The queue timeout is measured from when the daemon receives the request. An
-explicit `--no-wait`, `--wait-timeout`, `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, or
-`daemon.queueTimeoutSeconds` in `rush.json` bounds the entire wait: waiting for
-workspace admission and waiting for a running build that the request could not
-join. The built-in 30-second default bounds only workspace admission (for example,
-waiting for a command that needs exclusive access). With the default, a build that
-arrives while a compatible build is already running waits for it to finish and then
-runs, instead of failing after 30 seconds. On a timeout, the client exits with
-code 1 and says how to wait longer.
+Only time that the request spends waiting for other requests counts against the
+queue timeout, whether it comes from `--wait-timeout`,
+`RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, `daemon.queueTimeoutSeconds` in `rush.json`,
+or the built-in 30-second default. Waiting while another request
+loads or reloads the workspace graph does not count, so every build that arrives
+while the first build after startup loads the graph runs once the load finishes.
+That wait fails after 10 times the timeout (5 minutes with the default), so a load
+that never finishes does not hold other requests forever. The request's own work,
+such as checking its inputs, loading the graph, routing and execution, does not
+count either. A configured or per-invocation timeout also
+limits waiting for a running build to start so that the request can join it (with
+`joinRunningBatch`), waiting for a running build that the request could not join, and waiting for
+the requests that the daemon is serving to finish before it restarts for the
+request's environment. The built-in default does not: with it, a build that arrives
+while a compatible build is already running waits for it to finish and then runs,
+instead of failing after 30 seconds, and a request that needs a restart waits for
+the requests that were running when it arrived to finish and then runs on the
+restarted daemon. The default still limits a restart wait while the daemon runs a
+`rushx` script, such as a dev server, which may not exit until it is stopped, and
+while it serves requests that arrived later. A `rushx-client` script that arrives
+while another request waits for the daemon to restart does not start on the old
+daemon, where the restart would wait for it to exit: it waits for the restart and
+then runs on the restarted daemon, and its timeout applies to that wait as it does
+to the restart wait. `--no-wait` fails wherever the request would wait. On a
+timeout, the client exits with code 1 and suggests `--wait-timeout`. It does not
+suggest exporting `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, because Rush versions that do
+not recognize a `RUSH_` environment variable fail every command while it is set.
+In legacy output and in `rushx-client`, the admission failure line
+(`rush-client: daemon admission failed (wait-timeout): …`, or `(no-wait)`; in
+`rushx-client` it begins with `rushx-client:`) gives the daemon's reason, as agent
+mode's summary line does, so it names what the request waited for, such as a daemon
+restart, and why the daemon restarts.
+
+A request also waits while a Rush process that the daemon does not run, such as
+`rush install` or a `--no-daemon` build, holds the repository's lock. Every timeout,
+the built-in default included, limits that wait, since that process can run for any
+length of time. Stderr, on a terminal and on a pipe, names the process at once
+(`rush-client: waiting for another Rush process (PID 12345: rush install) to release
+this repository's lock.`), and again with the time waited every 10 seconds
+(`still waiting after 10s for …`); agent output shows it as the progress phase, and if the
+daemon then restarts, `request resubmitted to the new daemon; preparing the workspace graph`
+until the new daemon reports a queue position or starts the command. Only
+Linux tells the PID and command; elsewhere the line says `another Rush process`. On
+Linux, the name also says when that process is stopped, since it cannot release the
+lock until something resumes it (`another Rush process (PID 12345: rush install; it is
+stopped (state T), for example by SIGSTOP)`).
+`--no-wait` and `--wait-timeout 0` fail at once, and the admission failure line of
+these and of a timeout names the process. A request never waits for a lock that the
+daemon itself holds for another request: it fails at once, as before.
 
 Admission controls also apply to experimental graph requests, but not
-`start|stop|restart|status|logs`. They affect daemon admission only; native fallback
+`start|stop|restart|status|logs`. They affect daemon admission, and how long Rush that runs in-process after
+the client tried the daemon waits for the repository's lock (see above); otherwise native fallback
 retains native command behavior. Waiting positions are shown on interactive stderr,
-and admission failures report their typed reason and a nonzero exit code.
+and a wait for a daemon restart (see below) or for another Rush process on a pipe
+too. Admission failures report their typed reason and a nonzero exit code.
 
 Explicit reporter/output/log-level controls (`--reporter`, `--output`, `--log-level`,
 `RUSH_REPORTER` other than `legacy`, or `RUSH_LOG_LEVEL`) retain the native frontend
@@ -84,14 +191,97 @@ agent mode writes nothing ahead of it. Otherwise, selection precedence is:
 3. Otherwise `legacy`: the unchanged collated operation stream.
 
 Agent mode is plain text for humans and agents, not the AI reporter's JSON record format;
-use `--reporter=ai` for machine-parsed records. It writes a first status line before
-`@microsoft/rush-lib` is loaded, then at most three live rows on a TTY (append-only lines
-throttled to one per 2 seconds on a pipe), the queue position when waiting for admission,
-and always one final summary line (`rush build: SUCCESS 12/12 operations (...) in 3.1s`, or
-`up to date (no operations needed)`). On failure, it lists failed operations and a
-bounded tail (10 lines) of their stderr, or of their stdout when they wrote no stderr.
-Operation logs are otherwise not printed; use `RUSHD_OUTPUT=legacy` for full logs. When
-a request falls back to in-process Rush, agent mode stops and native output follows.
+use `--reporter=ai` for machine-parsed records. On a TTY it paints at most three live rows, the
+first before `@microsoft/rush-lib` is loaded. On a pipe it writes one progress line when the
+daemon has the request (`rush build · 0.1s · sent to rushd; preparing the workspace graph
+(status at least every 25s)`), however many operations run. A longer request also gets status
+lines, so that it does not look hung: one whenever nothing was written for 25 s, with the counts
+and the running operations, and one when connecting to the daemon takes more than 10 s. A
+wait for a daemon that is still starting gets a line of its own
+(`rushd is still starting; waiting for it (up to 15s more) because its startup helper (PID 4242) is
+still waiting for the daemon`). A
+request that waited for admission says so at the end of its summary line
+(`· queued behind another request (position 1 at 0.2s)`), unless it failed: a failure's summary
+line gives the failure, not the wait. It always ends with one summary
+line, for example
+`rush build: SUCCESS 772/772 operations (12 success, 760 from cache) in 3.1s`, or
+`up to date (no operations needed)`, or, when the selection parameters matched no projects,
+`rush build: SUCCESS 0 operations in 0.5s · the selection parameters did not match any projects`.
+The counts follow the native summary: silent operations
+(such as phases a project does not define) are not counted unless they fail, and operations
+that did not need to run (`SKIPPED` or `NO OP` in native output) are counted as `up to date`. The verdict is
+`SUCCESS`, `FAILURE` or `CANCELLED` (Ctrl+C or a termination signal); a request that a daemon
+shutdown aborted is a `FAILURE` whose summary line gives the reason, with exit code 1. When the
+daemon did not admit the request in time, or at once with `--no-wait`, the reason on the summary
+line starts with `daemon admission failed (wait-timeout)` or `daemon admission failed (no-wait)`,
+as in legacy output, followed by the daemon's reason in full. Warnings and errors that Rush or a
+Rush plugin writes outside any operation (for example a plugin that continues without the cloud
+build cache) are written at the end, at most three lines of them, before the summary line and any
+operations reported with it.
+
+A failed operation is reported as soon as it fails, while the rest of the request runs on: a
+`failed: <operation> · full log: <path>` line and a short excerpt of its output, error lines
+with the line that follows them first, then the last lines. Stack frames, `Require stack:` lists
+and progress noise are left out, and so are a message that a tool repeats in its summary, an
+error count that the shown errors account for, and, when the first error shown names a source
+location, the lines before it. Up to three operations are reported. Two kinds are reported just
+before the summary line instead: a failed operation that wrote no output, with the error from the
+daemon's result, and, when no operation failed, the operations whose warnings failed the request
+(`warnings: …`). An operation that succeeded and then got warnings, because its build cache entry
+could not be written, is shown with the output that it wrote after it succeeded. The error of a
+reported operation that wrote output is printed too, unless its excerpt shows it or it only gives
+the exit code (`Returned error code: 1`): for example an error
+thrown while the operation's build cache entry was restored. Only the daemon's result carries it,
+so for an operation reported as it failed it comes just before the summary line, as an
+`error: <operation>` line followed by the error. On a pipe, a status line names a failed
+operation that wrote no output 1 s after it failed, unless the result came first. The summary
+line names up to five failed (or warning) operations. Every operation's full output is in its
+project's `rush-logs/` folder, whether or not it was printed.
+When the daemon ran an operation's incremental command (its `<phase>:incremental` script; see
+`incrementalBuilds` below) and that command failed, the line reads
+`failed: <operation> · incremental command; its next run uses the initial command · full log: <path>`.
+That command can fail where the initial command, which `--no-daemon` runs, would not. Warnings
+that an incremental command reported get `· incremental command` in the same place.
+When a request falls back to in-process Rush, agent mode stops and native output follows.
+
+In agent mode a failed `rush build` doesn't wait for all of its work. Its result comes once an
+operation failed and none of the selected projects that no other selected project depends on (for
+example, the projects named by `--to`) is still waiting or running. The daemon keeps running the
+operations that the failure didn't block, so that the next build finds them done, and the summary
+line counts them and names up to three, in name order
+(`· 2 independent operations continue in rushd: lib-b (build), lib-c (build)`). A later `rush build`
+waits for them. While it waits only for them, its output says so and names up to three of them.
+In agent mode the phase reads
+`queued behind 2 operations left running by an earlier failed command (position 1): lib-b (build), lib-c (build)`,
+a status line on a pipe reads
+`waiting for 2 operations left running by an earlier failed command (queue position 1 at 0.1s): lib-b (build), lib-c (build)`,
+and the summary line ends with
+`· queued behind 2 operations left running by an earlier failed command (position 1 at 0.1s): lib-b (build), lib-c (build)`.
+Legacy output on a terminal prints
+`rush-client: waiting for daemon admission (position 1) behind 2 operations left running by an earlier failed command: lib-b (build), lib-c (build).`
+The daemon reports the position again each time one of them ends, so the phase and the status
+line name only the ones that still run; the summary line keeps the first position that named them.
+`rush rebuild`, `rush install` and `rush update`, a restart of the daemon for another
+environment, and `rush-client daemon stop` stop them instead. So does a command that the daemon
+doesn't run (such as a custom command that it can't serve), before the client runs it in-process;
+the client then prints, indented under its fallback line,
+`rushd stopped 2 operations left running by an earlier failed command (lib-b (build), lib-c (build)), so that this command can run in-process.`
+A served command that makes the daemon reload its graph, such as `rush test` after `rush build`,
+stops them as well, and so does a served phased command that isn't incremental, such as a custom
+`rush retest`. These commands and a served `rush rebuild` name them while the daemon stops them:
+the agent phase reads
+`stopping 2 operations left running by an earlier failed command (position 1): lib-b (build), lib-c (build)`,
+a status line on a pipe reads
+`waiting while rushd stops 2 operations left running by an earlier failed command (queue position 1 at 0.1s): lib-b (build), lib-c (build)`,
+and if the command succeeds or is cancelled, its summary line ends with
+`· stopped 2 operations left running by an earlier failed command (position 1 at 0.1s): lib-b (build), lib-c (build)`.
+Legacy output on a terminal prints
+`rush-client: waiting for daemon admission (position 1) while rushd stops 2 operations left running by an earlier failed command: lib-b (build), lib-c (build).`
+Older clients say that such a command is queued behind them. Older daemons don't name them, so the
+summary line ends with `· queued behind another request (position 1 at 0.1s)`.
+Rushx scripts, and built-in commands that only read the workspace (such as `rush list`), run
+in-process alongside them, like two Rush commands at once in one checkout.
+Older daemons report the failure when all of the work has ended.
 
 Positively identified built-in `install` and `update` follow the same opt-in routing
 precedence as workspace builds and require protocol **0.10**
@@ -104,8 +294,9 @@ Request cwd, environment, argv, width and color are captured before connecting.
 The protocol currently expresses request color as a boolean; subscriptions carry
 the corresponding color level. There is no SIGWINCH forwarding.
 
-The standalone host now binds native `build`/`rebuild` requests to a reusable
-all-project graph. Native Rush parsing, project selection, graph plugins, and
+The standalone host now binds native `build`/`rebuild` requests, and the phased
+commands of command-line.json (such as `test`), to a reusable all-project graph.
+Global commands still run in-process. Native Rush parsing, project selection, graph plugins, and
 incremental/cache semantics are reused rather than spawning another Rush CLI.
 The client renders operation headers, collated text, and activity events; global
 command byte streams remain byte-preserving. A `rushx build` script never claims
@@ -154,17 +345,20 @@ changed configuration or command shape replaces the session and graph in the sam
 process. Environment, installed dependencies, implementation content, or selected
 Rush version changes require a process restart rather than patching the existing
 engine. Direct, inherited, and rig-based project configuration uses private native
-loaders and is rechecked before execution. External plugins, `.env`, phased
+loaders and is rechecked before execution. External plugins that participate in the
+requested command (unassociated plugins, plugins associated with it, or plugin command-line
+files that define it, its phases or parameters for either), `.env`, phased
 watch/install options, and unsupported event-hook scripts still use typed
-pre-execution fallback; this does not exclude the built-in `install` and `update`
+pre-execution fallback; plugins scoped only to other commands are permitted. This does not exclude the built-in `install` and `update`
 commands described above. The native Rush lock is held for preparation and each
 coalesced iteration, not while idle; native commands and `--no-daemon` can run
 after a completed request without stopping the daemon.
 
 Native workspace dispatch copies the request envelope and normalizes only the
-engine-owned `_RUSH_LIB_PATH` to this daemon's real engine. Foreign client SDK
-paths therefore neither select the wrong SDK nor cause a false restart. All other
-environment inputs remain unchanged and participate in normal lifecycle checks.
+engine-owned `_RUSH_LIB_PATH` to this daemon's own engine, keeping the spelling
+that the engine chose when it loaded. Foreign client SDK paths therefore neither
+select the wrong SDK nor cause a false restart. All other environment inputs
+remain unchanged and participate in normal lifecycle checks.
 
 Protocol 0.10 permits a bounded retry only when a pre-execution command result
 explicitly carries `retryAfterRestart: true`. `executeWithDaemonRestartAsync`
@@ -176,6 +370,136 @@ only an unstarted request can receive
 the typed retry authorization. Accepted queued requests drain their typed restart
 results before the old connection closes.
 
+When the daemon's own installation was removed or replaced (for example a deleted
+snapshot folder or a reinstalled Rush release), the daemon lets its running requests
+finish, answers each other request with that typed restart once they have, and then
+exits. The timeout rules of a restart for the request's environment apply (see
+above): the built-in default does not limit waiting for the requests that were running
+when the command arrived, but still limits it while the daemon runs a `rushx` script,
+and `--no-wait` and an explicit `--wait-timeout` limit the whole wait. A command that
+times out exits with code 1, names the changed folder and, if a script runs, suggests
+stopping it. Otherwise the client starts a daemon from its own launcher once the wait
+ends, resubmits the request, and prints one line on stderr (or above the agent
+progress rows): `rush-client: The daemon's installation at <folder> was removed;
+restarted the daemon (PID <pid>).`
+
+While a command waits for a daemon restart, for its installation, the command's
+environment or the workspace's inputs, the agent progress status (or stderr, on a
+terminal and on a pipe) says what it waits for and why the daemon restarts, as soon as
+the daemon reports the wait: `rush-client: waiting for 2 running requests to finish,
+including 1 rushx script; the daemon (PID <pid>) then restarts, because
+common/config/rush/pnpm-lock.yaml changed.` After `because`, the cause is `its
+installation at <folder> was removed` (or `replaced`), `this request's environment
+differs from the daemon's in NODE_OPTIONS` (variable names, never their values),
+`<files> changed` for the workspace's installation, `the code of Rush or a Rush plugin
+changed (<files>)`, or `this request selects Rush <version>`. The count names `rushx`
+scripts, because a script such as a dev server may run until it is stopped. A
+`rushx-client` script that waits for another request's restart prints `rushx-client:
+waiting for the daemon (PID <pid>) to restart for another request (2 requests ahead),
+because <cause>.` The line goes to the stderr that the script writes to, which is a
+pipe, because a `rushx-client` with a terminal runs the script in-process. Its first line
+comes once `rushx-client` itself has started and sent the request, which takes about half a
+second on a busy machine. A native `install` or `update` restarts the daemon once it ends,
+unless it fails before it changes the installation (for example on the Rush lock), and
+that restart would end the `rushx` scripts that the daemon runs. The daemon can't tell
+beforehand whether the command will fail, so it first waits for them and says so the
+same way: `rush-client: waiting for 1 running rushx script to finish, since this command
+restarts the daemon (PID <pid>), which would end it.` A terminal
+gets a line whenever the wait changes, and a pipe when the wait begins or its cause
+changes. Both get the line again with the time waited (`still waiting after 25s for
+…`) whenever 25 seconds pass without one, until the command follows the restart,
+starts, or ends. Once the client asks rushd to cancel the command (Ctrl+C) and says so,
+it writes no more wait lines. In agent mode, the progress phase says it, and on a pipe
+a status line is written at once when the wait begins or its cause changes.
+
+When the daemon restarts for a command's environment, the client prints a line of the
+same kind that names the variables that differed, never their values:
+`rush-client: A command's environment differed from the daemon's in NODE_OPTIONS;
+restarted the daemon (PID <pid>).` It names at most four variables and then says how
+many more differed (`A, B, C, D and 2 more`). A command that was waiting when another
+command's environment restarted the daemon prints that command's variables, because the
+successor starts with that command's environment. A daemon that does not name the
+variables gets no line. A variable name that holds a control character, such as a newline
+or ESC, is printed with that character written as a `\xHH` escape, so the line stays one
+line.
+
+If the daemon that replaces it does not start, after either kind of restart, the command
+fails with exit code 1 and one line that gives the reason for the restart before the
+startup error: `rush-client: A command's environment differed from the daemon's in
+NODE_OPTIONS; the restarted daemon did not start: <startup error>`. A variable that keeps
+the daemon from starting is then among the names in that line.
+
+The client leaves out the `…; restarted the daemon (PID <pid>).` line of either kind when
+the command already wrote a wait line (see above) for the same cause since it last
+restarted, because that line said why the daemon restarts: the same variables, or the same
+change to the same installation. The wait line counts when it was written as a line, on
+stderr or as an agent status line on a pipe. With agent output on a terminal, the wait is
+only in the live rows, so the line is printed above them.
+
+When the connection is lost before a command's result, the command fails with exit code 1
+and is not retried. The diagnostic keeps "Daemon disconnected before delivering a result; the
+command was not retried." and says what happened to rushd. If its process exited (a crash, an
+out-of-memory kill or a signal), it names the PID, points to `rush-client daemon logs` and, if
+the daemon exits again, to `--no-daemon` (`rushx-client --no-daemon` for Rushx), and quotes on a
+second line the fatal error that the launcher log recorded after the command was sent. Before it
+prints that, the client removes the exited daemon's ownership record and socket, as the next daemon
+start would. On Linux, it first stops the operations that the daemon left running, so a rerun, with
+or without `--no-daemon`, does not race them.
+Rush run in-process, with `--no-daemon` or as a fallback, first does the same when the ownership
+record names a daemon that no longer runs, for example when the client that ran the command was
+killed along with the daemon. On Linux that includes a daemon that has exited but is not reaped yet:
+the client waits up to 1 second for it to be reaped, and else runs Rush without the reclaim, which a
+later command does once the daemon's parent reaps it. Each of these reclaims, and the ones that `daemon start`, an automatic
+start and `daemon stop --force` do, prints one line that says what it stopped, for example:
+
+```
+rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).
+```
+
+The line begins "Killed" instead, and ends "they did not exit after SIGTERM", when an operation
+needed SIGKILL. While agent mode shows its progress lines, the line is written among them.
+If rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
+or `daemon restart` still end a command as cancelled (exit code 130).
+
+A command that was still waiting in rushd's queue when rushd exited has not run, if rushd says
+when it starts a command (protocol 0.14) and had not said so. The client then sends it to a new
+daemon once, within its `--wait-timeout`, and before that daemon starts it prints one line on
+stderr (or above the agent progress rows): `rush-client: rushd (PID <pid>) exited while the
+command was queued; sending the command to a new daemon.` In agent mode the phase, and the status
+lines on a pipe, then read `request resubmitted to the new daemon; preparing the workspace graph`
+rather than what the command waited for in the exited daemon's queue, until the new daemon reports
+a queue position or starts the command. If the new daemon does not start,
+the command fails after that line with the startup error. If the connection to the new daemon
+is lost too, the diagnostic begins "Daemon disconnected before delivering a result; the command
+was already sent to a new daemon once." Commands that waited together reach the new daemon in
+the order in which their clients noticed that rushd exited, not in their order in the queue.
+
+While a command runs, the client checks that rushd still responds. Once rushd has sent nothing
+for 10 s, the client pings it. Once it has sent nothing for 30 s, not even the reply, for example
+because its process was stopped, the client says so at once and says what that means:
+`rush-client: rushd (PID <pid>) has not responded for 30s; its process may be stopped or
+overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd
+responds; interrupt it (Ctrl+C) to stop waiting.` When
+rushd sends anything again, a second line says so: `rush-client: rushd (PID <pid>) responded again
+after 70s.` In agent mode, the progress phase says it; on a pipe both lines are written at once,
+and until rushd responds, the status lines say how long it has not responded instead of what runs.
+Time in which the client itself was stopped or busy writing output does not count. An interrupt
+asks rushd to cancel the command, which a stopped rushd cannot confirm, so the client stops waiting
+when its 5 s cancellation wait ends, and writes no more of these lines once it asked. Daemons older
+than protocol 0.13 are not checked.
+
+When the process that reads the client's output exits first, for example `head` in
+`rush-client build | head -5`, the client's next write to that stream fails with EPIPE. The client
+does not report that as a lost connection. It asks rushd to cancel the command, waits for the stop
+as it does after Ctrl+C, and exits with code 141 (128 + SIGPIPE), which a shell reports for a writer
+that SIGPIPE ended. Instead of the cancelling and cancelled lines it prints one line, which names
+the stream: `rush-client: build cancelled, because the process reading its stdout exited (EPIPE).`
+In `rushx-client` it begins with `rushx-client:`.
+Agent output prints the same line on stderr. The client only learns of the exit at its next write,
+which in agent output on a pipe can be the next status line, up to 25 s later. A command whose
+result arrived before a write failed keeps the result's exit code. Rush run in-process and
+`rush-client daemon logs` still report a failed write as an error.
+
 Piped input uses protocol 0.7's negotiated stdin admission and EOF. The client does
 not read input until the command attaches an input destination, and sends bounded
 chunks only as the daemon grants write credits. EOF follows all preceding writes;
@@ -207,9 +531,14 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `enabled` | `RUSH_DAEMON` | false | Client routing |
 | `autoStart` | `RUSH_DAEMON_AUTO_START` | true | Only after opt-in |
 | `idleTimeoutSeconds` | `RUSH_DAEMON_IDLE_TIMEOUT_SECONDS` | 900 | Host idle shutdown after request/output/cleanup drain |
-| `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. The default does not bound waiting behind a running compatible build; an explicit value does |
+| `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. Time behind another request's graph load (up to 10 times the limit) and the request's own work do not count. The default does not limit waiting behind a running compatible build, or, for a daemon restart, behind requests that were already running (while no `rushx` script is running); an explicit value does |
 | `watch` | `RUSH_DAEMON_WATCH` | false | Persistent host observation of requested warm projects; false keeps root/config guards only. Never schedules builds |
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
+| `incrementalBuilds` | `RUSH_DAEMON_INCREMENTAL_BUILDS` | true | Runs an operation's `<phase>:incremental` script instead of its initial script when only files it builds were edited since its last successful run in the daemon and its output folders are unchanged. Additions, deletions, renames, configuration, tool, environment and command-line changes, bundled outputs, cache restores and native Rush commands run the initial script. Incremental results are never written to the build cache |
+| `warmWorkers` | `RUSH_DAEMON_WARM_WORKERS` | false | With `incrementalBuilds`, keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run. Opt in only if that script runs every task and check that the initial script runs, for Heft including lint and API Extractor. When an incremental run is not allowed, the worker is closed and the initial script runs. Workers count toward `warmMemoryBudgetMB` and `warmSetMaxProjects`, so raise both to keep them alive |
+| `joinRunningBatch` | `RUSH_DAEMON_JOIN_RUNNING_BATCH` | false | Experimental. A build request that arrives while the daemon executes an incremental batch with the same request settings adds its operations to the executing iteration and gets its result once they complete, instead of waiting for the iteration to end. When the iteration can't take its work, the request waits as before |
+| `deferCacheWrites` | `RUSH_DAEMON_DEFER_CACHE_WRITES` | false | Lets an operation complete once its output files are cloned, and writes its build cache entry from the clones in the background. Needs a file system that can clone files (such as Btrfs, XFS or APFS); otherwise, and in cobuilds, the entry is written before the operation completes. A failed background write doesn't change the operation's status; the next command reports it in a warning (on stderr in legacy output), which agent output also prints. A restore of the entry's key misses until the entry is written, and `daemon stop` drops the entries that aren't written yet |
+| `backgroundPrepare` | `RUSH_DAEMON_BACKGROUND_PREPARE` | false | Experimental. When a watched workspace input changes so that the next request would reload the workspace graph (`lastReloadTier` 1), for example after an edit of `rush.json` or `common/config/rush/command-line.json`, an idle daemon reloads it and creates the engine for the command line of the last phased command that it served, 2 seconds after the last change. It never runs an operation or restarts the daemon, and it doesn't start while another Rush process holds the repository lock. A request with the same command line waits for it; any other request stops it and runs as before |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
 | `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
 | `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
@@ -254,13 +583,80 @@ It does not replace a peer lacking safe shutdown support. Foreign package instal
 is a client preparation step; host self-restart selects only bundled or already cached
 compatible installations, never installing while the old workspace is being cleaned up.
 
+Every client of a checkout finds its daemon in one per-user runtime folder: on Linux and
+macOS, `/tmp/rushd-<uid>/`, whatever `TMPDIR` or `XDG_RUNTIME_DIR` a shell, job, service or
+sandbox sets. It holds the socket (`<key>.sock`), the ownership record
+(`<key>.pid.json`) and the launcher log. To move it, set `RUSHD_RUNTIME_DIR` to an absolute
+path for every client of that checkout; the folder becomes `$RUSHD_RUNTIME_DIR/rushd-<uid>/`,
+and its file system must support hard links. A relative `RUSHD_RUNTIME_DIR` is ignored. Clients
+that disagree about `RUSHD_RUNTIME_DIR` use different folders, so each folder gets its own daemon
+for the checkout. A client passes the folder to the daemon it starts.
+The socket path must fit in a socket address: at most 108 bytes on Linux and 104 on macOS.
+`RUSHD_RUNTIME_DIR` can therefore be at most 57 bytes on Linux and 53 on macOS, minus the
+number of digits in your uid (50 bytes on Linux for uid 1234567).
+Windows uses the named pipe `\\.\pipe\rushd-<key>` and is unchanged.
+The client refuses a runtime folder that is a symbolic link, is not a directory or belongs to
+another user, and a `RUSHD_RUNTIME_DIR` too long for the socket path: commands run in-process
+with that reason, and `daemon` commands exit 1. Remove the folder or change `RUSHD_RUNTIME_DIR`.
+Auto-start likewise refuses a launcher log that is not a regular file of yours with one link, or
+that it cannot open for writing, such as a symlink, a directory or a FIFO: commands run in-process
+with that reason (for example `Launcher log cannot be opened for writing (ELOOP): <path>`), and
+`daemon start` exits 1. Remove the file.
+A folder that others can open is made owner-only (`0700`).
+Within one runtime folder, `TMPDIR`, `TMP`, `TEMP`, `XDG_RUNTIME_DIR` and `RUSHD_RUNTIME_DIR`
+never select a different daemon; each operation receives the requesting client's values.
+Clients and daemons before protocol 0.12 used `$XDG_RUNTIME_DIR/rushd-<uid>/` or the
+temporary folder instead. A daemon started there stays there, where current clients do not
+look, until it idles out or is stopped with that older client (`rush-client daemon stop`).
+An older client that starts a current engine while `XDG_RUNTIME_DIR` or `TMPDIR` is set does
+not find it and runs in-process, so upgrade `rush-cli-client` with the engine.
+When a daemon before protocol 0.12 serves a current client, for example one listening in
+`/tmp/rushd-<uid>/`, the client leaves `XDG_RUNTIME_DIR`, `TMPDIR`, `TMP` and `TEMP` out of
+its requests on Linux and macOS, because that daemon would restart into the folder they name.
+Its operations see the daemon's own values; stop it (`rush-client daemon stop`) to use yours.
+
 `rush-client daemon status` only connects and checks hello/pong. It never starts
 a process, reclaims files, or treats a PID file as evidence of readiness. Both
 commands print one JSON object with `state: "ready"`, `socketPath`, and the actual
 pong fields (`uptimeMs`, available versions, optional `pid` and
 `residentMemoryBytes`, and an optional `workspace` snapshot). Exit code 0 means protocol
 readiness, not build support. An unreachable/incompatible endpoint, invalid
-arguments, or startup failure returns exit code 1 with a diagnostic.
+arguments, or startup failure returns exit code 1 with a diagnostic. When no daemon runs
+at all, status also exits 1, and its diagnostic says `No daemon is running for <repository>
+(Rush <version>)` and what the next command does: with `enabled` and `autoStart`, the next
+rush-client command that uses the daemon starts one; otherwise rush-client commands run Rush
+in-process. This is the normal state after `daemon stop`, the idle timeout or SIGTERM. Status
+reports it only when the endpoint refuses connections and neither an ownership record, a startup
+reservation nor (outside Windows) a socket file remains; with any of these, the diagnostic
+still says that it could not connect. When the endpoint
+refuses connections and its ownership record (`<key>.pid.json`) names a PID that no longer
+exists, the diagnostic adds that rushd exited without shutting down (an orderly shutdown
+removes the record) and that `daemon logs` may show why. When that PID still exists but the endpoint
+refuses connections or does not complete hello/ping, the diagnostic adds what that process is doing,
+on Linux for example `rushd (PID <pid>) still owns <key>.pid.json: it is stopped (state T), for example
+by SIGSTOP, and it started 5 min ago.`, and on the next line what to do about it.
+A client that lost its connection to that daemon, or that ran Rush in-process, removes the record
+when it reclaims the daemon, and appends a line that names the daemon to the launcher log. Until a
+daemon becomes ready again or `daemon stop --force` resets the workspace, the `No daemon is running`
+diagnostic then adds `The last daemon, rushd (PID <pid>), exited without shutting down; "rush-client
+daemon logs" may show why.`
+A daemon whose installation was removed or replaced still answers, but it restarts on
+the next command: status then prints `state: "installationChanged"` with the pong's
+`installationChange` (`change` and `folder`), a hint on stderr, and exits with code 1.
+
+A startup reservation (`<key>.pid.json.starting`) refuses another daemon launch until
+the daemon it reserved becomes ready. Status reports one that remains as
+`startupReservation` with its `path`, the startup helper's `helperPid` when recorded, and
+`helperState`: `running` (the helper still waits for readiness), `exited` (the helper will not
+release it), or `unknown` (written by an older client). Status never removes it. Next to a
+ready daemon, the next command that uses, stops or restarts that daemon removes it; when status
+cannot connect, its diagnostic explains the reservation. After an `exited` helper, status also
+reports `relaunchAfter`, 15 seconds after that helper was launched. Until then every automatic
+start is refused at once (the command runs in-process), so that a daemon that fails the same way
+each time, for example because of a configuration error, is not launched by every command. The
+first command after it that finds nothing listening at the endpoint takes the reservation over
+and starts the daemon again, and `daemon logs` shows a line saying so. `daemon logs` may also show
+why the daemon did not become ready.
 
 The optional workspace snapshot reports the provider generation/token, graph existence,
 and available warm accounting without initializing a graph. Missing fields are unknown,
@@ -286,9 +682,25 @@ attests a restart request, not completion of successor startup or success of a c
 `rush-client daemon stop` requires protocol >= 0.6 and waits for `shutdownAck`
 followed by EOF. It reports `state: "shutdownAccepted"` with exit code 0; this
 does not assert successful workspace disposal. Stop is idempotent: when nothing
-listens at the endpoint it reports `state: "notRunning"` with exit code 0. An
+listens at the endpoint and no daemon is starting, it reports `state: "notRunning"` with exit code 0.
+When nothing listens but the ownership record names a process that still runs, for example a daemon
+that removed its socket while it shuts down, stop first waits up to 15 seconds for that process to exit,
+and says so on stderr once it has waited a second. If it still runs then, stop exits with code 1 and
+says what that process is doing and what to do about it; a daemon that accepts the connection but does
+not complete hello/ping gets the same diagnostic. On Linux, stop does not wait for a Rush daemon that
+has this workspace's ownership record open and stays stopped (state T or t) while stop samples it for
+1.5 s, because it cannot exit before something resumes it: stop exits with code 1 and that diagnostic
+once the 1.5 s have passed.
+While a daemon is still starting (its startup helper still runs, or another client holds the start
+mutex), stop says so on stderr and waits up to 15 seconds for that daemon to become ready, then stops
+it as below; reporting `notRunning` would leave it running afterwards. If it is still not ready by then,
+stop exits with code 1 and leaves it running; run stop again once `daemon status` reports it ready. An
 unsupported protocol, missing acknowledgement, handshake failure, or timeout
-returns exit code 1. It does not auto-start anything.
+returns exit code 1. It does not auto-start anything. Before shutdown, it removes a startup
+reservation that remains next to that daemon, as restart does, so that the reservation cannot
+refuse the next start once the daemon is gone. It does so only for the live owner in the
+ownership record, under the start mutex (waiting up to 15 seconds for it); a reservation that
+it cannot resolve stays in place and is reported as `startupReservation`.
 
 `rush-client daemon stop --force` stops a running daemon the same way, then waits
 (up to 15 seconds) for it to release its listener and ownership record and removes
@@ -298,14 +710,38 @@ any remaining artifacts, such as an abandoned startup reservation, reporting the
 `state: "reset"` and the `removedPaths` (or `state: "notRunning"` if nothing was
 left behind). It holds the start mutex, proves that no listener is bound, and
 refuses (exit 1) while the recorded owner PID still exists and cannot be shown to
-be a reused PID. It never kills a process. Automatic startup already reclaims
+be a reused PID, saying what that process is doing, that no process was killed, and what to do about it.
+It fails the same way, without killing that process, when that process accepts the connection but does
+not complete hello/ping, for example because a signal stopped it. When the recorded owner PID no longer exists, the daemon exited without shutting
+down and may have left operations running that only its records name, so the reset first stops them
+as the next daemon start would: SIGTERM, then SIGKILL 2 seconds later, to the daemon's own process
+group and to each operation process group that it recorded whose leader still has the recorded start
+time (or has exited, while every live member of the group is in the group's own session and one of
+them still has the `RUSHD_OPERATION_GROUPS` variable that the daemon gives the processes it starts). When a
+process that started after the record was written has the recorded PID now, the daemon exited the same
+way, so the reset stops the operation process groups that it recorded the same way, but never the
+process group whose ID is that PID, which the later process may lead. It prints the
+line shown above for a lost connection and reports what it stopped in `orphansReaped` (`daemonPid`,
+`processGroupIds`, `outcome`). A recorded group that it cannot prove, such as a PID that a later
+process now has, or a group whose leader has exited under a daemon from a release that did not set
+`RUSHD_OPERATION_GROUPS`, is not signalled; its record is removed with the others. When such a group still
+has a live process, the launcher log that `daemon logs` prints gets a line that names the group and the
+daemon and says which check the group failed; nothing about it is printed. The reclaims after a lost
+connection, before Rush runs in-process and before a daemon start do the same. If the operations cannot be
+stopped, it exits with code 1 and removes nothing. While another process reclaims the same files it
+also exits with code 1, except that after a shutdown it re-checks for up to 15 seconds. Otherwise it
+never signals a process. Automatic startup already reclaims
 the common leftovers on its own (see below); this is the documented escape hatch
-that every fail-closed startup message points to.
+that every fail-closed startup message points to. A reset also appends a line to the launcher log
+that clears the report of a daemon that a client reclaimed, so status no longer names it.
 
 `rush-client daemon restart` first verifies that the selected Rush version has a
 launcher and captures the original lock's PID/start timestamp, checking that it
 matches pong's positive PID and the selected endpoint, then performs acknowledged
-shutdown. It waits for original ownership release or a demonstrably dead owner
+shutdown. Before shutdown, it removes a startup reservation that remains next to that
+daemon (under the start mutex), so that the reservation cannot refuse the successor; if
+another client holds the mutex for 15 seconds, restart fails without stopping the daemon.
+It waits for original ownership release or a demonstrably dead owner
 before calling the existing locked starter. A live owner fails closed at
 the startup deadline; no PID is killed and no live ownership record is deleted.
 A newly
@@ -313,11 +749,15 @@ started/reused successor must pass hello/ping before reporting `state: "ready"`.
 When nothing listens at the endpoint, restart starts a daemon exactly like `daemon start`.
 
 Automatic and explicit startup reclaim stale artifacts only when that is provably
-safe: while holding the start mutex with no `.starting` reservation, a socket
+safe: while holding the start mutex with no `.starting` reservation (or after taking over
+one whose helper exited, as described above), a socket
 without an ownership record, or an unreadable/corrupt record, is removed only after
 a connection attempt is refused (so no listener exists). On Linux, a record whose
 PID now belongs to a process that started after the record's `startedAt` (PID reuse)
-is treated as dead; other platforms fail closed and point to `daemon stop --force`.
+is treated as dead; other platforms fail closed and point to `daemon stop --force`. Before such a
+record is removed, the operation process groups that the daemon recorded are stopped as
+`daemon stop --force` stops them, and the line shown above for a lost connection is printed; if they
+cannot be stopped, the command fails and the record stays.
 
 Restart is explicit even when automatic startup or CI execution routing is
 disabled, but conflicts with `--no-daemon`. The two-phase host retains ownership
@@ -334,6 +774,14 @@ parent closes its descriptor after spawning. On POSIX the launcher enforces mode
 `0600` and rejects linked destinations; Windows uses the existing per-user
 transport directory permissions.
 
+Each daemon writes `<time> rushd ready at <socket> (Rush <version>, PID <pid>)` when it
+is ready, and `<time> rushd (PID <pid>) shutting down: <reason>` when it begins to shut
+down. The reason is `received SIGTERM` or `received SIGINT`; `requested by a client`, for
+`daemon stop`, `daemon stop --force` and `daemon restart`; `idle for <seconds> s`;
+`its socket file was deleted or replaced`, after the line that reports the lost socket;
+or a restart, with its cause. A daemon that is killed (SIGKILL, or SIGHUP, which it does
+not handle) writes no such line, and a crash still writes its stack.
+
 Default reading is bounded to the size observed when the log is opened, with chunked,
 backpressured output. Empty snapshots succeed without output; missing/unreadable logs
 or invalid destinations fail with a diagnostic and exit code 1. A launcher log
diff --git a/apps/rush-cli-client/package.json b/apps/rush-cli-client/package.json
index 16258e97efc..db15fec8b33 100644
--- a/apps/rush-cli-client/package.json
+++ b/apps/rush-cli-client/package.json
@@ -36,6 +36,9 @@
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",
+    "@rushstack/rush-amazon-s3-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-azure-storage-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-http-build-cache-plugin": "workspace:*",
     "eslint": "~9.37.0",
     "local-node-rig": "workspace:*"
   }
diff --git a/apps/rush-cli-client/src/AgentNotices.ts b/apps/rush-cli-client/src/AgentNotices.ts
new file mode 100644
index 00000000000..154f44ff470
--- /dev/null
+++ b/apps/rush-cli-client/src/AgentNotices.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads the agent renderer before @microsoft/rush-lib.
+
+/** The most warning and error lines printed before the summary line. */
+const MAX_NOTICE_LINES: number = 3;
+/** A longer line is cut to this many characters. */
+const MAX_NOTICE_LENGTH: number = 300;
+
+function clip(line: string): string {
+  return line.length > MAX_NOTICE_LENGTH ? `${line.slice(0, MAX_NOTICE_LENGTH - 1)}…` : line;
+}
+
+/**
+ * Collects the warnings and errors that Rush or a Rush plugin wrote while the daemon engine loaded or ran, for
+ * example a plugin that continues without the cloud build cache, or a daemon-compatible plugin name that
+ * matches no configured plugin. They arrive as `activityChanged` events with a `severity` and no operation
+ * scope. Agent output shows other activity only in its live row, which a pipe never prints.
+ */
+export class AgentNotices {
+  readonly #lines: Set<string> = new Set();
+
+  /** Records the lines of an activity payload that is a warning or an error outside any operation. */
+  public add(payload: Readonly<Record<string, unknown>>, operationId: string | undefined): void {
+    const { severity, text } = payload;
+    if (operationId !== undefined || typeof text !== 'string') {
+      return;
+    }
+    if (severity !== 'warning' && severity !== 'error') {
+      return;
+    }
+    for (const line of text.split('\n')) {
+      const trimmed: string = line.trim();
+      if (trimmed) {
+        this.#lines.add(trimmed);
+      }
+    }
+  }
+
+  /** The first distinct lines, each cut to a maximum length, followed by the number of lines left out. */
+  public getLines(): string[] {
+    const lines: string[] = [...this.#lines];
+    const shown: string[] = lines.slice(0, MAX_NOTICE_LINES).map(clip);
+    const omitted: number = lines.length - shown.length;
+    if (omitted > 0) {
+      shown.push(`+${omitted} more warning and error lines; RUSHD_OUTPUT=legacy prints them all`);
+    }
+    return shown;
+  }
+}
diff --git a/apps/rush-cli-client/src/AgentOperationTracker.ts b/apps/rush-cli-client/src/AgentOperationTracker.ts
new file mode 100644
index 00000000000..951ac7a44f9
--- /dev/null
+++ b/apps/rush-cli-client/src/AgentOperationTracker.ts
@@ -0,0 +1,279 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it (through AgentProgressRenderer) before
+// @microsoft/rush-lib.
+
+import type { IDaemonOperationStatusChangedPayload } from '@rushstack/rush-daemon-protocol';
+
+import { OperationOutputExcerpt } from './OperationOutputExcerpt';
+
+const FAILURE: string = 'FAILURE';
+const SUCCESS_WITH_WARNINGS: string = 'SUCCESS WITH WARNINGS';
+const EXECUTING: string = 'EXECUTING';
+
+/** The order in which status counts are listed in the summary: problems first. */
+const STATUS_ORDER: ReadonlyArray<string> = [
+  FAILURE,
+  'BLOCKED',
+  'ABORTED',
+  SUCCESS_WITH_WARNINGS,
+  'SUCCESS',
+  'FROM CACHE',
+  'SKIPPED',
+  'NO OP'
+];
+const TERMINAL_STATUSES: ReadonlySet<string> = new Set(STATUS_ORDER);
+
+/** Which of an operation's commands produced its status: its initial command or its incremental command. */
+export type AgentCommandKind = NonNullable<IDaemonOperationStatusChangedPayload['commandKind']>;
+
+export interface IAgentOperationStatusUpdate {
+  readonly operationId: string;
+  readonly status: string;
+  /** The operation's full log file, when the daemon reports one (failures and warnings). */
+  readonly logFilePath?: string;
+  /**
+   * The command that produced the status, when the daemon reports it (failures and warnings of an operation
+   * that has an incremental command).
+   */
+  readonly commandKind?: AgentCommandKind;
+}
+
+/** An operation's final status, as reported in the daemon's result. */
+export interface IAgentOperationResult {
+  readonly operationId: string;
+  readonly status: string;
+  readonly errorMessage?: string;
+}
+
+/** An operation that explains a failed request, with the excerpt and log file to print for it. */
+export interface IAgentProblemOperation {
+  readonly operationId: string;
+  readonly logFilePath: string | undefined;
+  readonly excerpt: OperationOutputExcerpt | undefined;
+  /** The engine's error for the operation, when the daemon's result reported one. */
+  readonly errorMessage: string | undefined;
+  /** The command that failed or reported the warnings, when the daemon said which one it was. */
+  readonly commandKind: AgentCommandKind | undefined;
+}
+
+/**
+ * Tracks one request's operations for agent output: progress counters, running and failed operations,
+ * and short output excerpts for the operations that can explain a failure.
+ *
+ * @remarks
+ * Silent operations (for example phases that a project does not define) are registered but are not part of
+ * the progress totals, matching the native `x of y` operation headers; only a silent failure is counted.
+ * Counters follow status transitions, so an operation that is reset and runs again is counted once.
+ * Output that belongs to no registered operation (a global command's byte stream) is kept as one excerpt.
+ */
+export class AgentOperationTracker {
+  readonly #registered: Set<string> = new Set();
+  readonly #silent: Set<string> = new Set();
+  readonly #statuses: Map<string, string> = new Map();
+  readonly #running: Set<string> = new Set();
+  readonly #counts: Map<string, number> = new Map();
+  readonly #failed: Set<string> = new Set();
+  readonly #warned: Set<string> = new Set();
+  readonly #excerpts: Map<string, OperationOutputExcerpt> = new Map();
+  readonly #logFilePaths: Map<string, string> = new Map();
+  readonly #commandKinds: Map<string, AgentCommandKind> = new Map();
+  readonly #errorMessages: Map<string, string> = new Map();
+  readonly #globalExcerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+  #headerTotal: number = 0;
+  #done: number = 0;
+
+  /** The number of non-silent operations that reached a terminal status. */
+  public get done(): number {
+    return this.#done;
+  }
+
+  /** The number of non-silent operations in the request, once known. */
+  public get total(): number {
+    return Math.max(this.#headerTotal, this.#registered.size);
+  }
+
+  /** Operations currently executing, oldest first. */
+  public get running(): ReadonlyArray<string> {
+    return [...this.#running];
+  }
+
+  /** Failed operations, in the order they failed. */
+  public get failed(): ReadonlyArray<string> {
+    return [...this.#failed];
+  }
+
+  /** Operations that succeeded with warnings, in the order they finished. */
+  public get warned(): ReadonlyArray<string> {
+    return [...this.#warned];
+  }
+
+  /** Whether any output arrived that belongs to no operation (for example a global command's output). */
+  public get hasGlobalOutput(): boolean {
+    return this.#globalExcerpt.lineCount > 0;
+  }
+
+  /** Whether the daemon announced any operation for the request, including silent ones. */
+  public get hasOperations(): boolean {
+    return this.#registered.size > 0 || this.#silent.size > 0;
+  }
+
+  public get globalExcerpt(): OperationOutputExcerpt {
+    return this.#globalExcerpt;
+  }
+
+  /** Status counts in summary order, for example `[['FAILURE', 1], ['BLOCKED', 3]]`. */
+  public getCounts(): ReadonlyArray<[string, number]> {
+    return STATUS_ORDER.filter((status) => (this.#counts.get(status) ?? 0) > 0).map((status) => [
+      status,
+      this.#counts.get(status) ?? 0
+    ]);
+  }
+
+  public register(operationId: string, silent: boolean): void {
+    if (silent && !this.#registered.has(operationId)) {
+      this.#silent.add(operationId);
+    } else if (!silent) {
+      this.#silent.delete(operationId);
+      this.#registered.add(operationId);
+    }
+  }
+
+  /** Records the engine's per-request operation total (from the operation header extension). */
+  public setHeaderTotal(total: number): void {
+    this.#headerTotal = Math.max(this.#headerTotal, total);
+  }
+
+  /** Applies a status change. */
+  public updateStatus(update: IAgentOperationStatusUpdate): void {
+    const { operationId, status } = update;
+    if (this.#silent.has(operationId)) {
+      if (status !== FAILURE) {
+        return;
+      }
+      // Failed operations are reported even if silent, as in the native summary.
+      this.register(operationId, false);
+    }
+    // An operation that was never registered still counts, so `done` never exceeds `total`.
+    this.#registered.add(operationId);
+    const previous: string | undefined = this.#statuses.get(operationId);
+    this.#statuses.set(operationId, status);
+    if (previous !== undefined && TERMINAL_STATUSES.has(previous)) {
+      this.#done--;
+      this.#counts.set(previous, (this.#counts.get(previous) ?? 1) - 1);
+      this.#failed.delete(operationId);
+      this.#warned.delete(operationId);
+    }
+    if (status === EXECUTING) {
+      this.#running.add(operationId);
+    } else {
+      this.#running.delete(operationId);
+    }
+    if (TERMINAL_STATUSES.has(status)) {
+      this.#onTerminalStatus(update);
+    }
+  }
+
+  /**
+   * Applies the daemon's final operation results to operations whose final status this client did not see,
+   * for example an operation still executing when the daemon shut down, which the result reports as aborted.
+   *
+   * @remarks
+   * The results also list silent operations without saying so, so an operation that no event announced is
+   * only added when it failed.
+   */
+  public reconcile(results: ReadonlyArray<IAgentOperationResult>): void {
+    for (const { operationId, status, errorMessage } of results) {
+      const current: string | undefined = this.#statuses.get(operationId);
+      const known: boolean = this.#registered.has(operationId) || this.#silent.has(operationId);
+      if (
+        TERMINAL_STATUSES.has(status) &&
+        (known || status === FAILURE) &&
+        (current === undefined || !TERMINAL_STATUSES.has(current))
+      ) {
+        this.updateStatus({ operationId, status });
+      }
+      if (errorMessage && this.#statuses.get(operationId) === FAILURE) {
+        this.#errorMessages.set(operationId, errorMessage);
+      }
+    }
+  }
+
+  /**
+   * Records output. An operation's output is discarded when it reaches a status without problems, but output
+   * that follows is kept until its output stream closes: Rush writes an operation's build cache entry after its
+   * status, and if that fails, it writes why and then changes the status to SUCCESS WITH WARNINGS.
+   */
+  public appendLog(operationId: string, text: string, stream: 'stdout' | 'stderr'): void {
+    if (this.#silent.has(operationId)) {
+      return;
+    }
+    const status: string | undefined = this.#statuses.get(operationId);
+    if (status === undefined && !this.#registered.has(operationId)) {
+      this.#globalExcerpt.append(text, stream);
+      return;
+    }
+    let excerpt: OperationOutputExcerpt | undefined = this.#excerpts.get(operationId);
+    if (!excerpt) {
+      excerpt = new OperationOutputExcerpt();
+      this.#excerpts.set(operationId, excerpt);
+    }
+    excerpt.append(text, stream);
+  }
+
+  /** Discards an operation's output when its output stream closes, unless its status is a problem. */
+  public closeOutput(operationId: string): void {
+    const status: string | undefined = this.#statuses.get(operationId);
+    if (status !== undefined && TERMINAL_STATUSES.has(status) && !this.#isProblemStatus(status)) {
+      this.#excerpts.delete(operationId);
+    }
+  }
+
+  /**
+   * The operations that explain a failed request: failed operations, or, when none failed, operations that
+   * reported warnings (warnings fail a build unless the command allows them).
+   */
+  public getProblemOperations(): ReadonlyArray<IAgentProblemOperation> {
+    const operationIds: ReadonlyArray<string> = this.#failed.size ? this.failed : this.warned;
+    return operationIds.map((operationId) => this.getProblemOperation(operationId));
+  }
+
+  /** An operation's log file, output excerpt and error, to report it. */
+  public getProblemOperation(operationId: string): IAgentProblemOperation {
+    return {
+      operationId,
+      logFilePath: this.#logFilePaths.get(operationId),
+      excerpt: this.#excerpts.get(operationId),
+      errorMessage: this.#errorMessages.get(operationId),
+      commandKind: this.#commandKinds.get(operationId)
+    };
+  }
+
+  #isProblemStatus(status: string): boolean {
+    return status === FAILURE || status === SUCCESS_WITH_WARNINGS;
+  }
+
+  #onTerminalStatus(update: IAgentOperationStatusUpdate): void {
+    const { operationId, status, logFilePath, commandKind } = update;
+    this.#done++;
+    this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
+    if (!this.#isProblemStatus(status)) {
+      // Output that follows starts a new excerpt; see appendLog.
+      this.#excerpts.delete(operationId);
+      return;
+    }
+    // Record unterminated last lines now, so a kept excerpt holds no partial-line buffer.
+    this.#excerpts.get(operationId)?.flush();
+    (status === FAILURE ? this.#failed : this.#warned).add(operationId);
+    if (logFilePath) {
+      this.#logFilePaths.set(operationId, logFilePath);
+    }
+    // An operation that runs again may run its other command, or report none.
+    if (commandKind) {
+      this.#commandKinds.set(operationId, commandKind);
+    } else {
+      this.#commandKinds.delete(operationId);
+    }
+  }
+}
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 08fa1087964..6e1d2ba649f 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -4,23 +4,119 @@
 // Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib
 // so that the first line can be written within a few milliseconds.
 
-import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonSilence } from '@rushstack/rush-client-core';
+import type {
+  DaemonRequestAdmissionErrorCode,
+  IDaemonContinuingOperations,
+  IDaemonEventEnvelope,
+  RUSHD_OPERATION_STREAM_CLOSED
+} from '@rushstack/rush-daemon-protocol';
+
+import { AgentNotices } from './AgentNotices';
+import {
+  type AgentCommandKind,
+  AgentOperationTracker,
+  type IAgentOperationResult,
+  type IAgentProblemOperation
+} from './AgentOperationTracker';
+import { clipLine } from './OperationOutputExcerpt';
+import { formatContinuingOperationNames, formatContinuingOperations } from './continuingOperations';
+import { DAEMON_SILENCE_ADVICE, formatDaemonResponded, formatDaemonSilence } from './daemonSilence';
 
 const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-const TERMINAL_STATUSES: ReadonlySet<string> = new Set([
-  'SUCCESS',
-  'SUCCESS WITH WARNINGS',
-  'SKIPPED',
-  'FROM CACHE',
-  'FAILURE',
-  'BLOCKED',
-  'NO OP',
-  'ABORTED'
-]);
-const MAX_ERROR_LINES: number = 10;
-const PIPE_MIN_INTERVAL_MS: number = 2000;
-const PIPE_HEARTBEAT_MS: number = 10000;
+/**
+ * On a pipe, the connecting line is written only when the connection takes longer than this. Like a status line,
+ * it is never written in the first 10 s, so a connection that is fast, or a daemon that starts within that time,
+ * costs no line.
+ */
+const PIPE_CONNECTING_LINE_DELAY_MS: number = 10_000;
+/**
+ * On a pipe, a status line is written whenever nothing was written for this long, so that a reader can tell a slow
+ * request from a hung one. Agent shells return partial output after 30 s. A request that ends sooner writes none.
+ */
+const PIPE_STATUS_INTERVAL_MS: number = 25_000;
+/**
+ * On a pipe, a failed operation that wrote no output is reported only with the daemon's result, which carries its
+ * error. Unless that result comes first, the next status line, which names it, is written this long after it failed.
+ */
+const PIPE_UNREPORTED_FAILURE_DELAY_MS: number = 1_000;
+const SENT_PHASE: string = 'sent to rushd; preparing the workspace graph';
+const STARTING_PHASE: string = 'rushd is still starting; waiting for it';
+/** Ends the summary line of a cancelled request when the client stopped waiting before rushd confirmed the stop. */
+const UNCONFIRMED_STOP: string = 'rushd did not confirm that the request stopped; it may still be stopping';
+const FAILURE_STATUS: string = 'FAILURE';
+/** The protocol's name for this extension event, repeated so that loading this module does not load the protocol. */
+const OPERATION_STREAM_CLOSED: typeof RUSHD_OPERATION_STREAM_CLOSED = 'rushd.operation-stream-closed';
 const TTY_INTERVAL_MS: number = 100;
+/** The most failed (or warning) operations whose output excerpt is printed. */
+const MAX_REPORTED_OPERATIONS: number = 3;
+/** Excerpt lines for the first reported operation, which is most often the root cause. */
+const FIRST_OPERATION_EXCERPT_LINES: number = 8;
+const OTHER_OPERATION_EXCERPT_LINES: number = 3;
+const GLOBAL_OUTPUT_EXCERPT_LINES: number = 8;
+/** The most operation names listed in the summary line, and in a live row. */
+const MAX_SUMMARY_NAMES: number = 5;
+const MAX_LIVE_NAMES: number = 3;
+/** The most names of operations that continue in rushd, which the summary line lists after the failed ones. */
+const MAX_CONTINUING_NAMES: number = 3;
+const MAX_MESSAGE_LENGTH: number = 300;
+/**
+ * Lines of a multi-line error message printed after its first line: the first and last lines of the rest, since a
+ * message that ends with the error after the diagnostics written before it can be thousands of lines long.
+ */
+const ERROR_DETAIL_HEAD_LINES: number = 2;
+const ERROR_DETAIL_TAIL_LINES: number = 5;
+const FAILED_LABEL: string = 'failed';
+/**
+ * Follows the name of an operation whose incremental command (`<phase>:incremental`) failed or reported the
+ * warnings. That command can fail where the initial command would not, as in a build with `--no-daemon`. The daemon
+ * forgets the last successful run of an operation that failed, so the operation's next run uses its initial command.
+ */
+const INCREMENTAL_COMMAND_NOTE: string = ' · incremental command';
+const INCREMENTAL_COMMAND_FAILURE_NOTE: string = `${INCREMENTAL_COMMAND_NOTE}; its next run uses the initial command`;
+/**
+ * The error of an operation whose process exited with a nonzero code. It says nothing that the operation's output
+ * does not, so it is printed only for an operation that wrote no output.
+ */
+const EXIT_CODE_ERROR_PATTERN: RegExp = /^Returned error code: \d+$/;
+/** How much of an operation error's first line is looked for in the output shown for it, which clips long lines. */
+const SHOWN_ERROR_KEY_LENGTH: number = 100;
+const WHITESPACE_PATTERN: RegExp = /\s+/g;
+/**
+ * Summary labels that differ from the native status name. A daemon reports an operation that is unchanged since
+ * it last ran as `NO OP` (when no operation in the iteration had to run) or as `SKIPPED`; both mean up to date.
+ */
+const STATUS_LABELS: ReadonlyMap<string, string> = new Map([
+  ['SKIPPED', 'up to date'],
+  ['NO OP', 'up to date']
+]);
+/** The plural of a summary label, where it differs. */
+const PLURAL_LABELS: ReadonlyMap<string, string> = new Map([['failure', 'failures']]);
+
+type Verdict = 'SUCCESS' | 'FAILURE' | 'CANCELLED';
+
+/**
+ * Statuses that a failed result reports for operations that are still unfinished: a daemon that returns a failure
+ * early lets the operations that the failure did not block run on.
+ */
+const UNFINISHED_STATUSES: ReadonlySet<string> = new Set(['WAITING', 'READY', 'QUEUED', 'EXECUTING']);
+
+/** A queue position that the daemon reported, and when. */
+interface IQueuePosition {
+  readonly position: number;
+  readonly elapsed: string;
+  /**
+   * Set if the request waited only for operations that an earlier failed command left running, or, with `stopping`,
+   * only while rushd stopped them.
+   */
+  readonly continuing: IDaemonContinuingOperations | undefined;
+}
+
+/** A daemon that has not responded: its process ID, and since when (on the renderer's clock) it has sent nothing. */
+interface ISilence {
+  readonly pid: number | undefined;
+  readonly sinceMs: number;
+}
 
 export interface IAgentProgressRendererOptions {
   readonly commandName: string;
@@ -31,37 +127,150 @@ export interface IAgentProgressRendererOptions {
   readonly startTimeMs?: number;
 }
 
-interface IAgentFinalResult {
+export interface IAgentFinalResult {
   readonly exitCode: number;
   readonly errorMessage?: string;
+  /** Whether the command was cancelled (for example with Ctrl+C); reported as `CANCELLED`, not `FAILURE`. */
+  readonly cancelled?: boolean;
+  /**
+   * For a cancelled command: the client stopped waiting before rushd confirmed that the request stopped, so it may
+   * still be stopping.
+   */
+  readonly stopUnconfirmed?: boolean;
+  /** The daemon's final operation results, which may report statuses that no event carried. */
+  readonly operationResults?: ReadonlyArray<IAgentOperationResult>;
+  /** Why the daemon did not admit the request, if it did not. */
+  readonly admissionErrorCode?: DaemonRequestAdmissionErrorCode;
+}
+
+/** Says which operations the daemon still runs after it reported the failure, if any, in name order. */
+function formatUnfinishedOperations(results: ReadonlyArray<IAgentOperationResult> | undefined): string {
+  const names: string[] = (results ?? [])
+    .filter(({ status }) => UNFINISHED_STATUSES.has(status))
+    .map(({ operationId }) => operationId)
+    .sort();
+  if (names.length === 0) {
+    return '';
+  }
+  const continues: string = names.length === 1 ? 'operation continues' : 'operations continue';
+  return ` · ${names.length} independent ${continues} in rushd: ${formatNames(names, MAX_CONTINUING_NAMES)}`;
+}
+
+function formatNames(names: ReadonlyArray<string>, maxNames: number): string {
+  const shown: string = names.slice(0, maxNames).join(', ');
+  return names.length > maxNames ? `${shown} +${names.length - maxNames} more` : shown;
+}
+
+function getErrorDetail(lines: ReadonlyArray<string>): string[] {
+  const omitted: number = lines.length - ERROR_DETAIL_HEAD_LINES - ERROR_DETAIL_TAIL_LINES;
+  if (omitted <= 1) {
+    return [...lines];
+  }
+  return [
+    ...lines.slice(0, ERROR_DETAIL_HEAD_LINES),
+    `… ${omitted} more lines …`,
+    ...lines.slice(-ERROR_DETAIL_TAIL_LINES)
+  ];
+}
+
+function getCommandKind(value: unknown): AgentCommandKind | undefined {
+  return value === 'initial' || value === 'incremental' ? value : undefined;
+}
+
+/** What a reported operation's line says about the command that failed or reported the warnings. */
+function getCommandNote(label: string, problem: IAgentProblemOperation): string {
+  if (problem.commandKind !== 'incremental') {
+    return '';
+  }
+  return label === FAILED_LABEL ? INCREMENTAL_COMMAND_FAILURE_NOTE : INCREMENTAL_COMMAND_NOTE;
+}
+
+function getMatchKey(line: string): string {
+  return line.replace(WHITESPACE_PATTERN, ' ').trim().toLowerCase();
+}
+
+/**
+ * The lines that report a failed operation's error from the daemon's result, given the lines already shown for
+ * the operation: its first line, then its further lines as for a request's error. None when the lines shown
+ * include the error's first line, or when the error only gives the exit code of a process that wrote output.
+ */
+function getOperationErrorLines(
+  errorMessage: string | undefined,
+  shownLines: ReadonlyArray<string>
+): string[] {
+  const [firstLine, ...detail] = (errorMessage ?? '')
+    .split('\n')
+    .map((line) => line.trimEnd())
+    .filter((line) => line.trim());
+  if (firstLine === undefined) {
+    return [];
+  }
+  const message: string = firstLine.trim();
+  const key: string = getMatchKey(message).slice(0, SHOWN_ERROR_KEY_LENGTH);
+  if (
+    (shownLines.length && EXIT_CODE_ERROR_PATTERN.test(message)) ||
+    shownLines.some((line) => getMatchKey(line).includes(key))
+  ) {
+    return [];
+  }
+  return [message, ...getErrorDetail(detail)].map((line) => clipLine(line, MAX_MESSAGE_LENGTH));
 }
 
 /**
- * Compact progress for agents on the daemon path: an immediate first line, at most
- * three live rows (TTY) or throttled append-only lines (pipes), and a guaranteed
- * bounded final summary line, even when no operation ran.
+ * Compact progress for agents on the daemon path: at most three live rows (TTY) or one line when the request is
+ * sent (pipes), each failed operation's log file and a short excerpt of its output as soon as it fails, and a
+ * guaranteed one-line summary, even when no operation ran.
+ *
+ * @remarks
+ * On a pipe, a request that takes less than 25 s writes the line that says it was sent, its failures and its
+ * summary line, and nothing else. Status lines keep a longer request from looking hung: whenever nothing was
+ * written for 25 s, a status line with the counts and the running operations follows, and a connection that
+ * takes longer than 10 s gets one. A wait for a daemon that is still starting also gets a line, once, and so
+ * does a cancellation, as soon as the client asks rushd to stop the request. So does a daemon that has not
+ * responded for 30 s, with what to do, and the same daemon when it responds again. Only the first three failed
+ * operations are reported. Whether warnings fail the request is only known at its end, so operations with
+ * warnings are reported before the summary line; so is a failed operation that wrote no output, whose error
+ * only the daemon's result carries. On a pipe, the next status line, which names that operation, is then due
+ * 1 s after it failed, so that a result that the daemon returns early can come first and make it moot. An error
+ * that the output shown for a reported operation leaves out, for example one thrown while its build cache entry
+ * was restored, is written before the summary line too, as `error: <operation>` and the error.
  */
 export class AgentProgressRenderer {
   readonly #options: IAgentProgressRendererOptions;
   readonly #now: () => number;
   readonly #startTimeMs: number;
-  readonly #registered: Set<string> = new Set();
-  readonly #statuses: Map<string, string> = new Map();
-  readonly #running: Set<string> = new Set();
-  readonly #counts: Map<string, number> = new Map();
-  readonly #failed: string[] = [];
-  readonly #stderrTails: Map<string, string[]> = new Map();
-  readonly #stdoutTails: Map<string, string[]> = new Map();
-  #total: number = 0;
-  #done: number = 0;
+  readonly #tracker: AgentOperationTracker = new AgentOperationTracker();
+  readonly #notices: AgentNotices = new AgentNotices();
+  /** The operations whose log file and excerpt were written, in that order, with the output lines shown for each. */
+  readonly #reported: Map<string, ReadonlyArray<string>> = new Map();
   #lastActivity: string = '';
   #phase: string = 'connecting to rushd (auto-starts if needed)';
   #painted: number = 0;
   #frame: number = 0;
-  #lastLineKey: string = '';
-  #lastLineAtMs: number = -Infinity;
+  #startingLineWritten: boolean = false;
+  #sentLineWritten: boolean = false;
+  #started: boolean = false;
   #timer: ReturnType<typeof setInterval> | undefined;
+  #connectingTimer: ReturnType<typeof setTimeout> | undefined;
+  #statusTimer: ReturnType<typeof setTimeout> | undefined;
+  /** The last queue position, until operations start. */
+  #queued: IQueuePosition | undefined;
+  /** The first queue position, for the summary line. */
+  #firstQueued: IQueuePosition | undefined;
+  /**
+   * The first queue position that named operations left running by an earlier failed command, which the summary line
+   * gives instead of the first one, since the request waited behind them, or while rushd stopped them.
+   */
+  #firstContinuingQueued: IQueuePosition | undefined;
   #stopped: boolean = false;
+  /** The client asked rushd to cancel the request; the progress line says so until the end. */
+  #cancelling: boolean = false;
+  /** rushd has not responded, and has sent nothing since; see {@link AgentProgressRenderer.onDaemonUnresponsive}. */
+  #silence: ISilence | undefined;
+  /** On a pipe: an operation that wrote no output failed, and no line has named it yet. */
+  #unnamedFailure: boolean = false;
+  /** The error message that the summary line contains in full, once written. */
+  #reportedErrorMessage: string | undefined;
 
   public constructor(options: IAgentProgressRendererOptions) {
     this.#options = options;
@@ -69,109 +278,229 @@ export class AgentProgressRenderer {
     this.#startTimeMs = options.startTimeMs ?? this.#now();
   }
 
-  /** Writes the first line and starts the spinner / heartbeat. */
+  /**
+   * On a TTY, paints the first line and starts the spinner. On a pipe, starts the status lines, and writes the
+   * connecting line after 10 s unless the request was sent by then. Does nothing if rendering already started or
+   * stopped.
+   */
   public start(): void {
-    this.#render(true);
-    this.#timer = setInterval(
-      () => this.#render(false),
-      this.#options.isTTY ? TTY_INTERVAL_MS : PIPE_MIN_INTERVAL_MS
-    );
+    if (this.#started || this.#stopped) {
+      return;
+    }
+    this.#started = true;
+    if (!this.#options.isTTY) {
+      this.#connectingTimer = setTimeout(
+        () => this.#writePipeLine(this.#rows()[0]),
+        PIPE_CONNECTING_LINE_DELAY_MS
+      );
+      this.#connectingTimer.unref?.();
+      this.#scheduleStatusLine();
+      return;
+    }
+    this.#paint();
+    this.#timer = setInterval(() => this.#paint(), TTY_INTERVAL_MS);
     this.#timer.unref?.();
   }
 
   public setPhase(phase: string): void {
-    if (phase === this.#phase) {
+    if (phase === this.#phase || this.#cancelling) {
       return;
     }
     this.#phase = phase;
-    this.#render(true);
+    if (this.#options.isTTY) {
+      this.#paint();
+    }
+  }
+
+  /**
+   * The daemon is not ready yet, but a live process can still make it ready, so the client waits up to `waitMs`
+   * more for it instead of running Rush in-process. On a pipe, says so once, with `owner`, the sentence that
+   * describes that process, for example "Its startup helper (PID 123) is still waiting for the daemon"; the
+   * connecting line is then not due.
+   */
+  public onAwaitStartup(waitMs: number, owner?: string): void {
+    this.setPhase(STARTING_PHASE);
+    clearTimeout(this.#connectingTimer);
+    this.#connectingTimer = undefined;
+    if (!this.#options.isTTY && !this.#stopped && !this.#startingLineWritten) {
+      this.#startingLineWritten = true;
+      const reason: string = owner ? ` because ${owner.charAt(0).toLowerCase()}${owner.slice(1)}` : '';
+      this.#writePipeLine(`${this.#rows()[0]} (up to ${Math.round(waitMs / 1000)}s more)${reason}`);
+    }
+  }
+
+  /** The daemon has the request. On a pipe, says so once, and that the next line can take a while. */
+  public onRequestSent(): void {
+    this.setPhase(SENT_PHASE);
+    clearTimeout(this.#connectingTimer);
+    this.#connectingTimer = undefined;
+    if (!this.#options.isTTY && !this.#stopped && !this.#sentLineWritten) {
+      this.#sentLineWritten = true;
+      this.#writePipeLine(`${this.#rows()[0]} (status at least every ${PIPE_STATUS_INTERVAL_MS / 1000}s)`);
+    }
+  }
+
+  /**
+   * Writes one line. On a TTY, the live rows are redrawn below it; on a pipe, the next status line is then due 25 s
+   * later.
+   */
+  public note(line: string): void {
+    if (this.#stopped) {
+      return;
+    }
+    if (this.#options.isTTY) {
+      this.#clear();
+      this.#options.write(`${line}\n`);
+      this.#paint();
+    } else {
+      this.#writePipeLine(line);
+    }
+  }
+
+  /**
+   * The request waits for admission, and with `continuing`, only for operations that an earlier failed command left
+   * running, which the daemon names again whenever one of them ends, or, with `continuing.stopping`, only while the
+   * daemon stops them for this request. The status lines and the summary line say so.
+   */
+  public onQueuePosition(position: number, continuing?: IDaemonContinuingOperations): void {
+    this.#queued = { position, elapsed: this.#elapsed(), continuing };
+    this.#firstQueued ??= this.#queued;
+    if (continuing) {
+      this.#firstContinuingQueued ??= this.#queued;
+      this.setPhase(
+        `${continuing.stopping ? 'stopping' : 'queued behind'} ${formatContinuingOperations(continuing)} ` +
+          `(position ${position})${formatContinuingOperationNames(continuing)}`
+      );
+    } else {
+      this.setPhase(`queued behind another request (position ${position})`);
+    }
+  }
+
+  /**
+   * The request waits for a daemon restart, and `wait` says why and for what. The phase and the status lines say
+   * that instead of a queue position. On a pipe, `announce` writes a status line at once, so that the wait and its
+   * cause are known when the wait begins or its cause changes, rather than at the next status line. Once the client
+   * asked rushd to cancel the request, the cancelling phase stays, and nothing is written. Returns whether it wrote
+   * a line.
+   */
+  public onRestartWait(wait: string, announce: boolean): boolean {
+    if (this.#cancelling) {
+      return false;
+    }
+    this.#queued = undefined;
+    this.setPhase(wait);
+    if (!announce || this.#options.isTTY || this.#stopped) {
+      return false;
+    }
+    this.#writePipeLine(this.#getStatusLine());
+    return true;
+  }
+
+  /**
+   * The request was sent to a new daemon, and `phase` says so. The phase and the status lines then no longer give
+   * the previous daemon's queue position, or what the request waited for there, until the new daemon reports a
+   * position. The summary line still gives the first position, since the request did wait there.
+   */
+  public onResubmitted(phase: string): void {
+    this.#queued = undefined;
+    this.setPhase(phase);
+  }
+
+  /**
+   * The client asked rushd to cancel the request, and waits up to `timeoutMs` for rushd to stop it, which can take
+   * seconds while rushd prepares the workspace graph. Says so at once, and on a TTY until the end; on a pipe, in one
+   * line.
+   */
+  public onCancelRequested(timeoutMs: number): void {
+    if (this.#cancelling) {
+      return;
+    }
+    this.setPhase(`cancelling; waiting up to ${Math.round(timeoutMs / 1000)}s for rushd to stop the request`);
+    this.#cancelling = true;
+    this.#silence = undefined;
+    if (!this.#options.isTTY) {
+      this.#writePipeLine(this.#rows()[0]);
+    }
   }
 
-  public onQueuePosition(position: number): void {
-    this.setPhase(`queued behind another request (position ${position})`);
+  /**
+   * rushd has sent nothing for `silence.silentForMs`, not even the reply to a ping. Until it sends something again,
+   * the progress line says so, with what to do, and a pipe's status lines say so instead of what runs, which is no
+   * longer known. On a pipe, that line is written at once. Once the client asked rushd to cancel the request,
+   * nothing changes.
+   */
+  public onDaemonUnresponsive(silence: IDaemonSilence): void {
+    if (this.#cancelling) {
+      return;
+    }
+    this.#silence = { pid: silence.pid, sinceMs: this.#now() - silence.silentForMs };
+    if (this.#options.isTTY) {
+      this.#paint();
+    } else {
+      this.#writePipeLine(this.#rows()[0]);
+    }
+  }
+
+  /**
+   * rushd sent something again after {@link AgentProgressRenderer.onDaemonUnresponsive}. The progress line returns
+   * to the phase; on a pipe, a line says how long rushd was silent.
+   */
+  public onDaemonResponsive(silence: IDaemonSilence): void {
+    if (!this.#silence) {
+      return;
+    }
+    this.#silence = undefined;
+    if (this.#options.isTTY) {
+      this.#paint();
+    } else {
+      this.#writePipeLine(`${this.#getHeader()} · ${formatDaemonResponded(silence)}`);
+    }
   }
 
   public onEvent(event: IDaemonEventEnvelope): void {
+    if (this.#stopped) {
+      return;
+    }
     const payload: Record<string, unknown> = (event.payload ?? {}) as Record<string, unknown>;
     switch (event.type) {
       case 'operationRegistered': {
-        if (!payload.silent && typeof payload.operationId === 'string') {
-          this.#registered.add(payload.operationId);
+        if (typeof payload.operationId === 'string') {
+          this.#tracker.register(payload.operationId, !!payload.silent);
         }
         break;
       }
       case 'operationStatusChanged': {
-        const operationId: unknown = payload.operationId;
-        const status: unknown = payload.status;
-        if (typeof operationId !== 'string' || typeof status !== 'string') {
-          break;
-        }
-        this.#phase = 'running';
-        const previous: string | undefined = this.#statuses.get(operationId);
-        this.#statuses.set(operationId, status);
-        if (status === 'EXECUTING') {
-          this.#running.add(operationId);
-        }
-        if (TERMINAL_STATUSES.has(status) && (previous === undefined || !TERMINAL_STATUSES.has(previous))) {
-          this.#running.delete(operationId);
-          this.#done++;
-          this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
-          if (status === 'FAILURE') {
-            this.#failed.push(operationId);
-          } else {
-            this.#stdoutTails.delete(operationId);
-            this.#stderrTails.delete(operationId);
-          }
-        }
+        this.#onStatusChanged(payload);
         break;
       }
       case 'extension': {
-        const data: { totalOperations?: unknown } | undefined = payload.data as
-          | { totalOperations?: unknown }
+        const data: { totalOperations?: unknown; operationId?: unknown } | undefined = payload.data as
+          | { totalOperations?: unknown; operationId?: unknown }
           | undefined;
         if (data && typeof data.totalOperations === 'number') {
-          this.#total = Math.max(this.#total, data.totalOperations);
+          this.#tracker.setHeaderTotal(data.totalOperations);
+        } else if (payload.name === OPERATION_STREAM_CLOSED && typeof data?.operationId === 'string') {
+          this.#tracker.closeOutput(data.operationId);
         }
         break;
       }
       case 'activityChanged': {
+        this.#notices.add(payload, event.scope?.operationId);
         if (typeof payload.text === 'string' && payload.text.trim()) {
           this.#lastActivity = payload.text.trim().split('\n')[0];
-          if (this.#phase !== 'running') {
-            this.#phase = 'running';
-          }
+          this.#onRunning();
         }
         break;
       }
     }
-    this.#render(false);
   }
 
   /**
-   * Keeps bounded per-operation stderr and stdout tails (the last lines of each). They are only
-   * printed for failed operations; stdout is used when an operation reported its diagnostics
-   * there (tsc, eslint, jest) and wrote nothing to stderr.
+   * Keeps short excerpts of operation output. They are only printed for operations that explain a failed
+   * request (failed operations, or operations with warnings when warnings failed the request).
    */
   public onLog(bytes: Uint8Array, operationId: string, stream: 'stdout' | 'stderr'): void {
-    const status: string | undefined = this.#statuses.get(operationId);
-    if (status !== undefined && TERMINAL_STATUSES.has(status) && status !== 'FAILURE') {
-      return;
-    }
-    const tails: Map<string, string[]> = stream === 'stderr' ? this.#stderrTails : this.#stdoutTails;
-    for (const line of Buffer.from(bytes).toString('utf8').split('\n')) {
-      if (!line.trim()) {
-        continue;
-      }
-      let tail: string[] | undefined = tails.get(operationId);
-      if (!tail) {
-        tail = [];
-        tails.set(operationId, tail);
-      }
-      tail.push(line.trim());
-      if (tail.length > MAX_ERROR_LINES) {
-        tail.shift();
-      }
-    }
+    this.#tracker.appendLog(operationId, Buffer.from(bytes).toString('utf8'), stream);
   }
 
   /** Stops rendering without a summary (e.g. the request is handed to in-process Rush). */
@@ -179,52 +508,230 @@ export class AgentProgressRenderer {
     this.#stop();
   }
 
-  /** Stops the live region and writes the final summary line, at most once. */
-  public finish(result: IAgentFinalResult | undefined): void {
+  /**
+   * Stops the live region and writes the failure report (on failure) and the final summary line, at most once.
+   * Warnings and errors that Rush or a plugin wrote outside any operation precede them. The summary line carries
+   * the first line of the error message; the further lines of a multi-line message precede it, at most eight,
+   * with the middle ones elided. Returns true when the error message was reported, now or by an earlier call, so
+   * callers need not repeat it: only a single line too long for the summary line is not, unless it gives the
+   * reason for an admission failure, which is never clipped.
+   */
+  public finish(result: IAgentFinalResult | undefined): boolean {
+    const errorMessage: string | undefined = result?.errorMessage?.trim();
     if (!this.#stop()) {
+      return errorMessage !== undefined && errorMessage === this.#reportedErrorMessage;
+    }
+    for (const notice of this.#notices.getLines()) {
+      this.#options.write(`${notice}\n`);
+    }
+    if (result?.operationResults) {
+      this.#tracker.reconcile(result.operationResults);
+    }
+    const verdict: Verdict = result?.cancelled
+      ? 'CANCELLED'
+      : result !== undefined && result.exitCode === 0
+        ? 'SUCCESS'
+        : 'FAILURE';
+    const lines: string[] = verdict === 'SUCCESS' ? [] : this.#getFailureReport(verdict);
+    // A phased result without operations, for which the daemon announced none, had an empty selection.
+    const emptySelection: boolean =
+      verdict === 'SUCCESS' && result?.operationResults?.length === 0 && !this.#tracker.hasOperations;
+    let summary: string = this.#getSummaryLine(verdict, emptySelection);
+    if (verdict === 'FAILURE') {
+      summary += formatUnfinishedOperations(result?.operationResults);
+    } else if (verdict === 'CANCELLED' && result?.stopUnconfirmed) {
+      summary += ` · ${UNCONFIRMED_STOP}`;
+    }
+    // Why a success or a cancellation took long. A failure has its own reason, which an old queue position is not,
+    // and an admission failure says that the request waited, and why it stopped waiting.
+    const queued: IQueuePosition | undefined = this.#firstContinuingQueued ?? this.#firstQueued;
+    if (queued && verdict !== 'FAILURE' && !result?.admissionErrorCode) {
+      const { position, elapsed, continuing } = queued;
+      summary += continuing
+        ? ` · ${continuing.stopping ? 'stopped' : 'queued behind'} ${formatContinuingOperations(continuing)} ` +
+          `(position ${position} at ${elapsed})${formatContinuingOperationNames(continuing)}`
+        : ` · queued behind another request (position ${position} at ${elapsed})`;
+    }
+    if (errorMessage) {
+      const [firstLine, ...detail] = errorMessage.split('\n').filter((line) => line.trim());
+      const admissionErrorCode: string | undefined =
+        verdict === 'FAILURE' &&
+        (result?.admissionErrorCode === 'no-wait' || result?.admissionErrorCode === 'wait-timeout')
+          ? result.admissionErrorCode
+          : undefined;
+      // Keep the string that legacy output prints for a busy workspace, which guidance tells agents to look for.
+      const prefix: string = admissionErrorCode ? `daemon admission failed (${admissionErrorCode}): ` : '';
+      // The daemon's reason for an admission failure says what the request waited for and what to do instead, and
+      // the caller has no better text for it, so it is never clipped.
+      const summaryMessage: string = admissionErrorCode ? firstLine : clipLine(firstLine, MAX_MESSAGE_LENGTH);
+      summary += ` · ${prefix}${summaryMessage}`;
+      if (detail.length) {
+        lines.push(...getErrorDetail(detail).map((line) => `  ${clipLine(line, MAX_MESSAGE_LENGTH)}`));
+      }
+      if (detail.length || summaryMessage === firstLine) {
+        this.#reportedErrorMessage = errorMessage;
+      }
+    }
+    lines.push(summary);
+    this.#options.write(lines.map((line) => `${line}\n`).join(''));
+    return this.#reportedErrorMessage !== undefined;
+  }
+
+  #onStatusChanged(payload: Record<string, unknown>): void {
+    const { operationId, status, logFilePath, commandKind } = payload;
+    if (typeof operationId !== 'string' || typeof status !== 'string') {
+      return;
+    }
+    this.#tracker.updateStatus({
+      operationId,
+      status,
+      logFilePath: typeof logFilePath === 'string' ? logFilePath : undefined,
+      commandKind: getCommandKind(commandKind)
+    });
+    this.#onRunning();
+    if (status === FAILURE_STATUS) {
+      this.#reportFailure(operationId);
+    }
+  }
+
+  /** The request runs, so it no longer waits in a queue. The phase says so, unless the request is being cancelled. */
+  #onRunning(): void {
+    if (!this.#cancelling) {
+      this.#phase = 'running';
+    }
+    this.#queued = undefined;
+  }
+
+  /**
+   * Writes a failed operation's log file and output excerpt as soon as it fails, while the rest of the request
+   * runs on. The operation's output all arrived before its status. An operation that wrote nothing is left to
+   * the failure report, which has the error from the daemon's result; on a pipe, the next status line names it
+   * sooner. The error of an operation reported here follows with the failure report, if the excerpt lacks it.
+   */
+  #reportFailure(operationId: string): void {
+    if (this.#stopped || this.#reported.has(operationId) || this.#reported.size >= MAX_REPORTED_OPERATIONS) {
       return;
     }
-    const succeeded: boolean = result !== undefined && result.exitCode === 0;
-    const total: number = this.#getTotal();
-    const parts: string[] = [...this.#counts].map(([status, count]) => `${count} ${status.toLowerCase()}`);
-    const scope: string =
-      total === 0 && succeeded
-        ? 'up to date (no operations needed)'
-        : `${this.#done}/${total} operations${parts.length ? ` (${parts.join(', ')})` : ''}`;
-    let line: string = `rush ${this.#options.commandName}: ${succeeded ? 'SUCCESS' : 'FAILURE'} ${scope} in ${this.#elapsed()}`;
-    if (this.#failed.length) {
-      line += ` · failed: ${this.#failed.join(', ')}`;
-    }
-    if (result?.errorMessage) {
-      line += ` · ${result.errorMessage}`;
-    }
-    this.#options.write(`${line}\n`);
-    if (!succeeded) {
-      for (const errorLine of this.#getFailureLines().slice(0, MAX_ERROR_LINES)) {
-        this.#options.write(`  ${errorLine}\n`);
+    const problem: IAgentProblemOperation = this.#tracker.getProblemOperation(operationId);
+    if (!problem.excerpt?.lineCount) {
+      if (this.#statusTimer && !this.#unnamedFailure) {
+        this.#unnamedFailure = true;
+        this.#scheduleStatusLine();
       }
+      return;
+    }
+    const lines: string[] = this.#getProblemLines(FAILED_LABEL, problem);
+    const text: string = lines.map((line) => `${line}\n`).join('');
+    if (this.#options.isTTY) {
+      this.#clear();
+      this.#options.write(text);
+      this.#paint();
+    } else {
+      this.#writePipeText(text);
     }
   }
 
-  /** Failed operations' tails, or every operation's stderr tail when no operation failed. */
-  #getFailureLines(): string[] {
-    const operationIds: Iterable<string> = this.#failed.length ? this.#failed : this.#stderrTails.keys();
+  #getSummaryLine(verdict: Verdict, emptySelection: boolean): string {
+    const tracker: AgentOperationTracker = this.#tracker;
+    const { total, done } = tracker;
+    const countsByLabel: Map<string, number> = new Map();
+    for (const [status, count] of tracker.getCounts()) {
+      const label: string = STATUS_LABELS.get(status) ?? status.toLowerCase();
+      countsByLabel.set(label, (countsByLabel.get(label) ?? 0) + count);
+    }
+    const counts: string[] = [...countsByLabel].map(
+      ([label, count]) => `${count} ${(count !== 1 && PLURAL_LABELS.get(label)) || label}`
+    );
+    const matchedNothing: boolean = total === 0 && done === 0 && emptySelection && !tracker.hasGlobalOutput;
+    let scope: string = '';
+    if (total > 0 || done > 0) {
+      scope = ` ${done}/${total} operations${counts.length ? ` (${counts.join(', ')})` : ''}`;
+    } else if (matchedNothing) {
+      scope = ' 0 operations';
+    } else if (verdict === 'SUCCESS' && !tracker.hasGlobalOutput) {
+      scope = ' up to date (no operations needed)';
+    }
+    let line: string = `rush ${this.#options.commandName}: ${verdict}${scope} in ${this.#elapsed()}`;
+    if (tracker.failed.length) {
+      line += ` · failed: ${formatNames(tracker.failed, MAX_SUMMARY_NAMES)}`;
+    } else if (verdict === 'FAILURE' && tracker.warned.length) {
+      line += ` · warnings: ${formatNames(tracker.warned, MAX_SUMMARY_NAMES)}`;
+    } else if (matchedNothing) {
+      // Worded like native Rush's "The command line selection parameters did not match any projects."
+      line += ' · the selection parameters did not match any projects';
+    }
+    return line;
+  }
+
+  /**
+   * The log file and output excerpt of each failed operation not yet reported. Without failed operations:
+   * operations with warnings (they fail a build unless the command allows warnings), or else output that belongs
+   * to no operation. A cancelled command reports only failed operations. At most three operations are reported
+   * in all, with the operations reported as they failed. The daemon's result carries the error of each failed
+   * operation, so an operation reported as it failed gets its error here, unless the output shown for it had it.
+   */
+  #getFailureReport(verdict: Verdict): string[] {
+    const tracker: AgentOperationTracker = this.#tracker;
+    if (verdict === 'CANCELLED' && !tracker.failed.length) {
+      return [];
+    }
+    const problems: ReadonlyArray<IAgentProblemOperation> = tracker.getProblemOperations();
+    if (!problems.length) {
+      return tracker.globalExcerpt.getExcerpt(GLOBAL_OUTPUT_EXCERPT_LINES).map((line) => `  ${line}`);
+    }
+    const label: string = tracker.failed.length ? FAILED_LABEL : 'warnings';
     const lines: string[] = [];
-    for (const operationId of operationIds) {
-      const tail: string[] = this.#stderrTails.get(operationId) ?? this.#stdoutTails.get(operationId) ?? [];
-      for (const line of tail) {
-        lines.push(`${operationId}: ${line}`);
+    let hidden: number = 0;
+    for (const problem of problems) {
+      const shownLines: ReadonlyArray<string> | undefined = this.#reported.get(problem.operationId);
+      if (shownLines) {
+        const errorLines: string[] = getOperationErrorLines(problem.errorMessage, shownLines);
+        if (errorLines.length) {
+          lines.push(`error: ${problem.operationId}`, ...errorLines.map((line) => `  ${line}`));
+        }
+        continue;
+      }
+      if (this.#reported.size < MAX_REPORTED_OPERATIONS) {
+        lines.push(...this.#getProblemLines(label, problem));
+      } else {
+        hidden++;
       }
     }
+    if (hidden > 0) {
+      const what: string = label === FAILED_LABEL ? 'failed operations' : 'operations with warnings';
+      lines.push(`+${hidden} more ${what}; their logs are in each project's rush-logs folder`);
+    }
     return lines;
   }
 
+  /**
+   * An operation's report: its log file, then its output excerpt, which is longer for the first reported
+   * operation (most often the root cause), then its error from the daemon's result, if known and not shown
+   * already. Records that the operation was reported, and the lines shown for it.
+   */
+  #getProblemLines(label: string, problem: IAgentProblemOperation): string[] {
+    const maxLines: number = this.#reported.size
+      ? OTHER_OPERATION_EXCERPT_LINES
+      : FIRST_OPERATION_EXCERPT_LINES;
+    const excerpt: string[] = problem.excerpt?.getExcerpt(maxLines) ?? [];
+    const shownLines: string[] = [...excerpt, ...getOperationErrorLines(problem.errorMessage, excerpt)];
+    this.#reported.set(problem.operationId, shownLines);
+    const logFile: string = problem.logFilePath ? ` · full log: ${problem.logFilePath}` : '';
+    return [
+      `${label}: ${problem.operationId}${getCommandNote(label, problem)}${logFile}`,
+      ...(shownLines.length ? shownLines : ['(no output)']).map((line) => `  ${line}`)
+    ];
+  }
+
   /** Returns false if rendering had already stopped; after stopping, nothing more is written. */
   #stop(): boolean {
     if (this.#stopped) {
       return false;
     }
     this.#stopped = true;
+    for (const timer of [this.#connectingTimer, this.#statusTimer]) {
+      clearTimeout(timer);
+    }
     if (this.#timer) {
       clearInterval(this.#timer);
       this.#timer = undefined;
@@ -233,50 +740,98 @@ export class AgentProgressRenderer {
     return true;
   }
 
-  #getTotal(): number {
-    return Math.max(this.#total, this.#registered.size, this.#done);
-  }
-
   #elapsed(): string {
     return `${((this.#now() - this.#startTimeMs) / 1000).toFixed(1)}s`;
   }
 
+  /** The start of every progress line: `rush <command> <done>/<total> · <elapsed>`. */
+  #getHeader(): string {
+    const { total, done } = this.#tracker;
+    const counter: string = total ? ` ${done}/${total}` : '';
+    return `rush ${this.#options.commandName}${counter} · ${this.#elapsed()}`;
+  }
+
+  /** How long rushd has not responded, unless it has responded since, or the request is being cancelled. */
+  #getSilence(): string | undefined {
+    if (!this.#silence || this.#cancelling) {
+      return undefined;
+    }
+    return formatDaemonSilence(this.#silence.pid, this.#now() - this.#silence.sinceMs);
+  }
+
   #rows(): [string, string, string] {
-    const total: number = this.#getTotal();
-    const running: string[] = [...this.#running];
-    const shown: string =
-      running.slice(0, 3).join(', ') + (running.length > 3 ? ` +${running.length - 3} more` : '');
-    const counter: string = total ? ` ${this.#done}/${total}` : '';
+    const { running, failed } = this.#tracker;
+    const silence: string | undefined = this.#getSilence();
     return [
-      `rush ${this.#options.commandName}${counter} · ${this.#elapsed()} · ${this.#phase}`,
-      running.length ? `running: ${shown}` : '',
-      this.#lastActivity
+      `${this.#getHeader()} · ${silence === undefined ? this.#phase : `${silence}; ${DAEMON_SILENCE_ADVICE}`}`,
+      running.length ? `running: ${formatNames(running, MAX_LIVE_NAMES)}` : '',
+      failed.length ? `failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : this.#lastActivity
     ];
   }
 
-  #render(force: boolean): void {
-    if (this.#stopped) {
-      return;
+  #writePipeLine(line: string): void {
+    if (!this.#stopped) {
+      this.#writePipeText(`${line}\n`);
     }
-    const rows: [string, string, string] = this.#rows();
-    if (this.#options.isTTY) {
-      const width: number = Math.max(20, this.#options.columns || 80) - 1;
-      const clip = (row: string): string => (row.length > width ? `${row.slice(0, width - 1)}…` : row);
-      const frame: string = SPINNER_FRAMES[this.#frame++ % SPINNER_FRAMES.length];
-      const text: string = [`${frame} ${rows[0]}`, rows[1], rows[2]].map(clip).join('\n');
-      this.#options.write(`${this.#painted ? `\x1b[${this.#painted}A\x1b[0J` : '\x1b[?25l'}${text}\n`);
-      this.#painted = 3;
-      return;
+  }
+
+  /** Writes to a pipe; the next status line is then due 25 s later. */
+  #writePipeText(text: string): void {
+    this.#options.write(text);
+    if (this.#statusTimer) {
+      this.#scheduleStatusLine();
     }
-    const key: string = `${this.#phase}|${this.#done}`;
-    const nowMs: number = this.#now();
-    const sinceLast: number = nowMs - this.#lastLineAtMs;
-    if (!force && (sinceLast < PIPE_MIN_INTERVAL_MS || (key === this.#lastLineKey && sinceLast < PIPE_HEARTBEAT_MS))) {
+  }
+
+  #scheduleStatusLine(): void {
+    clearTimeout(this.#statusTimer);
+    this.#statusTimer = setTimeout(
+      () => {
+        this.#unnamedFailure = false;
+        this.#writePipeLine(this.#getStatusLine());
+      },
+      this.#unnamedFailure ? PIPE_UNREPORTED_FAILURE_DELAY_MS : PIPE_STATUS_INTERVAL_MS
+    );
+    this.#statusTimer.unref?.();
+  }
+
+  /**
+   * A pipe status line: the counts, then the running operations, or else what the request waits for. The daemon
+   * does not report admission, so after a queue position this says when the position was reported instead of
+   * claiming that the request is still queued. While rushd has not responded, what runs is not known, so the line
+   * says how long rushd has not responded instead.
+   */
+  #getStatusLine(): string {
+    const { running, failed } = this.#tracker;
+    let activity: string = this.#phase;
+    const silence: string | undefined = this.#getSilence();
+    if (silence !== undefined) {
+      activity = silence;
+    } else if (running.length) {
+      activity = `running: ${formatNames(running, MAX_LIVE_NAMES)}`;
+    } else if (this.#queued) {
+      const { position, elapsed, continuing } = this.#queued;
+      activity = continuing
+        ? `${continuing.stopping ? 'waiting while rushd stops' : 'waiting for'} ` +
+          `${formatContinuingOperations(continuing)} (queue position ${position} at ${elapsed})` +
+          formatContinuingOperationNames(continuing)
+        : `waiting for admission or the workspace graph (queue position ${position} at ${elapsed})`;
+    }
+    const failures: string = failed.length ? ` · failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : '';
+    return `${this.#getHeader()} · ${activity}${failures}`;
+  }
+
+  #paint(): void {
+    if (this.#stopped) {
       return;
     }
-    this.#lastLineKey = key;
-    this.#lastLineAtMs = nowMs;
-    this.#options.write(`${rows[0]}${rows[1] ? ` · ${rows[1]}` : ''}\n`);
+    const rows: [string, string, string] = this.#rows();
+    const width: number = Math.max(20, this.#options.columns || 80) - 1;
+    const clip = (row: string): string => (row.length > width ? `${row.slice(0, width - 1)}…` : row);
+    const frame: string = SPINNER_FRAMES[this.#frame++ % SPINNER_FRAMES.length];
+    const text: string = [`${frame} ${rows[0]}`, rows[1], rows[2]].map(clip).join('\n');
+    this.#options.write(`${this.#painted ? `\x1b[${this.#painted}A\x1b[0J` : '\x1b[?25l'}${text}\n`);
+    this.#painted = 3;
   }
 
   #clear(): void {
diff --git a/apps/rush-cli-client/src/ClientAdmissionControls.ts b/apps/rush-cli-client/src/ClientAdmissionControls.ts
index a0dc6cb0173..cbb6ce7d631 100644
--- a/apps/rush-cli-client/src/ClientAdmissionControls.ts
+++ b/apps/rush-cli-client/src/ClientAdmissionControls.ts
@@ -72,22 +72,43 @@ export function getConfiguredAdmission(options: IConfiguredAdmissionOptions): ID
   return options.explicit ? { waitTimeoutMs } : { waitTimeoutMs, waitTimeoutIsDefault: true };
 }
 
-/** Explains a daemon admission failure and how to wait longer. */
+// Only the per-invocation flag is offered: Rush versions that do not recognize the variable reject it.
+const WAIT_LONGER_REMEDY: string = 'To wait longer, pass --wait-timeout <seconds>.';
+
+/** The client that writes a line, which begins with its name. */
+export type ClientName = 'rush-client' | 'rushx-client';
+
+/**
+ * Explains a daemon admission failure and how to wait longer.
+ *
+ * @remarks
+ * The daemon's reason for the failure (`daemonMessage`), when present, replaces the generic explanation,
+ * because it names what the request waited for, such as a daemon restart.
+ */
 export function formatAdmissionFailure(
   code: DaemonRequestAdmissionErrorCode,
-  admission: IDaemonRequestAdmissionOptions | undefined
+  admission: IDaemonRequestAdmissionOptions | undefined,
+  daemonMessage?: string,
+  clientName: ClientName = 'rush-client'
 ): string {
-  const prefix: string = `rush-client: daemon admission failed (${code})`;
+  const prefix: string = `${clientName}: daemon admission failed (${code})`;
   if (code === 'no-wait') {
-    return `${prefix}: another daemon request is using this workspace and --no-wait was specified.\n`;
+    return daemonMessage
+      ? `${prefix}: ${daemonMessage}\n`
+      : `${prefix}: another daemon request is using this workspace and --no-wait was specified.\n`;
   }
   if (code === 'wait-timeout') {
-    const seconds: string =
-      admission?.waitTimeoutMs === undefined ? '' : ` after ${admission.waitTimeoutMs / 1000}s`;
+    if (daemonMessage) {
+      const remedy: string = daemonMessage.includes('--wait-timeout') ? '' : ` ${WAIT_LONGER_REMEDY}`;
+      return `${prefix}: ${daemonMessage}${remedy}\n`;
+    }
+    const timeout: string =
+      admission?.waitTimeoutMs === undefined
+        ? ''
+        : ` after its ${admission.waitTimeoutMs / 1000}s wait timeout`;
     return (
-      `${prefix}: timed out${seconds} waiting for another daemon request in this workspace to finish ` +
-      '(a command that needs exclusive access, or a running build). ' +
-      'To wait longer, use --wait-timeout <seconds> or set RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS.\n'
+      `${prefix}: timed out${timeout} waiting for another daemon request in this workspace to finish ` +
+      `(a command that needs exclusive access, or a running build). ${WAIT_LONGER_REMEDY}\n`
     );
   }
   return `${prefix}.\n`;
diff --git a/apps/rush-cli-client/src/GraphRequestContext.ts b/apps/rush-cli-client/src/GraphRequestContext.ts
index 6dc196e858d..55bedd3049e 100644
--- a/apps/rush-cli-client/src/GraphRequestContext.ts
+++ b/apps/rush-cli-client/src/GraphRequestContext.ts
@@ -39,6 +39,8 @@ export class GraphRequestContext implements Disposable {
     try {
       client = await DaemonClient.connectAsync({
         ...options,
+        // A graph request never reports the warm set.
+        omitWarmSetStatus: true,
         timeoutMs: remaining ? Math.min(remaining, options.timeoutMs ?? 5000) : options.timeoutMs
       });
     } catch (error) {
diff --git a/apps/rush-cli-client/src/OperationOutputExcerpt.ts b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
new file mode 100644
index 00000000000..b924c6a8d16
--- /dev/null
+++ b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
@@ -0,0 +1,272 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it (through AgentProgressRenderer) before
+// @microsoft/rush-lib.
+
+const ESC: string = String.fromCharCode(27);
+const BEL: string = String.fromCharCode(7);
+/** Matches ANSI CSI sequences (colors, cursor movement) and OSC sequences (hyperlinks, titles). */
+const ANSI_ESCAPE_PATTERN: RegExp = new RegExp(
+  `${ESC}(?:\\[[0-?]*[ -/]*[@-~]|\\][^${BEL}${ESC}]*(?:${BEL}|${ESC}\\\\))`,
+  'g'
+);
+/** A Heft task prefix such as `[build:typescript]`, followed by the line's content. */
+const TASK_PREFIX_PATTERN: RegExp = /^(\[[^\]\s]+\])\s*(.*)$/;
+/**
+ * Lines that carry no diagnostic value in a short excerpt: JavaScript stack frames, `Require stack:` and its
+ * module paths, code frames (`> 113 | code`, `    |   ^`), decorative banners (`---- build finished ----`),
+ * and the lines Rush itself writes into every operation's output (the command it invokes and the build cache
+ * status). A failed operation is always a cache miss, and "not found" would otherwise make that line look
+ * like an error.
+ */
+const NOISE_PATTERNS: ReadonlyArray<RegExp> = [
+  /^at\s.*(?::\d+(?::\d+)?\)?|\((?:index \d+|native|<anonymous>)\))$/,
+  /^Require stack:$/,
+  /^-\s+(?:\/|[A-Za-z]:[\\/]|\\\\)\S*$/,
+  /^(?:>\s*)?\d*\s*\|/,
+  /^[-=]{3,}(?:\s.*\s[-=]{3,})?$/,
+  /^Invoking(?: \((?:initial|incremental)\))?: /,
+  /^(?:This project was not found in the build cache|Build cache hit|Successfully set cache entry)\.$/,
+  /^Caching build output folders: /
+];
+const ERROR_PATTERN: RegExp =
+  /\b(?:errors?|exception|fatal|failed|failure|FAIL|cannot|could not|unable to|not found|TS\d{4,5})\b|\bERR(?:!|_[A-Z0-9_]+)|[●✖✕]/i;
+const NO_ERRORS_PATTERN: RegExp = /\b(?:0|no) errors?\b/i;
+/** Lines without any letter (bare exit codes, progress percentages, caret markers) explain nothing. */
+const LETTER_PATTERN: RegExp = /\p{L}/u;
+/** A severity word that some tools put before a diagnostic that they also print without it. */
+const SEVERITY_PREFIX_PATTERN: RegExp = /^(?:error|warning)\s*:\s*/i;
+const WHITESPACE_PATTERN: RegExp = /\s+/g;
+/** A tool's error count, such as Heft's `Encountered 2 errors` or tsc's `Found 1 error.` */
+const ERROR_COUNT_PATTERN: RegExp = /^(?:encountered|found) (\d+) errors?\b/i;
+/**
+ * A source location such as `src/x.ts:3:7` or `src/x.ts(3,7)`, with a line and a column, so that a host and port
+ * such as `registry.example.com:443` is not taken for one.
+ */
+const SOURCE_LOCATION_PATTERN: RegExp = /[\w-]\.[A-Za-z]\w{0,5}(?::\d+:\d+|\(\d+,\d+\))/;
+
+/** Lines longer than this keep their start and end, joined by an ellipsis. */
+const MAX_LINE_LENGTH: number = 300;
+const CLIPPED_LINE_TAIL_LENGTH: number = 80;
+/** Raw lines are clipped to this length before they are classified, so huge lines cost little. */
+const MAX_RAW_LINE_LENGTH: number = 4096;
+/** A partial line longer than this (for example a progress bar without newlines) is recorded as a line. */
+const MAX_PARTIAL_LINE_LENGTH: number = 65536;
+const HEAD_LINES: number = 8;
+const TAIL_LINES: number = 3;
+const ERROR_LINES: number = 8;
+/** Excerpt rows reserved for the last lines, which usually contain a tool's own error summary. */
+const TAIL_RESERVE: number = 2;
+
+type OutputStream = 'stdout' | 'stderr';
+
+interface IExcerptLine {
+  /** The arrival order across both streams, used to print the excerpt in output order. */
+  readonly index: number;
+  readonly text: string;
+  /** Equal for lines that repeat one message; see {@link getRepeatKey}. */
+  readonly key: string;
+}
+
+interface IErrorLine extends IExcerptLine {
+  /** The line that followed this error line, which often continues its message. */
+  context?: IExcerptLine;
+}
+
+interface IStreamLines {
+  readonly head: IExcerptLine[];
+  readonly tail: IExcerptLine[];
+  partial: string;
+}
+
+/**
+ * Normalizes one line of operation output for an excerpt: removes ANSI escapes and carriage-return overwrites,
+ * and collapses whitespace after a Heft task prefix. Returns undefined for lines that are empty or noise.
+ */
+export function normalizeExcerptLine(rawLine: string): string | undefined {
+  let line: string = clipLine(rawLine, MAX_RAW_LINE_LENGTH);
+  if (line.includes(ESC)) {
+    line = line.replace(ANSI_ESCAPE_PATTERN, '');
+  }
+  if (line.endsWith('\r')) {
+    line = line.slice(0, -1);
+  }
+  line = line.slice(line.lastIndexOf('\r') + 1).trim();
+  const prefixMatch: RegExpMatchArray | null = TASK_PREFIX_PATTERN.exec(line);
+  const content: string = prefixMatch ? prefixMatch[2].trim() : line;
+  if (!LETTER_PATTERN.test(content) || NOISE_PATTERNS.some((pattern) => pattern.test(content))) {
+    return undefined;
+  }
+  return clipLine(prefixMatch ? `${prefixMatch[1]} ${content}` : content, MAX_LINE_LENGTH);
+}
+
+/** Returns whether a normalized line looks like an error message. */
+export function isErrorLine(line: string): boolean {
+  return ERROR_PATTERN.test(line) && !NO_ERRORS_PATTERN.test(line);
+}
+
+/**
+ * A normalized line's message without its task prefix, a leading `Error:` or `Warning:`, case and repeated
+ * whitespace. Tools such as Heft print each diagnostic when it occurs and again in their final summary, once with
+ * and once without these, so lines with the same key repeat one message.
+ */
+function getRepeatKey(line: string): string {
+  const prefixMatch: RegExpMatchArray | null = TASK_PREFIX_PATTERN.exec(line);
+  const content: string = prefixMatch ? prefixMatch[2] : line;
+  return content.replace(SEVERITY_PREFIX_PATTERN, '').replace(WHITESPACE_PATTERN, ' ').toLowerCase();
+}
+
+/** The number of errors that a tool's error count line reports, or undefined if the line is no such count. */
+function getReportedErrorCount(line: IExcerptLine): number | undefined {
+  const match: RegExpMatchArray | null = ERROR_COUNT_PATTERN.exec(line.key);
+  return match ? Number(match[1]) : undefined;
+}
+
+/**
+ * Leaves out of chosen lines (in output order) the error counts that the chosen errors account for, and, when
+ * the first chosen error names a source location, the lines before it.
+ */
+function trimExcerpt(lines: ReadonlyArray<IExcerptLine>): IExcerptLine[] {
+  const errors: IExcerptLine[] = lines.filter(
+    (line) => getReportedErrorCount(line) === undefined && isErrorLine(line.text)
+  );
+  const kept: IExcerptLine[] = lines.filter((line) => {
+    const count: number | undefined = getReportedErrorCount(line);
+    return count === undefined || count === 0 || count > errors.length;
+  });
+  return errors.length && SOURCE_LOCATION_PATTERN.test(errors[0].text)
+    ? kept.slice(kept.indexOf(errors[0]))
+    : kept;
+}
+
+/** Shortens a line to at most `maxLength` characters, keeping its start and its end. */
+export function clipLine(line: string, maxLength: number): string {
+  if (line.length <= maxLength) {
+    return line;
+  }
+  const tailLength: number = Math.min(CLIPPED_LINE_TAIL_LENGTH, Math.floor(maxLength / 3));
+  return `${line.slice(0, maxLength - tailLength - 1)}…${line.slice(line.length - tailLength)}`;
+}
+
+/**
+ * Keeps a short excerpt of one operation's output, to explain a failure in a few lines.
+ *
+ * @remarks
+ * Memory use does not grow with the output: only the first and last lines of each stream are kept, plus the
+ * first distinct error-looking lines of either stream, each with the next line of the same stream. The
+ * excerpt prefers error lines, then the end of the output (where tools print their error summary), then its
+ * beginning. Like the native `StdioSummarizer`, head and tail lines come from stderr when the operation wrote
+ * any, otherwise from stdout; error lines come from both, because tools such as tsc and eslint report errors
+ * on stdout. Stack frames, `Require stack:` paths and code frames are dropped, so they cannot crowd out the
+ * cause. A message that a tool repeats in its summary is shown once, and so is an error count that the shown
+ * errors already account for; when the first error shown names a source location, the lines before it (a
+ * tool's banner and progress) are left out.
+ */
+export class OperationOutputExcerpt {
+  readonly #streams: Record<OutputStream, IStreamLines> = {
+    stdout: { head: [], tail: [], partial: '' },
+    stderr: { head: [], tail: [], partial: '' }
+  };
+  readonly #errors: IErrorLine[] = [];
+  readonly #errorKeys: Set<string> = new Set();
+  /**
+   * Per stream, the error line whose context is the stream's next line. The streams are separate pipes, so the
+   * next line of the other stream is unrelated to the error.
+   */
+  readonly #pendingContext: Record<OutputStream, IErrorLine | undefined> = {
+    stdout: undefined,
+    stderr: undefined
+  };
+  #lineCount: number = 0;
+
+  /** The number of non-empty, non-noise lines seen so far. */
+  public get lineCount(): number {
+    return this.#lineCount;
+  }
+
+  /** Records a chunk of output; a line split across chunks is joined. */
+  public append(text: string, stream: OutputStream): void {
+    const lines: IStreamLines = this.#streams[stream];
+    const pieces: string[] = (lines.partial + text).split('\n');
+    lines.partial = pieces.pop() ?? '';
+    if (lines.partial.length > MAX_PARTIAL_LINE_LENGTH) {
+      pieces.push(lines.partial);
+      lines.partial = '';
+    }
+    for (const piece of pieces) {
+      this.#addLine(piece, stream);
+    }
+  }
+
+  /** Records any unterminated last lines. Further output is still accepted. */
+  public flush(): void {
+    for (const stream of ['stdout', 'stderr'] as const) {
+      const lines: IStreamLines = this.#streams[stream];
+      if (lines.partial) {
+        const partial: string = lines.partial;
+        lines.partial = '';
+        this.#addLine(partial, stream);
+      }
+    }
+  }
+
+  /** Returns at most `maxLines` lines that best explain the output, in output order. */
+  public getExcerpt(maxLines: number): string[] {
+    this.flush();
+    const preferred: IStreamLines = this.#streams.stderr.head.length
+      ? this.#streams.stderr
+      : this.#streams.stdout;
+    const chosen: Map<number, IExcerptLine> = new Map();
+    const keys: Set<string> = new Set();
+    const add = (line: IExcerptLine | undefined, limit: number): void => {
+      if (line && chosen.size < limit && !chosen.has(line.index) && !keys.has(line.key)) {
+        chosen.set(line.index, line);
+        keys.add(line.key);
+      }
+    };
+    const errorLimit: number = Math.max(1, maxLines - TAIL_RESERVE);
+    for (const errorLine of this.#errors) {
+      add(errorLine, errorLimit);
+      add(errorLine.context, errorLimit);
+    }
+    // Newest first, so the last line (often the tool's own error summary) is always kept.
+    for (let i: number = preferred.tail.length - 1; i >= 0; i--) {
+      add(preferred.tail[i], maxLines);
+    }
+    for (const errorLine of this.#errors) {
+      add(errorLine, maxLines);
+    }
+    for (const line of preferred.head) {
+      add(line, maxLines);
+    }
+    return trimExcerpt([...chosen.values()].sort((a, b) => a.index - b.index)).map((line) => line.text);
+  }
+
+  #addLine(rawLine: string, stream: OutputStream): void {
+    const text: string | undefined = normalizeExcerptLine(rawLine);
+    if (text === undefined) {
+      return;
+    }
+    const line: IExcerptLine = { index: this.#lineCount++, text, key: getRepeatKey(text) };
+    const lines: IStreamLines = this.#streams[stream];
+    if (lines.head.length < HEAD_LINES) {
+      lines.head.push(line);
+    }
+    lines.tail.push(line);
+    if (lines.tail.length > TAIL_LINES) {
+      lines.tail.shift();
+    }
+    const pendingContext: IErrorLine | undefined = this.#pendingContext[stream];
+    if (pendingContext) {
+      pendingContext.context = line;
+      this.#pendingContext[stream] = undefined;
+    }
+    if (this.#errors.length < ERROR_LINES && !this.#errorKeys.has(line.key) && isErrorLine(text)) {
+      const errorLine: IErrorLine = { ...line };
+      this.#errors.push(errorLine);
+      this.#errorKeys.add(line.key);
+      this.#pendingContext[stream] = errorLine;
+    }
+  }
+}
diff --git a/apps/rush-cli-client/src/clientCancellation.ts b/apps/rush-cli-client/src/clientCancellation.ts
index 4c60a964eb5..bce29e06100 100644
--- a/apps/rush-cli-client/src/clientCancellation.ts
+++ b/apps/rush-cli-client/src/clientCancellation.ts
@@ -5,6 +5,8 @@ import * as os from 'node:os';
 
 import type { DaemonClientOutcome } from '@rushstack/rush-client-core';
 
+import type { ClientName } from './ClientAdmissionControls';
+
 /** Signals that cancel a daemon-routed command. */
 export const CANCELLATION_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM', 'SIGHUP'];
 
@@ -18,22 +20,69 @@ export function getSignalExitCode(signal: NodeJS.Signals): number {
   return SIGNAL_EXIT_CODE_BASE + (os.constants.signals[signal] ?? os.constants.signals.SIGINT);
 }
 
-/** Formats the notice printed when a daemon-routed command is cancelled. */
-export function formatCancellationMessage(commandName: string): string {
-  return `rush-client: ${commandName} cancelled.\n`;
+/**
+ * Formats the notice printed as soon as the client asks the daemon to cancel a daemon-routed command, which can take
+ * the daemon seconds, for example while it prepares the workspace graph. `clientName` begins the line, as it does
+ * the client's other lines.
+ */
+export function formatCancellingMessage(
+  commandName: string,
+  timeoutMs: number,
+  clientName: ClientName = 'rush-client'
+): string {
+  const seconds: number = Math.round(timeoutMs / 1000);
+  return `${clientName}: cancelling ${commandName}; waiting up to ${seconds} s for rushd to stop the request.\n`;
+}
+
+/**
+ * Formats the notice printed when a daemon-routed command is cancelled. `stopUnconfirmed` says that the client
+ * stopped waiting before the daemon confirmed that the request stopped. `clientName` begins the line.
+ */
+export function formatCancellationMessage(
+  commandName: string,
+  stopUnconfirmed: boolean = false,
+  clientName: ClientName = 'rush-client'
+): string {
+  return stopUnconfirmed
+    ? `${clientName}: ${commandName} cancelled, but rushd did not confirm that the request stopped; ` +
+        'it may still be stopping.\n'
+    : `${clientName}: ${commandName} cancelled.\n`;
+}
+
+/**
+ * Formats the notice printed when a daemon-routed command is cancelled because the process reading its output
+ * exited, for example `head` in `rush-client build | head -5`. It is the only notice of that cancellation.
+ * `clientName` begins the line.
+ */
+export function formatClosedOutputMessage(
+  commandName: string,
+  streamName: string,
+  code: string | undefined,
+  stopUnconfirmed: boolean,
+  clientName: ClientName = 'rush-client'
+): string {
+  const reason: string = `the process reading its ${streamName} exited${code ? ` (${code})` : ''}`;
+  return stopUnconfirmed
+    ? `${clientName}: ${commandName} cancelled, because ${reason}, but rushd did not confirm that the request ` +
+        'stopped; it may still be stopping.\n'
+    : `${clientName}: ${commandName} cancelled, because ${reason}.\n`;
 }
 
 /**
  * Returns whether a daemon outcome represents a cancelled command. A result is cancelled when the daemon reports it
- * as aborted, even if an operation failure determines its semantic outcome. A completed (non-aborted) result wins
- * over a late signal, and a rejection is never reported as a cancellation.
+ * as aborted, even if an operation failure determines its semantic outcome, unless the daemon aborted it for its own
+ * reason (such as a daemon shutdown), which the result's error message carries and a signal did not cause. A
+ * completed (non-aborted) result wins over a late signal. A rejection is only a cancellation when the client was
+ * signalled and the daemon could not route the request: that is how the daemon answers a request cancelled before
+ * engine initialization. A rejection of the request itself (for example an invalid or unsupported request) is
+ * always reported.
  */
 export function isCancelledOutcome(outcome: DaemonClientOutcome, signalled: boolean): boolean {
   switch (outcome.kind) {
     case 'result':
-      return outcome.result.aborted;
+      return outcome.result.aborted && (signalled || !outcome.result.errorMessage);
     case 'rejected':
-      return false;
+      return signalled && outcome.rejection.code === 'routingFailed';
     default:
       return signalled;
   }
diff --git a/apps/rush-cli-client/src/clientOutput.ts b/apps/rush-cli-client/src/clientOutput.ts
new file mode 100644
index 00000000000..50d8d9cb551
--- /dev/null
+++ b/apps/rush-cli-client/src/clientOutput.ts
@@ -0,0 +1,157 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+import type { Writable } from 'node:stream';
+
+import { writeStreamAsync } from './writeStreamAsync';
+
+/**
+ * The exit code of a command that stopped because the process reading its output exited: 128 + SIGPIPE, which a
+ * shell reports for a writer that SIGPIPE ended, as in `make | head`. Windows has no SIGPIPE; the code is the same.
+ */
+export const CLOSED_OUTPUT_EXIT_CODE: number = 128 + (os.constants.signals.SIGPIPE ?? 13);
+
+export type ClientOutputStreamName = 'stdout' | 'stderr';
+
+export interface IClientOutputStreams {
+  readonly stdout: Writable;
+  readonly stderr: Writable;
+}
+
+/**
+ * Returns the error code when a write failed because nothing reads the stream any more, for example after
+ * `| head` exits: EPIPE for a pipe, or ECONNRESET for a socket.
+ */
+export function getClosedOutputCode(error: unknown): string | undefined {
+  const code: unknown =
+    typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+  return code === 'EPIPE' || code === 'ECONNRESET' ? code : undefined;
+}
+
+/**
+ * One of the client's own output streams. Once a write shows that the stream's reader has exited, later writes
+ * are dropped, and the owner hears of it once.
+ */
+export class ClientOutputStream {
+  public readonly name: ClientOutputStreamName;
+  readonly #stream: Writable;
+  readonly #onClosed: (stream: ClientOutputStream) => void;
+  #closedCode: string | undefined;
+  #guarded: boolean = false;
+
+  public constructor(
+    name: ClientOutputStreamName,
+    stream: Writable,
+    onClosed: (stream: ClientOutputStream) => void
+  ) {
+    this.name = name;
+    this.#stream = stream;
+    this.#onClosed = onClosed;
+  }
+
+  /** The code of the error that showed that the stream's reader exited (for example EPIPE), if one has. */
+  public get closedCode(): string | undefined {
+    return this.#closedCode;
+  }
+
+  /** Resolves once the bytes are written, or dropped because the reader exited. Other write errors reject. */
+  public async writeAsync(bytes: Uint8Array): Promise<void> {
+    if (this.#closedCode !== undefined) return;
+    try {
+      await writeStreamAsync(this.#stream, bytes);
+    } catch (error) {
+      const code: string | undefined = getClosedOutputCode(error);
+      if (code === undefined) throw error;
+      this.#close(code);
+    }
+  }
+
+  /**
+   * Writes without waiting. Another write error is left unhandled, so that it still fails the process, as the
+   * stream's unhandled 'error' event did.
+   */
+  public write(text: string): void {
+    void this.writeAsync(Buffer.from(text));
+  }
+
+  /**
+   * Node emits a failed write's error as an 'error' event too, and a stream with no listener for it fails the
+   * process. This listener keeps a reader that exited from doing so.
+   */
+  public guard(): void {
+    if (!this.#guarded) {
+      this.#guarded = true;
+      this.#stream.on('error', this.#onStreamError);
+    }
+  }
+
+  public release(): void {
+    if (this.#guarded) {
+      this.#guarded = false;
+      this.#stream.removeListener('error', this.#onStreamError);
+    }
+  }
+
+  readonly #onStreamError = (error: Error): void => {
+    const code: string | undefined = getClosedOutputCode(error);
+    if (code !== undefined) {
+      this.#close(code);
+    } else if (this.#stream.listenerCount('error') === 1) {
+      // No write waits for this error, so it fails the process, as it would without this listener.
+      throw error;
+    }
+  };
+
+  #close(code: string): void {
+    if (this.#closedCode === undefined) {
+      this.#closedCode = code;
+      this.#onClosed(this);
+    }
+  }
+}
+
+/**
+ * The client's stdout and stderr. A reader that exits (for example `rush-client build | head -5`) makes the
+ * next write to its stream fail. The client then cancels a running daemon request, as SIGPIPE would stop a
+ * native command, instead of reporting the failed write as a lost daemon connection.
+ */
+export class ClientOutput {
+  public readonly stdout: ClientOutputStream;
+  public readonly stderr: ClientOutputStream;
+  readonly #listeners: Set<(stream: ClientOutputStream) => void> = new Set();
+
+  public constructor(streams: IClientOutputStreams = process) {
+    const onClosed = (stream: ClientOutputStream): void => {
+      for (const listener of [...this.#listeners]) listener(stream);
+    };
+    this.stdout = new ClientOutputStream('stdout', streams.stdout, onClosed);
+    this.stderr = new ClientOutputStream('stderr', streams.stderr, onClosed);
+  }
+
+  /**
+   * Calls `listener` for each stream whose reader exits, and at once for one whose reader already has. Returns a
+   * function that removes the listener.
+   */
+  public onClosed(listener: (stream: ClientOutputStream) => void): () => void {
+    this.#listeners.add(listener);
+    for (const stream of [this.stdout, this.stderr]) {
+      if (stream.closedCode !== undefined) listener(stream);
+    }
+    return () => {
+      this.#listeners.delete(listener);
+    };
+  }
+
+  /** Keeps a reader that exits from failing the process; see {@link ClientOutputStream.guard}. */
+  public guard(): void {
+    this.stdout.guard();
+    this.stderr.guard();
+  }
+
+  /** Removes the listeners of `guard()`, for example before Rush runs in-process with its own error handling. */
+  public release(): void {
+    this.stdout.release();
+    this.stderr.release();
+  }
+}
diff --git a/apps/rush-cli-client/src/continuingOperations.ts b/apps/rush-cli-client/src/continuingOperations.ts
new file mode 100644
index 00000000000..2d2b6230420
--- /dev/null
+++ b/apps/rush-cli-client/src/continuingOperations.ts
@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// AgentProgressRenderer loads this module before @microsoft/rush-lib, so it stays free of heavy imports.
+
+import type { IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+/** The most names of operations that an earlier failed command left running that a line lists. */
+const MAX_CONTINUING_OPERATION_NAMES: number = 3;
+
+/**
+ * Says what a request waits for while it waits only for operations that an earlier failed command left running,
+ * for example "2 operations left running by an earlier failed command".
+ */
+export function formatContinuingOperations({ count }: IDaemonContinuingOperations): string {
+  return `${count} ${count === 1 ? 'operation' : 'operations'} left running by an earlier failed command`;
+}
+
+/**
+ * Names those operations after a colon, for example ": a (build), b (build), c (build) +4 more", where the count
+ * says how many are not named. Returns an empty string if the daemon named none.
+ */
+export function formatContinuingOperationNames({ count, names }: IDaemonContinuingOperations): string {
+  const shown: ReadonlyArray<string> = names.slice(0, MAX_CONTINUING_OPERATION_NAMES);
+  if (shown.length === 0) {
+    return '';
+  }
+  const more: number = count - shown.length;
+  return `: ${shown.join(', ')}${more > 0 ? ` +${more} more` : ''}`;
+}
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index fd19088343c..bc935fc3b89 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -1,28 +1,56 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import {
   DaemonClient,
+  DaemonClientError,
+  DaemonStartupPendingError,
   connectOrStartDaemonAsync,
+  connectToStartingDaemonAsync,
+  describeLiveDaemonOwner,
+  findReclaimedDaemonPid,
+  inspectDaemonStartupReservation,
+  isDaemonOwnerStoppedAsync,
   requestDaemonShutdownAsync,
   resetDaemonArtifactsAsync,
-  type IConnectOrStartDaemonOptions
+  resolveDaemonStartupReservationAsync,
+  type DaemonOwnerHintPurpose,
+  type IConnectOrStartDaemonOptions,
+  type IDaemonStartupReservationInfo
 } from '@rushstack/rush-client-core';
 import {
   DaemonTransportError,
   DaemonTransportErrorCode,
-  type IDaemonLockfile
+  isDaemonProcessAlive,
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
-import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPongMessage, IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { printDaemonLogAsync } from './daemonLogs';
 import { executeDaemonGraphCommandAsync } from './daemonGraph';
+import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
 import { writeStreamAsync } from './writeStreamAsync';
 
 const FORCE_STOP_WAIT_MS: number = 15000;
+/** How long stop waits for a daemon that no longer listens to exit, for example because it is shutting down. */
+const STOP_EXIT_WAIT_MS: number = 15000;
+/** Stop says that it waits only when the daemon is still there after this long. */
+const STOP_EXIT_NOTICE_MS: number = 1000;
+const STOP_EXIT_POLL_MS: number = 100;
+
+/**
+ * What a command that could not reach the daemon was for. `forceStop` is `daemon stop --force`: like a reset that a
+ * live owner refuses, it says that it killed no process.
+ */
+type ConnectionPurpose = DaemonOwnerHintPurpose | 'forceStop';
 
 export interface IDaemonCommandOptions {
   readonly argv: ReadonlyArray<string>;
@@ -30,6 +58,8 @@ export interface IDaemonCommandOptions {
   readonly rushJsonPath?: string;
   readonly rushVersion: string;
   readonly admission?: IDaemonRequestAdmissionOptions;
+  /** The resolved daemon settings. When no daemon runs, status uses them to say what the next command does. */
+  readonly daemonConfiguration?: { readonly enabled: boolean; readonly autoStart: boolean };
 }
 
 export async function executeDaemonCommandAsync(options: IDaemonCommandOptions): Promise<void> {
@@ -60,12 +90,16 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
   if (!options.rushJsonPath) throw new Error('Daemon management requires a repository containing rush.json.');
   const mayStart: boolean = command === 'start' || command === 'restart';
-  const connectionOptions: IConnectOrStartDaemonOptions = await getDaemonConnectionOptionsAsync(
-    path.dirname(options.rushJsonPath),
-    options.rushVersion,
-    options.environment,
-    mayStart
-  );
+  const connectionOptions: IConnectOrStartDaemonOptions = {
+    ...(await getDaemonConnectionOptionsAsync(
+      path.dirname(options.rushJsonPath),
+      options.rushVersion,
+      options.environment,
+      mayStart
+    )),
+    // A start, or a forced stop, reclaims a daemon that exited uncleanly, and says what it stopped.
+    onOrphansReaped: createOrphanReapNoticeHandler({ rushx: false, agentRenderer: undefined, writeStderr })
+  };
   if (command === 'logs') {
     if (options.argv[1] !== '--follow') {
       await printDaemonLogAsync(connectionOptions.paths);
@@ -90,35 +124,42 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   const client: DaemonClient | undefined =
     command === 'start'
       ? await connectOrStartDaemonAsync(connectionOptions)
-      : await connectExistingAsync(connectionOptions, command !== 'status');
+      : command === 'stop' && options.argv[1] !== '--force'
+        ? await connectForStopAsync(connectionOptions)
+        : command === 'status'
+          ? await connectForStatusAsync(connectionOptions, options)
+          : await connectExistingAsync(connectionOptions, true, command === 'stop' ? 'forceStop' : 'use');
   if (!client) {
     if (command === 'restart') {
       // Nothing to shut down: restart behaves like start.
       const started: DaemonClient = await connectOrStartDaemonAsync(connectionOptions);
       try {
-        await writeStatusAsync({
-          state: 'ready',
-          socketPath: connectionOptions.paths.socketPath,
-          ...(await started.status)
-        });
+        await writeReadyStatusAsync(connectionOptions.paths, await started.status);
       } finally {
         await started.closeAsync();
       }
       return;
     }
-    const { removedPaths } =
-      options.argv[1] === '--force'
-        ? await resetDaemonArtifactsAsync(connectionOptions.paths)
-        : { removedPaths: [] };
+    if (command === 'stop' && options.argv[1] !== '--force') {
+      await waitForUnreachableDaemonExitAsync(connectionOptions.paths);
+    }
+    const reset: IForceResetResult | undefined =
+      options.argv[1] === '--force' ? await forceResetAsync(connectionOptions) : undefined;
     await writeStatusAsync({
-      state: removedPaths.length > 0 ? 'reset' : 'notRunning',
+      state: reset && reset.removedPaths.length > 0 ? 'reset' : 'notRunning',
       socketPath: connectionOptions.paths.socketPath,
-      ...(options.argv[1] === '--force' ? { removedPaths } : {})
+      ...reset,
+      ...getStartupReservationStatus(connectionOptions.paths)
     });
     return;
   }
   try {
     if (command === 'stop') {
+      if (options.argv[1] !== '--force') {
+        // Once the daemon is gone, nothing proves a remaining reservation stale, so it would refuse every later
+        // automatic start. A reservation that cannot be resolved is still reported; --force removes it below.
+        await resolveDaemonStartupReservationAsync(client, connectionOptions.paths).catch(() => false);
+      }
       const { activeRequests } = await client.shutdownAsync();
       if (activeRequests) {
         await writeStreamAsync(
@@ -133,32 +174,27 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       if (options.argv[1] === '--force') {
         // Wait for the acknowledged daemon to release its listener and record, then clear leftovers
         // such as an abandoned startup reservation in the same invocation.
-        const { removedPaths } = await resetDaemonArtifactsAsync(connectionOptions.paths, {
-          waitTimeoutMs: FORCE_STOP_WAIT_MS
-        });
+        const reset: IForceResetResult = await forceResetAsync(connectionOptions, FORCE_STOP_WAIT_MS);
         await writeStatusAsync({
           state: 'shutdownAccepted',
           socketPath: connectionOptions.paths.socketPath,
           ...cancelled,
-          removedPaths
+          ...reset
         });
         return;
       }
       await writeStatusAsync({
         state: 'shutdownAccepted',
         socketPath: connectionOptions.paths.socketPath,
-        ...cancelled
+        ...cancelled,
+        ...getStartupReservationStatus(connectionOptions.paths)
       });
       return;
     }
     const readyClient: DaemonClient =
       command === 'restart' ? await restartDaemonAsync(client, connectionOptions) : client;
     try {
-      await writeStatusAsync({
-        state: 'ready',
-        socketPath: connectionOptions.paths.socketPath,
-        ...(await readyClient.status)
-      });
+      await writeReadyStatusAsync(connectionOptions.paths, await readyClient.status);
     } finally {
       if (readyClient !== client) await readyClient.closeAsync();
     }
@@ -167,10 +203,36 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
 }
 
+/**
+ * Connects to the daemon that stop shuts down. When nothing listens yet but a daemon is still starting, stop
+ * waits for it to become ready and then stops it: reporting notRunning would leave it running afterwards.
+ */
+async function connectForStopAsync(options: IConnectOrStartDaemonOptions): Promise<DaemonClient | undefined> {
+  const client: DaemonClient | undefined = await connectExistingAsync(options, true, 'stop');
+  if (client) return client;
+  try {
+    return await connectToStartingDaemonAsync({
+      ...options,
+      onAwaitStartup: (owner: string, waitMs: number): void => {
+        process.stderr.write(
+          `rush-client: The daemon is not ready yet. ${owner}, so stop waits up to ` +
+            `${Math.round(waitMs / 1000)} s for it to become ready and then stops it.\n`
+        );
+      }
+    });
+  } catch (error) {
+    if (!(error instanceof DaemonStartupPendingError)) throw error;
+    throw new Error(
+      `${error.message} It was not stopped; run "rush-client daemon stop" again once "rush-client daemon status" reports it ready.`
+    );
+  }
+}
+
 /** Returns undefined when nothing listens at the endpoint and `allowAbsent` is set; other failures propagate. */
 async function connectExistingAsync(
   options: IConnectOrStartDaemonOptions,
-  allowAbsent: boolean
+  allowAbsent: boolean,
+  purpose: ConnectionPurpose
 ): Promise<DaemonClient | undefined> {
   try {
     return await DaemonClient.connectAsync({ socketPath: options.paths.socketPath });
@@ -182,8 +244,203 @@ async function connectExistingAsync(
     ) {
       return undefined;
     }
-    throw error;
+    throw explainConnectionFailure(error, options.paths, purpose);
+  }
+}
+
+/**
+ * A daemon that no longer listens but still runs is shutting down, lost its socket, or is not running at all
+ * (a signal stopped it, for example). Stop waits for it to exit, and says what it is doing when it does not:
+ * reporting notRunning would leave it running. It does not wait for this workspace's daemon while a signal or a
+ * tracer keeps it stopped, because it cannot exit before something resumes it.
+ */
+async function waitForUnreachableDaemonExitAsync(paths: IDaemonPaths): Promise<void> {
+  const deadline: number = Date.now() + STOP_EXIT_WAIT_MS;
+  let noticed: boolean = false;
+  let owner: string | undefined = describeLiveDaemonOwner(paths, 'stop');
+  while (owner !== undefined) {
+    if (await isDaemonOwnerStoppedAsync(paths, deadline)) {
+      // The sampling took 1.5 s: say what the process is doing now.
+      owner = describeLiveDaemonOwner(paths, 'stop');
+      if (owner === undefined) return;
+      throw new Error(`Nothing listens at ${paths.socketPath}, but ${owner}`);
+    }
+    const remainingMs: number = deadline - Date.now();
+    if (remainingMs <= 0) throw new Error(`Nothing listens at ${paths.socketPath}, but ${owner}`);
+    if (!noticed && remainingMs <= STOP_EXIT_WAIT_MS - STOP_EXIT_NOTICE_MS) {
+      noticed = true;
+      const description: string = owner.split('\n')[0].replace(/\.$/, '');
+      await writeStreamAsync(
+        process.stderr,
+        Buffer.from(
+          `rush-client: Nothing listens at ${paths.socketPath}, but ${description}, so stop waits up to ${Math.round(remainingMs / 1000)} s for it to exit.\n`
+        )
+      );
+    }
+    await delayAsync(Math.min(STOP_EXIT_POLL_MS, remainingMs));
+    owner = describeLiveDaemonOwner(paths, 'stop');
+  }
+}
+
+/**
+ * Connects for `daemon status`. When nothing listens and nothing is left at the endpoint, which is the state
+ * after `daemon stop`, the idle timeout or a signal, it fails with a diagnostic that says so instead of the
+ * transport's refused connection. It also names a daemon that a client reclaimed after it exited without
+ * shutting down, until a daemon becomes ready again.
+ */
+async function connectForStatusAsync(
+  connectionOptions: IConnectOrStartDaemonOptions,
+  options: IDaemonCommandOptions
+): Promise<DaemonClient> {
+  const { paths } = connectionOptions;
+  try {
+    return await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+  } catch (error) {
+    if (
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.connectionRefused &&
+      isEndpointAbsent(paths)
+    ) {
+      throw new DaemonTransportError(
+        error.code,
+        `${describeAbsentDaemon(options)}${describeReclaimedDaemon(paths)}`
+      );
+    }
+    throw explainConnectionFailure(error, paths, 'use');
+  }
+}
+
+function explainConnectionFailure(error: unknown, paths: IDaemonPaths, purpose: ConnectionPurpose): unknown {
+  return explainStartupReservation(
+    explainLiveOwner(explainExitedDaemon(error, paths), paths, purpose),
+    paths
+  );
+}
+
+export function addForceStopNoProcessKilledNote(owner: string): string {
+  const firstLineEnd: number = owner.indexOf('\n');
+  if (firstLineEnd === -1) {
+    return `${owner} No process was killed.`;
+  }
+  return `${owner.slice(0, firstLineEnd)} No process was killed.${owner.slice(firstLineEnd)}`;
+}
+
+/**
+ * Explains a connection that failed while the process that the ownership record names still runs: what that
+ * process is doing, for example that a signal stopped it, and what to do about it.
+ */
+function explainLiveOwner(error: unknown, paths: IDaemonPaths, purpose: ConnectionPurpose): unknown {
+  if (!isUnansweredConnection(error)) return error;
+  const hintPurpose: DaemonOwnerHintPurpose = purpose === 'forceStop' ? 'stop' : purpose;
+  const owner: string | undefined = describeLiveDaemonOwner(paths, hintPurpose);
+  if (owner === undefined) return error;
+  // The note ends the first line, which says what that process is doing.
+  const explained: string = purpose === 'forceStop' ? addForceStopNoProcessKilledNote(owner) : owner;
+  return new Error(`${error.message} ${explained}`, { cause: error });
+}
+
+/** The daemon refused the connection, or accepted it but did not complete hello/ping. */
+function isUnansweredConnection(error: unknown): error is Error {
+  if (error instanceof DaemonTransportError) {
+    return (
+      error.code === DaemonTransportErrorCode.connectionRefused ||
+      error.code === DaemonTransportErrorCode.connectionTimeout
+    );
+  }
+  return error instanceof DaemonClientError && (error.code === 'timeout' || error.code === 'disconnected');
+}
+
+/**
+ * An orderly shutdown removes the ownership record and the socket, and a starting daemon has a startup
+ * reservation. A refused connection with none of them therefore means that no daemon runs or is starting.
+ * Windows names a pipe, which leaves no file behind.
+ */
+function isEndpointAbsent(paths: IDaemonPaths): boolean {
+  return (
+    !fs.existsSync(paths.lockfilePath) &&
+    !inspectDaemonStartupReservation(paths) &&
+    (process.platform === 'win32' || !fs.existsSync(paths.socketPath))
+  );
+}
+
+function describeAbsentDaemon(options: IDaemonCommandOptions): string {
+  const repoRoot: string = path.dirname(options.rushJsonPath!);
+  const absent: string = `No daemon is running for ${repoRoot} (Rush ${options.rushVersion})`;
+  const configuration: IDaemonCommandOptions['daemonConfiguration'] = options.daemonConfiguration;
+  if (!configuration) return `${absent}.`;
+  if (!configuration.enabled) {
+    return `${absent}; the daemon is not enabled here, so rush-client commands run Rush in-process.`;
+  }
+  return configuration.autoStart
+    ? `${absent}; the next rush-client command that uses the daemon starts one.`
+    : `${absent}, and auto-start is off, so rush-client commands run Rush in-process until "rush-client daemon start" starts one.`;
+}
+
+/**
+ * A client that reclaims a daemon that exited without shutting down removes the ownership record that
+ * {@link explainExitedDaemon} reads, so the reclaim is logged, and status reads that instead.
+ */
+function describeReclaimedDaemon(paths: IDaemonPaths): string {
+  const pid: number | undefined = findReclaimedDaemonPid(paths);
+  return pid === undefined
+    ? ''
+    : ` The last daemon, rushd (PID ${pid}), exited without shutting down; "rush-client daemon logs" may show why.`;
+}
+
+/**
+ * Explains a refused connection whose ownership record names a daemon that no longer runs. An orderly
+ * shutdown removes the record, so that daemon exited without shutting down, for example after a crash.
+ */
+function explainExitedDaemon(error: unknown, paths: IDaemonPaths): unknown {
+  if (!(error instanceof DaemonTransportError) || error.code !== DaemonTransportErrorCode.connectionRefused) {
+    return error;
+  }
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
+  if (
+    owner?.socketPath !== paths.socketPath ||
+    !Number.isSafeInteger(owner.pid) ||
+    owner.pid <= 0 ||
+    isDaemonProcessAlive(owner.pid)
+  ) {
+    return error;
   }
+  return new DaemonTransportError(
+    error.code,
+    `${error.message} rushd (PID ${owner.pid}) exited without shutting down; "rush-client daemon logs" may show why.`
+  );
+}
+
+/**
+ * Reports a startup reservation, which refuses another daemon launch until it is resolved. Clients resolve it
+ * once the daemon it reserved is ready, so the next command that uses, stops or restarts a ready daemon resolves
+ * a remaining one. Once its helper exited, a command that starts the daemon after `relaunchAfter` takes it over.
+ * Status only reports it.
+ */
+function getStartupReservationStatus(paths: IDaemonPaths): {
+  startupReservation?: IDaemonStartupReservationInfo;
+} {
+  const startupReservation: IDaemonStartupReservationInfo | undefined =
+    inspectDaemonStartupReservation(paths);
+  return startupReservation ? { startupReservation } : {};
+}
+
+/** Explains that a remaining startup reservation refuses another daemon launch, and what can resolve it. */
+function explainStartupReservation(error: unknown, paths: IDaemonPaths): unknown {
+  const reservation: IDaemonStartupReservationInfo | undefined = inspectDaemonStartupReservation(paths);
+  if (!reservation || !(error instanceof Error)) return error;
+  const helper: string = `its startup helper (PID ${reservation.helperPid})`;
+  let explanation: string;
+  switch (reservation.helperState) {
+    case 'running':
+      explanation = `A daemon is starting: ${helper} is still waiting for it to become ready; retry shortly.`;
+      break;
+    case 'exited':
+      explanation = `The startup reservation at ${reservation.path} remains, but ${helper} exited before the daemon became ready. A command that starts the daemon after ${reservation.relaunchAfter} takes the reservation over and launches the daemon again, provided that nothing listens at ${paths.socketPath} then. "rush-client daemon logs" may show why the daemon did not become ready.`;
+      break;
+    default:
+      explanation = `The startup reservation at ${reservation.path} refuses another daemon launch. Check "rush-client daemon logs"; if no daemon is starting, run "rush-client daemon stop --force" to remove it.`;
+  }
+  return new Error(`${error.message} ${explanation}`, { cause: error });
 }
 
 async function restartDaemonAsync(
@@ -200,3 +457,48 @@ async function restartDaemonAsync(
 function writeStatusAsync(status: object): Promise<void> {
   return writeStreamAsync(process.stdout, Buffer.from(`${JSON.stringify(status)}\n`));
 }
+
+interface IForceResetResult {
+  readonly removedPaths: ReadonlyArray<string>;
+  /** Present when the reset first stopped operations that a daemon that exited had left running. */
+  readonly orphansReaped?: ReadonlyArray<IDaemonOrphanReap>;
+}
+
+/** Removes the leftover daemon files; the operations that it stops first are also noted on stderr. */
+async function forceResetAsync(
+  connectionOptions: IConnectOrStartDaemonOptions,
+  waitTimeoutMs?: number
+): Promise<IForceResetResult> {
+  const orphansReaped: IDaemonOrphanReap[] = [];
+  const { removedPaths } = await resetDaemonArtifactsAsync(connectionOptions.paths, {
+    waitTimeoutMs,
+    onOrphansReaped: (reap: IDaemonOrphanReap): void => {
+      orphansReaped.push(reap);
+      connectionOptions.onOrphansReaped?.(reap);
+    }
+  });
+  return orphansReaped.length > 0 ? { removedPaths, orphansReaped } : { removedPaths };
+}
+
+/** A daemon whose installation was removed or replaced still answers, but restarts on its next request. */
+async function writeReadyStatusAsync(
+  paths: IDaemonPaths,
+  status: IDaemonPongMessage['payload']
+): Promise<void> {
+  const change: IDaemonPongMessage['payload']['installationChange'] = status.installationChange;
+  await writeStatusAsync({
+    state: change ? 'installationChanged' : 'ready',
+    socketPath: paths.socketPath,
+    ...status,
+    ...getStartupReservationStatus(paths)
+  });
+  if (!change) return;
+  process.exitCode = 1;
+  await writeStreamAsync(
+    process.stderr,
+    Buffer.from(
+      `rush-client: The daemon's installation at ${change.folder} was ${change.change}. ` +
+        'The next command restarts the daemon, or run "rush-client daemon restart".\n'
+    )
+  );
+}
diff --git a/apps/rush-cli-client/src/daemonConnectionOptions.ts b/apps/rush-cli-client/src/daemonConnectionOptions.ts
index bb87818b850..d088352dde7 100644
--- a/apps/rush-cli-client/src/daemonConnectionOptions.ts
+++ b/apps/rush-cli-client/src/daemonConnectionOptions.ts
@@ -4,8 +4,15 @@
 import * as fs from 'node:fs';
 
 import { JsonFile } from '@rushstack/node-core-library';
-import type { IConnectOrStartDaemonOptions } from '@rushstack/rush-client-core';
-import { computeDaemonWorkspaceKey, resolveDaemonPathsFromProcess } from '@rushstack/rush-daemon-transport';
+import {
+  assertDaemonRuntimeFolderIsPrivate,
+  type IConnectOrStartDaemonOptions
+} from '@rushstack/rush-client-core';
+import {
+  computeDaemonWorkspaceKey,
+  resolveDaemonPathsFromProcess,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
 import { readDaemonInstallationMetadata } from '@rushstack/rush-daemon/lib/DaemonInstallation';
 import type * as VersionSelectedDaemonLauncherModule from '@rushstack/rush-daemon/lib/VersionSelectedDaemonLauncher';
 
@@ -26,8 +33,11 @@ export function getDaemonConnectionOptions(
       'The synchronous launcher only supports its installed engine; use asynchronous version selection.'
     );
   }
+  const paths: IDaemonPaths = getDaemonPaths(canonicalRepoRoot, rushVersion);
+  // Every daemon command trusts files in this folder: the socket, the lockfile, the log and the reservation.
+  assertDaemonRuntimeFolderIsPrivate(paths);
   return {
-    paths: resolveDaemonPathsFromProcess(computeDaemonWorkspaceKey({ canonicalRepoRoot, rushVersion })),
+    paths,
     expectedDaemonVersion: daemonPackage.version,
     startCommand: autoStart
       ? loadVersionSelectedDaemonLauncher().getSelectedDaemonStartCommand(daemonPackagePath, {
@@ -75,3 +85,10 @@ export async function getDaemonConnectionOptionsAsync(
     });
   return { ...options, expectedDaemonVersion: launch.daemonVersion, startCommand: launch.startCommand };
 }
+
+/** The runtime files of the workspace's daemon for this Rush version: its socket and ownership record. */
+export function getDaemonPaths(repoRoot: string, rushVersion: string): IDaemonPaths {
+  return resolveDaemonPathsFromProcess(
+    computeDaemonWorkspaceKey({ canonicalRepoRoot: fs.realpathSync.native(repoRoot), rushVersion })
+  );
+}
diff --git a/apps/rush-cli-client/src/daemonGraph.ts b/apps/rush-cli-client/src/daemonGraph.ts
index 4ff19472722..cbdd9bafacc 100644
--- a/apps/rush-cli-client/src/daemonGraph.ts
+++ b/apps/rush-cli-client/src/daemonGraph.ts
@@ -116,8 +116,11 @@ async function executeGraphRequestAsync(
       sawSnapshot = true;
       await writeJsonAsync(event);
     },
-    onQueuePositionAsync: (position) =>
-      writeJsonAsync({ kind: 'queuePosition', payload: { requestId: request.requestId, position } })
+    onQueuePositionAsync: (position, restartReason) =>
+      writeJsonAsync({
+        kind: 'queuePosition',
+        payload: { requestId: request.requestId, position, ...(restartReason && { restartReason }) }
+      })
   });
   if (outcome.kind === 'fallback') {
     throw new Error(
diff --git a/apps/rush-cli-client/src/daemonReclaimNotice.ts b/apps/rush-cli-client/src/daemonReclaimNotice.ts
new file mode 100644
index 00000000000..9854f61ee2f
--- /dev/null
+++ b/apps/rush-cli-client/src/daemonReclaimNotice.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
+
+/** The most process groups that a line names before it says how many more were stopped. */
+const MAX_NAMED_GROUPS: number = 4;
+
+/** Lists process groups as `process group A`, `process groups A and B`, or `process groups A, B, C, D and 2 more`. */
+function formatProcessGroups(groupIds: readonly number[]): string {
+  const items: string[] = groupIds.slice(0, MAX_NAMED_GROUPS).map(String);
+  if (groupIds.length > items.length) items.push(`${groupIds.length - items.length} more`);
+  const last: string | undefined = items.pop();
+  return items.length === 0 ? `process group ${last}` : `process groups ${items.join(', ')} and ${last}`;
+}
+
+/**
+ * Returns the line that tells the user that the operations an exited daemon left running were stopped, so that
+ * they cannot overwrite the outputs of this command.
+ */
+export function formatOrphanReapNotice(reap: IDaemonOrphanReap, rushx: boolean): string {
+  const client: string = rushx ? 'rushx-client' : 'rush-client';
+  const operations: string =
+    `the operations that the exited daemon (PID ${reap.daemonPid}) left running ` +
+    `(${formatProcessGroups(reap.processGroupIds)})`;
+  return reap.outcome === 'killed'
+    ? `${client}: Killed ${operations}; they did not exit after SIGTERM.`
+    : `${client}: Stopped ${operations}.`;
+}
+
+/**
+ * Where a reclaim line goes: the agent renderer when one is active, and otherwise stderr.
+ */
+export interface IOrphanReapNoticeTarget {
+  readonly rushx: boolean;
+  readonly agentRenderer: { note(line: string): void } | undefined;
+  readonly writeStderr: (text: string) => void;
+}
+
+/**
+ * Creates the `onOrphansReaped` callback that prints {@link formatOrphanReapNotice}'s line, in place of the
+ * `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+ */
+export function createOrphanReapNoticeHandler(
+  target: IOrphanReapNoticeTarget
+): (reap: IDaemonOrphanReap) => void {
+  return (reap: IDaemonOrphanReap): void => {
+    const line: string = formatOrphanReapNotice(reap, target.rushx);
+    if (target.agentRenderer) target.agentRenderer.note(line);
+    else target.writeStderr(`${line}\n`);
+  };
+}
+
+/** Writes to this process's stderr. */
+export function writeStderr(text: string): void {
+  process.stderr.write(text);
+}
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
new file mode 100644
index 00000000000..8bb2ac817ee
--- /dev/null
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -0,0 +1,360 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DaemonClientError,
+  DaemonRestartFailedError,
+  formatDaemonRestartCause,
+  type IDaemonRestartNotice,
+  type IDaemonRestartWaitDetails
+} from '@rushstack/rush-client-core';
+import type { DaemonRestartReason, IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+import { formatContinuingOperationNames, formatContinuingOperations } from './continuingOperations';
+
+/**
+ * Completes "A command restarted the daemon <cause>", in which "its" and "it" mean the command, or returns
+ * `undefined` for a reason that this client does not know.
+ */
+function formatRestartedBecause(reason: DaemonRestartReason | undefined): string | undefined {
+  return reason === undefined ? undefined : formatDaemonRestartCause(reason, 'anotherRequest');
+}
+
+/**
+ * Returns the line that tells the user why the daemon restarted during a command, or why the command is sent to a
+ * new daemon, or `undefined` for a restart that needs no explanation.
+ */
+export function formatDaemonRestartNotice(notice: IDaemonRestartNotice, rushx: boolean): string | undefined {
+  const { reason, successorPid, exitedPid } = notice;
+  const pid: string = successorPid === undefined ? '' : ` (PID ${successorPid})`;
+  const prefix: string = rushx ? 'rushx-client' : 'rush-client';
+  if (exitedPid !== undefined) {
+    return `${prefix}: rushd (PID ${exitedPid}) exited while the command was queued; sending the command to a new daemon${pid}.`;
+  }
+  const cause: string | undefined = formatRestartedBecause(reason);
+  if (cause === undefined) return undefined;
+  return `${prefix}: A command restarted the daemon${pid} ${cause}.`;
+}
+
+/**
+ * Returns the error to report when a command's daemon restarted and the new daemon did not start. Its message says
+ * first why the daemon restarted, so that a user whose environment keeps the daemon from starting knows what to
+ * change. Any other error, and a restart for a reason that this client does not know, is returned unchanged.
+ */
+export function explainDaemonRestartFailure(error: unknown): unknown {
+  if (!(error instanceof DaemonRestartFailedError)) return error;
+  const cause: string | undefined = formatRestartedBecause(error.restartReason);
+  if (cause === undefined) return error;
+  return new DaemonClientError(
+    error.code,
+    `A command restarted the daemon ${cause}; the restarted daemon did not start: ${error.message}`,
+    { cause: error }
+  );
+}
+
+/**
+ * Where a restart line goes: the agent renderer when one is active, and otherwise stderr.
+ */
+export interface IDaemonRestartNoticeTarget {
+  readonly rushx: boolean;
+  readonly agentRenderer: { note(line: string): void } | undefined;
+  readonly writeStderrAsync: (text: string) => Promise<void>;
+}
+
+/**
+ * Creates the `onRestartAsync` callback that prints {@link formatDaemonRestartNotice}'s line.
+ */
+export function createDaemonRestartNoticeHandler(
+  target: IDaemonRestartNoticeTarget
+): (notice: IDaemonRestartNotice) => Promise<void> {
+  return async (notice: IDaemonRestartNotice): Promise<void> => {
+    const line: string | undefined = formatDaemonRestartNotice(notice, target.rushx);
+    if (!line) return;
+    if (target.agentRenderer) target.agentRenderer.note(line);
+    else await target.writeStderrAsync(`${line}\n`);
+  };
+}
+
+/** The agent phase after a request that waited for a restart follows it to the new daemon. */
+export const RESUBMITTED_PHASE: string =
+  'request resubmitted to the new daemon; preparing the workspace graph';
+
+/** A request that waits for a daemon restart says so again when it has written nothing about the wait for this long. */
+export const RESTART_WAIT_REPEAT_MS: number = 25_000;
+
+/** What a queue position says about a wait for a daemon restart. */
+export interface IDaemonRestartWait {
+  /**
+   * How many requests the wait counts: those that the daemon serves, and for a rushx script that waits for another
+   * request's restart, also those that wait to restart the daemon.
+   */
+  readonly position: number;
+  /**
+   * Why the daemon restarts. Without one, the request restarts the daemon itself once it ends, as a native
+   * `install` or `update` does, and first waits for the rushx scripts that `details.scriptCount` counts to finish.
+   */
+  readonly reason: DaemonRestartReason | undefined;
+  readonly details: IDaemonRestartWaitDetails;
+}
+
+/** Options for {@link formatDaemonRestartWait}. */
+export interface IDaemonRestartWaitLineOptions extends IDaemonRestartWait {
+  /** The process ID of the daemon that restarts. */
+  readonly daemonPid: number | undefined;
+  /** How long the request has waited. From a second on, the line says so. */
+  readonly elapsedMs?: number;
+}
+
+function formatCount(count: number, noun: string): string {
+  return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+
+function formatIncludedScripts(scriptCount: number): string {
+  return scriptCount > 0 ? `, including ${formatCount(scriptCount, 'rushx script')}` : '';
+}
+
+/**
+ * Says what a request that waits for a daemon restart waits for and why the daemon restarts, for example
+ * "waiting for 2 running requests to finish, including 1 rushx script; the daemon (PID 41) then restarts, because
+ * common/config/rush/pnpm-lock.yaml changed". A rushx script that waits for another request's restart gets
+ * "waiting for the daemon (PID 41) to restart for another request (2 requests ahead), because ...", and a request
+ * that restarts the daemon itself once it ends gets "waiting for 1 running rushx script to finish, since this
+ * command restarts the daemon (PID 41), which would end it". The line names environment variables, never their
+ * values, and leaves out a cause that this client cannot word.
+ */
+export function formatDaemonRestartWait(options: IDaemonRestartWaitLineOptions): string {
+  const { position, reason, details, daemonPid, elapsedMs = 0 } = options;
+  const anotherRequest: boolean = !!details.restartsForAnotherRequest;
+  const pid: string = daemonPid === undefined ? '' : ` (PID ${daemonPid})`;
+  const waiting: string =
+    elapsedMs < 1000 ? 'waiting' : `still waiting after ${Math.round(elapsedMs / 1000)}s`;
+  const scriptCount: number = details.scriptCount ?? 0;
+  if (!reason) {
+    const scripts: number = scriptCount || position;
+    return (
+      `${waiting} for ${formatCount(scripts, 'running rushx script')} to finish, since this command restarts ` +
+      `the daemon${pid}, which would end ${scripts === 1 ? 'it' : 'them'}`
+    );
+  }
+  const cause: string | undefined = formatDaemonRestartCause(
+    reason,
+    anotherRequest ? 'anotherRequest' : 'thisRequest'
+  );
+  const because: string = cause === undefined ? '' : `, ${cause}`;
+  if (anotherRequest) {
+    const ahead: string = `${formatCount(position, 'request')} ahead${formatIncludedScripts(scriptCount)}`;
+    return `${waiting} for the daemon${pid} to restart for another request (${ahead})${because}`;
+  }
+  // Scripts are named, since a script such as a dev server may run until it is stopped.
+  const allScripts: boolean = scriptCount >= position;
+  const running: string = formatCount(position, allScripts ? 'running rushx script' : 'running request');
+  const scripts: string = allScripts ? '' : formatIncludedScripts(scriptCount);
+  return `${waiting} for ${running} to finish${scripts}; the daemon${pid} then restarts${because}`;
+}
+
+/** The part of a restart wait that a pipe gets a line for at once when it changes: whose restart, and why. */
+function getRestartWaitCause(wait: IDaemonRestartWait): string {
+  const { reason, details } = wait;
+  if (!reason) return 'thisCommand';
+  const anotherRequest: boolean = !!details.restartsForAnotherRequest;
+  const cause: string | undefined = formatDaemonRestartCause(
+    reason,
+    anotherRequest ? 'anotherRequest' : 'thisRequest'
+  );
+  return `${anotherRequest}:${cause ?? reason.kind}`;
+}
+
+/**
+ * Whether a restart wait line for `waitReason` already said why the daemon restarted for `reason`, so that the
+ * restart notice would only repeat it: the same variables, or the same change to the same installation.
+ */
+function isRestartCauseWritten(
+  waitReason: DaemonRestartReason | undefined,
+  reason: DaemonRestartReason | undefined
+): boolean {
+  if (waitReason?.kind === 'environmentChanged' && reason?.kind === 'environmentChanged') {
+    const names: readonly string[] = reason.variableNames;
+    return (
+      waitReason.variableNames.length === names.length &&
+      waitReason.variableNames.every((name: string, index: number) => name === names[index])
+    );
+  }
+  if (waitReason?.kind === 'installationChanged' && reason?.kind === 'installationChanged') {
+    return waitReason.folder === reason.folder && waitReason.change === reason.change;
+  }
+  return false;
+}
+
+/** The agent renderer methods that tell an agent why a request waits or restarted. */
+export interface IAgentRequestNoticeRenderer {
+  note(line: string): void;
+  /** See `AgentProgressRenderer.onResubmitted`. */
+  onResubmitted(phase: string): void;
+  /** See `AgentProgressRenderer.onQueuePosition`. */
+  onQueuePosition(position: number, continuingOperations?: IDaemonContinuingOperations): void;
+  /** See `AgentProgressRenderer.onRestartWait`. Returns whether it wrote the wait as a line. */
+  onRestartWait(wait: string, announce: boolean): boolean;
+}
+
+/**
+ * Where a request's queue positions and restart lines go.
+ */
+export interface IDaemonRequestNoticeTarget extends IDaemonRestartNoticeTarget {
+  readonly agentRenderer: IAgentRequestNoticeRenderer | undefined;
+  /**
+   * Without an agent renderer, a terminal gets a line for every change of a restart wait and every queue position,
+   * and a pipe gets a line when a restart wait begins or its cause changes. Both get the restart wait line again
+   * with the time waited when {@link RESTART_WAIT_REPEAT_MS} passes without one.
+   */
+  readonly stderrIsTTY: boolean;
+  /** The process ID of the daemon that serves the request first. */
+  readonly daemonPid: number | undefined;
+  /** Returns the current time in milliseconds. Defaults to `Date.now`. */
+  readonly now?: () => number;
+}
+
+/**
+ * The callbacks of one request that tell the user why it waits or restarted.
+ */
+export interface IDaemonRequestNoticeHandlers {
+  readonly onRestartAsync: (notice: IDaemonRestartNotice) => Promise<void>;
+  readonly onQueuePositionAsync: (
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails,
+    /** Set while the request waits only for operations that an earlier failed command left running. */
+    continuingOperations?: IDaemonContinuingOperations
+  ) => Promise<void>;
+  /** The daemon admitted the request's input, so a rushx script starts, and no longer waits. */
+  readonly onInputAdmittedAsync: () => Promise<void>;
+  /** The request's output or an event arrived, so it no longer waits. */
+  readonly onRequestProgress: () => void;
+  /**
+   * The agent renderer shows another wait of the request at its daemon as the phase, for example a wait for another
+   * Rush process to release the repository's lock. A restart then replaces the phase, as after a restart wait.
+   */
+  readonly onAgentWaitShown: () => void;
+  /**
+   * The request ended, or the client asked rushd to cancel it: stops repeating the restart wait line, and ignores
+   * later queue positions.
+   */
+  readonly dispose: () => void;
+}
+
+interface IRestartWaitState {
+  readonly startedAtMs: number;
+  wait: IDaemonRestartWait;
+  /** The cause of the last restart wait that was announced; see {@link getRestartWaitCause}. */
+  announcedCause: string | undefined;
+  /** The last restart wait line without the time waited, so that a terminal gets a line for each change. */
+  line: string | undefined;
+  timer: ReturnType<typeof setTimeout> | undefined;
+}
+
+/**
+ * Creates the callbacks that tell the user why a request waits or restarted. The lines name the daemon that serves
+ * the request, which changes when the request follows a restart. A restart wait line is repeated until the request
+ * restarts, gets input, output or an event, or waits for plain admission instead. A restart gets no notice when the
+ * request already wrote a wait line for the same cause since it last restarted, since that line said why. Once the
+ * request ends or the client asks rushd to cancel it (see `dispose`), nothing more is written.
+ */
+export function createDaemonRequestNoticeHandlers(
+  target: IDaemonRequestNoticeTarget
+): IDaemonRequestNoticeHandlers {
+  const { agentRenderer, stderrIsTTY, now = Date.now } = target;
+  const prefix: string = target.rushx ? 'rushx-client' : 'rush-client';
+  const writeRestartNoticeAsync: (notice: IDaemonRestartNotice) => Promise<void> =
+    createDaemonRestartNoticeHandler(target);
+  let daemonPid: number | undefined = target.daemonPid;
+  let restartWait: IRestartWaitState | undefined;
+  // Whether the agent phase showed a wait at the daemon since the request last restarted.
+  let showedAgentWait: boolean = false;
+  // The reason of the last wait line written as a line since the request last restarted.
+  let writtenWaitReason: DaemonRestartReason | undefined;
+  let disposed: boolean = false;
+
+  const endRestartWait = (): void => {
+    clearTimeout(restartWait?.timer);
+    restartWait = undefined;
+  };
+  const writeRestartWaitAsync = async (state: IRestartWaitState): Promise<void> => {
+    clearTimeout(state.timer);
+    state.timer = setTimeout(() => {
+      if (restartWait === state) writeRestartWaitAsync(state).catch(() => undefined);
+    }, RESTART_WAIT_REPEAT_MS);
+    state.timer.unref?.();
+    const elapsedMs: number = now() - state.startedAtMs;
+    const line: string = formatDaemonRestartWait({ ...state.wait, daemonPid, elapsedMs });
+    writtenWaitReason = state.wait.reason;
+    await target.writeStderrAsync(`${prefix}: ${line}.\n`);
+  };
+
+  return {
+    onRestartAsync: async (notice: IDaemonRestartNotice): Promise<void> => {
+      endRestartWait();
+      daemonPid = notice.successorPid;
+      const waitReason: DaemonRestartReason | undefined = writtenWaitReason;
+      writtenWaitReason = undefined;
+      if (!isRestartCauseWritten(waitReason, notice.reason)) await writeRestartNoticeAsync(notice);
+      // The phase and the status lines still say what the request waited for at the previous daemon.
+      if (agentRenderer && (showedAgentWait || notice.exitedPid !== undefined)) {
+        agentRenderer.onResubmitted(RESUBMITTED_PHASE);
+      }
+      showedAgentWait = false;
+    },
+    onQueuePositionAsync: async (
+      position: number,
+      restartReason?: DaemonRestartReason,
+      details: IDaemonRestartWaitDetails = {},
+      continuing?: IDaemonContinuingOperations
+    ): Promise<void> => {
+      if (disposed) return;
+      // Without a reason, a count of scripts means that the request restarts the daemon itself once it ends.
+      if (!restartReason && !details.scriptCount) {
+        endRestartWait();
+        if (agentRenderer) agentRenderer.onQueuePosition(position, continuing);
+        else if (stderrIsTTY) {
+          const behind: string = continuing
+            ? `${continuing.stopping ? ' while rushd stops' : ' behind'} ` +
+              `${formatContinuingOperations(continuing)}${formatContinuingOperationNames(continuing)}`
+            : '';
+          await target.writeStderrAsync(
+            `${prefix}: waiting for daemon admission (position ${position})${behind}.\n`
+          );
+        }
+        return;
+      }
+      const wait: IDaemonRestartWait = { position, reason: restartReason, details };
+      const state: IRestartWaitState = (restartWait ??= {
+        startedAtMs: now(),
+        wait,
+        announcedCause: undefined,
+        line: undefined,
+        timer: undefined
+      });
+      state.wait = wait;
+      const cause: string = getRestartWaitCause(wait);
+      const announce: boolean = cause !== state.announcedCause;
+      state.announcedCause = cause;
+      const line: string = formatDaemonRestartWait({ ...wait, daemonPid });
+      const changed: boolean = line !== state.line;
+      state.line = line;
+      if (agentRenderer) {
+        showedAgentWait = true;
+        // The agent renderer's own status lines repeat the phase.
+        if (agentRenderer.onRestartWait(line, announce)) writtenWaitReason = restartReason;
+      } else if (announce || (stderrIsTTY && changed)) {
+        await writeRestartWaitAsync(state);
+      }
+    },
+    onInputAdmittedAsync: async (): Promise<void> => endRestartWait(),
+    onRequestProgress: endRestartWait,
+    onAgentWaitShown: (): void => {
+      showedAgentWait = true;
+    },
+    dispose: (): void => {
+      disposed = true;
+      endRestartWait();
+    }
+  };
+}
diff --git a/apps/rush-cli-client/src/daemonSilence.ts b/apps/rush-cli-client/src/daemonSilence.ts
new file mode 100644
index 00000000000..d749c457f5f
--- /dev/null
+++ b/apps/rush-cli-client/src/daemonSilence.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of runtime imports: AgentProgressRenderer, which start.ts loads before
+// @microsoft/rush-lib, uses it.
+
+import type { IDaemonClientLivenessOptions, IDaemonSilence } from '@rushstack/rush-client-core';
+
+/**
+ * What a daemon that has not responded means, and what to do, to follow a semicolon. On Linux,
+ * `rush-client daemon status` waits 5 s for the daemon to get ready and then names its process's state, such as
+ * stopped (state T) or running (state R), with what to do. Elsewhere it cannot read that state.
+ */
+export const DAEMON_SILENCE_ADVICE: string =
+  'its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting';
+
+function formatDaemon(pid: number | undefined): string {
+  return pid === undefined ? 'rushd' : `rushd (PID ${pid})`;
+}
+
+function formatSeconds(ms: number): string {
+  return `${Math.floor(ms / 1000)}s`;
+}
+
+/** Says how long the daemon has sent nothing, for example "rushd (PID 41) has not responded for 30s". */
+export function formatDaemonSilence(pid: number | undefined, silentForMs: number): string {
+  return `${formatDaemon(pid)} has not responded for ${formatSeconds(silentForMs)}`;
+}
+
+/** Says that the daemon sent something again, for example "rushd (PID 41) responded again after 70s". */
+export function formatDaemonResponded(silence: IDaemonSilence): string {
+  return `${formatDaemon(silence.pid)} responded again after ${formatSeconds(silence.silentForMs)}`;
+}
+
+/** The agent renderer's methods for a daemon that stops responding, and for one that responds again. */
+export interface IAgentDaemonSilenceRenderer {
+  onDaemonUnresponsive(silence: IDaemonSilence): void;
+  onDaemonResponsive(silence: IDaemonSilence): void;
+}
+
+/** Where the lines about a daemon that stopped responding go. */
+export interface IDaemonSilenceTarget {
+  readonly rushx: boolean;
+  readonly agentRenderer: IAgentDaemonSilenceRenderer | undefined;
+  readonly writeStderrAsync: (text: string) => Promise<void>;
+}
+
+/**
+ * Creates a request's liveness check. When the daemon stops responding, the agent renderer says so, if one is
+ * active, and otherwise a line on stderr does, with what to do. When it responds again, a second line says so.
+ * An interrupt asks the daemon to cancel the request; a stopped daemon cannot confirm that, so the client stops
+ * waiting when its cancellation timeout ends.
+ */
+export function createDaemonLivenessOptions(target: IDaemonSilenceTarget): IDaemonClientLivenessOptions {
+  const { agentRenderer } = target;
+  const prefix: string = target.rushx ? 'rushx-client' : 'rush-client';
+  const writeLine = (line: string): void => {
+    // After SIGHUP the terminal may be gone.
+    target.writeStderrAsync(`${prefix}: ${line}\n`).catch(() => undefined);
+  };
+  return {
+    onUnresponsive: (silence: IDaemonSilence): void => {
+      if (agentRenderer) {
+        agentRenderer.onDaemonUnresponsive(silence);
+        return;
+      }
+      writeLine(`${formatDaemonSilence(silence.pid, silence.silentForMs)}; ${DAEMON_SILENCE_ADVICE}.`);
+    },
+    onResponsive: (silence: IDaemonSilence): void => {
+      if (agentRenderer) {
+        agentRenderer.onDaemonResponsive(silence);
+        return;
+      }
+      writeLine(`${formatDaemonResponded(silence)}.`);
+    }
+  };
+}
diff --git a/apps/rush-cli-client/src/earlyRouting.ts b/apps/rush-cli-client/src/earlyRouting.ts
new file mode 100644
index 00000000000..b81fdbe34e1
--- /dev/null
+++ b/apps/rush-cli-client/src/earlyRouting.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib.
+
+import * as fs from 'node:fs';
+
+/** Rush commands that the client always runs in-process. `daemon` runs the client's own daemon commands. */
+export const NEVER_DAEMONIZED_COMMANDS: ReadonlySet<string> = new Set([
+  'add',
+  'change',
+  'check',
+  'deploy',
+  'init',
+  'init-autoinstaller',
+  'init-deploy',
+  'link',
+  'publish',
+  'purge',
+  'remove',
+  'scan',
+  'setup',
+  'unlink',
+  'update-autoinstaller',
+  'version',
+  'help',
+  'daemon'
+]);
+
+/**
+ * Rush's global flags that only hide its startup banner, which a daemon request never prints. The client leaves
+ * them out of a daemon request and keeps them for in-process Rush.
+ */
+export const QUIET_FLAGS: ReadonlySet<string> = new Set(['--quiet', '-q']);
+
+/** The environment variables that mark a CI run. */
+export const CI_ENVIRONMENT_VARIABLES: ReadonlyArray<string> = [
+  'CI',
+  'TF_BUILD',
+  'GITHUB_ACTIONS',
+  'JENKINS_URL',
+  'TEAMCITY_VERSION'
+];
+
+/** Returns the first CI marker that is set. In CI, the daemon is off unless RUSH_DAEMON=1. */
+export function getCiEnvironmentVariable(
+  environment: Readonly<Record<string, string | undefined>>
+): string | undefined {
+  return CI_ENVIRONMENT_VARIABLES.find((name) => {
+    const value: string | undefined = environment[name];
+    return value !== undefined && value !== '' && value !== '0' && value !== 'false';
+  });
+}
+
+/**
+ * Whether the daemon is off for this invocation, as far as the client can tell before it loads
+ * `@microsoft/rush-lib`: there is no rush.json, RUSH_DAEMON=0, a CI marker is set without RUSH_DAEMON=1, or
+ * RUSH_DAEMON is not set and rush.json's "daemon" block does not set "enabled" to true. False when it can't tell;
+ * routing then decides. A wrong guess either way is harmless: the progress line is painted after routing, or
+ * painted and then erased.
+ */
+export function isDaemonOffBeforeRouting(
+  environment: Readonly<Record<string, string | undefined>>,
+  rushJsonPath: string | undefined
+): boolean {
+  const optIn: string | undefined = environment.RUSH_DAEMON;
+  if (rushJsonPath === undefined || optIn === '0') {
+    return true;
+  }
+  if (optIn !== '1' && getCiEnvironmentVariable(environment) !== undefined) {
+    return true;
+  }
+  if (optIn !== undefined) {
+    return false;
+  }
+  let contents: string;
+  try {
+    contents = fs.readFileSync(rushJsonPath, 'utf8');
+  } catch {
+    return false;
+  }
+  if (!/"daemon"\s*:/.test(contents)) {
+    return true;
+  }
+  // `rush init` writes the daemon block as comments. A comment marker inside a string only makes the guess wrong.
+  const uncommented: string = contents.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  // The block holds no nested objects.
+  const block: RegExpExecArray | null = /"daemon"\s*:\s*\{([^}]*)\}/.exec(uncommented);
+  return !block || !/"enabled"\s*:\s*true\b/.test(block[1]);
+}
diff --git a/apps/rush-cli-client/src/inProcessFallback.ts b/apps/rush-cli-client/src/inProcessFallback.ts
new file mode 100644
index 00000000000..e57469bd7cf
--- /dev/null
+++ b/apps/rush-cli-client/src/inProcessFallback.ts
@@ -0,0 +1,16 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Formats the stderr lines that say why the client runs a command in-process instead of on the daemon. The first
+ * line of the reason is the fallback line, which starts with `rush-client:` (or the given client name) and ends with
+ * `using in-process Rush.` The other lines of a multi-line reason, such as a warning that the daemon wrote before its
+ * error, follow it as detail lines.
+ */
+export function formatInProcessFallbackMessage(reason: string, clientName: string = 'rush-client'): string {
+  const [firstLine = '', ...details] = reason.split(/\r?\n/).filter((line) => line.trim());
+  // A reason is usually a sentence, or a line that introduces the lines after it; "; using" follows it without the
+  // period or the colon.
+  const fallbackLine: string = `${clientName}: ${firstLine.replace(/[.:]$/, '')}; using in-process Rush.`;
+  return [fallbackLine, ...details.map((line) => `  ${line}`)].map((line) => `${line}\n`).join('');
+}
diff --git a/apps/rush-cli-client/src/inProcessLockWait.ts b/apps/rush-cli-client/src/inProcessLockWait.ts
new file mode 100644
index 00000000000..404a2b82af7
--- /dev/null
+++ b/apps/rush-cli-client/src/inProcessLockWait.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { loadEnvironmentConfiguration } from './lazyRushModules';
+
+/**
+ * How long Rush, when the client runs it in-process after it tried the daemon, waits for another Rush process to
+ * release the repository's lock, instead of failing at once as it does when it runs without the client.
+ */
+export interface IInProcessLockWait {
+  /**
+   * When the request's wait began, in milliseconds since the Unix epoch: when the client sent the request to the
+   * daemon, or, if the client could not reach a daemon, when it gave up on the daemon.
+   */
+  readonly startedAtMs: number;
+  /** The request's admission options, whose wait timeout also ends the wait for the lock. */
+  readonly admission: IDaemonRequestAdmissionOptions | undefined;
+  /** The process ID of the daemon that handed the command back, so that Rush can name it if it holds the lock. */
+  readonly daemonPid: number | undefined;
+}
+
+/**
+ * Returns the time until which Rush waits for the repository's lock: the request's wait timeout after its wait began,
+ * so that the time that the request already waited on the daemon counts. With `--no-wait` or a zero timeout, Rush
+ * tries once, as it does without the client, and names the process that holds the lock.
+ */
+export function getInProcessLockWaitDeadlineMs(wait: IInProcessLockWait): number {
+  const { admission, startedAtMs } = wait;
+  // The client always sends a timeout unless it sends noWait.
+  const waitTimeoutMs: number = admission?.noWait ? 0 : (admission?.waitTimeoutMs ?? 0);
+  return Math.floor(startedAtMs + waitTimeoutMs);
+}
+
+/**
+ * Asks the Rush that the client runs in-process to wait for the repository's lock. Rush reads and removes these
+ * variables when it starts, so its operations do not inherit them. Only the Rush release that the client bundles
+ * reads them.
+ */
+export function setInProcessLockWait(environment: NodeJS.ProcessEnv, wait: IInProcessLockWait): void {
+  const { EnvironmentVariableNames } = loadEnvironmentConfiguration();
+  environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE] = `${getInProcessLockWaitDeadlineMs(wait)}`;
+  if (wait.daemonPid === undefined) {
+    delete environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID];
+  } else {
+    environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID] = `${wait.daemonPid}`;
+  }
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 895c8dd08fe..1266d12ddb7 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -13,30 +13,46 @@ import { JsonFile } from '@rushstack/node-core-library';
 import {
   DaemonClientError,
   captureDaemonRequest,
-  connectOrStartDaemonAsync,
+  connectOrAwaitDaemonStartupAsync,
   executeWithDaemonRestartAsync,
+  reclaimCrashedDaemonAsync,
   type DaemonClient,
   type DaemonClientOutcome,
-  type IConnectOrStartDaemonOptions
+  type IConnectOrStartDaemonOptions,
+  type IDaemonRestartNotice
 } from '@rushstack/rush-client-core';
 import type { DaemonVerbosity, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonTransportError,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
 import { executeDaemonCommandAsync } from './daemonCommands';
-import { formatAdmissionFailure, getConfiguredAdmission } from './ClientAdmissionControls';
+import { getConfiguredAdmission, type ClientName } from './ClientAdmissionControls';
 import { ClientOperationRenderer } from './ClientOperationRenderer';
 import type { AgentProgressRenderer } from './AgentProgressRenderer';
+import { withNativeLockWaitNotices, type INativeLockWaitNoticeHandlers } from './nativeLockWaitNotice';
 import {
   CANCELLATION_SIGNALS,
   formatCancellationMessage,
+  formatCancellingMessage,
+  formatClosedOutputMessage,
   getSignalExitCode,
   isCancelledOutcome
 } from './clientCancellation';
-import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
-import { readUseRushReporter } from './outputSelection';
+import { CLOSED_OUTPUT_EXIT_CODE, ClientOutput, type ClientOutputStream } from './clientOutput';
+import { getDaemonConnectionOptionsAsync, getDaemonPaths } from './daemonConnectionOptions';
+import { readUseRushReporter, selectClientOutputMode } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
-import { getResultDiagnostic } from './resultDiagnostics';
-import { writeStreamAsync } from './writeStreamAsync';
+import { getResultStderr } from './resultDiagnostics';
+import { createDaemonLivenessOptions } from './daemonSilence';
+import { getTerminalColumns } from './terminalColumns';
+import { createDaemonRequestNoticeHandlers, explainDaemonRestartFailure } from './daemonRestartNotice';
+import { formatInProcessFallbackMessage } from './inProcessFallback';
+import { setInProcessLockWait, type IInProcessLockWait } from './inProcessLockWait';
+import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
 import {
   getBundledRushVersion,
   loadMinimalRushConfiguration,
@@ -49,9 +65,22 @@ interface IWorkspaceJson {
   readonly daemon?: IDaemonConfigurationJson;
 }
 
+/** Socket errors that end a connection. The daemon client passes them on unchanged. */
+const CONNECTION_ERROR_CODES: ReadonlySet<string | undefined> = new Set(['ECONNRESET', 'EPIPE']);
+
+/** Whether an error says that the connection to the daemon failed or closed. */
+export function isConnectionFailure(error: unknown): boolean {
+  return (
+    error instanceof DaemonClientError ||
+    error instanceof DaemonTransportError ||
+    (error instanceof Error && CONNECTION_ERROR_CODES.has((error as NodeJS.ErrnoException).code))
+  );
+}
+
 export async function launchClientAsync(
   rushx: boolean,
-  agentRenderer?: AgentProgressRenderer
+  agentRenderer?: AgentProgressRenderer,
+  output: ClientOutput = new ClientOutput()
 ): Promise<void> {
   const cwd: string = process.cwd();
   const environment: Readonly<NodeJS.ProcessEnv> = Object.freeze({ ...process.env });
@@ -61,18 +90,22 @@ export async function launchClientAsync(
     workspace?.daemon,
     environment
   );
+  const argv: ReadonlyArray<string> = process.argv.slice(2);
+  const useRushReporter: boolean = !rushx && !!rushJsonPath && readUseRushReporter(rushJsonPath);
+  const clientName: ClientName = rushx ? 'rushx-client' : 'rush-client';
   const route: IClientRoute = selectClientRoute({
-    argv: process.argv.slice(2),
+    argv,
     environment,
     enabled: config.enabled,
     rushx,
     hasTerminal: !!(process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY),
-    useRushReporter: !rushx && !!rushJsonPath && readUseRushReporter(rushJsonPath)
+    useRushReporter
   });
   const selectedVersion: string =
     environment.RUSH_PREVIEW_VERSION ?? workspace?.rushVersion ?? getBundledRushVersion();
   if (!rushx && route.commandName === 'daemon') {
     agentRenderer?.dispose();
+    output.release();
     if ((route.argv[1] === 'start' || route.argv[1] === 'restart') && process.argv.includes('--no-daemon')) {
       throw new Error(`--no-daemon cannot be combined with daemon ${route.argv[1]}.`);
     }
@@ -81,6 +114,7 @@ export async function launchClientAsync(
       environment,
       rushJsonPath,
       rushVersion: selectedVersion,
+      daemonConfiguration: { enabled: config.enabled, autoStart: config.autoStart },
       admission:
         route.argv[1] === 'graph'
           ? (route.admission ?? { waitTimeoutMs: Math.floor(config.queueTimeoutSeconds * 1000) })
@@ -90,9 +124,22 @@ export async function launchClientAsync(
   }
   if (!route.daemon || !rushJsonPath || route.commandName === undefined) {
     agentRenderer?.dispose();
-    launchInProcess(route.argv, rushx, selectedVersion);
+    output.release();
+    // Agent output says why a command runs in-process; legacy output, which rushx-client always uses, says so only
+    // when RUSH_DAEMON=1 asked for the daemon.
+    if (
+      route.inProcessReason !== undefined &&
+      rushJsonPath &&
+      (environment.RUSH_DAEMON === '1' ||
+        (!rushx && selectClientOutputMode({ argv, environment, useRushReporter }) === 'agent'))
+    ) {
+      process.stderr.write(formatInProcessFallbackMessage(route.inProcessReason, clientName));
+    }
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
     return;
   }
+  // start.ts skips the progress line when it guesses that the daemon is off; routing decides.
+  agentRenderer?.start();
   const terminal: ConsoleTerminalProvider = new ConsoleTerminalProvider();
   const verbosity: DaemonVerbosity =
     route.argv.includes('--verbose') || route.argv.includes('-v')
@@ -107,12 +154,14 @@ export async function launchClientAsync(
     commandOrigin:
       !rushx && ['build', 'rebuild', 'install', 'update'].includes(route.commandName) ? 'built-in' : 'custom',
     invocationKind: rushx ? 'rushx' : 'rush',
+    // An agent acts on a failure as soon as it is known; the daemon finishes the independent work without it.
+    ...(agentRenderer ? { returnEarlyOnFailure: true } : {}),
     cwd,
     environment,
     terminal: {
       isTTY: !!process.stdout.isTTY,
       supportsColor: terminal.supportsColor,
-      columns: process.stdout.columns,
+      columns: getTerminalColumns(process.stdout),
       acceptsStdin: true
     },
     admission:
@@ -134,14 +183,33 @@ export async function launchClientAsync(
         request.environment,
         config.autoStart
       )),
+      // A request never reports the warm set, which in a large repo is most of the daemon's ready reply.
+      omitWarmSetStatus: true,
       capabilities: {
         isTTY: request.terminal.isTTY,
         columns: request.terminal.columns,
         colorLevel: terminal.supportsColor ? 1 : 0,
         verbosity
-      }
+      },
+      // A reclaim before a start, or after the daemon exited during the command, says what it stopped.
+      onOrphansReaped: createOrphanReapNoticeHandler({ rushx, agentRenderer, writeStderr })
     };
-    client = await connectOrStartDaemonAsync(connection);
+    // While a live daemon or starter can still make the daemon ready, a startup failure rejects with a
+    // DaemonStartupPendingError, which is not a DaemonClientError, so Rush does not run in-process next to it.
+    client = await connectOrAwaitDaemonStartupAsync({
+      ...connection,
+      onAwaitStartup: (owner: string, waitMs: number): void => {
+        if (agentRenderer) {
+          agentRenderer.onAwaitStartup(waitMs, owner);
+          return;
+        }
+        const seconds: number = Math.round(waitMs / 1000);
+        process.stderr.write(
+          `${clientName}: The daemon is not ready yet. ${owner}, so this command waits up to ${seconds} s ` +
+            'more for it instead of running Rush in-process.\n'
+        );
+      }
+    });
   } catch (error) {
     if (
       !(error instanceof DaemonClientError) &&
@@ -149,39 +217,77 @@ export async function launchClientAsync(
     )
       throw error;
     agentRenderer?.dispose();
-    process.stderr.write(`rush-client: ${error.message} Using in-process Rush.\n`);
-    launchInProcess(route.argv, rushx, selectedVersion);
+    output.release();
+    process.stderr.write(formatInProcessFallbackMessage(error.message, clientName));
+    // No daemon admitted the request, so its whole wait timeout is left.
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath, {
+      startedAtMs: Date.now(),
+      admission: request.admission,
+      daemonPid: undefined
+    });
     return;
   }
   const abort: AbortController = new AbortController();
+  const commandName: string = route.commandName;
   let cancellationSignal: NodeJS.Signals | undefined;
+  // Whether the client asked the daemon to cancel the request: after a signal, or a raw Ctrl+C, which raises none.
+  let cancelRequested: boolean = false;
+  // The output stream whose reader exited while the request ran, when nothing else had cancelled it first.
+  let closedOutput: ClientOutputStream | undefined;
   // Windows test harnesses emit signals without a name; treat those as Ctrl+C.
   const onSignal = (signal?: NodeJS.Signals): void => {
     cancellationSignal ??= signal ?? 'SIGINT';
     abort.abort();
   };
+  let notices: INativeLockWaitNoticeHandlers | undefined;
+  const onCancelRequested = (timeoutMs: number): void => {
+    cancelRequested = true;
+    // A line that the request still waits for a daemon restart would contradict the cancelling line.
+    notices?.dispose();
+    if (agentRenderer) {
+      agentRenderer.onCancelRequested(timeoutMs);
+      return;
+    }
+    // One line, written once the request stops, says why it was cancelled.
+    if (closedOutput) return;
+    // After SIGHUP the terminal may be gone.
+    output.stderr
+      .writeAsync(Buffer.from(formatCancellingMessage(commandName, timeoutMs, clientName)))
+      .catch(() => undefined);
+  };
+  const isCancelled = (): boolean => abort.signal.aborted || cancelRequested;
+  // A reader that exits (for example `| head`) cancels the request, as SIGPIPE stops a native command.
+  const onOutputClosed = (stream: ClientOutputStream): void => {
+    if (!isCancelled()) closedOutput = stream;
+    abort.abort();
+  };
   for (const signal of CANCELLATION_SIGNALS) process.on(signal, onSignal);
+  const removeOutputListener: () => void = output.onClosed(onOutputClosed);
   const renderer: ClientOperationRenderer = new ClientOperationRenderer({
     requestId: request.requestId,
     colorLevel: terminal.supportsColor ? 1 : 0,
     verbosity,
     terminal: {
       get columns() {
-        return process.stdout.columns ?? 80;
+        return getTerminalColumns(process.stdout) ?? 80;
       },
       get isTTY() {
         return !!process.stdout.isTTY;
       }
     },
-    writeAsync: (bytes, stream) =>
-      writeStreamAsync(stream === 'stderr' ? process.stderr : process.stdout, bytes)
+    writeAsync: (bytes, stream) => (stream === 'stderr' ? output.stderr : output.stdout).writeAsync(bytes)
   });
   let outcome: DaemonClientOutcome | undefined;
+  // If the daemon hands the request back, Rush waits in-process for the repository's lock only for what is left of
+  // the request's wait timeout, which counts from here.
+  const requestStartedAtMs: number = Date.now();
+  // After a restart, the daemon that the request followed it to hands the request back, not the first one.
+  const restarts: IDaemonRestartNotice[] = [];
   let restartFailure: DaemonClientError | undefined;
   const discoveryLines: string[] = [];
   const writeDiscoveryAsync = async (): Promise<void> => {
     if (discoveryLines.length > 0) {
-      await writeStreamAsync(process.stdout, Buffer.from(discoveryLines.splice(0).join('\n') + '\n'));
+      await output.stdout.writeAsync(Buffer.from(discoveryLines.splice(0).join('\n') + '\n'));
     }
   };
   try {
@@ -191,34 +297,53 @@ export async function launchClientAsync(
       );
     }
     await renderer.initializeAsync();
-    agentRenderer?.setPhase('request submitted; preparing the workspace graph');
+    agentRenderer?.onRequestSent();
+    const writeStderrAsync = (text: string): Promise<void> => output.stderr.writeAsync(Buffer.from(text));
+    const requestNotices: INativeLockWaitNoticeHandlers = withNativeLockWaitNotices(
+      createDaemonRequestNoticeHandlers({
+        rushx,
+        agentRenderer,
+        stderrIsTTY: !!process.stderr.isTTY,
+        daemonPid: (await client.status).pid,
+        writeStderrAsync
+      }),
+      { rushx, agentRenderer, writeStderrAsync }
+    );
+    notices = requestNotices;
     outcome = await executeWithDaemonRestartAsync(client, connection, {
       request,
       abortSignal: abort.signal,
       onStdoutAsync: async (bytes, operationId) => {
+        requestNotices.onRequestProgress();
         if (agentRenderer) return agentRenderer.onLog(bytes, operationId, 'stdout');
         await writeDiscoveryAsync();
         await renderer.writeLogAsync(bytes, operationId, 'stdout');
       },
       onStderrAsync: async (bytes, operationId) => {
+        requestNotices.onRequestProgress();
         if (agentRenderer) return agentRenderer.onLog(bytes, operationId, 'stderr');
         await writeDiscoveryAsync();
         await renderer.writeLogAsync(bytes, operationId, 'stderr');
       },
-      onEventAsync: async (event) =>
-        agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event),
-      onQueuePositionAsync: agentRenderer
-        ? async (position) => agentRenderer.onQueuePosition(position)
-        : process.stderr.isTTY
-        ? (position) =>
-            writeStreamAsync(
-              process.stderr,
-              Buffer.from(`rush-client: waiting for daemon admission (position ${position}).\n`)
-            )
-        : undefined,
+      onEventAsync: async (event) => {
+        requestNotices.onRequestProgress();
+        return agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event);
+      },
+      onRestartAsync: async (notice) => {
+        restarts.push(notice);
+        await requestNotices.onRestartAsync(notice);
+      },
+      onQueuePositionAsync: requestNotices.onQueuePositionAsync,
+      onInputAdmittedAsync: requestNotices.onInputAdmittedAsync,
       stdin: process.stdin,
       requiresStdinEnd: !process.stdin.isTTY,
       cancelOnCtrlC: !!process.stdin.isTTY,
+      onCancelRequested,
+      liveness: createDaemonLivenessOptions({
+        rushx,
+        agentRenderer,
+        writeStderrAsync: (text) => output.stderr.writeAsync(Buffer.from(text))
+      }),
       initialRawMode: !!process.stdin.isRaw,
       setRawMode: process.stdin.isTTY
         ? (enabled) => {
@@ -227,16 +352,20 @@ export async function launchClientAsync(
         : undefined
     });
   } catch (error) {
-    if (!(error instanceof DaemonClientError)) throw error;
-    if (!abort.signal.aborted) {
+    if (isCancelled()) {
+      // After cancellation, a connection failure (e.g. at the cancellation deadline) still means "cancelled".
+      if (!isConnectionFailure(error)) throw explainDaemonRestartFailure(error);
+    } else if (error instanceof DaemonClientError && error.code === 'startupFailed') {
       // A restart handoff fails only before the request executes, so in-process fallback cannot replay work.
-      if (error.code !== 'startupFailed') throw error;
       restartFailure = error;
+    } else {
+      throw explainDaemonRestartFailure(error);
     }
-    // After cancellation, a transport failure (e.g. the cancellation deadline) still means "cancelled".
     outcome = undefined;
   } finally {
+    notices?.dispose();
     for (const signal of CANCELLATION_SIGNALS) process.removeListener(signal, onSignal);
+    removeOutputListener();
     try {
       await renderer.closeAsync();
     } finally {
@@ -244,42 +373,121 @@ export async function launchClientAsync(
     }
   }
   if (restartFailure) {
+    const explained: unknown = explainDaemonRestartFailure(restartFailure);
     agentRenderer?.dispose();
-    process.stderr.write(`rush-client: ${restartFailure.message} Using in-process Rush.\n`);
-    launchInProcess(route.argv, rushx, selectedVersion);
+    output.release();
+    process.stderr.write(
+      formatInProcessFallbackMessage(
+        explained instanceof Error ? explained.message : String(explained),
+        clientName
+      )
+    );
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath, {
+      startedAtMs: requestStartedAtMs,
+      admission: request.admission,
+      daemonPid: restarts.length > 0 ? restarts[restarts.length - 1].successorPid : (await client.status).pid
+    });
     return;
   }
-  if (outcome === undefined || isCancelledOutcome(outcome, abort.signal.aborted)) {
-    const exitCode: number = getSignalExitCode(cancellationSignal ?? 'SIGINT');
-    agentRenderer?.finish({ exitCode, errorMessage: 'cancelled' });
-    process.exitCode = exitCode;
-    // After SIGHUP the terminal may be gone; the exit code is what matters.
-    await writeStreamAsync(process.stderr, Buffer.from(formatCancellationMessage(route.commandName))).catch(
-      () => undefined
+  if (outcome === undefined || isCancelledOutcome(outcome, isCancelled())) {
+    const exitCode: number = closedOutput
+      ? CLOSED_OUTPUT_EXIT_CODE
+      : getSignalExitCode(cancellationSignal ?? 'SIGINT');
+    // The client stopped waiting (at the cancellation deadline, or when the connection closed) before the daemon
+    // confirmed that the request stopped. The daemon also cancels a request whose client disconnects.
+    const stopUnconfirmed: boolean = outcome === undefined && cancelRequested;
+    agentRenderer?.finish(
+      outcome?.kind === 'result'
+        ? { ...outcome.result, exitCode, cancelled: true }
+        : { exitCode, cancelled: true, stopUnconfirmed }
     );
+    process.exitCode = exitCode;
+    // After SIGHUP the terminal may be gone; the exit code is what matters. Agent output's summary line already
+    // says whether the daemon confirmed the stop, unless its reader exited: then this line is the only report.
+    await output.stderr
+      .writeAsync(
+        Buffer.from(
+          closedOutput
+            ? formatClosedOutputMessage(
+                commandName,
+                closedOutput.name,
+                closedOutput.closedCode,
+                stopUnconfirmed,
+                clientName
+              )
+            : formatCancellationMessage(commandName, stopUnconfirmed && !agentRenderer, clientName)
+        )
+      )
+      .catch(() => undefined);
   } else if (outcome.kind === 'result') {
-    agentRenderer?.finish(outcome.result);
+    // In agent mode the summary line may already carry the complete error message; do not repeat it.
+    const reportedByAgent: boolean = agentRenderer?.finish(outcome.result) ?? false;
     process.exitCode = outcome.result.exitCode;
-    const diagnostic: string | undefined = getResultDiagnostic(outcome.result);
-    if (diagnostic) {
-      await writeStreamAsync(process.stderr, Buffer.from(diagnostic));
-    } else if (outcome.result.admissionErrorCode) {
-      await writeStreamAsync(
-        process.stderr,
-        Buffer.from(formatAdmissionFailure(outcome.result.admissionErrorCode, request.admission))
-      );
+    // Like native Rush, legacy output prints the usage of a command whose command line is invalid before the error.
+    // Agent output leaves it out: its summary line names the invalid argument.
+    if (!agentRenderer && outcome.result.usage) {
+      await output.stdout.writeAsync(Buffer.from(outcome.result.usage));
+    }
+    // When the agent summary line explains the failure, nothing more is printed.
+    const stderr: string | undefined = reportedByAgent
+      ? undefined
+      : getResultStderr(outcome.result, request.admission, clientName);
+    if (stderr) {
+      await output.stderr.writeAsync(Buffer.from(stderr));
     }
   } else if (outcome.kind === 'rejected') {
-    agentRenderer?.finish({ exitCode: 1, errorMessage: `daemon rejected the request (${outcome.rejection.code})` });
-    throw new Error(`Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`);
+    const message: string = `Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`;
+    agentRenderer?.finish({ exitCode: 1, errorMessage: message });
+    throw new Error(message);
   } else {
     agentRenderer?.dispose();
-    process.stderr.write(`rush-client: ${outcome.message ?? outcome.reason}; using in-process Rush.\n`);
-    launchInProcess(route.argv, rushx, selectedVersion);
+    output.release();
+    process.stderr.write(formatInProcessFallbackMessage(outcome.message ?? outcome.reason, clientName));
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath, {
+      startedAtMs: requestStartedAtMs,
+      admission: request.admission,
+      daemonPid: restarts.length > 0 ? restarts[restarts.length - 1].successorPid : (await client.status).pid
+    });
   }
 }
 
-function launchInProcess(argv: ReadonlyArray<string>, rushx: boolean, selectedVersion: string): void {
+/**
+ * Runs Rush in-process. A daemon that crashed while it ran a command can leave its operations running, and
+ * they could overwrite this command's outputs, so they are stopped first, as the next daemon start would.
+ */
+async function launchInProcessAsync(
+  argv: ReadonlyArray<string>,
+  rushx: boolean,
+  selectedVersion: string,
+  rushJsonPath: string | undefined,
+  lockWait?: IInProcessLockWait
+): Promise<void> {
+  if (rushJsonPath) {
+    let paths: IDaemonPaths | undefined;
+    try {
+      paths = getDaemonPaths(path.dirname(rushJsonPath), selectedVersion);
+    } catch {
+      // Without the daemon's folder there is nothing to reclaim; Rush reports a workspace problem itself.
+    }
+    if (paths) {
+      // Any agent renderer was disposed before Rush runs in-process.
+      const onOrphansReaped: (reap: IDaemonOrphanReap) => void = createOrphanReapNoticeHandler({
+        rushx,
+        agentRenderer: undefined,
+        writeStderr
+      });
+      await reclaimCrashedDaemonAsync(paths, { onOrphansReaped });
+    }
+  }
+  launchInProcess(argv, rushx, selectedVersion, lockWait);
+}
+
+function launchInProcess(
+  argv: ReadonlyArray<string>,
+  rushx: boolean,
+  selectedVersion: string,
+  lockWait: IInProcessLockWait | undefined
+): void {
   const executable: string = rushx ? 'rushx' : 'rush';
   const rushFolder: string = path.dirname(require.resolve('@microsoft/rush/package.json'));
   process.argv = [process.execPath, path.join(rushFolder, 'bin', executable), ...argv];
@@ -289,6 +497,10 @@ function launchInProcess(argv: ReadonlyArray<string>, rushx: boolean, selectedVe
     for (const name of [...Object.values(daemonEnvironmentVariables), 'RUSH_DAEMON_EXPERIMENTAL']) {
       delete process.env[name];
     }
+  } else if (lockWait && !rushx) {
+    // Rush waits for the repository's lock as the daemon would have. Other releases would pass the variables on to
+    // their operations instead of removing them.
+    setInProcessLockWait(process.env, lockWait);
   }
   require('@microsoft/rush/lib/start');
 }
diff --git a/apps/rush-cli-client/src/lazyRushModules.ts b/apps/rush-cli-client/src/lazyRushModules.ts
index d10c8774de9..6469b737107 100644
--- a/apps/rush-cli-client/src/lazyRushModules.ts
+++ b/apps/rush-cli-client/src/lazyRushModules.ts
@@ -8,6 +8,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import type * as RushLibModule from '@microsoft/rush-lib';
+import type * as EnvironmentConfigurationModule from '@microsoft/rush-lib/lib/api/EnvironmentConfiguration';
 import type * as MinimalRushConfigurationModule from '@microsoft/rush/lib/MinimalRushConfiguration';
 import type * as VersionSelectedDaemonLauncherModule from '@rushstack/rush-daemon/lib/VersionSelectedDaemonLauncher';
 
@@ -15,6 +16,10 @@ export function loadRushLib(): typeof RushLibModule {
   return require('@microsoft/rush-lib');
 }
 
+export function loadEnvironmentConfiguration(): typeof EnvironmentConfigurationModule {
+  return require('@microsoft/rush-lib/lib/api/EnvironmentConfiguration');
+}
+
 export function loadMinimalRushConfiguration(): typeof MinimalRushConfigurationModule {
   return require('@microsoft/rush/lib/MinimalRushConfiguration');
 }
diff --git a/apps/rush-cli-client/src/nativeLockWaitNotice.ts b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
new file mode 100644
index 00000000000..7dd6ec74da4
--- /dev/null
+++ b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
@@ -0,0 +1,160 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatNativeLockHolder, type IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
+import type {
+  DaemonRestartReason,
+  IDaemonContinuingOperations,
+  IDaemonNativeLockHolder
+} from '@rushstack/rush-daemon-protocol';
+
+import type { IDaemonRequestNoticeHandlers } from './daemonRestartNotice';
+
+/** A request that waits for another Rush process says so again when it has written nothing about it for this long. */
+export const NATIVE_LOCK_WAIT_REPEAT_MS: number = 10_000;
+
+/**
+ * Says what a request waits for while a Rush process that the daemon does not run holds the repository's lock, for
+ * example "waiting for another Rush process (PID 41: rush install) to release this repository's lock", and from a
+ * second on, "still waiting after 10s for another Rush process (PID 41: rush install) to release ...".
+ */
+export function formatNativeLockWait(holder: IDaemonNativeLockHolder, elapsedMs: number = 0): string {
+  const waiting: string =
+    elapsedMs < 1000 ? 'waiting' : `still waiting after ${Math.round(elapsedMs / 1000)}s`;
+  return `${waiting} for ${formatNativeLockHolder(holder)} to release this repository's lock`;
+}
+
+/** Where the lines of {@link withNativeLockWaitNotices} go. */
+export interface INativeLockWaitNoticeTarget {
+  readonly rushx: boolean;
+  /** See `AgentProgressRenderer.onRestartWait`, which shows any wait of a request that is not a queue position. */
+  readonly agentRenderer: { onRestartWait(wait: string, announce: boolean): unknown } | undefined;
+  readonly writeStderrAsync: (text: string) => Promise<void>;
+  /** Returns the current time in milliseconds. Defaults to `Date.now`. */
+  readonly now?: () => number;
+}
+
+/**
+ * A request's notice handlers, whose queue positions can say that it waits for native Rush's repository lock. Their
+ * queue positions take the arguments of `IDaemonClientExecuteOptions.onQueuePositionAsync`.
+ */
+export interface INativeLockWaitNoticeHandlers
+  extends Omit<IDaemonRequestNoticeHandlers, 'onQueuePositionAsync' | 'onAgentWaitShown'> {
+  readonly onQueuePositionAsync: (
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails,
+    nativeLockHolder?: IDaemonNativeLockHolder,
+    continuingOperations?: IDaemonContinuingOperations
+  ) => Promise<void>;
+}
+
+interface INativeLockWaitState {
+  readonly startedAtMs: number;
+  holder: IDaemonNativeLockHolder;
+  /** Identifies the process that the last line named. */
+  key: string;
+  timer: ReturnType<typeof setTimeout> | undefined;
+}
+
+/**
+ * Adds to a request's notice `handlers` the lines that say that the request waits for a Rush process that the daemon
+ * does not run to release the repository's lock, and which process that is.
+ *
+ * @remarks
+ * Without an agent renderer, a terminal and a pipe get a line at once and whenever another process holds the lock,
+ * and the line again with the time waited when {@link NATIVE_LOCK_WAIT_REPEAT_MS} passes without one. An agent
+ * renderer shows the wait as its phase instead, which its status lines repeat, and announces each process on a pipe;
+ * a restart then replaces the phase, as after a restart wait.
+ * The wait ends when the request gets another queue position, restarts, gets input, output or an event, or ends.
+ * The other notices are the ones that `handlers` gives.
+ */
+export function withNativeLockWaitNotices(
+  handlers: IDaemonRequestNoticeHandlers,
+  target: INativeLockWaitNoticeTarget
+): INativeLockWaitNoticeHandlers {
+  const { agentRenderer, now = Date.now } = target;
+  const prefix: string = target.rushx ? 'rushx-client' : 'rush-client';
+  let wait: INativeLockWaitState | undefined;
+  let disposed: boolean = false;
+
+  const endWait = (): void => {
+    clearTimeout(wait?.timer);
+    wait = undefined;
+  };
+  const writeWaitAsync = async (state: INativeLockWaitState): Promise<void> => {
+    clearTimeout(state.timer);
+    state.timer = setTimeout(() => {
+      if (wait === state) writeWaitAsync(state).catch(() => undefined);
+    }, NATIVE_LOCK_WAIT_REPEAT_MS);
+    state.timer.unref?.();
+    const line: string = formatNativeLockWait(state.holder, now() - state.startedAtMs);
+    await target.writeStderrAsync(`${prefix}: ${line}.\n`);
+  };
+
+  return {
+    onRestartAsync: async (notice) => {
+      endWait();
+      await handlers.onRestartAsync(notice);
+    },
+    onQueuePositionAsync: async (
+      position,
+      restartReason,
+      restartWait,
+      nativeLockHolder,
+      continuingOperations
+    ) => {
+      if (!nativeLockHolder || restartReason) {
+        endWait();
+        return await handlers.onQueuePositionAsync(
+          position,
+          restartReason,
+          restartWait,
+          continuingOperations
+        );
+      }
+      if (disposed) return;
+      // This ends a wait for a daemon restart, if the request waited for one; it waits for the lock instead.
+      handlers.onRequestProgress();
+      const key: string = `${nativeLockHolder.pid}:${nativeLockHolder.command}`;
+      if (wait?.key === key || isSameProcessWithoutCommand(wait?.holder, nativeLockHolder)) return;
+      const state: INativeLockWaitState = (wait ??= {
+        startedAtMs: now(),
+        holder: nativeLockHolder,
+        key,
+        timer: undefined
+      });
+      state.holder = nativeLockHolder;
+      state.key = key;
+      if (agentRenderer) {
+        agentRenderer.onRestartWait(formatNativeLockWait(nativeLockHolder), true);
+        // So that a restart replaces the phase, which names a process that only the previous daemon reported.
+        handlers.onAgentWaitShown();
+      } else await writeWaitAsync(state);
+    },
+    onInputAdmittedAsync: async () => {
+      endWait();
+      await handlers.onInputAdmittedAsync();
+    },
+    onRequestProgress: () => {
+      endWait();
+      handlers.onRequestProgress();
+    },
+    dispose: () => {
+      disposed = true;
+      endWait();
+      handlers.dispose();
+    }
+  };
+}
+
+/**
+ * Whether `found` is the process that `named` names, but without its command. A process's command can no longer be
+ * read once it exits, yet it holds the lock until it is reaped, so the daemon can report it once more that way.
+ */
+function isSameProcessWithoutCommand(
+  named: IDaemonNativeLockHolder | undefined,
+  found: IDaemonNativeLockHolder
+): boolean {
+  return found.pid !== undefined && found.command === undefined && named?.pid === found.pid;
+}
diff --git a/apps/rush-cli-client/src/outputSelection.ts b/apps/rush-cli-client/src/outputSelection.ts
index cc5bce489c6..42fbfe413d8 100644
--- a/apps/rush-cli-client/src/outputSelection.ts
+++ b/apps/rush-cli-client/src/outputSelection.ts
@@ -6,6 +6,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { NEVER_DAEMONIZED_COMMANDS, QUIET_FLAGS } from './earlyRouting';
+
 /** Environment variable that selects the rush-client output mode: `agent` or `legacy`. */
 export const RUSHD_OUTPUT_ENV_VAR: 'RUSHD_OUTPUT' = 'RUSHD_OUTPUT';
 
@@ -14,6 +16,10 @@ export const RUSHD_OUTPUT_ENV_VAR: 'RUSHD_OUTPUT' = 'RUSHD_OUTPUT';
  * `detectAgent()` in `@rushstack/reporter` (libraries/reporter/src/config/AgentDetection.ts).
  */
 const AGENT_MARKERS: readonly string[] = ['COPILOT_CLI'];
+
+/** Every environment variable that `selectClientOutputMode()` reads to choose between agent and legacy output. */
+export const CLIENT_OUTPUT_SELECTION_ENV_VARS: readonly string[] = [RUSHD_OUTPUT_ENV_VAR, ...AGENT_MARKERS];
+
 const INACTIVE_VALUES: ReadonlySet<string> = new Set(['', '0', 'false', 'no', 'off']);
 const NATIVE_REPORTER_FLAGS: readonly string[] = ['--reporter', '--output', '--log-level'];
 
@@ -33,7 +39,8 @@ export function isNativeReporterEnvironmentRequested(value: string | undefined):
 
 /**
  * Returns the command name for early agent output, or undefined when the invocation has no plain
- * command (a leading option, `--help`/`-h`, or `daemon`). Daemon admission controls (`--no-wait`,
+ * command that the daemon could run (a leading option other than `--quiet`/`-q`, `--help`/`-h`, or a command
+ * that always runs in-process, such as `daemon` or `check`). Daemon admission controls (`--no-wait`,
  * `--wait-timeout SECONDS`) are skipped like `parseClientAdmissionControls()`, which is not imported
  * here to avoid loading `@rushstack/rush-daemon-protocol` before the first line; invalid controls
  * are reported later by the full parser.
@@ -48,11 +55,11 @@ export function getAgentCommandName(argv: ReadonlyArray<string>): string | undef
       remaining.push(arg);
     }
   }
-  const commandName: string | undefined = remaining[0];
+  const commandName: string | undefined = remaining.find((arg) => !QUIET_FLAGS.has(arg));
   if (
     commandName === undefined ||
     commandName.startsWith('-') ||
-    commandName === 'daemon' ||
+    NEVER_DAEMONIZED_COMMANDS.has(commandName) ||
     remaining.includes('--help') ||
     remaining.includes('-h')
   ) {
diff --git a/apps/rush-cli-client/src/resultDiagnostics.ts b/apps/rush-cli-client/src/resultDiagnostics.ts
index e65be243645..9a012c5309b 100644
--- a/apps/rush-cli-client/src/resultDiagnostics.ts
+++ b/apps/rush-cli-client/src/resultDiagnostics.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonCommandResult, IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { formatAdmissionFailure, type ClientName } from './ClientAdmissionControls';
 
 /**
  * Returns the stderr line that explains a failed daemon result, if any.
@@ -13,13 +15,31 @@ import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
  * explains.
  */
 export function getResultDiagnostic(
-  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>
+  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>,
+  clientName: ClientName = 'rush-client'
 ): string | undefined {
   // A request aborted while waiting for admission carries the reason (such as a daemon shutdown) in its
   // error message; other admission failures are explained by `formatAdmissionFailure`.
   if (result.admissionErrorCode !== undefined && result.admissionErrorCode !== 'aborted') return undefined;
   if (result.exitCode !== 0 && result.errorMessage) {
-    return `rush-client: ${result.errorMessage}\n`;
+    return `${clientName}: ${result.errorMessage}\n`;
   }
   return undefined;
 }
+
+/**
+ * Returns the stderr text that explains a daemon result when no agent summary line explains it, if any.
+ *
+ * @remarks
+ * An admission failure is explained with the daemon's reason when it sent one, so that the text names what
+ * the request waited for, such as a daemon restart.
+ */
+export function getResultStderr(
+  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>,
+  admission: IDaemonRequestAdmissionOptions | undefined,
+  clientName: ClientName = 'rush-client'
+): string | undefined {
+  const diagnostic: string | undefined = getResultDiagnostic(result, clientName);
+  if (diagnostic || !result.admissionErrorCode) return diagnostic;
+  return formatAdmissionFailure(result.admissionErrorCode, admission, result.errorMessage, clientName);
+}
diff --git a/apps/rush-cli-client/src/routing.ts b/apps/rush-cli-client/src/routing.ts
index b9f8c52f84d..2e6b6547f7f 100644
--- a/apps/rush-cli-client/src/routing.ts
+++ b/apps/rush-cli-client/src/routing.ts
@@ -6,29 +6,9 @@ import type { IRushXCommandLineArguments } from '@microsoft/rush-lib';
 
 import { loadRushLib } from './lazyRushModules';
 import { parseClientAdmissionControls, type IClientAdmissionControls } from './ClientAdmissionControls';
+import { getCiEnvironmentVariable, NEVER_DAEMONIZED_COMMANDS, QUIET_FLAGS } from './earlyRouting';
 import { isNativeReporterEnvironmentRequested } from './outputSelection';
 
-const neverDaemonize: ReadonlySet<string> = new Set([
-  'add',
-  'change',
-  'check',
-  'deploy',
-  'init',
-  'init-autoinstaller',
-  'init-deploy',
-  'link',
-  'publish',
-  'purge',
-  'remove',
-  'scan',
-  'setup',
-  'unlink',
-  'update-autoinstaller',
-  'version',
-  'help',
-  'daemon'
-]);
-
 export interface IClientRouteOptions {
   readonly argv: ReadonlyArray<string>;
   readonly environment: Readonly<Record<string, string | undefined>>;
@@ -40,47 +20,93 @@ export interface IClientRouteOptions {
 }
 
 export interface IClientRoute {
+  /** The arguments of a daemon request. They leave out leading `--quiet` flags, which only native Rush uses. */
   readonly argv: ReadonlyArray<string>;
+  /** The arguments for in-process Rush: all but the client's own options. */
+  readonly nativeArgv: ReadonlyArray<string>;
   readonly daemon: boolean;
   readonly commandName: string | undefined;
   readonly admission: IDaemonRequestAdmissionOptions | undefined;
+  /**
+   * Why the command runs in-process instead of on the daemon. Absent for a daemon request, and when the
+   * invocation asks for in-process Rush or native Rush explains itself: `--no-daemon`, help, or no command.
+   */
+  readonly inProcessReason?: string;
 }
 
+const NATIVE_REPORTER_FLAGS: ReadonlyArray<string> = ['--reporter', '--output', '--log-level'];
+
 /** Routing never parses action parameters or relabels a custom command as a built-in. */
 export function selectClientRoute(options: IClientRouteOptions): IClientRoute {
   const controls: IClientAdmissionControls = parseClientAdmissionControls(options.argv);
   const separator: number = controls.argv.indexOf('--');
   const prefix: ReadonlyArray<string> = separator < 0 ? controls.argv : controls.argv.slice(0, separator);
   const noDaemon: boolean = prefix.includes('--no-daemon');
-  const argv: ReadonlyArray<string> = [
+  const nativeArgv: ReadonlyArray<string> = [
     ...prefix.filter((arg) => arg !== '--no-daemon'),
     ...(separator < 0 ? [] : controls.argv.slice(separator))
   ];
+  let quietFlags: number = 0;
+  while (!options.rushx && QUIET_FLAGS.has(nativeArgv[quietFlags])) quietFlags++;
+  const argv: ReadonlyArray<string> = nativeArgv.slice(quietFlags);
   const rushxArguments: IRushXCommandLineArguments | undefined = options.rushx
     ? loadRushLib().RushXCommand.parseArguments(argv, options.environment)
     : undefined;
-  const commandName: string | undefined = rushxArguments ? rushxArguments.commandName || undefined : argv[0];
-  const reporterControls: boolean =
-    options.environment.RUSH_LOG_LEVEL !== undefined ||
-    isNativeReporterEnvironmentRequested(options.environment.RUSH_REPORTER) ||
-    (!options.rushx &&
-      prefix.some((arg) =>
-        ['--reporter', '--output', '--log-level'].some((name) => arg === name || arg.startsWith(`${name}=`))
-      )) ||
-    (!options.rushx && !!options.useRushReporter);
-  const ci: boolean = ['CI', 'TF_BUILD', 'GITHUB_ACTIONS', 'JENKINS_URL', 'TEAMCITY_VERSION'].some((key) => {
-    const value: string | undefined = options.environment[key];
-    return value !== undefined && value !== '' && value !== '0' && value !== 'false';
-  });
-  const daemon: boolean =
-    options.enabled &&
-    !reporterControls &&
-    !noDaemon &&
-    !(options.rushx && options.hasTerminal) &&
-    !!commandName &&
-    !commandName.startsWith('-') &&
-    (options.rushx || !neverDaemonize.has(commandName)) &&
-    !(rushxArguments ? rushxArguments.help : prefix.includes('--help') || prefix.includes('-h')) &&
-    (!ci || options.environment.RUSH_DAEMON === '1');
-  return { argv, commandName, daemon, admission: controls.admission };
+  const commandName: string | undefined =
+    (rushxArguments ? rushxArguments.commandName : argv[0]) || undefined;
+  const help: boolean = rushxArguments
+    ? rushxArguments.help
+    : prefix.includes('--help') || prefix.includes('-h') || commandName === 'help';
+  const inProcessReason: string | undefined =
+    noDaemon || help || commandName === undefined
+      ? undefined
+      : getInProcessReason(options, prefix, commandName);
+  return {
+    argv,
+    nativeArgv,
+    commandName,
+    daemon: !noDaemon && !help && commandName !== undefined && inProcessReason === undefined,
+    admission: controls.admission,
+    ...(inProcessReason === undefined ? {} : { inProcessReason })
+  };
+}
+
+function getInProcessReason(
+  options: IClientRouteOptions,
+  prefix: ReadonlyArray<string>,
+  commandName: string
+): string | undefined {
+  const { environment, rushx } = options;
+  const reporter: string | undefined = getNativeReporterRequest(options, prefix);
+  if (reporter !== undefined) return `${reporter} selects the native reporter`;
+  if (commandName.startsWith('-')) return `the daemon does not support "${commandName}"`;
+  if (!rushx && NEVER_DAEMONIZED_COMMANDS.has(commandName)) return `the daemon does not run "${commandName}"`;
+  if (rushx && options.hasTerminal) return 'the daemon does not run scripts in a terminal';
+  if (!options.enabled) {
+    return environment.RUSH_DAEMON === '0'
+      ? 'RUSH_DAEMON=0 turns the daemon off'
+      : 'the daemon is not enabled for this repo';
+  }
+  const ci: string | undefined = getCiEnvironmentVariable(environment);
+  if (ci !== undefined && environment.RUSH_DAEMON !== '1') {
+    return `${ci} is set, so the daemon is off unless RUSH_DAEMON=1`;
+  }
+  return undefined;
+}
+
+function getNativeReporterRequest(
+  options: IClientRouteOptions,
+  prefix: ReadonlyArray<string>
+): string | undefined {
+  const { environment } = options;
+  if (environment.RUSH_LOG_LEVEL !== undefined) return 'RUSH_LOG_LEVEL';
+  if (isNativeReporterEnvironmentRequested(environment.RUSH_REPORTER)) {
+    return `RUSH_REPORTER=${environment.RUSH_REPORTER?.trim()}`;
+  }
+  if (options.rushx) return undefined;
+  const flag: string | undefined = NATIVE_REPORTER_FLAGS.find((name) =>
+    prefix.some((arg) => arg === name || arg.startsWith(`${name}=`))
+  );
+  if (flag !== undefined) return flag;
+  return options.useRushReporter ? 'useRushReporter in experiments.json' : undefined;
 }
diff --git a/apps/rush-cli-client/src/start.ts b/apps/rush-cli-client/src/start.ts
index 989adb4e9fa..2173fbe2132 100644
--- a/apps/rush-cli-client/src/start.ts
+++ b/apps/rush-cli-client/src/start.ts
@@ -2,6 +2,8 @@
 // See LICENSE in the project root for license information.
 
 import { AgentProgressRenderer } from './AgentProgressRenderer';
+import { ClientOutput } from './clientOutput';
+import { isDaemonOffBeforeRouting } from './earlyRouting';
 import {
   findRushJsonPath,
   getAgentCommandName,
@@ -13,28 +15,37 @@ const startTimeMs: number = Date.now();
 const argv: string[] = process.argv.slice(2);
 const commandName: string | undefined = getAgentCommandName(argv);
 const rushJsonPath: string | undefined = findRushJsonPath(process.cwd());
+// Until Rush runs in-process, a reader of the output that exits (for example `| head`) cancels the command instead
+// of failing the process.
+const output: ClientOutput = new ClientOutput();
+output.guard();
 // Write the agent status line before loading @microsoft/rush-lib (hundreds of milliseconds).
 const agentRenderer: AgentProgressRenderer | undefined =
   selectClientOutputMode({
     argv,
     environment: process.env,
     useRushReporter: !!rushJsonPath && readUseRushReporter(rushJsonPath)
-  }) === 'agent' &&
-  commandName !== undefined
+  }) === 'agent' && commandName !== undefined
     ? new AgentProgressRenderer({
         commandName,
-        isTTY: !!process.stdout.isTTY && process.env.TERM !== 'dumb',
+        // A pty without a size (e.g. `script` run without a terminal) cannot be repainted; treat it as a pipe.
+        isTTY: !!process.stdout.isTTY && process.env.TERM !== 'dumb' && !!process.stdout.columns,
         columns: process.stdout.columns || 80,
-        write: (text: string) => process.stdout.write(text),
+        write: (text: string) => output.stdout.write(text),
         startTimeMs
       })
     : undefined;
-agentRenderer?.start();
+// A command that runs in-process shows no progress. When routing sends it to the daemon, launchClient starts this.
+if (agentRenderer && !isDaemonOffBeforeRouting(process.env, rushJsonPath)) {
+  agentRenderer.start();
+}
 
 const { launchClientAsync } = require('./launchClient') as typeof import('./launchClient');
 
-launchClientAsync(false, agentRenderer).catch((error: Error) => {
-  agentRenderer?.finish({ exitCode: 1, errorMessage: error.message });
-  process.stderr.write(`rush-client: ${error.message}\n`);
+launchClientAsync(false, agentRenderer, output).catch((error: Error) => {
+  // In agent mode the summary line may already carry the complete message; do not repeat it.
+  if (!agentRenderer?.finish({ exitCode: 1, errorMessage: error.message })) {
+    process.stderr.write(`rush-client: ${error.message}\n`);
+  }
   process.exitCode = 1;
 });
diff --git a/apps/rush-cli-client/src/startRushX.ts b/apps/rush-cli-client/src/startRushX.ts
index 9c0d3be3ff5..b29b7b7424b 100644
--- a/apps/rush-cli-client/src/startRushX.ts
+++ b/apps/rush-cli-client/src/startRushX.ts
@@ -1,9 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { ClientOutput } from './clientOutput';
 import { launchClientAsync } from './launchClient';
 
-launchClientAsync(true).catch((error: Error) => {
+// Until Rush runs in-process, a reader of the output that exits (for example `| head`) cancels the command instead
+// of failing the process.
+const output: ClientOutput = new ClientOutput();
+output.guard();
+
+launchClientAsync(true, undefined, output).catch((error: Error) => {
   process.stderr.write(`rushx-client: ${error.message}\n`);
   process.exitCode = 1;
 });
diff --git a/apps/rush-cli-client/src/terminalColumns.ts b/apps/rush-cli-client/src/terminalColumns.ts
new file mode 100644
index 00000000000..9ab79e6b1a3
--- /dev/null
+++ b/apps/rush-cli-client/src/terminalColumns.ts
@@ -0,0 +1,12 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Returns the stream's terminal width, or undefined when it has none. A pseudo-terminal that was never sized
+ * (for example `script` started from a non-terminal) reports 0 columns, which the daemon rejects as request
+ * metadata; treat it like a stream without a width.
+ */
+export function getTerminalColumns(stream: { readonly columns?: number }): number | undefined {
+  const { columns } = stream;
+  return columns !== undefined && Number.isSafeInteger(columns) && columns > 0 ? columns : undefined;
+}
diff --git a/apps/rush-cli-client/src/test/AgentNotices.test.ts b/apps/rush-cli-client/src/test/AgentNotices.test.ts
new file mode 100644
index 00000000000..5a3f96995e0
--- /dev/null
+++ b/apps/rush-cli-client/src/test/AgentNotices.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  type IDaemonActivityPayload,
+  type IDaemonEventEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { AgentNotices } from '../AgentNotices';
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+
+const UNMATCHED_PLUGIN_WARNING: string =
+  "Warning: the daemon's compatible plugin list names plugins that are not configured in rush-plugins.json: typo-plugin\n";
+const CACHE_WARNING: string =
+  'The Rush daemon never signs in interactively, so this build continues without signing in to the cloud build cache.\n';
+
+function activity(payload: IDaemonActivityPayload, operationId?: string): IDaemonEventEnvelope {
+  return {
+    eventId: 'event',
+    sessionId: 'session',
+    sequence: 1,
+    timestamp: new Date().toISOString(),
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    source: { packageName: 'test', packageVersion: '1.0.0' },
+    privacy: 'public',
+    required: true,
+    type: 'activityChanged',
+    scope: operationId === undefined ? undefined : { operationId },
+    payload
+  };
+}
+
+function createRenderer(isTTY: boolean): { renderer: AgentProgressRenderer; output: string[] } {
+  const output: string[] = [];
+  const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+    commandName: 'build',
+    isTTY,
+    columns: 60,
+    write: (text: string) => output.push(text),
+    now: () => 0,
+    startTimeMs: 0
+  });
+  return { renderer, output };
+}
+
+describe(AgentNotices.name, () => {
+  it('keeps the distinct lines of warnings and errors outside any operation', () => {
+    const notices: AgentNotices = new AgentNotices();
+    notices.add({ severity: 'warning', stream: 'stderr', text: UNMATCHED_PLUGIN_WARNING }, undefined);
+    notices.add({ severity: 'warning', stream: 'stderr', text: UNMATCHED_PLUGIN_WARNING }, undefined);
+    notices.add({ severity: 'error', stream: 'stderr', text: '\nFirst line\n  second line  \n' }, undefined);
+    notices.add({ stream: 'stderr', text: 'Operations failed.\n' }, undefined);
+    notices.add({ stream: 'stdout', text: 'FSTrace: Enabled\n' }, undefined);
+    notices.add({ severity: 'warning', stream: 'stderr', text: 'operation warning\n' }, 'a (build)');
+    expect(notices.getLines()).toEqual([UNMATCHED_PLUGIN_WARNING.trim(), 'First line', 'second line']);
+  });
+
+  it('prints at most three lines, each cut to 300 characters, and counts the rest', () => {
+    const notices: AgentNotices = new AgentNotices();
+    notices.add({ severity: 'warning', text: `${'x'.repeat(400)}\nb\nc\nd\ne\n` }, undefined);
+    const lines: string[] = notices.getLines();
+    expect(lines).toEqual([
+      `${'x'.repeat(299)}…`,
+      'b',
+      'c',
+      '+2 more warning and error lines; RUSHD_OUTPUT=legacy prints them all'
+    ]);
+  });
+});
+
+describe(`${AgentProgressRenderer.name} notices`, () => {
+  it.each([false, true])('prints plugin warnings before the summary line (isTTY: %s)', (isTTY: boolean) => {
+    const { renderer, output } = createRenderer(isTTY);
+    renderer.start();
+    renderer.onEvent(activity({ severity: 'warning', stream: 'stderr', text: UNMATCHED_PLUGIN_WARNING }));
+    renderer.onEvent(activity({ severity: 'warning', stream: 'stderr', text: CACHE_WARNING }));
+    renderer.onEvent(activity({ stream: 'stdout', text: 'rush build (0.50 seconds)\n' }));
+    const beforeFinish: number = output.length;
+    renderer.finish({ exitCode: 0 });
+    expect(output.slice(beforeFinish).filter((text: string) => !text.startsWith('\x1b'))).toEqual([
+      UNMATCHED_PLUGIN_WARNING,
+      CACHE_WARNING,
+      'rush build: SUCCESS up to date (no operations needed) in 0.0s\n'
+    ]);
+  });
+
+  it('prints nothing more when no warning or error was written', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(activity({ stream: 'stderr', text: 'Operations succeeded with warnings.\n' }));
+    const beforeFinish: number = output.length;
+    renderer.finish({ exitCode: 0 });
+    expect(output.slice(beforeFinish)).toEqual([
+      'rush build: SUCCESS up to date (no operations needed) in 0.0s\n'
+    ]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 6a23fc2c5ce..26e1a6a97a1 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -4,10 +4,17 @@
 import {
   DAEMON_PROTOCOL_VERSION,
   type DaemonEventType,
+  type IDaemonContinuingOperations,
   type IDaemonEventEnvelope
 } from '@rushstack/rush-daemon-protocol';
 
 import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import {
+  RESUBMITTED_PHASE,
+  createDaemonRequestNoticeHandlers,
+  type IDaemonRequestNoticeHandlers
+} from '../daemonRestartNotice';
+import { withNativeLockWaitNotices, type INativeLockWaitNoticeHandlers } from '../nativeLockWaitNotice';
 
 function event(type: DaemonEventType, payload: unknown): IDaemonEventEnvelope {
   return {
@@ -26,45 +33,93 @@ function event(type: DaemonEventType, payload: unknown): IDaemonEventEnvelope {
 
 const ANSI_ESCAPE: RegExp = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`, 'g');
 
-function createRenderer(isTTY: boolean): { renderer: AgentProgressRenderer; output: string[]; clock: { ms: number } } {
+interface ITestRenderer {
+  renderer: AgentProgressRenderer;
+  output: string[];
+  clock: { ms: number };
+  /** All output, split into lines. */
+  lines(): string[];
+}
+
+function createRenderer(isTTY: boolean, commandName: string = 'build', columns: number = 60): ITestRenderer {
   const output: string[] = [];
   const clock: { ms: number } = { ms: 0 };
   const renderer: AgentProgressRenderer = new AgentProgressRenderer({
-    commandName: 'build',
+    commandName,
     isTTY,
-    columns: 60,
+    columns,
     write: (text: string) => output.push(text),
     now: () => clock.ms,
     startTimeMs: 0
   });
-  return { renderer, output, clock };
+  return { renderer, output, clock, lines: () => output.join('').split('\n').slice(0, -1) };
+}
+
+function registered(operationId: string, silent: boolean = false): IDaemonEventEnvelope {
+  return event('operationRegistered', { operationId, silent });
+}
+
+function status(
+  operationId: string,
+  value: string,
+  logFilePath?: string,
+  commandKind?: unknown
+): IDaemonEventEnvelope {
+  return event('operationStatusChanged', {
+    operationId,
+    previousStatus: 'READY',
+    status: value,
+    logFilePath,
+    commandKind
+  });
+}
+
+function header(
+  operationId: string,
+  completedOperations: number,
+  totalOperations: number
+): IDaemonEventEnvelope {
+  return event('extension', {
+    name: 'rushd.operation-header',
+    data: { operationId, completedOperations, totalOperations }
+  });
 }
 
-function status(operationId: string, value: string): IDaemonEventEnvelope {
-  return event('operationStatusChanged', { operationId, previousStatus: 'READY', status: value });
+function streamClosed(operationId: string): IDaemonEventEnvelope {
+  return event('extension', { name: 'rushd.operation-stream-closed', data: { operationId } });
+}
+
+function fail(renderer: AgentProgressRenderer, operationId: string, errorLines: ReadonlyArray<string>): void {
+  renderer.onEvent(status(operationId, 'EXECUTING'));
+  renderer.onLog(Buffer.from(errorLines.map((line) => `${line}\n`).join('')), operationId, 'stderr');
+  renderer.onEvent(status(operationId, 'FAILURE', `/repo/${operationId.split(' ')[0]}/rush-logs/x.log`));
 }
 
 describe(AgentProgressRenderer.name, () => {
-  it('writes a first line immediately and a bounded summary for a successful build (pipe)', () => {
-    const { renderer, output, clock } = createRenderer(false);
+  it('writes one line when the request is sent and a summary line for a successful build (pipe)', () => {
+    const { renderer, output, clock, lines } = createRenderer(false);
     renderer.start();
-    expect(output).toEqual(['rush build · 0.0s · connecting to rushd (auto-starts if needed)\n']);
-    renderer.onEvent(event('operationRegistered', { operationId: 'a (build)', silent: false }));
-    renderer.onEvent(event('operationRegistered', { operationId: 'b (build)', silent: false }));
-    renderer.onEvent(event('operationRegistered', { operationId: 'hidden', silent: true }));
+    expect(output).toEqual([]);
+    renderer.onRequestSent();
+    expect(output).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)\n'
+    ]);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('b (build)'));
+    renderer.onEvent(registered('hidden', true));
     renderer.onEvent(status('a (build)', 'EXECUTING'));
     renderer.onLog(Buffer.from('noise\n'), 'a (build)', 'stdout');
     clock.ms = 2500;
     renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onEvent(status('hidden', 'SUCCESS'));
     renderer.onEvent(status('b (build)', 'SKIPPED'));
     clock.ms = 3000;
-    renderer.finish({ exitCode: 0 });
+    expect(renderer.finish({ exitCode: 0 })).toBe(false);
     renderer.dispose();
-    expect(output.join('')).not.toContain('noise');
-    expect(output[output.length - 1]).toBe(
-      'rush build: SUCCESS 2/2 operations (1 success, 1 skipped) in 3.0s\n'
-    );
-    expect(output.length).toBeLessThanOrEqual(4);
+    expect(lines()).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+      'rush build: SUCCESS 2/2 operations (1 success, 1 up to date) in 3.0s'
+    ]);
   });
 
   it('reports an up-to-date request instead of printing nothing', () => {
@@ -73,68 +128,446 @@ describe(AgentProgressRenderer.name, () => {
     expect(output).toEqual(['rush build: SUCCESS up to date (no operations needed) in 0.0s\n']);
   });
 
-  it('lists failed operations and a bounded stderr tail on failure', () => {
-    const { renderer, output } = createRenderer(false);
-    renderer.onEvent(status('p05 (build)', 'EXECUTING'));
-    for (let i = 0; i < 20; i++) {
-      renderer.onLog(Buffer.from(`error ${i}\n`), 'p05 (build)', 'stderr');
-    }
-    renderer.onEvent(status('p05 (build)', 'FAILURE'));
+  it('tells an empty selection apart from a request whose operations were all up to date', () => {
+    const hot: ITestRenderer = createRenderer(false);
+    // The daemon announces retained operations as silent and reports their retained results.
+    hot.renderer.onEvent(registered('a (build)', true));
+    hot.renderer.onEvent(registered('b (build)', true));
+    hot.renderer.finish({
+      exitCode: 0,
+      operationResults: [
+        { operationId: 'a (build)', status: 'SUCCESS' },
+        { operationId: 'b (build)', status: 'FROM CACHE' }
+      ]
+    });
+    expect(hot.output).toEqual(['rush build: SUCCESS up to date (no operations needed) in 0.0s\n']);
+
+    const empty: ITestRenderer = createRenderer(false);
+    empty.renderer.finish({ exitCode: 0, operationResults: [] });
+    expect(empty.output).toEqual([
+      'rush build: SUCCESS 0 operations in 0.0s · the selection parameters did not match any projects\n'
+    ]);
+  });
+
+  it('reports a failed operation with its log file and an excerpt as soon as it fails', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(
+      renderer,
+      'p05 (build)',
+      Array.from({ length: 20 }, (unused, i) => `error ${i}`)
+    );
+    expect(lines()).toHaveLength(9);
     renderer.onEvent(status('p06 (build)', 'BLOCKED'));
     renderer.finish({ exitCode: 1 });
-    const text: string = output.join('');
-    expect(text).toContain('rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: p05 (build)\n');
-    expect(text).toContain('  p05 (build): error 10\n');
-    expect(text).toContain('  p05 (build): error 19\n');
-    expect(text).not.toContain('error 9\n');
+    expect(lines()).toEqual([
+      'failed: p05 (build) · full log: /repo/p05/rush-logs/x.log',
+      '  error 0',
+      '  error 1',
+      '  error 2',
+      '  error 3',
+      '  error 4',
+      '  error 5',
+      '  error 18',
+      '  error 19',
+      'rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: p05 (build)'
+    ]);
+  });
+
+  it('says which operations continue in rushd after a failure that the daemon reported early', () => {
+    const operationIds: ReadonlyArray<string> = ['a (build)', 'b (build)', 'c (build)', 'd (build)'];
+    const finishWith = (unfinished: ReadonlyArray<[string, string]>, exitCode: number = 1): string[] => {
+      const { renderer, lines } = createRenderer(false);
+      for (const operationId of operationIds) renderer.onEvent(registered(operationId));
+      fail(renderer, 'b (build)', ['error']);
+      renderer.onEvent(status('a (build)', 'BLOCKED'));
+      renderer.finish({
+        exitCode,
+        operationResults: [
+          { operationId: 'a (build)', status: 'BLOCKED' },
+          { operationId: 'b (build)', status: 'FAILURE' },
+          ...unfinished.map(([operationId, value]) => ({ operationId, status: value }))
+        ]
+      });
+      return lines();
+    };
+
+    expect(finishWith([['c (build)', 'EXECUTING']]).pop()).toBe(
+      'rush build: FAILURE 2/4 operations (1 failure, 1 blocked) in 0.0s · failed: b (build)' +
+        ' · 1 independent operation continues in rushd: c (build)'
+    );
+    expect(
+      finishWith([
+        ['c (build)', 'EXECUTING'],
+        ['d (build)', 'QUEUED']
+      ]).pop()
+    ).toMatch(
+      / · failed: b \(build\) · 2 independent operations continue in rushd: c \(build\), d \(build\)$/
+    );
+    // Like a live row, the line names only the first few.
+    expect(
+      finishWith([
+        ['c (build)', 'EXECUTING'],
+        ['d (build)', 'QUEUED'],
+        ['e (build)', 'WAITING'],
+        ['f (build)', 'READY'],
+        ['g (build)', 'EXECUTING']
+      ]).pop()
+    ).toMatch(
+      / · 5 independent operations continue in rushd: c \(build\), d \(build\), e \(build\) \+2 more$/
+    );
+    // The names come in name order, as the daemon's queue positions give them, whatever the result's order.
+    expect(
+      finishWith([
+        ['g (build)', 'EXECUTING'],
+        ['f (build)', 'READY'],
+        ['e (build)', 'WAITING'],
+        ['d (build)', 'QUEUED'],
+        ['c (build)', 'EXECUTING']
+      ]).pop()
+    ).toMatch(
+      / · 5 independent operations continue in rushd: c \(build\), d \(build\), e \(build\) \+2 more$/
+    );
+    expect(finishWith([['c (build)', 'SUCCESS']]).pop()).toMatch(/ · failed: b \(build\)$/);
+    expect(finishWith([['c (build)', 'EXECUTING']], 0).pop()).not.toContain('continue');
   });
 
   it('keeps failure diagnostics when successful operations wrote stderr first', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onEvent(status('noisy (build)', 'EXECUTING'));
-    for (let i = 0; i < 20; i++) {
+    for (let i: number = 0; i < 20; i++) {
       renderer.onLog(Buffer.from(`warning ${i}\n`), 'noisy (build)', 'stderr');
     }
     renderer.onEvent(status('noisy (build)', 'SUCCESS WITH WARNINGS'));
-    renderer.onEvent(status('broken (build)', 'EXECUTING'));
-    renderer.onLog(Buffer.from('the real error\n'), 'broken (build)', 'stderr');
-    renderer.onEvent(status('broken (build)', 'FAILURE'));
+    fail(renderer, 'broken (build)', ['the real error']);
     renderer.finish({ exitCode: 1 });
     const text: string = output.join('');
-    expect(text).toContain('  broken (build): the real error\n');
-    expect(text).not.toContain('noisy (build): warning');
+    expect(text).toContain(
+      'failed: broken (build) · full log: /repo/broken/rush-logs/x.log\n  the real error\n'
+    );
+    expect(text).not.toContain('warning 1');
+    expect(text).toMatch(/· failed: broken \(build\)\n$/);
+  });
+
+  it('reports unchanged operations as up to date, whether the daemon says SKIPPED or NO OP', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(status('a (build)', 'NO OP'));
+    renderer.onEvent(status('b (build)', 'SKIPPED'));
+    renderer.onEvent(status('c (build)', 'FROM CACHE'));
+    renderer.finish({ exitCode: 0 });
+    expect(output[output.length - 1]).toBe(
+      'rush build: SUCCESS 3/3 operations (1 from cache, 2 up to date) in 0.0s\n'
+    );
   });
 
   it('counts ABORTED operations as finished', () => {
     const { renderer, output } = createRenderer(false);
-    renderer.onEvent(event('operationRegistered', { operationId: 'a (build)', silent: false }));
+    renderer.onEvent(registered('a (build)'));
     renderer.onEvent(status('a (build)', 'EXECUTING'));
     renderer.onEvent(status('a (build)', 'ABORTED'));
     renderer.finish({ exitCode: 1 });
     expect(output[output.length - 1]).toBe('rush build: FAILURE 1/1 operations (1 aborted) in 0.0s\n');
   });
 
+  it('reports a cancelled command as CANCELLED, without the output of the interrupted operations', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('b (build)'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('error: interrupted by SIGINT\n'), 'a (build)', 'stderr');
+    renderer.finish({
+      exitCode: 130,
+      cancelled: true,
+      operationResults: [
+        { operationId: 'a (build)', status: 'ABORTED' },
+        { operationId: 'b (build)', status: 'ABORTED' }
+      ]
+    });
+    expect(lines()).toEqual(['rush build: CANCELLED 2/2 operations (2 aborted) in 0.0s']);
+  });
+
+  it('still reports the failures of a cancelled command', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(renderer, 'a (build)', ['src/a.ts(1,1): error TS2322: bad']);
+    renderer.finish({ exitCode: 130, cancelled: true });
+    expect(lines().slice(-3)).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  src/a.ts(1,1): error TS2322: bad',
+      'rush build: CANCELLED 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it('says at once that it waits for rushd to stop a cancelled request, and whether rushd confirmed', () => {
+    const confirmed: ITestRenderer = createRenderer(false);
+    confirmed.renderer.onEvent(registered('a (build)'));
+    confirmed.renderer.onEvent(status('a (build)', 'EXECUTING'));
+    confirmed.clock.ms = 7_600;
+    confirmed.renderer.onCancelRequested(5_000);
+    expect(confirmed.lines()).toEqual([
+      'rush build 0/1 · 7.6s · cancelling; waiting up to 5s for rushd to stop the request'
+    ]);
+    // Written once, and the operations that rushd stops do not make the request look as if it runs on.
+    confirmed.renderer.onCancelRequested(5_000);
+    confirmed.renderer.onEvent(status('a (build)', 'ABORTED'));
+    confirmed.clock.ms = 8_100;
+    confirmed.renderer.finish({ exitCode: 130, cancelled: true });
+    expect(confirmed.lines()).toEqual([
+      'rush build 0/1 · 7.6s · cancelling; waiting up to 5s for rushd to stop the request',
+      'rush build: CANCELLED 1/1 operations (1 aborted) in 8.1s'
+    ]);
+
+    const unconfirmed: ITestRenderer = createRenderer(false);
+    unconfirmed.renderer.onCancelRequested(5_000);
+    unconfirmed.clock.ms = 5_000;
+    unconfirmed.renderer.finish({ exitCode: 130, cancelled: true, stopUnconfirmed: true });
+    expect(unconfirmed.lines()).toEqual([
+      'rush build · 0.0s · cancelling; waiting up to 5s for rushd to stop the request',
+      'rush build: CANCELLED in 5.0s · rushd did not confirm that the request stopped; it may still be stopping'
+    ]);
+  });
+
+  it('keeps showing on a TTY that it cancels', () => {
+    jest.useFakeTimers();
+    try {
+      const { renderer, output } = createRenderer(true, 'build', 120);
+      const firstRow = (): string => output[output.length - 1].replace(ANSI_ESCAPE, '').split('\n')[0];
+      renderer.start();
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onCancelRequested(5_000);
+      // Repainted at once, rather than on the next tick of the timer.
+      expect(firstRow()).toBe(
+        '⠙ rush build 0/1 · 0.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      );
+      renderer.onEvent(status('a (build)', 'ABORTED'));
+      renderer.onQueuePosition(1);
+      jest.advanceTimersByTime(100);
+      // Neither the operation that rushd stopped nor a queue position makes the request look as if it runs on.
+      expect(firstRow()).toBe(
+        '⠹ rush build 1/1 · 0.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      );
+      renderer.dispose();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('applies final statuses from the daemon result that no event reported', () => {
+    const { renderer, lines } = createRenderer(false);
+    const reason: string =
+      'The Rush daemon was shut down (idle timeout) while this request was running; re-run the command.';
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('b (build)'));
+    renderer.onEvent(registered('silent (build)', true));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onEvent(status('b (build)', 'EXECUTING'));
+    const reported: boolean = renderer.finish({
+      exitCode: 1,
+      errorMessage: reason,
+      operationResults: [
+        { operationId: 'a (build)', status: 'SUCCESS' },
+        { operationId: 'b (build)', status: 'ABORTED' },
+        { operationId: 'silent (build)', status: 'ABORTED' },
+        // The result lists silent operations too; one that no event announced is not counted.
+        { operationId: 'unannounced (build)', status: 'NO OP' }
+      ]
+    });
+    expect(reported).toBe(true);
+    expect(lines().slice(-1)).toEqual([
+      `rush build: FAILURE 2/2 operations (1 aborted, 1 success) in 0.0s · ${reason}`
+    ]);
+  });
+
+  it("prints a failed operation's error from the daemon result when the operation wrote no output", () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [{ operationId: 'a (build)', status: 'FAILURE', errorMessage: 'spawn heft ENOENT' }]
+    });
+    expect(lines().slice(-3)).toEqual([
+      'failed: a (build)',
+      '  spawn heft ENOENT',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it('tells a repeated finish whether its error message was already reported in full', () => {
+    const { renderer, output } = createRenderer(false);
+    const message: string = 'Daemon rejected the request (routingFailed): Another Rush command is running.';
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(true);
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(true);
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'another message' })).toBe(false);
+    expect(output).toEqual([`rush build: FAILURE in 0.0s · ${message}\n`]);
+  });
+
+  it('keeps the legacy "daemon admission failed (<code>)" string in the summary line', () => {
+    const timeout: ITestRenderer = createRenderer(false);
+    const message: string =
+      'The request was not admitted within 30000ms while waiting for workspace admission. ' +
+      'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.';
+    expect(
+      timeout.renderer.finish({ exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: message })
+    ).toBe(true);
+    expect(timeout.output).toEqual([
+      `rush build: FAILURE in 0.0s · daemon admission failed (wait-timeout): ${message}\n`
+    ]);
+
+    const noWait: ITestRenderer = createRenderer(false);
+    noWait.renderer.finish({
+      exitCode: 1,
+      admissionErrorCode: 'no-wait',
+      errorMessage: 'The workspace is busy.'
+    });
+    expect(noWait.output).toEqual([
+      'rush build: FAILURE in 0.0s · daemon admission failed (no-wait): The workspace is busy.\n'
+    ]);
+
+    // A request aborted while it waited, for example by a daemon shutdown, is not a busy workspace.
+    const aborted: ITestRenderer = createRenderer(false);
+    aborted.renderer.finish({
+      exitCode: 1,
+      admissionErrorCode: 'aborted',
+      errorMessage: 'The Rush daemon was shut down.'
+    });
+    expect(aborted.output).toEqual(['rush build: FAILURE in 0.0s · The Rush daemon was shut down.\n']);
+  });
+
+  it('writes the reason for an admission failure in full however long it is, so the caller adds nothing', () => {
+    // A restart drain that timed out behind a rushx script after it waived time: 350 characters.
+    const message: string =
+      'The request was not admitted before the daemon could restart for its environment, which waits for the ' +
+      'requests that the daemon is serving to finish, including a rushx script that may not exit until it is ' +
+      'stopped; 61.8s spent waiting for requests that were already running did not count. Stop the script, ' +
+      'or use --wait-timeout <seconds> to wait longer.';
+    expect(message.length).toBeGreaterThan(300);
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: message })).toBe(
+      true
+    );
+    expect(output).toEqual([
+      `rush build: FAILURE in 0.0s · daemon admission failed (wait-timeout): ${message}\n`
+    ]);
+  });
+
+  it('clips any other single-line error message that is too long, and leaves it to the caller', () => {
+    const message: string = `Rush failed: ${'x'.repeat(400)} (end)`;
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(false);
+    expect(output).toHaveLength(1);
+    expect(output[0]).toMatch(/^rush build: FAILURE in 0\.0s · Rush failed: x+…x+ \(end\)\n$/);
+    expect(output[0].length).toBeLessThan(message.length);
+  });
+
   it('writes the final line at most once and nothing after it', () => {
     const { renderer, output } = createRenderer(false);
-    renderer.finish({ exitCode: 1, errorMessage: 'daemon rejected the request (x)' });
-    renderer.finish({ exitCode: 1, errorMessage: 'again' });
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'daemon rejected the request (x)' })).toBe(true);
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'again' })).toBe(false);
     renderer.onQueuePosition(3);
+    renderer.onEvent(status('a (build)', 'FAILURE'));
     renderer.dispose();
-    expect(output).toEqual(['rush build: FAILURE 0/0 operations in 0.0s · daemon rejected the request (x)\n']);
+    expect(output).toEqual(['rush build: FAILURE in 0.0s · daemon rejected the request (x)\n']);
   });
 
-  it('does not repeat an unchanged queue position', () => {
+  it('writes the further lines of a multi-line error message before the summary line', () => {
     const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'first line\n\nsecond line\n' })).toBe(true);
+    expect(output).toEqual(['  second line\nrush build: FAILURE in 0.0s · first line\n']);
+  });
+
+  it('keeps the age of a daemon that did not answer, and that Rush was not run in-process, whole', () => {
+    // As the client words it for a stopped daemon, with a socket path as long as a Unix socket path can be.
+    const socketPath: string = `/${'s'.repeat(100)}.sock`;
+    const description: string =
+      `The daemon, rushd (PID 4194304), did not answer at ${socketPath}: it is stopped (state T), ` +
+      'for example by SIGSTOP, and it started 59 min ago.';
+    const notRun: string =
+      'Rush was not run in-process, where it would compete with that daemon for the repository.';
+    const hint: string = 'Resume it with "kill -CONT 4194304"; it then serves the next command.';
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, errorMessage: [description, notRun, hint].join('\n') })).toBe(true);
+    expect(output.join('').split('\n')).toEqual([
+      `  ${notRun}`,
+      `  ${hint}`,
+      `rush build: FAILURE in 0.0s · ${description}`,
+      ''
+    ]);
+  });
+
+  it('elides the middle of an error message with thousands of lines and keeps its last lines', () => {
+    const { renderer, output } = createRenderer(false);
+    const diagnostics: string[] = Array.from({ length: 1745 }, (unused, index) => `debug line ${index}`);
+    const message: string = [
+      'Daemon rejected the request (invalidRequest): Incremental strategy: cache restoration',
+      ...diagnostics,
+      'The project name "@x/nope" passed to "--to" does not exist in rush.json.',
+      'An error occurred.'
+    ].join('\n');
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(true);
+    expect(output.join('').split('\n')).toEqual([
+      '  debug line 0',
+      '  debug line 1',
+      '  … 1740 more lines …',
+      '  debug line 1742',
+      '  debug line 1743',
+      '  debug line 1744',
+      '  The project name "@x/nope" passed to "--to" does not exist in rush.json.',
+      '  An error occurred.',
+      'rush build: FAILURE in 0.0s · Daemon rejected the request (invalidRequest): Incremental strategy: cache restoration',
+      ''
+    ]);
+  });
+
+  it('reports the queue in the summary line rather than in a line of its own (pipe)', () => {
+    const { renderer, output, clock } = createRenderer(false);
+    clock.ms = 100;
     renderer.onQueuePosition(2);
-    renderer.onQueuePosition(2);
-    renderer.onQueuePosition(2);
-    expect(output).toHaveLength(1);
+    clock.ms = 5000;
     renderer.onQueuePosition(1);
-    expect(output).toHaveLength(2);
-    renderer.dispose();
+    expect(output).toEqual([]);
+    clock.ms = 15_000;
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 0 });
+    expect(output).toEqual([
+      'rush build: SUCCESS 1/1 operations (1 success) in 15.0s · ' +
+        'queued behind another request (position 2 at 0.1s)\n'
+    ]);
+  });
+
+  it('leaves the queue to the message of a request that was not admitted', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onQueuePosition(1);
+    renderer.finish({ exitCode: 1, admissionErrorCode: 'no-wait', errorMessage: 'The workspace is busy.' });
+    expect(output).toEqual([
+      'rush build: FAILURE in 0.0s · daemon admission failed (no-wait): The workspace is busy.\n'
+    ]);
   });
 
-  it('shows the stdout tail of a failed operation that reported errors on stdout', () => {
+  it('gives no old queue position as the reason for a failure, but keeps it for a cancellation', () => {
+    const failed: ITestRenderer = createRenderer(false, 'install');
+    failed.clock.ms = 200;
+    failed.renderer.onQueuePosition(1);
+    failed.clock.ms = 21_600;
+    failed.renderer.finish({ exitCode: 1 });
+    expect(failed.lines()).toEqual(['rush install: FAILURE in 21.6s']);
+
+    const withMessage: ITestRenderer = createRenderer(false, 'install');
+    withMessage.renderer.onQueuePosition(1);
+    withMessage.renderer.finish({ exitCode: 1, errorMessage: 'The mutation failed.' });
+    expect(withMessage.lines()).toEqual(['rush install: FAILURE in 0.0s · The mutation failed.']);
+
+    const cancelled: ITestRenderer = createRenderer(false);
+    cancelled.clock.ms = 200;
+    cancelled.renderer.onQueuePosition(1);
+    cancelled.clock.ms = 3_000;
+    cancelled.renderer.finish({ exitCode: 130, cancelled: true });
+    expect(cancelled.lines()).toEqual([
+      'rush build: CANCELLED in 3.0s · queued behind another request (position 1 at 0.2s)'
+    ]);
+  });
+
+  it('shows the excerpt of a failed operation that reported errors on stdout', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onEvent(status('ok (build)', 'EXECUTING'));
     renderer.onLog(Buffer.from('ok noise\n'), 'ok (build)', 'stdout');
@@ -144,14 +577,134 @@ describe(AgentProgressRenderer.name, () => {
     renderer.onEvent(status('tsc (build)', 'FAILURE'));
     renderer.finish({ exitCode: 1 });
     const text: string = output.join('');
-    expect(text).toContain('  tsc (build): src/x.ts(1,1): error TS1005: stdout-error\n');
+    expect(text).toContain('failed: tsc (build)\n  src/x.ts(1,1): error TS1005: stdout-error\n');
     expect(text).not.toContain('ok noise');
   });
 
-  it('shows queue position immediately', () => {
-    const { renderer, output } = createRenderer(false);
+  it('says so when a failed operation wrote no output', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('quiet (build)', 'FAILURE'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().slice(-3)).toEqual([
+      'failed: quiet (build)',
+      '  (no output)',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: quiet (build)'
+    ]);
+  });
+
+  it('shows the queue position immediately on a TTY', () => {
+    const { renderer, output } = createRenderer(true, 'build', 120);
     renderer.onQueuePosition(2);
     expect(output[0]).toContain('queued behind another request (position 2)');
+    renderer.dispose();
+  });
+
+  describe('while the request waits only for operations that an earlier failed command left running', () => {
+    const TWO: IDaemonContinuingOperations = { count: 2, names: ['t8-slow1', 't8-slow2'] };
+    const LEFT: string = 'left running by an earlier failed command';
+
+    function getPhase(...positions: [number, IDaemonContinuingOperations?][]): string | undefined {
+      const { renderer, output } = createRenderer(true, 'build', 200);
+      for (const [position, continuing] of positions) renderer.onQueuePosition(position, continuing);
+      renderer.dispose();
+      return / · (queued behind [^\n]*)\n/.exec(
+        output.filter((text) => text.includes('queued')).pop() ?? ''
+      )?.[1];
+    }
+
+    it('names them in the phase on a TTY: in the singular, up to three names, and then how many more', () => {
+      expect(getPhase([1, TWO])).toBe(`queued behind 2 operations ${LEFT} (position 1): t8-slow1, t8-slow2`);
+      expect(getPhase([1, { count: 1, names: ['t8-slow1'] }])).toBe(
+        `queued behind 1 operation ${LEFT} (position 1): t8-slow1`
+      );
+      expect(getPhase([2, { count: 3, names: ['a', 'b', 'c'] }])).toBe(
+        `queued behind 3 operations ${LEFT} (position 2): a, b, c`
+      );
+      // The daemon names the first three, and the count says how many it did not name.
+      expect(getPhase([1, { count: 7, names: ['a', 'b', 'c'] }])).toBe(
+        `queued behind 7 operations ${LEFT} (position 1): a, b, c +4 more`
+      );
+      expect(getPhase([1, { count: 5, names: ['a', 'b', 'c', 'd'] }])).toBe(
+        `queued behind 5 operations ${LEFT} (position 1): a, b, c +2 more`
+      );
+      expect(getPhase([1, { count: 2, names: [] }])).toBe(`queued behind 2 operations ${LEFT} (position 1)`);
+      // A position that names none is a wait for another request, as before.
+      expect(getPhase([1, TWO], [1])).toBe('queued behind another request (position 1)');
+      // Each position the daemon sends again names the operations that still run.
+      expect(getPhase([1, TWO], [1, { count: 1, names: ['t8-slow2'] }])).toBe(
+        `queued behind 1 operation ${LEFT} (position 1): t8-slow2`
+      );
+    });
+
+    it('ends the summary line with the first position that named them, not an earlier or a later one', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      clock.ms = 50;
+      renderer.onQueuePosition(2);
+      clock.ms = 100;
+      renderer.onQueuePosition(1, TWO);
+      clock.ms = 5000;
+      renderer.onQueuePosition(1, { count: 1, names: ['t8-slow2'] });
+      clock.ms = 9000;
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onEvent(status('a (build)', 'SUCCESS'));
+      renderer.finish({ exitCode: 0 });
+      expect(lines()).toEqual([
+        'rush build: SUCCESS 1/1 operations (1 success) in 9.0s · ' +
+          `queued behind 2 operations ${LEFT} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+
+      // A request that the daemon never told of them keeps the text it had before.
+      const other: ITestRenderer = createRenderer(false);
+      other.clock.ms = 50;
+      other.renderer.onQueuePosition(2);
+      other.clock.ms = 9000;
+      other.renderer.finish({ exitCode: 0 });
+      expect(other.lines()).toEqual([
+        'rush build: SUCCESS up to date (no operations needed) in 9.0s · ' +
+          'queued behind another request (position 2 at 0.1s)'
+      ]);
+
+      // As for any queue position, a failure gives its own reason instead.
+      const failed: ITestRenderer = createRenderer(false);
+      failed.renderer.onQueuePosition(1, TWO);
+      failed.renderer.finish({ exitCode: 1 });
+      expect(failed.lines()).toEqual(['rush build: FAILURE in 0.0s']);
+    });
+
+    it('says that rushd stops them for the request, in the phase and in the summary line', () => {
+      const STOPPING: IDaemonContinuingOperations = { ...TWO, stopping: true };
+      const { renderer, output } = createRenderer(true, 'build', 200);
+      renderer.onQueuePosition(1, STOPPING);
+      renderer.dispose();
+      expect(
+        / · (stopping [^\n]*)\n/.exec(output.filter((text) => text.includes('stopping')).pop() ?? '')?.[1]
+      ).toBe(`stopping 2 operations ${LEFT} (position 1): t8-slow1, t8-slow2`);
+
+      const succeeded: ITestRenderer = createRenderer(false);
+      succeeded.clock.ms = 100;
+      succeeded.renderer.onQueuePosition(1, STOPPING);
+      succeeded.clock.ms = 9000;
+      succeeded.renderer.finish({ exitCode: 0 });
+      expect(succeeded.lines()).toEqual([
+        'rush build: SUCCESS up to date (no operations needed) in 9.0s · ' +
+          `stopped 2 operations ${LEFT} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+
+      const cancelled: ITestRenderer = createRenderer(false);
+      cancelled.clock.ms = 100;
+      cancelled.renderer.onQueuePosition(1, STOPPING);
+      cancelled.clock.ms = 3000;
+      cancelled.renderer.finish({ exitCode: 130, cancelled: true });
+      expect(cancelled.lines()).toEqual([
+        `rush build: CANCELLED in 3.0s · stopped 2 operations ${LEFT} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+
+      // As for any queue position, a failure gives its own reason instead.
+      const failed: ITestRenderer = createRenderer(false);
+      failed.renderer.onQueuePosition(1, STOPPING);
+      failed.renderer.finish({ exitCode: 1 });
+      expect(failed.lines()).toEqual(['rush build: FAILURE in 0.0s']);
+    });
   });
 
   it('writes a final summary line after a queued request completes', () => {
@@ -160,23 +713,1064 @@ describe(AgentProgressRenderer.name, () => {
     renderer.onQueuePosition(1);
     clock.ms = 4000;
     renderer.finish({ exitCode: 0 });
-    expect(output[output.length - 1]).toBe('rush build: SUCCESS up to date (no operations needed) in 4.0s\n');
+    expect(output[output.length - 1]).toBe(
+      'rush build: SUCCESS up to date (no operations needed) in 4.0s · ' +
+        'queued behind another request (position 1 at 0.0s)\n'
+    );
   });
 
-  it('throttles progress lines on a pipe', () => {
-    const { renderer, output, clock } = createRenderer(false);
+  it('writes one progress line and one summary line on a pipe for a large monorepo', () => {
+    const { renderer, clock, lines } = createRenderer(false);
+    renderer.start();
+    renderer.onRequestSent();
+    renderer.onQueuePosition(1);
+    const operationIds: string[] = Array.from({ length: 772 }, (unused, i) => `p${i} (build)`);
+    for (const operationId of operationIds) {
+      renderer.onEvent(registered(operationId));
+    }
+    for (let i: number = 0; i < 1200; i++) {
+      renderer.onEvent(registered(`p${i} (tool-build)`, true));
+    }
+    for (const [index, operationId] of operationIds.entries()) {
+      clock.ms = index * 270;
+      renderer.onEvent(status(operationId, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`building ${operationId}\n`), operationId, 'stdout');
+      renderer.onEvent(status(operationId, index % 2 ? 'FROM CACHE' : 'SUCCESS'));
+      renderer.onEvent(header(operationId, index + 1, 772));
+      renderer.onEvent(event('activityChanged', { text: `${index + 1} of 772 operations complete` }));
+    }
+    for (let i: number = 0; i < 1200; i++) {
+      renderer.onEvent(status(`p${i} (tool-build)`, 'NO OP'));
+    }
+    clock.ms = 210_000;
+    renderer.finish({ exitCode: 0 });
+    expect(lines()).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+      'rush build: SUCCESS 772/772 operations (386 success, 386 from cache) in 210.0s · ' +
+        'queued behind another request (position 1 at 0.0s)'
+    ]);
+  });
+
+  it('keeps a failure in a large monorepo to the sent line, the failure report and one summary line', () => {
+    const { renderer, lines } = createRenderer(false);
     renderer.start();
-    for (let i = 0; i < 50; i++) {
-      clock.ms = i * 10;
+    renderer.onRequestSent();
+    for (let i: number = 0; i < 772; i++) {
+      renderer.onEvent(registered(`p${i} (build)`));
+    }
+    for (let i: number = 0; i < 700; i++) {
       renderer.onEvent(status(`p${i} (build)`, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`${'noise '.repeat(20)}\n`.repeat(50)), `p${i} (build)`, 'stdout');
+      renderer.onEvent(status(`p${i} (build)`, 'SUCCESS'));
     }
-    expect(output).toHaveLength(1);
-    clock.ms = 2500;
-    renderer.onEvent(status('p0 (build)', 'SUCCESS'));
+    fail(renderer, 'p700 (build)', [
+      'src/x.ts:1:1 - error TS2304: Cannot find name "y".',
+      'Encountered 1 error'
+    ]);
+    for (let i: number = 701; i < 772; i++) {
+      renderer.onEvent(status(`p${i} (build)`, 'BLOCKED'));
+    }
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+      'failed: p700 (build) · full log: /repo/p700/rush-logs/x.log',
+      '  src/x.ts:1:1 - error TS2304: Cannot find name "y".',
+      'rush build: FAILURE 772/772 operations (1 failure, 71 blocked, 700 success) in 0.0s · failed: p700 (build)'
+    ]);
+  });
+
+  it('ignores silent operations in the counters unless they fail', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('s1 (tool-build)', true));
+    renderer.onEvent(registered('s2 (tool-build)', true));
+    renderer.onLog(Buffer.from('silent output\n'), 's1 (tool-build)', 'stderr');
+    renderer.onEvent(status('s1 (tool-build)', 'NO OP'));
+    renderer.onEvent(status('s2 (tool-build)', 'FAILURE'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 1 });
+    const text: string = output.join('');
+    expect(text).not.toContain('silent output');
+    expect(output[output.length - 1]).toMatch(
+      /rush build: FAILURE 2\/2 operations \(1 failure, 1 success\) in 0\.0s · failed: s2 \(tool-build\)\n$/
+    );
+  });
+
+  it('uses the per-request total from the operation header', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(header('a (build)', 1, 772));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 0 });
+    expect(lines()).toEqual(['rush build: SUCCESS 1/772 operations (1 success) in 0.0s']);
+  });
+
+  it('counts an operation that runs again once', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(status('a (build)', 'FAILURE'));
+    renderer.onEvent(status('a (build)', 'READY'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 0 });
+    expect(output[output.length - 1]).toBe('rush build: SUCCESS 1/1 operations (1 success) in 0.0s\n');
+  });
+
+  it('reports operations with warnings when the warnings failed the request', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('w (build)', 'EXECUTING'));
+    renderer.onLog(
+      Buffer.from('[build:lint] Warning: src/x.ts:1:1 - (rule) message\n'),
+      'w (build)',
+      'stderr'
+    );
+    renderer.onEvent(status('w (build)', 'SUCCESS WITH WARNINGS', '/repo/w/rush-logs/w._phase_build.log'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().slice(-3)).toEqual([
+      'warnings: w (build) · full log: /repo/w/rush-logs/w._phase_build.log',
+      '  [build:lint] Warning: src/x.ts:1:1 - (rule) message',
+      'rush build: FAILURE 1/1 operations (1 success with warnings) in 0.0s · warnings: w (build)'
+    ]);
+  });
+
+  it('reports the output that explains warnings given after an operation succeeded, such as a failed cache write', () => {
+    const { renderer, lines } = createRenderer(false);
+    const tarLine: string =
+      '"tar" exited with code 2 while attempting to create the cache entry. ' +
+      'See "/repo/a/.rush/temp/a.tar.log" for logs from the tar process.';
+    for (const operationId of ['a (build)', 'b (build)']) {
+      renderer.onEvent(status(operationId, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`built ${operationId}\n`), operationId, 'stdout');
+      renderer.onLog(Buffer.from(`note from ${operationId}\n`), operationId, 'stderr');
+      renderer.onEvent(status(operationId, 'SUCCESS'));
+    }
+    // Rush writes an operation's build cache entry after its status. If that fails, it writes why and then changes
+    // the status. The operation's output stream closes last.
+    renderer.onLog(Buffer.from(`${tarLine}\nUnable to set `), 'a (build)', 'stderr');
+    renderer.onLog(Buffer.from('local cache entry.\n'), 'a (build)', 'stderr');
+    renderer.onEvent(event('extension', { name: 'rushd.unknown', data: { operationId: 'a (build)' } }));
+    renderer.onEvent(status('a (build)', 'SUCCESS WITH WARNINGS', '/repo/a/rush-logs/a._phase_build.log'));
+    renderer.onEvent(streamClosed('a (build)'));
+    renderer.onLog(Buffer.from('Successfully set cache entry.\n'), 'b (build)', 'stdout');
+    renderer.onEvent(streamClosed('b (build)'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'warnings: a (build) · full log: /repo/a/rush-logs/a._phase_build.log',
+      `  ${tarLine}`,
+      '  Unable to set local cache entry.',
+      'rush build: FAILURE 2/2 operations (1 success with warnings, 1 success) in 0.0s · warnings: a (build)'
+    ]);
+  });
+
+  it('reports the output that an operation wrote after it succeeded when it then failed', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('compiled\n'), 'a (build)', 'stdout');
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onLog(Buffer.from('Unable to set local cache entry.\n'), 'a (build)', 'stderr');
+    renderer.onEvent(status('a (build)', 'SUCCESS WITH WARNINGS'));
+    // A later hook threw.
+    renderer.onEvent(status('a (build)', 'FAILURE', '/repo/a/rush-logs/a._phase_build.log'));
+    renderer.onEvent(streamClosed('a (build)'));
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [{ operationId: 'a (build)', status: 'FAILURE', errorMessage: 'the plugin failed' }]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/a._phase_build.log',
+      '  Unable to set local cache entry.',
+      'error: a (build)',
+      '  the plugin failed',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it('discards the output that an operation wrote after it succeeded once its output stream closes', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onLog(Buffer.from('written after the first run\n'), 'a (build)', 'stderr');
+    renderer.onEvent(streamClosed('a (build)'));
+    // The operation runs again.
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Warning: from the second run\n'), 'a (build)', 'stderr');
+    renderer.onEvent(status('a (build)', 'SUCCESS WITH WARNINGS', '/repo/a/rush-logs/a._phase_build.log'));
+    renderer.onEvent(streamClosed('a (build)'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'warnings: a (build) · full log: /repo/a/rush-logs/a._phase_build.log',
+      '  Warning: from the second run',
+      'rush build: FAILURE 1/1 operations (1 success with warnings) in 0.0s · warnings: a (build)'
+    ]);
+  });
+
+  it('does not report warnings when the request succeeded', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('w (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Warning: x\n'), 'w (build)', 'stderr');
+    renderer.onEvent(status('w (build)', 'SUCCESS WITH WARNINGS'));
+    renderer.finish({ exitCode: 0 });
+    expect(lines().slice(-1)).toEqual([
+      'rush build: SUCCESS 1/1 operations (1 success with warnings) in 0.0s'
+    ]);
+    expect(lines().join('\n')).not.toContain('Warning: x');
+  });
+
+  it('says when a failed operation ran its incremental command, and that its next run uses the initial one', () => {
+    const { renderer, lines } = createRenderer(false);
+    for (const [name, commandKind] of [
+      ['inc', 'incremental'],
+      ['init', 'initial']
+    ]) {
+      renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`${name} error\n`), `${name} (build)`, 'stderr');
+      renderer.onEvent(status(`${name} (build)`, 'FAILURE', `/repo/${name}/rush-logs/x.log`, commandKind));
+    }
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'failed: inc (build) · incremental command; its next run uses the initial command · ' +
+        'full log: /repo/inc/rush-logs/x.log',
+      '  inc error',
+      'failed: init (build) · full log: /repo/init/rush-logs/x.log',
+      '  init error',
+      'rush build: FAILURE 2/2 operations (2 failures) in 0.0s · failed: inc (build), init (build)'
+    ]);
+  });
+
+  it('says when warnings that failed the request came from an incremental command', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('w (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Warning: x\n'), 'w (build)', 'stderr');
+    renderer.onEvent(status('w (build)', 'SUCCESS WITH WARNINGS', '/repo/w/rush-logs/x.log', 'incremental'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().slice(-3)).toEqual([
+      'warnings: w (build) · incremental command · full log: /repo/w/rush-logs/x.log',
+      '  Warning: x',
+      'rush build: FAILURE 1/1 operations (1 success with warnings) in 0.0s · warnings: w (build)'
+    ]);
+  });
+
+  it('names the command of the last run of an operation, and ignores a command it does not know', () => {
+    const { renderer, lines } = createRenderer(false);
+    // Operations without output are reported with the summary, after their last run.
+    renderer.onEvent(status('again (build)', 'FAILURE', undefined, 'incremental'));
+    renderer.onEvent(status('again (build)', 'READY'));
+    renderer.onEvent(status('again (build)', 'EXECUTING'));
+    renderer.onEvent(status('again (build)', 'FAILURE'));
+    renderer.onEvent(status('odd (build)', 'FAILURE', undefined, 'other'));
+    renderer.onEvent(status('late (build)', 'FAILURE', undefined, 'initial'));
+    renderer.onEvent(status('late (build)', 'READY'));
+    renderer.onEvent(status('late (build)', 'FAILURE', undefined, 'incremental'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().filter((line) => line.startsWith('failed: '))).toEqual([
+      'failed: again (build)',
+      'failed: odd (build)',
+      'failed: late (build) · incremental command; its next run uses the initial command'
+    ]);
+  });
+
+  it('caps the reported operations, their excerpts and the names in the summary', () => {
+    const { renderer, lines } = createRenderer(false);
+    for (let i: number = 0; i < 8; i++) {
+      fail(
+        renderer,
+        `f${i} (build)`,
+        Array.from({ length: 12 }, (unused, j) => `f${i} error ${j}`)
+      );
+    }
+    renderer.finish({ exitCode: 1 });
+    const report: string[] = lines();
+    expect(report.filter((line) => line.startsWith('failed: '))).toEqual([
+      'failed: f0 (build) · full log: /repo/f0/rush-logs/x.log',
+      'failed: f1 (build) · full log: /repo/f1/rush-logs/x.log',
+      'failed: f2 (build) · full log: /repo/f2/rush-logs/x.log'
+    ]);
+    expect(report.filter((line) => line.startsWith('  f0 '))).toHaveLength(8);
+    expect(report.filter((line) => line.startsWith('  f1 '))).toHaveLength(3);
+    expect(report.filter((line) => line.startsWith('  f2 '))).toHaveLength(3);
+    expect(report.slice(-2)).toEqual([
+      "+5 more failed operations; their logs are in each project's rush-logs folder",
+      'rush build: FAILURE 8/8 operations (8 failures) in 0.0s · failed: f0 (build), f1 (build), f2 (build), ' +
+        'f3 (build), f4 (build) +3 more'
+    ]);
+  });
+
+  it('reports a failed operation that wrote no output with the error from the daemon result', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+    renderer.onEvent(status('quiet (build)', 'FAILURE'));
+    fail(renderer, 'b (build)', ['src/b.ts:1:1 - error TS2322: b']);
+    expect(lines()).toHaveLength(4);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'a (build)', status: 'FAILURE' },
+        { operationId: 'quiet (build)', status: 'FAILURE', errorMessage: 'spawn heft ENOENT' },
+        { operationId: 'b (build)', status: 'FAILURE' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  src/a.ts:1:1 - error TS2322: a',
+      'failed: b (build) · full log: /repo/b/rush-logs/x.log',
+      '  src/b.ts:1:1 - error TS2322: b',
+      'failed: quiet (build)',
+      '  spawn heft ENOENT',
+      'rush build: FAILURE 3/3 operations (3 failures) in 0.0s · failed: a (build), quiet (build), b (build)'
+    ]);
+  });
+
+  it('prints the error of an operation reported as it failed, when its output lacks the error', () => {
+    const { renderer, lines } = createRenderer(false);
+    const querying: string =
+      'This project was not found in the local build cache. Querying the cloud build cache.';
+    const sasError: string =
+      "An Azure Storage SAS credential hasn't been provided, or has expired. Update the credentials by " +
+      'running "rush update-cloud-credentials", or provide a SAS in the RUSH_BUILD_CACHE_CREDENTIAL ' +
+      'environment variable';
+    renderer.onEvent(registered('mini-a (build)'));
+    renderer.onEvent(registered('mini-b (build)'));
+    renderer.onEvent(status('mini-a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from(`${querying}\n`), 'mini-a (build)', 'stdout');
+    renderer.onEvent(status('mini-a (build)', 'FAILURE'));
+    renderer.onEvent(status('mini-b (build)', 'BLOCKED'));
+    expect(lines()).toEqual(['failed: mini-a (build)', `  ${querying}`]);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'mini-a (build)', status: 'FAILURE', errorMessage: `${sasError}\n` },
+        { operationId: 'mini-b (build)', status: 'BLOCKED' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: mini-a (build)',
+      `  ${querying}`,
+      'error: mini-a (build)',
+      `  ${sasError}`,
+      'rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: mini-a (build)'
+    ]);
+  });
+
+  it("prints a failed operation's error after its excerpt, with the further lines of a multi-line error", () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Restoring from the build cache\n'), 'a (build)', 'stdout');
+    const detail: string[] = Array.from({ length: 9 }, (unused, i) => `  detail ${i}`);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        {
+          operationId: 'a (build)',
+          status: 'FAILURE',
+          errorMessage: ['  Could not read the cache entry', ...detail].join('\r\n')
+        }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build)',
+      '  Restoring from the build cache',
+      '  Could not read the cache entry',
+      '    detail 0',
+      '    detail 1',
+      '  … 2 more lines …',
+      '    detail 4',
+      '    detail 5',
+      '    detail 6',
+      '    detail 7',
+      '    detail 8',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it("does not repeat a failed operation's error that its output shows, or the exit code of a process that wrote output", () => {
+    const { renderer, lines } = createRenderer(false);
+    const readiness: string = 'The explicit daemon Node tool exited without completing IPC readiness.';
+    fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+    fail(renderer, 'b (build)', [
+      `  The  explicit daemon node tool exited without completing IPC readiness.`
+    ]);
+    renderer.onEvent(status('c (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('c output\n'), 'c (build)', 'stderr');
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'a (build)', status: 'FAILURE', errorMessage: 'Returned error code: 2' },
+        { operationId: 'b (build)', status: 'FAILURE', errorMessage: readiness },
+        { operationId: 'c (build)', status: 'FAILURE', errorMessage: 'Returned error code: 127' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  src/a.ts:1:1 - error TS2322: a',
+      'failed: b (build) · full log: /repo/b/rush-logs/x.log',
+      '  The  explicit daemon node tool exited without completing IPC readiness.',
+      'failed: c (build)',
+      '  c output',
+      'rush build: FAILURE 3/3 operations (3 failures) in 0.0s · failed: a (build), b (build), c (build)'
+    ]);
+  });
+
+  it('prints the signal that ended an operation, and clips a long error unless the output shows its start', () => {
+    const { renderer, lines } = createRenderer(false);
+    const long: string = `Cache entry rejected: ${'x'.repeat(400)}`;
+    const other: string = `Cache entry rejected: ${'y'.repeat(400)}`;
+    fail(renderer, 'a (build)', ['a output']);
+    fail(renderer, 'b (build)', [long]);
+    fail(renderer, 'c (build)', ['c output']);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'a (build)', status: 'FAILURE', errorMessage: 'Terminated by signal: SIGKILL' },
+        { operationId: 'b (build)', status: 'FAILURE', errorMessage: long },
+        { operationId: 'c (build)', status: 'FAILURE', errorMessage: other }
+      ]
+    });
+    expect(lines()).toHaveLength(11);
+    expect(lines()[3]).toMatch(/^ {2}Cache entry rejected: x+…x+$/);
+    expect(lines().slice(6, 9)).toEqual([
+      'error: a (build)',
+      '  Terminated by signal: SIGKILL',
+      'error: c (build)'
+    ]);
+    expect(lines()[9]).toMatch(/^ {2}Cache entry rejected: y+…y+$/);
+    expect(lines()[9]).toHaveLength(2 + 300);
+    expect(lines()[10]).toBe(
+      'rush build: FAILURE 3/3 operations (3 failures) in 0.0s · failed: a (build), b (build), c (build)'
+    );
+  });
+
+  it('reports at most three operations in all, as they failed or before the summary line', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(renderer, 'a (build)', ['a error']);
+    for (const name of ['q1', 'q2', 'q3']) {
+      renderer.onEvent(status(`${name} (build)`, 'FAILURE'));
+    }
+    fail(renderer, 'b (build)', ['b error']);
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  a error',
+      'failed: b (build) · full log: /repo/b/rush-logs/x.log',
+      '  b error',
+      'failed: q1 (build)',
+      '  (no output)',
+      "+2 more failed operations; their logs are in each project's rush-logs folder",
+      'rush build: FAILURE 5/5 operations (5 failures) in 0.0s · ' +
+        'failed: a (build), q1 (build), q2 (build), q3 (build), b (build)'
+    ]);
+  });
+
+  it('writes a failure report above the live rows on a TTY when the operation fails', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+    renderer.dispose();
+    expect(output[1]).toBe('\x1b[3A\x1b[0J\x1b[?25h');
+    expect(output[2]).toBe(
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log\n  src/a.ts:1:1 - error TS2322: a\n'
+    );
+    expect(output[3].replace(ANSI_ESCAPE, '').split('\n')[2]).toBe('failed: a (build)');
+    expect(output.slice(4)).toEqual(['\x1b[3A\x1b[0J\x1b[?25h']);
+  });
+
+  it('shows the output of a command that failed without running operations', () => {
+    const { renderer, lines } = createRenderer(false, 'install');
+    renderer.onLog(Buffer.from('Installing packages\n'), 'request-id', 'stdout');
+    renderer.onLog(
+      Buffer.from('ERR_PNPM_FETCH_401 GET https://registry.example/pkg: Unauthorized\n'),
+      'request-id',
+      'stderr'
+    );
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      '  ERR_PNPM_FETCH_401 GET https://registry.example/pkg: Unauthorized',
+      'rush install: FAILURE in 0.0s'
+    ]);
+  });
+
+  it('does not claim a successful global command was up to date', () => {
+    const { renderer, output } = createRenderer(false, 'install');
+    renderer.onLog(Buffer.from('Installing packages\n'), 'request-id', 'stdout');
+    renderer.finish({ exitCode: 0 });
+    expect(output).toEqual(['rush install: SUCCESS in 0.0s\n']);
+  });
+
+  describe('on a pipe, with timers', () => {
+    beforeEach(() => jest.useFakeTimers());
+    afterEach(() => jest.useRealTimers());
+
+    function advance(clock: { ms: number }, ms: number): void {
+      clock.ms += ms;
+      jest.advanceTimersByTime(ms);
+    }
+
+    it('writes the connecting line only when the connection takes more than 10 s', () => {
+      const fast: ITestRenderer = createRenderer(false);
+      fast.renderer.start();
+      advance(fast.clock, 3000);
+      fast.renderer.onRequestSent();
+      advance(fast.clock, 10_000);
+      fast.renderer.dispose();
+      expect(fast.lines()).toEqual([
+        'rush build · 3.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 9999);
+      expect(output).toEqual([]);
+      advance(clock, 1);
+      renderer.onRequestSent();
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 10.0s · connecting to rushd (auto-starts if needed)',
+        'rush build · 10.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+    });
+
+    it('starts once, and not after it stopped', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 5_000);
+      // The client starts it again once routing chose the daemon.
+      renderer.start();
+      advance(clock, 5_000);
+      advance(clock, 10_000);
+      expect(lines()).toEqual(['rush build · 10.0s · connecting to rushd (auto-starts if needed)']);
+      renderer.dispose();
+
+      for (const isTTY of [false, true]) {
+        const stopped: ITestRenderer = createRenderer(isTTY);
+        stopped.renderer.dispose();
+        stopped.renderer.start();
+        // A timer would keep the client alive after rendering stopped.
+        expect(jest.getTimerCount()).toBe(0);
+        advance(stopped.clock, 30_000);
+        expect(stopped.output).toEqual([]);
+      }
+
+      const tty: ITestRenderer = createRenderer(true);
+      tty.renderer.start();
+      const painted: number = tty.output.length;
+      tty.renderer.start();
+      expect(tty.output).toHaveLength(painted);
+      tty.renderer.dispose();
+    });
+
+    it('writes one line when the client waits for a daemon that is still starting', () => {
+      const early: ITestRenderer = createRenderer(false);
+      early.renderer.start();
+      advance(early.clock, 300);
+      early.renderer.onAwaitStartup(15_000);
+      expect(early.lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)'
+      ]);
+      advance(early.clock, 1_000);
+      early.renderer.onAwaitStartup(15_000);
+      // The connecting line is not due after this line.
+      advance(early.clock, 11_000);
+      expect(early.output).toHaveLength(1);
+      early.renderer.onRequestSent();
+      early.renderer.dispose();
+      expect(early.lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)',
+        'rush build · 12.3s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+
+      // As usual, the first startup deadline (15 s) comes after the connecting line.
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 10_000);
+      advance(clock, 5_000);
+      renderer.onAwaitStartup(15_000);
+      advance(clock, 6_000);
+      renderer.onRequestSent();
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 10.0s · connecting to rushd (auto-starts if needed)',
+        'rush build · 15.0s · rushd is still starting; waiting for it (up to 15s more)',
+        'rush build · 21.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+    });
+
+    it('names the process it waits for in the line for a daemon that is still starting', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 300);
+      renderer.onAwaitStartup(15_000, 'Its startup helper (PID 4242) is still waiting for the daemon');
+      renderer.onAwaitStartup(14_000, 'Another client is still starting the daemon');
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more) because its startup ' +
+          'helper (PID 4242) is still waiting for the daemon'
+      ]);
+    });
+
+    it('writes nothing for a request that is handed to in-process Rush within 10 s', () => {
+      const { renderer, output, clock } = createRenderer(false);
+      renderer.start();
+      advance(clock, 9000);
+      renderer.dispose();
+      advance(clock, 60_000);
+      expect(output).toEqual([]);
+    });
+
+    it('writes a status line after 25 s of silence, with the running and failed operations', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'c', 'd', 'e']) {
+        renderer.onEvent(registered(`${name} (build)`));
+      }
+      advance(clock, 20_000);
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onEvent(status('b (build)', 'EXECUTING'));
+      advance(clock, 4999);
+      expect(lines()).toHaveLength(1);
+      advance(clock, 1);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 20_000);
+      renderer.onEvent(status('c (build)', 'EXECUTING'));
+      renderer.onEvent(status('d (build)', 'EXECUTING'));
+      renderer.onEvent(status('e (build)', 'EXECUTING'));
+      fail(renderer, 'a (build)', ['error TS2322']);
+      // The failure report postpones the status line that was due at 50 s.
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(4);
+      advance(clock, 1);
+      renderer.onEvent(status('b (build)', 'SUCCESS'));
+      advance(clock, 25_000);
+      clock.ms += 1000;
+      renderer.finish({ exitCode: 1 });
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build 0/5 · 25.0s · running: a (build), b (build)',
+        // The failure report is written when the operation fails, and the next status line is due 25 s later.
+        'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+        '  error TS2322',
+        'rush build 1/5 · 70.0s · running: b (build), c (build), d (build) +1 more · failed: a (build)',
+        'rush build 2/5 · 95.0s · running: c (build), d (build), e (build) · failed: a (build)',
+        'rush build: FAILURE 2/5 operations (1 failure, 1 success) in 96.0s · failed: a (build)'
+      ]);
+    });
+
+    it('does not claim that a request is still queued once it may have been admitted', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 2000);
+      renderer.onQueuePosition(1);
+      advance(clock, 23_000);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build · 25.0s · waiting for admission or the workspace graph (queue position 1 at 2.0s)',
+        'rush build 0/1 · 50.0s · running: a (build)'
+      ]);
+    });
+
+    it('names the operations that an earlier failed command left running as the latest position does', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      renderer.onQueuePosition(1, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+      advance(clock, 24_900);
+      advance(clock, 5_000);
+      renderer.onQueuePosition(1, { count: 1, names: ['t8-slow2'] });
+      advance(clock, 20_000);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      advance(clock, 25_000);
+      renderer.dispose();
+      const left: string = 'left running by an earlier failed command';
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        `rush build · 25.0s · waiting for 2 operations ${left} (queue position 1 at 0.1s): t8-slow1, t8-slow2`,
+        `rush build · 50.0s · waiting for 1 operation ${left} (queue position 1 at 30.0s): t8-slow2`,
+        'rush build 0/1 · 75.0s · running: a (build)'
+      ]);
+    });
+
+    it('says that rushd stops the operations that an earlier failed command left running for the request', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      renderer.onQueuePosition(1, { count: 1, names: ['t8-slow1'], stopping: true });
+      advance(clock, 24_900);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build · 25.0s · waiting while rushd stops 1 operation left running by an earlier failed command ' +
+          '(queue position 1 at 0.1s): t8-slow1',
+        'rush build 0/1 · 50.0s · running: a (build)'
+      ]);
+    });
+
+    it('says that a command sent to a new daemon was resubmitted, not what it waited for at the exited daemon (tasks 108 and 145)', async () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const handlers: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
+        rushx: false,
+        stderrIsTTY: false,
+        daemonPid: 41,
+        now: () => clock.ms,
+        agentRenderer: renderer,
+        writeStderrAsync: async () => undefined
+      });
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+      advance(clock, 4_900);
+      await handlers.onRestartAsync({
+        restart: 1,
+        reason: undefined,
+        successorPid: undefined,
+        exitedPid: 41
+      });
+      advance(clock, 25_000);
+      advance(clock, 5_000);
+      await handlers.onQueuePositionAsync(1);
+      advance(clock, 20_000);
+      advance(clock, 2_000);
+      handlers.dispose();
+      renderer.finish({ exitCode: 0 });
+      const left: string = 'left running by an earlier failed command';
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.',
+        `rush build · 30.0s · ${RESUBMITTED_PHASE}`,
+        'rush build · 55.0s · waiting for admission or the workspace graph (queue position 1 at 35.0s)',
+        // The command did wait behind them, before it was resubmitted.
+        'rush build: SUCCESS up to date (no operations needed) in 57.0s · ' +
+          `queued behind 2 operations ${left} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+    });
+
+    it('says that a command which waited for another Rush process was resubmitted after the daemon restarted', async () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const writeStderrAsync = async (): Promise<void> => undefined;
+      const handlers: INativeLockWaitNoticeHandlers = withNativeLockWaitNotices(
+        createDaemonRequestNoticeHandlers({
+          rushx: false,
+          stderrIsTTY: false,
+          daemonPid: 41,
+          now: () => clock.ms,
+          agentRenderer: renderer,
+          writeStderrAsync
+        }),
+        { rushx: false, agentRenderer: renderer, now: () => clock.ms, writeStderrAsync }
+      );
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { pid: 4242, command: 'rush install' });
+      advance(clock, 4_900);
+      // The install changed the lockfile, so the daemon restarted at once.
+      await handlers.onRestartAsync({
+        restart: 1,
+        reason: { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/pnpm-lock.yaml'] },
+        successorPid: 43
+      });
+      advance(clock, 20_100);
+      handlers.dispose();
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        "rush build · 0.1s · waiting for another Rush process (PID 4242: rush install) to release this repository's lock",
+        'rush-client: A command restarted the daemon (PID 43) because common/config/rush/pnpm-lock.yaml changed.'
+      ]);
+    });
+
+    it('writes status lines after a failure report, and none after the summary', () => {
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      renderer.onQueuePosition(1);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      fail(renderer, 'a (build)', ['error']);
+      expect(lines()).toHaveLength(3);
+      advance(clock, 25_000);
+      expect(lines()[3]).toBe('rush build 1/1 · 25.0s · running · failed: a (build)');
+      renderer.finish({ exitCode: 1 });
+      const written: number = output.length;
+      advance(clock, 100_000);
+      expect(output).toHaveLength(written);
+    });
+
+    it('names a failed operation that wrote no output in a status line 1 s after it failed', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'q']) {
+        renderer.onEvent(registered(`${name} (build)`));
+        renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      }
+      advance(clock, 2000);
+      renderer.onEvent(status('q (build)', 'FAILURE', '/repo/q/rush-logs/x.log'));
+      advance(clock, 999);
+      expect(lines()).toHaveLength(1);
+      advance(clock, 1);
+      expect(lines()).toHaveLength(2);
+      // The next status line is due 25 s after that one, as usual.
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.finish({
+        exitCode: 1,
+        operationResults: [
+          { operationId: 'a (build)', status: 'SUCCESS' },
+          { operationId: 'b (build)', status: 'SUCCESS' },
+          { operationId: 'q (build)', status: 'FAILURE', errorMessage: 'Returned error code: 1' }
+        ]
+      });
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build 1/3 · 3.0s · running: a (build), b (build) · failed: q (build)',
+        'rush build 1/3 · 28.0s · running: a (build), b (build) · failed: q (build)',
+        'failed: q (build) · full log: /repo/q/rush-logs/x.log',
+        '  Returned error code: 1',
+        'rush build: FAILURE 3/3 operations (1 failure, 2 success) in 28.0s · failed: q (build)'
+      ]);
+    });
+
+    it('writes no status line for a failure without output when the result comes within 1 s', () => {
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      renderer.onEvent(registered('q (build)'));
+      renderer.onEvent(registered('top (build)'));
+      renderer.onEvent(status('q (build)', 'EXECUTING'));
+      renderer.onEvent(status('q (build)', 'FAILURE'));
+      renderer.onEvent(status('top (build)', 'BLOCKED'));
+      advance(clock, 999);
+      renderer.finish({
+        exitCode: 1,
+        operationResults: [
+          { operationId: 'q (build)', status: 'FAILURE', errorMessage: 'Returned error code: 1' },
+          { operationId: 'top (build)', status: 'BLOCKED' }
+        ]
+      });
+      const written: number = output.length;
+      advance(clock, 100_000);
+      expect(output).toHaveLength(written);
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'failed: q (build)',
+        '  Returned error code: 1',
+        'rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 1.0s · failed: q (build)'
+      ]);
+    });
+
+    it('names failures without output that no line named yet in one status line, however they interleave', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'q1', 'q2', 'q3']) {
+        renderer.onEvent(registered(`${name} (build)`));
+        renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      }
+      renderer.onEvent(status('q1 (build)', 'FAILURE'));
+      advance(clock, 600);
+      // A second failure without output does not postpone the line.
+      renderer.onEvent(status('q2 (build)', 'FAILURE'));
+      advance(clock, 399);
+      expect(lines()).toHaveLength(1);
+      advance(clock, 1);
+      expect(lines()[1]).toBe(
+        'rush build 2/5 · 1.0s · running: a (build), b (build), q3 (build) · failed: q1 (build), q2 (build)'
+      );
+      // A failure report does not name an earlier failure without output, so a status line follows 1 s after it.
+      advance(clock, 5000);
+      renderer.onEvent(status('q3 (build)', 'FAILURE'));
+      advance(clock, 500);
+      fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+      advance(clock, 999);
+      expect(lines()).toHaveLength(4);
+      advance(clock, 1);
+      renderer.dispose();
+      expect(lines().slice(2)).toEqual([
+        'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+        '  src/a.ts:1:1 - error TS2322: a',
+        'rush build 4/5 · 7.5s · running: b (build) · failed: q1 (build), q2 (build), q3 (build) +1 more'
+      ]);
+    });
+
+    it('writes a restart wait at once when it is announced, and then in place of the queue position', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const wait = (count: string): string =>
+        `waiting for ${count} to finish; the daemon (PID 41) then restarts, because x changed`;
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 400);
+      renderer.onQueuePosition(1);
+      advance(clock, 600);
+      // It says whether it wrote the wait as a line, so the client knows whether a restart notice would repeat it.
+      expect(renderer.onRestartWait(wait('2 running requests'), true)).toBe(true);
+      advance(clock, 1000);
+      expect(renderer.onRestartWait(wait('1 running request'), false)).toBe(false);
+      advance(clock, 23_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.dispose();
+      expect(renderer.onRestartWait(wait('3 running requests'), true)).toBe(false);
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        `rush build · 1.0s · ${wait('2 running requests')}`,
+        `rush build · 26.0s · ${wait('1 running request')}`
+      ]);
+    });
+
+    it('writes no restart wait once the client asked rushd to cancel the request (tasks 166 and 132)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const wait: string =
+        'waiting for 1 running request to finish; the daemon (PID 41) then restarts, because x changed';
+      renderer.start();
+      renderer.onRequestSent();
+      expect(renderer.onRestartWait(wait, true)).toBe(true);
+      advance(clock, 2000);
+      renderer.onCancelRequested(5_000);
+      expect(renderer.onRestartWait(`${wait} again`, true)).toBe(false);
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        `rush build · 0.0s · ${wait}`,
+        'rush build · 2.0s · cancelling; waiting up to 5s for rushd to stop the request',
+        'rush build · 27.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      ]);
+    });
+
+    it('writes a note like any other line, so the next status line is due 25 s after it', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 20_000);
+      renderer.note('rush-client: restarted the daemon.');
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush-client: restarted the daemon.',
+        'rush build · 45.0s · sent to rushd; preparing the workspace graph'
+      ]);
+    });
+
+    it('says at once that rushd has not responded, and in the status lines, until it responds again', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'c', 'd', 'e']) {
+        renderer.onEvent(registered(`${name} (build)`));
+        renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      }
+      for (const name of ['a', 'b', 'c', 'd']) {
+        renderer.onEvent(status(`${name} (build)`, 'SUCCESS'));
+      }
+      // rushd stops at 5 s; the client reports it once rushd has sent nothing for 30 s.
+      advance(clock, 25_000);
+      advance(clock, 10_000);
+      renderer.onDaemonUnresponsive({ pid: 12345, silentForMs: 30_000 });
+      advance(clock, 25_000);
+      advance(clock, 15_200);
+      renderer.onDaemonResponsive({ pid: 12345, silentForMs: 70_200 });
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build 4/5 · 25.0s · running: e (build)',
+        'rush build 4/5 · 35.0s · rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
+        'rush build 4/5 · 60.0s · rushd (PID 12345) has not responded for 55s',
+        'rush build 4/5 · 75.2s · rushd (PID 12345) responded again after 70s',
+        'rush build 4/5 · 100.2s · running: e (build)'
+      ]);
+    });
+
+    it('says nothing more about a silent rushd once the client asked it to cancel the request', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 20_000);
+      renderer.onDaemonUnresponsive({ pid: undefined, silentForMs: 20_000 });
+      advance(clock, 2_000);
+      renderer.onCancelRequested(5_000);
+      renderer.onDaemonUnresponsive({ pid: undefined, silentForMs: 22_000 });
+      renderer.onDaemonResponsive({ pid: undefined, silentForMs: 22_500 });
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build · 20.0s · rushd has not responded for 20s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
+        'rush build · 22.0s · cancelling; waiting up to 5s for rushd to stop the request',
+        'rush build · 47.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      ]);
+    });
+  });
+
+  it('writes a note between progress lines on a pipe', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.start();
+    renderer.onRequestSent();
+    renderer.note('rush-client: restarted the daemon.');
+    renderer.finish({ exitCode: 0 });
+    renderer.note('after the summary');
+    expect(output).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)\n',
+      'rush-client: restarted the daemon.\n',
+      'rush build: SUCCESS up to date (no operations needed) in 0.0s\n'
+    ]);
+  });
+
+  it('shows a restart wait as the phase of the live rows on a TTY, and writes no line for it', () => {
+    const { renderer, output } = createRenderer(true, 'build', 200);
+    renderer.start();
+    expect(
+      renderer.onRestartWait(
+        'waiting for 1 running request to finish; the daemon (PID 41) then restarts',
+        true
+      )
+    ).toBe(false);
     expect(output).toHaveLength(2);
-    clock.ms = 3000;
-    renderer.onEvent(status('p1 (build)', 'SUCCESS'));
+    expect(output[1].replace(ANSI_ESCAPE, '')).toMatch(
+      /^. rush build · 0\.0s · waiting for 1 running request to finish; the daemon \(PID 41\) then restarts\n/
+    );
+    renderer.dispose();
+  });
+
+  it('shows on a TTY that rushd has not responded, with what to do, until it responds again', () => {
+    const { renderer, output, clock } = createRenderer(true, 'build', 250);
+    const firstRow = (text: string): string => text.replace(ANSI_ESCAPE, '').split('\n')[0];
+    renderer.start();
+    clock.ms = 35_000;
+    renderer.onDaemonUnresponsive({ pid: 12345, silentForMs: 30_000 });
     expect(output).toHaveLength(2);
+    expect(firstRow(output[1])).toMatch(
+      /^. rush build · 35\.0s · rushd \(PID 12345\) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
+    );
+    clock.ms = 75_200;
+    renderer.onDaemonResponsive({ pid: 12345, silentForMs: 70_200 });
+    expect(output).toHaveLength(3);
+    expect(firstRow(output[2])).toMatch(/^. rush build · 75\.2s · connecting to rushd/);
+    renderer.dispose();
+  });
+
+  it('writes a note above the live rows on a TTY and redraws them below it', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    renderer.note('rush-client: restarted the daemon.');
+    expect(output.slice(1, 3)).toEqual(['\x1b[3A\x1b[0J\x1b[?25h', 'rush-client: restarted the daemon.\n']);
+    expect(output[3].startsWith('\x1b[?25l')).toBe(true);
+    expect(output[3].replace(ANSI_ESCAPE, '')).toMatch(/^. rush build · 0\.0s · connecting/);
     renderer.dispose();
   });
 
@@ -196,4 +1790,95 @@ describe(AgentProgressRenderer.name, () => {
     expect(output[output.length - 2]).toBe('\x1b[3A\x1b[0J\x1b[?25h');
     expect(output[output.length - 1]).toContain('rush build: SUCCESS');
   });
+
+  it('shows the wait for a daemon that is still starting as the phase on a TTY', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    renderer.onAwaitStartup(15_000);
+    renderer.dispose();
+    expect(output).toHaveLength(3);
+    // The row is clipped to the 60 columns of the test terminal.
+    expect(output[1].replace(ANSI_ESCAPE, '').split('\n')[0]).toMatch(
+      /^. rush build · 0\.0s · rushd is still starting; waiting for…$/
+    );
+  });
+
+  it('says on a TTY that a command which waited for another Rush process was resubmitted after the daemon restarted', async () => {
+    const { renderer, output, clock } = createRenderer(true, 'build', 120);
+    const firstRow = (): string => output[output.length - 1].replace(ANSI_ESCAPE, '').split('\n')[0].slice(2);
+    const writeStderrAsync = async (): Promise<void> => undefined;
+    const handlers: INativeLockWaitNoticeHandlers = withNativeLockWaitNotices(
+      createDaemonRequestNoticeHandlers({
+        rushx: false,
+        stderrIsTTY: true,
+        daemonPid: 41,
+        now: () => clock.ms,
+        agentRenderer: renderer,
+        writeStderrAsync
+      }),
+      { rushx: false, agentRenderer: renderer, now: () => clock.ms, writeStderrAsync }
+    );
+    renderer.start();
+    renderer.onRequestSent();
+    clock.ms = 100;
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: 4242, command: 'rush install' });
+    // On a TTY, no line says so; only the phase shows the wait.
+    expect(firstRow()).toBe(
+      "rush build · 0.1s · waiting for another Rush process (PID 4242: rush install) to release this repository's lock"
+    );
+    clock.ms = 5_000;
+    // The install changed the lockfile, so the daemon restarted at once.
+    await handlers.onRestartAsync({
+      restart: 1,
+      reason: { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/pnpm-lock.yaml'] },
+      successorPid: 43
+    });
+    expect(output.join('')).toContain(
+      'rush-client: A command restarted the daemon (PID 43) because common/config/rush/pnpm-lock.yaml changed.\n'
+    );
+    expect(firstRow()).toBe(`rush build · 5.0s · ${RESUBMITTED_PHASE}`);
+    handlers.dispose();
+    renderer.dispose();
+  });
+
+  it('repaints a TTY on its timer rather than on every event, and shows failures in the last row', () => {
+    jest.useFakeTimers();
+    try {
+      const { renderer, output } = createRenderer(true);
+      renderer.start();
+      for (let i: number = 0; i < 100; i++) {
+        renderer.onEvent(status(`p${i} (build)`, 'EXECUTING'));
+      }
+      renderer.onEvent(status('p0 (build)', 'FAILURE'));
+      expect(output).toHaveLength(1);
+      jest.advanceTimersByTime(100);
+      expect(output).toHaveLength(2);
+      const rows: string[] = output[1].replace(ANSI_ESCAPE, '').split('\n');
+      expect(rows[0]).toMatch(/^. rush build 1\/100 · 0\.0s · running$/);
+      expect(rows[1]).toBe('running: p1 (build), p2 (build), p3 (build) +96 more');
+      expect(rows[2]).toBe('failed: p0 (build)');
+      renderer.dispose();
+      jest.advanceTimersByTime(1000);
+      expect(output).toHaveLength(3);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('writes no status line on a TTY for a failed operation that wrote no output', () => {
+    jest.useFakeTimers();
+    try {
+      const { renderer, output } = createRenderer(true);
+      renderer.start();
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onEvent(status('a (build)', 'FAILURE'));
+      jest.advanceTimersByTime(30_000);
+      expect(output.length).toBeGreaterThan(1);
+      // Every write after the first paint repaints the live rows.
+      expect(output.slice(1).filter((text) => !text.startsWith('\x1b[3A\x1b[0J'))).toEqual([]);
+      renderer.dispose();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
 });
diff --git a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
index 5aea17bc372..eac7e35547c 100644
--- a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
+++ b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
@@ -53,6 +53,7 @@ describe(parseClientAdmissionControls.name, () => {
       })
     ).toEqual({
       argv: ['build', '--', '--wait-timeout=2'],
+      nativeArgv: ['build', '--', '--wait-timeout=2'],
       commandName: 'build',
       daemon: false,
       admission: { noWait: true }
@@ -68,20 +69,63 @@ describe(getConfiguredAdmission.name, () => {
     });
   });
 
-  it('keeps an explicitly configured timeout as one absolute deadline', () => {
+  it('does not mark an explicitly configured timeout as the default', () => {
     expect(getConfiguredAdmission({ queueTimeoutSeconds: 1.5, explicit: true })).toEqual({ waitTimeoutMs: 1500 });
   });
 });
 
 describe(formatAdmissionFailure.name, () => {
-  it('explains a wait timeout and how to wait longer', () => {
+  it('explains a wait timeout and offers only the per-invocation way to wait longer', () => {
     const message: string = formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 });
-    expect(message).toContain('daemon admission failed (wait-timeout): timed out after 5s waiting for');
-    expect(message).toContain('--wait-timeout <seconds>');
-    expect(message).toContain('RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS');
+    expect(message).toContain(
+      'daemon admission failed (wait-timeout): timed out after its 5s wait timeout waiting for'
+    );
+    expect(message).toContain('pass --wait-timeout <seconds>');
+    // Exporting it would break later commands of Rush versions that reject unknown RUSH_ variables.
+    expect(message).not.toContain('RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS');
   });
 
   it('explains a no-wait failure', () => {
     expect(formatAdmissionFailure('no-wait', { noWait: true })).toContain('--no-wait was specified');
   });
+
+  it("prints the daemon's reason for a wait timeout instead of the generic explanation", () => {
+    const reason: string =
+      "The rushx script was not admitted before the daemon could restart for another request's environment. " +
+      'Use --wait-timeout <seconds> to wait longer.';
+    expect(formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 }, reason)).toBe(
+      `rush-client: daemon admission failed (wait-timeout): ${reason}\n`
+    );
+  });
+
+  it("adds the way to wait longer when the daemon's reason does not name it", () => {
+    expect(
+      formatAdmissionFailure(
+        'wait-timeout',
+        { waitTimeoutMs: 5000 },
+        'The request was not admitted within 5000ms.'
+      )
+    ).toBe(
+      'rush-client: daemon admission failed (wait-timeout): The request was not admitted within 5000ms. ' +
+        'To wait longer, pass --wait-timeout <seconds>.\n'
+    );
+  });
+
+  it("prints the daemon's reason for a no-wait failure", () => {
+    const reason: string =
+      'Another request is waiting to restart the daemon for its environment; ' +
+      'the rushx script did not wait for the restart.';
+    expect(formatAdmissionFailure('no-wait', { noWait: true }, reason)).toBe(
+      `rush-client: daemon admission failed (no-wait): ${reason}\n`
+    );
+  });
+
+  it('keeps the generic explanation when the daemon sent no reason', () => {
+    expect(formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 }, '')).toBe(
+      formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 })
+    );
+    expect(formatAdmissionFailure('no-wait', { noWait: true }, '')).toBe(
+      formatAdmissionFailure('no-wait', { noWait: true })
+    );
+  });
 });
diff --git a/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts b/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts
index f4ec40eb3a1..e251e711011 100644
--- a/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts
+++ b/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts
@@ -30,6 +30,7 @@ import {
 import { DaemonFrameListener, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 describe('generation-aware graph reference client', () => {
   it.each([
@@ -55,6 +56,7 @@ describe('generation-aware graph reference client', () => {
           path.join(folder, 'rush.json'),
           JSON.stringify({
             rushVersion: Rush.version,
+            suppressNodeLtsWarning: true,
             npmVersion: '10.0.0',
             projects: []
           })
@@ -146,7 +148,7 @@ describe('generation-aware graph reference client', () => {
           ],
           {
             cwd: folder,
-            env: { ...process.env, RUSH_DAEMON_EXPERIMENTAL: '1' },
+            env: { ...getTestProcessEnvironment(), RUSH_DAEMON_EXPERIMENTAL: '1' },
             stdio: ['ignore', 'pipe', 'pipe']
           }
         );
@@ -237,6 +239,7 @@ describe('generation-aware graph reference client', () => {
           path.join(folder, 'rush.json'),
           JSON.stringify({
             rushVersion: Rush.version,
+            suppressNodeLtsWarning: true,
             npmVersion: '10.0.0',
             projects: [],
             daemon:
@@ -384,7 +387,7 @@ describe('generation-aware graph reference client', () => {
           {
             cwd: folder,
             env: {
-              ...process.env,
+              ...getTestProcessEnvironment(),
               RUSH_DAEMON_EXPERIMENTAL: '1',
               RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: mode === 'environment-timeout' ? '0.25' : undefined
             },
diff --git a/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts b/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts
index 79670f27900..e6e812b3ce5 100644
--- a/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts
+++ b/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts
@@ -9,6 +9,36 @@ import * as path from 'node:path';
 import { createNativeBuildTestFixture } from './NativeBuildTestFixture';
 
 describe('native build fixture lifetime', () => {
+  it('gives spawned clients the default output when the tests run in an agent shell', async () => {
+    const saved: Record<string, string | undefined> = {
+      COPILOT_CLI: process.env.COPILOT_CLI,
+      RUSHD_OUTPUT: process.env.RUSHD_OUTPUT
+    };
+    process.env.COPILOT_CLI = '1';
+    process.env.RUSHD_OUTPUT = 'agent';
+    const fixture = createNativeBuildTestFixture();
+    try {
+      expect(fixture.environment.COPILOT_CLI).toBeUndefined();
+      expect(fixture.environment.RUSHD_OUTPUT).toBeUndefined();
+      await fixture.runAsync(async ({ invokeAsync }) => {
+        const result = await invokeAsync(['build', '--to', 'a', '--verbose']);
+        expect(result.code).toBe(0);
+        expect(result.stderr).not.toMatch(/using in-process/i);
+        expect(result.stdout).toContain('built-a-one');
+        expect(result.stdout).not.toContain('connecting to rushd');
+      });
+    } finally {
+      for (const [name, value] of Object.entries(saved)) {
+        if (value === undefined) {
+          delete process.env[name];
+        } else {
+          process.env[name] = value;
+        }
+      }
+      await fixture.closeAsync();
+    }
+  }, 60000);
+
   it('joins the whole old callback without rebinding it to a later fixture', async () => {
     const old = createNativeBuildTestFixture();
     const next = createNativeBuildTestFixture();
diff --git a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
index 07eb1bd763e..7215331fa58 100644
--- a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
+++ b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
@@ -17,6 +17,8 @@ import {
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 export interface INativeBuildResult {
   readonly code: number | undefined;
   readonly stdout: string;
@@ -41,13 +43,13 @@ export interface INativeBuildTestFixture {
 export function createNativeBuildTestFixture(): INativeBuildTestFixture {
   const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-native-'));
   const environment: NodeJS.ProcessEnv = {
-    ...process.env,
+    ...getTestProcessEnvironment(),
     RUSH_DAEMON: '1',
     RUSH_REPORTER: 'legacy',
     CI: 'false',
     TF_BUILD: 'false',
     GITHUB_ACTIONS: 'false',
-    XDG_RUNTIME_DIR: folder
+    RUSHD_RUNTIME_DIR: folder
   };
   const invocationClosures: Promise<unknown[]>[] = [];
   const callbacks: Promise<void>[] = [];
@@ -62,6 +64,7 @@ export function createNativeBuildTestFixture(): INativeBuildTestFixture {
     'rush.json',
     JSON.stringify({
       rushVersion: Rush.version,
+      suppressNodeLtsWarning: true,
       npmVersion: '10.0.0',
       daemon: { enabled: true, autoStart: true, idleTimeoutSeconds: 30 },
       projectFolderMinDepth: 1,
@@ -110,6 +113,9 @@ export function createNativeBuildTestFixture(): INativeBuildTestFixture {
   execFileSync(
     'git',
     [
+      // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+      '-c',
+      'maintenance.auto=false',
       '-c',
       'user.name=Client Test',
       '-c',
diff --git a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
new file mode 100644
index 00000000000..5312815bc74
--- /dev/null
+++ b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
@@ -0,0 +1,303 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  OperationOutputExcerpt,
+  clipLine,
+  isErrorLine,
+  normalizeExcerptLine
+} from '../OperationOutputExcerpt';
+
+const ESC: string = String.fromCharCode(27);
+
+// Shaped like a Heft plugin that fails to load: the cause is on one line, followed by a long require stack.
+const REQUIRE_STACK_FAILURE: string = [
+  '',
+  'Internal Error: Could not load plugin from "/repo/tools/example-plugin/lib/ExamplePlugin.js": ' +
+    "Error: Cannot find module '/repo/tools/example-plugin/lib/ExamplePlugin.js'",
+  'Require stack:',
+  ...Array.from(
+    { length: 8 },
+    (unused, i) =>
+      `- /repo/common/temp/node_modules/.pnpm/@rushstack+heft@1.2.3/node_modules/@rushstack/heft/lib/m${i}.js`
+  ),
+  '',
+  'You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.',
+  ''
+].join('\n');
+
+// Shaped like Heft's Jest plugin output: prefixed lines, a message, a code frame and stack frames per test.
+function jestFailure(testNames: ReadonlyArray<string>): string {
+  const lines: string[] = [];
+  for (const [index, testName] of testNames.entries()) {
+    lines.push(
+      `[test:jest]   ● ${testName}`,
+      '[test:jest] ',
+      '[test:jest]     1',
+      '[test:jest] ',
+      '[test:jest]     ERROR: The following environment variables were found with the "RUSH_" prefix,',
+      '[test:jest]     but they are not recognized by this version of Rush: RUSH_EXAMPLE',
+      '[test:jest] ',
+      '[test:jest]       11 |   if (result.status !== 0) {',
+      '[test:jest]     > 12 |     throw new Error(`${result.status}`);',
+      '[test:jest]          |           ^',
+      '[test:jest]       13 |   }',
+      '[test:jest] ',
+      `[test:jest]       at runStep (src/test/example.test.ts:12:11)`,
+      `[test:jest]       at Object.runStep (src/test/example.test.ts:${40 + index}:3)`,
+      '[test:jest] '
+    );
+  }
+  lines.push(`[test:jest] Error: ${testNames.length} Jest tests failed`, 'Encountered 1 error', '');
+  return lines.join('\n');
+}
+
+describe(normalizeExcerptLine.name, () => {
+  it('removes colors, carriage-return overwrites and the whitespace after a task prefix', () => {
+    expect(normalizeExcerptLine(`${ESC}[31merror${ESC}[39m TS2304: x`)).toBe('error TS2304: x');
+    expect(normalizeExcerptLine('progress 10%\rprogress 100%\r')).toBe('progress 100%');
+    expect(normalizeExcerptLine('[build:lint]     Warning: src/x.ts:1:1')).toBe(
+      '[build:lint] Warning: src/x.ts:1:1'
+    );
+    expect(normalizeExcerptLine(`${ESC}]8;;https://example.com${String.fromCharCode(7)}link`)).toBe('link');
+  });
+
+  it('drops empty, prefix-only and noise lines', () => {
+    for (const line of [
+      '',
+      '   ',
+      '[test:jest] ',
+      '    at Object.<anonymous> (src/x.test.ts:12:19)',
+      '    at async Promise.all (index 0)',
+      '    at new Promise (<anonymous>)',
+      'Require stack:',
+      '- /repo/node_modules/x/lib/index.js',
+      '- C:\\repo\\node_modules\\x\\lib\\index.js',
+      '[test:jest]     > 12 |     throw new Error();',
+      '[test:jest]          |           ^',
+      ' ---- build started ---- ',
+      '-------------------- Finished (12.407s) --------------------',
+      'Invoking: heft run --only build -- --clean ',
+      'Invoking (incremental): heft run --only build --',
+      'This project was not found in the build cache.',
+      'Build cache hit.',
+      'Caching build output folders: lib, lib-commonjs',
+      'Successfully set cache entry.'
+    ]) {
+      expect(normalizeExcerptLine(line)).toBeUndefined();
+    }
+  });
+
+  it('keeps English lines that merely start with "at"', () => {
+    expect(normalizeExcerptLine('at least one project failed')).toBe('at least one project failed');
+  });
+
+  it('clips very long lines, keeping their start and end', () => {
+    const line: string | undefined = normalizeExcerptLine(
+      `start ${'x'.repeat(10000)} Cannot find module 'y'`
+    );
+    expect(line?.length).toBe(300);
+    expect(line?.startsWith('start ')).toBe(true);
+    expect(line?.endsWith("Cannot find module 'y'")).toBe(true);
+  });
+});
+
+describe(isErrorLine.name, () => {
+  it.each([
+    'src/x.ts(1,1): error TS1005: expected',
+    'src/x.ts:1:1 - error TS2304: Cannot find name',
+    '[test:jest]   ● suite › test',
+    'Error: 3 Jest tests failed',
+    'npm ERR! code ELIFECYCLE',
+    'ERR_PNPM_FETCH_401 GET https://registry.example/pkg: Unauthorized',
+    'Encountered 1 error',
+    'FAIL src/x.test.ts',
+    'Could not load plugin'
+  ])('recognizes %s', (line) => {
+    expect(isErrorLine(line)).toBe(true);
+  });
+
+  it.each([
+    'Found 0 errors. Watching for file changes.',
+    'Linting finished with no errors',
+    'Compiling 12 files'
+  ])('ignores %s', (line) => {
+    expect(isErrorLine(line)).toBe(false);
+  });
+});
+
+describe(clipLine.name, () => {
+  it('leaves short lines alone', () => {
+    expect(clipLine('short', 10)).toBe('short');
+  });
+
+  it('keeps the start and end of long lines', () => {
+    expect(clipLine('abcdefghijklmnopqrstuvwxyz', 10)).toBe('abcdef…xyz');
+  });
+});
+
+describe(OperationOutputExcerpt.name, () => {
+  it('shows the cause of a plugin load failure instead of its require stack', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append(REQUIRE_STACK_FAILURE, 'stderr');
+    const lines: string[] = excerpt.getExcerpt(8);
+    expect(lines).toHaveLength(2);
+    expect(lines[0]).toMatch(/^Internal Error: Could not load plugin/);
+    expect(lines[0]).toContain("Cannot find module '");
+    expect(lines[1]).toMatch(/^You have encountered a software defect/);
+  });
+
+  it('shows the failing tests, the message and the summary of a Jest failure', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('[test:jest] PASS src/test/other.test.ts\n', 'stdout');
+    excerpt.append(jestFailure(['test one', 'test two', 'test three']), 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual([
+      '[test:jest] ● test one',
+      '[test:jest] ERROR: The following environment variables were found with the "RUSH_" prefix,',
+      '[test:jest] but they are not recognized by this version of Rush: RUSH_EXAMPLE',
+      '[test:jest] ● test two',
+      '[test:jest] ● test three',
+      '[test:jest] Error: 3 Jest tests failed'
+    ]);
+    expect(excerpt.getExcerpt(3)).toEqual([
+      '[test:jest] ● test one',
+      '[test:jest] Error: 3 Jest tests failed'
+    ]);
+  });
+
+  it('finds errors that tools report on stdout', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('[build:typescript] Using TypeScript version 5.8.2\n', 'stdout');
+    excerpt.append('[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".\n', 'stdout');
+    excerpt.append('[build:typescript] Encountered 1 error\n', 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual([
+      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".'
+    ]);
+  });
+
+  it("does not spend the error lines of a short excerpt on Rush's own cache and invocation lines", () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('This project was not found in the build cache.\n', 'stdout');
+    excerpt.append('Invoking (initial): heft run --only build -- --clean \n', 'stdout');
+    excerpt.append('[build:typescript] Using TypeScript version 5.8.2\n', 'stdout');
+    excerpt.append('[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".\n', 'stderr');
+    excerpt.append('[build:lint] Using ESLint version 9.37.0\n', 'stdout');
+    excerpt.append('Error: Encountered 1 error\n', 'stderr');
+    expect(excerpt.getExcerpt(3)).toEqual([
+      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".'
+    ]);
+  });
+
+  it('takes the line after an error from the same stream, not from the interleaved other stream', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append(
+      "src/x.ts(3,7): error TS2322: Type 'string' is not assignable to type 'number'.\n",
+      'stderr'
+    );
+    excerpt.append('[build:lint] still linting file 4\n', 'stdout');
+    excerpt.append('  The expected type comes from property "x".\n', 'stderr');
+    excerpt.append("src/y.ts(1,1): error TS2304: Cannot find name 'z'.\n", 'stderr');
+    excerpt.append('[build:lint] still linting file 5\n', 'stdout');
+    excerpt.append('  Did you mean "y"?\n', 'stderr');
+    excerpt.append('Encountered 2 errors\n', 'stderr');
+    expect(excerpt.getExcerpt(5)).toEqual([
+      "src/x.ts(3,7): error TS2322: Type 'string' is not assignable to type 'number'.",
+      'The expected type comes from property "x".',
+      "src/y.ts(1,1): error TS2304: Cannot find name 'z'.",
+      'Did you mean "y"?'
+    ]);
+  });
+
+  it('shows a diagnostic that a tool repeats in its summary once, without the error count', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    const message: string = "src/index.ts:3:7 - (TS2322) Type 'string' is not assignable to type 'number'.";
+    excerpt.append(`[build:typescript] Error: ${message}\n`, 'stdout');
+    excerpt.append('Encountered 1 error\n', 'stderr');
+    excerpt.append(`  [build:typescript] ${message}\n`, 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual([`[build:typescript] Error: ${message}`]);
+  });
+
+  it('keeps an error count that reports more errors than the excerpt shows', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    for (let i: number = 0; i < 12; i++) {
+      excerpt.append(`src/x${i}.ts:1:1 - error TS2304: Cannot find name "y${i}".\n`, 'stdout');
+    }
+    excerpt.append('Encountered 12 errors\n', 'stderr');
+    expect(excerpt.getExcerpt(3)).toEqual([
+      'src/x0.ts:1:1 - error TS2304: Cannot find name "y0".',
+      'src/x1.ts:1:1 - error TS2304: Cannot find name "y1".',
+      'Encountered 12 errors'
+    ]);
+  });
+
+  it('leaves out the lines before an error that names a source location, but not before other errors', () => {
+    const located: OperationOutputExcerpt = new OperationOutputExcerpt();
+    located.append('[build] @x/a: start\n', 'stdout');
+    located.append("ERROR in src/index.ts:4:1: Unexpected token '}'\n", 'stdout');
+    expect(located.getExcerpt(8)).toEqual(["ERROR in src/index.ts:4:1: Unexpected token '}'"]);
+
+    const unlocated: OperationOutputExcerpt = new OperationOutputExcerpt();
+    unlocated.append('src/a.ts(1,1): something unexpected\n', 'stdout');
+    unlocated.append('Build failed\n', 'stdout');
+    expect(unlocated.getExcerpt(8)).toEqual(['src/a.ts(1,1): something unexpected', 'Build failed']);
+  });
+
+  it('does not take a host and port for a source location', () => {
+    for (const error of [
+      'npm ERR! connect ECONNREFUSED registry.example.com:443',
+      'Error: request to https://pkgs.dev.azure.com:443/x failed'
+    ]) {
+      const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+      excerpt.append('Installing @x/a from the registry\n', 'stderr');
+      excerpt.append(`${error}\n`, 'stderr');
+      expect(excerpt.getExcerpt(8)).toEqual(['Installing @x/a from the registry', error]);
+    }
+  });
+
+  it('shows a message that is repeated in another case once', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append("Error: Cannot find module 'X'\n", 'stdout');
+    excerpt.append("error: cannot find module 'x'\n", 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual(["Error: Cannot find module 'X'"]);
+  });
+
+  it('always keeps the last line, which usually is the tool summary', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    for (let i: number = 0; i < 20; i++) {
+      excerpt.append(`error ${i}\n`, 'stderr');
+    }
+    const lines: string[] = excerpt.getExcerpt(8);
+    expect(lines).toHaveLength(8);
+    expect(lines[0]).toBe('error 0');
+    expect(lines[lines.length - 1]).toBe('error 19');
+  });
+
+  it('joins lines split across chunks and records an unterminated last line', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('src/x.ts(1,1): err', 'stdout');
+    excerpt.append('or TS1005: expected\nlast line without newline', 'stdout');
+    expect(excerpt.getExcerpt(8)).toEqual([
+      'src/x.ts(1,1): error TS1005: expected',
+      'last line without newline'
+    ]);
+  });
+
+  it('does not repeat a line that was written to both streams', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('Error: boom\n', 'stdout');
+    excerpt.append('Error: boom\n', 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual(['Error: boom']);
+  });
+
+  it('keeps memory use flat for huge output', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    for (let i: number = 0; i < 100000; i++) {
+      excerpt.append(`line ${i} ${'x'.repeat(100)}\n`, 'stdout');
+    }
+    excerpt.append('x'.repeat(200000), 'stdout');
+    expect(excerpt.lineCount).toBe(100001);
+    const lines: string[] = excerpt.getExcerpt(8);
+    expect(lines).toHaveLength(8);
+    expect(lines[lines.length - 1]).toMatch(/^x+…x+$/);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts b/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts
index 470c0160e3c..e9d3d9672a4 100644
--- a/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts
+++ b/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts
@@ -156,6 +156,9 @@ export function createPersistentIpcTestFixture(
   execFileSync(
     'git',
     [
+      // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+      '-c',
+      'maintenance.auto=false',
       '-c',
       'user.name=IPC Test',
       '-c',
diff --git a/apps/rush-cli-client/src/test/RushXDaemon.test.ts b/apps/rush-cli-client/src/test/RushXDaemon.test.ts
index 0a11be8ad5a..75427560e14 100644
--- a/apps/rush-cli-client/src/test/RushXDaemon.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemon.test.ts
@@ -130,6 +130,14 @@ describe('native Rushx through a real daemon', () => {
     expect(native.stderr.toString()).toContain('raw-err\x1b[31mError: Failed calling');
   });
 
+  it('compares without the readiness notice that a client prints when the daemon answers it late', async () => {
+    const args: string[] = ['fail', 'two words', '--flag'];
+    const native: IScriptResult = await fixture.invokeAsync(true, args, cwd);
+    fixture.delayNextConnection(1500);
+    expect(await fixture.invokeAsync(false, args, cwd)).toEqual(native);
+    expect(fixture.readinessNotices).toBe(1);
+  });
+
   it('retains unregistered-project warnings and native missing-script errors without fallback', async () => {
     for (const [project, script] of [
       ['unregistered', 'args'],
diff --git a/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts b/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
index b8f81115f60..46cf4dfe3a1 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
@@ -158,8 +158,12 @@ console.log(JSON.stringify({
       kind: 'global',
       executor: holdAsync
     });
+    // The workspace parses a custom Rush command before it captures inputs, and that parse falls back in this
+    // fixture. A built-in origin reaches the mocked resolution unparsed, and an unknown built-in command is
+    // still exclusive.
     const holder = fixture.runAsync({
       ...fixture.request(['hold'], path.join(physicalRoot, 'projects/a')),
+      commandOrigin: 'built-in',
       invocationKind: 'rush'
     });
     await holding;
diff --git a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
index ecb58c4df29..06a862bf2b2 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
@@ -156,6 +156,25 @@ describe('native Rushx execution boundaries', () => {
     }
   );
 
+  it("serves a request that sets a variable the daemon host starts without, with the request's value", async () => {
+    const parallelism: string | undefined = process.env.RUSH_PARALLELISM;
+    // A daemon host does not inherit the request-scoped variables of the client that started it.
+    delete process.env.RUSH_PARALLELISM;
+    let cwd: string;
+    try {
+      cwd = await startAsync();
+    } finally {
+      if (parallelism !== undefined) process.env.RUSH_PARALLELISM = parallelism;
+    }
+    fixture.write('projects/a/script.cjs', 'console.log(process.env.RUSH_PARALLELISM);');
+    const result: IRequestResult = await fixture.runAsync(
+      fixture.request(['-q', 'build'], cwd, fixture.environment({ RUSH_PARALLELISM: '2' }))
+    );
+    expect(result.outcome.kind).toBe('result');
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.toString()).toBe('2\n');
+  });
+
   it('runs a script without queueing behind an exclusive workspace request', async () => {
     const cwd: string = await startAsync();
     let release: () => void = () => {};
@@ -175,7 +194,14 @@ describe('native Rushx execution boundaries', () => {
       kind: 'global',
       executor: holdAsync
     });
-    const holder = fixture.runAsync({ ...fixture.request(['hold'], cwd), invocationKind: 'rush' });
+    // The workspace parses a custom Rush command before it captures inputs, and that parse falls back in this
+    // fixture. A built-in origin reaches the mocked resolution unparsed, and an unknown built-in command is
+    // still exclusive.
+    const holder = fixture.runAsync({
+      ...fixture.request(['hold'], cwd),
+      commandOrigin: 'built-in',
+      invocationKind: 'rush'
+    });
     await holding;
     const onQueuePositionAsync = jest.fn(async () => undefined);
     try {
@@ -193,7 +219,9 @@ describe('native Rushx execution boundaries', () => {
 
   it('does not guess package scripts for legacy or custom workspace requests', async () => {
     const cwd: string = await startAsync();
-    const phased = jest.spyOn(fixture.phasedResolver, 'resolveRequestAsync');
+    // The workspace parses a custom Rush command before it captures inputs, and this fixture's requests fall
+    // back there. A rushx request never reaches that parse.
+    const phased = jest.spyOn(fixture.phasedResolver, 'getCommandParameterIdentityAsync');
     for (const invocationKind of [undefined, 'rush'] as const) {
       const request: IDaemonRequestEnvelope = { ...fixture.request(['build'], cwd), invocationKind };
       expect((await fixture.runAsync(request)).outcome).toMatchObject({
@@ -220,10 +248,24 @@ describe('native Rushx execution boundaries', () => {
       kind: 'result',
       result: { exitCode: 1, aborted: true, outcome: 'aborted' }
     });
+    // The client reports the cancellation; the script's end is not an error of its own.
+    expect(result.stderr.toString()).toBe('');
     assertChildrenStopped(output);
     expect((await fixture.runAsync(fixture.request(['-q', 'args'], cwd))).exitCode).toBe(0);
   });
 
+  // cmd.exe has no built-in command that ends its own process with a signal.
+  (process.platform === 'win32' ? it.skip : it)(
+    'names the signal that ended a script, as native Rushx does',
+    async () => {
+      const cwd: string = await startAsync();
+      const served: IScriptResult = await fixture.invokeAsync(false, ['term'], cwd);
+      expect(served).toEqual(await fixture.invokeAsync(true, ['term'], cwd));
+      expect(served.exitCode).toBe(1);
+      expect(served.stderr.toString()).toContain('Error: The script was ended by SIGTERM.');
+    }
+  );
+
   it('cleans disconnected children without retrying the request', async () => {
     const cwd: string = await startAsync();
     const client: DaemonClient = await DaemonClient.connectAsync({
diff --git a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
index 389a3133f87..20f16c8b28a 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
@@ -22,6 +22,8 @@ import {
 } from '@rushstack/rush-daemon';
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 export interface IScriptResult {
   readonly exitCode: number | undefined;
   readonly stdout: Buffer;
@@ -32,6 +34,15 @@ export interface IRequestResult extends IScriptResult {
   readonly outcome: DaemonClientOutcome;
 }
 
+/** Matches the notice a client prints when a daemon listens but misses its hello/ping budget. */
+function createReadinessNoticePattern(socketPath: string): RegExp {
+  const escapedSocketPath: string = socketPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(
+    `^rushx?-client: The daemon is not ready yet\\. A process listens at ${escapedSocketPath} but was not ` +
+      'ready in time, so this command waits up to \\d+ s more for it instead of running Rush in-process\\.$'
+  );
+}
+
 export class RushXDaemonTestFixture implements AsyncDisposable {
   public readonly folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushx-daemon-'));
   public readonly home: string = path.join(this.folder, 'home');
@@ -39,6 +50,9 @@ export class RushXDaemonTestFixture implements AsyncDisposable {
   public readonly errors: Error[] = [];
   public host!: RushDaemonHost;
   public session!: WorkspaceSession;
+  /** The number of readiness notices that {@link RushXDaemonTestFixture.invokeAsync} removed. */
+  public readinessNotices: number = 0;
+  #nextConnectionDelayMs: number = 0;
 
   public constructor(hooks: boolean = false, pnpmSync: boolean = false) {
     this.write(
@@ -77,6 +91,7 @@ export class RushXDaemonTestFixture implements AsyncDisposable {
             early: 'node early.cjs',
             tree: 'node tree.cjs',
             sync: 'node sync.cjs',
+            term: 'kill -TERM $$',
             daemon: 'node args.cjs'
           }
         })
@@ -140,6 +155,11 @@ setInterval(() => {}, 1000);
       onError: (error) => {
         this.errors.push(error);
       },
+      onInteractiveConnection: () => {
+        const delayMs: number = this.#nextConnectionDelayMs;
+        this.#nextConnectionDelayMs = 0;
+        if (delayMs > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
+      },
       createWorkspaceSessionAsync: async (options) => {
         this.session = await WorkspaceSession.createAsync(options);
         return this.session;
@@ -153,9 +173,17 @@ setInterval(() => {}, 1000);
     fs.writeFileSync(fullPath, content);
   }
 
+  /**
+   * Blocks the daemon's event loop (this test process) for `delayMs` as the next client connects, as a loaded
+   * host can, so that client's hello/ping answer arrives late.
+   */
+  public delayNextConnection(delayMs: number): void {
+    this.#nextConnectionDelayMs = delayMs;
+  }
+
   public environment(overrides: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
     return {
-      ...process.env,
+      ...getTestProcessEnvironment(),
       HOME: this.home,
       USERPROFILE: this.home,
       CLIENT_MARKER: 'client',
@@ -248,12 +276,25 @@ setInterval(() => {}, 1000);
         resolve({
           exitCode: exitCode ?? undefined,
           stdout: Buffer.concat(stdout),
-          stderr: Buffer.concat(stderr)
+          stderr: native ? Buffer.concat(stderr) : this.#removeReadinessNotice(Buffer.concat(stderr))
         })
       );
     });
   }
 
+  /**
+   * This daemon runs in the test process, so on a loaded host it can miss a client's 1 s hello/ping budget. The
+   * client then prints a notice as its first line of stderr and waits for the daemon. The notice isn't output of
+   * the command, so this removes it before the comparison with native Rushx. Any other difference still fails.
+   */
+  #removeReadinessNotice(stderr: Buffer): Buffer {
+    const end: number = stderr.indexOf('\n');
+    const firstLine: string = end < 0 ? '' : stderr.toString('utf8', 0, end);
+    if (!createReadinessNoticePattern(this.host.paths.socketPath).test(firstLine)) return stderr;
+    this.readinessNotices++;
+    return stderr.subarray(end + 1);
+  }
+
   public async [Symbol.asyncDispose](): Promise<void> {
     await this.host?.closeAsync();
     fs.rmSync(this.folder, { recursive: true, force: true });
diff --git a/apps/rush-cli-client/src/test/RushXTerminal.test.ts b/apps/rush-cli-client/src/test/RushXTerminal.test.ts
index 746418a87f3..cb57ccd7842 100644
--- a/apps/rush-cli-client/src/test/RushXTerminal.test.ts
+++ b/apps/rush-cli-client/src/test/RushXTerminal.test.ts
@@ -99,7 +99,13 @@ setInterval(()=>{},1000);
         environment,
         stdinIsTTY
       );
-      expect(client).toEqual(native);
+      // RUSH_DAEMON=1 asked for the daemon, so the client says why it did not use it.
+      expect(client).toEqual({
+        ...native,
+        output:
+          'rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.\r\n' +
+          native.output
+      });
       expect(fs.readFileSync(path.join(cwd, 'tty-runs.txt'), 'utf8')).toBe('run\nrun\n');
       expect(resolve).not.toHaveBeenCalled();
     },
diff --git a/apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts b/apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts
new file mode 100644
index 00000000000..513fa9c458a
--- /dev/null
+++ b/apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameListener, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+// A stand-in daemon that acknowledges a shutdown and then exits without releasing its files, as a daemon that
+// crashes while it shuts down does. Once it listens, it starts an operation process, which shares its process group
+// like a phased operation and keeps running after it exits, and prints that process's PID.
+async function mainAsync(): Promise<void> {
+  const paths: IDaemonPaths = JSON.parse(process.argv[2]);
+  await DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: (connection) => {
+      connection.onFrame(async (frame) => {
+        const message = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'hello') {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage({
+              kind: 'helloAck',
+              payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'stand-in' }
+            })
+          });
+        } else if (message.kind === 'ping') {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage({
+              kind: 'pong',
+              payload: { daemonVersion: 'stand-in', uptimeMs: 1, pid: process.pid }
+            })
+          });
+        } else if (message.kind === 'shutdown') {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage({ kind: 'shutdownAck', payload: {} })
+          });
+          await connection.closeAsync();
+          process.kill(process.pid, 'SIGKILL');
+        }
+      });
+    }
+  });
+  const operation: ChildProcess = spawn(process.execPath, ['-e', process.argv[3]], { stdio: 'ignore' });
+  process.stdout.write(`${operation.pid}\n`);
+}
+
+mainAsync().catch((error: Error) => {
+  process.stderr.write(`${error.stack}\n`);
+  process.exitCode = 1;
+});
diff --git a/apps/rush-cli-client/src/test/TestProcessEnvironment.ts b/apps/rush-cli-client/src/test/TestProcessEnvironment.ts
new file mode 100644
index 00000000000..df8bac55b29
--- /dev/null
+++ b/apps/rush-cli-client/src/test/TestProcessEnvironment.ts
@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { CLIENT_OUTPUT_SELECTION_ENV_VARS } from '../outputSelection';
+
+/**
+ * Returns a copy of `base` (by default `process.env`) for the clients that tests spawn, without the variables
+ * that select the client's output mode (`RUSHD_OUTPUT` and agent markers such as `COPILOT_CLI`). Spawned
+ * clients then use the default output even when the tests run in an agent's shell. Tests of agent output set
+ * those variables explicitly.
+ */
+export function getTestProcessEnvironment(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...base };
+  for (const name of CLIENT_OUTPUT_SELECTION_ENV_VARS) {
+    delete environment[name];
+  }
+  return environment;
+}
diff --git a/apps/rush-cli-client/src/test/cancellationNotice.test.ts b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
new file mode 100644
index 00000000000..7a8fe66756e
--- /dev/null
+++ b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
@@ -0,0 +1,548 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { Writable } from 'node:stream';
+
+import {
+  DaemonClientError,
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient,
+  type DaemonClientOutcome,
+  type IDaemonClientExecuteOptions
+} from '@rushstack/rush-client-core';
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import { ClientOutput } from '../clientOutput';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+const CANCELLING: string =
+  'rush-client: cancelling build; waiting up to 5 s for rushd to stop the request.\n';
+const CANCELLED: string = 'rush-client: build cancelled.\n';
+const UNCONFIRMED: string =
+  'rush-client: build cancelled, but rushd did not confirm that the request stopped; it may still be stopping.\n';
+
+const CLOSED_STDOUT: string =
+  'rush-client: build cancelled, because the process reading its stdout exited (EPIPE).\n';
+
+type Execution = (options: IDaemonClientExecuteOptions) => Promise<DaemonClientOutcome>;
+
+function brokenPipe(): NodeJS.ErrnoException {
+  return Object.assign(new Error('write EPIPE'), { code: 'EPIPE', errno: -32, syscall: 'write' });
+}
+
+/** Agent output whose writes fail once `readerExited` is set, as a pipe's do once the process reading it exits. */
+class ClosingOutput extends Writable {
+  public text: string = '';
+  public readerExited: boolean = false;
+
+  public constructor() {
+    super({
+      write: (chunk: Buffer, encoding, callback) => {
+        if (this.readerExited) {
+          callback(brokenPipe());
+        } else {
+          this.text += chunk.toString();
+          callback();
+        }
+      }
+    });
+  }
+}
+
+describe('the cancellation of a daemon request', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let listenersBefore: Map<NodeJS.Signals, unknown[]>;
+  let errorListenersBefore: Map<NodeJS.WriteStream, unknown[]>;
+  let stderr: string[];
+  /** What the client had written to stderr when the daemon heard of the cancellation. */
+  let stderrAtCancel: string[] | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-cancellation-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    listenersBefore = new Map(
+      (['SIGINT', 'SIGTERM'] as const).map((signal) => [signal, process.listeners(signal)])
+    );
+    errorListenersBefore = new Map(
+      [process.stdout, process.stderr].map((stream) => [stream, stream.listeners('error')])
+    );
+    stderr = [];
+    stderrAtCancel = undefined;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      stderr.push(Buffer.from(chunk).toString());
+      (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+      return true;
+    }) as typeof process.stderr.write);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: process.pid })
+    } as unknown as DaemonClient);
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    // A failed write leaves its 'error' listener, which a real pipe's error event would have removed.
+    for (const [stream, listeners] of errorListenersBefore) {
+      for (const listener of stream.listeners('error')) {
+        if (!listeners.includes(listener)) stream.removeListener('error', listener as (error: Error) => void);
+      }
+    }
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  /** Delivers a signal to the listener that the client installed, without signalling the test process. */
+  function deliverSignal(name: 'SIGINT' | 'SIGTERM'): void {
+    const installed: unknown[] = process
+      .listeners(name)
+      .filter((listener) => !listenersBefore.get(name)!.includes(listener));
+    expect(installed).toHaveLength(1);
+    (installed[0] as (signal: NodeJS.Signals) => void)(name);
+  }
+
+  /** Runs the request on a daemon that `execute` plays, as `DaemonClient` reports it to the client. */
+  function execute(execution: Execution): void {
+    jest
+      .mocked(executeWithDaemonRestartAsync)
+      .mockImplementation((client, connection, options) => execution(options));
+  }
+
+  /** The daemon hears of the cancellation, with the default deadline of `DaemonClient`. */
+  function requestCancel(options: IDaemonClientExecuteOptions): void {
+    options.onCancelRequested!(5000);
+    stderrAtCancel = [...stderr];
+  }
+
+  function aborted(options: IDaemonClientExecuteOptions): DaemonClientOutcome {
+    return {
+      kind: 'result',
+      result: { requestId: options.request.requestId, exitCode: 130, outcome: 'aborted', aborted: true }
+    };
+  }
+
+  function cancellationDeadline(): DaemonClientError {
+    return new DaemonClientError(
+      'timeout',
+      'Daemon did not finish cancellation; disconnected without retrying the command.'
+    );
+  }
+
+  /**
+   * Makes each write to `stream` fail, as a pipe's writes do once the process reading it (for example `head`)
+   * exited, and records what the client tried to write.
+   */
+  function closeReader(stream: NodeJS.WriteStream, written: string[] = []): void {
+    jest.spyOn(stream, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      written.push(Buffer.from(chunk).toString());
+      const callback: ((error: Error) => void) | undefined = rest.find(
+        (argument) => typeof argument === 'function'
+      ) as ((error: Error) => void) | undefined;
+      process.nextTick(() => callback?.(brokenPipe()));
+      return false;
+    }) as typeof stream.write);
+  }
+
+  /** Resolves once the client aborts the request; `DaemonClient` then asks rushd to cancel it. */
+  async function abortedAsync(signal: AbortSignal): Promise<void> {
+    if (signal.aborted) return;
+    await new Promise<void>((resolve, reject) => {
+      const timer: NodeJS.Timeout = setTimeout(
+        () => reject(new Error('The client did not cancel the request.')),
+        2000
+      );
+      signal.addEventListener(
+        'abort',
+        () => {
+          clearTimeout(timer);
+          resolve();
+        },
+        { once: true }
+      );
+    });
+  }
+
+  function disconnected(): DaemonClientError {
+    return new DaemonClientError(
+      'disconnected',
+      'Daemon disconnected before delivering a result; the command was not retried.'
+    );
+  }
+
+  it('says at once that it waits for rushd, and keeps the final line when rushd confirms the stop', async () => {
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      expect(options.abortSignal!.aborted).toBe(true);
+      requestCancel(options);
+      return aborted(options);
+    });
+    await launchClientAsync(false);
+    expect(stderrAtCancel).toEqual([CANCELLING]);
+    expect(stderr).toEqual([CANCELLING, CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('writes no restart wait line once it asks rushd to cancel', async () => {
+    const lockfile: DaemonRestartReason = {
+      kind: 'workspaceInputsChanged',
+      installationFiles: ['common/config/rush/pnpm-lock.yaml']
+    };
+    const environment: DaemonRestartReason = { kind: 'environmentChanged', variableNames: ['FOO'] };
+    execute(async (options) => {
+      await options.onQueuePositionAsync!(1, lockfile, { scriptCount: 1 });
+      deliverSignal('SIGINT');
+      requestCancel(options);
+      // A new cause would get a line at once on a pipe.
+      await options.onQueuePositionAsync!(1, environment, { scriptCount: 1 });
+      return aborted(options);
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([
+      `rush-client: waiting for 1 running rushx script to finish; the daemon (PID ${process.pid}) then restarts, ` +
+        'because common/config/rush/pnpm-lock.yaml changed.\n',
+      CANCELLING,
+      CANCELLED
+    ]);
+  });
+
+  it('says so when rushd does not confirm the stop before the cancellation deadline', async () => {
+    execute(async (options) => {
+      deliverSignal('SIGTERM');
+      requestCancel(options);
+      throw cancellationDeadline();
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLING, UNCONFIRMED]);
+    expect(process.exitCode).toBe(143);
+  });
+
+  it('reports a raw Ctrl+C, which raises no signal, like SIGINT', async () => {
+    execute(async (options) => {
+      requestCancel(options);
+      expect(options.abortSignal!.aborted).toBe(false);
+      throw cancellationDeadline();
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLING, UNCONFIRMED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('adds nothing when the request never reached rushd, which has nothing to stop', async () => {
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      return aborted(options);
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('adds nothing when the connection fails before the client asked rushd to stop the request', async () => {
+    // For example, a signal while the client waits for a restarted daemon, whose connection then fails.
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      expect(options.abortSignal!.aborted).toBe(true);
+      throw disconnected();
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it.each([
+    ['confirms', 'rushx-client: build cancelled.\n'],
+    [
+      'does not confirm',
+      'rushx-client: build cancelled, but rushd did not confirm that the request stopped; it may still be ' +
+        'stopping.\n'
+    ]
+  ])(
+    'begins both notices of a rushx script with rushx-client when rushd %s the stop',
+    async (confirmation: string, cancelled: string) => {
+      process.argv = [process.execPath, 'rushx-client', 'build'];
+      execute(async (options) => {
+        deliverSignal('SIGINT');
+        requestCancel(options);
+        if (confirmation === 'confirms') return aborted(options);
+        throw cancellationDeadline();
+      });
+      await launchClientAsync(true);
+      expect(stderr).toEqual([
+        'rushx-client: cancelling build; waiting up to 5 s for rushd to stop the request.\n',
+        cancelled
+      ]);
+      expect(process.exitCode).toBe(130);
+    }
+  );
+
+  it('begins the error line of a rushx script that rushd failed with rushx-client, like its notices', async () => {
+    process.argv = [process.execPath, 'rushx-client', 'build'];
+    execute(async (options) => ({
+      kind: 'result',
+      result: {
+        requestId: options.request.requestId,
+        exitCode: 1,
+        outcome: 'failure',
+        aborted: false,
+        errorMessage: 'The daemon shut down before the request finished.'
+      }
+    }));
+    await launchClientAsync(true);
+    expect(stderr).toEqual(['rushx-client: The daemon shut down before the request finished.\n']);
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('writes both notices in the agent output, once', async () => {
+    const output: string[] = [];
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: (text: string) => output.push(text)
+    });
+    let outputAtCancel: string[] | undefined;
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      requestCancel(options);
+      outputAtCancel = [...output];
+      throw cancellationDeadline();
+    });
+    await launchClientAsync(false, renderer);
+    const lines: string[] = output.join('').split('\n').slice(0, -1);
+    expect(outputAtCancel).toHaveLength(2);
+    expect(lines).toEqual([
+      expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
+      expect.stringMatching(
+        /^rush build · \d+\.\ds · cancelling; waiting up to 5s for rushd to stop the request$/
+      ),
+      expect.stringMatching(
+        /^rush build: CANCELLED in \d+\.\ds · rushd did not confirm that the request stopped; it may still be stopping$/
+      )
+    ]);
+    // The summary line says whether rushd confirmed the stop, so the legacy notices add nothing to it.
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('ends the agent summary line without a stop to confirm when the client never asked rushd to stop', async () => {
+    const output: string[] = [];
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: (text: string) => output.push(text)
+    });
+    execute(async () => {
+      deliverSignal('SIGINT');
+      throw disconnected();
+    });
+    await launchClientAsync(false, renderer);
+    const lines: string[] = output.join('').split('\n').slice(0, -1);
+    expect(lines).toEqual([
+      expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
+      expect.stringMatching(/^rush build: CANCELLED in \d+\.\ds$/)
+    ]);
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  describe('when the process reading its output exits, as `head` does', () => {
+    it('cancels the request, says why in one line and exits with 141, as SIGPIPE would', async () => {
+      closeReader(process.stdout);
+      execute(async (options) => {
+        // As for `rush-client build --verbose | head -5`, once head has read its lines.
+        await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+        await abortedAsync(options.abortSignal!);
+        requestCancel(options);
+        return aborted(options);
+      });
+      await launchClientAsync(false);
+      // Nothing is left to read a line that says the client waits for rushd.
+      expect(stderrAtCancel).toEqual([]);
+      expect(stderr).toEqual([CLOSED_STDOUT]);
+      expect(process.exitCode).toBe(141);
+    });
+
+    it.each([
+      ['confirms', 'rushx-client: build cancelled, because the process reading its stdout exited (EPIPE).\n'],
+      [
+        'does not confirm',
+        'rushx-client: build cancelled, because the process reading its stdout exited (EPIPE), but rushd did ' +
+          'not confirm that the request stopped; it may still be stopping.\n'
+      ]
+    ])(
+      'begins the line of a rushx script with rushx-client when rushd %s the stop, like its other notices',
+      async (confirmation: string, closed: string) => {
+        process.argv = [process.execPath, 'rushx-client', 'build'];
+        closeReader(process.stdout);
+        execute(async (options) => {
+          await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+          await abortedAsync(options.abortSignal!);
+          requestCancel(options);
+          if (confirmation === 'confirms') return aborted(options);
+          throw cancellationDeadline();
+        });
+        await launchClientAsync(true);
+        expect(stderr).toEqual([closed]);
+        expect(process.exitCode).toBe(141);
+      }
+    );
+
+    it('fails no write when stderr has the same reader (`2>&1 | head`)', async () => {
+      const written: string[] = [];
+      closeReader(process.stdout, written);
+      closeReader(process.stderr, written);
+      execute(async (options) => {
+        await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+        await abortedAsync(options.abortSignal!);
+        requestCancel(options);
+        return aborted(options);
+      });
+      await launchClientAsync(false);
+      expect(written).toEqual(['built-a\n', CLOSED_STDOUT]);
+      expect(process.exitCode).toBe(141);
+    });
+
+    it("keeps a signal's exit code and lines when the signal cancelled the request first", async () => {
+      closeReader(process.stdout);
+      execute(async (options) => {
+        deliverSignal('SIGTERM');
+        requestCancel(options);
+        // Output that was already on its way to the client.
+        await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+        return aborted(options);
+      });
+      await launchClientAsync(false);
+      expect(stderr).toEqual([CANCELLING, CANCELLED]);
+      expect(process.exitCode).toBe(143);
+    });
+
+    it('keeps the exit code of a result that arrived before the client found the reader gone', async () => {
+      const written: string[] = [];
+      closeReader(process.stderr, written);
+      execute(async (options) => ({
+        kind: 'result',
+        result: {
+          requestId: options.request.requestId,
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          errorMessage: 'Rush build failed.'
+        }
+      }));
+      await launchClientAsync(false);
+      expect(written).toEqual(['rush-client: Rush build failed.\n']);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('still fails on an EPIPE that is not from its own output', async () => {
+      execute(async () => {
+        throw brokenPipe();
+      });
+      await expect(launchClientAsync(false)).rejects.toThrow('write EPIPE');
+      expect(stderr).toEqual([]);
+    });
+
+    it('cancels the request in agent output when a status line finds the reader gone', async () => {
+      const stdout: ClosingOutput = new ClosingOutput();
+      const output: ClientOutput = new ClientOutput({ stdout, stderr: process.stderr });
+      const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+        commandName: 'build',
+        isTTY: false,
+        columns: 80,
+        write: (text: string) => output.stdout.write(text)
+      });
+      const lockfile: DaemonRestartReason = {
+        kind: 'workspaceInputsChanged',
+        installationFiles: ['common/config/rush/pnpm-lock.yaml']
+      };
+      execute(async (options) => {
+        stdout.readerExited = true;
+        // On a pipe, a new cause gets a status line at once; otherwise the next one is due every 25 s.
+        await options.onQueuePositionAsync!(1, lockfile, { scriptCount: 1 });
+        await abortedAsync(options.abortSignal!);
+        requestCancel(options);
+        return aborted(options);
+      });
+      await launchClientAsync(false, renderer, output);
+      expect(stdout.text).toMatch(
+        /^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph [^\n]*\n$/
+      );
+      // The summary line can no longer be read, so the line on stderr is the only report.
+      expect(stderr).toEqual([CLOSED_STDOUT]);
+      expect(process.exitCode).toBe(141);
+    });
+
+    it("keeps the result's exit code in agent output when only the summary line finds the reader gone", async () => {
+      const stdout: ClosingOutput = new ClosingOutput();
+      const output: ClientOutput = new ClientOutput({ stdout, stderr: process.stderr });
+      const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+        commandName: 'build',
+        isTTY: false,
+        columns: 80,
+        write: (text: string) => output.stdout.write(text)
+      });
+      execute(async (options) => {
+        // As for `rush-client build | head -1` on a request that takes less than 25 s.
+        stdout.readerExited = true;
+        return {
+          kind: 'result',
+          result: { requestId: options.request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+        };
+      });
+      await launchClientAsync(false, renderer, output);
+      expect(stdout.text).toMatch(
+        /^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph [^\n]*\n$/
+      );
+      expect(stderr).toEqual([]);
+      expect(process.exitCode).toBe(0);
+    });
+  });
+});
diff --git a/apps/rush-cli-client/src/test/clientOutput.test.ts b/apps/rush-cli-client/src/test/clientOutput.test.ts
new file mode 100644
index 00000000000..948c18e05a3
--- /dev/null
+++ b/apps/rush-cli-client/src/test/clientOutput.test.ts
@@ -0,0 +1,160 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import { Writable } from 'node:stream';
+
+import {
+  CLOSED_OUTPUT_EXIT_CODE,
+  ClientOutput,
+  getClosedOutputCode,
+  type ClientOutputStream
+} from '../clientOutput';
+
+function errnoError(code: string): NodeJS.ErrnoException {
+  return Object.assign(new Error(`write ${code}`), { code, syscall: 'write' });
+}
+
+/** A stream whose writes fail with `failure` once it is set, as a pipe's do after its reader exits. */
+class FakeOutput extends Writable {
+  public readonly chunks: string[] = [];
+  public attempts: number = 0;
+  public failure: string | undefined;
+
+  public constructor() {
+    super({
+      write: (chunk: Buffer, encoding, callback) => {
+        this.attempts++;
+        if (this.failure) {
+          callback(errnoError(this.failure));
+        } else {
+          this.chunks.push(chunk.toString());
+          callback();
+        }
+      }
+    });
+  }
+}
+
+describe('ClientOutput', () => {
+  let stdout: FakeOutput;
+  let stderr: FakeOutput;
+  let output: ClientOutput;
+  let closed: ClientOutputStream[];
+
+  beforeEach(() => {
+    stdout = new FakeOutput();
+    stderr = new FakeOutput();
+    output = new ClientOutput({ stdout, stderr });
+    closed = [];
+    output.onClosed((stream) => closed.push(stream));
+  });
+
+  afterEach(() => {
+    output.release();
+  });
+
+  it('exits like a writer that SIGPIPE ended', () => {
+    expect(CLOSED_OUTPUT_EXIT_CODE).toBe(141);
+  });
+
+  it('only takes EPIPE and ECONNRESET for a reader that exited', () => {
+    expect(getClosedOutputCode(errnoError('EPIPE'))).toBe('EPIPE');
+    expect(getClosedOutputCode(errnoError('ECONNRESET'))).toBe('ECONNRESET');
+    expect(getClosedOutputCode(errnoError('ENOSPC'))).toBeUndefined();
+    expect(getClosedOutputCode(new Error('write EPIPE'))).toBeUndefined();
+    expect(getClosedOutputCode('EPIPE')).toBeUndefined();
+    expect(getClosedOutputCode(undefined)).toBeUndefined();
+  });
+
+  it('reports a reader that exited once, and then drops the writes to its stream', async () => {
+    await output.stdout.writeAsync(Buffer.from('first\n'));
+    stdout.failure = 'EPIPE';
+    await expect(output.stdout.writeAsync(Buffer.from('second\n'))).resolves.toBeUndefined();
+    await expect(output.stdout.writeAsync(Buffer.from('third\n'))).resolves.toBeUndefined();
+    expect(stdout.chunks).toEqual(['first\n']);
+    expect(stdout.attempts).toBe(2);
+    expect(closed).toEqual([output.stdout]);
+    expect(output.stdout.closedCode).toBe('EPIPE');
+    // The other stream is still read.
+    await output.stderr.writeAsync(Buffer.from('still read\n'));
+    expect(stderr.chunks).toEqual(['still read\n']);
+    expect(output.stderr.closedCode).toBeUndefined();
+  });
+
+  it('rejects any other write error, and keeps writing', async () => {
+    stdout.failure = 'ENOSPC';
+    await expect(output.stdout.writeAsync(Buffer.from('lost\n'))).rejects.toMatchObject({ code: 'ENOSPC' });
+    expect(closed).toEqual([]);
+    expect(output.stdout.closedCode).toBeUndefined();
+  });
+
+  it('reports a stream whose reader already exited to a later listener at once, until it is removed', async () => {
+    stderr.failure = 'ECONNRESET';
+    await output.stderr.writeAsync(Buffer.from('lost\n'));
+    const late: ClientOutputStream[] = [];
+    const remove: () => void = output.onClosed((stream) => late.push(stream));
+    expect(late).toEqual([output.stderr]);
+    remove();
+    stdout.failure = 'EPIPE';
+    await output.stdout.writeAsync(Buffer.from('lost\n'));
+    expect(late).toEqual([output.stderr]);
+    expect(closed).toEqual([output.stderr, output.stdout]);
+  });
+
+  it('keeps an error event of a reader that exited from failing the process, while guarded', () => {
+    output.guard();
+    output.guard();
+    expect(stdout.listenerCount('error')).toBe(1);
+    expect(() => stdout.emit('error', errnoError('EPIPE'))).not.toThrow();
+    expect(closed).toEqual([output.stdout]);
+    // No write waits for an unexpected error, so it still fails the process.
+    expect(() => stderr.emit('error', errnoError('ENOSPC'))).toThrow('write ENOSPC');
+    const handler: jest.Mock = jest.fn();
+    stderr.on('error', handler);
+    expect(() => stderr.emit('error', errnoError('ENOSPC'))).not.toThrow();
+    expect(handler).toHaveBeenCalledTimes(1);
+    stderr.removeListener('error', handler);
+    output.release();
+    expect(stdout.listenerCount('error')).toBe(0);
+    expect(stderr.listenerCount('error')).toBe(0);
+  });
+
+  it('drops the text of a write that does not wait once the reader exited', async () => {
+    stdout.failure = 'EPIPE';
+    output.guard();
+    output.stdout.write('lost\n');
+    await new Promise((resolve) => setImmediate(resolve));
+    output.stdout.write('dropped\n');
+    expect(stdout.attempts).toBe(1);
+    expect(closed).toEqual([output.stdout]);
+  });
+
+  // On Windows, libuv never closes file descriptors 0 to 2, so the reader cannot close its end of the pipe.
+  (process.platform === 'win32' ? it.skip : it)('recognizes a real pipe whose reader closed it', async () => {
+    // The reader closes its end of the pipe, and then waits, so that the parent does not destroy the pipe on exit.
+    const reader: ChildProcess = spawn(
+      process.execPath,
+      ['-e', "require('node:fs').closeSync(0);process.stdout.write('closed');setTimeout(()=>{},30000)"],
+      { stdio: ['pipe', 'pipe', 'ignore'] }
+    );
+    const exited: Promise<unknown[]> = once(reader, 'close');
+    const real: ClientOutput = new ClientOutput({ stdout: reader.stdin!, stderr });
+    const realClosed: ClientOutputStream[] = [];
+    real.onClosed((stream) => realClosed.push(stream));
+    real.guard();
+    try {
+      await once(reader.stdout!, 'data');
+      for (let attempt: number = 0; attempt < 20 && !realClosed.length; attempt++) {
+        await real.stdout.writeAsync(Buffer.alloc(64 * 1024));
+      }
+      expect(realClosed).toEqual([real.stdout]);
+      expect(real.stdout.closedCode).toBe('EPIPE');
+    } finally {
+      real.release();
+      reader.kill();
+      await exited;
+    }
+  });
+});
diff --git a/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts b/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
index 98daf2fe4db..25ed0eb7614 100644
--- a/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
+++ b/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
@@ -6,16 +6,33 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { Rush } from '@microsoft/rush-lib';
+import { DaemonClientError } from '@rushstack/rush-client-core';
 import { computeDaemonWorkspaceKey, resolveDaemonPathsFromProcess } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions, getDaemonConnectionOptionsAsync } from '../daemonConnectionOptions';
 
+function captureErrorWithRuntimeDir(base: string, action: () => void): unknown {
+  const previous: string | undefined = process.env.RUSHD_RUNTIME_DIR;
+  process.env.RUSHD_RUNTIME_DIR = base;
+  try {
+    action();
+  } catch (error) {
+    return error;
+  } finally {
+    if (previous === undefined) delete process.env.RUSHD_RUNTIME_DIR;
+    else process.env.RUSHD_RUNTIME_DIR = previous;
+  }
+}
+
 describe('version-selected daemon connection options', () => {
   let repoRoot: string;
 
   beforeEach(() => {
     repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'daemon-connection-'));
-    fs.writeFileSync(path.join(repoRoot, 'rush.json'), JSON.stringify({ rushVersion: Rush.version }));
+    fs.writeFileSync(
+      path.join(repoRoot, 'rush.json'),
+      JSON.stringify({ rushVersion: Rush.version, suppressNodeLtsWarning: true })
+    );
   });
   afterEach(() => fs.rmSync(repoRoot, { recursive: true }));
 
@@ -48,6 +65,46 @@ describe('version-selected daemon connection options', () => {
     );
   });
 
+  (process.platform === 'win32' ? it.skip : it)(
+    'refuses an unsafe runtime folder before any daemon command uses it',
+    () => {
+      const base: string =
+        process.platform === 'darwin'
+          ? path.join('/tmp', `rushd-runtime-${process.pid}-${Date.now()}`)
+          : path.join(path.dirname(repoRoot), `rd-${process.pid.toString(36)}`);
+      try {
+        fs.rmSync(base, { recursive: true, force: true });
+        fs.mkdirSync(base);
+        fs.symlinkSync(repoRoot, path.join(base, `rushd-${process.getuid?.()}`));
+        const error: unknown = captureErrorWithRuntimeDir(base, () =>
+          getDaemonConnectionOptions(repoRoot, Rush.version, process.env, false)
+        );
+        expect(error).toBeInstanceOf(DaemonClientError);
+        expect(error).toMatchObject({ code: 'startupFailed' });
+        expect((error as Error).message).toContain('is unsafe: it is a symbolic link');
+      } finally {
+        fs.rmSync(base, { recursive: true, force: true });
+      }
+    }
+  );
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'refuses a RUSHD_RUNTIME_DIR too long for a socket path before any daemon command uses it',
+    () => {
+      // Too long on every platform: the base alone is longer than a socket address allows.
+      const base: string = path.join(repoRoot, 'r'.repeat(80));
+      const error: unknown = captureErrorWithRuntimeDir(base, () =>
+        getDaemonConnectionOptions(repoRoot, Rush.version, process.env, true)
+      );
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect(error).toMatchObject({ code: 'startupFailed' });
+      expect((error as Error).message).toMatch(
+        /^The daemon socket path .*\.sock is \d+ bytes long, but this platform allows at most 10[48]\. Set RUSHD_RUNTIME_DIR to an absolute path of at most \d+ bytes, or unset it\.$/
+      );
+      expect(fs.existsSync(base)).toBe(false);
+    }
+  );
+
   it('does not select or install a launcher for a connect-only invocation', async () => {
     const options = await getDaemonConnectionOptionsAsync(repoRoot, '5.178.1', {}, false);
     expect(options.startCommand).toBeUndefined();
diff --git a/apps/rush-cli-client/src/test/daemonGraph.test.ts b/apps/rush-cli-client/src/test/daemonGraph.test.ts
index 4305314b830..68f0e470a4f 100644
--- a/apps/rush-cli-client/src/test/daemonGraph.test.ts
+++ b/apps/rush-cli-client/src/test/daemonGraph.test.ts
@@ -21,6 +21,7 @@ import {
 import { DaemonFrameListener, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 describe('graph client fails closed over the public wire', () => {
   it.each(['unsupported', 'missing-snapshot', 'invalid-snapshot', 'old-protocol'])(
@@ -35,6 +36,7 @@ describe('graph client fails closed over the public wire', () => {
           path.join(folder, 'rush.json'),
           JSON.stringify({
             rushVersion: Rush.version,
+            suppressNodeLtsWarning: true,
             npmVersion: '10.0.0',
             projects: []
           })
@@ -108,7 +110,7 @@ describe('graph client fails closed over the public wire', () => {
           [path.resolve(__dirname, '../../bin/rush-client'), 'daemon', 'graph', 'show'],
           {
             cwd: folder,
-            env: { ...process.env, RUSH_DAEMON_EXPERIMENTAL: '1' },
+            env: { ...getTestProcessEnvironment(), RUSH_DAEMON_EXPERIMENTAL: '1' },
             stdio: ['ignore', 'pipe', 'pipe']
           }
         );
diff --git a/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts b/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
new file mode 100644
index 00000000000..8a0200d8941
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
@@ -0,0 +1,291 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import { writeDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { addForceStopNoProcessKilledNote, executeDaemonCommandAsync } from '../daemonCommands';
+import * as connectionOptions from '../daemonConnectionOptions';
+
+function readState(pid: number): string | undefined {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  return stat.slice(stat.lastIndexOf(')') + 2)[0];
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+describe(addForceStopNoProcessKilledNote.name, () => {
+  it('adds the force stop note after the first line only', () => {
+    expect(addForceStopNoProcessKilledNote('first\nsecond\nthird')).toBe(
+      'first No process was killed.\nsecond\nthird'
+    );
+    expect(addForceStopNoProcessKilledNote('first')).toBe('first No process was killed.');
+  });
+});
+
+/**
+ * Removes a test's folder. The sockets that killed daemons left there go first, without a stat: after a plain stat
+ * of a socket, which `fs.rmSync` makes, the next `require()` in this process could fail to find a package's
+ * dependencies (nodejs/node#65113).
+ */
+function removeFolder(folder: string): void {
+  for (const entry of fs.readdirSync(folder, { withFileTypes: true })) {
+    if (entry.isSocket()) fs.unlinkSync(path.join(folder, entry.name));
+  }
+  fs.rmSync(folder, { recursive: true });
+}
+
+/** Listens as rushd does, with the paths in its argument, never answers, and exits after the time in the last. */
+const FAKE_DAEMON_SCRIPT: string = [
+  'const [transport, protocol, paths, exitAfterMs] = process.argv.slice(2);',
+  'require(transport)',
+  '  .DaemonFrameListener.listenAsync(JSON.parse(paths), {',
+  '    protocolVersion: require(protocol).DAEMON_PROTOCOL_VERSION,',
+  '    onConnection: () => undefined',
+  '  })',
+  "  .then(() => console.log('listening'));",
+  'setTimeout(() => process.exit(0), Number(exitAfterMs));',
+  ''
+].join('\n');
+
+// It needs /proc to tell what the live owner is doing.
+(process.platform === 'linux' ? describe : describe.skip)(
+  'daemon commands and a live owner that does not answer',
+  () => {
+    let folder: string;
+    let paths: IDaemonPaths;
+    let children: ChildProcess[];
+    let stderr: string[];
+    let stdout: string[];
+
+    beforeEach(() => {
+      children = [];
+      stderr = [];
+      stdout = [];
+      folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-live-owner-'));
+      paths = {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      };
+      fs.writeFileSync(
+        path.join(folder, 'rush.json'),
+        JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+      );
+      jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({ paths });
+      for (const [stream, lines] of [
+        [process.stderr, stderr],
+        [process.stdout, stdout]
+      ] as const) {
+        jest.spyOn(stream, 'write').mockImplementation(((
+          chunk: string | Uint8Array,
+          ...rest: unknown[]
+        ): boolean => {
+          lines.push(Buffer.from(chunk).toString());
+          (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+          return true;
+        }) as typeof stream.write);
+      }
+    });
+
+    afterEach(async () => {
+      jest.restoreAllMocks();
+      for (const child of children) {
+        if (child.exitCode !== null || child.signalCode !== null) continue;
+        const exited: Promise<unknown> = once(child, 'exit');
+        // Only this test's own children, by their PIDs: resume a stopped one so that it can exit.
+        process.kill(child.pid!, 'SIGCONT');
+        child.kill('SIGKILL');
+        await exited;
+      }
+      removeFolder(folder);
+    });
+
+    /**
+     * A process whose command line looks like rushd's, which listens as rushd does with `daemonPaths` (by
+     * default this workspace's), but never answers: it binds its socket under a private name, links the
+     * endpoint to it, then writes its ownership record and keeps it open. Its listen backlog accepts
+     * connections even while a signal stops it. This workspace's ownership record names it either way.
+     */
+    async function startFakeDaemonAsync(
+      exitAfterMs: number = 600_000,
+      daemonPaths: IDaemonPaths = paths
+    ): Promise<number> {
+      const script: string = path.join(folder, 'rush-daemon', 'fake.js');
+      fs.mkdirSync(path.dirname(script), { recursive: true });
+      fs.writeFileSync(script, FAKE_DAEMON_SCRIPT);
+      const child: ChildProcess = spawn(
+        process.execPath,
+        [
+          script,
+          require.resolve('@rushstack/rush-daemon-transport'),
+          require.resolve('@rushstack/rush-daemon-protocol'),
+          JSON.stringify(daemonPaths),
+          String(exitAfterMs)
+        ],
+        { stdio: ['ignore', 'pipe', 'ignore'] }
+      );
+      children.push(child);
+      await once(child.stdout!, 'data');
+      const pid: number = child.pid!;
+      if (daemonPaths !== paths) {
+        writeDaemonLockfile(paths.lockfilePath, {
+          pid,
+          protocolVersion: DAEMON_PROTOCOL_VERSION,
+          startedAt: new Date().toISOString(),
+          socketPath: paths.socketPath
+        });
+      }
+      return pid;
+    }
+
+    async function stopChildAsync(pid: number): Promise<void> {
+      process.kill(pid, 'SIGSTOP');
+      const deadline: number = Date.now() + 5000;
+      while (readState(pid) !== 'T') {
+        if (Date.now() >= deadline) throw new Error(`PID ${pid} did not stop.`);
+        await delayAsync(10);
+      }
+    }
+
+    async function runAsync(...argv: string[]): Promise<Error | undefined> {
+      return await executeDaemonCommandAsync({
+        argv,
+        environment: {},
+        rushJsonPath: path.join(folder, 'rush.json'),
+        rushVersion: '5.178.1'
+      }).then(
+        () => undefined,
+        (error: Error) => error
+      );
+    }
+
+    it('says that a signal stopped the daemon, and how to resume it, for status, stop and stop --force', async () => {
+      const pid: number = await startFakeDaemonAsync();
+      await stopChildAsync(pid);
+      const timeout: string = `Daemon at ${paths.socketPath} did not complete hello/ping readiness within 5000ms.`;
+      const description: string = `rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.`;
+      const owner: RegExp = new RegExp(`${description}\\n`);
+      const stopHint: string = `Resume it with "kill -CONT ${pid}", then run "rush-client daemon stop" again.`;
+
+      const status: Error | undefined = await runAsync('status');
+      expect(status?.message.startsWith(`${timeout} `)).toBe(true);
+      expect(status?.message).toMatch(owner);
+      expect(status?.message.split('\n')[1]).toBe(
+        `Resume it with "kill -CONT ${pid}"; it then serves the next command.`
+      );
+
+      const stop: Error | undefined = await runAsync('stop');
+      expect(stop?.message.startsWith(`${timeout} `)).toBe(true);
+      expect(stop?.message).toMatch(owner);
+      expect(stop?.message.split('\n')[1]).toBe(stopHint);
+
+      // Like a reset that a live owner refuses, it says that it killed nothing.
+      const forceStop: Error | undefined = await runAsync('stop', '--force');
+      expect(forceStop?.message.startsWith(`${timeout} `)).toBe(true);
+      expect(forceStop?.message).toMatch(new RegExp(`${description} No process was killed\\.\\n`));
+      expect(forceStop?.message.split('\n')[1]).toBe(stopHint);
+      expect(readState(pid)).toBe('T');
+      expect(stdout).toEqual([]);
+    }, 30000);
+
+    it("names no signal to send to a daemon that does not have this workspace's record open", async () => {
+      // For example the daemon of another workspace, whose PID an old record of this workspace names: it has
+      // only its own record open.
+      const pid: number = await startFakeDaemonAsync(600_000, {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'other.sock'),
+        lockfilePath: path.join(folder, 'other.pid.json')
+      });
+      await stopChildAsync(pid);
+
+      const status: Error | undefined = await runAsync('status');
+
+      expect(status?.message).toMatch(
+        new RegExp(
+          ` rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n`
+        )
+      );
+      expect(status?.message.split('\n')[1]).toBe(
+        `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
+      );
+      expect(readState(pid)).toBe('T');
+      expect(stdout).toEqual([]);
+    }, 30000);
+
+    it('waits for a daemon that no longer listens to exit before stop reports that none runs', async () => {
+      const pid: number = await startFakeDaemonAsync(1500);
+      // It still runs, with its record open, but no client can reach it.
+      fs.unlinkSync(paths.socketPath);
+      const started: number = Date.now();
+
+      expect(await runAsync('stop')).toBeUndefined();
+
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1000);
+      expect(stderr).toHaveLength(1);
+      expect(stderr[0]).toMatch(
+        new RegExp(
+          `^rush-client: Nothing listens at ${escapeRegExp(paths.socketPath)}, but rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started \\d+ s ago, so stop waits up to 1[34] s for it to exit\\.\\n$`
+        )
+      );
+      expect(JSON.parse(stdout.join(''))).toMatchObject({
+        state: 'notRunning',
+        socketPath: paths.socketPath
+      });
+    }, 30000);
+
+    it('fails stop, saying what the daemon is doing, when a daemon that no longer listens does not exit', async () => {
+      const pid: number = await startFakeDaemonAsync();
+      fs.unlinkSync(paths.socketPath);
+
+      const error: Error | undefined = await runAsync('stop');
+
+      expect(error?.message).toMatch(
+        new RegExp(
+          `^Nothing listens at ${escapeRegExp(paths.socketPath)}, but rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started 1\\d s ago\\.\\n`
+        )
+      );
+      expect(error?.message.split('\n')[1]).toBe(
+        `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
+      );
+      expect(stderr).toHaveLength(1);
+      expect(stdout).toEqual([]);
+    }, 30000);
+
+    it('fails stop without waiting 15 s when a daemon that no longer listens stays stopped', async () => {
+      const pid: number = await startFakeDaemonAsync();
+      fs.unlinkSync(paths.socketPath);
+      await stopChildAsync(pid);
+      const started: number = Date.now();
+
+      const error: Error | undefined = await runAsync('stop');
+
+      // It samples the stopped daemon for 1.5 s, which cannot exit before something resumes it.
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1500);
+      expect(Date.now() - started).toBeLessThan(5000);
+      expect(error?.message).toMatch(
+        new RegExp(
+          `^Nothing listens at ${escapeRegExp(paths.socketPath)}, but rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n`
+        )
+      );
+      expect(error?.message.split('\n')[1]).toBe(
+        `Run "kill ${pid}", then "kill -CONT ${pid}": it then cancels its running requests and exits, and the next command starts a new daemon.`
+      );
+      // It printed no line that says that it waits for the daemon to exit.
+      expect(stderr).toEqual([]);
+      expect(stdout).toEqual([]);
+      expect(readState(pid)).toBe('T');
+    }, 30000);
+  }
+);
diff --git a/apps/rush-cli-client/src/test/daemonLogs.test.ts b/apps/rush-cli-client/src/test/daemonLogs.test.ts
index a098d9276d5..320bc45069e 100644
--- a/apps/rush-cli-client/src/test/daemonLogs.test.ts
+++ b/apps/rush-cli-client/src/test/daemonLogs.test.ts
@@ -15,6 +15,7 @@ import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
 import { printDaemonLogAsync } from '../daemonLogs';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 async function waitUntilAsync(predicate: () => boolean): Promise<void> {
   const deadline: number = Date.now() + 5000;
@@ -39,6 +40,7 @@ describe('daemon launcher log following', () => {
       path.join(folder, 'rush.json'),
       JSON.stringify({
         rushVersion: Rush.version,
+        suppressNodeLtsWarning: true,
         npmVersion: '10.0.0',
         projects: []
       })
@@ -159,7 +161,7 @@ describe('daemon launcher log following', () => {
         ],
         {
           cwd: folder,
-          env: { ...process.env, RUSH_DAEMON: '1' },
+          env: { ...getTestProcessEnvironment(), RUSH_DAEMON: '1' },
           stdio: windowsSignal ? ['ignore', 'pipe', 'pipe', 'ipc'] : ['ignore', 'pipe', 'pipe']
         }
       );
@@ -213,7 +215,11 @@ describe('daemon launcher log following', () => {
     const child = spawn(
       process.execPath,
       [path.resolve(__dirname, '../../bin/rush-client'), 'daemon', 'logs', '--follow'],
-      { cwd: folder, env: { ...process.env, RUSH_DAEMON: '1' }, stdio: ['ignore', 'pipe', 'pipe'] }
+      {
+        cwd: folder,
+        env: { ...getTestProcessEnvironment(), RUSH_DAEMON: '1' },
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
     );
     const closed = once(child, 'close');
     const readable = once(child.stdout, 'readable');
@@ -268,7 +274,7 @@ describe('daemon launcher log following', () => {
         ],
         {
           cwd: folder,
-          env: { ...process.env, RUSH_DAEMON: '1' },
+          env: { ...getTestProcessEnvironment(), RUSH_DAEMON: '1' },
           stdio: windowsSignal ? ['ignore', outputFd, 'pipe', 'ipc'] : ['ignore', outputFd, 'pipe']
         }
       );
diff --git a/apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts b/apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts
new file mode 100644
index 00000000000..6a4580d58f7
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
+
+import { createOrphanReapNoticeHandler, formatOrphanReapNotice } from '../daemonReclaimNotice';
+
+function reapOf(processGroupIds: number[], outcome: IDaemonOrphanReap['outcome']): IDaemonOrphanReap {
+  return { daemonPid: 4242, processGroupIds, outcome };
+}
+
+describe(formatOrphanReapNotice.name, () => {
+  it('names the exited daemon and the process group that was stopped', () => {
+    expect(formatOrphanReapNotice(reapOf([4242], 'terminated'), false)).toBe(
+      'rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).'
+    );
+    expect(formatOrphanReapNotice(reapOf([4242], 'terminated'), true)).toBe(
+      'rushx-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).'
+    );
+  });
+
+  it('says when the operations had to be killed', () => {
+    expect(formatOrphanReapNotice(reapOf([501, 502], 'killed'), false)).toBe(
+      'rush-client: Killed the operations that the exited daemon (PID 4242) left running ' +
+        '(process groups 501 and 502); they did not exit after SIGTERM.'
+    );
+  });
+
+  it('lists up to four process groups, then counts the others', () => {
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503], 'terminated'), false)).toContain(
+      '(process groups 501, 502 and 503).'
+    );
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503, 504], 'terminated'), false)).toContain(
+      '(process groups 501, 502, 503 and 504).'
+    );
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503, 504, 505], 'terminated'), false)).toContain(
+      '(process groups 501, 502, 503, 504 and 1 more).'
+    );
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503, 504, 505, 506], 'terminated'), false)).toContain(
+      '(process groups 501, 502, 503, 504 and 2 more).'
+    );
+  });
+});
+
+describe(createOrphanReapNoticeHandler.name, () => {
+  const line: string =
+    'rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).';
+
+  it('writes the line to stderr without an agent renderer', () => {
+    const writes: string[] = [];
+    const handler: (reap: IDaemonOrphanReap) => void = createOrphanReapNoticeHandler({
+      rushx: false,
+      agentRenderer: undefined,
+      writeStderr: (text: string) => writes.push(text)
+    });
+    handler(reapOf([4242], 'terminated'));
+    expect(writes).toEqual([`${line}\n`]);
+  });
+
+  it('gives the line to the agent renderer, and writes nothing to stderr', () => {
+    const notes: string[] = [];
+    const writes: string[] = [];
+    const handler: (reap: IDaemonOrphanReap) => void = createOrphanReapNoticeHandler({
+      rushx: false,
+      agentRenderer: { note: (text: string) => notes.push(text) },
+      writeStderr: (text: string) => writes.push(text)
+    });
+    handler(reapOf([4242], 'terminated'));
+    expect(notes).toEqual([line]);
+    expect(writes).toEqual([]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
new file mode 100644
index 00000000000..906c3c017ab
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -0,0 +1,877 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DaemonClientError,
+  DaemonRestartFailedError,
+  type IDaemonRestartWaitDetails
+} from '@rushstack/rush-client-core';
+import type { DaemonRestartReason, IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+import {
+  RESTART_WAIT_REPEAT_MS,
+  RESUBMITTED_PHASE,
+  createDaemonRequestNoticeHandlers,
+  createDaemonRestartNoticeHandler,
+  explainDaemonRestartFailure,
+  formatDaemonRestartNotice,
+  formatDaemonRestartWait,
+  type IDaemonRequestNoticeHandlers
+} from '../daemonRestartNotice';
+
+// A kind that only a newer daemon knows.
+const NEWER_REASON: DaemonRestartReason = {
+  kind: 'newerReason',
+  detail: ['NODE_OPTIONS']
+} as unknown as DaemonRestartReason;
+
+describe(formatDaemonRestartNotice.name, () => {
+  it('names the changed installation and the new daemon', () => {
+    expect(
+      formatDaemonRestartNotice(
+        {
+          restart: 1,
+          reason: { kind: 'installationChanged', change: 'replaced', folder: '/snapshots/s9' },
+          successorPid: 42
+        },
+        false
+      )
+    ).toBe(
+      "rush-client: A command restarted the daemon (PID 42) because the daemon's installation at /snapshots/s9 was replaced."
+    );
+    expect(
+      formatDaemonRestartNotice(
+        {
+          restart: 1,
+          reason: { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+          successorPid: undefined
+        },
+        true
+      )
+    ).toBe(
+      "rushx-client: A command restarted the daemon because the daemon's installation at /snapshots/s9 was removed."
+    );
+  });
+
+  it("names the variables in which a command's environment differed, at most four of them", () => {
+    const format = (
+      variableNames: string[],
+      successorPid: number | undefined,
+      rushx: boolean
+    ): string | undefined =>
+      formatDaemonRestartNotice(
+        { restart: 1, reason: { kind: 'environmentChanged', variableNames }, successorPid },
+        rushx
+      );
+    expect(format(['NODE_OPTIONS'], 42, false)).toBe(
+      "rush-client: A command restarted the daemon (PID 42) because its environment differs from the daemon's in NODE_OPTIONS."
+    );
+    expect(format(['FOO', 'NODE_OPTIONS'], undefined, true)).toBe(
+      "rushx-client: A command restarted the daemon because its environment differs from the daemon's in FOO and NODE_OPTIONS."
+    );
+    expect(format(['A', 'B', 'C', 'D'], 42, false)).toContain("the daemon's in A, B, C and D.");
+    expect(format(['A', 'B', 'C', 'D', 'E', 'F'], 42, false)).toContain(
+      "the daemon's in A, B, C, D and 2 more."
+    );
+    expect(format([], 42, false)).toBe(
+      "rush-client: A command restarted the daemon (PID 42) because its environment differs from the daemon's."
+    );
+  });
+
+  it('names restart causes shared with the wait lines', () => {
+    expect(
+      formatDaemonRestartNotice(
+        {
+          restart: 1,
+          reason: {
+            kind: 'workspaceInputsChanged',
+            installationFiles: ['common/config/rush/pnpm-lock.yaml']
+          },
+          successorPid: 42
+        },
+        false
+      )
+    ).toBe(
+      'rush-client: A command restarted the daemon (PID 42) because common/config/rush/pnpm-lock.yaml changed.'
+    );
+    expect(
+      formatDaemonRestartNotice(
+        { restart: 1, reason: { kind: 'nativeMutation', commandName: 'install' }, successorPid: undefined },
+        true
+      )
+    ).toBe('rushx-client: A command restarted the daemon because it runs rush install.');
+    expect(
+      formatDaemonRestartNotice(
+        {
+          restart: 1,
+          reason: {
+            kind: 'workspaceInputsChanged',
+            implementationFiles: [],
+            selectedRushVersion: '5.180.0'
+          },
+          successorPid: 42
+        },
+        false
+      )
+    ).toBe(
+      'rush-client: A command restarted the daemon (PID 42) because the code of Rush or a Rush plugin changed and it selects Rush 5.180.0.'
+    );
+  });
+
+  it('names the daemon that exited while the command was queued, and the new daemon if it is known', () => {
+    expect(
+      formatDaemonRestartNotice(
+        { restart: 1, reason: undefined, successorPid: undefined, exitedPid: 41 },
+        false
+      )
+    ).toBe(
+      'rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.'
+    );
+    expect(
+      formatDaemonRestartNotice({ restart: 2, reason: NEWER_REASON, successorPid: 42, exitedPid: 41 }, true)
+    ).toBe(
+      'rushx-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon (PID 42).'
+    );
+  });
+
+  it('says nothing about restarts that need no explanation', () => {
+    expect(
+      formatDaemonRestartNotice({ restart: 1, reason: undefined, successorPid: 42 }, false)
+    ).toBeUndefined();
+    expect(
+      formatDaemonRestartNotice({ restart: 1, reason: NEWER_REASON, successorPid: 42 }, false)
+    ).toBeUndefined();
+  });
+});
+
+describe(explainDaemonRestartFailure.name, () => {
+  const startupError: DaemonClientError = new DaemonClientError(
+    'startupFailed',
+    'Daemon startup has an unresolved startup handoff at /run/rushd.pid.json.starting.'
+  );
+
+  it('says first why the daemon restarted, and keeps the code and the startup error', () => {
+    const explain = (reason: DaemonRestartReason): unknown =>
+      explainDaemonRestartFailure(new DaemonRestartFailedError(startupError, reason));
+    const environment: unknown = explain({ kind: 'environmentChanged', variableNames: ['NODE_OPTIONS'] });
+    expect(environment).toBeInstanceOf(DaemonClientError);
+    expect(environment).toMatchObject({
+      code: 'startupFailed',
+      message:
+        "A command restarted the daemon because its environment differs from the daemon's in NODE_OPTIONS; the restarted daemon did not " +
+        'start: Daemon startup has an unresolved startup handoff at /run/rushd.pid.json.starting.'
+    });
+    const { cause } = environment as DaemonClientError;
+    expect(cause).toBeInstanceOf(DaemonRestartFailedError);
+    expect((cause as DaemonRestartFailedError).cause).toBe(startupError);
+    expect(
+      (explain({ kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' }) as Error).message
+    ).toBe(
+      "A command restarted the daemon because the daemon's installation at /snapshots/s9 was removed; the restarted daemon did not start: " +
+        'Daemon startup has an unresolved startup handoff at /run/rushd.pid.json.starting.'
+    );
+  });
+
+  it('returns any other error, and a restart for a reason that this client does not know, unchanged', () => {
+    const newer: DaemonRestartFailedError = new DaemonRestartFailedError(startupError, NEWER_REASON);
+    const other: Error = new Error('other');
+    expect(explainDaemonRestartFailure(newer)).toBe(newer);
+    expect(explainDaemonRestartFailure(startupError)).toBe(startupError);
+    expect(explainDaemonRestartFailure(other)).toBe(other);
+  });
+});
+
+describe(createDaemonRestartNoticeHandler.name, () => {
+  const notice = {
+    restart: 1,
+    reason: { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+    successorPid: 42
+  } as const;
+  const line: string =
+    "rush-client: A command restarted the daemon (PID 42) because the daemon's installation at /snapshots/s9 was removed.";
+
+  it('gives the line to the agent renderer when one is active', async () => {
+    const notes: string[] = [];
+    const written: string[] = [];
+    const handler = createDaemonRestartNoticeHandler({
+      rushx: false,
+      agentRenderer: { note: (text: string) => notes.push(text) },
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    await handler(notice);
+    expect(notes).toEqual([line]);
+    expect(written).toEqual([]);
+  });
+
+  it('writes the line to stderr without an agent renderer, and stays quiet for other restarts', async () => {
+    const written: string[] = [];
+    const handler = createDaemonRestartNoticeHandler({
+      rushx: false,
+      agentRenderer: undefined,
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    await handler(notice);
+    await handler({ restart: 2, reason: undefined, successorPid: 43 });
+    expect(written).toEqual([`${line}\n`]);
+  });
+});
+
+const REMOVED: DaemonRestartReason = {
+  kind: 'installationChanged',
+  change: 'removed',
+  folder: '/snapshots/s9'
+};
+const LOCKFILE: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const PLUGIN_CODE: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  implementationFiles: ['common/autoinstallers/p/node_modules/q/lib/x.js']
+};
+const ANOTHER: IDaemonRestartWaitDetails = { restartsForAnotherRequest: true };
+
+// One case for each reason that a daemon gives for a restart, and how a waiting request and a waiting rushx script
+// word it.
+const REASONS: [string, DaemonRestartReason, string, string][] = [
+  [
+    'a removed installation',
+    REMOVED,
+    'because its installation at /snapshots/s9 was removed',
+    "because the daemon's installation at /snapshots/s9 was removed"
+  ],
+  [
+    'an environment',
+    { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS', 'RUSH_X'] },
+    "because this request's environment differs from the daemon's in NODE_OPTIONS and RUSH_X",
+    "because its environment differs from the daemon's in NODE_OPTIONS and RUSH_X"
+  ],
+  [
+    'a lockfile',
+    LOCKFILE,
+    'because common/config/rush/pnpm-lock.yaml changed',
+    'because common/config/rush/pnpm-lock.yaml changed'
+  ],
+  [
+    'plugin code',
+    PLUGIN_CODE,
+    'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/node_modules/q/lib/x.js)',
+    'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/node_modules/q/lib/x.js)'
+  ],
+  [
+    'a Rush version',
+    { kind: 'workspaceInputsChanged', selectedRushVersion: '5.180.0' },
+    'because this request selects Rush 5.180.0',
+    'because it selects Rush 5.180.0'
+  ],
+  [
+    'a native install',
+    { kind: 'nativeMutation', commandName: 'install' },
+    'because this request runs rush install',
+    'because it runs rush install'
+  ]
+];
+
+describe(formatDaemonRestartWait.name, () => {
+  it.each(REASONS)('says why the daemon restarts for %s', (name, reason, cause, anotherCause) => {
+    expect(formatDaemonRestartWait({ position: 1, reason, details: {}, daemonPid: 41 })).toBe(
+      `waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${cause}`
+    );
+    expect(formatDaemonRestartWait({ position: 2, reason, details: ANOTHER, daemonPid: 41 })).toBe(
+      `waiting for the daemon (PID 41) to restart for another request (2 requests ahead), ${anotherCause}`
+    );
+  });
+
+  it('says how many of the requests that it waits for run a rushx script', () => {
+    const format = (position: number, details: IDaemonRestartWaitDetails): string =>
+      formatDaemonRestartWait({ position, reason: LOCKFILE, details, daemonPid: undefined });
+    expect(format(3, { scriptCount: 1 })).toBe(
+      'waiting for 3 running requests to finish, including 1 rushx script; the daemon then restarts, because ' +
+        'common/config/rush/pnpm-lock.yaml changed'
+    );
+    expect(format(3, { scriptCount: 2 })).toMatch(
+      /^waiting for 3 running requests to finish, including 2 rushx scripts;/
+    );
+    expect(format(1, { scriptCount: 1 })).toMatch(
+      /^waiting for 1 running rushx script to finish; the daemon then/
+    );
+    expect(format(2, { scriptCount: 2 })).toMatch(/^waiting for 2 running rushx scripts to finish;/);
+    expect(format(2, { scriptCount: 0 })).toMatch(/^waiting for 2 running requests to finish;/);
+    expect(format(1, { ...ANOTHER, scriptCount: 0 })).toMatch(
+      /restart for another request \(1 request ahead\), /
+    );
+    expect(format(3, { ...ANOTHER, scriptCount: 1 })).toMatch(
+      /^waiting for the daemon to restart for another request \(3 requests ahead, including 1 rushx script\), /
+    );
+  });
+
+  it('says what a request queued behind a native install that waits for rushx scripts waits for', () => {
+    expect(
+      formatDaemonRestartWait({
+        position: 2,
+        reason: { kind: 'nativeMutation', commandName: 'install' },
+        details: { ...ANOTHER, scriptCount: 1 },
+        daemonPid: 41
+      })
+    ).toBe(
+      'waiting for the daemon (PID 41) to restart for another request (2 requests ahead, including 1 rushx ' +
+        'script), because it runs rush install'
+    );
+  });
+
+  it('says how many rushx scripts a command that restarts the daemon itself waits for', () => {
+    const format = (scriptCount: number, daemonPid?: number, elapsedMs?: number): string =>
+      formatDaemonRestartWait({
+        position: 1,
+        reason: undefined,
+        details: { scriptCount },
+        daemonPid,
+        elapsedMs
+      });
+    expect(format(1, 41)).toBe(
+      'waiting for 1 running rushx script to finish, since this command restarts the daemon (PID 41), which ' +
+        'would end it'
+    );
+    expect(format(2)).toBe(
+      'waiting for 2 running rushx scripts to finish, since this command restarts the daemon, which would end them'
+    );
+    expect(format(1, 41, 25_400)).toMatch(
+      /^still waiting after 25s for 1 running rushx script to finish, since this command restarts the daemon /
+    );
+    // Without a count, the position counts them.
+    expect(formatDaemonRestartWait({ position: 3, reason: undefined, details: {}, daemonPid: 41 })).toMatch(
+      /^waiting for 3 running rushx scripts to finish, since /
+    );
+  });
+
+  it('says how long the request has waited, from a second on', () => {
+    const format = (elapsedMs: number, details: IDaemonRestartWaitDetails): string =>
+      formatDaemonRestartWait({ position: 1, reason: LOCKFILE, details, daemonPid: 41, elapsedMs });
+    expect(format(999, {})).toMatch(/^waiting for 1 running request/);
+    expect(format(25_400, {})).toMatch(
+      /^still waiting after 25s for 1 running request to finish; the daemon/
+    );
+    expect(format(50_000, ANOTHER)).toMatch(
+      /^still waiting after 50s for the daemon \(PID 41\) to restart for/
+    );
+  });
+
+  it('leaves out a cause that it cannot word', () => {
+    expect(formatDaemonRestartWait({ position: 2, reason: NEWER_REASON, details: {}, daemonPid: 41 })).toBe(
+      'waiting for 2 running requests to finish; the daemon (PID 41) then restarts'
+    );
+    expect(
+      formatDaemonRestartWait({ position: 2, reason: NEWER_REASON, details: ANOTHER, daemonPid: 41 })
+    ).toBe('waiting for the daemon (PID 41) to restart for another request (2 requests ahead)');
+  });
+});
+
+describe(createDaemonRequestNoticeHandlers.name, () => {
+  let clock: number;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    clock = 0;
+  });
+  afterEach(() => jest.useRealTimers());
+
+  function advance(ms: number): void {
+    clock += ms;
+    jest.advanceTimersByTime(ms);
+  }
+
+  function createHandlers(options: {
+    agent: boolean;
+    stderrIsTTY: boolean;
+    rushx?: boolean;
+    // Whether the agent renderer writes an announced wait as a line, as it does on a pipe.
+    agentWritesWaitLines?: boolean;
+  }): {
+    calls: string[];
+    handlers: IDaemonRequestNoticeHandlers;
+  } {
+    const calls: string[] = [];
+    const agentWritesWaitLines: boolean = options.agentWritesWaitLines ?? true;
+    const handlers: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
+      rushx: !!options.rushx,
+      stderrIsTTY: options.stderrIsTTY,
+      daemonPid: 41,
+      now: () => clock,
+      agentRenderer: options.agent
+        ? {
+            note: (line: string) => calls.push(`note: ${line}`),
+            onResubmitted: (phase: string) => calls.push(`resubmitted: ${phase}`),
+            onQueuePosition: (position: number, continuing?: IDaemonContinuingOperations) =>
+              calls.push(
+                `position: ${position}` +
+                  (continuing ? ` behind ${continuing.count} (${continuing.names.join(', ')})` : '')
+              ),
+            onRestartWait: (wait: string, announce: boolean) => {
+              calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`);
+              return announce && agentWritesWaitLines;
+            }
+          }
+        : undefined,
+      writeStderrAsync: async (text: string) => {
+        calls.push(`stderr: ${text}`);
+      }
+    });
+    return { calls, handlers };
+  }
+
+  const LOCKFILE_WAIT: string =
+    'the daemon (PID 41) then restarts, because common/config/rush/pnpm-lock.yaml changed';
+  // What a native install or update, which restarts the daemon itself once it ends, waits for.
+  const TWO_SCRIPTS: string =
+    '2 running rushx scripts to finish, since this command restarts the daemon (PID 41), which would end them';
+  const ONE_SCRIPT: string =
+    '1 running rushx script to finish, since this command restarts the daemon (PID 41), which would end it';
+  const ENV_NODE_OPTIONS: DaemonRestartReason = {
+    kind: 'environmentChanged',
+    variableNames: ['NODE_OPTIONS']
+  };
+  const ENV_BOTH: DaemonRestartReason = {
+    kind: 'environmentChanged',
+    variableNames: ['NODE_OPTIONS', 'RUSH_X']
+  };
+  const REPLACED: DaemonRestartReason = {
+    kind: 'installationChanged',
+    change: 'replaced',
+    folder: '/snapshots/s9'
+  };
+  const REMOVED_S10: DaemonRestartReason = {
+    kind: 'installationChanged',
+    change: 'removed',
+    folder: '/snapshots/s10'
+  };
+
+  describe.each([
+    ['rush-client', false],
+    ['rushx-client', true]
+  ])('%s without an agent renderer', (client: string, rushx: boolean) => {
+    it.each(REASONS)(
+      'writes the first line of a wait for %s at once, on a pipe and a terminal',
+      async (name, reason, cause) => {
+        for (const stderrIsTTY of [false, true]) {
+          const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+          await handlers.onQueuePositionAsync(1, reason, { scriptCount: 0 });
+          handlers.dispose();
+          expect(calls).toEqual([
+            `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${cause}.\n`
+          ]);
+        }
+      }
+    );
+
+    it('repeats the line with the time waited when 25 s pass without one, until the restart', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      advance(3000);
+      await handlers.onQueuePositionAsync(2, LOCKFILE, { scriptCount: 1 });
+      advance(10_000);
+      // On a pipe, a new count waits for the next line.
+      await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+      advance(RESTART_WAIT_REPEAT_MS - 10_001);
+      expect(calls).toHaveLength(1);
+      advance(1);
+      advance(RESTART_WAIT_REPEAT_MS);
+      await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: 42 });
+      advance(RESTART_WAIT_REPEAT_MS * 4);
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for 2 running requests to finish, including 1 rushx script; ${LOCKFILE_WAIT}.\n`,
+        `stderr: ${client}: still waiting after 25s for 1 running request to finish; ${LOCKFILE_WAIT}.\n`,
+        `stderr: ${client}: still waiting after 50s for 1 running request to finish; ${LOCKFILE_WAIT}.\n`
+      ]);
+    });
+
+    it('writes a line on a pipe at once when the cause changes, and every change on a terminal', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        advance(500);
+        await handlers.onQueuePositionAsync(2, LOCKFILE, ANOTHER);
+        await handlers.onQueuePositionAsync(2, LOCKFILE, ANOTHER);
+        advance(1500);
+        // Another cause of the same kind.
+        await handlers.onQueuePositionAsync(2, PLUGIN_CODE, ANOTHER);
+        advance(1000);
+        await handlers.onQueuePositionAsync(2, REMOVED, ANOTHER);
+        handlers.dispose();
+        const another: string = 'for the daemon (PID 41) to restart for another request';
+        const lockfile: string = 'because common/config/rush/pnpm-lock.yaml changed';
+        expect(calls).toEqual([
+          `stderr: ${client}: waiting ${another} (1 request ahead), ${lockfile}.\n`,
+          ...(stderrIsTTY
+            ? [`stderr: ${client}: waiting ${another} (2 requests ahead), ${lockfile}.\n`]
+            : []),
+          `stderr: ${client}: still waiting after 2s ${another} (2 requests ahead), because the code of Rush or a ` +
+            'Rush plugin changed (common/autoinstallers/p/node_modules/q/lib/x.js).\n',
+          `stderr: ${client}: still waiting after 3s ${another} (2 requests ahead), because the daemon's ` +
+            'installation at /snapshots/s9 was removed.\n'
+        ]);
+      }
+    });
+
+    it('writes a line for a command that restarts the daemon itself once the rushx scripts exit', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        // The install first waits for the workspace, as any request can, and then for the scripts.
+        await handlers.onQueuePositionAsync(1);
+        await handlers.onQueuePositionAsync(2, undefined, { scriptCount: 2 });
+        advance(RESTART_WAIT_REPEAT_MS);
+        await handlers.onQueuePositionAsync(1, undefined, { scriptCount: 1 });
+        advance(RESTART_WAIT_REPEAT_MS);
+        handlers.onRequestProgress();
+        advance(RESTART_WAIT_REPEAT_MS * 2);
+        handlers.dispose();
+        expect(calls).toEqual([
+          ...(stderrIsTTY ? [`stderr: ${client}: waiting for daemon admission (position 1).\n`] : []),
+          `stderr: ${client}: waiting for ${TWO_SCRIPTS}.\n`,
+          `stderr: ${client}: still waiting after 25s for ${TWO_SCRIPTS}.\n`,
+          // On a pipe, a new count waits for the next line.
+          ...(stderrIsTTY ? [`stderr: ${client}: still waiting after 25s for ${ONE_SCRIPT}.\n`] : []),
+          `stderr: ${client}: still waiting after 50s for ${ONE_SCRIPT}.\n`
+        ]);
+      }
+    });
+
+    it('writes a line on a pipe when whose restart the request waits for changes, even for the same cause', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+      await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+      handlers.dispose();
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for 1 running request to finish; ${LOCKFILE_WAIT}.\n`,
+        `stderr: ${client}: waiting for the daemon (PID 41) to restart for another request (1 request ahead), ` +
+          'because common/config/rush/pnpm-lock.yaml changed.\n'
+      ]);
+    });
+
+    it('stops when the request gets input, output or an event, or waits for plain admission', async () => {
+      const stops: [string, (handlers: IDaemonRequestNoticeHandlers) => Promise<void> | void][] = [
+        ['input', (handlers) => handlers.onInputAdmittedAsync()],
+        ['progress', (handlers) => handlers.onRequestProgress()],
+        ['plain position', (handlers) => handlers.onQueuePositionAsync(1)]
+      ];
+      for (const [, stop] of stops) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        await stop(handlers);
+        advance(RESTART_WAIT_REPEAT_MS * 3);
+        expect(calls).toHaveLength(1);
+        // A later wait is a new one.
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        handlers.dispose();
+        expect(calls).toHaveLength(2);
+        expect(calls[1]).toBe(calls[0]);
+      }
+    });
+
+    it('writes nothing more once the request ends or the client asks rushd to cancel it', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        handlers.dispose();
+        advance(RESTART_WAIT_REPEAT_MS * 3);
+        await handlers.onQueuePositionAsync(1, REMOVED, ANOTHER);
+        await handlers.onQueuePositionAsync(2);
+        expect(calls).toHaveLength(1);
+      }
+    });
+
+    it('names the new daemon after a restart, and writes plain positions only to a terminal', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(3);
+        await handlers.onQueuePositionAsync(1, REMOVED, {});
+        await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+        handlers.dispose();
+        // The wait line said why the daemon restarted, so the restart gets no notice.
+        expect(calls).toEqual([
+          ...(stderrIsTTY ? [`stderr: ${client}: waiting for daemon admission (position 3).\n`] : []),
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, because ` +
+            'its installation at /snapshots/s9 was removed.\n',
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 42) then restarts, because ` +
+            'common/config/rush/pnpm-lock.yaml changed.\n'
+        ]);
+      }
+    });
+
+    it('says that the command is sent to a new daemon after rushd exited, even during a restart wait', async () => {
+      const resent: string =
+        `stderr: ${client}: rushd (PID 41) exited while the command was queued; sending the command to a new ` +
+        'daemon.\n';
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, REMOVED, {});
+        await handlers.onRestartAsync({
+          restart: 1,
+          reason: undefined,
+          successorPid: undefined,
+          exitedPid: 41
+        });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+        advance(RESTART_WAIT_REPEAT_MS * 2);
+        handlers.dispose();
+        expect(calls.slice(0, 3)).toEqual([
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, because ` +
+            'its installation at /snapshots/s9 was removed.\n',
+          resent,
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon then restarts, because ` +
+            'common/config/rush/pnpm-lock.yaml changed.\n'
+        ]);
+        // The wait for the exited daemon ended with the notice, and the new daemon's PID is not known yet.
+        expect(calls.slice(3).some((call: string) => call.includes('(PID 41)'))).toBe(false);
+      }
+    });
+
+    it('names the operations that an earlier failed command left running, on a terminal only', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(2);
+        await handlers.onQueuePositionAsync(1, undefined, {}, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+        await handlers.onQueuePositionAsync(1, undefined, {}, { count: 1, names: ['t8-slow2'] });
+        await handlers.onQueuePositionAsync(1, undefined, {}, { count: 5, names: ['a', 'b', 'c'] });
+        handlers.dispose();
+        const left: string = 'left running by an earlier failed command';
+        expect(calls).toEqual(
+          stderrIsTTY
+            ? [
+                `stderr: ${client}: waiting for daemon admission (position 2).\n`,
+                `stderr: ${client}: waiting for daemon admission (position 1) behind 2 operations ${left}: ` +
+                  't8-slow1, t8-slow2.\n',
+                `stderr: ${client}: waiting for daemon admission (position 1) behind 1 operation ${left}: ` +
+                  't8-slow2.\n',
+                `stderr: ${client}: waiting for daemon admission (position 1) behind 5 operations ${left}: ` +
+                  'a, b, c +2 more.\n'
+              ]
+            : []
+        );
+      }
+    });
+
+    it('says that rushd stops the operations that an earlier failed command left running, on a terminal only', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(
+          1,
+          undefined,
+          {},
+          { count: 2, names: ['t8-slow1', 't8-slow2'], stopping: true }
+        );
+        handlers.dispose();
+        expect(calls).toEqual(
+          stderrIsTTY
+            ? [
+                `stderr: ${client}: waiting for daemon admission (position 1) while rushd stops 2 operations ` +
+                  'left running by an earlier failed command: t8-slow1, t8-slow2.\n'
+              ]
+            : []
+        );
+      }
+    });
+
+    it('gives no restart notice when a wait line since the last restart gave its cause', async () => {
+      const cases: [DaemonRestartReason, IDaemonRestartWaitDetails, DaemonRestartReason][] = [
+        [
+          ENV_BOTH,
+          { scriptCount: 1 },
+          { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS', 'RUSH_X'] }
+        ],
+        [REMOVED, {}, { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' }],
+        // The wait line names the variables of the request that the daemon restarts for, and so does the notice.
+        [ENV_NODE_OPTIONS, ANOTHER, ENV_NODE_OPTIONS]
+      ];
+      for (const stderrIsTTY of [false, true]) {
+        for (const [waitReason, details, reason] of cases) {
+          const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+          await handlers.onQueuePositionAsync(1, waitReason, details);
+          advance(RESTART_WAIT_REPEAT_MS);
+          await handlers.onRestartAsync({ restart: 1, reason, successorPid: 42 });
+          advance(RESTART_WAIT_REPEAT_MS * 2);
+          handlers.dispose();
+          expect(calls).toHaveLength(2);
+          expect(calls[1]).toBe(calls[0].replace(': waiting for ', ': still waiting after 25s for '));
+        }
+      }
+    });
+
+    it('gives the restart notice when no wait line since the last restart gave its cause', async () => {
+      const notice = (cause: string, pid: number): string =>
+        `stderr: ${client}: A command restarted the daemon (PID ${pid}) ${cause}.\n`;
+      const cases: [string, (handlers: IDaemonRequestNoticeHandlers) => Promise<void>, string][] = [
+        [
+          'other variables',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, ENV_NODE_OPTIONS, {});
+            await handlers.onRestartAsync({ restart: 1, reason: ENV_BOTH, successorPid: 42 });
+          },
+          notice("because its environment differs from the daemon's in NODE_OPTIONS and RUSH_X", 42)
+        ],
+        [
+          'as many other variables',
+          async (handlers) => {
+            const waitReason: DaemonRestartReason = { kind: 'environmentChanged', variableNames: ['RUSH_X'] };
+            await handlers.onQueuePositionAsync(1, waitReason, {});
+            await handlers.onRestartAsync({ restart: 1, reason: ENV_NODE_OPTIONS, successorPid: 42 });
+          },
+          notice("because its environment differs from the daemon's in NODE_OPTIONS", 42)
+        ],
+        [
+          'another change',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, REMOVED, {});
+            await handlers.onRestartAsync({ restart: 1, reason: REPLACED, successorPid: 42 });
+          },
+          notice("because the daemon's installation at /snapshots/s9 was replaced", 42)
+        ],
+        [
+          'another installation',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, REMOVED, {});
+            await handlers.onRestartAsync({ restart: 1, reason: REMOVED_S10, successorPid: 42 });
+          },
+          notice("because the daemon's installation at /snapshots/s10 was removed", 42)
+        ],
+        [
+          'another kind',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+            await handlers.onRestartAsync({ restart: 1, reason: ENV_NODE_OPTIONS, successorPid: 42 });
+          },
+          notice("because its environment differs from the daemon's in NODE_OPTIONS", 42)
+        ],
+        [
+          'a plain position',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1);
+            await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+          },
+          notice("because the daemon's installation at /snapshots/s9 was removed", 42)
+        ],
+        [
+          'a second restart',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, REMOVED, {});
+            await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+            await handlers.onRestartAsync({ restart: 2, reason: REMOVED, successorPid: 43 });
+          },
+          notice("because the daemon's installation at /snapshots/s9 was removed", 43)
+        ]
+      ];
+      for (const stderrIsTTY of [false, true]) {
+        for (const [name, runAsync, expected] of cases) {
+          const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+          await runAsync(handlers);
+          handlers.dispose();
+          expect([name, calls.filter((call: string) => call.includes('restarted the daemon'))]).toEqual([
+            name,
+            [expected]
+          ]);
+          expect(calls[calls.length - 1]).toBe(expected);
+        }
+      }
+    });
+  });
+
+  it('shows a restart wait as the agent phase, announces each cause, and names the new daemon after the restart', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(2);
+    await handlers.onQueuePositionAsync(2, LOCKFILE, { scriptCount: 1 });
+    await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+    advance(RESTART_WAIT_REPEAT_MS * 2);
+    await handlers.onQueuePositionAsync(1, REMOVED, {});
+    await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+    await handlers.onQueuePositionAsync(1, REMOVED, {});
+    handlers.dispose();
+    const removed: string = 'because its installation at /snapshots/s9 was removed';
+    // The renderer wrote the announced wait as a line, which said why the daemon restarted, so the restart gets no
+    // note.
+    expect(calls).toEqual([
+      'position: 2',
+      `announce: waiting for 2 running requests to finish, including 1 rushx script; ${LOCKFILE_WAIT}`,
+      `wait: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`,
+      `announce: waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${removed}`,
+      `resubmitted: ${RESUBMITTED_PHASE}`,
+      `announce: waiting for 1 running request to finish; the daemon (PID 42) then restarts, ${removed}`
+    ]);
+  });
+
+  it('shows the rushx scripts that a command which restarts the daemon itself waits for as the agent phase', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1);
+    await handlers.onQueuePositionAsync(2, undefined, { scriptCount: 2 });
+    await handlers.onQueuePositionAsync(1, undefined, { scriptCount: 1 });
+    handlers.dispose();
+    expect(calls).toEqual([
+      'position: 1',
+      `announce: waiting for ${TWO_SCRIPTS}`,
+      `wait: waiting for ${ONE_SCRIPT}`
+    ]);
+  });
+
+  it('gives the agent a note for the restart only when the renderer wrote no line for its wait', async () => {
+    const wait: string =
+      "waiting for 1 running request to finish; the daemon (PID 41) then restarts, because this request's " +
+      "environment differs from the daemon's in NODE_OPTIONS";
+    for (const agentWritesWaitLines of [true, false]) {
+      const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false, agentWritesWaitLines });
+      await handlers.onQueuePositionAsync(1, ENV_NODE_OPTIONS, {});
+      await handlers.onQueuePositionAsync(1, ENV_NODE_OPTIONS, {});
+      await handlers.onRestartAsync({ restart: 1, reason: ENV_NODE_OPTIONS, successorPid: 42 });
+      handlers.dispose();
+      // On a TTY, the wait was only in the live rows, which the renderer then redraws.
+      expect(calls).toEqual([
+        `announce: ${wait}`,
+        `wait: ${wait}`,
+        ...(agentWritesWaitLines
+          ? []
+          : [
+              'note: rush-client: A command restarted the daemon (PID 42) because its environment differs ' +
+                "from the daemon's in NODE_OPTIONS."
+            ]),
+        `resubmitted: ${RESUBMITTED_PHASE}`
+      ]);
+    }
+  });
+
+  it('gives the agent a note and the resubmitted phase when the command is sent to a new daemon', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1);
+    await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: undefined, exitedPid: 41 });
+    handlers.dispose();
+    expect(calls).toEqual([
+      'position: 1',
+      'note: rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.',
+      `resubmitted: ${RESUBMITTED_PHASE}`
+    ]);
+  });
+
+  it('keeps the agent phase after a restart that the request did not wait for', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1);
+    await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: 42 });
+    expect(calls).toEqual(['position: 1']);
+  });
+
+  it('gives the agent renderer no more positions once the request ends or the client asks rushd to cancel it', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+    handlers.dispose();
+    await handlers.onQueuePositionAsync(1, REMOVED, {});
+    await handlers.onQueuePositionAsync(2);
+    expect(calls).toEqual([`announce: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`]);
+  });
+
+  it('gives the agent renderer the operations that an earlier failed command left running', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(1, undefined, {}, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+    await handlers.onQueuePositionAsync(1);
+    handlers.dispose();
+    expect(calls).toEqual(['position: 1 behind 2 (t8-slow1, t8-slow2)', 'position: 1']);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/daemonSilence.test.ts b/apps/rush-cli-client/src/test/daemonSilence.test.ts
new file mode 100644
index 00000000000..0491b40e394
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonSilence.test.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonClientLivenessOptions } from '@rushstack/rush-client-core';
+
+import { createDaemonLivenessOptions } from '../daemonSilence';
+import type { IAgentDaemonSilenceRenderer } from '../daemonSilence';
+
+describe(createDaemonLivenessOptions.name, () => {
+  function createLegacy(rushx: boolean): { liveness: IDaemonClientLivenessOptions; written: string[] } {
+    const written: string[] = [];
+    const liveness: IDaemonClientLivenessOptions = createDaemonLivenessOptions({
+      rushx,
+      agentRenderer: undefined,
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    return { liveness, written };
+  }
+
+  it('writes a line with what to do when rushd stops responding, and one when it responds again', () => {
+    const { liveness, written } = createLegacy(false);
+    liveness.onUnresponsive({ pid: 12345, silentForMs: 30_999 });
+    liveness.onResponsive?.({ pid: 12345, silentForMs: 70_200 });
+    expect(written).toEqual([
+      'rush-client: rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
+      'rush-client: rushd (PID 12345) responded again after 70s.\n'
+    ]);
+  });
+
+  it('names rushx-client, and names no PID when rushd reported none', () => {
+    const { liveness, written } = createLegacy(true);
+    liveness.onUnresponsive({ pid: undefined, silentForMs: 30_000 });
+    liveness.onResponsive?.({ pid: undefined, silentForMs: 31_000 });
+    expect(written).toEqual([
+      'rushx-client: rushd has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
+      'rushx-client: rushd responded again after 31s.\n'
+    ]);
+  });
+
+  it('leaves both reports to the agent renderer when it is active', () => {
+    const written: string[] = [];
+    const agentRenderer: IAgentDaemonSilenceRenderer = {
+      onDaemonUnresponsive: jest.fn(),
+      onDaemonResponsive: jest.fn()
+    };
+    const liveness: IDaemonClientLivenessOptions = createDaemonLivenessOptions({
+      rushx: false,
+      agentRenderer,
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    liveness.onUnresponsive({ pid: 41, silentForMs: 30_000 });
+    liveness.onResponsive?.({ pid: 41, silentForMs: 40_000 });
+    expect(agentRenderer.onDaemonUnresponsive).toHaveBeenCalledWith({ pid: 41, silentForMs: 30_000 });
+    expect(agentRenderer.onDaemonResponsive).toHaveBeenCalledWith({ pid: 41, silentForMs: 40_000 });
+    expect(written).toEqual([]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts b/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
new file mode 100644
index 00000000000..6ab81b9d9ab
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
@@ -0,0 +1,146 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+const DAEMON_PID: number = 41;
+
+const UNRESPONSIVE: string =
+  `rush-client: rushd (PID ${DAEMON_PID}) has not responded for 30s; its process may be stopped or ` +
+  'overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; ' +
+  'interrupt it (Ctrl+C) to stop waiting.\n';
+const RESPONDED: string = `rush-client: rushd (PID ${DAEMON_PID}) responded again after 31s.\n`;
+
+describe('the lines about a daemon that stopped responding', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let stdout: string[];
+  let stderr: string[];
+  /** What the client had written to stderr while the daemon was still silent. */
+  let stderrWhileSilent: string[] | undefined;
+
+  /** Records each write to `stream`, and completes it at once. */
+  function record(stream: NodeJS.WriteStream, chunks: string[]): void {
+    jest.spyOn(stream, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      chunks.push(Buffer.from(chunk).toString());
+      (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+      return true;
+    }) as typeof stream.write);
+  }
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-daemon-silence-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    stdout = [];
+    stderr = [];
+    stderrWhileSilent = undefined;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    record(process.stdout, stdout);
+    record(process.stderr, stderr);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: DAEMON_PID })
+    } as unknown as DaemonClient);
+    // The daemon writes a line of the command's output, then sends nothing for 31 s, which DaemonClient
+    // reports once 30 s have passed, then writes another line and the result.
+    jest
+      .mocked(executeWithDaemonRestartAsync)
+      .mockImplementation(async (client, connection, { request, onStdoutAsync, liveness }) => {
+        await onStdoutAsync!(Buffer.from('built-a\n'), request.requestId);
+        liveness!.onUnresponsive({ pid: DAEMON_PID, silentForMs: 30_000 });
+        await new Promise((resolve) => setImmediate(resolve));
+        stderrWhileSilent = [...stderr];
+        liveness!.onResponsive!({ pid: DAEMON_PID, silentForMs: 31_000 });
+        await onStdoutAsync!(Buffer.from('built-b\n'), request.requestId);
+        return {
+          kind: 'result',
+          result: { requestId: request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+        };
+      });
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it("writes them to stderr while the daemon is silent, and leaves stdout to the command's output", async () => {
+    await launchClientAsync(false);
+    // `rush-client build | grep ...` must not see them.
+    expect(stdout.join('')).toBe('built-a\nbuilt-b\n');
+    expect(stderrWhileSilent).toEqual([UNRESPONSIVE]);
+    expect(stderr).toEqual([UNRESPONSIVE, RESPONDED]);
+    expect(process.exitCode).toBe(0);
+  });
+
+  it('leaves them to the agent output, and writes none to stderr', async () => {
+    const output: string[] = [];
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: (text: string) => output.push(text)
+    });
+    await launchClientAsync(false, renderer);
+    expect(output.join('').split('\n').slice(0, -1)).toEqual([
+      expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
+      expect.stringMatching(
+        /^rush build · \d+\.\ds · rushd \(PID 41\) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
+      ),
+      expect.stringMatching(/^rush build · \d+\.\ds · rushd \(PID 41\) responded again after 31s$/),
+      expect.stringMatching(/^rush build: SUCCESS/)
+    ]);
+    expect(stderr).toEqual([]);
+    expect(stdout).toEqual([]);
+    expect(process.exitCode).toBe(0);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/earlyRouting.test.ts b/apps/rush-cli-client/src/test/earlyRouting.test.ts
new file mode 100644
index 00000000000..95a86ed6805
--- /dev/null
+++ b/apps/rush-cli-client/src/test/earlyRouting.test.ts
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { getCiEnvironmentVariable, isDaemonOffBeforeRouting } from '../earlyRouting';
+
+describe(getCiEnvironmentVariable.name, () => {
+  it.each([
+    { environment: {}, name: undefined },
+    { environment: { CI: '' }, name: undefined },
+    { environment: { CI: '0', GITHUB_ACTIONS: 'false' }, name: undefined },
+    { environment: { CI: 'true' }, name: 'CI' },
+    { environment: { CI: 'false', TF_BUILD: 'True' }, name: 'TF_BUILD' },
+    { environment: { TEAMCITY_VERSION: '2024.1', JENKINS_URL: 'https://ci' }, name: 'JENKINS_URL' }
+  ])('returns $name for $environment', ({ environment, name }) => {
+    expect(getCiEnvironmentVariable(environment)).toBe(name);
+  });
+});
+
+describe(isDaemonOffBeforeRouting.name, () => {
+  let folder: string;
+  let rushJsonPath: string;
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-early-routing-'));
+    rushJsonPath = path.join(folder, 'rush.json');
+  });
+  afterEach(() => fs.rmSync(folder, { recursive: true, force: true }));
+
+  function isOff(rushJson: string, environment: Record<string, string> = {}): boolean {
+    fs.writeFileSync(rushJsonPath, rushJson);
+    return isDaemonOffBeforeRouting(environment, rushJsonPath);
+  }
+
+  it('follows RUSH_DAEMON and the CI markers', () => {
+    expect(isDaemonOffBeforeRouting({ RUSH_DAEMON: '1' }, undefined)).toBe(true);
+    expect(isOff('{ "daemon": { "enabled": true } }', { RUSH_DAEMON: '0' })).toBe(true);
+    expect(isOff('{}', { RUSH_DAEMON: '1' })).toBe(false);
+    expect(isOff('{ "daemon": { "enabled": true } }', { CI: '1' })).toBe(true);
+    expect(isOff('{}', { CI: '1', RUSH_DAEMON: '1' })).toBe(false);
+  });
+
+  it('reads daemon.enabled from rush.json when RUSH_DAEMON is not set', () => {
+    expect(isOff('{ "projects": [] }')).toBe(true);
+    expect(isOff('{ "daemon": {} }')).toBe(true);
+    expect(isOff('{ "daemon": { "enabled": false, "autoStart": true } }')).toBe(true);
+    expect(isOff('{ "daemon": { "compatiblePlugins": ["p"], "enabled": true } }')).toBe(false);
+  });
+
+  it('reads "enabled" only inside the daemon block', () => {
+    expect(isOff('{ "daemon": {}, "x": { "enabled": true } }')).toBe(true);
+    expect(isOff('{ "x": { "enabled": true }, "daemon": { "enabled": false } }')).toBe(true);
+    expect(isOff('{ "x": { "enabled": false }, "daemon": { "enabled": true } }')).toBe(false);
+  });
+
+  it('ignores the daemon block that `rush init` writes as comments', () => {
+    expect(isOff('{\n  // "daemon": {\n  //   "enabled": true\n  // },\n  "projects": []\n}')).toBe(true);
+    expect(isOff('{\n  /* "daemon": { "enabled": true } */\n  "projects": []\n}')).toBe(true);
+    expect(isOff('{\n  "daemon": {\n    // "enabled": false\n    "enabled": true\n  }\n}')).toBe(false);
+  });
+
+  it('cannot tell when rush.json cannot be read', () => {
+    expect(isDaemonOffBeforeRouting({}, path.join(folder, 'missing', 'rush.json'))).toBe(false);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/inProcessFallback.test.ts b/apps/rush-cli-client/src/test/inProcessFallback.test.ts
new file mode 100644
index 00000000000..cea7fce1e83
--- /dev/null
+++ b/apps/rush-cli-client/src/test/inProcessFallback.test.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatInProcessFallbackMessage } from '../inProcessFallback';
+
+describe(formatInProcessFallbackMessage.name, () => {
+  it('ends the reason with the fallback, without a period before the semicolon', () => {
+    expect(
+      formatInProcessFallbackMessage(
+        'The daemon does not support explicit Rushx invocations; no request was sent.'
+      )
+    ).toBe(
+      'rush-client: The daemon does not support explicit Rushx invocations; no request was sent; ' +
+        'using in-process Rush.\n'
+    );
+    expect(formatInProcessFallbackMessage('controllingTerminalRequired')).toBe(
+      'rush-client: controllingTerminalRequired; using in-process Rush.\n'
+    );
+  });
+
+  it('starts with the given client name', () => {
+    expect(
+      formatInProcessFallbackMessage('the daemon does not run scripts in a terminal', 'rushx-client')
+    ).toBe('rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.\n');
+  });
+
+  it('gives the first line of a multi-line reason on the fallback line and the other lines as details', () => {
+    expect(
+      formatInProcessFallbackMessage(
+        'Plugins must be declared daemon-compatible. Use --no-daemon.\n\n' +
+          'The compatible plugin list names plugins that are not configured: "p".\n'
+      )
+    ).toBe(
+      'rush-client: Plugins must be declared daemon-compatible. Use --no-daemon; using in-process Rush.\n' +
+        '  The compatible plugin list names plugins that are not configured: "p".\n'
+    );
+  });
+
+  it('drops the colon of a first line that introduces the lines after it', () => {
+    expect(
+      formatInProcessFallbackMessage(
+        'Error reading "/repo/common/config/rush/command-line.json":\n  Unexpected token } at 3:1\n}\n^'
+      )
+    ).toBe(
+      'rush-client: Error reading "/repo/common/config/rush/command-line.json"; using in-process Rush.\n' +
+        '    Unexpected token } at 3:1\n' +
+        '  }\n' +
+        '  ^\n'
+    );
+    // JsonFile ends the line with os.EOL.
+    expect(formatInProcessFallbackMessage('Error reading "x.json":\r\n  Unexpected token')).toBe(
+      'rush-client: Error reading "x.json"; using in-process Rush.\n    Unexpected token\n'
+    );
+  });
+});
diff --git a/apps/rush-cli-client/src/test/inProcessLockWait.test.ts b/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
new file mode 100644
index 00000000000..3100914ae21
--- /dev/null
+++ b/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
@@ -0,0 +1,231 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { getInProcessLockWaitDeadlineMs, setInProcessLockWait } from '../inProcessLockWait';
+import { getBundledRushVersion } from '../lazyRushModules';
+import { launchClientAsync } from '../launchClient';
+
+// Rush reads these names from EnvironmentVariableNames in @microsoft/rush-lib.
+const DEADLINE: string = '_RUSH_LOCK_WAIT_DEADLINE';
+const DAEMON_PID: string = '_RUSH_LOCK_WAIT_DAEMON_PID';
+
+// Rushx keeps a script that has a terminal in-process, so the rushx test hides the test runner's terminal.
+function hideTerminal(): () => void {
+  const streams: object[] = [process.stdin, process.stdout, process.stderr];
+  const descriptors: (PropertyDescriptor | undefined)[] = streams.map((stream) =>
+    Object.getOwnPropertyDescriptor(stream, 'isTTY')
+  );
+  for (const stream of streams) {
+    Object.defineProperty(stream, 'isTTY', { value: undefined, configurable: true, writable: true });
+  }
+  return () => {
+    streams.forEach((stream, index) => {
+      const descriptor: PropertyDescriptor | undefined = descriptors[index];
+      if (descriptor) Object.defineProperty(stream, 'isTTY', descriptor);
+      else delete (stream as { isTTY?: boolean }).isTTY;
+    });
+  };
+}
+
+describe(getInProcessLockWaitDeadlineMs.name, () => {
+  it('counts the wait timeout from when the wait began', () => {
+    expect(
+      getInProcessLockWaitDeadlineMs({
+        startedAtMs: 1000,
+        admission: { waitTimeoutMs: 30000, waitTimeoutIsDefault: true },
+        daemonPid: 42
+      })
+    ).toBe(31000);
+    expect(
+      getInProcessLockWaitDeadlineMs({
+        startedAtMs: 1000,
+        admission: { waitTimeoutMs: 60500 },
+        daemonPid: 42
+      })
+    ).toBe(61500);
+  });
+
+  it('does not wait with --no-wait, a zero timeout, or no admission options', () => {
+    for (const admission of [{ noWait: true }, { waitTimeoutMs: 0 }, undefined]) {
+      expect(getInProcessLockWaitDeadlineMs({ startedAtMs: 1000, admission, daemonPid: 42 })).toBe(1000);
+    }
+  });
+});
+
+describe(setInProcessLockWait.name, () => {
+  it('sets the deadline and the daemon PID', () => {
+    const environment: NodeJS.ProcessEnv = { PATH: '/bin' };
+    setInProcessLockWait(environment, {
+      startedAtMs: 1000,
+      admission: { waitTimeoutMs: 5000 },
+      daemonPid: 42
+    });
+    expect(environment).toEqual({ PATH: '/bin', [DEADLINE]: '6000', [DAEMON_PID]: '42' });
+  });
+
+  it('removes a daemon PID that no daemon handed over', () => {
+    const environment: NodeJS.ProcessEnv = { [DAEMON_PID]: '7' };
+    setInProcessLockWait(environment, {
+      startedAtMs: 1000,
+      admission: { noWait: true },
+      daemonPid: undefined
+    });
+    expect(environment).toEqual({ [DEADLINE]: '1000' });
+  });
+});
+
+describe('rush-client asks in-process Rush to wait for the repository lock after it tried the daemon', () => {
+  const SENT_AT_MS: number = 1_000_000;
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let now: jest.SpyInstance<number, []>;
+
+  function writeRushJson(rushVersion: string): void {
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion, pnpmVersion: '10.27.0', projects: [] })
+    );
+  }
+
+  function mockDaemon(pid: number): void {
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      status: Promise.resolve({ pid }),
+      closeAsync: async () => undefined
+    } as unknown as DaemonClient);
+  }
+
+  /** The daemon takes 20 s to hand the request back. */
+  function mockHandBack(successorPid?: number): void {
+    jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => {
+      now.mockReturnValue(SENT_AT_MS + 20000);
+      if (successorPid !== undefined) {
+        await options.onRestartAsync?.({ restart: 1, reason: undefined, successorPid });
+      }
+      return { kind: 'fallback', reason: 'unsupported', message: 'The daemon cannot run this command.' };
+    });
+  }
+
+  function getLockWait(): { deadline?: string; daemonPid?: string } {
+    return { deadline: process.env[DEADLINE], daemonPid: process.env[DAEMON_PID] };
+  }
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-lock-wait-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    writeRushJson(getBundledRushVersion());
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    now = jest.spyOn(Date, 'now').mockReturnValue(SENT_AT_MS);
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
+    for (const name of ['RUSH_LOG_LEVEL', 'RUSH_PREVIEW_VERSION', DEADLINE, DAEMON_PID])
+      delete process.env[name];
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('for what is left of the wait timeout when the daemon hands the request back', async () => {
+    mockDaemon(42);
+    mockHandBack();
+    await launchClientAsync(false);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 30000}`, daemonPid: '42' });
+  });
+
+  it('naming the daemon that the request followed a restart to', async () => {
+    mockDaemon(42);
+    mockHandBack(43);
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 30000}`, daemonPid: '43' });
+  });
+
+  it('for the explicit wait timeout, and not at all with --no-wait', async () => {
+    mockDaemon(42);
+    mockHandBack();
+    process.argv = [process.execPath, 'rush-client', 'build', '--wait-timeout', '90', '--to', 'project'];
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 90000}`, daemonPid: '42' });
+
+    now.mockReturnValue(SENT_AT_MS);
+    process.argv = [process.execPath, 'rush-client', 'build', '--no-wait', '--to', 'project'];
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS}`, daemonPid: '42' });
+  });
+
+  it('for the whole wait timeout when it cannot reach a daemon', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonClientError('startupFailed', 'No ready daemon; auto-start is disabled.'));
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 30000}`, daemonPid: undefined });
+  });
+
+  it('not when the command runs in-process without the daemon', async () => {
+    process.env.RUSH_DAEMON = '0';
+    await launchClientAsync(false);
+    expect(connectOrAwaitDaemonStartupAsync).not.toHaveBeenCalled();
+    expect(getLockWait()).toEqual({});
+  });
+
+  it('not for rushx, whose script would inherit the variables', async () => {
+    const restoreTerminal: () => void = hideTerminal();
+    try {
+      mockDaemon(42);
+      mockHandBack();
+      process.argv = [process.execPath, 'rushx-client', 'sample'];
+      delete process.env.RUSH_REPORTER;
+      await launchClientAsync(true);
+      expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+      expect(process.argv[1]).toBe(
+        path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rushx')
+      );
+      expect(getLockWait()).toEqual({});
+    } finally {
+      restoreTerminal();
+    }
+  });
+
+  it('not when the workspace selects another Rush release, which would not remove the variables', async () => {
+    writeRushJson('5.178.1');
+    mockDaemon(42);
+    mockHandBack();
+    await launchClientAsync(false);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(getLockWait()).toEqual({});
+  });
+});
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index 39b091f31fa..2501eb24b58 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -10,7 +10,13 @@ import * as http from 'node:http';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { Rush } from '@microsoft/rush-lib';
-import { DaemonClient, connectOrStartDaemonAsync, getDaemonLogFilePath } from '@rushstack/rush-client-core';
+import {
+  DaemonClient,
+  DaemonClientError,
+  connectOrStartDaemonAsync,
+  getDaemonLogFilePath,
+  reclaimCrashedDaemonAsync
+} from '@rushstack/rush-client-core';
 import type { DaemonClientOutcome } from '@rushstack/rush-client-core';
 import { RushDaemonHost, WorkspaceSession } from '@rushstack/rush-daemon';
 import {
@@ -18,15 +24,23 @@ import {
   waitForTestProcessExitAsync
 } from '@rushstack/rush-daemon/lib/test/TestProcessExit';
 import { captureTestDaemonListenerAsync } from '@rushstack/rush-daemon/lib/test/TestDaemonListener';
-import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  readDaemonLockfile,
+  type IDaemonLockfile
+} from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
+import { CI_ENVIRONMENT_VARIABLES } from '../earlyRouting';
+import { isConnectionFailure } from '../launchClient';
 import {
   CANCELLATION_SIGNALS,
   formatCancellationMessage,
   getSignalExitCode,
   isCancelledOutcome
 } from '../clientCancellation';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 interface IInvocationResult {
   readonly code: number | undefined;
@@ -34,6 +48,19 @@ interface IInvocationResult {
   readonly stderr: string;
 }
 
+// What `daemon status` adds when no daemon runs, for each resolved daemon.enabled and daemon.autoStart.
+const NEXT_COMMAND_STARTS: string = '; the next rush-client command that uses the daemon starts one.';
+const AUTO_START_OFF: string =
+  ', and auto-start is off, so rush-client commands run Rush in-process until "rush-client daemon start" starts one.';
+const NOT_ENABLED: string = '; the daemon is not enabled here, so rush-client commands run Rush in-process.';
+// Turns off every CI marker that the test process may have inherited from its CI runner.
+const NON_CI_ENVIRONMENT: NodeJS.ProcessEnv = Object.fromEntries(
+  CI_ENVIRONMENT_VARIABLES.map((name) => [name, 'false'])
+);
+// Windows runners take much longer to start the processes that these tests run.
+const SLOW_TEST_TIMEOUT_MS: number = process.platform === 'win32' ? 60000 : 15000;
+const CLEANUP_TIMEOUT_MS: number = process.platform === 'win32' ? 30000 : 5000;
+
 describe('standalone rushx fallback', () => {
   let folder: string;
   let project: string;
@@ -53,6 +80,7 @@ describe('standalone rushx fallback', () => {
       path.join(folder, 'rush.json'),
       JSON.stringify({
         rushVersion: Rush.version,
+        suppressNodeLtsWarning: true,
         pnpmVersion: '10.27.0',
         daemon: { enabled: false, autoStart: false },
         projects: [{ packageName: 'sample', projectFolder: 'project' }],
@@ -84,14 +112,15 @@ describe('standalone rushx fallback', () => {
     await Promise.all(Array.from(closingDaemonPids, (pid) => waitForTestProcessExitAsync(pid)));
     await removeTestFolderAsync(closingLogFilePath, true);
     await removeTestFolderAsync(closingFolder);
-  });
+  }, CLEANUP_TIMEOUT_MS);
 
   async function invokeAsync(
     client: boolean,
     optIn: boolean,
     fakeTty: boolean = false,
     managementArgs?: ReadonlyArray<string>,
-    environmentOverrides: NodeJS.ProcessEnv = {}
+    environmentOverrides: NodeJS.ProcessEnv = {},
+    onStderr?: (stderr: string) => void
   ): Promise<IInvocationResult> {
     const invocationDaemonPids: Set<number> = daemonPids;
     const entry: string = client
@@ -106,12 +135,11 @@ describe('standalone rushx fallback', () => {
     const child: ChildProcess = spawn(process.execPath, args, {
       cwd: project,
       env: {
-        ...process.env,
+        ...getTestProcessEnvironment(),
         CLIENT_MARKER: 'script-output',
         RUSH_DAEMON: optIn ? '1' : '0',
+        ...NON_CI_ENVIRONMENT,
         CI: managementArgs ? 'true' : 'false',
-        TF_BUILD: 'false',
-        GITHUB_ACTIONS: 'false',
         ...environmentOverrides
       },
       stdio: ['ignore', 'pipe', 'pipe']
@@ -123,6 +151,7 @@ describe('standalone rushx fallback', () => {
     });
     child.stderr!.on('data', (chunk: Buffer) => {
       stderr += chunk.toString();
+      onStderr?.(stderr);
     });
     const closed: Promise<unknown[]> = once(child, 'close');
     invocationClosures.push(closed);
@@ -141,25 +170,155 @@ describe('standalone rushx fallback', () => {
     return { code: typeof code === 'number' ? code : undefined, stdout, stderr };
   }
 
-  it('preserves native project-script output and exit code for --no-daemon', async () => {
-    const native: IInvocationResult = await invokeAsync(false, false);
-    expect(native.code).toBe(7);
-    expect(await invokeAsync(true, true)).toEqual(native);
-  }, 15000);
+  /** The client names the repository by the path it found; that spelling of the temporary folder varies by platform. */
+  function expectNoDaemonRunning(result: IInvocationResult, next: string): void {
+    expect(result).toMatchObject({ code: 1, stdout: '' });
+    expect(result.stderr).toMatch(/^rush-client: No daemon is running for /);
+    expect(result.stderr).toContain(`${path.sep}${path.basename(folder)} (Rush ${Rush.version})${next}\n`);
+    expect(result.stderr.split('\n')).toHaveLength(2);
+  }
+
+  it(
+    'preserves native project-script output and exit code for --no-daemon',
+    async () => {
+      const native: IInvocationResult = await invokeAsync(false, false);
+      expect(native.code).toBe(7);
+      expect(await invokeAsync(true, true)).toEqual(native);
+    },
+    SLOW_TEST_TIMEOUT_MS
+  );
+
+  it(
+    'keeps unknown interactive scripts on the native path even when a daemon is running',
+    async () => {
+      const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+      host = await RushDaemonHost.startAsync({
+        repoRoot: folder,
+        rushVersion: Rush.version,
+        daemonVersion: daemonPackage.version
+      });
+      const native: IInvocationResult = await invokeAsync(false, false);
+      const client: IInvocationResult = await invokeAsync(true, true, true);
+      expect(client.code).toBe(native.code);
+      expect(client.stdout).toBe(native.stdout);
+      // RUSH_DAEMON=1 asked for the daemon, so the client says why it did not use it.
+      expect(client).toEqual({
+        ...native,
+        stderr:
+          'rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.\n' +
+          native.stderr
+      });
+      // rushx-client always uses legacy output, so an agent marker adds no line.
+      expect(await invokeAsync(true, false, true, undefined, { COPILOT_CLI: '1' })).toEqual(native);
+    },
+    SLOW_TEST_TIMEOUT_MS
+  );
 
-  it('keeps unknown interactive scripts on the native path even when a daemon is running', async () => {
+  it('says why a command runs in-process in agent mode, or when RUSH_DAEMON=1 asked for the daemon', async () => {
+    const agent: IInvocationResult = await invokeAsync(true, false, false, ['-q', 'list'], {
+      COPILOT_CLI: '1'
+    });
+    expect(agent.code).toBe(0);
+    expect(agent.stderr).toBe('rush-client: RUSH_DAEMON=0 turns the daemon off; using in-process Rush.\n');
+    // In-process Rush got the quiet flag, and no progress line was written.
+    expect(agent.stdout).toContain('sample');
+    expect(agent.stdout).not.toMatch(/Rush Multi-Project Build Tool|rushd/);
+    const legacy: IInvocationResult = await invokeAsync(true, false, false, ['-q', 'list']);
+    expect(legacy).toEqual({ ...agent, stderr: '' });
+    const requested: IInvocationResult = await invokeAsync(true, true, false, ['-q', '--debug', 'list']);
+    expect(requested.code).toBe(0);
+    expect(requested.stderr).toBe(
+      'rush-client: the daemon does not support "--debug"; using in-process Rush.\n'
+    );
+    // In-process Rush got both flags: --debug lists the plugins that Rush loads.
+    expect(requested.stdout).toMatch(/^Loaded rush plugin[^]*\nsample\n$/);
+    expect(requested.stdout).not.toContain('Rush Multi-Project Build Tool');
+    expect(await invokeAsync(true, true, false, ['--no-daemon', '-q', 'list'])).toEqual(legacy);
+    expect((await invokeAsync(true, false, false, ['list'])).stdout).toContain(
+      'Rush Multi-Project Build Tool'
+    );
+  }, 30000);
+
+  it('keeps the quiet flag for in-process Rush after the daemon could not run the command', async () => {
+    const unreachable: IInvocationResult = await invokeAsync(true, true, false, ['-q', 'list']);
+    expect(unreachable).toMatchObject({ code: 0, stdout: 'sample\n' });
+    expect(unreachable.stderr).toMatch(
+      /^rush-client: No ready daemon at .*; auto-start is disabled; using in-process Rush\.\n$/
+    );
     const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
     host = await RushDaemonHost.startAsync({
       repoRoot: folder,
       rushVersion: Rush.version,
       daemonVersion: daemonPackage.version
     });
-    const native: IInvocationResult = await invokeAsync(false, false);
-    const client: IInvocationResult = await invokeAsync(true, true, true);
-    expect(client.code).toBe(native.code);
-    expect(client.stdout).toBe(native.stdout);
-    expect(client).toEqual(native);
-  }, 15000);
+    const sentBack: IInvocationResult = await invokeAsync(true, true, false, ['-q', 'list']);
+    expect(sentBack).toMatchObject({ code: 0, stdout: 'sample\n' });
+    expect(sentBack.stderr).toMatch(/^rush-client: .*; using in-process Rush\.\n$/);
+  }, 30000);
+
+  it('paints no progress line on a terminal for a command that runs in-process', async () => {
+    const entry: string = path.resolve(__dirname, '../../bin/rush-client');
+    const invokeOnTerminalAsync = async (environment: NodeJS.ProcessEnv): Promise<IInvocationResult> => {
+      const child: ChildProcess = spawn(
+        process.execPath,
+        [
+          '-e',
+          `Object.assign(process.stdout, { isTTY: true, columns: 80 }); process.argv = [process.execPath, ${JSON.stringify(entry)}, '-q', 'list']; require(${JSON.stringify(entry)});`
+        ],
+        {
+          cwd: project,
+          env: {
+            ...getTestProcessEnvironment(),
+            COPILOT_CLI: '1',
+            TERM: 'xterm',
+            ...NON_CI_ENVIRONMENT,
+            ...environment
+          },
+          stdio: ['ignore', 'pipe', 'pipe']
+        }
+      );
+      let stdout: string = '';
+      let stderr: string = '';
+      child.stdout!.on('data', (chunk: Buffer) => (stdout += chunk.toString()));
+      child.stderr!.on('data', (chunk: Buffer) => (stderr += chunk.toString()));
+      const closed: Promise<unknown[]> = once(child, 'close');
+      invocationClosures.push(closed);
+      const [code] = await closed;
+      return { code: typeof code === 'number' ? code : undefined, stdout, stderr };
+    };
+    for (const environment of [
+      { RUSH_DAEMON: '0' },
+      { RUSH_DAEMON: undefined },
+      { CI: '1', RUSH_DAEMON: undefined }
+    ]) {
+      const result: IInvocationResult = await invokeOnTerminalAsync(environment);
+      expect(result).toMatchObject({ code: 0, stdout: 'sample\n' });
+      expect(result.stderr).toContain('; using in-process Rush.');
+    }
+
+    // The early guess misses the escaped key and paints nothing; the line starts once routing chose the daemon.
+    const rushJsonPath: string = path.join(folder, 'rush.json');
+    const config: Record<string, unknown> = JSON.parse(fs.readFileSync(rushJsonPath, 'utf8'));
+    fs.writeFileSync(
+      rushJsonPath,
+      JSON.stringify({ ...config, daemon: { autoStart: false } }).replace(
+        '"daemon":{',
+        '"daemon":{"\\u0065nabled":true,'
+      )
+    );
+    const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+    host = await RushDaemonHost.startAsync({
+      repoRoot: folder,
+      rushVersion: Rush.version,
+      daemonVersion: daemonPackage.version
+    });
+    const routed: IInvocationResult = await invokeOnTerminalAsync({ RUSH_DAEMON: undefined });
+    expect(routed.code).toBe(0);
+    // Painted before the request was sent, so the line started when routing chose the daemon.
+    expect(routed.stdout).toContain('rush list · ');
+    expect(routed.stdout).toContain('connecting to rushd');
+    expect(routed.stdout).toMatch(/sample\n$/);
+  }, 30000);
 
   it('starts idempotently and reports real readiness in CI without execution opt-in', async () => {
     const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
@@ -185,12 +344,38 @@ describe('standalone rushx fallback', () => {
     }
   }, 15000);
 
+  it('status reports a daemon whose installation was removed, with rc 1', async () => {
+    const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+    host = await RushDaemonHost.startAsync({
+      repoRoot: folder,
+      rushVersion: Rush.version,
+      daemonVersion: daemonPackage.version,
+      checkInstallation: () => ({ change: 'removed', folder: '/snapshots/gone' })
+    });
+    const result: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+    expect(result.code).toBe(1);
+    expect(JSON.parse(result.stdout)).toMatchObject({
+      state: 'installationChanged',
+      socketPath: host.paths.socketPath,
+      pid: process.pid,
+      installationChange: { change: 'removed', folder: '/snapshots/gone' }
+    });
+    expect(result.stderr).toBe(
+      "rush-client: The daemon's installation at /snapshots/gone was removed. " +
+        'The next command restarts the daemon, or run "rush-client daemon restart".\n'
+    );
+  }, 15000);
+
   it('status never starts an absent daemon or falls back to command execution', async () => {
     const result: IInvocationResult = await invokeAsync(true, true, false, ['daemon', 'status']);
-    expect(result.code).toBe(1);
-    expect(result.stdout).toBe('');
-    expect(result.stderr).toContain('Could not connect to daemon');
+    expectNoDaemonRunning(result, AUTO_START_OFF);
     expect(result.stderr).not.toContain('using in-process');
+    // What the next command does follows the resolved settings.
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+      NEXT_COMMAND_STARTS
+    );
+    expectNoDaemonRunning(await invokeAsync(true, false, false, ['daemon', 'status']), NOT_ENABLED);
     const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
     expect(fs.existsSync(paths.lockfilePath)).toBe(false);
   });
@@ -218,12 +403,72 @@ describe('standalone rushx fallback', () => {
       expect(fs.existsSync(paths.lockfilePath)).toBe(false);
     }
     const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
-    expect(stopped.code).toBe(1);
+    expectNoDaemonRunning(stopped, NOT_ENABLED);
     const log: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'logs']);
     expect(log.code).toBe(0);
-    expect(log.stdout).toContain('rushd ready at');
+    const isoTime: string = '\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z';
+    const ready: RegExpMatchArray | null = log.stdout.match(
+      new RegExp(`^${isoTime} rushd ready at .+ \\(Rush ${Rush.version}, PID (\\d+)\\)$`, 'm')
+    );
+    expect(ready).not.toBeNull();
+    expect(log.stdout).toMatch(
+      new RegExp(`^${isoTime} rushd \\(PID ${ready![1]}\\) shutting down: idle for 2 s$`, 'm')
+    );
   }, 15000);
 
+  it('status says that no daemon is running after daemon stop and after SIGTERM', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    try {
+      const stopCases: string[] = process.platform === 'win32' ? ['daemon stop'] : ['daemon stop', 'SIGTERM'];
+      for (const stopWith of stopCases) {
+        const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+        expect(started.code).toBe(0);
+        const { pid }: { pid: number } = JSON.parse(started.stdout);
+        expect(pid).not.toBe(process.pid);
+        if (stopWith === 'SIGTERM') {
+          // The daemon that this test just started shuts down in order on SIGTERM.
+          process.kill(pid, 'SIGTERM');
+        } else {
+          expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+        }
+        await waitForTestProcessExitAsync(pid);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+        expectNoDaemonRunning(
+          await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+          NEXT_COMMAND_STARTS
+        );
+      }
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'status keeps the refused-connection diagnostic for a socket that remains without its daemon',
+    async () => {
+      const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+      fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+      const listener: ChildProcess = spawn(
+        process.execPath,
+        [
+          '-e',
+          `require('net').createServer().listen(${JSON.stringify(paths.socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+        ],
+        { stdio: 'ignore' }
+      );
+      await once(listener, 'close');
+      try {
+        expect(fs.existsSync(paths.socketPath)).toBe(true);
+        const status: IInvocationResult = await invokeAsync(true, true, false, ['daemon', 'status']);
+        expect(status).toMatchObject({ code: 1, stdout: '' });
+        expect(status.stderr).toBe(`rush-client: Could not connect to daemon at ${paths.socketPath}.\n`);
+      } finally {
+        fs.rmSync(paths.socketPath, { force: true });
+      }
+    }
+  );
+
   it('reads a saved launcher log without connecting or auto-starting', async () => {
     fs.mkdirSync(path.dirname(logFilePath), { recursive: true, mode: 0o700 });
     const contents: string = `${'startup output\n'.repeat(20000)}startup error\n`;
@@ -306,6 +551,284 @@ describe('standalone rushx fallback', () => {
     }
   }, 30000);
 
+  it('stop resolves a startup reservation next to a ready daemon so that a later start launches', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    try {
+      const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+      expect(started.code).toBe(0);
+      const { pid }: { pid: number } = JSON.parse(started.stdout);
+      fs.writeFileSync(reservation, 'abandoned');
+      const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop']);
+      expect(stopped).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(stopped.stdout)).toEqual({
+        state: 'shutdownAccepted',
+        socketPath: paths.socketPath,
+        cancelledRequests: 0
+      });
+      expect(fs.existsSync(reservation)).toBe(false);
+      // The daemon writes the line before it acknowledges the request.
+      expect(fs.readFileSync(logFilePath, 'utf8')).toContain(
+        `rushd (PID ${pid}) shutting down: requested by a client ("rush-client daemon stop" or "daemon restart")\n`
+      );
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+      const restarted: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+      expect(restarted).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(restarted.stdout).pid).not.toBe(pid);
+      expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  it('reports a startup reservation next to a ready daemon, and restart resolves it', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    try {
+      const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+      expect(started.code).toBe(0);
+      const { pid }: { pid: number } = JSON.parse(started.stdout);
+      fs.writeFileSync(reservation, 'abandoned');
+      const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(status).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(status.stdout)).toMatchObject({
+        state: 'ready',
+        pid,
+        startupReservation: { path: reservation, helperState: 'unknown' }
+      });
+      // Status only reports the reservation.
+      expect(fs.readFileSync(reservation, 'utf8')).toBe('abandoned');
+      const restarted: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'restart']);
+      expect(restarted).toMatchObject({ code: 0, stderr: '' });
+      const successor: Record<string, unknown> = JSON.parse(restarted.stdout);
+      expect(successor).toMatchObject({ state: 'ready', pid: expect.any(Number) });
+      expect(successor.pid).not.toBe(pid);
+      expect(successor).not.toHaveProperty('startupReservation');
+      expect(fs.existsSync(reservation)).toBe(false);
+      expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  it.each(['exited', 'running'])(
+    'status explains a startup reservation (helper %s) while no daemon is ready',
+    async (helperState) => {
+      const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+      const reservation: string = `${paths.lockfilePath}.starting`;
+      fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+      // A startup helper that runs until its stdin ends, without ever starting a daemon.
+      const helper: ChildProcess = spawn(process.execPath, ['-e', 'process.stdin.resume()'], {
+        stdio: ['pipe', 'ignore', 'ignore']
+      });
+      const helperClosed: Promise<unknown[]> = once(helper, 'close');
+      const helperPid: number = helper.pid!;
+      if (helperState === 'exited') {
+        helper.stdin!.end();
+        await helperClosed;
+      }
+      const helperStartedAt: Date = new Date();
+      fs.writeFileSync(
+        reservation,
+        JSON.stringify({ token: 'fixture', helperPid, helperStartedAt: helperStartedAt.toISOString() })
+      );
+      const relaunchAfter: string = new Date(helperStartedAt.getTime() + 15000).toISOString();
+      try {
+        const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+        expect(status).toMatchObject({ code: 1, stdout: '' });
+        expect(status.stderr).toContain('Could not connect to daemon');
+        expect(status.stderr).toContain(
+          helperState === 'exited'
+            ? `its startup helper (PID ${helperPid}) exited before the daemon became ready. A command that starts the daemon after ${relaunchAfter} takes the reservation over and launches the daemon again, provided that nothing listens at ${paths.socketPath} then. "rush-client daemon logs" may show why the daemon did not become ready.`
+            : `A daemon is starting: its startup helper (PID ${helperPid}) is still waiting for it to become ready; retry shortly.`
+        );
+        let onStopWaits: () => void = () => undefined;
+        const stopWaits: Promise<void> = new Promise((resolve) => (onStopWaits = resolve));
+        const stopping: Promise<IInvocationResult> = invokeAsync(
+          true,
+          false,
+          false,
+          ['daemon', 'stop'],
+          {},
+          (stderr: string) => {
+            if (stderr.includes('stop waits up to')) onStopWaits();
+          }
+        );
+        if (helperState === 'running') {
+          // Stop waits while the helper runs, and reports the reservation once the helper exits without a daemon.
+          await Promise.race([stopWaits, stopping]);
+          helper.stdin!.end();
+          await helperClosed;
+        }
+        const stopped: IInvocationResult = await stopping;
+        expect(stopped.code).toBe(0);
+        expect(stopped.stderr).toEqual(
+          helperState === 'exited'
+            ? ''
+            : expect.stringMatching(
+                new RegExp(
+                  `^rush-client: The daemon is not ready yet\\. Its startup helper \\(PID ${helperPid}\\) is still waiting for the daemon, so stop waits up to \\d+ s for it to become ready and then stops it\\.\\n$`
+                )
+              )
+        );
+        expect(JSON.parse(stopped.stdout)).toEqual({
+          state: 'notRunning',
+          socketPath: paths.socketPath,
+          startupReservation: { path: reservation, helperPid, helperState: 'exited', relaunchAfter }
+        });
+        const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+        expect(reset).toMatchObject({ code: 0, stderr: '' });
+        expect(JSON.parse(reset.stdout)).toEqual({
+          state: 'reset',
+          socketPath: paths.socketPath,
+          removedPaths: [reservation]
+        });
+      } finally {
+        if (!helper.stdin!.writableEnded) helper.stdin!.end();
+        await helperClosed;
+      }
+    },
+    30000
+  );
+
+  it('stop waits for a daemon that is still starting and then stops it', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+    // This process stands in for the startup helper: it starts the daemon below while stop waits.
+    fs.writeFileSync(
+      reservation,
+      JSON.stringify({ token: 'fixture', helperPid: process.pid, helperStartedAt: new Date().toISOString() })
+    );
+    try {
+      let onStopWaits: () => void = () => undefined;
+      const stopWaits: Promise<void> = new Promise((resolve) => (onStopWaits = resolve));
+      const stopping: Promise<IInvocationResult> = invokeAsync(
+        true,
+        false,
+        false,
+        ['daemon', 'stop'],
+        {},
+        (stderr: string) => {
+          if (stderr.includes('stop waits up to')) onStopWaits();
+        }
+      );
+      await Promise.race([stopWaits, stopping]);
+      const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+      host = await RushDaemonHost.startAsync({
+        repoRoot: folder,
+        rushVersion: Rush.version,
+        daemonVersion: daemonPackage.version
+      });
+      const stopped: IInvocationResult = await stopping;
+      expect(stopped.code).toBe(0);
+      expect(stopped.stderr).toMatch(
+        new RegExp(
+          `^rush-client: The daemon is not ready yet\\. Its startup helper \\(PID ${process.pid}\\) is still waiting for the daemon, so stop waits up to \\d+ s for it to become ready and then stops it\\.\\n$`
+        )
+      );
+      // Stop resolved the reservation next to the ready daemon before it shut that daemon down.
+      expect(JSON.parse(stopped.stdout)).toEqual({
+        state: 'shutdownAccepted',
+        socketPath: paths.socketPath,
+        cancelledRequests: 0
+      });
+      expect(fs.existsSync(reservation)).toBe(false);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    }
+  }, 30000);
+
+  it('status names a recorded daemon that exited without shutting down', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+    const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+    await once(exited, 'close');
+    const record: IDaemonLockfile = {
+      pid: exited.pid!,
+      protocolVersion: { major: 0, minor: 11 },
+      startedAt: new Date().toISOString(),
+      socketPath: paths.socketPath
+    };
+    try {
+      fs.writeFileSync(paths.lockfilePath, JSON.stringify(record));
+      const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(status).toMatchObject({ code: 1, stdout: '' });
+      expect(status.stderr).toContain(
+        `Could not connect to daemon at ${paths.socketPath}. rushd (PID ${record.pid}) exited without shutting down; "rush-client daemon logs" may show why.`
+      );
+      // A record for another endpoint says nothing about the daemon at this one.
+      fs.writeFileSync(
+        paths.lockfilePath,
+        JSON.stringify({ ...record, socketPath: `${paths.socketPath}.x` })
+      );
+      const other: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(other).toMatchObject({ code: 1, stdout: '' });
+      expect(other.stderr).toContain('Could not connect to daemon');
+      expect(other.stderr).not.toContain('exited without shutting down');
+    } finally {
+      fs.rmSync(paths.lockfilePath, { force: true });
+    }
+  });
+
+  it('status still names a daemon that exited without shutting down after a client reclaimed it', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+    async function reclaimExitedDaemonAsync(): Promise<string> {
+      const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+      await once(exited, 'close');
+      const record: IDaemonLockfile = {
+        pid: exited.pid!,
+        protocolVersion: { major: 0, minor: 11 },
+        startedAt: new Date().toISOString(),
+        socketPath: paths.socketPath
+      };
+      fs.writeFileSync(paths.lockfilePath, JSON.stringify(record));
+      // As the client whose command the daemon ran does, or Rush in-process; this removes the record.
+      await reclaimCrashedDaemonAsync(paths);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+      return ` The last daemon, rushd (PID ${record.pid}), exited without shutting down; "rush-client daemon logs" may show why.`;
+    }
+    const exitedWithoutShutdown: string = await reclaimExitedDaemonAsync();
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+      NEXT_COMMAND_STARTS + exitedWithoutShutdown
+    );
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status']),
+      AUTO_START_OFF + exitedWithoutShutdown
+    );
+    expectNoDaemonRunning(
+      await invokeAsync(true, false, false, ['daemon', 'status']),
+      NOT_ENABLED + exitedWithoutShutdown
+    );
+    // A reset clears the report, as it removed the record before a client reclaimed the daemon.
+    const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+    expect(reset).toMatchObject({ code: 0, stderr: '' });
+    expect(JSON.parse(reset.stdout)).toMatchObject({ state: 'notRunning', removedPaths: [] });
+    expectNoDaemonRunning(await invokeAsync(true, false, false, ['daemon', 'status']), NOT_ENABLED);
+    // So does a daemon that becomes ready, even when it is then stopped in order.
+    const exitedAgain: string = await reclaimExitedDaemonAsync();
+    expectNoDaemonRunning(
+      await invokeAsync(true, false, false, ['daemon', 'status']),
+      NOT_ENABLED + exitedAgain
+    );
+    const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+    expect(started.code).toBe(0);
+    const { pid }: { pid: number } = JSON.parse(started.stdout);
+    expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+    await waitForTestProcessExitAsync(pid);
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+      NEXT_COMMAND_STARTS
+    );
+  }, 30000);
+
   (process.platform === 'win32' ? it.skip : it)(
     'stop --force removes stale artifacts left by a killed daemon',
     async () => {
@@ -507,6 +1030,20 @@ describe('daemon client cancellation exit codes', () => {
     result: { requestId: 'r', outcome: 'aborted', exitCode: 1, aborted: true }
   };
 
+  // After cancellation, the client reports any of these as the cancellation instead of an error.
+  it('recognizes the ways a connection to the daemon fails', () => {
+    const reset: Error = Object.assign(new Error('read ECONNRESET'), { code: 'ECONNRESET' });
+    const brokenPipe: Error = Object.assign(new Error('write EPIPE'), { code: 'EPIPE' });
+    expect(isConnectionFailure(reset)).toBe(true);
+    expect(isConnectionFailure(brokenPipe)).toBe(true);
+    expect(
+      isConnectionFailure(new DaemonTransportError(DaemonTransportErrorCode.transportClosed, 'closed'))
+    ).toBe(true);
+    expect(isConnectionFailure(new DaemonClientError('disconnected', 'Daemon disconnected.'))).toBe(true);
+    expect(isConnectionFailure(new Error('other'))).toBe(false);
+    expect(isConnectionFailure(Object.assign(new Error('no such file'), { code: 'ENOENT' }))).toBe(false);
+  });
+
   it('maps cancellation signals to 128 + signal number', () => {
     expect(getSignalExitCode('SIGINT')).toBe(130);
     expect(getSignalExitCode('SIGTERM')).toBe(143);
@@ -529,6 +1066,22 @@ describe('daemon client cancellation exit codes', () => {
     expect(isCancelledOutcome(cancelledWithFailure, true)).toBe(true);
   });
 
+  it('does not report a request that a daemon shutdown aborted as cancelled, unless the client was signalled', () => {
+    const shutDown: DaemonClientOutcome = {
+      kind: 'result',
+      result: {
+        requestId: 'r',
+        outcome: 'failure',
+        exitCode: 1,
+        aborted: true,
+        errorMessage:
+          'The Rush daemon was shut down (idle timeout) while this request was running; re-run the command.'
+      }
+    };
+    expect(isCancelledOutcome(shutDown, false)).toBe(false);
+    expect(isCancelledOutcome(shutDown, true)).toBe(true);
+  });
+
   it('keeps completed results and rejections when a signal arrives late', () => {
     const succeeded: DaemonClientOutcome = {
       kind: 'result',
@@ -538,9 +1091,29 @@ describe('daemon client cancellation exit codes', () => {
       kind: 'rejected',
       rejection: { requestId: 'r', code: 'unsupportedProtocolVersion', message: 'no' }
     } as unknown as DaemonClientOutcome;
+    const invalid: DaemonClientOutcome = {
+      kind: 'rejected',
+      rejection: { requestId: 'r', code: 'invalidRequest', message: 'Unknown operation id.' }
+    };
     expect(isCancelledOutcome(succeeded, true)).toBe(false);
     expect(isCancelledOutcome(rejected, true)).toBe(false);
+    expect(isCancelledOutcome(invalid, true)).toBe(false);
     expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, true)).toBe(true);
     expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, false)).toBe(false);
   });
+
+  it('treats a request that a signal cancelled before engine initialization as cancelled', () => {
+    // The daemon rejects a request that was cancelled while it prepared the workspace graph.
+    const cancelledBeforeEngine: DaemonClientOutcome = {
+      kind: 'rejected',
+      rejection: {
+        requestId: 'r',
+        code: 'routingFailed',
+        message: 'The request was cancelled before engine initialization.'
+      }
+    };
+    expect(isCancelledOutcome(cancelledBeforeEngine, true)).toBe(true);
+    // Without a signal, the daemon failed to route the request for its own reason, such as a shutdown.
+    expect(isCancelledOutcome(cancelledBeforeEngine, false)).toBe(false);
+  });
 });
diff --git a/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts b/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
new file mode 100644
index 00000000000..188d3b7cc00
--- /dev/null
+++ b/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
@@ -0,0 +1,171 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import type { ClientName } from '../ClientAdmissionControls';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+const RESTART_WAIT_TIMEOUT: string =
+  'The rushx script was not admitted before the daemon could restart because ' +
+  'common/config/rush/pnpm-lock.yaml changed. Stop the script, or use --wait-timeout <seconds> to wait longer.';
+const USAGE_MESSAGE: string = 'rush build: error: Unrecognized arguments: --nope.';
+const USAGE: string = 'usage: rush build [-h] [-p COUNT] [--timeline]\n                  [-t PROJECT]\n';
+const USAGE_RESULT: Omit<IDaemonCommandResult, 'requestId'> = {
+  exitCode: 2,
+  outcome: 'failure',
+  aborted: false,
+  errorMessage: USAGE_MESSAGE,
+  usage: USAGE
+};
+
+describe('the stderr line of a failed daemon result', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let writes: [stream: 'stdout' | 'stderr', text: string][];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-result-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    writes = [];
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    for (const stream of ['stdout', 'stderr'] as const) {
+      jest.spyOn(process[stream], 'write').mockImplementation(((
+        chunk: string | Uint8Array,
+        ...rest: unknown[]
+      ): boolean => {
+        writes.push([stream, Buffer.from(chunk).toString()]);
+        (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+        return true;
+      }) as typeof process.stderr.write);
+    }
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: process.pid })
+    } as unknown as DaemonClient);
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  describe.each<[ClientName, boolean, string[]]>([
+    ['rush-client', false, ['build', '--to', 'project']],
+    ['rushx-client', true, ['serve']]
+  ])('of %s', (clientName: ClientName, rushx: boolean, argv: string[]) => {
+    it.each<[string, Omit<IDaemonCommandResult, 'requestId'>, string]>([
+      [
+        "the daemon's error",
+        {
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          errorMessage: 'The daemon shut down before the request ran.'
+        },
+        `${clientName}: The daemon shut down before the request ran.\n`
+      ],
+      [
+        "the daemon's reason for an admission failure",
+        {
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage: RESTART_WAIT_TIMEOUT
+        },
+        `${clientName}: daemon admission failed (wait-timeout): ${RESTART_WAIT_TIMEOUT}\n`
+      ]
+    ])('names the client before %s', async (name, result, line) => {
+      process.argv = [process.execPath, clientName, ...argv];
+      jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => ({
+        kind: 'result',
+        result: { requestId: options.request.requestId, ...result }
+      }));
+      await launchClientAsync(rushx);
+      expect(jest.mocked(executeWithDaemonRestartAsync).mock.calls[0][2].request.invocationKind).toBe(
+        rushx ? 'rushx' : 'rush'
+      );
+      expect(writes.filter(([stream]) => stream === 'stderr').map(([, text]) => text)).toEqual([line]);
+      expect(process.exitCode).toBe(1);
+    });
+  });
+
+  describe('of an invalid command line', () => {
+    beforeEach(() => {
+      process.argv = [process.execPath, 'rush-client', 'build', '--nope'];
+      jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => ({
+        kind: 'result',
+        result: { requestId: options.request.requestId, ...USAGE_RESULT }
+      }));
+    });
+
+    it('follows the usage of the command on stdout, as native Rush does', async () => {
+      await launchClientAsync(false);
+      expect(writes).toEqual([
+        ['stdout', USAGE],
+        ['stderr', `rush-client: ${USAGE_MESSAGE}\n`]
+      ]);
+      expect(process.exitCode).toBe(2);
+    });
+
+    it('is left to the summary line of agent output, which omits the usage', async () => {
+      const agentOutput: string[] = [];
+      const agentRenderer: AgentProgressRenderer = new AgentProgressRenderer({
+        commandName: 'build',
+        isTTY: false,
+        columns: 120,
+        write: (text: string) => agentOutput.push(text)
+      });
+      await launchClientAsync(false, agentRenderer);
+      expect(writes).toEqual([]);
+      expect(agentOutput.join('')).toContain(USAGE_MESSAGE);
+      expect(agentOutput.join('')).not.toContain('usage:');
+      expect(process.exitCode).toBe(2);
+    });
+  });
+});
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index 2703d68a410..d0d296fcf6b 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -1,14 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { spawn } from 'node:child_process';
+import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { Rush } from '@microsoft/rush-lib';
 import { DaemonClient } from '@rushstack/rush-client-core';
-import { RUSHD_GRAPH_SNAPSHOT } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_PROTOCOL_VERSION, RUSHD_GRAPH_SNAPSHOT } from '@rushstack/rush-daemon-protocol';
+import { writeDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import {
   createNativeBuildTestFixture,
   type INativeBuildTestFixture,
@@ -17,6 +18,90 @@ import {
 
 // A pending CLI startup can take 15s; allow its join plus daemon stop/drain and fixture removal.
 const NATIVE_FIXTURE_CLEANUP_TIMEOUT_MS: number = 35_000;
+// Windows runners take much longer to start the processes of the first build.
+const NATIVE_FIXTURE_INITIAL_BUILD_TIMEOUT_MS: number = process.platform === 'win32' ? 120_000 : 30_000;
+// An operation process that a stand-in daemon starts; it exits by itself after a minute.
+const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+// A stand-in daemon: like a phased operation, its operation process shares the daemon's process group.
+const STAND_IN_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process')" +
+  `.spawn(process.execPath,['-e','${OPERATION_SCRIPT}'],{stdio:'ignore'});` +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+
+/** Records a stand-in daemon as the workspace's daemon, then SIGKILLs only it, so its operation keeps running. */
+async function startCrashedDaemonAsync(
+  paths: IDaemonPaths
+): Promise<{ daemonPid: number; operationPid: number }> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', STAND_IN_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const [chunk] = (await once(daemon.stdout!, 'data')) as [Buffer];
+  daemon.stdout!.destroy();
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: daemon.pid!,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  return { daemonPid: daemon.pid!, operationPid: Number(chunk.toString().trim()) };
+}
+
+/**
+ * Starts a stand-in daemon that exits without releasing its files once it acknowledges a shutdown, and waits until
+ * it listens and its operation runs.
+ */
+async function startShutdownExitDaemonAsync(
+  paths: IDaemonPaths
+): Promise<{ daemon: ChildProcess; operationPid: number }> {
+  const daemon: ChildProcess = spawn(
+    process.execPath,
+    [path.join(__dirname, 'ShutdownExitDaemonTestProcess.js'), JSON.stringify(paths), OPERATION_SCRIPT],
+    { detached: true, stdio: ['ignore', 'pipe', 'inherit'] }
+  );
+  const listening: [Buffer] | undefined = await Promise.race([
+    once(daemon.stdout!, 'data') as Promise<[Buffer]>,
+    once(daemon, 'exit').then(() => undefined)
+  ]);
+  daemon.stdout!.destroy();
+  if (!listening) throw new Error('The stand-in daemon exited before it listened.');
+  return { daemon, operationPid: Number(listening[0].toString().trim()) };
+}
+
+/** False once the operation process has exited, even before it is reaped: a zombie's command line is empty. */
+function isOperationRunning(pid: number): boolean {
+  try {
+    return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').includes(OPERATION_SCRIPT);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Expects one line of `client` on `stream`, and no Node.js process warning, for the stand-in daemon's
+ * operation.
+ */
+function expectOneReclaimLine(
+  result: IResult,
+  daemonPid: number,
+  stream: 'stdout' | 'stderr',
+  client: 'rush-client' | 'rushx-client' = 'rush-client'
+): void {
+  // The stand-in daemon's operation shares its process group, as a phased operation does.
+  const reclaimLine: string =
+    `${client}: Stopped the operations that the exited daemon (PID ${daemonPid}) left running ` +
+    `(process group ${daemonPid}).`;
+  const output: string = `${result.stdout}\n${result.stderr}`;
+  expect(output.split('\n').filter((line) => line.includes('left running'))).toEqual([reclaimLine]);
+  expect(result[stream]).toContain(reclaimLine);
+  expect(output).not.toMatch(/RUSH_DAEMON_ORPHANS_REAPED|--trace-warnings|\(node:\d+\)/);
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 
 describe('native build through the standalone client', () => {
   let fixture: INativeBuildTestFixture | undefined;
@@ -52,7 +137,7 @@ describe('native build through the standalone client', () => {
             await client.closeAsync();
           }
         }),
-      30000
+      NATIVE_FIXTURE_INITIAL_BUILD_TIMEOUT_MS
     );
 
     it(
@@ -322,10 +407,17 @@ describe('native build through the standalone client', () => {
           fs.writeFileSync(path.join(folder, 'a/input.txt'), 'two');
           const changed: IResult = await invokeAsync(argv);
           expect(changed.code).toBe(0);
-          expect(changed.stderr).not.toMatch(/using in-process|restart/i);
+          expect(changed.stderr).not.toMatch(/using in-process/i);
           expect(changed.stdout).toContain('built-a-two');
           const after = JSON.parse((await invokeAsync(['daemon', 'status'])).stdout);
           expect(after.pid).not.toBe(previousPid);
+          // One line names the variable that differed, never its value.
+          expect(changed.stderr).toContain(
+            `rush-client: A command restarted the daemon (PID ${after.pid}) because its environment differs ` +
+              "from the daemon's in RUSHD_TEST_RESTART_VALUE.\n"
+          );
+          expect(changed.stderr.match(/restarted the daemon/g)).toHaveLength(1);
+          expect(changed.stderr).not.toContain('new-process-environment');
           expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\na:two\nb:one\n');
           expect((await invokeAsync(argv)).code).toBe(0);
           expect(JSON.parse((await invokeAsync(['daemon', 'status'])).stdout).pid).toBe(after.pid);
@@ -333,5 +425,233 @@ describe('native build through the standalone client', () => {
         }),
       45000
     );
+
+    it.each(['legacy', 'agent'] as const)(
+      'says why the daemon restarted and runs in-process when the daemon that replaces it does not start (%s output)',
+      (output) =>
+        runWithFixtureAsync(async ({ folder, environment, invokeAsync }) => {
+          // Only the daemon's launch fails; the client and the helper that starts the daemon still run.
+          const refusePath: string = path.join(folder, 'refuse-daemon-launch.cjs');
+          fs.writeFileSync(
+            refusePath,
+            "if (process.argv.some((arg) => arg.endsWith('SelectedDaemonBootstrap.js')) && " +
+              "process.argv.includes('--launch')) process.exit(3);\n"
+          );
+          environment.RUSHD_OUTPUT = output;
+          environment.NODE_OPTIONS = `--require ${JSON.stringify(refusePath)}`;
+          const fallback: IResult = await invokeAsync(argv);
+          delete environment.NODE_OPTIONS;
+          delete environment.RUSHD_OUTPUT;
+          // The restart happens before the build starts, so running it in-process repeats no work.
+          expect(fallback.code).toBe(0);
+          const cause: string =
+            "A command restarted the daemon because its environment differs from the daemon's in NODE_OPTIONS; " +
+            'the restarted daemon did not start: ';
+          // One line gives the cause; the indented lines after it quote the launcher log.
+          expect(fallback.stderr).toMatch(
+            new RegExp(`^rush-client: ${escapeRegExp(cause)}[^\\n]+; using in-process Rush\\.\\n`, 'm')
+          );
+          expect(fallback.stderr).toContain('  Last launcher log lines:\n');
+          expect(fallback.stderr).toContain('Launcher exited (3) before protocol readiness');
+          expect(fallback.stdout).toContain('These operations were already up to date:');
+          expect(`${fallback.stdout}${fallback.stderr}`).not.toContain('restarted the daemon (PID');
+          expect(fallback.stderr).not.toContain('refuse-daemon-launch');
+          expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
+        }),
+      45000
+    );
   });
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a crashed daemon left running before it builds without the daemon',
+    () =>
+      runWithFixtureAsync(async ({ folder, paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          expect(isOperationRunning(operationPid)).toBe(true);
+          const native: IResult = await invokeAsync(['--no-daemon', 'build']);
+          expect(native.code).toBe(0);
+          expectOneReclaimLine(native, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+          expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
+        } finally {
+          // Only the operation process that this test started, not a process that reused its PID.
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip).each([
+    { output: 'legacy', stream: 'stderr' },
+    { output: 'agent', stream: 'stdout' }
+  ] as const)(
+    'stops the operations that a crashed daemon left running before it starts the next daemon ($output output)',
+    ({ output, stream }) =>
+      runWithFixtureAsync(async ({ folder, paths, environment, invokeAsync }) => {
+        environment.RUSHD_OUTPUT = output;
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const served: IResult = await invokeAsync(['build']);
+          expect(served.code).toBe(0);
+          expect(served.stderr).not.toMatch(/using in-process/i);
+          expectOneReclaimLine(served, daemonPid, stream);
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
+          expect(JSON.parse((await invokeAsync(['daemon', 'status'])).stdout).pid).not.toBe(daemonPid);
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'says rushx-client when rushx stops the operations that a crashed daemon left running',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const script: IResult = await invokeAsync(['build'], true);
+          expect(script.code).toBe(0);
+          expect(script.stderr).not.toMatch(/using in-process/i);
+          expect(script.stdout).toContain('rushx-only');
+          expectOneReclaimLine(script, daemonPid, 'stderr', 'rushx-client');
+          expect(isOperationRunning(operationPid)).toBe(false);
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a crashed daemon left running when "daemon start" starts the next daemon',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const started: IResult = await invokeAsync(['daemon', 'start']);
+          expect(started.code).toBe(0);
+          expectOneReclaimLine(started, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a crashed daemon left running when "daemon stop --force" removes its files',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const reset: IResult = await invokeAsync(['daemon', 'stop', '--force']);
+          expect(reset.code).toBe(0);
+          expectOneReclaimLine(reset, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(JSON.parse(reset.stdout)).toEqual({
+            state: 'reset',
+            socketPath: paths.socketPath,
+            removedPaths: [paths.lockfilePath],
+            orphansReaped: [{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]
+          });
+          // Nothing that the record led to is left, so a second reset stops and removes nothing.
+          const again: IResult = await invokeAsync(['daemon', 'stop', '--force']);
+          expect(again).toMatchObject({ code: 0, stderr: '' });
+          expect(JSON.parse(again.stdout)).toEqual({
+            state: 'notRunning',
+            socketPath: paths.socketPath,
+            removedPaths: []
+          });
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a daemon left running when it exits after it acknowledges "daemon stop --force"',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemon, operationPid } = await startShutdownExitDaemonAsync(paths);
+        const daemonPid: number = daemon.pid!;
+        try {
+          const stopped: IResult = await invokeAsync(['daemon', 'stop', '--force']);
+          expect(stopped.code).toBe(0);
+          expectOneReclaimLine(stopped, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(JSON.parse(stopped.stdout)).toEqual({
+            state: 'shutdownAccepted',
+            socketPath: paths.socketPath,
+            removedPaths: [paths.lockfilePath, paths.socketPath],
+            orphansReaped: [{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]
+          });
+        } finally {
+          // Node signals the stand-in only until it is reaped, so never a process that reused its PID.
+          daemon.kill('SIGKILL');
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  it(
+    'cancels a build whose output reader exits, as `head` does, and exits with 141',
+    () =>
+      runWithFixtureAsync(async ({ folder, environment, trackWatch }) => {
+        // An operation that writes a line every 20 ms for 20 s.
+        fs.writeFileSync(
+          path.join(folder, 'a/build.cjs'),
+          "let n=0;const t=setInterval(()=>{console.log('tick-'+ ++n);if(n===1000)clearInterval(t);},20);"
+        );
+        const client = spawn(
+          process.execPath,
+          [path.resolve(__dirname, '../../bin/rush-client'), 'build', '--to', 'a', '--verbose'],
+          { cwd: folder, env: environment, stdio: ['ignore', 'pipe', 'pipe'] }
+        );
+        const closed = once(client, 'close');
+        trackWatch(client, closed);
+        let errors: string = '';
+        client.stderr!.on('data', (bytes: Buffer) => {
+          errors += bytes.toString();
+        });
+        let output: string = '';
+        // Stops reading once the operation's output arrives, as `head -5` does.
+        const read = new Promise<void>((resolve) => {
+          client.stdout!.on('data', (bytes: Buffer) => {
+            output += bytes.toString();
+            if (output.includes('tick-')) {
+              client.stdout!.destroy();
+              resolve();
+            }
+          });
+        });
+        try {
+          await Promise.race([
+            read,
+            closed.then(() => {
+              throw new Error(`The build ended before its output arrived: ${errors}`);
+            })
+          ]);
+          expect(await closed).toEqual([141, null]);
+          // A socket (here) may report ECONNRESET where a shell's pipe reports EPIPE.
+          expect(
+            errors.split('\n').filter((line) => /cancel|connection|EPIPE|ECONNRESET/i.test(line))
+          ).toEqual([
+            expect.stringMatching(
+              /^rush-client: build cancelled, because the process reading its stdout exited \((EPIPE|ECONNRESET)\)\.$/
+            )
+          ]);
+        } finally {
+          if (client.exitCode === null && client.signalCode === null) client.kill('SIGTERM');
+          await closed;
+        }
+      }),
+    30000
+  );
 });
diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
new file mode 100644
index 00000000000..843d65651ce
--- /dev/null
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -0,0 +1,294 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRestartReason, IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+
+import {
+  RESTART_WAIT_REPEAT_MS,
+  RESUBMITTED_PHASE,
+  createDaemonRequestNoticeHandlers,
+  type IDaemonRequestNoticeTarget
+} from '../daemonRestartNotice';
+import {
+  NATIVE_LOCK_WAIT_REPEAT_MS,
+  formatNativeLockWait,
+  withNativeLockWaitNotices,
+  type INativeLockWaitNoticeHandlers
+} from '../nativeLockWaitNotice';
+
+const INSTALL: IDaemonNativeLockHolder = { pid: 41, command: 'rush install' };
+const UPDATE: IDaemonNativeLockHolder = { pid: 52, command: 'rush update' };
+const LOCKFILE: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const INSTALL_LOCK: string = "another Rush process (PID 41: rush install) to release this repository's lock";
+const UPDATE_LOCK: string = "another Rush process (PID 52: rush update) to release this repository's lock";
+const LOCKFILE_RESTART_42: string =
+  'note: rush-client: A command restarted the daemon (PID 42) because common/config/rush/pnpm-lock.yaml changed.';
+const LOCKFILE_RESTART_43: string =
+  'note: rush-client: A command restarted the daemon (PID 43) because common/config/rush/pnpm-lock.yaml changed.';
+
+describe(formatNativeLockWait.name, () => {
+  it('names the process that holds the lock as far as it is known, and from a second on, the time waited', () => {
+    expect(formatNativeLockWait(INSTALL)).toBe(`waiting for ${INSTALL_LOCK}`);
+    expect(formatNativeLockWait({ pid: 41 }, 999)).toBe(
+      "waiting for another Rush process (PID 41) to release this repository's lock"
+    );
+    expect(formatNativeLockWait({}, 10_400)).toBe(
+      "still waiting after 10s for another Rush process to release this repository's lock"
+    );
+  });
+});
+
+describe(withNativeLockWaitNotices.name, () => {
+  let clock: number;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    clock = 0;
+  });
+  afterEach(() => jest.useRealTimers());
+
+  function advance(ms: number): void {
+    clock += ms;
+    jest.advanceTimersByTime(ms);
+  }
+
+  function createHandlers(options: { agent: boolean; stderrIsTTY: boolean; rushx?: boolean }): {
+    calls: string[];
+    handlers: INativeLockWaitNoticeHandlers;
+  } {
+    const calls: string[] = [];
+    const target: IDaemonRequestNoticeTarget = {
+      rushx: !!options.rushx,
+      stderrIsTTY: options.stderrIsTTY,
+      daemonPid: 7,
+      now: () => clock,
+      agentRenderer: options.agent
+        ? {
+            note: (line: string) => calls.push(`note: ${line}`),
+            onResubmitted: (phase: string) => calls.push(`resubmitted: ${phase}`),
+            onQueuePosition: (position: number) => calls.push(`position: ${position}`),
+            // A renderer may say whether it wrote the wait as a line.
+            onRestartWait: (wait: string, announce: boolean) => {
+              calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`);
+              return announce;
+            }
+          }
+        : undefined,
+      writeStderrAsync: async (text: string) => {
+        calls.push(`stderr: ${text}`);
+      }
+    };
+    return { calls, handlers: withNativeLockWaitNotices(createDaemonRequestNoticeHandlers(target), target) };
+  }
+
+  describe.each([
+    ['rush-client', false],
+    ['rushx-client', true]
+  ])('%s without an agent renderer', (client: string, rushx: boolean) => {
+    it('writes the wait line at once, on a pipe and a terminal', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+        handlers.dispose();
+        expect(calls).toEqual([`stderr: ${client}: waiting for ${INSTALL_LOCK}.\n`]);
+      }
+    });
+
+    it('repeats the line with the time waited every 10 s, and at once when another process holds the lock', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+      advance(4000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS - 4001);
+      expect(calls).toHaveLength(1);
+      advance(1);
+      advance(2000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS);
+      handlers.dispose();
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS * 3);
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 10s for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 12s for ${UPDATE_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 22s for ${UPDATE_LOCK}.\n`
+      ]);
+      expect(calls.join('')).not.toContain('admission failed');
+    });
+
+    it('keeps naming the command of a process whose command can no longer be read, as once it exits', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+      advance(1000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { pid: INSTALL.pid });
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS - 1000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { pid: UPDATE.pid });
+      handlers.dispose();
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 10s for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 10s for another Rush process (PID 52) to release this repository's lock.\n`
+      ]);
+    });
+  });
+
+  it.each([
+    ['output or an event', (handlers: INativeLockWaitNoticeHandlers) => handlers.onRequestProgress(), []],
+    ['input', (handlers: INativeLockWaitNoticeHandlers) => handlers.onInputAdmittedAsync(), []],
+    [
+      'a queue position',
+      (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(2),
+      ['stderr: rush-client: waiting for daemon admission (position 2).\n']
+    ],
+    [
+      'a queue position behind operations that an earlier failed command left running',
+      (handlers: INativeLockWaitNoticeHandlers) =>
+        handlers.onQueuePositionAsync(1, undefined, {}, undefined, {
+          count: 2,
+          names: ['a (build)', 'b (build)']
+        }),
+      [
+        'stderr: rush-client: waiting for daemon admission (position 1) behind 2 operations left running by an ' +
+          'earlier failed command: a (build), b (build).\n'
+      ]
+    ],
+    [
+      'a restart',
+      (handlers: INativeLockWaitNoticeHandlers) =>
+        handlers.onRestartAsync({
+          restart: 1,
+          reason: { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+          successorPid: 42
+        }),
+      [
+        "stderr: rush-client: A command restarted the daemon (PID 42) because the daemon's installation at /snapshots/s9 was removed.\n"
+      ]
+    ],
+    [
+      'a wait for a restart',
+      (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(1, LOCKFILE, {}),
+      [
+        'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
+          'common/config/rush/pnpm-lock.yaml changed.\n'
+      ]
+    ],
+    [
+      'a wait for a restart that also names a process that holds the lock',
+      (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(1, LOCKFILE, {}, INSTALL),
+      [
+        'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
+          'common/config/rush/pnpm-lock.yaml changed.\n'
+      ]
+    ]
+  ])('stops when the request gets %s, whose own notice it gives', async (name, endAsync, notices) => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await endAsync(handlers);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS * 2);
+    expect(calls).toEqual([`stderr: rush-client: waiting for ${INSTALL_LOCK}.\n`, ...notices]);
+    handlers.dispose();
+  });
+
+  it('ends a wait for a daemon restart when the request waits for the lock instead', async () => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS);
+    // The restart wait line would have been repeated by now.
+    advance(RESTART_WAIT_REPEAT_MS - 2 * NATIVE_LOCK_WAIT_REPEAT_MS);
+    handlers.dispose();
+    expect(calls).toEqual([
+      'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
+        'common/config/rush/pnpm-lock.yaml changed.\n',
+      `stderr: rush-client: waiting for ${INSTALL_LOCK}.\n`,
+      `stderr: rush-client: still waiting after 10s for ${INSTALL_LOCK}.\n`,
+      `stderr: rush-client: still waiting after 20s for ${INSTALL_LOCK}.\n`
+    ]);
+  });
+
+  it('writes nothing more once the request ends or the client asks rushd to cancel it', async () => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    handlers.dispose();
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS * 3);
+    expect(calls).toEqual([`stderr: rush-client: waiting for ${INSTALL_LOCK}.\n`]);
+  });
+
+  it('shows the wait as the agent phase, announcing each process that holds the lock, and writes no line', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS * 3);
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    handlers.onRequestProgress();
+    handlers.dispose();
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    expect(calls).toEqual([`announce: waiting for ${INSTALL_LOCK}`, `announce: waiting for ${UPDATE_LOCK}`]);
+  });
+
+  it('gives the agent the resubmitted phase when the request follows a restart after it waited for the lock', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    // The install changed the lockfile, so the daemon restarts at once, without a restart wait.
+    await handlers.onRestartAsync({ restart: 1, reason: LOCKFILE, successorPid: 42 });
+    // The request showed no wait at the new daemon, so its phase stays.
+    await handlers.onRestartAsync({ restart: 2, reason: LOCKFILE, successorPid: 43 });
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    handlers.dispose();
+    expect(calls).toEqual([
+      `announce: waiting for ${INSTALL_LOCK}`,
+      LOCKFILE_RESTART_42,
+      `resubmitted: ${RESUBMITTED_PHASE}`,
+      LOCKFILE_RESTART_43,
+      `announce: waiting for ${UPDATE_LOCK}`
+    ]);
+  });
+
+  it('gives the agent the resubmitted phase after a restart when the daemon reported the same process again', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    // Neither is announced again, so the phase still names the process.
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: INSTALL.pid });
+    await handlers.onRestartAsync({ restart: 1, reason: LOCKFILE, successorPid: 42 });
+    handlers.dispose();
+    expect(calls).toEqual([
+      `announce: waiting for ${INSTALL_LOCK}`,
+      LOCKFILE_RESTART_42,
+      `resubmitted: ${RESUBMITTED_PHASE}`
+    ]);
+  });
+
+  it('gives the agent the resubmitted phase after a restart when output came after the lock wait', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    // A log line leaves the agent's phase, which still names the process.
+    handlers.onRequestProgress();
+    await handlers.onRestartAsync({ restart: 1, reason: LOCKFILE, successorPid: 42 });
+    handlers.dispose();
+    expect(calls).toEqual([
+      `announce: waiting for ${INSTALL_LOCK}`,
+      LOCKFILE_RESTART_42,
+      `resubmitted: ${RESUBMITTED_PHASE}`
+    ]);
+  });
+
+  it('announces a process once when its command can no longer be read, and names a command read later', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: INSTALL.pid });
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: UPDATE.pid });
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    handlers.dispose();
+    expect(calls).toEqual([
+      `announce: waiting for ${INSTALL_LOCK}`,
+      "announce: waiting for another Rush process (PID 52) to release this repository's lock",
+      `announce: waiting for ${UPDATE_LOCK}`
+    ]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/nativeMutation.test.ts b/apps/rush-cli-client/src/test/nativeMutation.test.ts
index 44158a49ca6..e7db5408894 100644
--- a/apps/rush-cli-client/src/test/nativeMutation.test.ts
+++ b/apps/rush-cli-client/src/test/nativeMutation.test.ts
@@ -11,6 +11,8 @@ import { Rush } from '@microsoft/rush-lib';
 import { SuccessfulMutationFixture } from '@rushstack/rush-daemon/lib/test/SuccessfulMutationFixture';
 import { computeDaemonWorkspaceKey, resolveDaemonPaths } from '@rushstack/rush-daemon-transport';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 interface IClientResult {
   readonly exitCode: number | undefined;
   readonly stdout: string;
@@ -23,7 +25,7 @@ async function invokeAsync(
 ): Promise<IClientResult> {
   const child = spawn(process.execPath, [path.resolve(__dirname, '../../bin/rush-client'), ...argv], {
     cwd: fixture.repoRoot,
-    env: { ...fixture.environment, RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' },
+    env: { ...getTestProcessEnvironment(fixture.environment), RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' },
     stdio: ['ignore', 'pipe', 'pipe']
   });
   let stdout: string = '';
diff --git a/apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts b/apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts
new file mode 100644
index 00000000000..1072007d871
--- /dev/null
+++ b/apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts
@@ -0,0 +1,104 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { GraphRequestContext } from '../GraphRequestContext';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+describe('omitWarmSetStatus', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  const client: DaemonClient = {
+    closeAsync: async () => undefined,
+    status: Promise.resolve({ pid: process.pid })
+  } as unknown as DaemonClient;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-warm-set-status-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue(client);
+    jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (daemon, connection, options) => ({
+      kind: 'result',
+      result: { requestId: options.request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+    }));
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('is set by a command, both when it connects and when it reconnects to a restarted daemon', async () => {
+    await launchClientAsync(false);
+    expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledTimes(1);
+    expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledWith(
+      expect.objectContaining({ omitWarmSetStatus: true })
+    );
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledWith(
+      client,
+      expect.objectContaining({ omitWarmSetStatus: true }),
+      expect.anything()
+    );
+  });
+
+  it('is set by a graph request', async () => {
+    const connect = jest.spyOn(DaemonClient, 'connectAsync').mockResolvedValue(client);
+    const context: GraphRequestContext = new GraphRequestContext({});
+    try {
+      expect(await context.connectAsync({ socketPath: 'socket' })).toBe(client);
+    } finally {
+      context[Symbol.dispose]();
+    }
+    expect(connect).toHaveBeenCalledWith(
+      expect.objectContaining({ socketPath: 'socket', omitWarmSetStatus: true })
+    );
+  });
+});
diff --git a/apps/rush-cli-client/src/test/outputSelection.test.ts b/apps/rush-cli-client/src/test/outputSelection.test.ts
index 23f11f467dd..e2b4a7a0bb8 100644
--- a/apps/rush-cli-client/src/test/outputSelection.test.ts
+++ b/apps/rush-cli-client/src/test/outputSelection.test.ts
@@ -50,8 +50,15 @@ describe(getAgentCommandName.name, () => {
     { argv: ['--wait-timeout=2', 'build', '-t', 'a'], commandName: 'build' },
     { argv: ['--no-wait', 'rebuild'], commandName: 'rebuild' },
     { argv: ['--', 'build'], commandName: undefined },
-    { argv: ['-q', 'build'], commandName: undefined },
+    { argv: ['-q', 'build'], commandName: 'build' },
+    { argv: ['--quiet', '--no-wait', '-q', 'build'], commandName: 'build' },
+    { argv: ['-q'], commandName: undefined },
+    { argv: ['-q', '--debug', 'build'], commandName: undefined },
+    { argv: ['-d', 'build'], commandName: undefined },
     { argv: ['daemon', 'status'], commandName: undefined },
+    { argv: ['-q', 'daemon', 'status'], commandName: undefined },
+    { argv: ['check'], commandName: undefined },
+    { argv: ['update-autoinstaller', '--name', 'x'], commandName: undefined },
     { argv: ['build', '--help'], commandName: undefined },
     { argv: ['build', '-h'], commandName: undefined },
     { argv: ['build', '--', '--help'], commandName: 'build' },
diff --git a/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts b/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
index 883d2f83ab5..1ba423e27e5 100644
--- a/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
+++ b/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
@@ -57,7 +57,13 @@ describe('public-client cancellation of an admitted Node operation', () => {
         else client.kill('SIGINT');
         // Cancellation terminates the client like a native signal (128 + SIGINT).
         expect(await closed).toEqual([130, null]);
-        expect(stderr).toContain('rush-client: build cancelled.');
+        // The client says at once that it waits for rushd, which then confirms the stop in time.
+        const cancelling: number = stderr.indexOf(
+          'rush-client: cancelling build; waiting up to 5 s for rushd'
+        );
+        expect(cancelling).toBeGreaterThanOrEqual(0);
+        expect(stderr.indexOf('rush-client: build cancelled.')).toBeGreaterThan(cancelling);
+        expect(stderr).not.toContain('did not confirm');
         expect(stderr).not.toMatch(/using in-process|not retried|timed out/i);
         expect(fixture.events().filter((event) => event.kind === 'ready')).toHaveLength(1);
         expect(fixture.events().filter((event) => event.kind === 'complete')).toHaveLength(2);
diff --git a/apps/rush-cli-client/src/test/pipedInput.test.ts b/apps/rush-cli-client/src/test/pipedInput.test.ts
index 0de06c1cc3f..bab1c6a7064 100644
--- a/apps/rush-cli-client/src/test/pipedInput.test.ts
+++ b/apps/rush-cli-client/src/test/pipedInput.test.ts
@@ -16,6 +16,8 @@ import {
   type IDaemonRequestResolver
 } from '@rushstack/rush-daemon';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 const SCRIPT: string =
   "const chunks=[];process.stdin.on('data',c=>{chunks.push(c);process.stdin.pause();" +
   'setTimeout(()=>process.stdin.resume(),1);});' +
@@ -42,6 +44,7 @@ describe('standalone client piped input', () => {
       path.join(folder, 'rush.json'),
       JSON.stringify({
         rushVersion: Rush.version,
+        suppressNodeLtsWarning: true,
         pnpmVersion: '10.27.0',
         daemon: { enabled: false, autoStart: false },
         projects: [{ packageName: 'sample', projectFolder: 'project' }],
@@ -86,7 +89,7 @@ describe('standalone client piped input', () => {
     const child = spawn(process.execPath, [entry, 'sample', ...admissionArgs], {
       cwd: project,
       env: {
-        ...process.env,
+        ...getTestProcessEnvironment(),
         RUSH_DAEMON: '1',
         RUSH_REPORTER: 'legacy',
         RUSH_QUIET_MODE: '1',
diff --git a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
index 46c0ad58147..5cc87473c0d 100644
--- a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
+++ b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { getResultDiagnostic } from '../resultDiagnostics';
+import { getResultDiagnostic, getResultStderr } from '../resultDiagnostics';
 
 describe(getResultDiagnostic.name, () => {
   it('prints the error message of a failed result', () => {
@@ -34,3 +34,56 @@ describe(getResultDiagnostic.name, () => {
     expect(getResultDiagnostic({ exitCode: 1 })).toBeUndefined();
   });
 });
+
+describe(getResultStderr.name, () => {
+  it("explains an admission failure with the daemon's reason", () => {
+    const reason: string =
+      "The rushx script was not admitted before the daemon could restart for another request's environment. " +
+      'Use --wait-timeout <seconds> to wait longer.';
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: reason },
+        { waitTimeoutMs: 5000 }
+      )
+    ).toBe(`rush-client: daemon admission failed (wait-timeout): ${reason}\n`);
+  });
+
+  it('falls back to the generic admission explanation without a reason', () => {
+    expect(
+      getResultStderr({ exitCode: 1, admissionErrorCode: 'wait-timeout' }, { waitTimeoutMs: 5000 })
+    ).toContain('timed out after its 5s wait timeout waiting for another daemon request');
+  });
+
+  it('keeps the diagnostic of other failures and stays silent on success', () => {
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'aborted', errorMessage: 'daemon shut down' },
+        undefined
+      )
+    ).toBe('rush-client: daemon shut down\n');
+    expect(getResultStderr({ exitCode: 0 }, undefined)).toBeUndefined();
+  });
+
+  it('begins with rushx-client for a rushx script', () => {
+    const reason: string =
+      'The rushx script was not admitted before the daemon could restart for another request, because ' +
+      'common/config/rush/pnpm-lock.yaml changed. Use --wait-timeout <seconds> to wait longer.';
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: reason },
+        { waitTimeoutMs: 5000 },
+        'rushx-client'
+      )
+    ).toBe(`rushx-client: daemon admission failed (wait-timeout): ${reason}\n`);
+    expect(
+      getResultStderr({ exitCode: 1, admissionErrorCode: 'no-wait' }, { noWait: true }, 'rushx-client')
+    ).toMatch(/^rushx-client: daemon admission failed \(no-wait\): another daemon request/);
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'aborted', errorMessage: 'daemon shut down' },
+        undefined,
+        'rushx-client'
+      )
+    ).toBe('rushx-client: daemon shut down\n');
+  });
+});
diff --git a/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts b/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
new file mode 100644
index 00000000000..3cb0891805e
--- /dev/null
+++ b/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+describe('returnEarlyOnFailure', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let requests: IDaemonRequestEnvelope[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-early-failure-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    requests = [];
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: process.pid })
+    } as unknown as DaemonClient);
+    jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => {
+      requests.push(options.request);
+      return {
+        kind: 'result',
+        result: { requestId: options.request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+      };
+    });
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('is requested by agent output, which reports the failure and leaves the independent work to rushd', async () => {
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: () => undefined
+    });
+    await launchClientAsync(false, renderer);
+    expect(requests).toHaveLength(1);
+    expect(requests[0].returnEarlyOnFailure).toBe(true);
+  });
+
+  it('is not requested by the default output, whose collated logs cover the whole request', async () => {
+    await launchClientAsync(false);
+    expect(requests).toHaveLength(1);
+    expect(requests[0]).not.toHaveProperty('returnEarlyOnFailure');
+  });
+});
diff --git a/apps/rush-cli-client/src/test/routing.test.ts b/apps/rush-cli-client/src/test/routing.test.ts
index 0bac92c254b..b5cb889c69d 100644
--- a/apps/rush-cli-client/src/test/routing.test.ts
+++ b/apps/rush-cli-client/src/test/routing.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { selectClientRoute } from '../routing';
+import { selectClientRoute, type IClientRoute, type IClientRouteOptions } from '../routing';
 
 describe('opt-in routing', () => {
   it.each([
@@ -56,7 +56,12 @@ describe('opt-in routing', () => {
         environment: {},
         rushx: true
       })
-    ).toEqual({ argv: ['install', '--', '--no-daemon'], commandName: 'install', daemon: true });
+    ).toEqual({
+      argv: ['install', '--', '--no-daemon'],
+      nativeArgv: ['install', '--', '--no-daemon'],
+      commandName: 'install',
+      daemon: true
+    });
   });
 
   it('uses native Rushx option boundaries instead of treating script flags as Rush options', () => {
@@ -107,3 +112,162 @@ describe('opt-in routing', () => {
     ).toBe(true);
   });
 });
+
+describe('global flags before the command', () => {
+  it.each([
+    { argv: ['-q', 'build', '--to', 'a'], daemonArgv: ['build', '--to', 'a'] },
+    { argv: ['--quiet', 'build'], daemonArgv: ['build'] },
+    { argv: ['--quiet', '-q', 'rebuild', '-q'], daemonArgv: ['rebuild', '-q'] },
+    { argv: ['--no-wait', '-q', 'build'], daemonArgv: ['build'] }
+  ])('leaves the leading quiet flags of $argv out of the daemon request only', ({ argv, daemonArgv }) => {
+    expect(selectClientRoute({ argv, enabled: true, environment: {}, rushx: false })).toEqual({
+      argv: daemonArgv,
+      nativeArgv: argv.filter((arg) => arg !== '--no-wait'),
+      commandName: daemonArgv[0],
+      daemon: true,
+      admission: argv.includes('--no-wait') ? { noWait: true } : undefined
+    });
+  });
+
+  it('keeps every flag for in-process Rush', () => {
+    expect(
+      selectClientRoute({
+        argv: ['-q', '--no-daemon', 'build', '--', '--no-daemon'],
+        enabled: true,
+        environment: {},
+        rushx: false
+      })
+    ).toEqual({
+      argv: ['build', '--', '--no-daemon'],
+      nativeArgv: ['-q', 'build', '--', '--no-daemon'],
+      commandName: 'build',
+      daemon: false,
+      admission: undefined
+    });
+    expect(
+      selectClientRoute({ argv: ['-q', '--debug', 'build'], enabled: true, environment: {}, rushx: false })
+    ).toMatchObject({ argv: ['--debug', 'build'], nativeArgv: ['-q', '--debug', 'build'], daemon: false });
+  });
+
+  it('does not strip Rushx flags, which native Rushx parses', () => {
+    expect(
+      selectClientRoute({ argv: ['-q', 'build'], enabled: true, environment: {}, rushx: true })
+    ).toMatchObject({
+      argv: ['-q', 'build'],
+      nativeArgv: ['-q', 'build'],
+      commandName: 'build',
+      daemon: true
+    });
+  });
+
+  it('routes a quiet daemon command to the client daemon commands', () => {
+    expect(
+      selectClientRoute({ argv: ['-q', 'daemon', 'status'], enabled: true, environment: {}, rushx: false })
+    ).toMatchObject({ argv: ['daemon', 'status'], commandName: 'daemon', daemon: false });
+  });
+});
+
+describe('in-process reasons', () => {
+  it.each([
+    {
+      argv: ['build'],
+      environment: { RUSH_LOG_LEVEL: 'debug' },
+      reason: 'RUSH_LOG_LEVEL selects the native reporter'
+    },
+    {
+      argv: ['build'],
+      environment: { RUSH_REPORTER: ' json ' },
+      reason: 'RUSH_REPORTER=json selects the native reporter'
+    },
+    { argv: ['build', '--reporter=ai'], reason: '--reporter selects the native reporter' },
+    { argv: ['build', '--output', 'x.log'], reason: '--output selects the native reporter' },
+    { argv: ['build', '--log-level=debug'], reason: '--log-level selects the native reporter' },
+    {
+      argv: ['build'],
+      useRushReporter: true,
+      reason: 'useRushReporter in experiments.json selects the native reporter'
+    },
+    { argv: ['--debug', 'build'], reason: 'the daemon does not support "--debug"' },
+    { argv: ['-q', '-d', 'build'], reason: 'the daemon does not support "-d"' },
+    { argv: ['check'], reason: 'the daemon does not run "check"' },
+    {
+      argv: ['-q', 'update-autoinstaller', '--name', 'x'],
+      reason: 'the daemon does not run "update-autoinstaller"'
+    },
+    {
+      argv: ['build'],
+      enabled: false,
+      environment: { RUSH_DAEMON: '0' },
+      reason: 'RUSH_DAEMON=0 turns the daemon off'
+    },
+    { argv: ['build'], enabled: false, reason: 'the daemon is not enabled for this repo' },
+    {
+      argv: ['build'],
+      environment: { CI: 'true' },
+      reason: 'CI is set, so the daemon is off unless RUSH_DAEMON=1'
+    },
+    {
+      argv: ['build'],
+      environment: { CI: '0', TF_BUILD: 'True' },
+      reason: 'TF_BUILD is set, so the daemon is off unless RUSH_DAEMON=1'
+    },
+    // The first reason that applies is given.
+    {
+      argv: ['--debug', 'check', '--reporter=json'],
+      enabled: false,
+      environment: { CI: '1' },
+      reason: '--reporter selects the native reporter'
+    },
+    { argv: ['--debug', 'check'], enabled: false, reason: 'the daemon does not support "--debug"' },
+    { argv: ['check'], enabled: false, environment: { CI: '1' }, reason: 'the daemon does not run "check"' },
+    {
+      argv: ['build'],
+      enabled: false,
+      environment: { CI: '1' },
+      reason: 'the daemon is not enabled for this repo'
+    }
+  ])('says "$reason" for $argv', ({ reason, enabled = true, environment = {}, ...options }) => {
+    expect(selectClientRoute({ ...options, enabled, environment, rushx: false })).toMatchObject({
+      daemon: false,
+      inProcessReason: reason
+    });
+  });
+
+  it.each([
+    { argv: ['build', '--no-daemon'] },
+    { argv: ['build', '--help'] },
+    { argv: ['-h'] },
+    { argv: ['help', 'build'] },
+    { argv: ['-q'] },
+    { argv: [] }
+  ])('gives no reason when $argv asks for in-process Rush or has no command', ({ argv }) => {
+    const route: IClientRoute = selectClientRoute({
+      argv,
+      enabled: false,
+      environment: { CI: '1' },
+      rushx: false
+    });
+    expect(route.daemon).toBe(false);
+    expect(route).not.toHaveProperty('inProcessReason');
+  });
+
+  it('gives no reason for a daemon request', () => {
+    expect(
+      selectClientRoute({ argv: ['build'], enabled: true, environment: {}, rushx: false })
+    ).not.toHaveProperty('inProcessReason');
+  });
+
+  it('gives the Rushx reasons', () => {
+    const route = (options: Partial<IClientRouteOptions>): IClientRoute =>
+      selectClientRoute({ argv: ['build'], enabled: true, environment: {}, rushx: true, ...options });
+    expect(route({ hasTerminal: true }).inProcessReason).toBe(
+      'the daemon does not run scripts in a terminal'
+    );
+    expect(route({ environment: { RUSH_REPORTER: 'json' } }).inProcessReason).toBe(
+      'RUSH_REPORTER=json selects the native reporter'
+    );
+    expect(route({ argv: ['build', '--reporter=json'] })).not.toHaveProperty('inProcessReason');
+    expect(route({ argv: ['check'] })).not.toHaveProperty('inProcessReason');
+    expect(route({ enabled: false }).inProcessReason).toBe('the daemon is not enabled for this repo');
+  });
+});
diff --git a/apps/rush-cli-client/src/test/rushxFallbackLines.test.ts b/apps/rush-cli-client/src/test/rushxFallbackLines.test.ts
new file mode 100644
index 00000000000..f3bd4e5da12
--- /dev/null
+++ b/apps/rush-cli-client/src/test/rushxFallbackLines.test.ts
@@ -0,0 +1,137 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+
+// Rushx keeps a script that has a terminal in-process, so these tests hide the test runner's terminal.
+function hideTerminal(): () => void {
+  const streams: object[] = [process.stdin, process.stdout, process.stderr];
+  const descriptors: (PropertyDescriptor | undefined)[] = streams.map((stream) =>
+    Object.getOwnPropertyDescriptor(stream, 'isTTY')
+  );
+  for (const stream of streams) {
+    Object.defineProperty(stream, 'isTTY', { value: undefined, configurable: true, writable: true });
+  }
+  return () => {
+    streams.forEach((stream, index) => {
+      const descriptor: PropertyDescriptor | undefined = descriptors[index];
+      if (descriptor) Object.defineProperty(stream, 'isTTY', descriptor);
+      else delete (stream as { isTTY?: boolean }).isTTY;
+    });
+  };
+}
+
+describe('rushx-client names itself in the lines about a daemon it did not use', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let restoreTerminal: () => void;
+  let output: jest.SpyInstance;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushx-client-fallback-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    output = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    restoreTerminal = hideTerminal();
+    process.argv = [process.execPath, 'rushx-client', 'sample'];
+    process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1' };
+    for (const name of ['RUSH_LOG_LEVEL', 'RUSH_REPORTER', 'RUSH_PREVIEW_VERSION']) delete process.env[name];
+  });
+
+  afterEach(() => {
+    restoreTerminal();
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  function expectInProcessRushx(): void {
+    expect(process.argv[1]).toBe(
+      path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rushx')
+    );
+    expect(process.argv.slice(2)).toEqual(['sample']);
+  }
+
+  it('when it cannot reach the daemon', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonClientError('startupFailed', 'No ready daemon; auto-start is disabled.'));
+    await launchClientAsync(true);
+    expectInProcessRushx();
+    expect(output.mock.calls).toEqual([
+      ['rushx-client: No ready daemon; auto-start is disabled; using in-process Rush.\n']
+    ]);
+  });
+
+  it('when the daemon sends the request back', async () => {
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      status: Promise.resolve({ pid: 42 }),
+      closeAsync: async () => undefined
+    } as unknown as DaemonClient);
+    jest.mocked(executeWithDaemonRestartAsync).mockResolvedValue({
+      kind: 'fallback',
+      reason: 'unsupported',
+      message: 'The daemon does not support explicit Rushx invocations; no request was sent.'
+    });
+    await launchClientAsync(true);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expectInProcessRushx();
+    expect(output.mock.calls).toEqual([
+      [
+        'rushx-client: The daemon does not support explicit Rushx invocations; no request was sent; ' +
+          'using in-process Rush.\n'
+      ]
+    ]);
+  });
+
+  it('when it waits for a daemon that is still starting', async () => {
+    const pending: DaemonStartupPendingError = new DaemonStartupPendingError('Still starting.');
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockImplementation(async (options) => {
+      options.onAwaitStartup?.('Its startup helper (PID 42) is still waiting for the daemon', 15000);
+      throw pending;
+    });
+    await expect(launchClientAsync(true)).rejects.toBe(pending);
+    expect(output.mock.calls).toEqual([
+      [
+        'rushx-client: The daemon is not ready yet. Its startup helper (PID 42) is still waiting for the ' +
+          'daemon, so this command waits up to 15 s more for it instead of running Rush in-process.\n'
+      ]
+    ]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/sentBackFallback.test.ts b/apps/rush-cli-client/src/test/sentBackFallback.test.ts
new file mode 100644
index 00000000000..bf34baed680
--- /dev/null
+++ b/apps/rush-cli-client/src/test/sentBackFallback.test.ts
@@ -0,0 +1,73 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+
+it('keeps the detail lines of a multi-line reason when the daemon sends a request back', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-sent-back-'));
+  const originalArgv: string[] = process.argv;
+  const originalEnvironment: NodeJS.ProcessEnv = process.env;
+  fs.writeFileSync(
+    path.join(folder, 'rush.json'),
+    JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+  );
+  jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+    paths: {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    }
+  });
+  jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+    status: Promise.resolve({ pid: 42 }),
+    closeAsync: async () => undefined
+  } as unknown as DaemonClient);
+  // The daemon puts the error first and the lines that explain it after it.
+  jest.mocked(executeWithDaemonRestartAsync).mockResolvedValue({
+    kind: 'fallback',
+    reason: 'unsupported',
+    message: 'Error reading "/repo/common/config/rush/command-line.json":\n  Unexpected token } at 3:1\n'
+  });
+  const output: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+  jest.spyOn(process, 'cwd').mockReturnValue(folder);
+  process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+  process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
+  for (const name of ['RUSH_LOG_LEVEL', 'RUSH_PREVIEW_VERSION']) delete process.env[name];
+  try {
+    await launchClientAsync(false);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(output.mock.calls).toEqual([
+      [
+        'rush-client: Error reading "/repo/common/config/rush/command-line.json"; using in-process Rush.\n' +
+          '    Unexpected token } at 3:1\n'
+      ]
+    ]);
+    expect(process.argv[1]).toBe(
+      path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rush')
+    );
+    expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
+  } finally {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true });
+  }
+});
diff --git a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
new file mode 100644
index 00000000000..f88d8f3bb96
--- /dev/null
+++ b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
@@ -0,0 +1,177 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  connectToStartingDaemonAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync,
+  connectToStartingDaemonAsync,
+  getDaemonLogFilePath
+} from '@rushstack/rush-client-core';
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+
+describe('a daemon startup failure', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let output: jest.SpyInstance;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-startup-pending-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    output = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
+    delete process.env.RUSH_PREVIEW_VERSION;
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(connectToStartingDaemonAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('fails the command instead of running Rush in-process while daemon startup is pending', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonStartupPendingError('Another client is still starting the daemon.'));
+    await expect(launchClientAsync(false)).rejects.toThrow('Another client is still starting the daemon.');
+    expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledTimes(1);
+    expect(process.argv).toEqual([process.execPath, 'rush-client', 'build', '--to', 'project']);
+    expect(output).not.toHaveBeenCalledWith(expect.stringContaining('using in-process Rush'));
+  });
+
+  it('says why it keeps waiting for a daemon that is still starting', async () => {
+    const pending: DaemonStartupPendingError = new DaemonStartupPendingError('Still starting.');
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockImplementation(async (options) => {
+      options.onAwaitStartup?.('Its startup helper (PID 42) is still waiting for the daemon', 15000);
+      throw pending;
+    });
+    await expect(launchClientAsync(false)).rejects.toBe(pending);
+    expect(output).toHaveBeenCalledWith(
+      'rush-client: The daemon is not ready yet. Its startup helper (PID 42) is still waiting for the daemon, ' +
+        'so this command waits up to 15 s more for it instead of running Rush in-process.\n'
+    );
+
+    // Agent output shows it as the phase of its progress line instead, and names the live process there.
+    output.mockClear();
+    const write: jest.Mock = jest.fn();
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write
+    });
+    await expect(launchClientAsync(false, renderer)).rejects.toBe(pending);
+    expect(write).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'rushd is still starting; waiting for it (up to 15s more) because its startup helper (PID 42) is ' +
+          'still waiting for the daemon'
+      )
+    );
+    expect(output).not.toHaveBeenCalledWith(expect.stringContaining('The daemon is not ready yet'));
+  });
+
+  it('still runs Rush in-process after a startup failure that no live process owns', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonClientError('startupFailed', 'No ready daemon; auto-start is disabled.'));
+    await launchClientAsync(false);
+    expect(process.argv[1]).toBe(
+      path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rush')
+    );
+    expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
+    expect(output).toHaveBeenCalledWith(
+      'rush-client: No ready daemon; auto-start is disabled; using in-process Rush.\n'
+    );
+  });
+
+  it('fails daemon stop without stopping a daemon that is still starting, and says to run stop again', async () => {
+    process.argv = [process.execPath, 'rush-client', 'daemon', 'stop'];
+    const pending: string = `The daemon at ${path.join(folder, 'd.sock')} is still starting after 15 s. Another client is still starting the daemon.`;
+    jest.mocked(connectToStartingDaemonAsync).mockImplementation(async (options) => {
+      options.onAwaitStartup?.('Another client is still starting the daemon', 15000);
+      throw new DaemonStartupPendingError(pending);
+    });
+    const error: Error = await launchClientAsync(false).then(
+      () => new Error('Expected daemon stop to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toBe(
+      `${pending} It was not stopped; run "rush-client daemon stop" again once "rush-client daemon status" reports it ready.`
+    );
+    expect(connectToStartingDaemonAsync).toHaveBeenCalledTimes(1);
+    expect(output.mock.calls).toEqual([
+      [
+        'rush-client: The daemon is not ready yet. Another client is still starting the daemon, ' +
+          'so stop waits up to 15 s for it to become ready and then stops it.\n'
+      ]
+    ]);
+    expect(connectOrAwaitDaemonStartupAsync).not.toHaveBeenCalled();
+  });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'runs Rush in-process when auto-start cannot open the launcher log, and says why',
+    async () => {
+      jest
+        .mocked(connectOrAwaitDaemonStartupAsync)
+        .mockImplementation(
+          jest.requireActual('@rushstack/rush-client-core').connectOrAwaitDaemonStartupAsync
+        );
+      const paths: IDaemonPaths = {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      };
+      jest.mocked(connectionOptions.getDaemonConnectionOptionsAsync).mockResolvedValue({
+        paths,
+        startCommand: { command: process.execPath, args: ['-e', ''], cwd: folder, environment: {} }
+      });
+      const logFilePath: string = getDaemonLogFilePath(paths);
+      fs.symlinkSync(`${logFilePath}.target`, logFilePath);
+      await launchClientAsync(false);
+      expect(process.argv[1]).toBe(
+        path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rush')
+      );
+      expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
+      // The reason and the path; the tests above pin the rest of the fallback line.
+      expect(output).toHaveBeenCalledWith(
+        expect.stringContaining(
+          `rush-client: Launcher log cannot be opened for writing (ELOOP): ${logFilePath}`
+        )
+      );
+      expect(fs.existsSync(`${logFilePath}.target`)).toBe(false);
+    }
+  );
+});
diff --git a/apps/rush-cli-client/src/test/terminalColumns.test.ts b/apps/rush-cli-client/src/test/terminalColumns.test.ts
new file mode 100644
index 00000000000..ea2fc00e57f
--- /dev/null
+++ b/apps/rush-cli-client/src/test/terminalColumns.test.ts
@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getTerminalColumns } from '../terminalColumns';
+
+describe(getTerminalColumns.name, () => {
+  it('keeps a real terminal width', () => {
+    expect(getTerminalColumns({ columns: 123 })).toBe(123);
+  });
+
+  it.each([0, -1, 1.5, Number.NaN])('treats %p columns as unknown', (columns) => {
+    expect(getTerminalColumns({ columns })).toBeUndefined();
+  });
+
+  it('treats a stream without a width as unknown', () => {
+    expect(getTerminalColumns({})).toBeUndefined();
+  });
+});
diff --git a/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts b/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts
index 66f53b90ac2..b99fed66791 100644
--- a/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts
+++ b/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts
@@ -46,7 +46,10 @@ it('uses the native version selector when no compatible foreign daemon launcher
     expect(Object.isFrozen(selection.mock.calls[0][2])).toBe(true);
     expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
     expect(process.env.RUSH_DAEMON).toBeUndefined();
-    expect(output).toHaveBeenCalledWith(expect.stringContaining('Using in-process Rush'));
+    expect(output).toHaveBeenCalledWith(
+      'rush-client: Cannot launch selected Rush 5.178.1: No compatible request-launch APIs. ' +
+        'Use native Rush instead; using in-process Rush.\n'
+    );
   } finally {
     process.argv = originalArgv;
     process.env = originalEnvironment;
diff --git a/common/changes/@microsoft/rush/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@microsoft/rush/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..b247f796b8c
--- /dev/null
+++ b/common/changes/@microsoft/rush/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add Rush daemon support to rush-lib: engines that serve several phased commands and daemon-compatible plugins, per-request hooks and telemetry (`afterExecuteRequestAsync`, `beforeLogRequest`), and experimental `daemon.*` settings. Never cache or skip an operation whose inputs changed during its run. Fix EPIPE crashes and lost output when piped, watch mode missing edits, and custom parameter values that reached the shell unquoted. Allow `disableBuildCache` and Azure `storageEndpoint` in their schemas, keep Azure credentials per endpoint, and limit the bridge cache plugin to selected operations.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/credential-cache/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/credential-cache/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..b32c59f925b
--- /dev/null
+++ b/common/changes/@rushstack/credential-cache/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/credential-cache",
+      "comment": "Report only the line and column of a JSON error in the credentials file, never its content, and compile the file's schema once per process.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/credential-cache",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/heft-lint-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/heft-lint-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..84eeadf7523
--- /dev/null
+++ b/common/changes/@rushstack/heft-lint-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-lint-plugin",
+      "comment": "Add a `lintInWatchMode` option that lints changed files and files with earlier failures on each watch run. Fix the ESLint cache treating a file with a suppressed message as passing when it also had unsuppressed warnings or errors.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/heft-lint-plugin",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/heft-rspack-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/heft-rspack-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..d1574cca9d1
--- /dev/null
+++ b/common/changes/@rushstack/heft-rspack-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-rspack-plugin",
+      "comment": "In watch mode, wait up to 1 second for the file watcher to record pending changes before resuming, so Rspack no longer misses files that an upstream task just wrote or starts an extra compilation.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-rspack-plugin",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/heft-typescript-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/heft-typescript-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..8a734c7af1c
--- /dev/null
+++ b/common/changes/@rushstack/heft-typescript-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-typescript-plugin",
+      "comment": "Fix two watch-mode issues: ENOENT errors after a dependency's `package.json` is rewritten with `onlyResolveSymlinksInNodeModules`, and a returning source file staying \"not found\" (TS6053) with the `useFsEventsOnParentDirectory` watcher.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-typescript-plugin",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/heft-webpack4-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/heft-webpack4-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..e616d2ab2d4
--- /dev/null
+++ b/common/changes/@rushstack/heft-webpack4-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-webpack4-plugin",
+      "comment": "In watch mode, wait up to 1 second for the file watcher to record pending changes before resuming, so Webpack no longer misses files that an upstream task just wrote or starts an extra compilation.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-webpack4-plugin",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/heft-webpack5-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/heft-webpack5-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..e250f2b0fb7
--- /dev/null
+++ b/common/changes/@rushstack/heft-webpack5-plugin/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-webpack5-plugin",
+      "comment": "Add a `deleteStaleAssetsInWatchMode` option that deletes outputs that earlier watch compilations emitted and the current one does not. In watch mode, wait up to 1 second for the file watcher to record pending changes before resuming, so Webpack no longer misses files that an upstream task just wrote.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/heft-webpack5-plugin",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/heft/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/heft/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..7d99ab8824b
--- /dev/null
+++ b/common/changes/@rushstack/heft/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft",
+      "comment": "Fix watch-mode issues: watchers leaked on every run, edits in a recreated folder were reported a run late, and changes made just before or during the start of a run caused an extra or late run. Exit with a nonzero code after an error even if in-process code sets `process.exitCode` to 0.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/node-core-library/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/node-core-library/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..fbebff96845
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "Fix `LockFile` on Linux and macOS granting one lock to two processes whose lockfiles share a birthtime, or deleting a live holder's lockfile when the processes use different time zones or locales. On Linux, check lock holders through /proc instead of running `ps`, which makes contended locks much faster.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/operation-graph/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/operation-graph/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..891db25f36c
--- /dev/null
+++ b/common/changes/@rushstack/operation-graph/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/operation-graph",
+      "comment": "On Linux, report the resident memory of `WatchLoop` from `VmRSS` in `/proc/self/status`, which stays accurate on machines with many CPUs.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/operation-graph",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/package-deps-hash/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/package-deps-hash/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..21ec8090d1e
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Add a (beta) `RepoStateCache` class that keeps Git repository state between calls in long-lived processes. Fix `getDetailedRepoStateAsync` for paths that `git hash-object` can't read, such as sparse-checkout, assume-unchanged or skip-worktree files and dangling symbolic links, and for an unhandled rejection when `git hash-object` fails early. Errors now name the Git command that failed.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rig-package/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/rig-package/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..108bd27a98e
--- /dev/null
+++ b/common/changes/@rushstack/rig-package/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rig-package",
+      "comment": "Fix the error for a `rigPackageName` without the `-rig` suffix, which quoted the `rigProfile` value instead of the package name.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rig-package",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/rush-cli-client/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..71cdea2cbc0
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Keep agent output short on pipes: progress at least every 25 seconds, failed operations with an excerpt and log path, and an early return from failed builds. Explain each wait, daemon restart and in-process fallback in one line. Make `daemon status`, `stop` and `stop --force` handle starting, crashed and stopped daemons, and handle Ctrl+C, closed output pipes and zero-size terminals.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/rush-client-core/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..c1d57e1d099
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Make daemon startup, restart and crash recovery reliable: concurrent clients share one startup and connect as soon as it is ready, requests follow daemon restarts, and a liveness ping detects an unresponsive daemon. A crashed daemon's stale files are removed, and on Linux the operations it left running are stopped. Errors say why no daemon answered. After a daemon fails to start, clients wait 15 seconds before launching it again. Add APIs for restart reasons, queue details and crash reclaim.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/rush-daemon-protocol/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..55de6a14a6f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add optional fields for restart reasons, queue status, keepalive pings, early return on failure and operation logs, and advertise protocol minors 12 to 14 (shared runtime folder, keepalive and request started). Older peers ignore the new fields.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/rush-daemon-transport/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..cf95f7e90fa
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Meet in `/tmp/rushd-<uid>` (or `$RUSHD_RUNTIME_DIR/rushd-<uid>`) whatever `TMPDIR` or `XDG_RUNTIME_DIR` says, reject unsafe runtime folders and socket paths that are too long, and on Linux stop a dead daemon's orphaned operation process groups only when they provably belong to it. Fix frame sends that could hang after a half-close, and close errors that kept a stopped daemon alive. Add `checkSocket()`, `releaseForExit()` and `sendFrameWrittenAsync()`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/rush-daemon/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..176406ecaa2
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Make warm builds correct and faster: re-run or restore operations whose outputs changed, give each request its own environment, results, hooks and telemetry (tagged by `RUSHD_TELEMETRY_TAG`), and let failed builds return early. Name the cause of every queue wait and restart, start rushx scripts without waiting behind builds, never hang on shutdown, check outputs on worker threads, free idle memory, and hide the console windows of tools on Windows.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/ts-command-line/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json b/common/changes/@rushstack/ts-command-line/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
new file mode 100644
index 00000000000..ce4236f77c6
--- /dev/null
+++ b/common/changes/@rushstack/ts-command-line/thelarkinn-dogfood-rush-daemon_2026-09-30-12-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/ts-command-line",
+      "comment": "Fix an action parameter being unusable, even by its long name, when the tool or a parent action defines the same short name; now only the short name is ambiguous.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/ts-command-line",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/config/rush/deploy-rush-daemon-dogfood.json b/common/config/rush/deploy-rush-daemon-dogfood.json
new file mode 100644
index 00000000000..e30a102fe05
--- /dev/null
+++ b/common/config/rush/deploy-rush-daemon-dogfood.json
@@ -0,0 +1,48 @@
+/**
+ * This configuration file defines a deployment scenario for use with the "rush deploy" command.
+ * For full documentation, please see https://rushjs.io
+ *
+ * The "rush-daemon-dogfood" scenario extracts a stable, self-contained copy of the source-built
+ * "rush-client" and "rushx-client" binaries, including the daemon and the Rush engine they bundle.
+ * Contributors use it to try the opt-in Rush daemon on this repository before a release contains it:
+ * a daemon started from the copy keeps working while the workspace rebuilds its own Rush projects.
+ * See docs/rush/dogfooding-rush-daemon.md.
+ */
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/deploy-scenario.schema.json",
+
+  "deploymentProjectNames": ["@rushstack/rush-cli-client"],
+
+  /**
+   * A published @microsoft/rush-lib depends on its built-in build cache plugins. The source-built copy lists them
+   * in "publishOnlyDependencies" instead, and loads them from next to the rush-lib link of the host script that
+   * loaded it: @microsoft/rush (the in-process fallback), rush-client (when it loads rush-lib before handing off
+   * to @microsoft/rush) and rush-daemon. Each of these hosts declares the plugins as devDependencies.
+   */
+  "projectSettings": [
+    {
+      "projectName": "@microsoft/rush",
+      "additionalDependenciesToInclude": [
+        "@rushstack/rush-amazon-s3-build-cache-plugin",
+        "@rushstack/rush-azure-storage-build-cache-plugin",
+        "@rushstack/rush-http-build-cache-plugin"
+      ]
+    },
+    {
+      "projectName": "@rushstack/rush-cli-client",
+      "additionalDependenciesToInclude": [
+        "@rushstack/rush-amazon-s3-build-cache-plugin",
+        "@rushstack/rush-azure-storage-build-cache-plugin",
+        "@rushstack/rush-http-build-cache-plugin"
+      ]
+    },
+    {
+      "projectName": "@rushstack/rush-daemon",
+      "additionalDependenciesToInclude": [
+        "@rushstack/rush-amazon-s3-build-cache-plugin",
+        "@rushstack/rush-azure-storage-build-cache-plugin",
+        "@rushstack/rush-http-build-cache-plugin"
+      ]
+    }
+  ]
+}
diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml
index 2d4e19dd39e..9254358cf54 100644
--- a/common/config/subspaces/default/pnpm-lock.yaml
+++ b/common/config/subspaces/default/pnpm-lock.yaml
@@ -451,6 +451,15 @@ importers:
       '@rushstack/heft':
         specifier: workspace:*
         version: link:../heft
+      '@rushstack/rush-amazon-s3-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-amazon-s3-build-cache-plugin
+      '@rushstack/rush-azure-storage-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-azure-storage-build-cache-plugin
+      '@rushstack/rush-http-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-http-build-cache-plugin
       eslint:
         specifier: ~9.37.0
         version: 9.37.0
@@ -4197,6 +4206,15 @@ importers:
       '@rushstack/heft':
         specifier: workspace:*
         version: link:../../apps/heft
+      '@rushstack/rush-amazon-s3-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-amazon-s3-build-cache-plugin
+      '@rushstack/rush-azure-storage-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-azure-storage-build-cache-plugin
+      '@rushstack/rush-http-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-http-build-cache-plugin
       eslint:
         specifier: ~9.37.0
         version: 9.37.0
@@ -4817,7 +4835,7 @@ importers:
         version: 1.3.1(@types/node@20.17.19)
       '@rushstack/heft-node-rig':
         specifier: 2.11.51
-        version: 2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)
+        version: 2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)
       '@types/jest':
         specifier: 30.0.0
         version: 30.0.0
@@ -24938,7 +24956,7 @@ snapshots:
     transitivePeerDependencies:
       - '@types/node'
 
-  '@rushstack/heft-jest-plugin@2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)':
+  '@rushstack/heft-jest-plugin@2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)':
     dependencies:
       '@jest/core': 30.3.0(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))
       '@jest/reporters': 30.3.0
@@ -24971,13 +24989,13 @@ snapshots:
     transitivePeerDependencies:
       - '@types/node'
 
-  '@rushstack/heft-node-rig@2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)':
+  '@rushstack/heft-node-rig@2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)':
     dependencies:
       '@microsoft/api-extractor': 7.59.2(@types/node@20.17.19)
       '@rushstack/eslint-config': 4.8.0(eslint@9.37.0)(typescript@5.8.2)
       '@rushstack/heft': 1.3.1(@types/node@20.17.19)
       '@rushstack/heft-api-extractor-plugin': 1.3.28(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)
-      '@rushstack/heft-jest-plugin': 2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)
+      '@rushstack/heft-jest-plugin': 2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)
       '@rushstack/heft-lint-plugin': 1.3.0(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)
       '@rushstack/heft-typescript-plugin': 1.3.23(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)
       '@types/jest': 30.0.0
diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json
index 7b9bfa0d939..c4bdac4d9b3 100644
--- a/common/config/subspaces/default/repo-state.json
+++ b/common/config/subspaces/default/repo-state.json
@@ -1,5 +1,5 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "85270521602b3b33e51d632eb11e4defdabae46d",
+  "pnpmShrinkwrapHash": "0bba018dc100225f133b4d52644f2ce57c457132",
   "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c"
 }
diff --git a/common/reviews/api/heft.api.md b/common/reviews/api/heft.api.md
index 96f4281126f..89c0f114e68 100644
--- a/common/reviews/api/heft.api.md
+++ b/common/reviews/api/heft.api.md
@@ -411,6 +411,17 @@ export interface IWatchFileSystem {
     statSync(filePath: string): fs.Stats;
 }
 
+// @internal
+export interface _IWatchpackPendingEventState {
+    hasPendingEvents: boolean;
+    pendingFileEvents: ReadonlyArray<_IWatchpackPendingFileEvent>;
+}
+
+// @internal
+export interface _IWatchpackPendingFileEvent {
+    filePath: string;
+}
+
 // @internal
 export class _MetricsCollector {
     recordAsync(command: string, performanceData?: Partial<_IPerformanceData>, parameters?: Record<string, string>): Promise<void>;
@@ -428,6 +439,12 @@ export type ReaddirStringCallback = (error: NodeJS.ErrnoException | null, files:
 // @public
 export type StatCallback = (error: NodeJS.ErrnoException | null, stats: fs.Stats) => void;
 
+// @internal
+export function _tryGetWatchpackPendingEventState(watcher: object | undefined): _IWatchpackPendingEventState | undefined;
+
+// @internal
+export function _waitForWatchpackPendingEventsAsync(getWatcher: () => object | undefined, hasChanges: () => boolean): Promise<void>;
+
 // @public
 export type WatchGlobFn = (pattern: string | string[], options?: IGlobOptions | undefined) => Promise<Map<string, IWatchedFileState>>;
 
diff --git a/common/reviews/api/package-deps-hash.api.md b/common/reviews/api/package-deps-hash.api.md
index 1de2d1b706f..67a8ebd6e75 100644
--- a/common/reviews/api/package-deps-hash.api.md
+++ b/common/reviews/api/package-deps-hash.api.md
@@ -48,4 +48,18 @@ export interface IFileDiffStatus {
     status: 'A' | 'D' | 'M';
 }
 
+// @beta
+export interface IRepoStateCacheOptions {
+    gitPath?: string;
+    rootDirectory: string;
+    temporaryFolderPath?: string;
+}
+
+// @beta
+export class RepoStateCache {
+    constructor(options: IRepoStateCacheOptions);
+    dispose(): void;
+    getDetailedRepoStateAsync(additionalRelativePathsToHash?: ReadonlyArray<string>, filterPath?: ReadonlyArray<string>): Promise<IDetailedRepoState>;
+}
+
 ```
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 465a2ce471a..a7b6188dabb 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -4,24 +4,38 @@
 
 ```ts
 
+import { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 import { IDaemonClientCaps } from '@rushstack/rush-daemon-protocol';
 import { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+import { IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
 import { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonLockfile } from '@rushstack/rush-daemon-transport';
+import { IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+import { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
 import { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
 import { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
+import { IDaemonReclaimOptions } from '@rushstack/rush-daemon-transport';
 import { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonRequestRejectedMessage } from '@rushstack/rush-daemon-protocol';
 import { IDaemonShutdownAckMessage } from '@rushstack/rush-daemon-protocol';
 import type { Readable } from 'node:stream';
 
+// @beta
+export function assertDaemonRuntimeFolderIsPrivate(paths: IDaemonPaths): void;
+
 // @beta
 export function captureDaemonRequest(options: ICaptureDaemonRequestOptions): IDaemonRequestEnvelope;
 
+// @beta
+export function connectOrAwaitDaemonStartupAsync(options: IConnectOrAwaitDaemonStartupOptions): Promise<DaemonClient>;
+
 // @beta
 export function connectOrStartDaemonAsync(options: IConnectOrStartDaemonOptions): Promise<DaemonClient>;
 
+// @beta
+export function connectToStartingDaemonAsync(options: IConnectOrAwaitDaemonStartupOptions): Promise<DaemonClient | undefined>;
+
 // @beta
 export class DaemonClient {
     // (undocumented)
@@ -30,6 +44,7 @@ export class DaemonClient {
     static connectAsync(options: IDaemonClientConnectOptions): Promise<DaemonClient>;
     executeAsync(options: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
     get protocolVersion(): IDaemonProtocolVersion;
+    get queuedWithoutStarting(): boolean;
     shutdownAsync(timeoutMs?: number): Promise<IDaemonShutdownAckMessage['payload']>;
     get status(): Promise<IDaemonPongMessage['payload']>;
 }
@@ -58,7 +73,42 @@ export type DaemonClientOutcome = {
 };
 
 // @beta
-export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, execution: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
+export type DaemonOwnerHintPurpose = 'use' | 'stop';
+
+// @beta
+export class DaemonRestartFailedError extends DaemonClientError {
+    constructor(startupError: DaemonClientError, restartReason: DaemonRestartReason);
+    readonly restartReason: DaemonRestartReason;
+}
+
+// @beta
+export type DaemonRestartRequester = 'thisRequest' | 'anotherRequest';
+
+// @beta
+export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
+
+// @beta
+export class DaemonStartupPendingError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+
+// @beta
+export function describeLiveDaemonOwner(paths: IDaemonPaths, purpose: DaemonOwnerHintPurpose): string | undefined;
+
+// @beta
+export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, options: IExecuteWithDaemonRestartOptions): Promise<DaemonClientOutcome>;
+
+// @beta
+export function findNativeLockHolder(lockFolder: string, ownPid?: number): IDaemonNativeLockHolder;
+
+// @beta
+export function findReclaimedDaemonPid(paths: IDaemonPaths): number | undefined;
+
+// @beta
+export function formatDaemonRestartCause(reason: DaemonRestartReason, requester: DaemonRestartRequester): string | undefined;
+
+// @beta
+export function formatNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): string;
 
 // @beta
 export function getDaemonLogFilePath(paths: IDaemonPaths): string;
@@ -71,9 +121,15 @@ export interface ICaptureDaemonRequestOptions extends Omit<IDaemonRequestEnvelop
     readonly requestId?: string;
 }
 
+// @beta
+export interface IConnectOrAwaitDaemonStartupOptions extends IConnectOrStartDaemonOptions {
+    onAwaitStartup?: (owner: string, waitMs: number) => void;
+}
+
 // @beta
 export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectOptions, 'socketPath'> {
     readonly abortSignal?: AbortSignal;
+    readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
     // (undocumented)
     readonly paths: IDaemonPaths;
     readonly previousDaemon?: Pick<IDaemonLockfile, 'pid' | 'startedAt'>;
@@ -83,7 +139,7 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
 }
 
 // @beta
-export interface IDaemonArtifactResetOptions {
+export interface IDaemonArtifactResetOptions extends IDaemonReclaimOptions {
     readonly waitTimeoutMs?: number;
 }
 
@@ -98,6 +154,7 @@ export interface IDaemonClientConnectOptions {
     readonly capabilities?: IDaemonClientCaps;
     // (undocumented)
     readonly expectedDaemonVersion?: string;
+    readonly omitWarmSetStatus?: boolean;
     // (undocumented)
     readonly socketPath: string;
     readonly timeoutMs?: number;
@@ -111,10 +168,14 @@ export interface IDaemonClientExecuteOptions {
     readonly cancelOnCtrlC?: boolean;
     // (undocumented)
     readonly initialRawMode?: boolean;
+    readonly liveness?: IDaemonClientLivenessOptions;
+    readonly onCancelRequested?: (timeoutMs: number) => void;
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
-    // (undocumented)
-    readonly onQueuePositionAsync?: (position: number) => Promise<void>;
+    readonly onInputAdmittedAsync?: () => Promise<void>;
+    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails,
+    nativeLockHolder?: IDaemonNativeLockHolder,
+    continuingOperations?: IDaemonContinuingOperations) => Promise<void>;
     // (undocumented)
     readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
     // (undocumented)
@@ -127,6 +188,34 @@ export interface IDaemonClientExecuteOptions {
     readonly stdin?: Readable;
 }
 
+// @beta
+export interface IDaemonClientLivenessOptions {
+    readonly onResponsive?: (silence: IDaemonSilence) => void;
+    readonly onUnresponsive: (silence: IDaemonSilence) => void;
+    readonly pingAfterMs?: number;
+    readonly unresponsiveAfterMs?: number;
+}
+
+// @beta
+export interface IDaemonRestartNotice {
+    readonly exitedPid?: number;
+    readonly reason: DaemonRestartReason | undefined;
+    readonly restart: number;
+    readonly successorPid: number | undefined;
+}
+
+// @beta
+export interface IDaemonRestartWaitDetails {
+    readonly restartsForAnotherRequest?: boolean;
+    readonly scriptCount?: number;
+}
+
+// @beta
+export interface IDaemonSilence {
+    readonly pid: number | undefined;
+    readonly silentForMs: number;
+}
+
 // @beta
 export interface IDaemonStartCommand {
     // (undocumented)
@@ -139,10 +228,35 @@ export interface IDaemonStartCommand {
     readonly environment: Readonly<Record<string, string>>;
 }
 
+// @beta
+export interface IDaemonStartupReservationInfo {
+    readonly helperPid?: number;
+    readonly helperState: DaemonStartupHelperState;
+    readonly path: string;
+    readonly relaunchAfter?: string;
+}
+
+// @beta
+export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOptions {
+    readonly onRestartAsync?: (notice: IDaemonRestartNotice) => Promise<void>;
+}
+
+// @beta
+export function inspectDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservationInfo | undefined;
+
+// @beta
+export function isDaemonOwnerStoppedAsync(paths: IDaemonPaths, deadline: number): Promise<boolean>;
+
+// @beta
+export function reclaimCrashedDaemonAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void>;
+
 // @beta
 export function requestDaemonShutdownAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<Pick<IDaemonLockfile, 'pid' | 'startedAt'>>;
 
 // @beta
 export function resetDaemonArtifactsAsync(paths: IDaemonPaths, options?: IDaemonArtifactResetOptions): Promise<IDaemonArtifactResetResult>;
 
+// @beta
+export function resolveDaemonStartupReservationAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<boolean>;
+
 ```
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 0584bcb366b..a5b08087829 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -27,6 +27,7 @@ export const DAEMON_CONTROL_MESSAGE_KINDS: readonly [
 'terminalPolicy',
 'queuePosition',
 'requestStart',
+'requestStarted',
 'requestCancel',
 'requestRejected',
 'requestResult',
@@ -67,6 +68,9 @@ export const DAEMON_INTERACTIVE_IO_PROTOCOL_MINOR: number;
 // @beta
 export const DAEMON_INVOCATION_KIND_PROTOCOL_MINOR: number;
 
+// @beta
+export const DAEMON_KEEPALIVE_PROTOCOL_MINOR: number;
+
 // @beta
 export const DAEMON_LIFECYCLE_PROTOCOL_MINOR: number;
 
@@ -79,6 +83,12 @@ export const DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR: number;
 // @beta
 export const DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR: number;
 
+// @beta
+export const DAEMON_REQUEST_STARTED_PROTOCOL_MINOR: number;
+
+// @beta
+export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number;
+
 // @beta
 export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number;
 
@@ -89,7 +99,7 @@ export const DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR: number;
 export type DaemonCommandOutcome = 'success' | 'success-with-warning' | 'failure' | 'aborted';
 
 // @beta
-export type DaemonControlMessage = IDaemonHelloMessage | IDaemonHelloAckMessage | IDaemonSubscribeMessage | IDaemonUnsubscribeMessage | IDaemonPingMessage | IDaemonPongMessage | IDaemonShutdownMessage | IDaemonShutdownAckMessage | IDaemonErrorMessage | IDaemonSetRawModeMessage | IDaemonStdinEndMessage | IDaemonStdinReadyMessage | IDaemonRawModeChangedMessage | IDaemonTerminalPolicyMessage | IDaemonRequestQueuePositionMessage | IDaemonRequestStartMessage | IDaemonRequestCancelMessage | IDaemonRequestRejectedMessage | IDaemonRequestResultMessage;
+export type DaemonControlMessage = IDaemonHelloMessage | IDaemonHelloAckMessage | IDaemonSubscribeMessage | IDaemonUnsubscribeMessage | IDaemonPingMessage | IDaemonPongMessage | IDaemonShutdownMessage | IDaemonShutdownAckMessage | IDaemonErrorMessage | IDaemonSetRawModeMessage | IDaemonStdinEndMessage | IDaemonStdinReadyMessage | IDaemonRawModeChangedMessage | IDaemonTerminalPolicyMessage | IDaemonRequestQueuePositionMessage | IDaemonRequestStartMessage | IDaemonRequestStartedMessage | IDaemonRequestCancelMessage | IDaemonRequestRejectedMessage | IDaemonRequestResultMessage;
 
 // @beta
 export type DaemonControlMessageKind = (typeof DAEMON_CONTROL_MESSAGE_KINDS)[number];
@@ -134,6 +144,9 @@ export type DaemonHandshakeOutcome = {
     readonly error: ProtocolVersionMismatchError;
 };
 
+// @beta
+export type DaemonInstallationChangeKind = 'removed' | 'replaced';
+
 // @beta
 export type DaemonInvocationKind = 'rush' | 'rushx';
 
@@ -163,6 +176,9 @@ export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-time
 // @beta
 export type DaemonRequestRejectionCode = 'invalidRequest' | 'routingFailed' | 'unsupported' | 'workspaceRecreationRequired';
 
+// @beta
+export type DaemonRestartReason = IDaemonInstallationChangedRestartReason | IDaemonEnvironmentChangedRestartReason | IDaemonWorkspaceInputsChangedRestartReason | IDaemonNativeMutationRestartReason;
+
 // @beta
 export type DaemonRushCommandOrigin = 'built-in' | 'custom';
 
@@ -216,6 +232,7 @@ export const FRAME_HEADER_BYTES: number;
 
 // @beta
 export interface IDaemonActivityPayload {
+    readonly severity?: 'warning' | 'error';
     readonly stream?: 'stdout' | 'stderr';
     readonly text: string;
 }
@@ -229,6 +246,7 @@ export interface IDaemonClientCaps {
     readonly supportsInteractiveIO?: boolean;
     readonly supportsRequestAdmission?: boolean;
     readonly supportsRequestLifecycle?: boolean;
+    readonly supportsRequestStarted?: boolean;
     readonly verbosity?: DaemonVerbosity;
 }
 
@@ -240,7 +258,16 @@ export interface IDaemonCommandResult {
     readonly exitCode: number;
     readonly outcome: DaemonCommandOutcome;
     readonly requestId: string;
+    readonly restartReason?: DaemonRestartReason;
     readonly retryAfterRestart?: true;
+    readonly usage?: string;
+}
+
+// @beta
+export interface IDaemonContinuingOperations {
+    readonly count: number;
+    readonly names: ReadonlyArray<string>;
+    readonly stopping?: boolean;
 }
 
 // @beta
@@ -249,6 +276,12 @@ export interface IDaemonDiagnosticPayload {
     readonly severity: DaemonDiagnosticSeverity;
 }
 
+// @beta
+export interface IDaemonEnvironmentChangedRestartReason {
+    readonly kind: 'environmentChanged';
+    readonly variableNames: readonly string[];
+}
+
 // @beta
 export interface IDaemonErrorMessage {
     // (undocumented)
@@ -385,12 +418,35 @@ export interface IDaemonInitializedGraphSnapshot {
     readonly workspaceGeneration?: string;
 }
 
+// @beta
+export interface IDaemonInstallationChange {
+    readonly change: DaemonInstallationChangeKind;
+    readonly folder: string;
+}
+
+// @beta
+export interface IDaemonInstallationChangedRestartReason extends IDaemonInstallationChange {
+    readonly kind: 'installationChanged';
+}
+
 // @beta
 export interface IDaemonLogChunk {
     readonly chunk: Uint8Array;
     readonly operationId: string;
 }
 
+// @beta
+export interface IDaemonNativeLockHolder {
+    readonly command?: string;
+    readonly pid?: number;
+}
+
+// @beta
+export interface IDaemonNativeMutationRestartReason {
+    readonly commandName: string;
+    readonly kind: 'nativeMutation';
+}
+
 // @beta
 export interface IDaemonOperationHeaderPayload {
     readonly completedOperations: number;
@@ -406,6 +462,8 @@ export interface IDaemonOperationRegisteredPayload {
 
 // @beta
 export interface IDaemonOperationStatusChangedPayload {
+    readonly commandKind?: 'initial' | 'incremental';
+    readonly logFilePath?: string;
     readonly operationId: string;
     readonly previousStatus?: string;
     readonly status: string;
@@ -445,6 +503,7 @@ export interface IDaemonPhasedRequest {
     readonly environment: Readonly<Record<string, string>>;
     readonly operationSelection: ReadonlyArray<IDaemonPhasedOperationSelection>;
     readonly requestId: string;
+    readonly returnEarlyOnFailure?: boolean;
     readonly terminalRequirement?: DaemonTerminalRequirement;
 }
 
@@ -460,7 +519,12 @@ export interface IDaemonPingMessage {
     // (undocumented)
     readonly kind: 'ping';
     // (undocumented)
-    readonly payload: DaemonEmptyPayload;
+    readonly payload: IDaemonPingPayload;
+}
+
+// @beta
+export interface IDaemonPingPayload {
+    readonly omitWarmSet?: boolean;
 }
 
 // @beta
@@ -474,6 +538,7 @@ export interface IDaemonPongMessage {
         readonly pid?: number;
         readonly residentMemoryBytes?: number;
         readonly workspace?: IDaemonWorkspaceStatus;
+        readonly installationChange?: IDaemonInstallationChange;
         readonly uptimeMs: number;
     };
 }
@@ -528,6 +593,7 @@ export interface IDaemonRequestEnvelope {
     readonly expectedWorkspaceGeneration?: string;
     readonly invocationKind?: DaemonInvocationKind;
     readonly requestId: string;
+    readonly returnEarlyOnFailure?: boolean;
     readonly terminal: IDaemonRequestTerminal;
 }
 
@@ -539,6 +605,11 @@ export interface IDaemonRequestQueuePositionMessage {
     readonly payload: {
         readonly position: number;
         readonly requestId: string;
+        readonly restartReason?: DaemonRestartReason;
+        readonly scriptCount?: number;
+        readonly restartsForAnotherRequest?: boolean;
+        readonly nativeLockHolder?: IDaemonNativeLockHolder;
+        readonly continuingOperations?: IDaemonContinuingOperations;
     };
 }
 
@@ -562,6 +633,16 @@ export interface IDaemonRequestResultMessage {
     readonly payload: IDaemonCommandResult | IDaemonPhasedRequestResult;
 }
 
+// @beta
+export interface IDaemonRequestStartedMessage {
+    // (undocumented)
+    readonly kind: 'requestStarted';
+    // (undocumented)
+    readonly payload: {
+        readonly requestId: string;
+    };
+}
+
 // @beta
 export interface IDaemonRequestStartMessage {
     // (undocumented)
@@ -728,8 +809,17 @@ export interface IDaemonWarmSetStatus {
     readonly watchedProjectNames: ReadonlyArray<string>;
 }
 
+// @beta
+export interface IDaemonWorkspaceInputsChangedRestartReason {
+    readonly implementationFiles?: ReadonlyArray<string>;
+    readonly installationFiles?: ReadonlyArray<string>;
+    readonly kind: 'workspaceInputsChanged';
+    readonly selectedRushVersion?: string;
+}
+
 // @beta
 export interface IDaemonWorkspaceStatus {
+    readonly continuingOperations?: IDaemonContinuingOperations;
     // (undocumented)
     readonly generation: number;
     readonly generationToken?: string;
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index adb1942b0d1..5d86c4a2506 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -8,32 +8,51 @@ import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 import type * as net from 'node:net';
 
+// @beta
+export function assertDaemonRuntimeDirIsPrivate(paths: IDaemonPaths): void;
+
 // @beta
 export function computeDaemonWorkspaceKey(input: IWorkspaceKeyInput): string;
 
 // @beta
 export function connectDaemonAsync(socketPath: string, options?: IDaemonConnectorOptions): Promise<DaemonFrameConnection>;
 
+// @beta
+export const DAEMON_OPERATION_GROUPS_ENV_VAR: 'RUSHD_OPERATION_GROUPS';
+
+// @beta
+export const DAEMON_RUNTIME_DIR_ENV_VAR: 'RUSHD_RUNTIME_DIR';
+
+// @beta
+export type DaemonFileChange = 'removed' | 'replaced';
+
 // @beta
 export class DaemonFrameConnection {
     constructor(socket: net.Socket);
     // @internal
     abort(error: Error): void;
     closeAsync(): Promise<void>;
+    get closedAfterReadingAll(): boolean;
     onClosed(handler: (error: Error | undefined) => void): void;
     onFrame(handler: (frame: IDaemonFrame) => void | Promise<void>): void;
     sendFrameAsync(frame: IDaemonFrame): Promise<void>;
+    sendFrameWrittenAsync(frame: IDaemonFrame): Promise<void>;
     // @internal
     get socket(): net.Socket;
 }
 
 // @beta
 export class DaemonFrameListener {
+    checkSocket(): DaemonFileChange | undefined;
     closeAsync(): Promise<void>;
     static listenAsync(paths: IDaemonPaths, options: IDaemonListenerOptions): Promise<DaemonFrameListener>;
+    releaseForExit(): boolean;
     stopAcceptingAsync(): Promise<void>;
 }
 
+// @beta
+export type DaemonOperationGroupLeftRunningReason = 'callerGroup' | 'daemonPidInUse' | 'leaderChanged' | 'otherSession' | 'noMarker';
+
 // @beta
 export type DaemonReclaimLockOutcome = {
     readonly acquired: true;
@@ -53,19 +72,24 @@ export enum DaemonTransportErrorCode {
     connectionRefused = "connectionRefused",
     connectionTimeout = "connectionTimeout",
     daemonAlreadyRunning = "daemonAlreadyRunning",
-    transportClosed = "transportClosed"
+    socketPathTooLong = "socketPathTooLong",
+    transportClosed = "transportClosed",
+    unsafeRuntimeDirectory = "unsafeRuntimeDirectory"
 }
 
 // @beta
 export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void;
 
+// @beta
+export function formatOperationGroupLeftRunning(group: IDaemonOperationGroupLeftRunning): string;
+
 // @beta
 export interface IDaemonConnectorOptions {
     readonly connectTimeoutMs?: number;
 }
 
 // @beta
-export interface IDaemonListenerOptions {
+export interface IDaemonListenerOptions extends IDaemonReclaimOptions {
     readonly onConnection: (connection: DaemonFrameConnection) => void;
     readonly protocolVersion: IDaemonProtocolVersion;
     readonly startedAt?: string;
@@ -79,6 +103,20 @@ export interface IDaemonLockfile {
     readonly startedAt: string;
 }
 
+// @beta
+export interface IDaemonOperationGroupLeftRunning {
+    readonly daemonPid: number;
+    readonly processGroupId: number;
+    readonly reason: DaemonOperationGroupLeftRunningReason;
+}
+
+// @beta
+export interface IDaemonOrphanReap {
+    readonly daemonPid: number;
+    readonly outcome: 'terminated' | 'killed';
+    readonly processGroupIds: readonly number[];
+}
+
 // @beta
 export interface IDaemonPathEnvironment {
     readonly env: Readonly<Record<string, string | undefined>>;
@@ -94,6 +132,12 @@ export interface IDaemonPaths {
     readonly socketPath: string;
 }
 
+// @beta
+export interface IDaemonReclaimOptions {
+    readonly onOperationGroupLeftRunning?: (group: IDaemonOperationGroupLeftRunning) => void;
+    readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
+}
+
 // @beta
 export function isDaemonProcessAlive(pid: number): boolean;
 
@@ -108,7 +152,10 @@ export interface IWorkspaceKeyInput {
 export function readDaemonLockfile(lockfilePath: string): IDaemonLockfile | undefined;
 
 // @beta
-export function reclaimStaleDaemonAsync(paths: IDaemonPaths): Promise<void>;
+export function reapReusedOwnerOperationGroupsAsync(paths: IDaemonPaths, ownerPid: number, options?: IDaemonReclaimOptions): Promise<void>;
+
+// @beta
+export function reclaimStaleDaemonAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void>;
 
 // @beta
 export function removeDaemonArtifacts(lockfilePath: string, socketPath: string): void;
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index fd40da63ca4..df7da85d956 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -15,6 +15,7 @@ import type { GetInputsSnapshotAsyncFn } from '@microsoft/rush-lib';
 import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
 import { IDaemonConfigurationJson } from '@microsoft/rush-lib';
 import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonInstallationChange } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import type { IDaemonPhasedRequest } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
@@ -27,14 +28,23 @@ import type { IDaemonTerminalPolicyResult } from '@rushstack/rush-daemon-protoco
 import type { IDaemonWarmSetStatus } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 import type { IInputsSnapshot } from '@microsoft/rush-lib';
+import type { IOperationExecutionResult } from '@microsoft/rush-lib';
 import { IOperationGraph } from '@microsoft/rush-lib';
 import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineTelemetryRecord } from '@microsoft/rush-lib';
 import type { ITerminal } from '@rushstack/terminal';
 import type { LockFile } from '@rushstack/node-core-library';
 import { Operation } from '@microsoft/rush-lib';
 import { RushConfiguration } from '@microsoft/rush-lib';
 import type { RushConfigurationProject } from '@microsoft/rush-lib';
 import type { RushSession } from '@microsoft/rush-lib';
+import type { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+
+// @beta
+export function captureDaemonInstallation(folders: ReadonlyArray<string>): CheckDaemonInstallation;
+
+// @beta
+export type CheckDaemonInstallation = () => IDaemonInstallationChange | undefined;
 
 // @beta
 export type CreateWorkspaceEngineComponentsAsync = (options: ICreateWorkspaceEngineComponentsOptions) => Promise<IWorkspaceEngineComponents>;
@@ -68,17 +78,30 @@ export class DaemonRequiresInProcessError extends Error {
     readonly policy: IDaemonTerminalPolicyResult;
 }
 
+// @beta
+export class DaemonShutdownDeadlineError extends Error {
+    constructor(options: IDaemonShutdownDeadlineErrorOptions);
+    readonly elapsedMs: number;
+    readonly forcedBy: string | undefined;
+    readonly stage: DaemonShutdownStage;
+    readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
 // @beta
 export class DaemonShutdownError extends Error {
     constructor(options: IDaemonShutdownErrorOptions);
     // (undocumented)
     readonly initiator: DaemonShutdownInitiator;
+    readonly requestStarted: boolean;
     // (undocumented)
     readonly signal: string | undefined;
 }
 
 // @beta
-export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
+export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host' | 'socketLost';
+
+// @beta
+export type DaemonShutdownStage = 'requests' | 'workspaceMaintenance' | 'requestDispatcher' | 'workspaceSession' | 'cacheWrites' | 'listener';
 
 // @beta
 export type DispatchWorkspaceRequestAsync = (options: IDispatchWorkspaceRequestOptions) => Promise<IDaemonCommandResult | undefined>;
@@ -157,16 +180,19 @@ export interface IDaemonRequestDispatchClient {
     getNextEventSequence(): number;
     // (undocumented)
     readonly interactiveSession: IInteractiveRequestSession;
+    readonly receivedTimeMs?: number;
     // (undocumented)
     readonly sessionId: string;
     // (undocumented)
     readonly supportsRequestAdmission: boolean;
+    waitForConnectingClientsAsync?(): Promise<void>;
     // (undocumented)
     writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
     // (undocumented)
     writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
     // (undocumented)
     writeQueuePositionAsync(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+    writeRequestStartedAsync?(): Promise<void>;
     // (undocumented)
     writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void>;
     // (undocumented)
@@ -181,6 +207,13 @@ export interface IDaemonRequestLifecycle extends AsyncDisposable {
     dispatchAsync(envelope: IDaemonRequestEnvelope, client: IDaemonRequestDispatchClient, dispatchAsync: DispatchWorkspaceRequestAsync): Promise<void>;
 }
 
+// @beta
+export interface IDaemonRequestLifecycleInfo {
+    readonly preparedTimeMs: number;
+    readonly receivedTimeMs: number;
+    readonly reloadTier: WorkspaceInputChangeTier;
+}
+
 // @beta
 export interface IDaemonRequestResolver {
     // (undocumented)
@@ -191,10 +224,19 @@ export interface IDaemonRequestResolver {
     readonly workspaceLifecycle?: IWorkspaceResolverLifecycle;
 }
 
+// @beta
+export interface IDaemonShutdownDeadlineErrorOptions {
+    readonly elapsedMs: number;
+    readonly forcedBy?: string;
+    readonly stage: DaemonShutdownStage;
+    readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
 // @beta
 export interface IDaemonShutdownErrorOptions {
     // (undocumented)
     readonly initiator: DaemonShutdownInitiator;
+    readonly requestStarted?: boolean;
     readonly signal?: string;
 }
 
@@ -204,6 +246,7 @@ export interface IDispatchWorkspaceRequestOptions {
     readonly client: IDaemonRequestDispatchClient;
     // (undocumented)
     readonly envelope: IDaemonRequestEnvelope;
+    readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
     // (undocumented)
     readonly onExecutionStarting?: () => void;
     // (undocumented)
@@ -337,6 +380,7 @@ export interface IMapWorkspaceInvalidationsOptions {
     readonly changedPaths: ReadonlyArray<string>;
     // (undocumented)
     readonly currentInputsSnapshot: IInputsSnapshot;
+    readonly executingIterationRecords?: ReadonlyMap<Operation, IOperationExecutionResult>;
     // (undocumented)
     readonly nextInputsSnapshot: IInputsSnapshot;
     // (undocumented)
@@ -364,6 +408,11 @@ export class InteractiveRequestInputRouter {
     routeStdinFrameAsync(payload: Uint8Array): Promise<void>;
 }
 
+// @beta
+export interface IPeekWorkspaceInvalidationsOptions {
+    readonly executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>;
+}
+
 // @beta
 export interface IPhasedRequestClient {
     readonly abortSignal: AbortSignal;
@@ -372,13 +421,44 @@ export interface IPhasedRequestClient {
     readonly interactiveSession?: IInteractiveRequestSession;
     readonly sessionId: string;
     readonly supportsRequestAdmission?: boolean;
+    waitForConnectingClientsAsync?(): Promise<void>;
     writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
     writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
     writeQueuePositionAsync?(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+    writeRequestStartedAsync?(): Promise<void>;
     writeResultAsync(result: IDaemonPhasedRequestResult): Promise<void>;
     writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
 }
 
+// @beta
+export interface IPhasedRequestTelemetryMeasure {
+    readonly endTimeMs: number;
+    readonly name: string;
+    readonly startTimeMs: number;
+}
+
+// @beta
+export interface IPhasedRequestTelemetryReport {
+    readonly batchSize: number;
+    readonly countRetained: number;
+    readonly earlyResult: boolean;
+    readonly executionStartTimeMs: number;
+    readonly iterationStartTimeMs: number | undefined;
+    readonly joinedIteration?: boolean;
+    readonly measures: ReadonlyArray<IPhasedRequestTelemetryMeasure>;
+    readonly receivedTimeMs: number;
+    readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+    readonly request: IDaemonPhasedRequest;
+    readonly result: IDaemonPhasedRequestResult;
+    readonly resultTimeMs: number;
+    readonly scheduled: boolean;
+}
+
+// @beta
+export interface IPhasedRequestTelemetrySink {
+    logRequest(report: IPhasedRequestTelemetryReport): void;
+}
+
 // @public
 export interface IRequestLease {
     // (undocumented)
@@ -390,6 +470,7 @@ export interface IRequestLease {
 // @public
 export interface IRequestSchedulerAcquireOptions {
     abortSignal?: AbortSignal;
+    admitAheadOfQueue?: boolean;
     exclusivityClass: RequestExclusivityClass;
     noWait?: boolean;
     onQueuePositionChanged?: (position: number) => void;
@@ -399,8 +480,10 @@ export interface IRequestSchedulerAcquireOptions {
 // @beta
 export interface IResolveDaemonRequestOptions {
     readonly abortSignal: AbortSignal;
+    readonly engineCreationSignal?: AbortSignal;
     // (undocumented)
     readonly envelope: IDaemonRequestEnvelope;
+    readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
     // (undocumented)
     readonly workspaceSession: IWorkspaceSession;
 }
@@ -416,11 +499,13 @@ export interface IResolvedDaemonGlobalRequest {
 // @beta
 export interface IResolvedDaemonPhasedRequest {
     readonly exactSelection?: boolean;
+    readonly exclusivityClass?: RequestExclusivityClass;
     // (undocumented)
     readonly kind: 'phased';
     // (undocumented)
     readonly request: IDaemonPhasedRequest;
     readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+    readonly telemetry?: IPhasedRequestTelemetrySink;
 }
 
 // @beta
@@ -464,15 +549,19 @@ export interface IResolveGlobalCommandRequestOptions {
 
 // @beta
 export interface IRushDaemonHostOptions {
+    readonly checkInstallation?: CheckDaemonInstallation;
     readonly createWorkspaceSessionAsync?: WorkspaceSessionFactory;
     readonly daemonVersion: string;
     readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
+    readonly idleGarbageCollectionDelayMs?: number;
     readonly idleTimeoutSeconds?: number;
     readonly onError?: (error: Error) => void;
     readonly onInteractiveConnection?: (connection: IDaemonInteractiveConnection) => void;
+    readonly onLog?: (message: string) => void;
     readonly repoRoot: string;
     readonly requestResolver?: IDaemonRequestResolver;
     readonly rushVersion: string;
+    readonly shutdownDeadlineMs?: number;
     readonly startupOptions?: Readonly<Record<string, unknown>>;
 }
 
@@ -524,6 +613,15 @@ export interface IWorkspaceEngineShape {
     readonly pluginNames: ReadonlyArray<string>;
 }
 
+// @beta
+export interface IWorkspaceInvalidationPeek {
+    commit(): void;
+    discard(): void;
+    readonly inputsSnapshot: IInputsSnapshot;
+    readonly invalidatedOperations: ReadonlySet<Operation>;
+    readonly invalidationReason: string;
+}
+
 // @beta
 export interface IWorkspaceInvalidationReconciliation {
     // (undocumented)
@@ -555,7 +653,7 @@ export interface IWorkspaceProcessRestartContext {
     // (undocumented)
     readonly environment: Readonly<Record<string, string>>;
     // (undocumented)
-    readonly reason: 'hard-input-change' | 'native-mutation';
+    readonly reason: 'hard-input-change' | 'native-mutation' | 'installation-changed';
     // (undocumented)
     readonly repoRoot: string;
     // (undocumented)
@@ -576,6 +674,7 @@ export interface IWorkspaceResolverLifecycle {
     createForSession(preparationLock?: LockFile, validateGraphInputsAsync?: () => Promise<void>): IDaemonRequestResolver;
     // (undocumented)
     getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string>;
+    getUnsupportedCommandError?(envelope: IDaemonRequestEnvelope): DaemonRequestDispatchError | undefined;
 }
 
 // @beta
@@ -593,6 +692,7 @@ export interface IWorkspaceSession extends AsyncDisposable {
     readonly metadata: IWorkspaceSessionMetadata;
     // (undocumented)
     readonly operationGraph: IOperationGraph | undefined;
+    peekInvalidationsAsync?(options: IPeekWorkspaceInvalidationsOptions): Promise<IWorkspaceInvalidationPeek | undefined>;
     quiesceWarmSetAsync?(): Promise<void>;
     // (undocumented)
     reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined>;
@@ -614,6 +714,7 @@ export interface IWorkspaceSessionComponents extends AsyncDisposable {
     readonly inputsSnapshot?: IInputsSnapshot;
     // (undocumented)
     readonly operationGraph?: IOperationGraph;
+    readonly peekInvalidationsAsync?: (options: IPeekWorkspaceInvalidationsOptions) => Promise<IWorkspaceInvalidationPeek | undefined>;
     readonly projectWatcher?: IWorkspaceInvalidationWatcher;
     // (undocumented)
     readonly reconcileInvalidationsAsync?: () => Promise<IWorkspaceInvalidationReconciliation>;
@@ -691,7 +792,7 @@ export type MapWorkspaceInvalidationsToOperationsAsync = (options: IMapWorkspace
 // @beta
 export class PhasedRequestRouter {
     constructor(workspaceSession: IWorkspaceSession);
-    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings): Promise<IDaemonPhasedRequestResult>;
+    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings, telemetry?: IPhasedRequestTelemetrySink, receivedTimeMs?: number, requestExclusivityClass?: RequestExclusivityClass): Promise<IDaemonPhasedRequestResult>;
 }
 
 // @beta
@@ -699,9 +800,11 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     constructor(options?: {
         readonly preparationLock?: LockFile;
         readonly validateGraphInputsAsync?: () => Promise<void>;
+        readonly startupEnvironment?: Readonly<Record<string, string | undefined>>;
     });
     createForSession(preparationLock?: LockFile, validateGraphInputsAsync?: () => Promise<void>): ProductionDaemonRequestResolver;
     getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string>;
+    getUnsupportedCommandError(envelope: IDaemonRequestEnvelope): DaemonRequestDispatchError | undefined;
     // (undocumented)
     resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest>;
     // (undocumented)
@@ -721,8 +824,12 @@ export enum RequestExclusivityClass {
 // @public
 export class RequestScheduler {
     acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease>;
+    get activeLeasesArePreemptible(): boolean;
     get activeRequestCount(): number;
     downgradeExclusiveLease(lease: IRequestLease, target: RequestExclusivityClass.SharedBuild | RequestExclusivityClass.SharedRead): void;
+    markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void;
+    notifyQueuePositions(): void;
+    preemptLeasesAsync(): Promise<void>;
     get queuedRequestCount(): number;
 }
 
@@ -750,9 +857,11 @@ export type ResolvedDaemonRequest = IResolvedDaemonPhasedRequest | IResolvedDaem
 export class RushDaemonHost {
     closeAsync(reason?: DaemonShutdownError): Promise<void>;
     readonly closed: Promise<void>;
+    expireShutdownDeadline(forcedBy: string): void;
     getWorkspaceSessionAsync(): Promise<IWorkspaceSession>;
     // (undocumented)
     readonly paths: IDaemonPaths;
+    releaseForExit(): boolean;
     readonly restartCompleted: Promise<IWorkspaceProcessRestartResult | undefined>;
     static startAsync(options: IRushDaemonHostOptions): Promise<RushDaemonHost>;
     get workspaceGeneration(): number;
@@ -825,6 +934,7 @@ export class WorkspaceSession implements IWorkspaceSession {
     readonly metadata: IWorkspaceSessionMetadata;
     // (undocumented)
     get operationGraph(): IOperationGraph | undefined;
+    peekInvalidationsAsync(options: IPeekWorkspaceInvalidationsOptions): Promise<IWorkspaceInvalidationPeek | undefined>;
     // (undocumented)
     quiesceWarmSetAsync(): Promise<void>;
     reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined>;
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 7b82e2af5d3..f79cfa2a80d 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -313,6 +313,8 @@ export const EnvironmentVariableNames: {
     readonly RUSH_TAR_BINARY_PATH: "RUSH_TAR_BINARY_PATH";
     readonly _RUSH_RECURSIVE_RUSHX_CALL: "_RUSH_RECURSIVE_RUSHX_CALL";
     readonly _RUSH_LIB_PATH: "_RUSH_LIB_PATH";
+    readonly _RUSH_LOCK_WAIT_DEADLINE: "_RUSH_LOCK_WAIT_DEADLINE";
+    readonly _RUSH_LOCK_WAIT_DAEMON_PID: "_RUSH_LOCK_WAIT_DAEMON_PID";
     readonly RUSH_INVOKED_FOLDER: "RUSH_INVOKED_FOLDER";
     readonly RUSH_INVOKED_ARGS: "RUSH_INVOKED_ARGS";
     readonly RUSH_QUIET_MODE: "RUSH_QUIET_MODE";
@@ -321,11 +323,18 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_AUTO_START: "RUSH_DAEMON_AUTO_START";
     readonly RUSH_DAEMON_WATCH: "RUSH_DAEMON_WATCH";
     readonly RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: "RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS";
+    readonly RUSH_DAEMON_INCREMENTAL_BUILDS: "RUSH_DAEMON_INCREMENTAL_BUILDS";
+    readonly RUSH_DAEMON_WARM_WORKERS: "RUSH_DAEMON_WARM_WORKERS";
+    readonly RUSH_DAEMON_JOIN_RUNNING_BATCH: "RUSH_DAEMON_JOIN_RUNNING_BATCH";
+    readonly RUSH_DAEMON_DEFER_CACHE_WRITES: "RUSH_DAEMON_DEFER_CACHE_WRITES";
+    readonly RUSH_DAEMON_BACKGROUND_PREPARE: "RUSH_DAEMON_BACKGROUND_PREPARE";
     readonly RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: "RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS: "RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
     readonly RUSH_DAEMON_WARM_SET_MAX_PROJECTS: "RUSH_DAEMON_WARM_SET_MAX_PROJECTS";
     readonly RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: "RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY";
+    readonly RUSH_DAEMON_COMPATIBLE_PLUGINS: "RUSH_DAEMON_COMPATIBLE_PLUGINS";
+    readonly RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS: "RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS";
     readonly RUSH_DAEMON_EXPERIMENTAL: "RUSH_DAEMON_EXPERIMENTAL";
 };
 
@@ -375,6 +384,9 @@ export class _FlagFile<TState extends JsonObject = JsonObject> {
     protected _state: TState;
 }
 
+// @internal
+export function _formatIterationStartLines(operationNames: Iterable<string>, parallelism: number, quietMode: boolean): string[];
+
 // @beta
 export type GetCacheEntryIdFunction = (options: IGenerateCacheEntryIdOptions) => string;
 
@@ -384,6 +396,12 @@ export type GetInputsSnapshotAsyncFn = () => Promise<IInputsSnapshot | undefined
 // @alpha
 export function getWorkspaceFingerprintEnvironmentEntries(environment: Readonly<Record<string, string | undefined>>): [string, string][];
 
+// @alpha
+export function getWorkspaceHostEnvironment(environment: Readonly<Record<string, string | undefined>>): Record<string, string>;
+
+// @alpha
+export function getWorkspaceRequestOperationEnvironment(hostEnvironment: Readonly<Record<string, string | undefined>>, requestEnvironment: Readonly<Record<string, string | undefined>>): Record<string, string>;
+
 // @alpha (undocumented)
 export interface IBaseOperationExecutionResult {
     getStateHash(): string;
@@ -518,13 +536,20 @@ export interface ICustomTipsJson {
 export interface IDaemonConfigurationJson {
     readonly autoStart?: boolean;
     readonly autoWarmByTelemetry?: boolean;
+    readonly backgroundPrepare?: boolean;
+    readonly commandAgnosticPlugins?: ReadonlyArray<string>;
+    readonly compatiblePlugins?: ReadonlyArray<string>;
+    readonly deferCacheWrites?: boolean;
     readonly enabled?: boolean;
     readonly idleTimeoutSeconds?: number;
+    readonly incrementalBuilds?: boolean;
+    readonly joinRunningBatch?: boolean;
     readonly queueTimeoutSeconds?: number;
     readonly usePersistentIpcRunners?: boolean;
     readonly warmIdleTimeoutSeconds?: number;
     readonly warmMemoryBudgetMB?: number;
     readonly warmSetMaxProjects?: number;
+    readonly warmWorkers?: boolean;
     readonly watch?: boolean;
 }
 
@@ -608,6 +633,17 @@ export interface IGlobalCommand extends IRushCommand {
     setHandled(): void;
 }
 
+// @beta
+export interface IIncrementalExecutionGuard {
+    getBlockReasonAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
+    verifyIncrementalResultAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
+}
+
+// @beta
+export interface IIncrementalExecutionGuardOptions {
+    readonly outputsMayBeBundles?: boolean;
+}
+
 // @public
 export interface IIndividualVersionJson extends IVersionPolicyJson {
     // (undocumented)
@@ -616,11 +652,12 @@ export interface IIndividualVersionJson extends IVersionPolicyJson {
 
 // @beta
 export interface IInputsSnapshot {
-    getOperationOwnStateHash(project: IRushConfigurationProjectForSnapshot, operationName?: string): string;
+    getOperationOwnStateHash(project: IRushConfigurationProjectForSnapshot, operationName?: string, environment?: Readonly<Record<string, string | undefined>>): string;
     getTrackedFileHashesForOperation(project: IRushConfigurationProjectForSnapshot, operationName?: string): ReadonlyMap<string, string>;
     readonly hashes: ReadonlyMap<string, string>;
     readonly hasUncommittedChanges: boolean;
     readonly rootDirectory: string;
+    readonly workingTreeReadStartTimeMs?: number;
 }
 
 // @public
@@ -703,6 +740,13 @@ export interface _IOperationChildProcessReporter {
     readonly stdio: child_process.StdioOptions;
 }
 
+// @beta
+export interface IOperationCommandExecution {
+    readonly hasIncrementalCommand: boolean;
+    readonly kind: 'initial' | 'incremental';
+    readonly watchesInputs?: boolean;
+}
+
 // @alpha
 export interface IOperationExecutionResult extends IBaseOperationExecutionResult, IOperationLastState {
     readonly enabled: boolean;
@@ -741,10 +785,12 @@ export interface IOperationGraph {
     quietMode: boolean;
     removeTerminalDestination(destination: TerminalWritable, close?: boolean): boolean;
     readonly resultByOperation: ReadonlyMap<Operation, IOperationExecutionResult>;
+    retainHeldOperations?(): (() => void) | undefined;
     scheduleIterationAsync(options: IOperationGraphIterationOptions): Promise<boolean>;
     setEnabledStates(operations: Iterable<Operation>, targetState: Operation['enabled'], mode: 'safe' | 'unsafe'): boolean;
     readonly status: OperationStatus;
     readonly terminalDestinations: ReadonlySet<TerminalWritable>;
+    tryExtendCurrentIteration?(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult;
 }
 
 // @alpha
@@ -756,6 +802,7 @@ export interface IOperationGraphContext extends ICreateOperationsContext {
 export interface _IOperationGraphEventSink {
     createChildProcessReporter?(operationId: string, iterationId: number): _IOperationChildProcessReporter | undefined;
     onActivity?(text: string, options?: _IOperationActivityOptions): void;
+    onIterationStarting?(records: ReadonlyArray<IOperationExecutionResult>, parallelism: number, quietMode: boolean): void;
     onOperationChunk?(operationId: string, chunk: ITerminalChunk, result?: IOperationExecutionResult, iterationId?: number): void;
     onOperationCompleted?(result: IOperationExecutionResult): void;
     onOperationHeader?(operationId: string, completedOperations: number, totalOperations: number): void;
@@ -764,13 +811,44 @@ export interface _IOperationGraphEventSink {
     onOperationStreamClosed?(operationId: string, result?: IOperationExecutionResult, iterationId?: number): void;
 }
 
+// @alpha
+export interface IOperationGraphExtensionOptions {
+    readonly beforeCommit?: () => void;
+    readonly inputsSnapshot: IInputsSnapshot;
+    readonly invalidatedOperations?: Iterable<Operation>;
+    readonly invalidationReason?: string;
+    readonly neededOperations: Iterable<Operation>;
+}
+
+// @alpha
+export interface IOperationGraphExtensionResult {
+    readonly changedOperations: ReadonlySet<Operation>;
+    readonly extended: boolean;
+    readonly reason?: string;
+}
+
 // @alpha
 export interface IOperationGraphIterationOptions {
+    getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
+    getOperationRequestId?: (operation: Operation) => string | undefined;
+    holdUnneededOperations?: boolean;
     // (undocumented)
     inputsSnapshot?: IInputsSnapshot;
+    isIncrementalBuildAllowed?: boolean;
+    startedOperations?: ReadonlySet<Operation>;
     startTime?: number;
 }
 
+// @alpha
+export interface IOperationGraphRequestResult extends IExecutionResult {
+    readonly commandName: string;
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    readonly operationResults: ReadonlyMap<Operation, IOperationExecutionResult>;
+    readonly requestId: string | undefined;
+    readonly status: OperationStatus;
+    readonly terminal: ITerminal;
+}
+
 // @beta
 export interface IOperationLastState {
     readonly status: OperationStatus;
@@ -832,10 +910,12 @@ export interface IOperationRunnerContext {
     debugMode: boolean;
     environment: IEnvironment | undefined;
     error?: Error;
+    getIncrementalExecutionGuard?(): IIncrementalExecutionGuard | undefined;
     getInvalidateCallback(): (reason: string) => void;
     // @internal
     _operationMetadataManager: _OperationMetadataManager;
     quietMode: boolean;
+    reportCommandExecution?(execution: IOperationCommandExecution): void;
     runWithTerminalAsync<T>(callback: (terminal: ITerminal, terminalProvider: ITerminalProvider, structuredChildOutputTerminalProvider: ITerminalProvider) => Promise<T>, options: {
         createLogFile: boolean;
         logFileSuffix?: string;
@@ -848,6 +928,7 @@ export interface IOperationRunnerContext {
 // @alpha (undocumented)
 export interface IOperationSettings {
     allowCobuildWithoutCache?: boolean;
+    allowDaemonWarmWorker?: boolean;
     daemonIpc?: IDaemonIpcConfiguration;
     dependsOnAdditionalFiles?: string[];
     dependsOnEnvVars?: string[];
@@ -903,6 +984,7 @@ export interface IParsePhasedCommandOptions {
     readonly argv: ReadonlyArray<string>;
     // (undocumented)
     readonly cwd: string;
+    readonly environment?: Readonly<Record<string, string | undefined>>;
     // (undocumented)
     readonly rushConfiguration: RushConfiguration;
     // (undocumented)
@@ -946,6 +1028,7 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
     readonly inputsSnapshot: IInputsSnapshot;
     // (undocumented)
     readonly isIncremental: boolean;
+    readonly logTelemetry?: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
     // (undocumented)
     readonly operationGraph: IOperationGraph;
     // (undocumented)
@@ -956,14 +1039,47 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
     readonly rushSession: RushSession;
 }
 
+// @alpha
+export interface IPhasedCommandEngineLogTelemetryOptions {
+    readonly servedByIteration?: boolean;
+}
+
 // @alpha
 export interface IPhasedCommandEngineRequestSettings {
+    readonly isIncrementalBuildAllowed: boolean;
     // (undocumented)
     readonly parallelism: Parallelism;
     // (undocumented)
     readonly quietMode: boolean;
 }
 
+// @alpha
+export interface IPhasedCommandEngineSharingLabels {
+    readonly engine: string;
+    readonly request: string;
+}
+
+// @alpha
+export interface IPhasedCommandEngineTelemetryOptions {
+    readonly durationInSeconds: number;
+    readonly extraData?: Readonly<Record<string, string | number | boolean>>;
+    readonly performanceEntries?: ReadonlyArray<PerformanceEntry_2>;
+    readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+    readonly succeeded: boolean;
+    readonly timeOriginMs: number;
+}
+
+// @alpha
+export interface IPhasedCommandEngineTelemetryRecord {
+    readonly nonCachedDurationMs: number | undefined;
+    readonly silent: boolean;
+    readonly status: OperationStatus;
+    readonly stopwatch: {
+        readonly startTime: number | undefined;
+        readonly endTime: number | undefined;
+    };
+}
+
 // @alpha
 export interface IPhasedCommandPlugin {
     apply(hooks: PhasedCommandHooks): void;
@@ -1260,7 +1376,6 @@ export interface IWorkspaceInputFingerprint {
     readonly environmentHash: string;
     // (undocumented)
     readonly installationHash: string;
-    // (undocumented)
     readonly runtimeHash: string;
     // (undocumented)
     readonly selectedRushVersion: string;
@@ -1335,8 +1450,8 @@ export class _OperationBuildCache {
     static getOperationBuildCache(options: _IProjectBuildCacheOptions): _OperationBuildCache;
     // (undocumented)
     tryRestoreFromCacheAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean>;
-    // (undocumented)
-    trySetCacheEntryAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean>;
+    // Warning: (ae-forgotten-export) The symbol "DeferredCacheEntryWrites" needs to be exported by the entry point index.d.ts
+    trySetCacheEntryAsync(terminal: ITerminal, specifiedCacheId?: string, deferredCacheEntryWrites?: DeferredCacheEntryWrites): Promise<boolean>;
 }
 
 // @alpha
@@ -1352,6 +1467,7 @@ export class OperationGraphHooks {
     readonly afterExecuteOperationAsync: AsyncSeriesHook<[
     IOperationRunnerContext & IOperationExecutionResult
     ]>;
+    readonly afterExecuteRequestAsync: AsyncSeriesHook<[IOperationGraphRequestResult]>;
     readonly beforeDeleteResults: SyncHook<[ReadonlySet<Operation>]>;
     readonly beforeExecuteIterationAsync: AsyncSeriesBailHook<[
     ReadonlyMap<Operation, IOperationExecutionResult>,
@@ -1361,6 +1477,7 @@ export class OperationGraphHooks {
     IOperationRunnerContext & IOperationExecutionResult
     ], OperationStatus | undefined>;
     readonly beforeLog: SyncHook<ITelemetryData, void>;
+    readonly beforeLogRequest: SyncHook<ITelemetryData, void>;
     readonly configureIteration: SyncHook<[
     ReadonlyMap<Operation, IConfigurableOperation>,
     ReadonlyMap<Operation, IOperationExecutionResult>,
@@ -1370,6 +1487,10 @@ export class OperationGraphHooks {
     IEnvironment,
     IOperationRunnerContext & IOperationExecutionResult
     ]>;
+    readonly extendIteration: SyncHook<[
+    ReadonlyMap<Operation, IOperationExecutionResult>,
+    IOperationGraphIterationOptions
+    ]>;
     readonly onEnableStatesChanged: SyncHook<[ReadonlySet<Operation>]>;
     readonly onExecutionStatesUpdated: SyncHook<[ReadonlySet<IOperationExecutionResult>]>;
     readonly onGraphStateChanged: SyncHook<[IOperationGraph]>;
@@ -1518,13 +1639,16 @@ export { parseReporterExtensionEventName }
 export class PhasedCommandEngine {
     // (undocumented)
     readonly commandName: string;
-    createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine>;
+    createEngineAsync(preparationLock?: LockFile, abortSignal?: AbortSignal): Promise<IPhasedCommandEngine>;
+    createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData;
+    getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession, labels?: IPhasedCommandEngineSharingLabels): string | undefined;
+    readonly isIncremental: boolean;
     // (undocumented)
     readonly parameterIdentity: string;
-    // (undocumented)
     static parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine>;
     get requestSettings(): IPhasedCommandEngineRequestSettings;
     selectOperationsAsync(graph: IOperationGraph): Promise<ReadonlyMap<Operation, OperationEnabledState>>;
+    readonly unmatchedCompatiblePluginNames: ReadonlyArray<string>;
 }
 
 // @alpha
@@ -1537,6 +1661,22 @@ export class PhasedCommandEngineConfigurationChangedError extends Error {
     constructor();
 }
 
+// @alpha
+export class PhasedCommandEngineProjectConfigurationError extends Error {
+    constructor(projectName: string, cause: unknown);
+    readonly projectName: string;
+}
+
+// @alpha
+export class PhasedCommandEngineUsageError extends Error {
+    constructor(message: string, exitCode: number, options?: {
+        cause?: unknown;
+        usage?: string;
+    });
+    readonly exitCode: number;
+    readonly usage: string | undefined;
+}
+
 // @alpha
 export class PhasedCommandHooks {
     readonly createOperationsAsync: AsyncSeriesWaterfallHook<[
@@ -1614,7 +1754,10 @@ export class ProjectChangeAnalyzer {
     // (undocumented)
     protected getChangesByProject(lookup: LookupByPath<RushConfigurationProject>, changedFiles: Map<string, IFileDiffStatus>): Map<RushConfigurationProject, Map<string, IFileDiffStatus>>;
     // @internal
-    _tryGetSnapshotProviderAsync(projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>, terminal: ITerminal, projectSelection?: ReadonlySet<RushConfigurationProject>): Promise<GetInputsSnapshotAsyncFn | undefined>;
+    _tryGetSnapshotProviderAsync(projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>, terminal: ITerminal, projectSelection?: ReadonlySet<RushConfigurationProject>, options?: {
+        readonly throwOnMissingProjectShrinkwrapFile?: boolean;
+        readonly reuseUnchangedInputs?: boolean;
+    }): Promise<GetInputsSnapshotAsyncFn | undefined>;
 }
 
 export { ReporterExtensionEventName }
@@ -2125,9 +2268,17 @@ export enum WorkspaceInputChangeTier {
     Reuse = 0
 }
 
+// @alpha
+export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string>;
+
 // @alpha
 export class WorkspaceRuntimeFingerprintCache {
+    get changedInstallationPaths(): ReadonlyArray<string>;
     get changedPaths(): ReadonlyArray<string>;
+    // @internal
+    _hashInputFilesAsync(filenames: Iterable<string>): Promise<string>;
+    // @internal
+    _hashInstallationFilesAsync(filenames: Iterable<string>): Promise<string>;
     // @internal (undocumented)
     _hashPaths(paths: ReadonlyArray<string>): string;
 }
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
new file mode 100644
index 00000000000..9c815a7e960
--- /dev/null
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -0,0 +1,454 @@
+# Dogfooding the Rush daemon in rushstack
+
+This guide is for contributors who want to build the rushstack repository with the opt-in Rush daemon
+(`rush-client`, from [`apps/rush-cli-client`](../../apps/rush-cli-client/README.md)) **before** a published
+Rush release contains it. Ordinary `rush`, `rushx`, and CI are unaffected: they keep running in-process
+unless you opt in explicitly.
+
+Nothing described here is published yet, so the client is built from source. The daemon must not run
+directly from the workspace's build outputs: rebuilding `@microsoft/rush-lib`, `@rushstack/rush-daemon`, or
+`@rushstack/rush-cli-client` would replace modules that the long-lived daemon is executing. Instead,
+`rush deploy` extracts a stable, self-contained snapshot of the built client closure into the gitignored
+`common/temp/rush-daemon-dogfood` folder, and the daemon runs from that snapshot.
+
+## Prerequisites
+
+- A supported Node.js version (see `nodeSupportedVersionRange` in `rush.json`) and Git.
+- A completed install: `node common/scripts/install-run-rush.js install`.
+- No `.env` file in the repository root or in `~/.rush-user/`. The daemon does not support `.env`
+  initialization and would fall back to in-process Rush.
+- The source-built Rush version must equal the repository's `rushVersion`. Compare the output of
+  `node -p "require('./apps/rush/package.json').version"` with the `rushVersion` field in `rush.json`.
+  If they differ, see [Version skew](#version-skew-and-rush_preview_version).
+
+> **Do not export `RUSH_DAEMON` in a shell that also runs ordinary `rush`.** The published Rush release that
+> `rush.json` currently selects rejects unrecognized `RUSH_` environment variables, so
+> `node common/scripts/install-run-rush.js ...` fails with
+> `The following environment variables were found with the "RUSH_" prefix, but they are not recognized`.
+> The shell functions below set `RUSH_DAEMON=1` only for `rush-client` invocations.
+>
+> **Do not add a `daemon` block to `rush.json` yet.** The published schema rejects it, which would break
+> ordinary `rush` and CI. Opting in with the environment variable is sufficient.
+
+## 1. Build the client closure
+
+```bash
+node common/scripts/install-run-rush.js build --to @rushstack/rush-cli-client
+```
+
+## 2. Create the snapshot
+
+If a daemon from an earlier snapshot is running, stop it first (see [Refresh](#refresh-the-snapshot)).
+Then extract the snapshot with the `rush-daemon-dogfood` deployment scenario
+([`common/config/rush/deploy-rush-daemon-dogfood.json`](../../common/config/rush/deploy-rush-daemon-dogfood.json)):
+
+```bash
+node common/scripts/install-run-rush.js deploy --scenario rush-daemon-dogfood --target-folder common/temp/rush-daemon-dogfood --overwrite
+```
+
+The snapshot contains copies of the built Rush projects and their npm dependencies, with links that stay
+inside the snapshot. To confirm that the client resolves its engine from the snapshot rather than from the
+workspace, run the following from the repository root. It must print a path under
+`common/temp/rush-daemon-dogfood`:
+
+```bash
+node -p "require('fs').realpathSync(require.resolve('@microsoft/rush-lib', { paths: [require('path').resolve('common/temp/rush-daemon-dogfood/apps/rush-cli-client')] }))"
+```
+
+The snapshot also contains Rush's built-in cloud build-cache plugins (`amazon-s3`, `azure-blob-storage` and
+`http`), next to the `@microsoft/rush-lib` links of `@microsoft/rush`, `rush-client` and the daemon. A source-built rush-lib loads them
+from there, and it points `_RUSH_LIB_PATH` at that same link. So plugins that resolve `@microsoft/rush-lib` by name
+from `_RUSH_LIB_PATH` work in both the daemon and the in-process fallback. This repository's own build cache is
+`local-only`, so it doesn't need them.
+
+## 3. Opt in and build
+
+Define a `rush-client` function in the terminal you will use, from the repository root.
+
+Bash:
+
+```bash
+DOGFOOD_SNAPSHOT="$PWD/common/temp/rush-daemon-dogfood"
+rush-client() { RUSH_DAEMON=1 node "$DOGFOOD_SNAPSHOT/apps/rush-cli-client/bin/rush-client" "$@"; }
+```
+
+PowerShell:
+
+```powershell
+$DogfoodSnapshot = "$PWD\common\temp\rush-daemon-dogfood"
+function rush-client {
+  $env:RUSH_DAEMON = '1'
+  try { node "$DogfoodSnapshot\apps\rush-cli-client\bin\rush-client" @args } finally { Remove-Item Env:RUSH_DAEMON }
+}
+```
+
+Then build as usual. The first request starts the daemon and constructs the all-project graph; later
+compatible requests from the same terminal reuse it:
+
+```bash
+rush-client build --to @rushstack/tree-pattern
+rush-client build --to @rushstack/tree-pattern
+```
+
+Any project selection that `rush build` accepts works, including projects in the `build-tests-subspace`
+subspace. `rush-client rebuild` is also supported, as are the phased commands of command-line.json
+(for example `rush-client test`). Commands share the warm graph where they can: a `test` graph also serves
+`build` and `rebuild`, and a `build` graph serves `rebuild`. The first `rush-client test` after a build reloads
+the graph once; later builds reuse the test graph. A custom command whose graph could not serve the current
+graph's command either, such as `retest` (which is not incremental) after a build, runs in-process instead, so
+that the two commands don't reload the graph on every switch. With `daemon.usePersistentIpcRunners`, a
+command that is not incremental never runs on another command's graph, because persistent IPC runners serve
+only incremental commands. After a `rush-client test`, for example, `rebuild` reloads the graph and `retest`
+runs in-process.
+
+## 4. Confirm that the daemon served the build
+
+Enabling the daemon is not proof that a build used it: unsupported requests silently or explicitly use
+in-process Rush. Check all of the following:
+
+1. **No fallback.** When the client does not use the daemon, it runs native Rush, which prints the
+   `Rush Multi-Project Build Tool` banner. If the daemon was selected but could not serve the request, stderr
+   also contains a line starting with `rush-client:` and ending with `using in-process Rush.` A
+   daemon-served build prints neither.
+2. **A warm graph.** `rush-client daemon status` prints one JSON object. `workspace.graphInitialized` must be
+   `true`.
+3. **The same process.** `pid` and `workspace.generationToken` stay the same across requests from the same
+   terminal. `workspace.lastReloadTier` is `0` when the request reused the existing graph, and `1` after an
+   in-process reload (for example, the first request, or a configuration change). The command line of that
+   `pid` runs `SelectedDaemonBootstrap.js` from `common/temp/rush-daemon-dogfood`, not from the workspace.
+4. **Parity.** For the same selection, ordinary Rush produces the same outputs. For example, after a
+   daemon-served build, `node common/scripts/install-run-rush.js rebuild --only @rushstack/tree-pattern`
+   leaves the files in `lib-commonjs`, `lib-dts`, `lib-esm`, and `dist` unchanged.
+
+A warm request whose selected operations are all up to date finishes **without printing anything**, and exits
+with code `0`. Unlike ordinary Rush, the daemon client does not yet print a summary, so "no output" after a
+build that already ran means everything was up to date; `rush-client daemon status` confirms that it was served.
+
+For example, in one Bash terminal after steps 1–3:
+
+```bash
+rush-client build --to @rushstack/tree-pattern 2>&1 | tee /tmp/dogfood-build.log
+grep -E 'in-process Rush|Rush Multi-Project Build Tool' /tmp/dogfood-build.log && echo 'NOT served by the daemon'
+rush-client daemon status   # graphInitialized: true; note pid and generationToken
+cp libraries/tree-pattern/src/index.ts /tmp/tree-pattern-index.ts   # keeps any edits you already made
+echo "// throwaway" >> libraries/tree-pattern/src/index.ts
+rush-client build --to @rushstack/tree-pattern   # rebuilds tree-pattern in the same daemon
+rush-client daemon status   # same pid and generationToken
+cp /tmp/tree-pattern-index.ts libraries/tree-pattern/src/index.ts   # restores the file as it was
+```
+
+In PowerShell, use `rush-client build --to @rushstack/tree-pattern *>&1 | Tee-Object dogfood-build.log` and
+`Select-String -Path dogfood-build.log -Pattern 'in-process Rush', 'Rush Multi-Project Build Tool'`.
+
+## Use native Rush for one command
+
+Pass `--no-daemon` to run a single `rush-client` command in-process:
+
+```bash
+rush-client build --no-daemon --to @rushstack/tree-pattern
+```
+
+Ordinary `node common/scripts/install-run-rush.js ...` commands also keep working while the daemon is
+running. The daemon holds the Rush lock only while it prepares or executes a request, not while idle.
+
+## Refresh the snapshot
+
+The snapshot does not pick up later source changes to Rush itself; after changing or pulling changes to
+`libraries/rush-lib`, `libraries/rush-daemon`, `libraries/rush-client-core`, or `apps/rush-cli-client`, refresh it.
+Stop the daemon first, because `--overwrite` deletes the files that a running daemon executes:
+
+```bash
+rush-client daemon stop
+node common/scripts/install-run-rush.js build --to @rushstack/rush-cli-client
+node common/scripts/install-run-rush.js deploy --scenario rush-daemon-dogfood --target-folder common/temp/rush-daemon-dogfood --overwrite
+```
+
+On Windows, the first daemon start from a new or refreshed snapshot can take longer than the client's 15-second
+startup deadline while Windows scans the newly written files. Because the startup helper is still waiting for the
+daemon, the client says so and keeps trying for another 15 seconds, then uses the daemon once it is ready. If it is
+still not ready, the request fails with exit code 1 and a `rush-client: ...` message that says Rush was not run
+in-process, rather than running native Rush next to the starting daemon. The daemon finishes starting in the
+background, so rerun the command (`rush-client daemon status` shows when it is ready).
+
+The daemon's identity is the canonical repository root plus the selected Rush version, so each checkout or
+worktree has its own daemon, and `rush-client daemon ...` commands address the daemon for the checkout that
+contains the current directory.
+
+## Stop and clean up
+
+```bash
+rush-client daemon stop     # prints state "shutdownAccepted"
+rush-client daemon status   # exits with code 1: no daemon is listening
+rush-client daemon logs     # launcher log, available even after the daemon stopped
+```
+
+Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purge`, which clears all of
+`common/temp`). Stop the daemon before purging or reinstalling.
+
+## Known limits
+
+- **Environment identity.** The request environment is a daemon input, apart from per-shell bookkeeping
+  (such as `PWD`, `SHLVL`, `TERM`, `TERM_SESSION_ID`, `WSL_INTEROP`, and SSH or tmux session handles) and the
+  client's own `RUSH_DAEMON` routing variables. Any other difference, such as a different `WT_SESSION` or
+  `VSCODE_*` value from another terminal window, or a changed `PATH`, restarts the daemon before anything runs,
+  and the new process then serves the request. This is not a fallback, but it costs a cold start and changes
+  `pid`. Run related requests from the same terminal.
+- **Only phased commands use the warm engine:** `build`, `rebuild`, and the phased commands of
+  command-line.json. Global commands, `rush start` (which always watches),
+  `--watch`, `--install`, `--variant`, and `--node-diagnostic-dir` stay native, as do build event-hook
+  scripts (for `build` and `rebuild`, the only commands that run them) and reporter controls such as `--output`. Keep using ordinary Rush for `install`, `update`, and
+  other commands. `rushx-client` keeps scripts attached to a TTY in-process.
+- **No persistent Heft or TypeScript workers by default.** Each operation still starts its Heft process; the
+  daemon saves Rush startup and graph construction, not compilation. The `usePersistentIpcRunners`/`daemonIpc`
+  mode requires a bundled, self-contained worker entry point, and Heft is not packaged that way. See
+  `daemon.warmWorkers` below for Heft workers that stay alive between builds.
+- **`:incremental` scripts.** With `daemon.incrementalBuilds` (on by default), an operation whose project
+  defines a `_phase:<name>:incremental` script runs it instead of the initial script when only files that the
+  operation builds were edited since its last successful run in the daemon. The operation log then says
+  `Invoking (incremental): ...`. An added, deleted or renamed input, a configuration, tool, environment or
+  command-line change, a change to its output folders, bundled outputs, a cache restore or a native `rush`
+  command make it run the initial script, and the log says why (`Not using the incremental command because
+  ...`). Incremental results are never written to the build cache, and neither are the results of operations
+  built against them. Set `RUSH_DAEMON_INCREMENTAL_BUILDS=0` to always run the initial script.
+- **Warm workers.** With `daemon.warmWorkers` (or `RUSH_DAEMON_WARM_WORKERS=1`, off by default) and
+  `incrementalBuilds`, an operation whose project defines a `_phase:<name>:incremental:ipc` script (for Heft,
+  `heft run-watch --only <phase> --`) and whose `rush-project.json` operation settings set
+  `"allowDaemonWarmWorker": true` runs its incremental builds in a worker started from that script. Set it only
+  if the script, run in watch mode, runs every task and check that the initial script runs: the daemon reports
+  a run on the worker as if the initial script had run, and `rush start` may run the same script with fewer
+  tasks on purpose. Heft skips lint and API Extractor in watch mode unless the lint task sets heft-lint-plugin's
+  `lintInWatchMode` option and `config/api-extractor-task.json` sets `runInWatchMode`; without them, a lint
+  error does not fail the build, and consumers read a stale `.d.ts` rollup. A rig can set all three for its
+  projects. The worker stays alive between builds and keeps its last build in memory, so the next build sends
+  it another run instead of starting Heft again. The operation log says `Invoking (incremental): ...`, followed
+  by `Starting a warm worker for it.` or `Sending run <n> to the warm worker (pid <pid>).`. When the rules above
+  require the initial script, the worker is closed first (`Closing the warm worker (pid <pid>), because ...`),
+  and that line is written even if the build cache then restores the operation. The initial script then runs
+  as usual, or in a new worker if the project defines `_phase:<name>:ipc` (for Heft,
+  `heft run-watch --only <phase> -- --clean`). A worker also accepts bundled outputs, because it keeps its
+  bundler state in memory; if a run changes which output files exist, the initial script runs after it. If the
+  run added or removed a file with a content hash in its name, as a bundler does when a chunk's content changes,
+  the operation runs only its initial script from then on, until a request replaces the engine, because each
+  later edit would rename the chunk again and leave the old one behind.
+  A worker starts with `TSC_WATCHFILE=UseFsEventsOnParentDirectory` unless the operation's environment sets
+  `TSC_WATCHFILE`. On Linux and macOS, TypeScript's default file watcher follows each file's inode, and after Git
+  replaces a file it can lose track of that file for the life of the process, so the worker would miss every later
+  edit to the file and keep its stale outputs, with no error. TypeScript reads the variable only if
+  `tsconfig.json` does not set `watchOptions.watchFile`. The variable's watcher fails loudly instead: on Linux,
+  if a source file is missing when a run on the worker updates the TypeScript program, for example because a
+  checkout deleted it during the build and then restored it, the run usually fails with error `TS6053` (file not
+  found), or with `ENOENT` if a whole folder was missing, and like any failed run it closes the worker (see
+  below), so it costs a failed run but leaves no stale outputs. With TypeScript 3.8 or later, Heft's TypeScript
+  plugin reports the file as created when it comes back; with TypeScript 3.7 or older, or an older release of the
+  plugin, TypeScript never finds that file again in the process. But if Heft sees the change while the run is in
+  progress, it runs its tasks again, and the last pass decides the result. The run can then succeed with warnings,
+  which fails the build unless the phase sets `allowWarningsOnSuccess`, but nothing runs again and the worker stays
+  alive. The next build does not reuse that worker, with or without the build cache, because input files that
+  changed while an operation ran make its result unverifiable.
+  A watcher of a folder can also miss every later change in it once the folder is deleted and created again, for
+  example by a branch switch that removed the folder and then restored it. So the next build runs the initial
+  script if a folder that held the operation's input files was deleted or recreated since the last run on the
+  worker started (`Not using the incremental command because folders that held its input files were deleted or
+  recreated since its last run (...)`), even if the files kept their content. The daemon compares each folder's
+  inode and creation time; a file that an editor saves by renaming a new file over it does not count. The
+  message names only the top folder of a recreated tree, and an operation whose own build recreates such a folder
+  never reuses its worker.
+  A worker's outputs are only as current as Heft's watchers. A change that a watcher misses is not built, and
+  because the run still succeeds, later builds report the operation as up to date and keep the stale outputs
+  until the file is edited again. The checks above cover the cases found in testing: a file that Git replaces, a
+  folder that is recreated, and a file that is missing while a run updates TypeScript. A case that none of them
+  covers would leave stale outputs without an error.
+  A reused worker can fail where the initial script passes, for example after Git rewrites the `package.json` of
+  a dependency, because some tools keep state between runs. So if a run on a reused worker fails, or the worker
+  exits during a run, the worker is closed and the initial script runs in the same build
+  (`Running the initial command, because the run on the warm worker failed.`), and the operation fails only if
+  the initial script fails too. A genuine error then costs an extra run of the initial script. The failed first
+  run of a new worker is reported as it stands, because that run had no earlier state. The build cache is not
+  read for a run on a live worker. A worker is closed after its operation fails, because the next build runs the
+  initial script, and after 25 runs or once its memory doubles. Builds that follow each other within seconds can
+  double a worker's memory in a few runs without a leak, because V8 collects each run's garbage later, while the
+  worker is idle: with API Extractor in watch mode, a small package's worker grew by 120 to 180 MB per run and was
+  replaced every 4 or 5 runs, but with 20 seconds between builds it stayed flat. Workers count toward
+  `warmMemoryBudgetMB` and `warmSetMaxProjects`. Over either limit, or once no build has included a project for
+  `warmIdleTimeoutSeconds`, the warm set closes the project's workers and drops its last results, so its next
+  build runs the initial script (`The warm worker (pid <pid>) was closed after the operation last ran.`). The
+  default budget, 512 MiB, includes the daemon itself and leaves room for few workers, so raise both limits when
+  you turn workers on. A request that replaces the engine, e.g. a `rebuild` after a `build`, closes every worker
+  without a note, and each operation's next build runs the initial script.
+- **Plugins.** This repository's only configured plugin, `@rushstack/rush-published-versions-json-plugin`,
+  is associated only with `record-published-versions` and is inert for builds. A plugin without
+  `associatedCommands`, a plugin associated with `build` or `rebuild`, or a plugin command-line that defines
+  the command, one of its phases, or a parameter for either would make those builds fall back to native Rush,
+  unless the plugin is declared daemon-compatible. See
+  [Rush plugins in daemon engines](#rush-plugins-in-daemon-engines).
+- **Windows.** Native Windows validation of the daemon code saw unresolved, intermittent failures in which
+  Git `hash-object --stdin-paths` exited with `0xC0000142` (DLL initialization failed) while the daemon
+  captured workspace snapshots under Jest. Direct fixtures did not reproduce it, and it did not occur while
+  this workflow was validated on native Windows. The cause is unresolved, so treat it as an open risk: if a
+  daemon-served build fails this way, retry it with `--no-daemon` and report the failure.
+  The daemon runs without a console, so it starts its tools (Git, tar and operation shells) with hidden
+  windows. Daemons started from a snapshot older than that change open a visible terminal window for each
+  tool; if you see that, [refresh the snapshot](#refresh-the-snapshot).
+- **CI** stays in-process unless `RUSH_DAEMON=1` is set; do not set it in CI workflows.
+
+## Deferred build cache writes
+
+With `"daemon": { "deferCacheWrites": true }` in `rush.json`, or `RUSH_DAEMON_DEFER_CACHE_WRITES=1` (off by
+default), an operation that writes a build cache entry completes as soon as the daemon has cloned its output files
+into `common/temp/build-cache-staging/<pid>/`. The daemon then writes the entry from the clones in the background,
+two at a time, so the operations that depend on it, and the command, don't wait for tar. On a file system that can
+clone files, such as Btrfs, XFS or APFS, the clones take well under a second, even for thousands of files, because
+a clone shares its data with the output file until either changes. That is also why later changes to the outputs
+don't change the entry. Like the daemon's other settings, the variable is part of its environment identity, so
+changing it restarts the daemon.
+
+- The operation's build cache log says
+  `Sealed <n> output files (<x.y> MB) in <ms> ms; writing the build cache entry in the background.` After each
+  command with background activity, legacy output prints
+  `Build cache entries written in the background since the previous command: <q> queued, <w> written (<x.y> MB), <f> failed; <p> pending.`
+  The line is a warning (on stderr) if any of those writes failed, and
+  [agent output](../../apps/rush-cli-client/README.md#output-modes) prints it only then. Either way, the next
+  command counts only the writes since this one.
+  The daemon log has a line for each entry that it writes, fails to write or drops.
+- The clones take longer while the file system writes back what the build just wrote, which can take seconds. An
+  operation waits for them for at most half a second. The rest of its files are then cloned in the background, and
+  its log says
+  `Sealing <n> output files (<x.y> MB) in the background after <ms> ms; the build cache entry is written once they're sealed.`
+  An output file that changes before it is cloned, for example because the next build rewrites it, would make the
+  entry inconsistent, so the entry is dropped instead: the daemon log says
+  `Dropped the build cache entry <id> for <operation>, because <path> changed before it was sealed.`, and the
+  command's line ends with `<f> failed, <d> dropped; <p> pending.` A dropped entry isn't a failure: like an entry
+  that isn't written yet, it makes a restore of its cache key miss, so the operation runs again.
+- If the files can't be cloned, for example on ext4 or tmpfs, the entry is written before the operation completes,
+  as in native Rush (`Unable to clone the output files (<code>), so the build cache entry is written now.`). Once
+  the file system has refused a clone, the daemon doesn't try again until it restarts.
+- Cobuilds always write an entry before its operation completes, because other agents read it as soon as the
+  operation completes.
+- An entry that fails to be written in the background doesn't change the operation's status. The daemon log and
+  the next command's warning report it.
+- Until an entry is written, a restore of its cache key misses. For example, a native build that starts right
+  after the daemon build runs the operation again.
+- `rush-client daemon stop` and a daemon restart drop the entries that aren't written yet.
+- Hard links among the output files are archived as separate files.
+
+## Rush plugins in daemon engines
+
+A daemon engine applies each Rush plugin once and then serves many requests from one long-lived process.
+A plugin written for a single native command can therefore misbehave, so the daemon serves a `build` or
+`rebuild` that a configured plugin participates in only if the plugin is declared daemon-compatible. A plugin
+participates if it has no `associatedCommands` (Rush initializes it for every command), is associated with
+the command, or its command-line.json defines the command, one of its phases, or a parameter for either.
+Any other plugin is inert for the build and needs no declaration.
+
+Declare a plugin in one of these ways:
+
+- **The plugin author** sets `"daemonCompatible": true` on the plugin's entry in `rush-plugin-manifest.json`.
+  Releases whose schemas predate this setting reject such a manifest, and then every command fails, not only
+  builds. Set it only in plugin versions that are installed with a Rush release that accepts it, as with the
+  `@rushstack` plugins, which are versioned with Rush; otherwise leave the declaration to repositories.
+- **The repository** lists the plugin's `pluginName` from `rush-plugins.json` in the `rush.json` setting
+  `"daemon": { "compatiblePlugins": [...] }`, after verifying the plugin against the contract below.
+- **One shell** sets `RUSH_DAEMON_COMPATIBLE_PLUGINS` to a comma-separated list of plugin names, which
+  replaces the `rush.json` list; an empty value lists no plugins. Releases whose schemas predate these
+  settings reject the manifest and `rush.json` keys, so a repository that still selects such a release can
+  only use this variable, and only for `rush-client`. The value is part of the daemon's environment
+  identity, so changing it starts a new daemon.
+
+A listed name that matches no configured plugin has no effect; the request that creates the daemon's engine
+prints a warning, which the daemon's launcher log also keeps. An undeclared participating plugin makes the
+request fall back to native Rush, with a message that names the plugin and each reason.
+
+The engine lifecycle that a declared plugin must support:
+
+- **Once per engine:** the plugin's `apply()`, `initialize`, `runAnyPhasedCommand`,
+  `runPhasedCommand.for(<command>)`, `createOperationsAsync` and `onGraphCreatedAsync`. The engine builds the
+  graph for every project, with `isWatch` false; each request then selects operations from it. A request
+  whose parameters differ from the engine's (other than project selection, `--include-phase-deps`,
+  `--ignore-hooks`, `--verbose`, `--parallelism` and `--timeline`) or a changed
+  configuration file replaces the engine, and the new engine applies the plugin again in the same process.
+  Module-level state therefore outlives an engine. An engine serves another command, such as `rebuild` on a
+  `build` engine, only if the same plugins are associated with both commands, no plugin taps the
+  `runPhasedCommand` hook of either command, and every plugin that taps `initialize` or `runAnyPhasedCommand` is
+  declared command-agnostic (below), because Rush calls these hooks only with the command that created the engine.
+- **Once per iteration:** the operation graph hooks, such as `configureIteration`,
+  `beforeExecuteIterationAsync`, `before`/`afterExecuteOperationAsync`, `createEnvironmentForOperation` and
+  `afterExecuteIterationAsync`. One iteration can serve several concurrent requests. If every operation that
+  a request selects is up to date, the daemon aborts the iteration before it runs anything, so
+  `beforeExecuteIterationAsync` and the operation hooks don't fire. Don't rely on iteration hooks for
+  per-request work.
+- **Disposal:** the engine aborts `IOperationGraph.abortController`, cancels the current iteration, and then
+  closes every operation runner. Release resources from the abort signal or the runner's `closeAsync()`.
+
+Rules for a daemon-compatible plugin:
+
+- Don't change process globals: no writes to `process.env`, `process.exitCode`, the current directory or
+  `process.argv`, and no patching or clearing of global functions such as `setTimeout`. They belong to the
+  daemon and to every other request.
+- Keep request-specific state per iteration, not per process or per engine (session IDs, start times,
+  performance marks).
+- Never prompt. The daemon has no terminal; fail fast with a message that the requesting client sees, and
+  continue without the feature where possible.
+- Read the operation's environment (from `createEnvironmentForOperation`), not the daemon's `process.env`.
+- Write output through the session's logger. Output written while an iteration runs reaches that iteration's
+  clients, and output written while the engine is created reaches the request that created it; the daemon
+  drops output written between iterations.
+
+A plugin that taps `initialize` or `runAnyPhasedCommand` keeps an engine from serving any command other than the
+one that created it, unless the plugin is also declared command-agnostic: what it does from those hooks doesn't
+depend on the command. Its callbacks there, and the command hooks that they tap in turn (such as
+`createOperationsAsync` and `onGraphCreatedAsync`), don't read the command's name, its parameters, its phase
+selection or `isIncrementalBuildAllowed`. A plugin that only reads `isWatch`, for example, is command-agnostic.
+Rush's built-in build cache plugins declare this in their manifests. Declare a plugin the same three ways as
+above: `"daemonCommandAgnostic": true` in the manifest, the `rush.json` setting
+`"daemon": { "commandAgnosticPlugins": [...] }`, or `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS` in one shell. The
+same release rules apply: releases whose schemas predate these settings reject them, and then only the
+variable works, only for `rush-client`, and only with an engine that recognizes it. The declaration covers only
+the taps that the plugin's `apply()` adds; a tap added later, an interceptor on the hook, or a tap of
+`runPhasedCommand` still keeps the engine to its own command. When a plugin keeps an engine to its own command,
+a request of another command replaces the engine, or, for a `rush-client` custom command that neither engine
+could serve, falls back to native Rush with a message that names the plugin.
+Node.js loads a plugin's code only once, so the daemon treats the installed package folder of every configured
+plugin as part of its implementation: a change to a plugin's `.js` or `.json` files, including through a
+`link:` dependency, starts a new daemon for the next request. Declaration (`lib-dts`) and ES module (`lib-esm`)
+output folders are left out, because a plugin's CommonJS entry point doesn't load them.
+
+## Version skew and `RUSH_PREVIEW_VERSION`
+
+`rush-client` runs the daemon with its bundled engine only if that engine's version equals the selected Rush
+version (`RUSH_PREVIEW_VERSION`, otherwise `rushVersion` in `rush.json`). Today both are the same, so the
+snapshot's engine is used. If a release bumps `apps/rush` and `libraries/rush-lib` without updating
+`rushVersion`, the client instead looks for a daemon-capable published release of the selected version.
+None exists, so every build falls back to native Rush, with a `rush-client: ...; using in-process Rush.`
+message (see [Confirm](#4-confirm-that-the-daemon-served-the-build)).
+
+To keep dogfooding in that state, select the snapshot's exact version for `rush-client` invocations only:
+
+```bash
+DOGFOOD_VERSION=$(node -p "require('./common/temp/rush-daemon-dogfood/libraries/rush-lib/package.json').version")
+rush-client() { RUSH_DAEMON=1 RUSH_PREVIEW_VERSION="$DOGFOOD_VERSION" node "$DOGFOOD_SNAPSHOT/apps/rush-cli-client/bin/rush-client" "$@"; }
+```
+
+Side effects:
+
+- The build runs with the snapshot's engine rather than the repository's selected release.
+- `RUSH_PREVIEW_VERSION` is part of the daemon's identity and environment, so `rush-client daemon status`
+  and `rush-client daemon stop` address the matching daemon only when the same value is set.
+- A native fallback, including `--no-daemon`, also selects that version. Because it equals the snapshot's
+  own frontend version, the snapshot's source-built Rush runs in-process, printing the
+  `RUSH_PREVIEW_VERSION` warning banner, rather than the repository's selected release. Use ordinary
+  `node common/scripts/install-run-rush.js ...` for builds with the selected release.
+- Never export `RUSH_PREVIEW_VERSION` to ordinary `rush`; it would try to install that version from npm.
+
+## After a release contains the daemon
+
+Once a published Rush release includes the daemon, the standalone client, and the plugin narrowing that lets
+this repository's command-scoped plugin coexist with daemon builds:
+
+1. Update `rushVersion` in `rush.json` to that release (or a later one).
+2. Optionally add `"daemon": { "enabled": true }` to `rush.json`, so that `rush-client` uses the daemon
+   without `RUSH_DAEMON=1`. CI still stays in-process unless it sets `RUSH_DAEMON=1`, and `RUSH_DAEMON=0`
+   opts a shell out.
+3. Install the published client whose engine matches `rushVersion`, for example
+   `npm install --global @rushstack/rush-cli-client`, and run `rush-client` directly instead of the snapshot.
+4. Stop any snapshot daemon and delete `common/temp/rush-daemon-dogfood`. The `rush-daemon-dogfood`
+   deployment scenario remains useful for trying unreleased daemon changes.
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index b1664e9c731..9d00907aaac 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -24,19 +24,29 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON` | `0` | Opt into daemon execution through the separate clients. `0` disables it. Overrides `daemon.enabled`. |
 | `RUSH_DAEMON_AUTO_START` | `1` | Start an absent compatible daemon after daemon execution is selected. Does not itself opt in. Overrides `autoStart`. |
 | `RUSH_DAEMON_IDLE_TIMEOUT_SECONDS` | `900` | Shut down after the last pending request, output drain and cleanup are complete. Positive seconds, at most 2147483.647. Overrides `idleTimeoutSeconds`. |
-| `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | `30` | Maximum request admission wait. Nonnegative seconds, at most 2147483.647; converted to whole milliseconds by rounding down. Per-invocation `--wait-timeout` or `--no-wait` takes precedence. Overrides `queueTimeoutSeconds`. |
+| `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | `30` | Maximum request admission wait. Nonnegative seconds, at most 2147483.647; converted to whole milliseconds by rounding down. Time behind another request's load of the workspace graph (up to 10 times this value) does not count. Per-invocation `--wait-timeout` or `--no-wait` takes precedence. Overrides `queueTimeoutSeconds`. |
 | `RUSH_DAEMON_WATCH` | `0` | Observe requested warm projects between requests. Never schedules builds and does not enable `--watch` mode. Root/config guards and request-time input reconciliation remain active when disabled. Overrides `watch`. |
 | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | `0` | Enable explicitly configured `operationSettings[].daemonIpc` Node workers for supported incremental daemon builds. Does not convert arbitrary shell scripts into persistent workers. Overrides `usePersistentIpcRunners`. |
-| `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners, project watchers and results. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
-| `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work is exempt. Overrides `warmMemoryBudgetMB`. |
+| `RUSH_DAEMON_INCREMENTAL_BUILDS` | `1` | Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. `0` always runs the initial script. Incremental results are never written to the build cache. Overrides `incrementalBuilds`. |
+| `RUSH_DAEMON_WARM_WORKERS` | `0` | With `RUSH_DAEMON_INCREMENTAL_BUILDS`, keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and send it the next incremental run. The worker keeps its last build in memory, so it rebuilds only what changed. When an incremental run is not allowed, the worker is closed and the initial script runs, in a new worker if the project defines `<phase>:ipc`. Workers count toward `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` and `RUSH_DAEMON_WARM_SET_MAX_PROJECTS`. Over either limit the daemon closes them and drops their projects' last results, so raise both for the workers to stay alive. Overrides `warmWorkers`. |
+| `RUSH_DAEMON_JOIN_RUNNING_BATCH` | `0` | Experimental. Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Operations that both requests need run once. If the iteration can't take the request's work, for example because an operation that the request needs started before its inputs changed, the request waits for the iteration to end as before. Overrides `joinRunningBatch`. |
+| `RUSH_DAEMON_DEFER_CACHE_WRITES` | `0` | Let an operation of a daemon build complete before its build cache entry is written. The daemon clones the operation's output files and writes the entry from the clones in the background, so the operations that depend on it, and the command, don't wait for it. This needs a file system that can clone files (such as Btrfs, XFS or APFS); otherwise, and in cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be written in the background doesn't change the operation's status, a restore of the entry's key misses until the entry is written, and stopping the daemon drops the entries that aren't written yet. See [Deferred build cache writes](./dogfooding-rush-daemon.md#deferred-build-cache-writes). Overrides `deferCacheWrites`. |
+| `RUSH_DAEMON_BACKGROUND_PREPARE` | `0` | Experimental. When a watched workspace input changes so that the next request would reload the workspace graph, for example after an edit of `rush.json` or `common/config/rush/command-line.json`, let an idle daemon reload it and create the engine for the command line of the last phased command that it served, 2 seconds after the last change. It never runs an operation or restarts the daemon. It starts only while no request or served `rushx` script runs and no other Rush process holds the repository lock, and it takes that lock without waiting. A request with the same command line waits for it; any other request stops it at its next step and then runs as before. Overrides `backgroundPrepare`. |
+| `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
+| `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
 | `RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY` | `0` | Rank retention using measured time saved, frequency and memory, with conservative LRU fallback. Never speculatively executes scripts. Overrides `autoWarmByTelemetry`. |
+| `RUSH_DAEMON_COMPATIBLE_PLUGINS` | empty | Comma-separated `pluginName` values of configured Rush plugins that the repository has verified for long-lived daemon engines, in addition to plugins whose manifest sets `daemonCompatible`. Entries are trimmed; an empty entry is an error, and an empty value lists no plugins. Part of the daemon's environment identity. Overrides `compatiblePlugins`. See [Rush plugins in daemon engines](./dogfooding-rush-daemon.md#rush-plugins-in-daemon-engines). |
+| `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS` | empty | Comma-separated `pluginName` values of configured Rush plugins that the repository has verified to be command-agnostic, in addition to plugins whose manifest sets `daemonCommandAgnostic`. Their `initialize` and `runAnyPhasedCommand` taps then don't keep a daemon engine from serving other phased commands. Entries are trimmed; an empty entry is an error, and an empty value lists no plugins. Part of the daemon's environment identity. Overrides `commandAgnosticPlugins`. See [Rush plugins in daemon engines](./dogfooding-rush-daemon.md#rush-plugins-in-daemon-engines). |
 | `RUSH_DAEMON_EXPERIMENTAL` | `0` | Enable the experimental `rush-client daemon graph` command surface. Does not start a daemon or enable builds; no corresponding `rush.json` property. |
 
 The timeout maximum is the signed 32-bit millisecond limit used by Node.js `setTimeout`,
 expressed in seconds. The other numeric maximum is JavaScript's `Number.MAX_SAFE_INTEGER`.
 Warm policies affect footprint and latency, not build correctness.
 
+`RUSHD_TELEMETRY_TAG` labels the daemon's telemetry entry for one command with the caller's own tag. The
+daemon reads it from each request, so setting, changing or unsetting it never restarts the daemon.
+
 For example, in PowerShell with a matching daemon-capable Rush release installed:
 
 ```powershell
@@ -50,6 +60,11 @@ Environment-only opt-in avoids adding a `daemon` block that an older Rush schema
 `RUSH_PREVIEW_VERSION` continues to select the requested Rush engine; a matching daemon must
 actually be available. A client never relabels its bundled engine to satisfy a different version.
 
+Releases that predate these variables reject unknown `RUSH_` names. While a repository's `rushVersion`
+selects such a release, set `RUSH_DAEMON` only for `rush-client` invocations rather than exporting it
+to a shell that also runs ordinary `rush`. The [contributor dogfooding guide](./dogfooding-rush-daemon.md)
+shows this for the rushstack repository.
+
 See the [client configuration and management reference](../../apps/rush-cli-client/README.md)
 for launcher selection, lifecycle commands, persistent-worker restrictions and status fields.
 
diff --git a/docs/rush/plugin-migration-guide.md b/docs/rush/plugin-migration-guide.md
index 5ea09366bb3..961a2432f21 100644
--- a/docs/rush/plugin-migration-guide.md
+++ b/docs/rush/plugin-migration-guide.md
@@ -322,6 +322,8 @@ class MyRunner implements IOperationRunner {
 
 This is how `ShellOperationRunner` selects between the `initialCommand` and `incrementalCommand` scripts defined in `rush-project.json`.
 
+Outside watch mode, the Rush daemon can also give a runner a `lastState`, but `ShellOperationRunner` runs the incremental command there only when the operation's incremental execution guard allows it. A custom runner can use the same guard through `context.getIncrementalExecutionGuard?.()` and `context.reportCommandExecution?.()` (beta); the documentation of `getIncrementalExecutionGuard` gives the steps. Rush treats the outputs of a runner that doesn't report its commands as the outputs of its initial command, and may write them to the build cache, so such a runner must not run its incremental command outside watch mode.
+
 > **Note:** `lastState` is only populated if the operation reached a completed terminal state (`Success`, `SuccessWithWarning`, `Failure`, `FromCache`, or `NoOp`) in a prior iteration. If the previous iteration was aborted before the operation began executing, or if the operation was `Skipped` or `Blocked`, `lastState` will still be `undefined` on the next call. Runners must not assume that a non-`undefined` `lastState` means the previous run succeeded — check `lastState.status` if the prior outcome matters for your incremental logic.
 >
 > To request re-execution from a long-lived runner, use `context.getInvalidateCallback()` on the `IOperationRunnerContext` to obtain a `(reason: string) => void` callback. This is available from the very first call to `executeAsync`, regardless of whether a previous result exists.
diff --git a/heft-plugins/heft-lint-plugin/src/Eslint.ts b/heft-plugins/heft-lint-plugin/src/Eslint.ts
index 23c6e6fc5c8..9f85bb64839 100644
--- a/heft-plugins/heft-lint-plugin/src/Eslint.ts
+++ b/heft-plugins/heft-lint-plugin/src/Eslint.ts
@@ -523,10 +523,11 @@ export class Eslint extends LinterBase<TEslint.ESLint.LintResult | TEslintLegacy
   protected override hasLintFailures(
     lintResults: (TEslint.ESLint.LintResult | TEslintLegacy.ESLint.LintResult)[]
   ): boolean {
+    // ESLint's error and warning counts leave out suppressed messages (from eslint-disable comments and from bulk
+    // suppressions), so a file whose problems are all suppressed passes, and a file with any problem that isn't
+    // suppressed fails.
     return lintResults.some((lintResult: TEslint.ESLint.LintResult | TEslintLegacy.ESLint.LintResult) => {
-      return (
-        !lintResult.suppressedMessages?.length && (lintResult.errorCount > 0 || lintResult.warningCount > 0)
-      );
+      return lintResult.errorCount > 0 || lintResult.warningCount > 0;
     });
   }
 
diff --git a/heft-plugins/heft-lint-plugin/src/LintPlugin.ts b/heft-plugins/heft-lint-plugin/src/LintPlugin.ts
index b62d6afcea2..b1b4c825514 100644
--- a/heft-plugins/heft-lint-plugin/src/LintPlugin.ts
+++ b/heft-plugins/heft-lint-plugin/src/LintPlugin.ts
@@ -32,6 +32,7 @@ const FIX_PARAMETER_NAME: string = '--fix';
 
 interface ILintPluginOptions {
   alwaysFix?: boolean;
+  lintInWatchMode?: boolean;
   sarifLogPath?: string;
 }
 
@@ -64,6 +65,10 @@ function checkFix(taskSession: IHeftTaskSession, pluginOptions?: ILintPluginOpti
   return fix;
 }
 
+function getConfigFilePath(tsProgram: IExtendedProgram): string | undefined {
+  return tsProgram.getCompilerOptions().configFilePath as string | undefined;
+}
+
 function getSarifLogPath(
   heftConfiguration: HeftConfiguration,
   pluginOptions?: ILintPluginOptions
@@ -87,9 +92,10 @@ export default class LintPlugin implements IHeftTaskPlugin<ILintPluginOptions> {
     heftConfiguration: HeftConfiguration,
     pluginOptions?: ILintPluginOptions
   ): void {
-    // Disable linting in watch mode. Some lint rules require the context of multiple files, which
-    // may not be available in watch mode.
-    if (taskSession.parameters.watch) {
+    // Unless the "lintInWatchMode" option is set, disable linting in watch mode. Some lint rules require the
+    // context of multiple files, which may not be available in watch mode.
+    const { watch } = taskSession.parameters;
+    if (watch && !pluginOptions?.lintInWatchMode) {
       let warningPrinted: boolean = false;
       taskSession.hooks.run.tapPromise(PLUGIN_NAME, async () => {
         if (warningPrinted) {
@@ -111,6 +117,10 @@ export default class LintPlugin implements IHeftTaskPlugin<ILintPluginOptions> {
 
     // Use the changed files hook to collect the files and programs from TypeScript
     let typescriptChangedFiles: [IExtendedProgram, ReadonlySet<IExtendedSourceFile>][] = [];
+    // In watch mode, TypeScript reports a program only in the runs in which it emits that program. The latest
+    // program of each tsconfig file is linted again in the other runs, so that files with lint failures are
+    // reported again, as they would be by a run that is not in watch mode.
+    const lastProgramByConfigFilePath: Map<string | undefined, IExtendedProgram> = new Map();
     taskSession.requestAccessToPluginByName(
       TYPESCRIPT_PLUGIN_PACKAGE_NAME,
       TYPESCRIPT_PLUGIN_NAME,
@@ -137,6 +147,18 @@ export default class LintPlugin implements IHeftTaskPlugin<ILintPluginOptions> {
           taskSession
         );
         typescriptChangedFiles.push([tsProgram, new Set(tsProgram.getSourceFiles())]);
+      } else if (watch) {
+        const reportedConfigFilePaths: Set<string | undefined> = new Set(
+          typescriptChangedFiles.map(([tsProgram]) => getConfigFilePath(tsProgram))
+        );
+        for (const [configFilePath, tsProgram] of lastProgramByConfigFilePath) {
+          if (!reportedConfigFilePaths.has(configFilePath)) {
+            typescriptChangedFiles.push([tsProgram, new Set()]);
+          }
+        }
+        for (const [tsProgram] of typescriptChangedFiles) {
+          lastProgramByConfigFilePath.set(getConfigFilePath(tsProgram), tsProgram);
+        }
       }
 
       // Run the linters to completion. Linters emit errors and warnings to the logger.
diff --git a/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json b/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json
index 072d2c70df6..1304e3edc39 100644
--- a/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json
+++ b/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json
@@ -13,6 +13,12 @@
       "type": "boolean"
     },
 
+    "lintInWatchMode": {
+      "title": "Lint In Watch Mode",
+      "description": "If set to true, lint in watch mode too. Each run lints the files that TypeScript reports as changed and the files that had lint failures, as a run that is not in watch mode does. Defaults to false, which skips linting in watch mode.",
+      "type": "boolean"
+    },
+
     "sarifLogPath": {
       "title": "SARIF Log Path",
       "description": "If specified and using ESLint, a log describing the lint configuration and all messages (suppressed or not) will be emitted in the Static Analysis Results Interchange Format (https://sarifweb.azurewebsites.net/) at the provided path, relative to the project root.",
diff --git a/heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts b/heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts
new file mode 100644
index 00000000000..3005d850c3a
--- /dev/null
+++ b/heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts
@@ -0,0 +1,202 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import path from 'node:path';
+
+import type * as TEslint from 'eslint';
+import * as ts from 'typescript';
+
+import type { IScopedLogger } from '@rushstack/heft';
+import { FileSystem, Path } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { Eslint } from '../Eslint';
+import type { IExtendedProgram, IExtendedSourceFile } from '../internalTypings/TypeScriptInternals';
+
+const PROJECT_FOLDER: string = path.resolve(__dirname, '../..');
+const FIXTURE_FOLDER: string = `${PROJECT_FOLDER}/temp/test/eslint-lint-cache`;
+// ESLint 9 loads its configuration with a dynamic import, which Jest doesn't support without
+// --experimental-vm-modules. So these tests load a stand-in for the ESLint package from a path that doesn't exist.
+const FAKE_ESLINT_PATH: string = `${FIXTURE_FOLDER}/node_modules/eslint`;
+
+const SOURCE: string = 'let a: any = 1;\nexport const b = a | 2;\n';
+
+const PREFER_CONST_WARNING: TEslint.Linter.LintMessage = {
+  ruleId: 'prefer-const',
+  severity: 1,
+  message: "'a' is never reassigned. Use 'const' instead.",
+  line: 1,
+  column: 5
+};
+
+const NO_BITWISE_ERROR: TEslint.Linter.LintMessage = {
+  ruleId: 'no-bitwise',
+  severity: 2,
+  message: "Unexpected use of '|'.",
+  line: 2,
+  column: 18
+};
+
+// With ESLint 9.37 or newer, @rushstack/eslint-patch adds a bulk suppression to the problem's suppressions, as an
+// eslint-disable comment does. So ESLint reports the problem in `suppressedMessages` instead of `messages`.
+const BULK_SUPPRESSED_ERROR: TEslint.Linter.SuppressedLintMessage = {
+  ruleId: '@typescript-eslint/no-explicit-any',
+  severity: 2,
+  message: 'Unexpected any. Specify a different type.',
+  line: 1,
+  column: 8,
+  suppressions: [{ kind: 'bulk', justification: '' }]
+};
+
+// The messages that the stand-in reports for every file that it lints.
+let fakeMessages: TEslint.Linter.LintMessage[] = [];
+let fakeSuppressedMessages: TEslint.Linter.SuppressedLintMessage[] = [];
+
+// The method names are ESLint's, so they don't end in "Async".
+/* eslint-disable @typescript-eslint/naming-convention */
+class FakeESLint {
+  public static readonly version: string = '9.37.0';
+
+  public async lintText(text: string, options: { filePath: string }): Promise<TEslint.ESLint.LintResult[]> {
+    // Like ESLint, count only the messages that aren't suppressed.
+    return [
+      {
+        filePath: options.filePath,
+        messages: fakeMessages,
+        suppressedMessages: fakeSuppressedMessages,
+        errorCount: fakeMessages.filter((message) => message.severity === 2).length,
+        fatalErrorCount: 0,
+        warningCount: fakeMessages.filter((message) => message.severity === 1).length,
+        fixableErrorCount: 0,
+        fixableWarningCount: 0,
+        usedDeprecatedRules: []
+      }
+    ];
+  }
+
+  public async calculateConfigForFile(): Promise<object> {
+    return {};
+  }
+
+  public async isPathIgnored(): Promise<boolean> {
+    return false;
+  }
+}
+/* eslint-enable @typescript-eslint/naming-convention */
+
+jest.doMock(FAKE_ESLINT_PATH, () => ({ ESLint: FakeESLint }), { virtual: true });
+// Eslint.initializeAsync() replaces the timer in this module before it loads the package.
+jest.doMock(`${FAKE_ESLINT_PATH}/lib/linter/timing`, () => ({ enabled: false }), { virtual: true });
+
+interface ILintRun {
+  lintedFileCounts: number[];
+  reports: string[];
+}
+
+function createProgram(): IExtendedProgram {
+  const filePath: string = `${FIXTURE_FOLDER}/src/a.ts`;
+  FileSystem.writeFile(filePath, SOURCE, { ensureFolderExists: true });
+  return ts.createProgram({
+    rootNames: [filePath],
+    options: {
+      configFilePath: `${FIXTURE_FOLDER}/tsconfig.json`,
+      noEmit: true,
+      types: []
+    }
+  }) as IExtendedProgram;
+}
+
+// Lints the program as one heft run does: a new linter reads the lint cache that the previous run wrote.
+async function lintAsync(
+  program: IExtendedProgram,
+  changedFiles: readonly IExtendedSourceFile[]
+): Promise<ILintRun> {
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const reports: string[] = [];
+  const logger: Partial<IScopedLogger> = {
+    terminal: new Terminal(terminalProvider),
+    emitError: (error: Error) => reports.push(`error ${error.message}`),
+    emitWarning: (warning: Error) => reports.push(`warning ${warning.message}`)
+  };
+
+  const linter: Eslint = await Eslint.initializeAsync({
+    scopedLogger: logger as IScopedLogger,
+    buildFolderPath: FIXTURE_FOLDER,
+    buildMetadataFolderPath: `${FIXTURE_FOLDER}/temp/lint`,
+    linterToolPath: FAKE_ESLINT_PATH,
+    linterConfigFilePath: `${FIXTURE_FOLDER}/eslint.config.js`,
+    tsProgram: program
+  });
+  const typeScriptFilenames: Set<string> = new Set(
+    program
+      .getRootFileNames()
+      .map((fileName: string) => Path.convertToSlashes(path.resolve(FIXTURE_FOLDER, fileName)))
+  );
+  await linter.performLintingAsync({
+    tsProgram: program,
+    typeScriptFilenames,
+    allProgramFilenames: typeScriptFilenames,
+    changedFiles: new Set(changedFiles)
+  });
+
+  const lintedFileCounts: number[] = Array.from(
+    terminalProvider.getVerboseOutput().matchAll(/Lint: [\d.]+ms \((\d+) files\)/g),
+    (match) => Number(match[1])
+  );
+  return { lintedFileCounts, reports };
+}
+
+describe('Eslint lint cache', () => {
+  beforeEach(() => {
+    FileSystem.ensureEmptyFolder(FIXTURE_FOLDER);
+    fakeMessages = [];
+    fakeSuppressedMessages = [];
+  });
+
+  it.each([
+    {
+      failure: 'a warning',
+      message: PREFER_CONST_WARNING,
+      report: "warning (prefer-const) 'a' is never reassigned. Use 'const' instead."
+    },
+    {
+      failure: 'an error',
+      message: NO_BITWISE_ERROR,
+      report: "error (no-bitwise) Unexpected use of '|'."
+    }
+  ])(
+    'lints a file again, and reports $failure again, when the file also has a suppressed message',
+    async ({ message, report }) => {
+      fakeMessages = [message];
+      fakeSuppressedMessages = [BULK_SUPPRESSED_ERROR];
+      const program: IExtendedProgram = createProgram();
+
+      expect(await lintAsync(program, program.getSourceFiles())).toEqual({
+        lintedFileCounts: [1],
+        reports: [report]
+      });
+
+      // Nothing changed, so TypeScript reports no changed files. The file has a lint failure, so it isn't in the
+      // lint cache: it's linted again, and the failure is reported again.
+      expect(await lintAsync(program, [])).toEqual({
+        lintedFileCounts: [1],
+        reports: [report]
+      });
+    }
+  );
+
+  it('caches a file whose messages are all suppressed', async () => {
+    fakeSuppressedMessages = [BULK_SUPPRESSED_ERROR];
+    const program: IExtendedProgram = createProgram();
+
+    expect(await lintAsync(program, program.getSourceFiles())).toEqual({
+      lintedFileCounts: [1],
+      reports: []
+    });
+
+    expect(await lintAsync(program, [])).toEqual({
+      lintedFileCounts: [0],
+      reports: []
+    });
+  });
+});
diff --git a/heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts b/heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts
new file mode 100644
index 00000000000..6fd91681425
--- /dev/null
+++ b/heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts
@@ -0,0 +1,245 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// ESLint 9 loads its configuration with a dynamic import, which Jest doesn't support without
+// --experimental-vm-modules. This linter reports every file that contains "debugger" instead, and it keeps the
+// real LinterBase, which decides which files to lint.
+jest.mock('../Eslint', () => {
+  const { LinterBase } = jest.requireActual<{ LinterBase: typeof LinterBaseType }>('../LinterBase');
+
+  class MockEslint extends LinterBase<string> {
+    public constructor(options: ILinterBaseOptions) {
+      super('eslint', options);
+    }
+
+    public static async resolveEslintConfigFilePathAsync(
+      heftConfiguration: HeftConfiguration
+    ): Promise<string> {
+      return `${heftConfiguration.buildFolderPath}/eslint.config.js`;
+    }
+
+    public static async initializeAsync(options: ILinterBaseOptions): Promise<MockEslint> {
+      return new MockEslint(options);
+    }
+
+    public printVersionHeader(): void {
+      // Nothing to print
+    }
+
+    protected async getCacheVersionAsync(): Promise<string> {
+      return 'mock';
+    }
+
+    protected async lintFileAsync(sourceFile: IExtendedSourceFile | ISourceFileToLint): Promise<string[]> {
+      return sourceFile.text.includes('debugger') ? [sourceFile.fileName] : [];
+    }
+
+    protected async lintingFinishedAsync(lintResults: string[]): Promise<void> {
+      for (const fileName of lintResults) {
+        this._scopedLogger.emitError(new Error(`(no-debugger) ${fileName}`));
+      }
+    }
+
+    protected hasLintFailures(lintResults: string[]): boolean {
+      return lintResults.length > 0;
+    }
+
+    protected async isFileExcludedAsync(): Promise<boolean> {
+      return false;
+    }
+  }
+
+  return { Eslint: MockEslint };
+});
+
+import path from 'node:path';
+
+import * as ts from 'typescript';
+
+import type {
+  HeftConfiguration,
+  IHeftTaskRunHookOptions,
+  IHeftTaskSession,
+  IScopedLogger
+} from '@rushstack/heft';
+import type { IChangedFilesHookOptions, ITypeScriptPluginAccessor } from '@rushstack/heft-typescript-plugin';
+import { AlreadyReportedError, FileSystem } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import LintPlugin from '../LintPlugin';
+import type { ILinterBaseOptions, ISourceFileToLint, LinterBase as LinterBaseType } from '../LinterBase';
+import type { IExtendedProgram, IExtendedSourceFile } from '../internalTypings/TypeScriptInternals';
+
+const PROJECT_FOLDER: string = path.resolve(__dirname, '../..');
+const FIXTURE_FOLDER: string = `${PROJECT_FOLDER}/temp/test/lint-plugin-watch`;
+const FAILING_SOURCE: string = 'export function a() {\n  debugger;\n}\n';
+const PASSING_SOURCE: string = 'export function a() {\n  return;\n}\n';
+
+interface IWatchSession {
+  readonly taskSession: IHeftTaskSession;
+  readonly heftConfiguration: HeftConfiguration;
+  readonly terminalProvider: StringBufferTerminalProvider;
+  readonly errors: Error[];
+  readonly requestedPluginNames: string[];
+  reportProgram(program: IExtendedProgram, changedFileNames: string[]): void;
+  runAsync(): Promise<void>;
+}
+
+function createWatchSession(): IWatchSession {
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const terminal: Terminal = new Terminal(terminalProvider);
+  const errors: Error[] = [];
+  const logger: Partial<IScopedLogger> = {
+    terminal,
+    get hasErrors(): boolean {
+      return errors.length > 0;
+    },
+    emitError: (error: Error) => errors.push(error),
+    emitWarning: () => undefined,
+    resetErrorsAndWarnings: () => {
+      errors.length = 0;
+    }
+  };
+
+  const runHooks: ((options: IHeftTaskRunHookOptions) => Promise<void>)[] = [];
+  const changedFilesListeners: ((options: IChangedFilesHookOptions) => void)[] = [];
+  const requestedPluginNames: string[] = [];
+  const taskSession: Partial<IHeftTaskSession> = {
+    logger: logger as IScopedLogger,
+    tempFolderPath: `${FIXTURE_FOLDER}/temp/lint`,
+    parameters: {
+      watch: true,
+      production: false,
+      getFlagParameter: () => ({ value: false })
+    } as unknown as IHeftTaskSession['parameters'],
+    hooks: {
+      run: {
+        tapPromise: (name: string, fn: (options: IHeftTaskRunHookOptions) => Promise<void>) => {
+          runHooks.push(fn);
+        }
+      }
+    } as unknown as IHeftTaskSession['hooks'],
+    requestAccessToPluginByName: ((
+      pluginPackageName: string,
+      pluginName: string,
+      callback: (accessor: ITypeScriptPluginAccessor) => void
+    ) => {
+      requestedPluginNames.push(pluginName);
+      callback({
+        onChangedFilesHook: {
+          tap: (name: string, fn: (options: IChangedFilesHookOptions) => void) => {
+            changedFilesListeners.push(fn);
+          }
+        }
+      } as unknown as ITypeScriptPluginAccessor);
+    }) as IHeftTaskSession['requestAccessToPluginByName']
+  };
+
+  const heftConfiguration: Partial<HeftConfiguration> = {
+    buildFolderPath: FIXTURE_FOLDER,
+    rigPackageResolver: {
+      resolvePackageAsync: async (packageName: string) => `${FIXTURE_FOLDER}/node_modules/${packageName}`
+    } as unknown as HeftConfiguration['rigPackageResolver']
+  };
+
+  return {
+    taskSession: taskSession as IHeftTaskSession,
+    heftConfiguration: heftConfiguration as HeftConfiguration,
+    terminalProvider,
+    errors,
+    requestedPluginNames,
+    reportProgram: (program: IExtendedProgram, changedFileNames: string[]) => {
+      const changedFiles: Set<ts.SourceFile> = new Set(
+        changedFileNames.map((fileName: string) => program.getSourceFile(fileName)!)
+      );
+      for (const listener of changedFilesListeners) {
+        listener({ program, changedFiles } as IChangedFilesHookOptions);
+      }
+    },
+    // Like Heft's task runner: reset the logger, then run the task's run hooks.
+    runAsync: async () => {
+      logger.resetErrorsAndWarnings!();
+      const options: IHeftTaskRunHookOptions = {
+        abortSignal: new AbortController().signal
+      } as IHeftTaskRunHookOptions;
+      await Promise.all(runHooks.map((runHook) => runHook(options)));
+    }
+  };
+}
+
+function writeSourceFile(name: string, text: string): string {
+  const filePath: string = `${FIXTURE_FOLDER}/src/${name}`;
+  FileSystem.writeFile(filePath, text, { ensureFolderExists: true });
+  return filePath;
+}
+
+function createProgram(rootNames: string[]): IExtendedProgram {
+  return ts.createProgram({
+    rootNames,
+    options: {
+      configFilePath: `${FIXTURE_FOLDER}/tsconfig.json`,
+      noEmit: true,
+      types: []
+    }
+  }) as IExtendedProgram;
+}
+
+function getLintedFileCounts(verboseOutput: string): number[] {
+  return Array.from(verboseOutput.matchAll(/Lint: [\d.]+ms \((\d+) files\)/g), (match) => Number(match[1]));
+}
+
+describe('LintPlugin in watch mode', () => {
+  beforeEach(() => {
+    FileSystem.ensureEmptyFolder(FIXTURE_FOLDER);
+  });
+
+  it('does not lint unless the lintInWatchMode option is set', async () => {
+    const session: IWatchSession = createWatchSession();
+    new LintPlugin().apply(session.taskSession, session.heftConfiguration, {});
+
+    await session.runAsync();
+    await session.runAsync();
+
+    expect(session.requestedPluginNames).toEqual([]);
+    expect(session.terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false })).toBe(
+      "Linting isn't currently supported in watch mode\n"
+    );
+  });
+
+  it('with the lintInWatchMode option, reports lint failures in every run until they are fixed', async () => {
+    const session: IWatchSession = createWatchSession();
+    new LintPlugin().apply(session.taskSession, session.heftConfiguration, { lintInWatchMode: true });
+    expect(session.requestedPluginNames).toEqual(['typescript-plugin']);
+
+    const aPath: string = writeSourceFile('a.ts', FAILING_SOURCE);
+    const bPath: string = writeSourceFile('b.ts', 'export const b = 1;\n');
+
+    // The first run lints the files that TypeScript emitted.
+    session.reportProgram(createProgram([aPath, bPath]), [aPath, bPath]);
+    await expect(session.runAsync()).rejects.toBeInstanceOf(AlreadyReportedError);
+    expect(session.errors.map(String)).toEqual([expect.stringContaining('(no-debugger)')]);
+
+    // TypeScript emits nothing, e.g. because only a file that it doesn't compile changed. The file with the
+    // lint failure is linted again, and the failure is reported again.
+    let verboseOutputLength: number = session.terminalProvider.getVerboseOutput().length;
+    await expect(session.runAsync()).rejects.toBeInstanceOf(AlreadyReportedError);
+    expect(session.errors.map(String)).toEqual([expect.stringContaining('(no-debugger)')]);
+    expect(
+      getLintedFileCounts(session.terminalProvider.getVerboseOutput().slice(verboseOutputLength))
+    ).toEqual([1]);
+
+    // Fixing the failure makes the next run pass.
+    writeSourceFile('a.ts', PASSING_SOURCE);
+    session.reportProgram(createProgram([aPath, bPath]), [aPath]);
+    await session.runAsync();
+    expect(session.errors).toEqual([]);
+
+    // Now every file is in the linter's cache, so a run in which TypeScript emits nothing lints no files.
+    verboseOutputLength = session.terminalProvider.getVerboseOutput().length;
+    await session.runAsync();
+    expect(session.errors).toEqual([]);
+    expect(
+      getLintedFileCounts(session.terminalProvider.getVerboseOutput().slice(verboseOutputLength))
+    ).toEqual([0]);
+  }, 60_000);
+});
diff --git a/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts b/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts
index 6b57c2d3fda..6dc03a12991 100644
--- a/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts
+++ b/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts
@@ -4,6 +4,8 @@
 import Watchpack, { type WatchOptions } from 'watchpack';
 import type { Compiler, RspackPluginInstance, WatchFileSystem } from '@rspack/core';
 
+import { _waitForWatchpackPendingEventsAsync } from '@rushstack/heft';
+
 // InputFileSystem type is defined inline since it's not exported from @rspack/core
 // missing re-export here: https://github.com/web-infra-dev/rspack/blob/9542b49ad43f91ecbcb37ff277e0445e67b99967/packages/rspack/src/exports.ts#L133
 // type definition here: https://github.com/web-infra-dev/rspack/blob/9542b49ad43f91ecbcb37ff277e0445e67b99967/packages/rspack/src/util/fs.ts#L496
@@ -54,6 +56,7 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
 
   readonly #onChange: () => void;
   #state: IWatchState | undefined;
+  #isFlushing: boolean = false;
 
   public constructor(inputFileSystem: InputFileSystem, onChange: () => void) {
     this.inputFileSystem = inputFileSystem;
@@ -106,6 +109,40 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     return false;
   }
 
+  /**
+   * Like {@link DeferredWatchFileSystem.flush}, but first lets watchpack finish recording the file system events
+   * that it has already received.
+   *
+   * @remarks
+   * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a file that an upstream
+   * task wrote just before a call to `flush()` can be missing from the changes. This method waits until the
+   * directory watchers have no events or scans in progress, for up to 1 second. If there are changes, it then
+   * waits for the clock to pass the time when they were recorded. The compilation that the callback starts takes
+   * its start time from the clock, and the next `watch()` call reports every change recorded at or after that
+   * start time again, as "outdated on attach".
+   *
+   * While this method waits, it keeps the changes that the watcher reports for the flush, and doesn't call
+   * `onChange` for them.
+   */
+  public async flushAsync(): Promise<boolean> {
+    if (!this.#state) {
+      return false;
+    }
+
+    this.#isFlushing = true;
+    try {
+      await this.#waitForPendingEventsAsync();
+      if (!this.watcher) {
+        // The watcher was closed while this method waited.
+        return false;
+      }
+
+      return this.flush();
+    } finally {
+      this.#isFlushing = false;
+    }
+  }
+
   public watch(
     files: Iterable<string>,
     directories: Iterable<string>,
@@ -138,7 +175,11 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
         removals.add(removal);
       }
 
-      this.#onChange();
+      // flushAsync() passes these changes to the callback when it finishes waiting, so they don't need
+      // another run.
+      if (!this.#isFlushing) {
+        this.#onChange();
+      }
     });
 
     this.watcher.watch({
@@ -187,6 +228,22 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     };
   }
 
+  async #waitForPendingEventsAsync(): Promise<void> {
+    await _waitForWatchpackPendingEventsAsync(
+      () => this.watcher,
+      () => this.#hasChanges()
+    );
+  }
+
+  #hasChanges(): boolean {
+    const state: IWatchState | undefined = this.#state;
+    const watcher: Watchpack | undefined = this.watcher;
+    return (
+      (!!state && (state.changes.size > 0 || state.removals.size > 0)) ||
+      (!!watcher && (watcher.aggregatedChanges.size > 0 || watcher.aggregatedRemovals.size > 0))
+    );
+  }
+
   #fetchTimeInfo(): ITimeInfoEntries {
     const fileTimeInfoEntries: IRawFileSystemMap = new Map();
     const contextTimeInfoEntries: IRawFileSystemMap = new Map();
diff --git a/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts b/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts
index 06ca57fae65..e5611ca5dcf 100644
--- a/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts
+++ b/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts
@@ -415,7 +415,8 @@ export default class RspackPlugin implements IHeftTaskPlugin<IRspackPluginOption
     if (!isInitial && this.#watchFileSystems) {
       hasChanges = false;
       for (const watchFileSystem of this.#watchFileSystems) {
-        hasChanges = watchFileSystem.flush() || hasChanges;
+        // The upstream tasks may have just written files that the watcher has seen but not recorded yet.
+        hasChanges = (await watchFileSystem.flushAsync()) || hasChanges;
       }
     }
 
diff --git a/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
new file mode 100644
index 00000000000..910ae68c014
--- /dev/null
+++ b/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -0,0 +1,392 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as child_process from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import type { WatchOptions } from 'watchpack';
+
+import { DeferredWatchFileSystem, type InputFileSystem, type Watcher } from '../DeferredWatchFileSystem';
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that these tests read or set.
+ */
+interface IDirectoryWatcherInternals {
+  scanning: boolean;
+  _activeEvents: Map<string, boolean>;
+}
+
+interface IFlush {
+  changes: string[];
+  removals: string[];
+}
+
+// On Linux, inotify queues the event for a write during the write, so the event loop delivers it on its next poll.
+// Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+// Windows has no FIFOs, so there holdThreadPool() gives each thread about 100 ms of work instead, which can take
+// longer than flushAsync() waits on a machine whose CPUs are busy.
+const PBKDF2_ITERATIONS: number = 200000;
+
+describe(DeferredWatchFileSystem.name, () => {
+  let fifoPath: string | undefined;
+  let folder: string;
+  let watchOptions: WatchOptions;
+  let onChange: jest.Mock<void, []>;
+  let purge: jest.Mock<void, [string]>;
+  let watchFileSystem: DeferredWatchFileSystem;
+  let watcher: Watcher | undefined;
+  let flushes: IFlush[];
+  let compilationStartTimes: number[];
+  let releaseThreadPoolAsync: (() => Promise<void>) | undefined;
+
+  beforeAll(() => {
+    if (process.platform !== 'win32') {
+      const fifoFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-rspack-plugin-test-fifo-'));
+      fifoPath = path.join(fifoFolder, 'fifo');
+      child_process.execFileSync('mkfifo', [fifoPath]);
+    }
+  });
+
+  afterAll(() => {
+    if (fifoPath) {
+      // Not fs.rmSync(), which calls lstat on the FIFO. Until the next stat call, Node's fs.realpathSync() then
+      // returns some paths with their symlinks unresolved, and jest fails to require() a package that pnpm linked.
+      fs.unlinkSync(fifoPath);
+      fs.rmdirSync(path.dirname(fifoPath));
+    }
+  });
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-rspack-plugin-test-'));
+    watchOptions = { aggregateTimeout: 20 };
+    onChange = jest.fn();
+    purge = jest.fn();
+    watchFileSystem = new DeferredWatchFileSystem({ purge } as unknown as InputFileSystem, onChange);
+    watcher = undefined;
+    flushes = [];
+    compilationStartTimes = [];
+    releaseThreadPoolAsync = undefined;
+  });
+
+  afterEach(async () => {
+    // For a test that failed while it held the thread pool
+    await releaseThreadPoolAsync?.();
+    watcher?.close();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createFile(name: string): string {
+    const filePath: string = path.join(folder, name);
+    fs.writeFileSync(filePath, 'initial');
+    // An old modification time, so that the first scan doesn't report the file as changed.
+    const past: Date = new Date(Date.now() - 60000);
+    fs.utimesSync(filePath, past, past);
+    return filePath;
+  }
+
+  /**
+   * Watches the files as Rspack's `Watching` does. When a flush calls back, the callback takes the start time for
+   * the next watch() from the clock and pauses the watcher, as `Watching.#go()` does.
+   */
+  function watch(files: string[], startTime: number): void {
+    watcher = watchFileSystem.watch(
+      files,
+      [],
+      [],
+      startTime,
+      watchOptions,
+      (error, fileTimeInfoEntries, contextTimeInfoEntries, changes, removals) => {
+        compilationStartTimes.push(Date.now());
+        watcher?.pause();
+        flushes.push({
+          changes: Array.from(changes ?? []).sort(),
+          removals: Array.from(removals ?? []).sort()
+        });
+      },
+      () => {
+        // Rspack's undelayed callback isn't used.
+      }
+    );
+  }
+
+  function getDirectoryWatchers(): IDirectoryWatcherInternals[] {
+    const internals: { watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> } } =
+      watchFileSystem.watcher as unknown as {
+        watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> };
+      };
+    return Array.from(internals.watcherManager.directoryWatchers.values());
+  }
+
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = performance.now() + 5000;
+    while (!condition()) {
+      if (performance.now() > deadline) {
+        throw new Error('The condition was not met within 5 seconds');
+      }
+      await setImmediateAsync();
+    }
+  }
+
+  async function watchAndWaitForScanAsync(files: string[]): Promise<void> {
+    watch(files, Date.now());
+    await waitForAsync(() => getDirectoryWatchers().every((directoryWatcher) => !directoryWatcher.scanning));
+  }
+
+  /**
+   * Holds every thread of the thread pool until the returned function releases them, so that the `fs.readdir()`
+   * and `fs.lstat()` calls that the watcher makes next wait in the queue. The returned function resolves when the
+   * threads are free again. On Windows, the threads are only busy for a while (see `PBKDF2_ITERATIONS`).
+   */
+  function holdThreadPool(): () => Promise<void> {
+    const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const releaseAsync: () => Promise<void> = fifoPath
+      ? holdThreadPoolWithFifo(fifoPath, threadCount)
+      : keepThreadPoolBusy(threadCount);
+    let releasePromise: Promise<void> | undefined;
+    releaseThreadPoolAsync = () => (releasePromise ??= releaseAsync());
+    return releaseThreadPoolAsync;
+  }
+
+  function holdThreadPoolWithFifo(fifo: string, threadCount: number): () => Promise<void> {
+    // Opening a FIFO for reading blocks the thread until something opens the FIFO for writing.
+    const fdPromises: Promise<number>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      fdPromises.push(
+        new Promise<number>((resolve, reject) => {
+          fs.open(fifo, 'r', (error, fd) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve(fd);
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      // Opening a FIFO for both reading and writing doesn't block on Linux or macOS, and it releases the threads.
+      // The FIFO stays open until every thread has opened it, so that none of them blocks again.
+      const writerFd: number = fs.openSync(fifo, 'r+');
+      try {
+        for (const fd of await Promise.all(fdPromises)) {
+          fs.closeSync(fd);
+        }
+      } finally {
+        fs.closeSync(writerFd);
+      }
+    };
+  }
+
+  function keepThreadPoolBusy(threadCount: number): () => Promise<void> {
+    const tasks: Promise<void>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      tasks.push(
+        new Promise<void>((resolve, reject) => {
+          crypto.pbkdf2('password', 'salt', PBKDF2_ITERATIONS, 64, 'sha512', (error) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve();
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      await Promise.all(tasks);
+    };
+  }
+
+  /**
+   * Waits until a `flushAsync()` call that was just made is waiting for pending events. It checks for them for the
+   * first time on the second turn of the event loop after the call, so after three turns it is waiting.
+   */
+  async function waitForFlushToWaitAsync(): Promise<void> {
+    for (let i: number = 0; i < 3; i++) {
+      await setImmediateAsync();
+    }
+  }
+
+  it('returns false before watch() is called', async () => {
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+  });
+
+  it('returns false and calls back nothing when nothing changed', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+
+    await setTimeoutAsync(50);
+    expect(flushes).toEqual([]);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file that was written just before the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    expect(purge).toHaveBeenCalledWith(file);
+    await setTimeoutAsync(50);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    fs.writeFileSync(file, 'changed');
+    await waitForAsync(() =>
+      getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
+    );
+    expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    // An fs callback runs in the poll phase, after the event loop has collected the events that were ready, so
+    // the event for this write can't arrive before the next poll phase.
+    const flushPromise: Promise<boolean> = new Promise<boolean>((resolve, reject) => {
+      fs.stat(file, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          fs.writeFileSync(file, 'changed');
+          resolve(watchFileSystem.flushAsync());
+        }
+      });
+    });
+
+    await expect(flushPromise).resolves.toBe(true);
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux(
+    'keeps the changes that the watcher reports while it waits, without calling onChange',
+    async () => {
+      const fileA: string = createFile('a.js');
+      const fileB: string = createFile('b.js');
+      await watchAndWaitForScanAsync([fileA, fileB]);
+      let aggregatedCount: number = 0;
+      watchFileSystem.watcher!.on('aggregated', () => {
+        aggregatedCount++;
+      });
+
+      fs.writeFileSync(fileA, 'changed');
+      await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
+      const releaseAsync: () => Promise<void> = holdThreadPool();
+      fs.writeFileSync(fileB, 'changed');
+      const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      await waitForAsync(() => aggregatedCount > 0);
+      await releaseAsync();
+      await expect(flushPromise).resolves.toBe(true);
+
+      expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  itOnLinux(
+    'starts the compilation after the changes it passes, so the next watch() does not report them again',
+    async () => {
+      const file: string = createFile('a.js');
+      await watchAndWaitForScanAsync([file]);
+
+      const reportedAgain: number[] = [];
+      for (let i: number = 0; i < 10; i++) {
+        fs.writeFileSync(file, `change ${i}`);
+        await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(file));
+        await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+        // When the compilation is done, Rspack's Watching calls watch() again with the start time that it took when
+        // the flush called back. The new watcher reports every change that was recorded at or after that time, as
+        // "outdated on attach".
+        watch([file], compilationStartTimes[i]);
+        await setImmediateAsync();
+        reportedAgain.push(watchFileSystem.watcher!.aggregatedChanges.size);
+      }
+
+      expect(reportedAgain).toEqual(new Array(10).fill(0));
+      expect(flushes).toHaveLength(10);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  it('includes a change that a scan in progress finds', async () => {
+    const subfolder: string = path.join(folder, 'sub');
+    fs.mkdirSync(subfolder);
+    const file: string = path.join(subfolder, 'a.js');
+    fs.writeFileSync(file, 'new');
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    // A start time before the file was written, as for a file that changed during the compilation.
+    watch([file], Date.now() - 60000);
+    expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  it('returns false when the watcher is closed while it waits', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    watcher!.close();
+
+    await expect(flushPromise).resolves.toBe(false);
+    expect(flushes).toEqual([]);
+  });
+
+  it('stops waiting after 1 second', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const directoryWatcher: IDirectoryWatcherInternals = getDirectoryWatchers()[0];
+    // An event whose fs.lstat() never finishes
+    directoryWatcher._activeEvents.set('never-finishes.js', false);
+
+    try {
+      const startTime: number = performance.now();
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+      const elapsedMs: number = performance.now() - startTime;
+
+      expect(elapsedMs).toBeGreaterThanOrEqual(999);
+      expect(elapsedMs).toBeLessThan(3000);
+    } finally {
+      directoryWatcher._activeEvents.delete('never-finishes.js');
+    }
+  });
+});
diff --git a/heft-plugins/heft-typescript-plugin/package.json b/heft-plugins/heft-typescript-plugin/package.json
index bfd8ef7ec42..504dba43403 100644
--- a/heft-plugins/heft-typescript-plugin/package.json
+++ b/heft-plugins/heft-typescript-plugin/package.json
@@ -43,7 +43,8 @@
     "build": "heft test --clean",
     "start": "heft build-watch",
     "_phase:build": "heft run --only build -- --clean",
-    "_phase:pack": "rush-pnpm pack"
+    "_phase:pack": "rush-pnpm pack",
+    "_phase:test": "heft run --only test -- --clean"
   },
   "peerDependencies": {
     "@rushstack/heft": "1.3.2"
diff --git a/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts b/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts
index 6b6e758434b..b01ebc3c61e 100644
--- a/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts
+++ b/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts
@@ -26,6 +26,7 @@ import type {
   ITypescriptWorkerData
 } from './types';
 import { configureProgramForMultiEmit } from './configureProgramForMultiEmit';
+import { createSystemWithExistenceAwareWatchFile } from './existenceAwareWatchFile';
 import { loadTsconfig } from './tsconfigLoader';
 import { loadTypeScriptToolAsync } from './loadTypeScriptTool';
 
@@ -253,12 +254,11 @@ export class TypeScriptBuilder {
       const getCurrentDirectory: () => string = () => this.#configuration.buildFolderPath;
 
       // Need to also update watchFile and watchDirectory
-      const system: ITypeScriptNodeSystem = {
-        ...baseSystem,
+      const system: ITypeScriptNodeSystem = createSystemWithExistenceAwareWatchFile(ts, baseSystem, {
         getCurrentDirectory,
         clearTimeout,
         setTimeout
-      };
+      });
       const { realpath } = system;
 
       if (realpath && system.getAccessibleFileSystemEntries) {
diff --git a/heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts b/heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts
new file mode 100644
index 00000000000..3eaa757b0e2
--- /dev/null
+++ b/heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts
@@ -0,0 +1,132 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as TTypescript from 'typescript';
+
+/**
+ * The type of `TTypescript.System.watchFile`.
+ */
+export type WatchFileFunction = NonNullable<TTypescript.System['watchFile']>;
+
+/**
+ * The parts of the TypeScript API that {@link createExistenceAwareWatchFile} uses. TypeScript 3.7 and older have no
+ * `WatchFileKind`.
+ */
+export type ExistenceAwareWatchFileTypeScript = Pick<typeof TTypescript, 'FileWatcherEventKind'> &
+  Partial<Pick<typeof TTypescript, 'WatchFileKind'>>;
+
+// TypeScript's `PollingInterval.Medium`, which it uses for missing files. Only used if the caller passes no interval.
+const DEFAULT_MISSING_FILE_POLLING_INTERVAL_MS: number = 500;
+
+/**
+ * Wraps a TypeScript system's `watchFile`, so that a watcher reports `Created` or `Deleted`, instead of `Changed`,
+ * when the watched file appeared or disappeared since the watcher's last event, and so that a watcher reports
+ * `Created` when a missing file comes back, even if the system's watcher doesn't notice. Returns `undefined` if the
+ * system can't watch files, and the system's own `watchFile` if TypeScript has no `WatchFileKind`.
+ *
+ * @remarks
+ * A watch program acts on a missing file only when the file's watcher reports `Created`, and a watch program that was
+ * created from a list of root files has no other way to notice that a missing root file is back. Without that event,
+ * a root file that was missing when the program was updated stays "not found" (TS6053) until the process restarts.
+ * TypeScript's `useFsEventsOnParentDirectory` file watcher doesn't always report it:
+ *
+ * - Except on macOS, it reports every event as `Changed`.
+ *
+ * - It watches the file's folder. If the folder was deleted, it watches the folder again only after the folder is
+ *   back, and it reports nothing about the files that were written to the folder before then.
+ *
+ * So while the file is missing, the returned watcher also polls for it with TypeScript's polling file watcher, at the
+ * caller's polling interval, or every 500 ms if the caller didn't pass one.
+ *
+ * TypeScript 3.7 and older have no `WatchFileKind`, so a watcher can't ask them for a polling file watcher.
+ */
+export function createExistenceAwareWatchFile(
+  ts: ExistenceAwareWatchFileTypeScript,
+  system: Pick<TTypescript.System, 'fileExists' | 'watchFile'>
+): WatchFileFunction | undefined {
+  const { watchFile: baseWatchFile } = system;
+  const { WatchFileKind } = ts;
+  if (!baseWatchFile || !WatchFileKind) {
+    return baseWatchFile;
+  }
+
+  const { Created, Changed, Deleted } = ts.FileWatcherEventKind;
+  const { PriorityPollingInterval } = WatchFileKind;
+  return (
+    fileName: string,
+    callback: TTypescript.FileWatcherCallback,
+    pollingInterval?: number,
+    options?: TTypescript.WatchOptions
+  ): TTypescript.FileWatcher => {
+    let existed: boolean = system.fileExists(fileName);
+    let closed: boolean = false;
+    let missingFileWatcher: TTypescript.FileWatcher | undefined;
+
+    const updateMissingFileWatcher = (): void => {
+      if (existed || closed) {
+        missingFileWatcher?.close();
+        missingFileWatcher = undefined;
+      } else if (!missingFileWatcher) {
+        missingFileWatcher = baseWatchFile.call(
+          system,
+          fileName,
+          (eventFileName: string, eventKind: TTypescript.FileWatcherEventKind, modifiedTime?: Date): void => {
+            if (!existed && !closed && system.fileExists(fileName)) {
+              existed = true;
+              updateMissingFileWatcher();
+              callback(eventFileName, Created, modifiedTime);
+            }
+          },
+          pollingInterval ?? DEFAULT_MISSING_FILE_POLLING_INTERVAL_MS,
+          { ...options, watchFile: PriorityPollingInterval }
+        );
+      }
+    };
+
+    const watcher: TTypescript.FileWatcher = baseWatchFile.call(
+      system,
+      fileName,
+      (eventFileName: string, eventKind: TTypescript.FileWatcherEventKind, modifiedTime?: Date): void => {
+        const exists: boolean = system.fileExists(fileName);
+        let reportedEventKind: TTypescript.FileWatcherEventKind = eventKind;
+        if (eventKind === Changed && exists !== existed) {
+          reportedEventKind = exists ? Created : Deleted;
+        }
+
+        existed = exists;
+        updateMissingFileWatcher();
+        callback(eventFileName, reportedEventKind, modifiedTime);
+      },
+      pollingInterval,
+      options
+    );
+    updateMissingFileWatcher();
+
+    return {
+      close: (): void => {
+        closed = true;
+        watcher.close();
+        updateMissingFileWatcher();
+      }
+    };
+  };
+}
+
+/**
+ * Returns a copy of a TypeScript system with the given overrides, whose `watchFile` is what
+ * {@link createExistenceAwareWatchFile} returns for the system.
+ */
+export function createSystemWithExistenceAwareWatchFile<
+  TSystem extends Pick<TTypescript.System, 'fileExists' | 'watchFile'>
+>(
+  ts: ExistenceAwareWatchFileTypeScript,
+  system: TSystem,
+  overrides: Partial<Omit<TSystem, 'watchFile'>>
+): TSystem {
+  return {
+    ...system,
+    ...overrides,
+    // So that a watch program notices when a missing root file comes back
+    watchFile: createExistenceAwareWatchFile(ts, system)
+  };
+}
diff --git a/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts b/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts
index 5fb9ad86fb8..60d02a63ae1 100644
--- a/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts
+++ b/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts
@@ -128,7 +128,9 @@ export async function loadTypeScriptToolAsync(
 
   let realpath: typeof ts.sys.realpath = ts.sys.realpath;
   if (onlyResolveSymlinksInNodeModules) {
-    const resolver: RealNodeModulePathResolver = new RealNodeModulePathResolver();
+    // Like `ts.sys.realpath`, which returns the input for a path that does not exist, it must not throw: in watch
+    // mode, TypeScript also asks for the real path of module resolution lookups that failed.
+    const resolver: RealNodeModulePathResolver = new RealNodeModulePathResolver({ ignoreMissingPaths: true });
     realpath = resolver.realNodeModulePath;
   }
 
diff --git a/heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts b/heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts
new file mode 100644
index 00000000000..c38b0e39896
--- /dev/null
+++ b/heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts
@@ -0,0 +1,415 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as ts from 'typescript';
+
+import { Async, FileSystem, PackageJsonLookup } from '@rushstack/node-core-library';
+
+import {
+  createExistenceAwareWatchFile,
+  createSystemWithExistenceAwareWatchFile,
+  type WatchFileFunction
+} from '../existenceAwareWatchFile';
+
+const { Created, Changed, Deleted } = ts.FileWatcherEventKind;
+const { PriorityPollingInterval, UseFsEventsOnParentDirectory } = ts.WatchFileKind;
+
+// TypeScript 3.7 and older have no `WatchFileKind`.
+const TYPESCRIPT_WITHOUT_WATCH_FILE_KIND: Pick<typeof ts, 'FileWatcherEventKind'> = {
+  FileWatcherEventKind: ts.FileWatcherEventKind
+};
+
+const WATCHED_FILE_PATH: string = '/project/src/b.ts';
+const POLLING_INTERVAL: number = 250;
+const WATCH_OPTIONS: ts.WatchOptions = {
+  watchFile: UseFsEventsOnParentDirectory,
+  fallbackPolling: ts.PollingWatchKind.DynamicPriority
+};
+
+interface IBaseWatcher {
+  callback: ts.FileWatcherCallback;
+  pollingInterval: number | undefined;
+  options: ts.WatchOptions | undefined;
+  closed: boolean;
+}
+
+interface IFakeSystem {
+  files: Set<string>;
+  watchers: IBaseWatcher[];
+  system: Pick<ts.System, 'fileExists' | 'watchFile'>;
+}
+
+function createFakeSystem(existingFilePaths: string[]): IFakeSystem {
+  const files: Set<string> = new Set(existingFilePaths);
+  const watchers: IBaseWatcher[] = [];
+  const system: Pick<ts.System, 'fileExists' | 'watchFile'> = {
+    fileExists: (filePath: string) => files.has(filePath),
+    watchFile: (
+      filePath: string,
+      callback: ts.FileWatcherCallback,
+      pollingInterval?: number,
+      options?: ts.WatchOptions
+    ): ts.FileWatcher => {
+      const watcher: IBaseWatcher = { callback, pollingInterval, options, closed: false };
+      watchers.push(watcher);
+      return {
+        close: () => {
+          watcher.closed = true;
+        }
+      };
+    }
+  };
+  return { files, watchers, system };
+}
+
+function watchAndRecordKinds(
+  fakeSystem: IFakeSystem
+): [baseWatcher: IBaseWatcher, reportedKinds: ts.FileWatcherEventKind[], watcher: ts.FileWatcher] {
+  const watchFile: WatchFileFunction = createExistenceAwareWatchFile(ts, fakeSystem.system)!;
+  const reportedKinds: ts.FileWatcherEventKind[] = [];
+  const watcher: ts.FileWatcher = watchFile(
+    WATCHED_FILE_PATH,
+    (fileName: string, eventKind: ts.FileWatcherEventKind) => {
+      reportedKinds.push(eventKind);
+    },
+    POLLING_INTERVAL,
+    WATCH_OPTIONS
+  );
+  const [baseWatcher] = fakeSystem.watchers;
+  expect(baseWatcher.options).toBe(WATCH_OPTIONS);
+  return [baseWatcher, reportedKinds, watcher];
+}
+
+function getOpenPollingWatchers(fakeSystem: IFakeSystem): IBaseWatcher[] {
+  return fakeSystem.watchers.filter(
+    (watcher: IBaseWatcher) => !watcher.closed && watcher.options?.watchFile === PriorityPollingInterval
+  );
+}
+
+describe(createExistenceAwareWatchFile.name, () => {
+  it('returns undefined if the system cannot watch files', () => {
+    expect(createExistenceAwareWatchFile(ts, { fileExists: () => true })).toBeUndefined();
+    expect(
+      createExistenceAwareWatchFile(TYPESCRIPT_WITHOUT_WATCH_FILE_KIND, { fileExists: () => true })
+    ).toBeUndefined();
+  });
+
+  it("returns the system's own watchFile if TypeScript has no WatchFileKind", () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    expect(createExistenceAwareWatchFile(TYPESCRIPT_WITHOUT_WATCH_FILE_KIND, fakeSystem.system)).toBe(
+      fakeSystem.system.watchFile
+    );
+  });
+
+  it('reports "Changed" as "Created" or "Deleted" when the file appeared or disappeared since the last event', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const [baseWatcher, reportedKinds] = watchAndRecordKinds(fakeSystem);
+
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+
+    expect(reportedKinds).toEqual([Created, Changed, Deleted, Changed, Created]);
+  });
+
+  it('passes "Created" and "Deleted" through, and counts them as the latest state', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([WATCHED_FILE_PATH]);
+    const [baseWatcher, reportedKinds] = watchAndRecordKinds(fakeSystem);
+
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Deleted);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Created);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+
+    expect(reportedKinds).toEqual([Deleted, Changed, Created, Changed]);
+  });
+
+  it('passes the arguments through and returns a watcher that closes the base watcher', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([WATCHED_FILE_PATH]);
+    const watchFile: WatchFileFunction = createExistenceAwareWatchFile(ts, fakeSystem.system)!;
+    const events: [string, ts.FileWatcherEventKind, Date | undefined][] = [];
+    const watcher: ts.FileWatcher = watchFile(
+      WATCHED_FILE_PATH,
+      (fileName: string, eventKind: ts.FileWatcherEventKind, modifiedTime?: Date) => {
+        events.push([fileName, eventKind, modifiedTime]);
+      },
+      250,
+      WATCH_OPTIONS
+    );
+
+    // The file exists, so nothing polls for it.
+    expect(fakeSystem.watchers).toHaveLength(1);
+    const [baseWatcher] = fakeSystem.watchers;
+    expect(baseWatcher.pollingInterval).toBe(250);
+    expect(baseWatcher.options).toBe(WATCH_OPTIONS);
+
+    const modifiedTime: Date = new Date(1000);
+    baseWatcher.callback('/project/src/sub/../b.ts', Changed, modifiedTime);
+    expect(events).toEqual([['/project/src/sub/../b.ts', Changed, modifiedTime]]);
+
+    expect(baseWatcher.closed).toBe(false);
+    watcher.close();
+    expect(baseWatcher.closed).toBe(true);
+  });
+
+  it('polls for a missing file with the same polling interval, and reports "Created" once when the poll finds it', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const watchFile: WatchFileFunction = createExistenceAwareWatchFile(ts, fakeSystem.system)!;
+    const events: [string, ts.FileWatcherEventKind, Date | undefined][] = [];
+    watchFile(
+      WATCHED_FILE_PATH,
+      (fileName: string, eventKind: ts.FileWatcherEventKind, modifiedTime?: Date) => {
+        events.push([fileName, eventKind, modifiedTime]);
+      },
+      POLLING_INTERVAL,
+      WATCH_OPTIONS
+    );
+
+    expect(fakeSystem.watchers).toHaveLength(2);
+    const [baseWatcher, pollingWatcher] = fakeSystem.watchers;
+    expect(baseWatcher.options).toBe(WATCH_OPTIONS);
+    expect(pollingWatcher.pollingInterval).toBe(POLLING_INTERVAL);
+    expect(pollingWatcher.options).toEqual({ ...WATCH_OPTIONS, watchFile: PriorityPollingInterval });
+
+    pollingWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(events).toEqual([]);
+
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    const modifiedTime: Date = new Date(2000);
+    pollingWatcher.callback(WATCHED_FILE_PATH, Changed, modifiedTime);
+    expect(events).toEqual([[WATCHED_FILE_PATH, Created, modifiedTime]]);
+    expect(pollingWatcher.closed).toBe(true);
+
+    // The base watcher sees the same file, which it now reports as changed.
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(events.map(([, eventKind]) => eventKind)).toEqual([Created, Changed]);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([]);
+
+    // A late event from the closed polling watcher doesn't report the file again.
+    pollingWatcher.callback(WATCHED_FILE_PATH, Created);
+    expect(events).toHaveLength(2);
+
+    // A caller that passes no polling interval or options gets TypeScript's interval for missing files.
+    watchFile('/project/src/c.ts', () => {
+      // Not called
+    });
+    expect(fakeSystem.watchers).toHaveLength(4);
+    expect(fakeSystem.watchers[2].pollingInterval).toBeUndefined();
+    expect(fakeSystem.watchers[3].pollingInterval).toBe(500);
+    expect(fakeSystem.watchers[3].options).toEqual({ watchFile: PriorityPollingInterval });
+  });
+
+  it('polls again whenever the file goes missing, and stops polling when the watcher is closed', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([WATCHED_FILE_PATH]);
+    const [baseWatcher, reportedKinds, watcher] = watchAndRecordKinds(fakeSystem);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([]);
+
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(reportedKinds).toEqual([Deleted, Changed]);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([fakeSystem.watchers[1]]);
+
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(reportedKinds).toEqual([Deleted, Changed, Created]);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([]);
+
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Deleted);
+    expect(reportedKinds).toEqual([Deleted, Changed, Created, Deleted]);
+    const pollingWatcher: IBaseWatcher = fakeSystem.watchers[2];
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([pollingWatcher]);
+
+    watcher.close();
+    expect(baseWatcher.closed).toBe(true);
+    expect(pollingWatcher.closed).toBe(true);
+
+    // Events that arrive after the watcher was closed don't report the file or poll for it again.
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    pollingWatcher.callback(WATCHED_FILE_PATH, Created);
+    expect(reportedKinds).toEqual([Deleted, Changed, Created, Deleted, Changed]);
+    expect(fakeSystem.watchers).toHaveLength(3);
+  });
+});
+
+describe(createSystemWithExistenceAwareWatchFile.name, () => {
+  it("keeps the system's members and the overrides, and wraps the system's watchFile", () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const readFile: (filePath: string) => string | undefined = () => undefined;
+    const baseGetCurrentDirectory: () => string = () => '/';
+    const getCurrentDirectory: () => string = () => '/project';
+    const baseSystem: Pick<ts.System, 'fileExists' | 'watchFile' | 'readFile' | 'getCurrentDirectory'> = {
+      ...fakeSystem.system,
+      readFile,
+      getCurrentDirectory: baseGetCurrentDirectory
+    };
+
+    const system: Pick<ts.System, 'fileExists' | 'watchFile' | 'readFile' | 'getCurrentDirectory'> =
+      createSystemWithExistenceAwareWatchFile(ts, baseSystem, { getCurrentDirectory });
+    expect(system).not.toBe(baseSystem);
+    expect(system.fileExists).toBe(baseSystem.fileExists);
+    expect(system.readFile).toBe(readFile);
+    expect(system.getCurrentDirectory).toBe(getCurrentDirectory);
+    expect(baseSystem.getCurrentDirectory).toBe(baseGetCurrentDirectory);
+    expect(system.watchFile).not.toBe(baseSystem.watchFile);
+
+    const reportedKinds: ts.FileWatcherEventKind[] = [];
+    system.watchFile!(
+      WATCHED_FILE_PATH,
+      (fileName: string, eventKind: ts.FileWatcherEventKind) => {
+        reportedKinds.push(eventKind);
+      },
+      POLLING_INTERVAL,
+      WATCH_OPTIONS
+    );
+    // The file is missing, so the system's watchFile was called for the watcher and for a poll.
+    expect(fakeSystem.watchers).toHaveLength(2);
+    expect(getOpenPollingWatchers(fakeSystem)).toHaveLength(1);
+
+    const [baseWatcher] = fakeSystem.watchers;
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(reportedKinds).toEqual([Created]);
+    expect(getOpenPollingWatchers(fakeSystem)).toHaveLength(0);
+  });
+
+  it("keeps the system's own watchFile if TypeScript has no WatchFileKind", () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const getCurrentDirectory: () => string = () => '/project';
+    const system: Pick<ts.System, 'fileExists' | 'watchFile' | 'getCurrentDirectory'> =
+      createSystemWithExistenceAwareWatchFile(
+        TYPESCRIPT_WITHOUT_WATCH_FILE_KIND,
+        { ...fakeSystem.system, getCurrentDirectory: () => '/' },
+        { getCurrentDirectory }
+      );
+    expect(system.watchFile).toBe(fakeSystem.system.watchFile);
+    expect(system.getCurrentDirectory).toBe(getCurrentDirectory);
+  });
+
+  it('has no watchFile if the system cannot watch files', () => {
+    const system: Pick<ts.System, 'fileExists' | 'watchFile'> = createSystemWithExistenceAwareWatchFile(
+      ts,
+      { fileExists: () => true },
+      {}
+    );
+    expect(system.watchFile).toBeUndefined();
+  });
+});
+
+describe('A TypeScript watch program that uses useFsEventsOnParentDirectory', () => {
+  const projectFolderPath: string = PackageJsonLookup.instance.tryGetPackageFolderFor(__dirname)!;
+
+  async function expectRecompiledAfterMissingAsync(
+    caseName: string,
+    deleteAsync: (bFilePath: string, bFolderPath: string) => Promise<void>
+  ): Promise<void> {
+    const testFolderPath: string = `${projectFolderPath}/temp/test/existenceAwareWatchFile/${caseName}`;
+    const aFilePath: string = `${testFolderPath}/src/a.ts`;
+    const bFolderPath: string = `${testFolderPath}/src/sub`;
+    const bFilePath: string = `${bFolderPath}/b.ts`;
+    const bDeclarationFilePath: string = `${testFolderPath}/lib/sub/b.d.ts`;
+
+    await FileSystem.ensureEmptyFolderAsync(testFolderPath);
+    await FileSystem.writeFileAsync(aFilePath, 'export const a: number = 1;\n', { ensureFolderExists: true });
+    await FileSystem.writeFileAsync(bFilePath, 'export const b: number = 1;\n', { ensureFolderExists: true });
+
+    // Like heft, run the program updates that TypeScript schedules only when asked to.
+    const pendingWork: Set<() => void> = new Set();
+    const system: ts.System = createSystemWithExistenceAwareWatchFile(ts, ts.sys, {
+      setTimeout: (callback: (...args: unknown[]) => void, ms: number, ...args: unknown[]): (() => void) => {
+        const work: () => void = () => callback(...args);
+        pendingWork.add(work);
+        return work;
+      },
+      clearTimeout: (work: () => void): void => {
+        pendingWork.delete(work);
+      }
+    });
+
+    const diagnosticCodes: number[] = [];
+    const host: ts.WatchCompilerHostOfFilesAndCompilerOptions<ts.EmitAndSemanticDiagnosticsBuilderProgram> =
+      ts.createWatchCompilerHost(
+        [aFilePath, bFilePath],
+        {
+          declaration: true,
+          lib: ['lib.es2019.d.ts'],
+          module: ts.ModuleKind.CommonJS,
+          outDir: `${testFolderPath}/lib`,
+          rootDir: `${testFolderPath}/src`,
+          skipLibCheck: true,
+          target: ts.ScriptTarget.ES2019,
+          types: []
+        },
+        system,
+        ts.createEmitAndSemanticDiagnosticsBuilderProgram,
+        (diagnostic: ts.Diagnostic) => {
+          diagnosticCodes.push(diagnostic.code);
+        },
+        () => {
+          // Ignore the watch status messages
+        },
+        undefined,
+        { watchFile: ts.WatchFileKind.UseFsEventsOnParentDirectory }
+      );
+
+    async function runNextProgramUpdateAsync(): Promise<void> {
+      const deadline: number = Date.now() + 10000;
+      while (pendingWork.size === 0) {
+        if (Date.now() > deadline) {
+          throw new Error('TypeScript did not schedule a program update.');
+        }
+
+        await Async.sleepAsync(20);
+      }
+
+      diagnosticCodes.length = 0;
+      for (const work of pendingWork) {
+        pendingWork.delete(work);
+        work();
+      }
+    }
+
+    const watchProgram: ts.WatchOfFilesAndCompilerOptions<ts.EmitAndSemanticDiagnosticsBuilderProgram> =
+      ts.createWatchProgram(host);
+    try {
+      expect(diagnosticCodes).toEqual([]);
+
+      await deleteAsync(bFilePath, bFolderPath);
+      await runNextProgramUpdateAsync();
+      // error TS6053: File '.../b.ts' not found.
+      expect(diagnosticCodes).toEqual([6053]);
+
+      await FileSystem.writeFileAsync(
+        bFilePath,
+        'export const b: number = 2;\nexport const b2: number = 3;\n',
+        { ensureFolderExists: true }
+      );
+      await runNextProgramUpdateAsync();
+      expect(diagnosticCodes).toEqual([]);
+      expect(await FileSystem.readFileAsync(bDeclarationFilePath)).toContain('b2');
+    } finally {
+      watchProgram.close();
+    }
+  }
+
+  it('compiles a root file again after it was missing during a program update', async () => {
+    await expectRecompiledAfterMissingAsync('file', async (bFilePath: string) => {
+      await FileSystem.deleteFileAsync(bFilePath);
+    });
+  }, 30000);
+
+  it('compiles a root file again after its folder was missing during a program update', async () => {
+    await expectRecompiledAfterMissingAsync('folder', async (bFilePath: string, bFolderPath: string) => {
+      await FileSystem.deleteFolderAsync(bFolderPath);
+    });
+  }, 30000);
+});
diff --git a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
new file mode 100644
index 00000000000..3fd77c1e3fc
--- /dev/null
+++ b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
@@ -0,0 +1,391 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as child_process from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import type { WatchOptions } from 'watchpack';
+
+import { DeferredWatchFileSystem, type IWatch } from './DeferredWatchFileSystem';
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that these tests read or set.
+ */
+interface IDirectoryWatcherInternals {
+  scanning: boolean;
+  _activeEvents: Map<string, boolean>;
+}
+
+interface IFlush {
+  changes: string[];
+  removals: string[];
+}
+
+// On Linux, inotify queues the event for a write during the write, so the event loop delivers it on its next poll.
+// Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+// Windows has no FIFOs, so there holdThreadPool() gives each thread about 100 ms of work instead, which can take
+// longer than flushAsync() waits on a machine whose CPUs are busy.
+const PBKDF2_ITERATIONS: number = 200000;
+
+describe(DeferredWatchFileSystem.name, () => {
+  let fifoPath: string | undefined;
+  let folder: string;
+  let watchOptions: WatchOptions;
+  let onChange: jest.Mock<void, []>;
+  let purge: jest.Mock<void, [string[]]>;
+  let watchFileSystem: DeferredWatchFileSystem;
+  let watcher: IWatch | undefined;
+  let flushes: IFlush[];
+  let compilationStartTimes: number[];
+  let releaseThreadPoolAsync: (() => Promise<void>) | undefined;
+
+  beforeAll(() => {
+    if (process.platform !== 'win32') {
+      const fifoFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack4-plugin-test-fifo-'));
+      fifoPath = path.join(fifoFolder, 'fifo');
+      child_process.execFileSync('mkfifo', [fifoPath]);
+    }
+  });
+
+  afterAll(() => {
+    if (fifoPath) {
+      // Not fs.rmSync(), which calls lstat on the FIFO. Until the next stat call, Node's fs.realpathSync() then
+      // returns some paths with their symlinks unresolved, and jest fails to require() a package that pnpm linked.
+      fs.unlinkSync(fifoPath);
+      fs.rmdirSync(path.dirname(fifoPath));
+    }
+  });
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack4-plugin-test-'));
+    watchOptions = { aggregateTimeout: 20 };
+    onChange = jest.fn();
+    purge = jest.fn();
+    watchFileSystem = new DeferredWatchFileSystem({ purge }, onChange);
+    watcher = undefined;
+    flushes = [];
+    compilationStartTimes = [];
+    releaseThreadPoolAsync = undefined;
+  });
+
+  afterEach(async () => {
+    // For a test that failed while it held the thread pool
+    await releaseThreadPoolAsync?.();
+    watcher?.close();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createFile(name: string): string {
+    const filePath: string = path.join(folder, name);
+    fs.writeFileSync(filePath, 'initial');
+    // An old modification time, so that the first scan doesn't report the file as changed.
+    const past: Date = new Date(Date.now() - 60000);
+    fs.utimesSync(filePath, past, past);
+    return filePath;
+  }
+
+  /**
+   * Watches the files as webpack's `Watching` does. When a flush calls back, the callback takes the start time of
+   * the compilation from the clock, as `Watching._go()` does. Webpack 4 doesn't pause the watcher there, because
+   * its callback clears `Watching.watcher` before it calls `_invalidate()`.
+   */
+  function watch(files: string[], startTime: number): void {
+    watcher = watchFileSystem.watch(
+      files,
+      [],
+      [],
+      startTime,
+      watchOptions,
+      (error, changedFiles, changedDirs, changedMissing, fileTimes, dirTimes, removals) => {
+        compilationStartTimes.push(Date.now());
+        flushes.push({
+          changes: changedFiles.slice().sort(),
+          removals: Array.from(removals).sort()
+        });
+      },
+      () => {
+        // Webpack's undelayed callback isn't used.
+      }
+    );
+  }
+
+  function getDirectoryWatchers(): IDirectoryWatcherInternals[] {
+    const internals: { watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> } } =
+      watchFileSystem.watcher as unknown as {
+        watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> };
+      };
+    return Array.from(internals.watcherManager.directoryWatchers.values());
+  }
+
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = performance.now() + 5000;
+    while (!condition()) {
+      if (performance.now() > deadline) {
+        throw new Error('The condition was not met within 5 seconds');
+      }
+      await setImmediateAsync();
+    }
+  }
+
+  async function watchAndWaitForScanAsync(files: string[]): Promise<void> {
+    watch(files, Date.now());
+    await waitForAsync(() => getDirectoryWatchers().every((directoryWatcher) => !directoryWatcher.scanning));
+  }
+
+  /**
+   * Holds every thread of the thread pool until the returned function releases them, so that the `fs.readdir()`
+   * and `fs.lstat()` calls that the watcher makes next wait in the queue. The returned function resolves when the
+   * threads are free again. On Windows, the threads are only busy for a while (see `PBKDF2_ITERATIONS`).
+   */
+  function holdThreadPool(): () => Promise<void> {
+    const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const releaseAsync: () => Promise<void> = fifoPath
+      ? holdThreadPoolWithFifo(fifoPath, threadCount)
+      : keepThreadPoolBusy(threadCount);
+    let releasePromise: Promise<void> | undefined;
+    releaseThreadPoolAsync = () => (releasePromise ??= releaseAsync());
+    return releaseThreadPoolAsync;
+  }
+
+  function holdThreadPoolWithFifo(fifo: string, threadCount: number): () => Promise<void> {
+    // Opening a FIFO for reading blocks the thread until something opens the FIFO for writing.
+    const fdPromises: Promise<number>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      fdPromises.push(
+        new Promise<number>((resolve, reject) => {
+          fs.open(fifo, 'r', (error, fd) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve(fd);
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      // Opening a FIFO for both reading and writing doesn't block on Linux or macOS, and it releases the threads.
+      // The FIFO stays open until every thread has opened it, so that none of them blocks again.
+      const writerFd: number = fs.openSync(fifo, 'r+');
+      try {
+        for (const fd of await Promise.all(fdPromises)) {
+          fs.closeSync(fd);
+        }
+      } finally {
+        fs.closeSync(writerFd);
+      }
+    };
+  }
+
+  function keepThreadPoolBusy(threadCount: number): () => Promise<void> {
+    const tasks: Promise<void>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      tasks.push(
+        new Promise<void>((resolve, reject) => {
+          crypto.pbkdf2('password', 'salt', PBKDF2_ITERATIONS, 64, 'sha512', (error) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve();
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      await Promise.all(tasks);
+    };
+  }
+
+  /**
+   * Waits until a `flushAsync()` call that was just made is waiting for pending events. It checks for them for the
+   * first time on the second turn of the event loop after the call, so after three turns it is waiting.
+   */
+  async function waitForFlushToWaitAsync(): Promise<void> {
+    for (let i: number = 0; i < 3; i++) {
+      await setImmediateAsync();
+    }
+  }
+
+  it('returns false before watch() is called', async () => {
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+  });
+
+  it('returns false and calls back nothing when nothing changed', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+
+    await setTimeoutAsync(50);
+    expect(flushes).toEqual([]);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file that was written just before the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    expect(purge).toHaveBeenCalledWith([file]);
+    await setTimeoutAsync(50);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    fs.writeFileSync(file, 'changed');
+    await waitForAsync(() =>
+      getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
+    );
+    expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    // An fs callback runs in the poll phase, after the event loop has collected the events that were ready, so
+    // the event for this write can't arrive before the next poll phase.
+    const flushPromise: Promise<boolean> = new Promise<boolean>((resolve, reject) => {
+      fs.stat(file, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          fs.writeFileSync(file, 'changed');
+          resolve(watchFileSystem.flushAsync());
+        }
+      });
+    });
+
+    await expect(flushPromise).resolves.toBe(true);
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux(
+    'keeps the changes that the watcher reports while it waits, without calling onChange',
+    async () => {
+      const fileA: string = createFile('a.js');
+      const fileB: string = createFile('b.js');
+      await watchAndWaitForScanAsync([fileA, fileB]);
+      let aggregatedCount: number = 0;
+      watchFileSystem.watcher!.on('aggregated', () => {
+        aggregatedCount++;
+      });
+
+      fs.writeFileSync(fileA, 'changed');
+      await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
+      const releaseAsync: () => Promise<void> = holdThreadPool();
+      fs.writeFileSync(fileB, 'changed');
+      const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      await waitForAsync(() => aggregatedCount > 0);
+      await releaseAsync();
+      await expect(flushPromise).resolves.toBe(true);
+
+      expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  itOnLinux(
+    'starts the compilation after the changes it passes, so the next watch() does not report them again',
+    async () => {
+      const file: string = createFile('a.js');
+      await watchAndWaitForScanAsync([file]);
+
+      const reportedAgain: number[] = [];
+      for (let i: number = 0; i < 10; i++) {
+        fs.writeFileSync(file, `change ${i}`);
+        await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(file));
+        await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+        // When the compilation is done, webpack's Watching calls watch() again with the compilation's start time.
+        // The new watcher reports every change that was recorded at or after that time, as "outdated on attach".
+        watch([file], compilationStartTimes[i]);
+        await setImmediateAsync();
+        reportedAgain.push(watchFileSystem.watcher!.aggregatedChanges.size);
+      }
+
+      expect(reportedAgain).toEqual(new Array(10).fill(0));
+      expect(flushes).toHaveLength(10);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  it('includes a change that a scan in progress finds', async () => {
+    const subfolder: string = path.join(folder, 'sub');
+    fs.mkdirSync(subfolder);
+    const file: string = path.join(subfolder, 'a.js');
+    fs.writeFileSync(file, 'new');
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    // A start time before the file was written, as for a file that changed during the compilation.
+    watch([file], Date.now() - 60000);
+    expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  it('returns false when the watcher is closed while it waits', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    watcher!.close();
+
+    await expect(flushPromise).resolves.toBe(false);
+    expect(flushes).toEqual([]);
+  });
+
+  it('stops waiting after 1 second', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const directoryWatcher: IDirectoryWatcherInternals = getDirectoryWatchers()[0];
+    // An event whose fs.lstat() never finishes
+    directoryWatcher._activeEvents.set('never-finishes.js', false);
+
+    try {
+      const startTime: number = performance.now();
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+      const elapsedMs: number = performance.now() - startTime;
+
+      expect(elapsedMs).toBeGreaterThanOrEqual(999);
+      expect(elapsedMs).toBeLessThan(3000);
+    } finally {
+      directoryWatcher._activeEvents.delete('never-finishes.js');
+    }
+  });
+});
diff --git a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts
index d0f719a2041..82c4bb8ddad 100644
--- a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts
+++ b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts
@@ -4,6 +4,8 @@
 import Watchpack, { type WatchOptions } from 'watchpack';
 import type { Compiler, Plugin } from 'webpack';
 
+import { _waitForWatchpackPendingEventsAsync } from '@rushstack/heft';
+
 export interface IPurgeable {
   purge?: (changes: string[]) => void;
 }
@@ -69,6 +71,7 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
 
   readonly #onChange: () => void;
   #state: IWatchState | undefined;
+  #isFlushing: boolean = false;
 
   public constructor(inputFileSystem: IPurgeable, onChange: () => void) {
     this.inputFileSystem = inputFileSystem;
@@ -121,6 +124,40 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
     return false;
   }
 
+  /**
+   * Like {@link DeferredWatchFileSystem.flush}, but first lets watchpack finish recording the file system events
+   * that it has already received.
+   *
+   * @remarks
+   * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a file that an upstream
+   * task wrote just before a call to `flush()` can be missing from the changes. This method waits until the
+   * directory watchers have no events or scans in progress, for up to 1 second. If there are changes, it then
+   * waits for the clock to pass the time when they were recorded. The compilation that the callback starts takes
+   * its start time from the clock, and the next `watch()` call reports every change recorded at or after that
+   * start time again, as "outdated on attach".
+   *
+   * While this method waits, it keeps the changes that the watcher reports for the flush, and doesn't call
+   * `onChange` for them.
+   */
+  public async flushAsync(): Promise<boolean> {
+    if (!this.#state) {
+      return false;
+    }
+
+    this.#isFlushing = true;
+    try {
+      await this.#waitForPendingEventsAsync();
+      if (!this.watcher) {
+        // The watcher was closed while this method waited.
+        return false;
+      }
+
+      return this.flush();
+    } finally {
+      this.#isFlushing = false;
+    }
+  }
+
   public watch(
     files: string[],
     directories: string[],
@@ -158,7 +195,11 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
         removals.add(removal);
       }
 
-      this.#onChange();
+      // flushAsync() passes these changes to the callback when it finishes waiting, so they don't need
+      // another run.
+      if (!this.#isFlushing) {
+        this.#onChange();
+      }
     });
 
     watcher.watch({
@@ -194,6 +235,22 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
       }
     };
   }
+
+  async #waitForPendingEventsAsync(): Promise<void> {
+    await _waitForWatchpackPendingEventsAsync(
+      () => this.watcher,
+      () => this.#hasChanges()
+    );
+  }
+
+  #hasChanges(): boolean {
+    const state: IWatchState | undefined = this.#state;
+    const watcher: Watchpack | undefined = this.watcher;
+    return (
+      (!!state && (state.changes.size > 0 || state.removals.size > 0)) ||
+      (!!watcher && (watcher.aggregatedChanges.size > 0 || watcher.aggregatedRemovals.size > 0))
+    );
+  }
 }
 
 export class OverrideNodeWatchFSPlugin implements Plugin {
diff --git a/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts b/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts
index c8d9fc7cff7..aa37b8f2e0a 100644
--- a/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts
+++ b/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts
@@ -399,7 +399,8 @@ export default class Webpack4Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
     if (!isInitial && this.#watchFileSystems) {
       hasChanges = false;
       for (const watchFileSystem of this.#watchFileSystems) {
-        hasChanges = watchFileSystem.flush() || hasChanges;
+        // The upstream tasks may have just written files that the watcher has seen but not recorded yet.
+        hasChanges = (await watchFileSystem.flushAsync()) || hasChanges;
       }
     }
 
diff --git a/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts b/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts
index 4d91e5c2993..6596ddcf1ae 100644
--- a/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts
@@ -4,6 +4,8 @@
 import Watchpack, { type WatchOptions } from 'watchpack';
 import type { Compiler, WebpackPluginInstance, InputFileSystem } from 'webpack';
 
+import { _waitForWatchpackPendingEventsAsync } from '@rushstack/heft';
+
 export type { InputFileSystem };
 export type WatchFileSystem = NonNullable<Compiler['watchFileSystem']>;
 export type WatchCallback = Parameters<WatchFileSystem['watch']>[5];
@@ -38,6 +40,7 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
 
   readonly #onChange: () => void;
   #state: IWatchState | undefined;
+  #isFlushing: boolean = false;
 
   public constructor(inputFileSystem: InputFileSystem, onChange: () => void) {
     this.inputFileSystem = inputFileSystem;
@@ -90,6 +93,40 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     return false;
   }
 
+  /**
+   * Like {@link DeferredWatchFileSystem.flush}, but first lets watchpack finish recording the file system events
+   * that it has already received.
+   *
+   * @remarks
+   * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a file that an upstream
+   * task wrote just before a call to `flush()` can be missing from the changes. This method waits until the
+   * directory watchers have no events or scans in progress, for up to 1 second. If there are changes, it then
+   * waits for the clock to pass the time when they were recorded. The compilation that the callback starts takes
+   * its start time from the clock, and the next `watch()` call reports every change recorded at or after that
+   * start time again, as "outdated on attach".
+   *
+   * While this method waits, it keeps the changes that the watcher reports for the flush, and doesn't call
+   * `onChange` for them.
+   */
+  public async flushAsync(): Promise<boolean> {
+    if (!this.#state) {
+      return false;
+    }
+
+    this.#isFlushing = true;
+    try {
+      await this.#waitForPendingEventsAsync();
+      if (!this.watcher) {
+        // The watcher was closed while this method waited.
+        return false;
+      }
+
+      return this.flush();
+    } finally {
+      this.#isFlushing = false;
+    }
+  }
+
   public watch(
     files: Iterable<string>,
     directories: Iterable<string>,
@@ -122,7 +159,11 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
         removals.add(removal);
       }
 
-      this.#onChange();
+      // flushAsync() passes these changes to the callback when it finishes waiting, so they don't need
+      // another run.
+      if (!this.#isFlushing) {
+        this.#onChange();
+      }
     });
 
     this.watcher.watch({
@@ -171,6 +212,22 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     };
   }
 
+  async #waitForPendingEventsAsync(): Promise<void> {
+    await _waitForWatchpackPendingEventsAsync(
+      () => this.watcher,
+      () => this.#hasChanges()
+    );
+  }
+
+  #hasChanges(): boolean {
+    const state: IWatchState | undefined = this.#state;
+    const watcher: Watchpack | undefined = this.watcher;
+    return (
+      (!!state && (state.changes.size > 0 || state.removals.size > 0)) ||
+      (!!watcher && (watcher.aggregatedChanges.size > 0 || watcher.aggregatedRemovals.size > 0))
+    );
+  }
+
   #fetchTimeInfo(): ITimeInfoEntries {
     const fileTimeInfoEntries: IRawFileSystemMap = new Map();
     const contextTimeInfoEntries: IRawFileSystemMap = new Map();
diff --git a/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts b/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
new file mode 100644
index 00000000000..1ecabf41d3c
--- /dev/null
+++ b/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
@@ -0,0 +1,246 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import type { Compilation, Compiler, WebpackPluginInstance } from 'webpack';
+
+import { Async } from '@rushstack/node-core-library';
+import type { IScopedLogger } from '@rushstack/heft';
+
+type ITerminal = IScopedLogger['terminal'];
+type OutputFileSystem = NonNullable<Compiler['outputFileSystem']>;
+
+const PLUGIN_NAME: 'DeleteStaleAssetsPlugin' = 'DeleteStaleAssetsPlugin';
+
+/**
+ * The stage of webpack's CleanPlugin: after the emit taps that add assets, and before webpack writes the
+ * files.
+ */
+const EMIT_STAGE: 100 = 100;
+
+const UNLINK_CONCURRENCY: 10 = 10;
+const WEBPACK_FRAGMENT_STRIPPING_MAJOR_VERSION: 5 = 5;
+const WEBPACK_FRAGMENT_STRIPPING_MINOR_VERSION: 104 = 104;
+
+interface IAssetPaths {
+  /**
+   * The output paths of every asset of the compilation.
+   */
+  all: Set<string>;
+  /**
+   * The output paths that a later compilation deletes if it no longer emits them. Hot update files aren't
+   * included, because a client can still request them after the next compilation.
+   */
+  tracked: Set<string>;
+}
+
+/**
+ * In watch mode, deletes the output files that earlier compilations emitted and the current compilation
+ * doesn't, such as the chunk of a dynamic import that was removed, or a file whose name contains a hash that
+ * changed. Webpack's watch mode never deletes these files.
+ *
+ * @remarks
+ * Unlike webpack's `output.clean`, this plugin deletes only files that the same compiler emitted earlier in
+ * the session. Other files in the output folder, such as the outputs of other tasks, are never deleted.
+ *
+ * - The first compilation deletes nothing.
+ * - A compilation with errors deletes nothing. The next compilation without errors deletes the files that it
+ *   doesn't emit from both compilations.
+ * - A compilation that emits nothing (for example, one with errors when `optimization.emitOnErrors` is false)
+ *   doesn't reach this plugin, so the files on disk are still those of the previous emit.
+ * - Hot update files are never deleted, because a client can still request them after the next compilation.
+ * - Like `output.clean`, it never deletes a file that webpack writes outside the output folder, such as the
+ *   asset `../manifest.json`. Some plugins emit such files in the first compilation only.
+ * - Like `output.clean`, if a plugin emits a file in the output folder in some compilations only, a
+ *   compilation that doesn't emit it deletes it.
+ */
+export class DeleteStaleAssetsPlugin implements WebpackPluginInstance {
+  readonly #terminal: ITerminal;
+  #previousAssetPaths: Set<string> | undefined;
+
+  public constructor(terminal: ITerminal) {
+    this.#terminal = terminal;
+  }
+
+  public apply(compiler: Compiler): void {
+    // Delete the stale files before webpack writes the new ones. On a case-insensitive file system, a file
+    // that was renamed only by case is the same file as the new one, so deleting it after the write would
+    // delete the new file.
+    compiler.hooks.emit.tapPromise(
+      { name: PLUGIN_NAME, stage: EMIT_STAGE },
+      async (compilation: Compilation): Promise<void> => {
+        await this.#onEmitAsync(compiler, compilation);
+      }
+    );
+  }
+
+  async #onEmitAsync(compiler: Compiler, compilation: Compilation): Promise<void> {
+    const outputPath: string = compilation.getPath(compiler.outputPath, {});
+    const outputFileSystem: OutputFileSystem | undefined = compiler.outputFileSystem ?? undefined;
+    const assetPaths: IAssetPaths = getAssetPaths(
+      compilation,
+      outputPath,
+      outputFileSystem,
+      doesWebpackStripAssetFragments(compiler.webpack.version)
+    );
+
+    const previousAssetPaths: Set<string> | undefined = this.#previousAssetPaths;
+    if (!previousAssetPaths) {
+      this.#previousAssetPaths = assetPaths.tracked;
+      return;
+    }
+
+    if (compilation.getStats().hasErrors()) {
+      for (const assetPath of assetPaths.tracked) {
+        previousAssetPaths.add(assetPath);
+      }
+      return;
+    }
+
+    const staleAssetPaths: string[] = [];
+    for (const assetPath of previousAssetPaths) {
+      if (!assetPaths.all.has(assetPath)) {
+        staleAssetPaths.push(assetPath);
+      }
+    }
+
+    // A file that couldn't be deleted stays tracked, so that the next compilation tries again.
+    const nextAssetPaths: Set<string> = assetPaths.tracked;
+    this.#previousAssetPaths = nextAssetPaths;
+    if (staleAssetPaths.length === 0) {
+      return;
+    }
+
+    const unlink: OutputFileSystem['unlink'] = outputFileSystem?.unlink;
+    if (!unlink) {
+      for (const assetPath of staleAssetPaths) {
+        nextAssetPaths.add(assetPath);
+      }
+      compilation.warnings.push(
+        new compiler.webpack.WebpackError(
+          `${PLUGIN_NAME}: The output file system can't delete files, so ${staleAssetPaths.length} ` +
+            `file(s) that an earlier compilation emitted and this compilation doesn't were not deleted.`
+        )
+      );
+      return;
+    }
+
+    const deletedAssetPaths: string[] = [];
+    await Async.forEachAsync(
+      staleAssetPaths,
+      async (assetPath: string) => {
+        const error: NodeJS.ErrnoException | null = await new Promise(
+          (resolve: (unlinkError: NodeJS.ErrnoException | null) => void) => {
+            unlink.call(outputFileSystem, assetPath, resolve);
+          }
+        );
+        if (!error) {
+          deletedAssetPaths.push(assetPath);
+        } else if (error.code !== 'ENOENT') {
+          nextAssetPaths.add(assetPath);
+          compilation.errors.push(
+            new compiler.webpack.WebpackError(
+              `${PLUGIN_NAME}: Could not delete "${assetPath}", which an earlier compilation emitted and ` +
+                `this compilation doesn't: ${error.message}`
+            )
+          );
+        }
+      },
+      { concurrency: UNLINK_CONCURRENCY }
+    );
+
+    if (deletedAssetPaths.length > 0) {
+      this.#terminal.writeLine(
+        `Deleted ${deletedAssetPaths.length} output file(s) that earlier compilations emitted and ` +
+          `this compilation doesn't`
+      );
+      for (const assetPath of deletedAssetPaths.sort()) {
+        this.#terminal.writeVerboseLine(`Deleted "${assetPath}"`);
+      }
+    }
+  }
+}
+
+/**
+ * Gets the paths that webpack writes the compilation's assets to, except for the paths outside the output
+ * folder.
+ */
+function getAssetPaths(
+  compilation: Compilation,
+  outputPath: string,
+  outputFileSystem: OutputFileSystem | undefined,
+  stripFragment: boolean
+): IAssetPaths {
+  // Like webpack, join with the output file system's join, or else with the path rules of the output path.
+  const pathApi: path.PlatformPath = path.posix.isAbsolute(outputPath) ? path.posix : path.win32;
+  const join: (path1: string, path2: string) => string = outputFileSystem?.join
+    ? outputFileSystem.join.bind(outputFileSystem)
+    : pathApi.join;
+  const all: Set<string> = new Set();
+  const tracked: Set<string> = new Set();
+  for (const { name, info } of compilation.getAssets()) {
+    const targetFile: string = getAssetTargetFile(name, stripFragment);
+    const assetPath: string = join(outputPath, targetFile);
+    // Check the path that webpack writes rather than the asset name: the file of "./../manifest.json" is
+    // outside the output folder, and the file of "..json" is in it.
+    if (!isInFolder(pathApi, outputPath, assetPath)) {
+      continue;
+    }
+    all.add(assetPath);
+    if (!info.hotModuleReplacement) {
+      tracked.add(assetPath);
+    }
+  }
+
+  return { all, tracked };
+}
+
+function getAssetTargetFile(assetName: string, stripFragment: boolean): string {
+  const queryIndex: number = assetName.indexOf('?');
+  const fragmentIndex: number = stripFragment ? assetName.indexOf('#') : -1;
+  let separatorIndex: number = -1;
+  if (queryIndex >= 0 && fragmentIndex >= 0) {
+    separatorIndex = Math.min(queryIndex, fragmentIndex);
+  } else if (queryIndex >= 0) {
+    separatorIndex = queryIndex;
+  } else {
+    separatorIndex = fragmentIndex;
+  }
+
+  return separatorIndex >= 0 ? assetName.slice(0, separatorIndex) : assetName;
+}
+
+function doesWebpackStripAssetFragments(version: string | undefined): boolean {
+  if (!version) {
+    return true;
+  }
+
+  const dotIndex: number = version.indexOf('.');
+  if (dotIndex < 0) {
+    return true;
+  }
+
+  const majorVersion: number = parseInt(version, 10);
+  const minorVersion: number = parseInt(version.slice(dotIndex + 1), 10);
+  return (
+    majorVersion > WEBPACK_FRAGMENT_STRIPPING_MAJOR_VERSION ||
+    (majorVersion === WEBPACK_FRAGMENT_STRIPPING_MAJOR_VERSION &&
+      minorVersion >= WEBPACK_FRAGMENT_STRIPPING_MINOR_VERSION)
+  );
+}
+
+/**
+ * Returns true if the path is in the folder, and isn't the folder itself.
+ */
+function isInFolder(pathApi: path.PlatformPath, folderPath: string, filePath: string): boolean {
+  const relativePath: string = pathApi.relative(folderPath, filePath);
+  // The relative path is absolute if the file is on another drive. On win32 it is also absolute if its first
+  // segment is a drive, e.g. `C:\a.js` for `C:\dist\C:\a.js`.
+  return (
+    relativePath !== '' &&
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${pathApi.sep}`) &&
+    !pathApi.isAbsolute(relativePath)
+  );
+}
diff --git a/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts b/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
index bfa7e1e0dde..018a083d8e6 100644
--- a/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
@@ -26,10 +26,12 @@ import {
 } from './shared';
 import { tryLoadWebpackConfigurationAsync } from './WebpackConfigurationLoader';
 import { type DeferredWatchFileSystem, OverrideNodeWatchFSPlugin } from './DeferredWatchFileSystem';
+import { DeleteStaleAssetsPlugin } from './DeleteStaleAssetsPlugin';
 
 export interface IWebpackPluginOptions {
   devConfigurationPath?: string | undefined;
   configurationPath?: string | undefined;
+  deleteStaleAssetsInWatchMode?: boolean | undefined;
 }
 const SERVE_PARAMETER_LONG_NAME: '--serve' = '--serve';
 const WEBPACK_PACKAGE_NAME: 'webpack' = 'webpack';
@@ -122,6 +124,10 @@ export default class Webpack5Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
           } else {
             config.plugins.unshift(overrideWatchFSPlugin);
           }
+
+          if (options.deleteStaleAssetsInWatchMode) {
+            config.plugins.push(new DeleteStaleAssetsPlugin(taskSession.logger.terminal));
+          }
         }
       }
 
@@ -142,7 +148,9 @@ export default class Webpack5Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
           taskSession.logger.terminal
         );
         this.#webpack = await import(webpackPackagePath);
-        taskSession.logger.terminal.writeDebugLine(`Using Webpack from rig package at "${webpackPackagePath}"`);
+        taskSession.logger.terminal.writeDebugLine(
+          `Using Webpack from rig package at "${webpackPackagePath}"`
+        );
       } catch (e) {
         // Fallback to bundled version if not found in rig.
         this.#webpack = await import(WEBPACK_PACKAGE_NAME);
@@ -400,7 +408,8 @@ export default class Webpack5Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
     if (!isInitial && this.#watchFileSystems) {
       hasChanges = false;
       for (const watchFileSystem of this.#watchFileSystems) {
-        hasChanges = watchFileSystem.flush() || hasChanges;
+        // The upstream tasks may have just written files that the watcher has seen but not recorded yet.
+        hasChanges = (await watchFileSystem.flushAsync()) || hasChanges;
       }
     }
 
diff --git a/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json b/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json
index 8253d4b9761..0198bb2c06e 100644
--- a/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json
+++ b/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json
@@ -20,6 +20,11 @@
     "configurationPath": {
       "description": "Specifies a relative path to the Webpack configuration. The default value is \"./webpack.config.js\".",
       "type": "string"
+    },
+
+    "deleteStaleAssetsInWatchMode": {
+      "description": "If true, then in watch mode, each compilation without errors deletes the output files that earlier compilations emitted and it doesn't, such as the chunk of a dynamic import that was removed, or a file whose name contains a hash that changed. Only files that Webpack emitted into the output folder during the watch session are deleted; other files, such as the outputs of other tasks and files that Webpack writes outside the output folder, are never deleted. As with Webpack's output.clean option, if a plugin emits a file in some compilations only, a compilation that doesn't emit it deletes it. The default value is false.",
+      "type": "boolean"
     }
   }
 }
diff --git a/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
new file mode 100644
index 00000000000..6a7fa063ac3
--- /dev/null
+++ b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -0,0 +1,392 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as child_process from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import type { WatchOptions } from 'watchpack';
+
+import { DeferredWatchFileSystem, type InputFileSystem, type Watcher } from '../DeferredWatchFileSystem';
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that these tests read or set.
+ */
+interface IDirectoryWatcherInternals {
+  scanning: boolean;
+  _activeEvents: Map<string, boolean>;
+}
+
+interface IFlush {
+  changes: string[];
+  removals: string[];
+}
+
+// On Linux, inotify queues the event for a write during the write, so the event loop delivers it on its next poll.
+// Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+// Windows has no FIFOs, so there holdThreadPool() gives each thread about 100 ms of work instead, which can take
+// longer than flushAsync() waits on a machine whose CPUs are busy.
+const PBKDF2_ITERATIONS: number = 200000;
+
+describe(DeferredWatchFileSystem.name, () => {
+  let fifoPath: string | undefined;
+  let folder: string;
+  let watchOptions: WatchOptions;
+  let onChange: jest.Mock<void, []>;
+  let purge: jest.Mock<void, [string]>;
+  let watchFileSystem: DeferredWatchFileSystem;
+  let watcher: Watcher | undefined;
+  let flushes: IFlush[];
+  let compilationStartTimes: number[];
+  let releaseThreadPoolAsync: (() => Promise<void>) | undefined;
+
+  beforeAll(() => {
+    if (process.platform !== 'win32') {
+      const fifoFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack5-plugin-test-fifo-'));
+      fifoPath = path.join(fifoFolder, 'fifo');
+      child_process.execFileSync('mkfifo', [fifoPath]);
+    }
+  });
+
+  afterAll(() => {
+    if (fifoPath) {
+      // Not fs.rmSync(). In Node 22, it calls lstat on the FIFO, and until the next stat call,
+      // Node's fs.realpathSync() then returns some paths with their symlinks unresolved, so jest fails to
+      // require() a package that pnpm linked.
+      fs.unlinkSync(fifoPath);
+      fs.rmdirSync(path.dirname(fifoPath));
+    }
+  });
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack5-plugin-test-'));
+    watchOptions = { aggregateTimeout: 20 };
+    onChange = jest.fn();
+    purge = jest.fn();
+    watchFileSystem = new DeferredWatchFileSystem({ purge } as unknown as InputFileSystem, onChange);
+    watcher = undefined;
+    flushes = [];
+    compilationStartTimes = [];
+    releaseThreadPoolAsync = undefined;
+  });
+
+  afterEach(async () => {
+    // For a test that failed while it held the thread pool
+    await releaseThreadPoolAsync?.();
+    watcher?.close();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createFile(name: string): string {
+    const filePath: string = path.join(folder, name);
+    fs.writeFileSync(filePath, 'initial');
+    // An old modification time, so that the first scan doesn't report the file as changed.
+    const past: Date = new Date(Date.now() - 60000);
+    fs.utimesSync(filePath, past, past);
+    return filePath;
+  }
+
+  /**
+   * Watches the files as webpack's `Watching` does. When a flush calls back, the callback takes the start time of
+   * the compilation from the clock and pauses the watcher, as `Watching._go()` does.
+   */
+  function watch(files: string[], startTime: number): void {
+    watcher = watchFileSystem.watch(
+      files,
+      [],
+      [],
+      startTime,
+      watchOptions,
+      (error, fileTimeInfoEntries, contextTimeInfoEntries, changes, removals) => {
+        compilationStartTimes.push(Date.now());
+        watcher?.pause();
+        flushes.push({
+          changes: Array.from(changes ?? []).sort(),
+          removals: Array.from(removals ?? []).sort()
+        });
+      },
+      () => {
+        // Webpack's undelayed callback isn't used.
+      }
+    );
+  }
+
+  function getDirectoryWatchers(): IDirectoryWatcherInternals[] {
+    const internals: { watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> } } =
+      watchFileSystem.watcher as unknown as {
+        watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> };
+      };
+    return Array.from(internals.watcherManager.directoryWatchers.values());
+  }
+
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = performance.now() + 5000;
+    while (!condition()) {
+      if (performance.now() > deadline) {
+        throw new Error('The condition was not met within 5 seconds');
+      }
+      await setImmediateAsync();
+    }
+  }
+
+  async function watchAndWaitForScanAsync(files: string[]): Promise<void> {
+    watch(files, Date.now());
+    await waitForAsync(() => getDirectoryWatchers().every((directoryWatcher) => !directoryWatcher.scanning));
+  }
+
+  /**
+   * Holds every thread of the thread pool until the returned function releases them, so that the `fs.readdir()`
+   * and `fs.lstat()` calls that the watcher makes next wait in the queue. The returned function resolves when the
+   * threads are free again. On Windows, the threads are only busy for a while (see `PBKDF2_ITERATIONS`).
+   */
+  function holdThreadPool(): () => Promise<void> {
+    const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const releaseAsync: () => Promise<void> = fifoPath
+      ? holdThreadPoolWithFifo(fifoPath, threadCount)
+      : keepThreadPoolBusy(threadCount);
+    let releasePromise: Promise<void> | undefined;
+    releaseThreadPoolAsync = () => (releasePromise ??= releaseAsync());
+    return releaseThreadPoolAsync;
+  }
+
+  function holdThreadPoolWithFifo(fifo: string, threadCount: number): () => Promise<void> {
+    // Opening a FIFO for reading blocks the thread until something opens the FIFO for writing.
+    const fdPromises: Promise<number>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      fdPromises.push(
+        new Promise<number>((resolve, reject) => {
+          fs.open(fifo, 'r', (error, fd) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve(fd);
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      // Opening a FIFO for both reading and writing doesn't block on Linux or macOS, and it releases the threads.
+      // The FIFO stays open until every thread has opened it, so that none of them blocks again.
+      const writerFd: number = fs.openSync(fifo, 'r+');
+      try {
+        for (const fd of await Promise.all(fdPromises)) {
+          fs.closeSync(fd);
+        }
+      } finally {
+        fs.closeSync(writerFd);
+      }
+    };
+  }
+
+  function keepThreadPoolBusy(threadCount: number): () => Promise<void> {
+    const tasks: Promise<void>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      tasks.push(
+        new Promise<void>((resolve, reject) => {
+          crypto.pbkdf2('password', 'salt', PBKDF2_ITERATIONS, 64, 'sha512', (error) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve();
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      await Promise.all(tasks);
+    };
+  }
+
+  /**
+   * Waits until a `flushAsync()` call that was just made is waiting for pending events. It checks for them for the
+   * first time on the second turn of the event loop after the call, so after three turns it is waiting.
+   */
+  async function waitForFlushToWaitAsync(): Promise<void> {
+    for (let i: number = 0; i < 3; i++) {
+      await setImmediateAsync();
+    }
+  }
+
+  it('returns false before watch() is called', async () => {
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+  });
+
+  it('returns false and calls back nothing when nothing changed', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+
+    await setTimeoutAsync(50);
+    expect(flushes).toEqual([]);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file that was written just before the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    expect(purge).toHaveBeenCalledWith(file);
+    await setTimeoutAsync(50);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    fs.writeFileSync(file, 'changed');
+    await waitForAsync(() =>
+      getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
+    );
+    expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    // An fs callback runs in the poll phase, after the event loop has collected the events that were ready, so
+    // the event for this write can't arrive before the next poll phase.
+    const flushPromise: Promise<boolean> = new Promise<boolean>((resolve, reject) => {
+      fs.stat(file, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          fs.writeFileSync(file, 'changed');
+          resolve(watchFileSystem.flushAsync());
+        }
+      });
+    });
+
+    await expect(flushPromise).resolves.toBe(true);
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux(
+    'keeps the changes that the watcher reports while it waits, without calling onChange',
+    async () => {
+      const fileA: string = createFile('a.js');
+      const fileB: string = createFile('b.js');
+      await watchAndWaitForScanAsync([fileA, fileB]);
+      let aggregatedCount: number = 0;
+      watchFileSystem.watcher!.on('aggregated', () => {
+        aggregatedCount++;
+      });
+
+      fs.writeFileSync(fileA, 'changed');
+      await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
+      const releaseAsync: () => Promise<void> = holdThreadPool();
+      fs.writeFileSync(fileB, 'changed');
+      const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      await waitForAsync(() => aggregatedCount > 0);
+      await releaseAsync();
+      await expect(flushPromise).resolves.toBe(true);
+
+      expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  itOnLinux(
+    'starts the compilation after the changes it passes, so the next watch() does not report them again',
+    async () => {
+      const file: string = createFile('a.js');
+      await watchAndWaitForScanAsync([file]);
+
+      const reportedAgain: number[] = [];
+      for (let i: number = 0; i < 10; i++) {
+        fs.writeFileSync(file, `change ${i}`);
+        await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(file));
+        await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+        // When the compilation is done, webpack's Watching calls watch() again with the compilation's start time.
+        // The new watcher reports every change that was recorded at or after that time, as "outdated on attach".
+        watch([file], compilationStartTimes[i]);
+        await setImmediateAsync();
+        reportedAgain.push(watchFileSystem.watcher!.aggregatedChanges.size);
+      }
+
+      expect(reportedAgain).toEqual(new Array(10).fill(0));
+      expect(flushes).toHaveLength(10);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  it('includes a change that a scan in progress finds', async () => {
+    const subfolder: string = path.join(folder, 'sub');
+    fs.mkdirSync(subfolder);
+    const file: string = path.join(subfolder, 'a.js');
+    fs.writeFileSync(file, 'new');
+    const releaseAsync: () => Promise<void> = holdThreadPool();
+
+    // A start time before the file was written, as for a file that changed during the compilation.
+    watch([file], Date.now() - 60000);
+    expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  it('returns false when the watcher is closed while it waits', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    watcher!.close();
+
+    await expect(flushPromise).resolves.toBe(false);
+    expect(flushes).toEqual([]);
+  });
+
+  it('stops waiting after 1 second', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const directoryWatcher: IDirectoryWatcherInternals = getDirectoryWatchers()[0];
+    // An event whose fs.lstat() never finishes
+    directoryWatcher._activeEvents.set('never-finishes.js', false);
+
+    try {
+      const startTime: number = performance.now();
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+      const elapsedMs: number = performance.now() - startTime;
+
+      expect(elapsedMs).toBeGreaterThanOrEqual(999);
+      expect(elapsedMs).toBeLessThan(3000);
+    } finally {
+      directoryWatcher._activeEvents.delete('never-finishes.js');
+    }
+  });
+});
diff --git a/heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts b/heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts
new file mode 100644
index 00000000000..8d5020a08b1
--- /dev/null
+++ b/heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts
@@ -0,0 +1,688 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import webpack from 'webpack';
+import type { Compilation, Compiler, Configuration, Stats, WebpackPluginInstance } from 'webpack';
+import { AsyncParallelHook } from 'tapable';
+
+import { FileSystem } from '@rushstack/node-core-library';
+import type {
+  HeftConfiguration,
+  IHeftTaskRunHookOptions,
+  IHeftTaskRunIncrementalHookOptions,
+  IHeftTaskSession
+} from '@rushstack/heft';
+import { MockScopedLogger } from '@rushstack/heft/lib/pluginFramework/logging/MockScopedLogger';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { DeleteStaleAssetsPlugin } from '../DeleteStaleAssetsPlugin';
+import Webpack5Plugin, { type IWebpackPluginOptions } from '../Webpack5Plugin';
+import type { IWebpackConfiguration } from '../shared';
+
+const OUTPUT_PATH: string = path.resolve('/delete-stale-assets-test/dist');
+const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/DeleteStaleAssetsPlugin');
+
+function outputPathOf(name: string): string {
+  return path.join(OUTPUT_PATH, name);
+}
+
+class StubWebpackError extends Error {}
+
+interface IStubAsset {
+  name: string;
+  hotModuleReplacement?: boolean;
+}
+
+interface IEmitResult {
+  unlinkedPaths: string[];
+  errors: Error[];
+  warnings: Error[];
+}
+
+interface IStubCompilerOptions {
+  outputPath?: string;
+  join?: (path1: string, path2: string) => string;
+  withoutUnlink?: boolean;
+  webpackVersion?: string;
+}
+
+interface IStubCompiler {
+  compiler: Compiler;
+  terminalProvider: StringBufferTerminalProvider;
+  unlinkErrorCodes: Map<string, string>;
+  getEmitTapOptions(): unknown;
+  emitAsync(assets: (string | IStubAsset)[], hasErrors?: boolean): Promise<IEmitResult>;
+}
+
+function createStubCompiler(options: IStubCompilerOptions = {}): IStubCompiler {
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider(false);
+  const unlinkedPaths: string[] = [];
+  const unlinkErrorCodes: Map<string, string> = new Map();
+  let emitTap: ((compilation: Compilation) => Promise<void>) | undefined;
+  let emitTapOptions: unknown;
+
+  const outputFileSystem: Partial<NonNullable<Compiler['outputFileSystem']>> = {
+    join: options.join,
+    unlink: options.withoutUnlink
+      ? undefined
+      : (filePath: unknown, callback: (error: NodeJS.ErrnoException | null) => void): void => {
+          unlinkedPaths.push(filePath as string);
+          const code: string | undefined = unlinkErrorCodes.get(filePath as string);
+          setImmediate(() => {
+            if (code) {
+              const error: NodeJS.ErrnoException = new Error(`${code}: ${filePath}`);
+              error.code = code;
+              callback(error);
+            } else {
+              callback(null);
+            }
+          });
+        }
+  };
+
+  const compiler: Compiler = {
+    outputPath: options.outputPath ?? OUTPUT_PATH,
+    outputFileSystem,
+    hooks: {
+      emit: {
+        tapPromise: (tapOptions: unknown, fn: (compilation: Compilation) => Promise<void>): void => {
+          emitTapOptions = tapOptions;
+          emitTap = fn;
+        }
+      }
+    },
+    webpack: { version: options.webpackVersion ?? webpack.version, WebpackError: StubWebpackError }
+  } as unknown as Compiler;
+
+  new DeleteStaleAssetsPlugin(new Terminal(terminalProvider)).apply(compiler);
+
+  return {
+    compiler,
+    terminalProvider,
+    unlinkErrorCodes,
+    getEmitTapOptions: () => emitTapOptions,
+    emitAsync: async (assets: (string | IStubAsset)[], hasErrors: boolean = false): Promise<IEmitResult> => {
+      const errors: Error[] = [];
+      const warnings: Error[] = [];
+      const compilation: Compilation = {
+        getPath: (filename: string) => filename,
+        getAssets: () =>
+          assets.map((asset: string | IStubAsset) =>
+            typeof asset === 'string'
+              ? { name: asset, info: {} }
+              : { name: asset.name, info: { hotModuleReplacement: asset.hotModuleReplacement } }
+          ),
+        getStats: () => ({ hasErrors: () => hasErrors }),
+        errors,
+        warnings
+      } as unknown as Compilation;
+
+      const firstIndex: number = unlinkedPaths.length;
+      await emitTap!(compilation);
+      return { unlinkedPaths: unlinkedPaths.slice(firstIndex).sort(), errors, warnings };
+    }
+  };
+}
+
+describe(DeleteStaleAssetsPlugin.name, () => {
+  it('runs in the emit hook at the stage of webpack CleanPlugin', () => {
+    const stub: IStubCompiler = createStubCompiler();
+    expect(stub.getEmitTapOptions()).toEqual({ name: 'DeleteStaleAssetsPlugin', stage: 100 });
+  });
+
+  it('deletes nothing on the first emit', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    expect(await stub.emitAsync(['main.js', '1.js'])).toEqual({
+      unlinkedPaths: [],
+      errors: [],
+      warnings: []
+    });
+  });
+
+  it('deletes the files that the previous emit had and this emit does not, once', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', '1.js', 'nested/2.js', 'index.html']);
+
+    expect((await stub.emitAsync(['main.js', 'index.html'])).unlinkedPaths).toEqual(
+      [outputPathOf('1.js'), outputPathOf('nested/2.js')].sort()
+    );
+    expect((await stub.emitAsync(['main.js', 'index.html'])).unlinkedPaths).toEqual([]);
+  });
+
+  it('deletes nothing when files are only added', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js']);
+    expect((await stub.emitAsync(['main.js', '1.js'])).unlinkedPaths).toEqual([]);
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([outputPathOf('1.js')]);
+  });
+
+  it('deletes nothing on an emit with errors, and deletes what both emits had on the next emit without errors', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', '1.js']);
+
+    expect((await stub.emitAsync(['main.js', '2.js'], true)).unlinkedPaths).toEqual([]);
+    expect((await stub.emitAsync(['main.js', '3.js'])).unlinkedPaths).toEqual(
+      [outputPathOf('1.js'), outputPathOf('2.js')].sort()
+    );
+  });
+
+  it('writes a file without its query string or fragment', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js?v=1', 'style.css#fragment']);
+    expect((await stub.emitAsync(['main.js?v=2', 'style.css'])).unlinkedPaths).toEqual([]);
+    expect((await stub.emitAsync([])).unlinkedPaths).toEqual(
+      [outputPathOf('main.js'), outputPathOf('style.css')].sort()
+    );
+  });
+
+  it('keeps fragments in output paths for earlier webpack versions', async () => {
+    const stub: IStubCompiler = createStubCompiler({ webpackVersion: '5.99.9' });
+    await stub.emitAsync(['style.css#fragment']);
+    expect((await stub.emitAsync([])).unlinkedPaths).toEqual([outputPathOf('style.css#fragment')]);
+  });
+
+  it('never deletes a file that webpack writes outside the output folder', async () => {
+    // Webpack writes an asset to the output path joined with its name, with the posix or win32 path rules of
+    // the output path. So the file of "./../dot.json" is outside the output folder, and "..json" is in it.
+    const posix: IStubCompiler = createStubCompiler({ outputPath: '/stub/dist' });
+    await posix.emitAsync([
+      'main.js',
+      '../manifest.json',
+      '../../two-up.json',
+      './../dot.json',
+      'nested/./../../dot-nested.json',
+      'nested/..',
+      'nested/../..',
+      'nested/../1.js',
+      '/absolute/2.js',
+      '..json',
+      '..\\3.js'
+    ]);
+    expect((await posix.emitAsync(['main.js'])).unlinkedPaths).toEqual(
+      ['/stub/dist/1.js', '/stub/dist/absolute/2.js', '/stub/dist/..json', '/stub/dist/..\\3.js'].sort()
+    );
+
+    const win32: IStubCompiler = createStubCompiler({ outputPath: 'C:\\stub\\dist' });
+    await win32.emitAsync([
+      'main.js',
+      '..\\manifest.json',
+      '.\\..\\dot.json',
+      'C:\\absolute\\windows.js',
+      'nested\\..\\1.js',
+      'nested/2.js',
+      '\\\\server\\share\\3.js'
+    ]);
+    expect((await win32.emitAsync(['main.js'])).unlinkedPaths).toEqual(
+      ['C:\\stub\\dist\\1.js', 'C:\\stub\\dist\\nested\\2.js', 'C:\\stub\\dist\\server\\share\\3.js'].sort()
+    );
+
+    // An output file system whose join resolves an absolute name
+    const resolving: IStubCompiler = createStubCompiler({
+      outputPath: '/stub/dist',
+      join: path.posix.resolve
+    });
+    await resolving.emitAsync(['main.js', '/etc/outside.js', '1.js']);
+    expect((await resolving.emitAsync(['main.js'])).unlinkedPaths).toEqual(['/stub/dist/1.js']);
+  });
+
+  it('never deletes a hot update file, or a file that the current emit has', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', { name: 'main.1.hot-update.js', hotModuleReplacement: true }]);
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([]);
+
+    await stub.emitAsync(['main.js', 'both.js']);
+    expect(
+      (await stub.emitAsync(['main.js', { name: 'both.js', hotModuleReplacement: true }])).unlinkedPaths
+    ).toEqual([]);
+  });
+
+  it('ignores a file that is already gone', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    stub.unlinkErrorCodes.set(outputPathOf('1.js'), 'ENOENT');
+    await stub.emitAsync(['main.js', '1.js']);
+
+    expect(await stub.emitAsync(['main.js'])).toEqual({
+      unlinkedPaths: [outputPathOf('1.js')],
+      errors: [],
+      warnings: []
+    });
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([]);
+  });
+
+  it('reports a file that it could not delete as an error, and tries again on the next emit', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    stub.unlinkErrorCodes.set(outputPathOf('1.js'), 'EACCES');
+    await stub.emitAsync(['main.js', '1.js', '2.js']);
+
+    const failed: IEmitResult = await stub.emitAsync(['main.js']);
+    expect(failed.unlinkedPaths).toEqual([outputPathOf('1.js'), outputPathOf('2.js')].sort());
+    expect(failed.errors).toHaveLength(1);
+    expect(failed.errors[0]).toBeInstanceOf(StubWebpackError);
+    expect(failed.errors[0].message).toContain(`"${outputPathOf('1.js')}"`);
+    expect(failed.errors[0].message).toContain('EACCES');
+
+    stub.unlinkErrorCodes.clear();
+    expect(await stub.emitAsync(['main.js'])).toEqual({
+      unlinkedPaths: [outputPathOf('1.js')],
+      errors: [],
+      warnings: []
+    });
+  });
+
+  it('warns on each emit while the output file system cannot delete a file that the emit does not have', async () => {
+    const stub: IStubCompiler = createStubCompiler({ withoutUnlink: true });
+    await stub.emitAsync(['main.js', '1.js']);
+
+    const result: IEmitResult = await stub.emitAsync(['main.js']);
+    expect(result.errors).toEqual([]);
+    expect(result.warnings).toHaveLength(1);
+    expect(result.warnings[0].message).toContain("can't delete files");
+    expect((await stub.emitAsync(['main.js'])).warnings).toHaveLength(1);
+    expect((await stub.emitAsync(['main.js', '1.js'])).warnings).toEqual([]);
+  });
+
+  it("uses the output file system's join", async () => {
+    const stub: IStubCompiler = createStubCompiler({
+      join: (path1: string, path2: string) => path.join(path1, 'joined', path2)
+    });
+    await stub.emitAsync(['main.js', '1.js']);
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([outputPathOf('joined/1.js')]);
+  });
+
+  it('keeps the state of each compiler separate', async () => {
+    const first: IStubCompiler = createStubCompiler();
+    const second: IStubCompiler = createStubCompiler();
+    await first.emitAsync(['first.js']);
+    await second.emitAsync(['second.js']);
+
+    expect((await first.emitAsync([])).unlinkedPaths).toEqual([outputPathOf('first.js')]);
+    expect((await second.emitAsync(['second.js'])).unlinkedPaths).toEqual([]);
+  });
+
+  it('logs the number of deleted files, and each path in verbose output', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', '1.js', '2.js']);
+    await stub.emitAsync(['main.js']);
+
+    expect(stub.terminalProvider.getOutput()).toContain(
+      'Deleted 2 output file(s) that earlier compilations emitted and this compilation does'
+    );
+    const verboseOutput: string = stub.terminalProvider.getVerboseOutput();
+    expect(verboseOutput).toContain(`Deleted "${outputPathOf('1.js')}"`);
+    expect(verboseOutput).toContain(`Deleted "${outputPathOf('2.js')}"`);
+  });
+});
+
+describe(`${DeleteStaleAssetsPlugin.name} with webpack`, () => {
+  // Each test runs several webpack compilations, which can take longer than the default timeout of Jest on a
+  // busy machine.
+  const TIMEOUT_MS: number = 60_000;
+  const ENTRY: string = 'export const value = 1;\n';
+  const LAZY_IMPORT: string = "void import(/* webpackChunkName: 'lazy' */ './lazy');\n";
+  const MISSING_IMPORT: string = "void import('./missing');\n";
+
+  let modifiedTime: number = Math.floor(Date.now() / 1000) - 100000;
+
+  async function writeSourceAsync(filePath: string, contents: string): Promise<void> {
+    await FileSystem.writeFileAsync(filePath, contents, { ensureFolderExists: true });
+    // Give each version its own modified time, so that webpack's cache sees every edit.
+    modifiedTime += 10;
+    FileSystem.updateTimes(filePath, { accessedTime: modifiedTime, modifiedTime });
+  }
+
+  async function prepareFolderAsync(name: string): Promise<string> {
+    const folder: string = `${TEST_FOLDER}/${name}`;
+    await FileSystem.ensureEmptyFolderAsync(folder);
+    await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+    await writeSourceAsync(`${folder}/src/second.js`, "console.log('second');\n");
+    await writeSourceAsync(`${folder}/src/lazy.js`, 'export const lazy = 1;\n');
+    // Files that were in the output folder before the first compilation, such as another task's output
+    await FileSystem.writeFileAsync(`${folder}/dist/other-task.txt`, 'other task\n', {
+      ensureFolderExists: true
+    });
+    await FileSystem.writeFileAsync(`${folder}/dist/lazy.chunk.js`, '// before the first compilation\n');
+    return folder;
+  }
+
+  function createCompiler(
+    folder: string,
+    emitOnErrors: boolean,
+    otherPlugins: WebpackPluginInstance[] = []
+  ): Compiler {
+    const configuration: Configuration = {
+      mode: 'development',
+      devtool: false,
+      cache: { type: 'memory' },
+      context: folder,
+      entry: {
+        main: './src/entry.js',
+        second: './src/second.js'
+      },
+      output: {
+        path: `${folder}/dist`,
+        filename: '[name].js',
+        chunkFilename: '[name].chunk.js'
+      },
+      optimization: { emitOnErrors },
+      infrastructureLogging: { level: 'none' },
+      plugins: [
+        ...otherPlugins,
+        new DeleteStaleAssetsPlugin(new Terminal(new StringBufferTerminalProvider(false)))
+      ]
+    };
+    return webpack(configuration);
+  }
+
+  async function runAsync(compiler: Compiler): Promise<Stats> {
+    return await new Promise((resolve: (stats: Stats) => void, reject: (error: Error) => void) => {
+      compiler.run((error: Error | null, stats: Stats | undefined) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve(stats!);
+        }
+      });
+    });
+  }
+
+  async function closeAsync(compiler: Compiler): Promise<void> {
+    await new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+      compiler.close((error: Error | null | undefined) => (error ? reject(error) : resolve()));
+    });
+  }
+
+  async function readOutputAsync(folder: string): Promise<string[]> {
+    return (await FileSystem.readFolderItemNamesAsync(`${folder}/dist`)).sort();
+  }
+
+  it(
+    'deletes the chunk of a removed dynamic import and keeps unchanged files and files that it did not emit',
+    async () => {
+      const folder: string = await prepareFolderAsync('remove-chunk');
+      const compiler: Compiler = createCompiler(folder, true);
+      try {
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + LAZY_IMPORT);
+        await runAsync(compiler);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+        const stats: Stats = await runAsync(compiler);
+        expect(stats.hasErrors()).toBe(false);
+        // Webpack doesn't write an unchanged file again, but it's still one of the compilation's files.
+        expect(stats.compilation.emittedAssets.has('second.js')).toBe(false);
+        expect(stats.compilation.emittedAssets.has('main.js')).toBe(true);
+        expect(await readOutputAsync(folder)).toEqual(['main.js', 'other-task.txt', 'second.js']);
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'keeps a file that was in the output folder before the first compilation',
+    async () => {
+      const folder: string = await prepareFolderAsync('first-compilation');
+      const compiler: Compiler = createCompiler(folder, true);
+      try {
+        await runAsync(compiler);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + '// edit\n');
+        await runAsync(compiler);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+        expect(await FileSystem.readFileAsync(`${folder}/dist/lazy.chunk.js`)).toEqual(
+          '// before the first compilation\n'
+        );
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'keeps the files outside the output folder that a plugin emits in the first compilation only',
+    async () => {
+      const folder: string = await prepareFolderAsync('outside-output-folder');
+      // Another task's file, at the path that "./../manifest.json" would have if "." were a folder name
+      await FileSystem.writeFileAsync(`${folder}/dist/manifest.json`, 'other task\n');
+      let hasEmitted: boolean = false;
+      // Like a plugin that writes manifests next to the output folder once per session
+      const emitOncePlugin: WebpackPluginInstance = {
+        apply: (compiler: Compiler): void => {
+          compiler.hooks.thisCompilation.tap('EmitOncePlugin', (compilation: Compilation) => {
+            compilation.hooks.processAssets.tap('EmitOncePlugin', () => {
+              if (!hasEmitted) {
+                hasEmitted = true;
+                const { RawSource } = compiler.webpack.sources;
+                compilation.emitAsset('../manifests/once.json', new RawSource('{}\n'));
+                compilation.emitAsset('./../manifest.json', new RawSource('{}\n'));
+                compilation.emitAsset('once.json', new RawSource('{}\n'));
+              }
+            });
+          });
+        }
+      };
+      const compiler: Compiler = createCompiler(folder, true, [emitOncePlugin]);
+      try {
+        await runAsync(compiler);
+        expect(await FileSystem.readFileAsync(`${folder}/manifests/once.json`)).toEqual('{}\n');
+        expect(await FileSystem.readFileAsync(`${folder}/manifest.json`)).toEqual('{}\n');
+        expect(await readOutputAsync(folder)).toContain('once.json');
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + '// edit\n');
+        expect((await runAsync(compiler)).hasErrors()).toBe(false);
+        expect(await FileSystem.readFileAsync(`${folder}/manifests/once.json`)).toEqual('{}\n');
+        expect(await FileSystem.readFileAsync(`${folder}/manifest.json`)).toEqual('{}\n');
+        expect(await FileSystem.readFileAsync(`${folder}/dist/manifest.json`)).toEqual('other task\n');
+        // As with webpack's output.clean, a file in the output folder that the compilation doesn't emit is
+        // deleted.
+        expect(await readOutputAsync(folder)).not.toContain('once.json');
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'deletes nothing when a compilation with errors emits, and cleans up on the next compilation',
+    async () => {
+      const folder: string = await prepareFolderAsync('emit-on-errors');
+      const compiler: Compiler = createCompiler(folder, true);
+      try {
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + LAZY_IMPORT);
+        await runAsync(compiler);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + MISSING_IMPORT);
+        const failed: Stats = await runAsync(compiler);
+        expect(failed.hasErrors()).toBe(true);
+        expect(failed.compilation.emittedAssets.has('main.js')).toBe(true);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+        expect((await runAsync(compiler)).hasErrors()).toBe(false);
+        expect(await readOutputAsync(folder)).toEqual(['main.js', 'other-task.txt', 'second.js']);
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'deletes nothing when a compilation with errors does not emit, and cleans up on the next compilation',
+    async () => {
+      const folder: string = await prepareFolderAsync('no-emit-on-errors');
+      const compiler: Compiler = createCompiler(folder, false);
+      try {
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + LAZY_IMPORT);
+        await runAsync(compiler);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + MISSING_IMPORT);
+        const failed: Stats = await runAsync(compiler);
+        expect(failed.hasErrors()).toBe(true);
+        expect(failed.compilation.emittedAssets.size).toBe(0);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+        expect((await runAsync(compiler)).hasErrors()).toBe(false);
+        expect(await readOutputAsync(folder)).toEqual(['main.js', 'other-task.txt', 'second.js']);
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+});
+
+describe(`${Webpack5Plugin.name} with the deleteStaleAssetsInWatchMode option`, () => {
+  const FAKE_WEBPACK_MODULE: string = 'fake-webpack-for-DeleteStaleAssetsPlugin-test';
+  const createdConfigurations: IWebpackConfiguration[] = [];
+
+  jest.doMock(
+    FAKE_WEBPACK_MODULE,
+    () => ({
+      __esModule: true,
+      version: '5.0.0-fake',
+      default: (configuration: IWebpackConfiguration) => {
+        createdConfigurations.push(configuration);
+        let onDone: ((stats?: Stats) => void) | undefined;
+        return {
+          hooks: {
+            done: {
+              tap: (name: string, fn: (stats?: Stats) => void) => {
+                onDone = fn;
+              }
+            }
+          },
+          watch: () => {
+            setImmediate(() => onDone!());
+          },
+          run: (callback: (error: Error | null, stats?: Stats) => void) => callback(null, undefined),
+          close: (callback: (error?: Error | null) => void) => callback()
+        };
+      }
+    }),
+    { virtual: true }
+  );
+
+  beforeEach(() => {
+    createdConfigurations.length = 0;
+  });
+
+  async function runPluginAsync(
+    watch: boolean,
+    options: IWebpackPluginOptions,
+    configuration: IWebpackConfiguration
+  ): Promise<IWebpackConfiguration> {
+    const terminal: Terminal = new Terminal(new StringBufferTerminalProvider(false));
+    const logger: MockScopedLogger = new MockScopedLogger(terminal);
+    const run: AsyncParallelHook<IHeftTaskRunHookOptions> = new AsyncParallelHook(['runOptions']);
+    const runIncremental: AsyncParallelHook<IHeftTaskRunIncrementalHookOptions> = new AsyncParallelHook([
+      'runIncrementalOptions'
+    ]);
+    const taskSession: IHeftTaskSession = {
+      logger,
+      hooks: { run, runIncremental },
+      parameters: {
+        watch,
+        production: false,
+        getFlagParameter: () => ({ value: false })
+      },
+      parsedCommandLine: { commandName: 'build', unaliasedCommandName: 'build' },
+      taskName: 'webpack',
+      tempFolderPath: `${TEST_FOLDER}/temp`
+    } as unknown as IHeftTaskSession;
+    const heftConfiguration: HeftConfiguration = {
+      buildFolderPath: TEST_FOLDER,
+      rigPackageResolver: { resolvePackageAsync: async () => FAKE_WEBPACK_MODULE },
+      terminalProvider: { supportsColor: false }
+    } as unknown as HeftConfiguration;
+
+    const plugin: Webpack5Plugin = new Webpack5Plugin();
+    plugin.apply(taskSession, heftConfiguration, options);
+    plugin.accessor.hooks.onLoadConfiguration.tapPromise('test', async () => configuration);
+
+    if (watch) {
+      await runIncremental.promise({ requestRun: () => {} } as unknown as IHeftTaskRunIncrementalHookOptions);
+    } else {
+      await run.promise({} as unknown as IHeftTaskRunHookOptions);
+    }
+
+    expect(logger.errors).toEqual([]);
+    expect(createdConfigurations).toHaveLength(1);
+    return createdConfigurations[0];
+  }
+
+  function countPlugins(configuration: Configuration): number {
+    return (configuration.plugins ?? []).filter(
+      (plugin: unknown) => plugin instanceof DeleteStaleAssetsPlugin
+    ).length;
+  }
+
+  it('adds the plugin in watch mode', async () => {
+    const configuration: IWebpackConfiguration = await runPluginAsync(
+      true,
+      { deleteStaleAssetsInWatchMode: true },
+      { plugins: [] }
+    );
+    expect(countPlugins(configuration as Configuration)).toBe(1);
+  });
+
+  it('adds its own instance to each configuration', async () => {
+    const configurations: IWebpackConfiguration = await runPluginAsync(
+      true,
+      { deleteStaleAssetsInWatchMode: true },
+      [{}, { plugins: [] }]
+    );
+    const [first, second] = configurations as Configuration[];
+    expect(countPlugins(first)).toBe(1);
+    expect(countPlugins(second)).toBe(1);
+    expect(first.plugins!.find((plugin: unknown) => plugin instanceof DeleteStaleAssetsPlugin)).not.toBe(
+      second.plugins!.find((plugin: unknown) => plugin instanceof DeleteStaleAssetsPlugin)
+    );
+  });
+
+  it('does not add the plugin when the option is not set', async () => {
+    const configuration: IWebpackConfiguration = await runPluginAsync(true, {}, { plugins: [] });
+    expect(countPlugins(configuration as Configuration)).toBe(0);
+  });
+
+  it('does not add the plugin outside watch mode', async () => {
+    const configuration: IWebpackConfiguration = await runPluginAsync(
+      false,
+      { deleteStaleAssetsInWatchMode: true },
+      { plugins: [] }
+    );
+    expect(countPlugins(configuration as Configuration)).toBe(0);
+  });
+});
diff --git a/libraries/credential-cache/src/CredentialCache.ts b/libraries/credential-cache/src/CredentialCache.ts
index c7535b81872..7dc23b781d2 100644
--- a/libraries/credential-cache/src/CredentialCache.ts
+++ b/libraries/credential-cache/src/CredentialCache.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { FileSystem, JsonFile, JsonSchema, LockFile, User, Objects } from '@rushstack/node-core-library';
@@ -15,6 +16,8 @@ export const RUSH_USER_FOLDER_NAME: '.rush-user' = '.rush-user';
 
 const DEFAULT_CACHE_FILENAME: 'credentials.json' = 'credentials.json';
 const LATEST_CREDENTIALS_JSON_VERSION: string = '0.1.0';
+// Shared so that the schema is compiled once, rather than on every load (about 5 ms each)
+const CREDENTIALS_JSON_SCHEMA: JsonSchema = JsonSchema.fromLoadedObject(schemaJson);
 
 interface ICredentialCacheJson {
   version: string;
@@ -29,6 +32,39 @@ interface ICacheEntryJson {
   credentialMetadata?: object;
 }
 
+/**
+ * Loads and validates the credentials file. Returns undefined if the file doesn't exist.
+ */
+async function loadCredentialsJsonAsync(cacheFilePath: string): Promise<ICredentialCacheJson | undefined> {
+  let contents: string;
+  try {
+    contents = await FileSystem.readFileAsync(cacheFilePath);
+  } catch (e) {
+    if (FileSystem.isNotExistError(e as Error)) {
+      return undefined;
+    }
+
+    throw new Error(`Error reading "${cacheFilePath}":${os.EOL}  ${(e as Error).message}`);
+  }
+
+  let credentialsJson: ICredentialCacheJson;
+  try {
+    credentialsJson = JsonFile.parseString(contents);
+  } catch (e) {
+    // Don't use the parser's message: it quotes the text around the problem, which can be a credential
+    const { row, column } = e as { row?: unknown; column?: unknown };
+    const position: string =
+      typeof row === 'number' && typeof column === 'number' ? ` (line ${row}, column ${column})` : '';
+    throw new Error(
+      `Error reading "${cacheFilePath}": the file is not valid JSON${position}. ` +
+        'Its contents are not shown because it stores credentials. Correct the file or delete it.'
+    );
+  }
+
+  CREDENTIALS_JSON_SCHEMA.validateObject(credentialsJson, cacheFilePath);
+  return credentialsJson;
+}
+
 /**
  * @public
  */
@@ -84,16 +120,7 @@ export class CredentialCache implements Disposable {
     }
     const cacheFilePath: string = `${cacheDirectory}/${cacheFileName}`;
 
-    const jsonSchema: JsonSchema = JsonSchema.fromLoadedObject(schemaJson);
-
-    let loadedJson: ICredentialCacheJson | undefined;
-    try {
-      loadedJson = await JsonFile.loadAndValidateAsync(cacheFilePath, jsonSchema);
-    } catch (e) {
-      if (!FileSystem.isErrnoException(e as Error)) {
-        throw e;
-      }
-    }
+    const loadedJson: ICredentialCacheJson | undefined = await loadCredentialsJsonAsync(cacheFilePath);
 
     let lockfile: LockFile | undefined;
     if (options.supportEditing) {
diff --git a/libraries/credential-cache/src/test/CredentialCache.test.ts b/libraries/credential-cache/src/test/CredentialCache.test.ts
index 5bdb13c49e6..f8bbc6a7640 100644
--- a/libraries/credential-cache/src/test/CredentialCache.test.ts
+++ b/libraries/credential-cache/src/test/CredentialCache.test.ts
@@ -2,11 +2,12 @@
 // See LICENSE in the project root for license information.
 
 import { mockGetHomeFolder } from './CredentialCache.mock';
-import { LockFile, Async, FileSystem } from '@rushstack/node-core-library';
+import { LockFile, Async, FileSystem, JsonFile, JsonSchema } from '@rushstack/node-core-library';
 import { CredentialCache, type ICredentialCacheOptions, RUSH_USER_FOLDER_NAME } from '../CredentialCache';
 
 const FAKE_HOME_FOLDER: string = 'temp';
 const FAKE_RUSH_USER_FOLDER: string = `${FAKE_HOME_FOLDER}/${RUSH_USER_FOLDER_NAME}`;
+const FAKE_SAS: string = 'sv=2025-01-05&sp=rwl&sig=FAKESIGNATURE0123';
 
 interface IPathsTestCase extends Required<Pick<ICredentialCacheOptions, 'cacheFilePath'>> {
   testCaseName: string;
@@ -392,4 +393,92 @@ describe(CredentialCache.name, () => {
       `"This instance of CredentialCache does not support editing."`
     );
   });
+
+  it('validates every load with the same schema object, so the schema is compiled once', async () => {
+    fakeFilesystem[`${FAKE_RUSH_USER_FOLDER}/credentials.json`] = JSON.stringify({
+      version: '0.1.0',
+      cacheEntries: {}
+    });
+    const validateObjectSpy: jest.SpyInstance = jest.spyOn(JsonSchema.prototype, 'validateObject');
+
+    for (let i: number = 0; i < 2; i++) {
+      const credentialCache: CredentialCache = await CredentialCache.initializeAsync({
+        supportEditing: false
+      });
+      credentialCache.dispose();
+    }
+
+    expect(validateObjectSpy).toHaveBeenCalledTimes(2);
+    expect(validateObjectSpy.mock.instances[1]).toBe(validateObjectSpy.mock.instances[0]);
+    validateObjectSpy.mockRestore();
+  });
+
+  describe('a credentials file that is not valid JSON', () => {
+    const cacheFilePath: string = `${FAKE_RUSH_USER_FOLDER}/credentials.json`;
+    const validJson: string = JSON.stringify(
+      {
+        version: '0.1.0',
+        cacheEntries: {
+          'test-credential': {
+            expires: 0,
+            credential: FAKE_SAS
+          }
+        }
+      },
+      undefined,
+      2
+    );
+    const endOfSas: number = validJson.indexOf(FAKE_SAS) + FAKE_SAS.length;
+
+    it.each([
+      {
+        name: 'cut off after the credential',
+        contents: validJson.slice(0, endOfSas + 1)
+      },
+      {
+        name: 'cut off inside the credential',
+        contents: validJson.slice(0, endOfSas - 4)
+      },
+      {
+        name: 'with an unexpected character after the credential',
+        contents: `${validJson.slice(0, endOfSas + 1)} x${validJson.slice(endOfSas + 1)}`
+      }
+    ])('reports the position without the contents when it is $name', async ({ contents }) => {
+      fakeFilesystem[cacheFilePath] = contents;
+      let parserError: (Error & { row?: number; column?: number }) | undefined;
+      try {
+        JsonFile.parseString(contents);
+      } catch (e) {
+        parserError = e as Error;
+      }
+      // The parser's own message quotes the credential
+      expect(parserError?.message).toContain('sig=FAKESIGNATURE');
+      expect(parserError?.row).toEqual(6);
+
+      const expectedError: Error = new Error(
+        `Error reading "${cacheFilePath}": the file is not valid JSON ` +
+          `(line ${parserError?.row}, column ${parserError?.column}). ` +
+          'Its contents are not shown because it stores credentials. Correct the file or delete it.'
+      );
+      for (const supportEditing of [false, true]) {
+        await expect(CredentialCache.initializeAsync({ supportEditing })).rejects.toThrow(expectedError);
+      }
+    });
+  });
+
+  it('reports a credentials file that does not match its schema without the values', async () => {
+    fakeFilesystem[`${FAKE_RUSH_USER_FOLDER}/credentials.json`] = JSON.stringify({
+      version: '0.1.0',
+      cacheEntries: {
+        'test-credential': {
+          expires: 'never',
+          credential: FAKE_SAS
+        }
+      }
+    });
+
+    await expect(CredentialCache.initializeAsync({ supportEditing: false })).rejects.toThrow(
+      /^JSON validation failed:\s+temp\/\.rush-user\/credentials\.json\s+Error: #\/cacheEntries\/test-credential\/expires\s+must be number$/
+    );
+  });
 });
diff --git a/libraries/node-core-library/src/LockFile.ts b/libraries/node-core-library/src/LockFile.ts
index c8c913056e4..985d4cc734e 100644
--- a/libraries/node-core-library/src/LockFile.ts
+++ b/libraries/node-core-library/src/LockFile.ts
@@ -138,6 +138,158 @@ export function getProcessStartTime(pid: number): string | undefined {
   throw new Error(`Unexpected output from the "ps" command`);
 }
 
+const LSTART_MONTHS: string[] = [
+  'Jan',
+  'Feb',
+  'Mar',
+  'Apr',
+  'May',
+  'Jun',
+  'Jul',
+  'Aug',
+  'Sep',
+  'Oct',
+  'Nov',
+  'Dec'
+];
+
+/**
+ * Helper function that is exported for unit tests only.
+ * Returns the time when the process started, in milliseconds since the epoch, rounded down to a whole second.
+ * Unlike getProcessStartTime(), the result doesn't depend on the time zone or locale of the current process.
+ * Returns undefined if the process doesn't exist with that pid, or if its start time can't be determined.
+ */
+export function getProcessStartTimeMs(pid: number): number | undefined {
+  const pidString: string = pid.toString();
+  if (pid < 0 || pidString.indexOf('e') >= 0 || pidString.indexOf('E') >= 0) {
+    return undefined;
+  }
+  let args: string[];
+  if (process.platform === 'darwin') {
+    args = [`-p ${pidString}`, '-o lstart'];
+  } else if (process.platform === 'linux') {
+    args = ['-p', pidString, '-o', 'lstart'];
+  } else {
+    return undefined;
+  }
+
+  // "ps -o lstart" formats the time using the time zone and locale of the "ps" process
+  const psResult: child_process.SpawnSyncReturns<string> = child_process.spawnSync('ps', args, {
+    encoding: 'utf8',
+    env: { ...process.env, LC_ALL: 'C', TZ: 'UTC0' }
+  });
+
+  return _parseLstartAsUtcMs((psResult.stdout || '').split('\n')[1] || '');
+}
+
+/**
+ * Parses a start time that "ps -o lstart" printed with the C locale, for example "Sun Sep 27 17:15:08 2026",
+ * as if it were in UTC.  Returns the time in milliseconds since the epoch, or undefined if the text has another
+ * format, such as the format of another locale.
+ */
+function _parseLstartAsUtcMs(lstart: string): number | undefined {
+  const match: RegExpExecArray | null =
+    /^\s*[A-Za-z]{3} ([A-Za-z]{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})\s*$/.exec(lstart);
+  if (!match) {
+    return undefined;
+  }
+  const month: number = LSTART_MONTHS.indexOf(match[1]);
+  if (month < 0) {
+    return undefined;
+  }
+  return Date.UTC(
+    Number(match[6]),
+    month,
+    Number(match[2]),
+    Number(match[3]),
+    Number(match[4]),
+    Number(match[5])
+  );
+}
+
+const LSTART_DAYS: string[] = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+
+// The number of clock ticks per second in /proc/[pid]/stat.  This is sysconf(_SC_CLK_TCK), which Linux fixes
+// at 100 (USER_HZ) on every architecture that Node.js supports.
+const LINUX_CLOCK_TICKS_PER_SECOND: number = 100;
+
+/**
+ * Helper function that is exported for unit tests only.
+ * Linux only: returns the time when the system booted, in seconds since the epoch, from the "btime" line of
+ * /proc/stat.  "ps -o lstart" adds the start time of a process to this time.
+ */
+export function getLinuxBootTimeSeconds(): number {
+  const match: RegExpExecArray | null = /^btime (\d+)$/m.exec(FileSystem.readFile('/proc/stat'));
+  if (!match) {
+    throw new Error('The contents of /proc/stat have an unexpected format');
+  }
+  return Number(match[1]);
+}
+
+/**
+ * The start time of a Linux process, in the formats that getProcessStartTime() returns.
+ */
+export interface ILinuxProcessStartTime {
+  /**
+   * What "ps -o lstart" prints with the C locale and the current time zone, for example "Mon Sep 28 13:52:39 2026"
+   */
+  lstart: string;
+  /**
+   * The start time in clock ticks after boot, from /proc/[pid]/stat.  getProcessStartTime() returns this if
+   * "ps" can't be run.
+   */
+  ticks: string;
+  /**
+   * The start time in milliseconds since the epoch, rounded down to a whole second like lstart.  This is what
+   * getProcessStartTimeMs() returns, and it doesn't depend on the time zone.
+   */
+  startTimeMs: number;
+}
+
+/**
+ * Helper function that is exported for unit tests only.
+ * Linux only: returns the start time of a process from /proc, without running "ps" like getProcessStartTime()
+ * does.  Returns undefined if the process doesn't exist with that pid.  Throws if /proc can't be read for another
+ * reason, or if it has an unexpected format.
+ * @param pid - The process ID
+ * @param getBootTimeSeconds - Returns what getLinuxBootTimeSeconds() returns
+ */
+export function getLinuxProcessStartTime(
+  pid: number,
+  getBootTimeSeconds: () => number
+): ILinuxProcessStartTime | undefined {
+  const pidString: string = pid.toString();
+  if (pid < 0 || pidString.indexOf('e') >= 0 || pidString.indexOf('E') >= 0) {
+    throw new Error(`"pid" is negative or too large`);
+  }
+  let stat: string;
+  try {
+    stat = FileSystem.readFile(`/proc/${pidString}/stat`);
+  } catch (error) {
+    // ESRCH means that the process exited while we were reading the file.
+    if (FileSystem.isNotExistError(error as Error) || (error as NodeJS.ErrnoException).code === 'ESRCH') {
+      return undefined;
+    }
+    throw error;
+  }
+  const ticks: string | undefined = getProcessStartTimeFromProcStat(stat);
+  if (ticks === undefined || !/^[0-9]+$/.test(ticks)) {
+    throw new Error(`The contents of /proc/${pidString}/stat have an unexpected format`);
+  }
+
+  // Like "ps", round down to a whole second and use "%a %b %e %H:%M:%S %Y" in the local time zone.
+  const startTimeMs: number =
+    (getBootTimeSeconds() + Math.floor(Number(ticks) / LINUX_CLOCK_TICKS_PER_SECOND)) * 1000;
+  const date: Date = new Date(startTimeMs);
+  const twoDigits: (value: number) => string = (value: number) => (value < 10 ? `0${value}` : `${value}`);
+  const lstart: string =
+    `${LSTART_DAYS[date.getDay()]} ${LSTART_MONTHS[date.getMonth()]} ` +
+    `${date.getDate() < 10 ? ' ' : ''}${date.getDate()} ` +
+    `${twoDigits(date.getHours())}:${twoDigits(date.getMinutes())}:${twoDigits(date.getSeconds())} ` +
+    `${date.getFullYear()}`;
+  return { lstart, ticks, startTimeMs };
+}
+
 // A set of locks that currently exist in the current process, to be used when
 // multiple locks are acquired in the same process.
 const IN_PROC_LOCKS: Set<string> = new Set<string>();
@@ -145,12 +297,41 @@ const IN_PROC_LOCKS: Set<string> = new Set<string>();
 // The function used to determine a process's start time.  Overridable for unit testing.
 let _getStartTime: (pid: number) => string | undefined = getProcessStartTime;
 
+// On Linux, what _getStartTime() returned for the current process, and what getLinuxProcessStartTime()
+// returned for it at the same time.  See _getCurrentProcessStartTime().
+let _currentProcessStartTime: { startTime: string; linuxLstart: string } | undefined;
+
 /**
  * For unit testing only: overrides the function used to determine a process's start time.
  * @internal
  */
 export function _setLockFileGetProcessStartTime(fn: (pid: number) => string | undefined): void {
   _getStartTime = fn;
+  _currentProcessStartTime = undefined;
+}
+
+/**
+ * Returns the start time of the current process, which its lockfiles contain.  On Linux, this runs "ps" again only
+ * if the start time that /proc gives changes, which happens when the system clock is set or process.env.TZ
+ * changes.  A process that acquires locks often would otherwise run "ps" each time, which is slow when there are
+ * many processes.
+ */
+function _getCurrentProcessStartTime(getLinuxBootTime: () => number): string | undefined {
+  let linuxLstart: string | undefined;
+  if (process.platform === 'linux') {
+    try {
+      linuxLstart = getLinuxProcessStartTime(process.pid, getLinuxBootTime)?.lstart;
+    } catch (error) {
+      // /proc can't be read, so run "ps" every time.
+    }
+  }
+  if (linuxLstart !== undefined && _currentProcessStartTime?.linuxLstart === linuxLstart) {
+    return _currentProcessStartTime.startTime;
+  }
+  const startTime: string | undefined = _getStartTime(process.pid);
+  _currentProcessStartTime =
+    startTime !== undefined && linuxLstart !== undefined ? { startTime, linuxLstart } : undefined;
+  return startTime;
 }
 
 /**
@@ -415,6 +596,142 @@ function _tryAcquireInner(
   }
 }
 
+// How much later than a lockfile's birthtime its process may appear to have started.  "ps" reports whole
+// seconds, and the system clock can be adjusted while a process runs.
+const START_TIME_TOLERANCE_MS: number = 5000;
+
+// Every time zone is ahead of or behind UTC by a whole number of 15-minute steps, from UTC-12 to UTC+14.
+const TIME_ZONE_OFFSET_STEP_MS: number = 15 * 60 * 1000;
+const MIN_TIME_ZONE_OFFSET_MS: number = -12 * 60 * 60 * 1000;
+const MAX_TIME_ZONE_OFFSET_MS: number = 14 * 60 * 60 * 1000;
+
+/**
+ * Returns false if the start time in a lockfile can't be what "ps -o lstart" printed for a process that started
+ * at `startTimeMs`, in any time zone.  Returns true if it can, or if the start time is in a format other than the
+ * C locale's, which can't be checked.
+ *
+ * On Linux, the start time that "ps" reports for a process moves with the system clock.  So if the clock is
+ * changed by more than START_TIME_TOLERANCE_MS while a process holds a lock, this can return false for the
+ * lockfile of that process, which is then treated as stale.
+ *
+ * A custom POSIX TZ string can set an offset that no time zone has, such as TZ=XYZ-5:07.  This returns false
+ * for a start time written with such an offset, so a process with another time zone treats that lockfile as
+ * stale.
+ */
+function _isStartTimeInSomeTimeZone(lockFileStartTime: string, startTimeMs: number): boolean {
+  const lockFileStartTimeMs: number | undefined = _parseLstartAsUtcMs(lockFileStartTime);
+  if (lockFileStartTimeMs === undefined) {
+    return true;
+  }
+  const offsetMs: number = lockFileStartTimeMs - startTimeMs;
+  if (
+    offsetMs < MIN_TIME_ZONE_OFFSET_MS - START_TIME_TOLERANCE_MS ||
+    offsetMs > MAX_TIME_ZONE_OFFSET_MS + START_TIME_TOLERANCE_MS
+  ) {
+    return false;
+  }
+  const stepOffsetMs: number = Math.round(offsetMs / TIME_ZONE_OFFSET_STEP_MS) * TIME_ZONE_OFFSET_STEP_MS;
+  return Math.abs(offsetMs - stepOffsetMs) <= START_TIME_TOLERANCE_MS;
+}
+
+/**
+ * Called when the start time in the lockfile of another running process differs from the start time that
+ * we got for its PID.  Returns true if the lockfile still belongs to that process.
+ */
+function _isLockFileOfRunningProcess(
+  pid: string,
+  lockFileStartTime: string | undefined,
+  lockFileBirthtimeMs: number | undefined
+): boolean {
+  // "ps -o lstart" formats the start time using the time zone and locale of the process that runs it,
+  // so a process whose TZ, LANG, LC_TIME or LC_ALL differs from ours wrote its start time differently.
+  // If the start time differs because the lockfile's process exited and the OS gave its PID to a new
+  // process, then the new process usually started after the lockfile was created.  It can have started
+  // before, if the lockfile was copied or restored, or if a process in another PID namespace (such as a
+  // container) wrote it.  So the lockfile must also hold the process's start time in some time zone.
+  // An empty lockfile is still treated as stale here, as before.
+  if (!lockFileStartTime || lockFileBirthtimeMs === undefined) {
+    return false;
+  }
+  const startTimeMs: number | undefined = getProcessStartTimeMs(parseInt(pid, 10));
+  return (
+    startTimeMs !== undefined &&
+    startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS &&
+    _isStartTimeInSomeTimeZone(lockFileStartTime, startTimeMs)
+  );
+}
+
+/**
+ * What /proc shows about the process that wrote the lockfile of another process.  See
+ * _getLinuxLockFileProcessState().
+ */
+type LinuxLockFileProcessState = 'running' | 'exited' | 'unknown';
+
+/**
+ * Uses /proc to tell whether the lockfile of another process belongs to the running process with its PID.  This
+ * is much faster than running "ps", which reads the files of every process in /proc.
+ * @returns `running` if it does.  `exited` if /proc has no process with that PID, while it has the current
+ * process: "ps" reads the same /proc, so it wouldn't find a process with that PID either.  `unknown` if the start
+ * time in the lockfile is different, if /proc can't tell, or if this isn't Linux.  Then the caller must run "ps",
+ * so this never makes the lockfile of a running process stale.
+ */
+function _getLinuxLockFileProcessState(
+  pid: string,
+  lockFileStartTime: string | undefined,
+  lockFileBirthtimeMs: number | undefined,
+  getBootTimeSeconds: () => number
+): LinuxLockFileProcessState {
+  if (process.platform !== 'linux') {
+    return 'unknown';
+  }
+  let startTime: ILinuxProcessStartTime | undefined;
+  try {
+    startTime = getLinuxProcessStartTime(parseInt(pid, 10), getBootTimeSeconds);
+  } catch (error) {
+    // For example, /proc isn't mounted, or it doesn't let us read the files of this process.
+    return 'unknown';
+  }
+  if (startTime === undefined) {
+    return _isCurrentProcessInLinuxProc(getBootTimeSeconds) ? 'exited' : 'unknown';
+  }
+  if (!lockFileStartTime) {
+    return 'unknown';
+  }
+  // These are the formats that getProcessStartTime() returns.
+  if (lockFileStartTime === startTime.lstart || lockFileStartTime === startTime.ticks) {
+    return 'running';
+  }
+  // The other process may have written its start time with another time zone or locale.  This is the check
+  // that _isLockFileOfRunningProcess() makes after running "ps" twice, with the start time from /proc.
+  if (
+    lockFileBirthtimeMs !== undefined &&
+    startTime.startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS &&
+    _isStartTimeInSomeTimeZone(lockFileStartTime, startTime.startTimeMs)
+  ) {
+    return 'running';
+  }
+  return 'unknown';
+}
+
+/**
+ * Returns true if /proc has the current process under its PID.  Otherwise, for example if /proc isn't mounted,
+ * a PID that /proc doesn't have may still belong to a running process.
+ */
+function _isCurrentProcessInLinuxProc(getBootTimeSeconds: () => number): boolean {
+  try {
+    return getLinuxProcessStartTime(process.pid, getBootTimeSeconds) !== undefined;
+  } catch (error) {
+    return false;
+  }
+}
+
+// Returned by _tryAcquireMacOrLinuxOnce() when the lockfile of another process has the same birthtime as ours.
+const TIED: unique symbol = Symbol('tied');
+// The maximum number of attempts that _tryAcquireMacOrLinux() makes while lockfiles keep tying.
+const MAX_TIED_ATTEMPTS: number = 4;
+// After a tie, the next attempt waits a random time of up to this many milliseconds times the attempt number.
+const TIE_RETRY_DELAY_MS: number = 20;
+
 /**
  * Attempts to acquire the lock on a Linux or OSX machine
  */
@@ -423,19 +740,59 @@ function _tryAcquireMacOrLinux(
   resourceName: string,
   pidLockFilePath: string
 ): ITryAcquireResult | undefined {
-  // get the current process identifier (PID)
-  const pid: number = process.pid;
+  // On Linux, the time when the system booted, which we read from /proc/stat at most once per call
+  let linuxBootTimeSeconds: number | undefined;
+  const getLinuxBootTime: () => number = () => {
+    if (linuxBootTimeSeconds === undefined) {
+      linuxBootTimeSeconds = getLinuxBootTimeSeconds();
+    }
+    return linuxBootTimeSeconds;
+  };
 
   // Suppose that a process terminates unexpectedly without deleting its PID-based lockfile,
   // then we check to see if the process is still alive.  The OS may have given the same PID
   // to a new process, how to detect that?  We will rely on getProcessStartTime() which
   // is stored in the file itself for comparison.
-  const startTime: string | undefined = _getStartTime(pid);
+  const startTime: string | undefined = _getCurrentProcessStartTime(getLinuxBootTime);
 
   if (!startTime) {
     throw new Error(`Unable to calculate start time for current process.`);
   }
 
+  for (let attempt: number = 1; ; attempt++) {
+    const result: ITryAcquireResult | typeof TIED | undefined = _tryAcquireMacOrLinuxOnce(
+      resourceFolder,
+      resourceName,
+      pidLockFilePath,
+      startTime,
+      getLinuxBootTime
+    );
+    if (result !== TIED) {
+      return result;
+    }
+    if (attempt >= MAX_TIED_ATTEMPTS) {
+      return undefined;
+    }
+    // If the other process also saw the tie, neither of us has the lock.  Wait a random time so that
+    // our next lockfile is unlikely to tie again, and try again.
+    const delayMs: number = 1 + Math.floor(Math.random() * TIE_RETRY_DELAY_MS * attempt);
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
+  }
+}
+
+/**
+ * Makes one attempt to acquire the lock on a Linux or OSX machine
+ */
+function _tryAcquireMacOrLinuxOnce(
+  resourceFolder: string,
+  resourceName: string,
+  pidLockFilePath: string,
+  startTime: string,
+  getLinuxBootTime: () => number
+): ITryAcquireResult | typeof TIED | undefined {
+  // get the current process identifier (PID)
+  const pid: number = process.pid;
+
   let lockFileHandle: FileWriter | undefined;
 
   let result: ITryAcquireResult | undefined;
@@ -448,8 +805,8 @@ function _tryAcquireMacOrLinux(
     lockFileHandle.write(startTime);
     const currentBirthTimeMs: number = lockFileHandle.getStatistics().birthtime.getTime();
 
-    let smallestBirthTimeMs: number = currentBirthTimeMs;
-    let smallestBirthTimePid: string = pid.toString();
+    // Set if another process has a lockfile with the same birthtime as ours
+    let tied: boolean = false;
 
     // now, scan the directory for all lockfiles
     const files: string[] = FileSystem.readFolderItemNames(resourceFolder);
@@ -475,9 +832,6 @@ function _tryAcquireMacOrLinux(
 
         // console.log(`FOUND OTHER LOCKFILE: ${otherPid}`);
 
-        // Actual start time of the other PID
-        const otherPidCurrentStartTime: string | undefined = _getStartTime(parseInt(otherPid, 10));
-
         // The start time from the file, which we will compare with otherPidCurrentStartTime
         // to determine whether the PID got reused by a new process.
         let otherPidOldStartTime: string | undefined;
@@ -506,6 +860,13 @@ function _tryAcquireMacOrLinux(
 
             // console.log(`Ignoring lock for pid ${otherPid} because its lockfile is newer than ours.`);
             continue;
+          } else if (otherBirthtimeMs === currentBirthTimeMs) {
+            // ==> Tie
+            // The other process's file has the same birthtime as ours, and they may acquire the lock
+            // after they finish writing the contents, so we must not treat this file as stale below.
+            // See the comment about ties below.
+            tied = true;
+            continue;
           } else if (
             otherBirthtimeMs - currentBirthTimeMs < 0 &&
             otherBirthtimeMs - currentBirthTimeMs > -1000
@@ -522,16 +883,50 @@ function _tryAcquireMacOrLinux(
         }
 
         // console.log(`Other pid ${otherPid} lockfile has start time: "${otherPidOldStartTime}"`);
+
+        // Actual start time of the other PID.  On Linux, /proc usually shows that the file belongs to the
+        // process with that PID, even if that process has another time zone or locale, or that no process has
+        // that PID, and then we don't need to run "ps", which is slow when there are many processes.  When many
+        // processes wait for the same lock, each of their attempts checks the file of every other process, and
+        // a process that exits without releasing its lock leaves its file for the next process to check.
+        let otherPidCurrentStartTime: string | undefined;
+        switch (
+          _getLinuxLockFileProcessState(otherPid, otherPidOldStartTime, otherBirthtimeMs, getLinuxBootTime)
+        ) {
+          case 'running': {
+            otherPidCurrentStartTime = otherPidOldStartTime;
+            break;
+          }
+          case 'exited': {
+            otherPidCurrentStartTime = undefined;
+            break;
+          }
+          default: {
+            otherPidCurrentStartTime = _getStartTime(parseInt(otherPid, 10));
+            break;
+          }
+        }
+
         // console.log(`Other pid ${otherPid} actually has start time: "${otherPidCurrentStartTime}"`);
 
         // Time to compare
-        if (!otherPidCurrentStartTime || otherPidOldStartTime !== otherPidCurrentStartTime) {
+        if (
+          !otherPidCurrentStartTime ||
+          (otherPidOldStartTime !== otherPidCurrentStartTime &&
+            !_isLockFileOfRunningProcess(otherPid, otherPidOldStartTime, otherBirthtimeMs))
+        ) {
           // ==> Stale lockfile
           // This file doesn't prevent us from acquiring the lock, but it does indicate that
           // the resource was left in a dirty state.  (If we delete the file right now, that
           // information would be lost, so we clean up later when we acquire successfully.)
 
           // console.log(`Other pid ${otherPid} is no longer executing!`);
+
+          // We checked the other process after we read its file.  If the file is gone now, the other process
+          // released the lock in between, so the resource isn't dirty.
+          if (!FileSystem.exists(fileInFolderPath)) {
+            continue;
+          }
           staleFilesToDelete.push(fileInFolderPath);
           continue;
         }
@@ -541,33 +936,29 @@ function _tryAcquireMacOrLinux(
 
         if (otherBirthtimeMs !== undefined) {
           // ==> We found a valid file belonging to another process.
-          // With multiple parties trying to acquire, the winner is the smallestBirthTime,
-          // so we need to sort.
-
-          // the other lock file was created before the current earliest lock file
-          // or the other lock file was created at the same exact time, but has earlier pid
-
-          // note that it is acceptable to do a direct comparison of the PIDs in this case
-          // since we are establishing a consistent order to apply to the lock files in all
-          // execution instances.
-
-          // it doesn't matter that the PIDs roll over, we've already
-          // established that these processes all started at the same time, so we just
-          // need to get all instances of the lock test to agree which one won.
-          if (
-            otherBirthtimeMs < smallestBirthTimeMs ||
-            (otherBirthtimeMs === smallestBirthTimeMs && otherPid < smallestBirthTimePid)
-          ) {
-            smallestBirthTimeMs = otherBirthtimeMs;
-            smallestBirthTimePid = otherPid;
+          // With multiple parties trying to acquire, the winner is the one with the earliest file.
+          if (otherBirthtimeMs < currentBirthTimeMs) {
+            // we do not have the lock
+            return undefined;
+          }
+
+          if (otherBirthtimeMs === currentBirthTimeMs) {
+            // ==> Tie
+            // Birthtimes have millisecond precision (often coarser), so files created at about the
+            // same time can have equal birthtimes.  We read the folder only once, so the other process
+            // may have read it before our file existed and concluded that it holds the lock.  Breaking
+            // the tie by PID could then let both processes acquire the lock.  Instead, a tie means that
+            // neither process acquires the lock in this attempt.  At least one of the two processes
+            // sees the other's file, so at most one of them acquires the lock.
+            tied = true;
           }
         }
       }
     }
 
-    if (smallestBirthTimePid !== pid.toString()) {
-      // we do not have the lock
-      return undefined;
+    if (tied) {
+      // we do not have the lock, but we may acquire it if we try again with a new file
+      return TIED;
     }
 
     let dirtyWhenAcquired: boolean = false;
diff --git a/libraries/node-core-library/src/test/LockFile.test.ts b/libraries/node-core-library/src/test/LockFile.test.ts
index 44957de4b93..83d9790dc14 100644
--- a/libraries/node-core-library/src/test/LockFile.test.ts
+++ b/libraries/node-core-library/src/test/LockFile.test.ts
@@ -2,14 +2,18 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import * as child_process from 'node:child_process';
 import {
   LockFile,
   type ILockFileHandle,
   getProcessStartTime,
   getProcessStartTimeFromProcStat,
+  getProcessStartTimeMs,
+  getLinuxBootTimeSeconds,
+  getLinuxProcessStartTime,
   _setLockFileGetProcessStartTime
 } from '../LockFile';
-import { FileSystem } from '../FileSystem';
+import { FileSystem, type FileSystemStats, type IFileSystemReadFileOptions } from '../FileSystem';
 import { FileWriter } from '../FileWriter';
 import * as WindowsLockFile from '../WindowsLockFile';
 
@@ -17,6 +21,59 @@ function setLockFileGetProcessStartTime(fn: (process: number) => string | undefi
   _setLockFileGetProcessStartTime(fn);
 }
 
+/**
+ * Replaces the contents of a file that FileSystem.readFile() reads, or makes reading it fail.
+ */
+function mockReadFile(filePath: string, contents: string | NodeJS.ErrnoException): void {
+  const originalReadFile: typeof FileSystem.readFile = FileSystem.readFile;
+  jest
+    .spyOn(FileSystem, 'readFile')
+    .mockImplementation((readFilePath: string, options?: IFileSystemReadFileOptions) => {
+      if (readFilePath !== filePath) {
+        return originalReadFile(readFilePath, options);
+      }
+      if (typeof contents !== 'string') {
+        throw contents;
+      }
+      return contents;
+    });
+}
+
+/**
+ * Runs "ps -o lstart" for a process with the C locale, and returns what it prints.
+ */
+function getLstartWithCLocale(pid: number, timeZone?: string): string {
+  return child_process
+    .spawnSync('ps', ['-p', `${pid}`, '-o', 'lstart'], {
+      encoding: 'utf8',
+      env: { ...process.env, LC_ALL: 'C', ...(timeZone === undefined ? {} : { TZ: timeZone }) }
+    })
+    .stdout.split('\n')[1]
+    .trim();
+}
+
+function createEaccesError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' });
+}
+
+function createEnoentError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('ENOENT: no such file or directory'), {
+    code: 'ENOENT',
+    errno: -2,
+    syscall: 'open'
+  });
+}
+
+/**
+ * Makes reading /proc/[pid]/stat fail, so that /proc can't tell whether a process has this PID, and LockFile runs
+ * "ps" for it.  A test needs this if the function that it passes to setLockFileGetProcessStartTime() returns a
+ * start time for a PID that no process has.  Otherwise /proc shows that no process has that PID, and LockFile
+ * doesn't call that function for it.
+ */
+function makeProcStatUnreadable(pid: number): void {
+  mockReadFile(`/proc/${pid}/stat`, createEaccesError());
+}
+
 // lib/test
 const libTestFolder: string = path.resolve(__dirname, '../../lib-commonjs/test');
 
@@ -308,6 +365,7 @@ describe(LockFile.name, () => {
         setLockFileGetProcessStartTime((pid: number) => {
           return pid === process.pid ? getProcessStartTime(process.pid) : otherPidStartTime;
         });
+        makeProcStatUnreadable(otherPid);
 
         // create an open lockfile
         const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
@@ -450,6 +508,918 @@ describe(LockFile.name, () => {
 
         lock!.release();
       });
+
+      test("doesn't mark dirtyWhenAcquired if other process releases the lock and exits after its lockfile is read", () => {
+        // ensure test folder is clean
+        const testFolder: string = path.join(libTestFolder, '17');
+        FileSystem.ensureEmptyFolder(testFolder);
+
+        const resourceName: string = 'test';
+
+        const otherPid: number = 999999999;
+        const otherPidStartTime: string = '2012-01-02 12:53:12';
+
+        const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+
+        // create an open lockfile for other process
+        const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
+        lockFileHandle.write(otherPidStartTime);
+        lockFileHandle.close();
+
+        // simulate other process lock release and exit while the current process checks whether it is running
+        setLockFileGetProcessStartTime((pid: number) => {
+          if (pid === otherPid) {
+            FileSystem.deleteFile(otherPidLockFileName);
+            return undefined;
+          }
+          return getProcessStartTime(pid);
+        });
+        makeProcStatUnreadable(otherPid);
+
+        const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+        expect(lock).toBeDefined();
+        expect(lock!.dirtyWhenAcquired).toEqual(false);
+        expect(lock!.isReleased).toEqual(false);
+
+        lock!.release();
+      });
+
+      describe('when lockfiles have the same birthtime', () => {
+        const resourceName: string = 'test';
+        // Compared as strings, this is larger than any real PID, so a PID tie-break would favor this process.
+        const otherPid: number = 999999999;
+        const otherPidStartTime: string = '2012-01-02 12:53:12';
+        const birthtime: Date = new Date(1500000000000);
+
+        interface IOtherLockFile {
+          otherPidLockFileName: string;
+          ourGetStatisticsSpy: jest.SpyInstance;
+        }
+
+        function prepareOtherLockFile(
+          testFolder: string,
+          contents: string,
+          otherBirthtime: Date,
+          deleteAfterFirstRead: boolean = false
+        ): IOtherLockFile {
+          FileSystem.ensureEmptyFolder(testFolder);
+          const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+          const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
+          lockFileHandle.write(contents);
+          lockFileHandle.close();
+
+          // the other process is still running
+          setLockFileGetProcessStartTime((pid: number) => {
+            return pid === otherPid ? otherPidStartTime : getProcessStartTime(pid);
+          });
+          makeProcStatUnreadable(otherPid);
+
+          const ourGetStatisticsSpy: jest.SpyInstance = jest
+            .spyOn(FileWriter.prototype, 'getStatistics')
+            .mockReturnValue({ birthtime } as FileSystemStats);
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            if (path.resolve(filePath) !== otherPidLockFileName) {
+              return originalGetStatistics(filePath);
+            }
+            if (deleteAfterFirstRead) {
+              // Like us, the other process saw the tie, so it deletes its lockfile before trying again.
+              FileSystem.deleteFile(otherPidLockFileName);
+            }
+            return { birthtime: otherBirthtime } as FileSystemStats;
+          });
+          return { otherPidLockFileName, ourGetStatisticsSpy };
+        }
+
+        test('cannot acquire a lock if another valid lock has the same birthtime and a larger pid', () => {
+          const testFolder: string = path.join(libTestFolder, '6');
+          const { otherPidLockFileName, ourGetStatisticsSpy } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            birthtime
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          // The other process may have read the folder before our lockfile existed, in which case it
+          // already holds the lock, so a tie must not let us acquire it.  We try again with a new
+          // lockfile a few times before giving up.
+          expect(lock).toBeUndefined();
+          expect(ourGetStatisticsSpy).toHaveBeenCalledTimes(4);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+          expect(FileSystem.exists(LockFile.getLockFilePath(testFolder, resourceName))).toEqual(false);
+        });
+
+        test('cannot acquire a lock or delete the other lockfile if it is still empty', () => {
+          const testFolder: string = path.join(libTestFolder, '7');
+          const { otherPidLockFileName } = prepareOtherLockFile(testFolder, '', birthtime);
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          // The other process hasn't written its start time yet, so its lockfile is not stale.
+          expect(lock).toBeUndefined();
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('can acquire a lock after a tie if the other process gives up', () => {
+          const testFolder: string = path.join(libTestFolder, '8');
+          const { otherPidLockFileName, ourGetStatisticsSpy } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            birthtime,
+            true
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(false);
+          expect(ourGetStatisticsSpy).toHaveBeenCalledTimes(2);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('does not try again if another valid lock is older', () => {
+          const testFolder: string = path.join(libTestFolder, '9');
+          const { otherPidLockFileName, ourGetStatisticsSpy } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            new Date(birthtime.getTime() - 1)
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeUndefined();
+          expect(ourGetStatisticsSpy).toHaveBeenCalledTimes(1);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('can acquire a lock if the other valid lock is newer', () => {
+          const testFolder: string = path.join(libTestFolder, '10');
+          const { otherPidLockFileName } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            new Date(birthtime.getTime() + 1)
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(false);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+          lock!.release();
+        });
+      });
+
+      describe('when the start time in a lockfile differs from the start time of its running process', () => {
+        const resourceName: string = 'test';
+        // The parent process is still running, and it started before any lockfile that this test creates.
+        const otherPid: number = process.ppid;
+
+        function createOtherLockFile(testFolder: string, contents: string): string {
+          FileSystem.ensureEmptyFolder(testFolder);
+          const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+          const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
+          lockFileHandle.write(contents);
+          lockFileHandle.close();
+          return otherPidLockFileName;
+        }
+
+        test('cannot acquire a lock if the other process wrote its start time in another time zone', () => {
+          const testFolder: string = path.join(libTestFolder, '11');
+          // This is UTC+14 (or UTC-12 if that is the local time zone).  POSIX time zones need no time zone database.
+          const otherTimeZone: string = new Date().getTimezoneOffset() === -840 ? 'XYZ+12' : 'XYZ-14';
+          // What the other process writes if it runs with TZ=otherTimeZone
+          const otherPidStartTime: string = child_process
+            .spawnSync('ps', ['-p', `${otherPid}`, '-o', 'lstart'], {
+              encoding: 'utf8',
+              env: { ...process.env, TZ: otherTimeZone }
+            })
+            .stdout.split('\n')[1]
+            .trim();
+          expect(otherPidStartTime).not.toEqual(getProcessStartTime(otherPid));
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, otherPidStartTime);
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          // The other process is running and started before its lockfile was created, so it holds the lock.
+          expect(lock).toBeUndefined();
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        // Formats a time as "ps -o lstart" prints it with the C locale and TZ=UTC0, for example
+        // "Sun Sep 27 17:15:08 2026".
+        function formatLstartInUtc(timeMs: number): string {
+          const date: Date = new Date(timeMs);
+          const days: string[] = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+          const months: string[] = [
+            'Jan',
+            'Feb',
+            'Mar',
+            'Apr',
+            'May',
+            'Jun',
+            'Jul',
+            'Aug',
+            'Sep',
+            'Oct',
+            'Nov',
+            'Dec'
+          ];
+          const twoDigits: (value: number) => string = (value: number) => `${value}`.padStart(2, '0');
+          return (
+            `${days[date.getUTCDay()]} ${months[date.getUTCMonth()]} ${`${date.getUTCDate()}`.padStart(2, ' ')} ` +
+            `${twoDigits(date.getUTCHours())}:${twoDigits(date.getUTCMinutes())}:${twoDigits(date.getUTCSeconds())} ` +
+            `${date.getUTCFullYear()}`
+          );
+        }
+
+        // What the other process wrote if its time zone is offsetMs ahead of UTC
+        function getOtherPidStartTimeWithOffset(offsetMs: number): string {
+          const otherPidStartTimeMs: number | undefined = getProcessStartTimeMs(otherPid);
+          expect(otherPidStartTimeMs).toBeDefined();
+          return formatLstartInUtc(otherPidStartTimeMs! + offsetMs);
+        }
+
+        test.each<[string, string, number]>([
+          ['5 hours and 45 minutes ahead of UTC', '20', (5 * 60 + 45) * 60 * 1000],
+          ['12 hours behind UTC', '21', -12 * 60 * 60 * 1000],
+          ['7 hours behind UTC, printed 2 seconds off', '22', -7 * 60 * 60 * 1000 + 2000],
+          ['7 hours behind UTC, printed 2 seconds early', '31', -7 * 60 * 60 * 1000 - 2000],
+          ['14 hours ahead of UTC, printed 3 seconds late', '32', 14 * 60 * 60 * 1000 + 3000],
+          ['12 hours behind UTC, printed 3 seconds early', '33', -12 * 60 * 60 * 1000 - 3000]
+        ])(
+          'cannot acquire a lock if the other process wrote its start time in a time zone %s',
+          (description: string, folderName: string, offsetMs: number) => {
+            const testFolder: string = path.join(libTestFolder, folderName);
+            const otherPidLockFileName: string = createOtherLockFile(
+              testFolder,
+              getOtherPidStartTimeWithOffset(offsetMs)
+            );
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeUndefined();
+            expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+          }
+        );
+
+        test.each<[string, string, number]>([
+          ['7 minutes after', '23', 7 * 60 * 1000],
+          ['15 hours after', '34', 15 * 60 * 60 * 1000],
+          ['25 hours after', '24', 25 * 60 * 60 * 1000],
+          ['13 hours before', '25', -13 * 60 * 60 * 1000]
+        ])(
+          'deletes the lockfile of a process that started before the lockfile if its start time is %s the start time of the process',
+          (description: string, folderName: string, offsetMs: number) => {
+            const testFolder: string = path.join(libTestFolder, folderName);
+            // No time zone is this far from UTC, so the lockfile was written by another process that had the same
+            // PID, for example in a container or before the lockfile was copied.
+            const otherPidLockFileName: string = createOtherLockFile(
+              testFolder,
+              getOtherPidStartTimeWithOffset(offsetMs)
+            );
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(true);
+            expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+            lock!.release();
+          }
+        );
+
+        test('deletes the lockfile of a process that started before the lockfile if its start time is from another year', () => {
+          const testFolder: string = path.join(libTestFolder, '26');
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Mon Jan  1 00:00:00 2024');
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('cannot acquire a lock if the other process wrote its start time in the format of another locale', () => {
+          const testFolder: string = path.join(libTestFolder, '27');
+          // Only the C locale's format can be compared with the start time of the process.
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Mo 28 Sep 2026 18:15:31');
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeUndefined();
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('deletes the lockfile of a process that started after the lockfile, even if its start time is in another time zone', () => {
+          const testFolder: string = path.join(libTestFolder, '30');
+          // UTC+14, or UTC-12 if that is the local time zone
+          const otherTimeZone: string = new Date().getTimezoneOffset() === -840 ? 'XYZ+12' : 'XYZ-14';
+          const otherPidStartTime: string = child_process
+            .spawnSync('ps', ['-p', `${otherPid}`, '-o', 'lstart'], {
+              encoding: 'utf8',
+              env: { ...process.env, LC_ALL: 'C', TZ: otherTimeZone }
+            })
+            .stdout.split('\n')[1]
+            .trim();
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, otherPidStartTime);
+          // The lockfile was created 1 minute before the process with its PID started.
+          const otherBirthtimeMs: number = getProcessStartTimeMs(otherPid)! - 60000;
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            return path.resolve(filePath) === otherPidLockFileName
+              ? ({ birthtime: new Date(otherBirthtimeMs) } as FileSystemStats)
+              : originalGetStatistics(filePath);
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('deletes the lockfile if its PID now belongs to a process that started after the lockfile was created', () => {
+          const testFolder: string = path.join(libTestFolder, '12');
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Thu Jan  1 00:00:10 1970');
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            return path.resolve(filePath) === otherPidLockFileName
+              ? ({ birthtime: new Date(10000) } as FileSystemStats)
+              : originalGetStatistics(filePath);
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('deletes an empty lockfile that is more than 1 second old', () => {
+          const testFolder: string = path.join(libTestFolder, '13');
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, '');
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            return path.resolve(filePath) === otherPidLockFileName
+              ? ({ birthtime: new Date(Date.now() - 2000) } as FileSystemStats)
+              : originalGetStatistics(filePath);
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test("doesn't mark dirtyWhenAcquired if the process releases the lock and exits before its start time is checked again", () => {
+          const testFolder: string = path.join(libTestFolder, '19');
+          // No process has this PID, so the second check of its start time finds that the process exited.
+          const exitedPid: number = 999999999;
+          FileSystem.ensureEmptyFolder(testFolder);
+          const exitedPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, exitedPid);
+          const lockFileHandle: FileWriter = FileWriter.open(exitedPidLockFileName);
+          lockFileHandle.write('Mon Jan  2 12:53:12 2012');
+          lockFileHandle.close();
+
+          // Before its lockfile is read, the process is running, and its start time is formatted differently,
+          // as if it had another time zone.
+          setLockFileGetProcessStartTime((pid: number) => {
+            return pid === exitedPid ? 'Mon Jan  2 04:53:12 2012' : getProcessStartTime(pid);
+          });
+          makeProcStatUnreadable(exitedPid);
+          // Right after its lockfile is read, the process releases the lock and exits.
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            const statistics: FileSystemStats = originalGetStatistics(filePath);
+            if (path.resolve(filePath) === exitedPidLockFileName) {
+              FileSystem.deleteFile(exitedPidLockFileName);
+            }
+            return statistics;
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(false);
+          lock!.release();
+        });
+      });
+
+      describe(getProcessStartTimeMs.name, () => {
+        test('returns the start time of a process', () => {
+          const startTimeMs: number | undefined = getProcessStartTimeMs(process.pid);
+          expect(startTimeMs).toBeDefined();
+          expect(startTimeMs! % 1000).toEqual(0);
+          expect(Math.abs(startTimeMs! - (Date.now() - process.uptime() * 1000))).toBeLessThan(5000);
+        });
+
+        test('does not depend on the time zone', () => {
+          const startTimeMs: number | undefined = getProcessStartTimeMs(process.pid);
+          const originalTimeZone: string | undefined = process.env.TZ;
+          process.env.TZ = 'XYZ-14';
+          try {
+            expect(getProcessStartTimeMs(process.pid)).toEqual(startTimeMs);
+          } finally {
+            if (originalTimeZone === undefined) {
+              delete process.env.TZ;
+            } else {
+              process.env.TZ = originalTimeZone;
+            }
+          }
+        });
+
+        test('returns undefined if the process does not exist', () => {
+          expect(getProcessStartTimeMs(999999999)).toBeUndefined();
+        });
+      });
+
+      if (process.platform === 'linux') {
+        describe(getLinuxProcessStartTime.name, () => {
+          test('returns what "ps -o lstart" prints with the C locale', () => {
+            for (const pid of [process.pid, process.ppid, 1]) {
+              expect(getLinuxProcessStartTime(pid, getLinuxBootTimeSeconds)!.lstart).toEqual(
+                getLstartWithCLocale(pid)
+              );
+            }
+          });
+
+          test('uses the time zone of the process, like "ps"', () => {
+            // A test can't change the time zone of its own process in Jest, so this runs another process.
+            const timeZone: string = new Date().getTimezoneOffset() === -840 ? 'XYZ+12' : 'XYZ-14';
+            const lockFileModulePath: string = require.resolve('../LockFile');
+            const script: string =
+              `const { getLinuxProcessStartTime, getLinuxBootTimeSeconds } = require(${JSON.stringify(lockFileModulePath)});` +
+              `console.log(getLinuxProcessStartTime(${process.pid}, getLinuxBootTimeSeconds).lstart);`;
+            const lstart: string = child_process
+              .spawnSync(process.execPath, ['-e', script], {
+                encoding: 'utf8',
+                env: { ...process.env, TZ: timeZone }
+              })
+              .stdout.trim();
+
+            expect(lstart).toEqual(getLstartWithCLocale(process.pid, timeZone));
+            expect(lstart).not.toEqual(
+              getLinuxProcessStartTime(process.pid, getLinuxBootTimeSeconds)!.lstart
+            );
+          });
+
+          test('returns the start time in clock ticks from /proc/[pid]/stat', () => {
+            expect(getLinuxProcessStartTime(process.pid, getLinuxBootTimeSeconds)!.ticks).toEqual(
+              getProcessStartTimeFromProcStat(FileSystem.readFile(`/proc/${process.pid}/stat`))
+            );
+          });
+
+          test('reads /proc/[pid]/stat if the command name contains spaces and parentheses', () => {
+            mockReadFile(
+              '/proc/12345/stat',
+              '12345 (a) (b) S 1 1 1 0 -1 4194304 0 0 0 0 0 0 0 0 20 0 1 0 250 0 0\n'
+            );
+            // 250 ticks are 2.5 seconds, which "ps" rounds down.  This is September 8 or 9, 2001 in any time zone.
+            const expectedLstart: string = child_process
+              .spawnSync('date', ['-d', '@1000000002', '+%a %b %e %H:%M:%S %Y'], {
+                encoding: 'utf8',
+                env: { ...process.env, LC_ALL: 'C' }
+              })
+              .stdout.trim();
+
+            expect(getLinuxProcessStartTime(12345, () => 1000000000)).toEqual({
+              lstart: expectedLstart,
+              ticks: '250',
+              startTimeMs: 1000000002000
+            });
+            expect(expectedLstart).toMatch(/^[A-Z][a-z]{2} Sep {2}[89] \d\d:\d\d:\d\d 2001$/);
+          });
+
+          test('returns undefined if the process does not exist', () => {
+            expect(getLinuxProcessStartTime(999999999, getLinuxBootTimeSeconds)).toBeUndefined();
+          });
+
+          test('throws if /proc/[pid]/stat cannot be read', () => {
+            mockReadFile('/proc/12345/stat', createEaccesError());
+            expect(() => getLinuxProcessStartTime(12345, getLinuxBootTimeSeconds)).toThrow('EACCES');
+          });
+
+          test('throws if /proc/[pid]/stat has an unexpected format', () => {
+            mockReadFile('/proc/12345/stat', '12345 (node) S 1\n');
+            expect(() => getLinuxProcessStartTime(12345, getLinuxBootTimeSeconds)).toThrow(
+              'unexpected format'
+            );
+          });
+        });
+
+        describe('when other lockfiles belong to running processes', () => {
+          const resourceName: string = 'test';
+          let childProcesses: child_process.ChildProcess[] = [];
+
+          afterEach(() => {
+            for (const childProcess of childProcesses) {
+              childProcess.kill();
+            }
+            childProcesses = [];
+          });
+
+          function startProcesses(count: number): number[] {
+            for (let i: number = 0; i < count; i++) {
+              childProcesses.push(child_process.spawn('sleep', ['60'], { stdio: 'ignore' }));
+            }
+            return childProcesses.map((childProcess: child_process.ChildProcess) => childProcess.pid!);
+          }
+
+          // Creates a lockfile for each process that is newer than the lockfile of this process,
+          // so that tryAcquire() checks all of them and then acquires the lock.
+          function createNewerLockFiles(
+            testFolder: string,
+            otherPids: number[],
+            getContents: (pid: number) => string
+          ): string[] {
+            FileSystem.ensureEmptyFolder(testFolder);
+            const otherPidLockFileNames: string[] = otherPids.map((otherPid: number) => {
+              const otherPidLockFileName: string = LockFile.getLockFilePath(
+                testFolder,
+                resourceName,
+                otherPid
+              );
+              FileSystem.writeFile(otherPidLockFileName, getContents(otherPid));
+              return otherPidLockFileName;
+            });
+            const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+            jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+              return otherPidLockFileNames.includes(path.resolve(filePath))
+                ? ({ birthtime: new Date(Date.now() + 60000) } as FileSystemStats)
+                : originalGetStatistics(filePath);
+            });
+            return otherPidLockFileNames;
+          }
+
+          function expectToAcquireAndKeep(testFolder: string, otherPidLockFileNames: string[]): void {
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(false);
+            for (const otherPidLockFileName of otherPidLockFileNames) {
+              expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+            }
+            lock!.release();
+          }
+
+          test('does not run "ps" for them', () => {
+            const testFolder: string = path.join(libTestFolder, '14');
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              [process.ppid, 1, ...startProcesses(6)],
+              getLstartWithCLocale
+            );
+            // LockFile calls the functions of this module object, so they can be spied on here.
+            const nativeChildProcess: typeof child_process = jest.requireActual('node:child_process');
+            const spawnSyncSpy: jest.SpyInstance = jest.spyOn(nativeChildProcess, 'spawnSync');
+            const readFileSpy: jest.SpyInstance = jest.spyOn(FileSystem, 'readFile');
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            // "ps" ran only for the start time of this process.
+            expect(spawnSyncSpy).toHaveBeenCalledTimes(1);
+            expect(spawnSyncSpy.mock.calls[0][1]).toEqual(['-p', `${process.pid}`, '-o', 'lstart']);
+            // The boot time was read once.
+            expect(readFileSpy.mock.calls.filter((args: unknown[]) => args[0] === '/proc/stat')).toHaveLength(
+              1
+            );
+          });
+
+          test('does not run "ps" if a lockfile has the start time in clock ticks', () => {
+            const testFolder: string = path.join(libTestFolder, '15');
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              startProcesses(1),
+              (otherPid: number) => getLinuxProcessStartTime(otherPid, getLinuxBootTimeSeconds)!.ticks
+            );
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid]]);
+          });
+
+          test('runs "ps" if /proc/[pid]/stat cannot be read', () => {
+            const testFolder: string = path.join(libTestFolder, '16');
+            const otherPids: number[] = startProcesses(1);
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              getLstartWithCLocale
+            );
+            mockReadFile(`/proc/${otherPids[0]}/stat`, createEaccesError());
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
+          });
+
+          test('keeps a lockfile with a start time from another time zone if /proc/[pid]/stat cannot be read', () => {
+            const testFolder: string = path.join(libTestFolder, '35');
+            const otherPids: number[] = startProcesses(1);
+            // UTC+5:45, or UTC-12 if that is the local time zone
+            const otherTimeZone: string = new Date().getTimezoneOffset() === -345 ? 'XYZ+12' : 'XYZ-05:45';
+            const otherPidStartTime: string = getLstartWithCLocale(otherPids[0], otherTimeZone);
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              () => otherPidStartTime
+            );
+            mockReadFile(`/proc/${otherPids[0]}/stat`, createEaccesError());
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            // "ps" printed another start time for it, so the time zone check kept the lockfile.
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
+            expect(getStartTimeSpy.mock.results[1].value).not.toEqual(otherPidStartTime);
+          });
+
+          test('does not run "ps" for them if they wrote their start times with other time zones or locales', () => {
+            const testFolder: string = path.join(libTestFolder, '28');
+            const otherPids: number[] = startProcesses(3);
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              (otherPid: number) => {
+                switch (otherPids.indexOf(otherPid)) {
+                  case 0:
+                    return getLstartWithCLocale(otherPid, 'XYZ-05:45');
+                  case 1:
+                    return getLstartWithCLocale(otherPid, 'XYZ+12');
+                  default:
+                    // The format of another locale
+                    return '28.09.2026 18:15:31';
+                }
+              }
+            );
+            const nativeChildProcess: typeof child_process = jest.requireActual('node:child_process');
+            const spawnSyncSpy: jest.SpyInstance = jest.spyOn(nativeChildProcess, 'spawnSync');
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            // "ps" ran only for the start time of this process.
+            expect(spawnSyncSpy).toHaveBeenCalledTimes(1);
+            expect(spawnSyncSpy.mock.calls[0][1]).toEqual(['-p', `${process.pid}`, '-o', 'lstart']);
+          });
+
+          test('runs "ps" for a lockfile whose start time is not the start time of its process in any time zone', () => {
+            const testFolder: string = path.join(libTestFolder, '29');
+            const otherPids: number[] = startProcesses(1);
+            // Another process that had the same PID wrote this lockfile.  It started 7 minutes after this process.
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              (otherPid: number) => getLstartWithCLocale(otherPid, 'XYZ-00:07')
+            );
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            // /proc never makes the lockfile of a running process stale, so "ps" decided it.
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(true);
+            expect(FileSystem.exists(otherPidLockFileNames[0])).toEqual(false);
+            lock!.release();
+          });
+        });
+
+        describe('when other lockfiles belong to processes that exited', () => {
+          const resourceName: string = 'test';
+          const otherPidStartTime: string = 'Mon Jan  1 00:00:00 2024';
+
+          // Returns the PID of a process that has exited.  No process has it until the OS gives it to a new one.
+          function getExitedPid(): number {
+            return child_process.spawnSync('true').pid;
+          }
+
+          // Creates a lockfile for each PID that is 2 seconds older than the lockfile of this process, so that
+          // tryAcquire() acquires the lock only if all of them are stale.
+          function createOlderLockFiles(testFolder: string, contentsByPid: Map<number, string>): string[] {
+            FileSystem.ensureEmptyFolder(testFolder);
+            const otherPidLockFileNames: string[] = [];
+            for (const [otherPid, contents] of contentsByPid) {
+              const otherPidLockFileName: string = LockFile.getLockFilePath(
+                testFolder,
+                resourceName,
+                otherPid
+              );
+              FileSystem.writeFile(otherPidLockFileName, contents);
+              otherPidLockFileNames.push(otherPidLockFileName);
+            }
+            const birthtime: Date = new Date(Date.now() - 2000);
+            const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+            jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+              return otherPidLockFileNames.includes(path.resolve(filePath))
+                ? ({ birthtime } as FileSystemStats)
+                : originalGetStatistics(filePath);
+            });
+            return otherPidLockFileNames;
+          }
+
+          function expectToAcquireAndDelete(testFolder: string, otherPidLockFileNames: string[]): void {
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(true);
+            for (const otherPidLockFileName of otherPidLockFileNames) {
+              expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+            }
+            lock!.release();
+          }
+
+          test('does not run "ps" for them', () => {
+            const testFolder: string = path.join(libTestFolder, '36');
+            const otherPidLockFileNames: string[] = createOlderLockFiles(
+              testFolder,
+              new Map([
+                [getExitedPid(), otherPidStartTime],
+                // No process can have this PID, because it is larger than the largest PID that Linux allows.
+                [999999999, otherPidStartTime],
+                // This process exited before it wrote its start time.
+                [getExitedPid(), '']
+              ])
+            );
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+            // LockFile calls the functions of this module object, so they can be spied on here.
+            const nativeChildProcess: typeof child_process = jest.requireActual('node:child_process');
+            const spawnSyncSpy: jest.SpyInstance = jest.spyOn(nativeChildProcess, 'spawnSync');
+
+            expectToAcquireAndDelete(testFolder, otherPidLockFileNames);
+
+            // "ps" ran only for the start time of this process.
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid]]);
+            expect(spawnSyncSpy).toHaveBeenCalledTimes(1);
+          });
+
+          test.each<[string, string, () => NodeJS.ErrnoException]>([
+            ['does not have this process either', '37', createEnoentError],
+            ['cannot show this process either', '40', createEaccesError]
+          ])(
+            'runs "ps" for them if /proc %s',
+            (description: string, folderName: string, createError: () => NodeJS.ErrnoException) => {
+              const testFolder: string = path.join(libTestFolder, folderName);
+              const exitedPid: number = getExitedPid();
+              const otherPidLockFileNames: string[] = createOlderLockFiles(
+                testFolder,
+                new Map([[exitedPid, otherPidStartTime]])
+              );
+              // Then /proc may not show the processes that "ps" finds.
+              mockReadFile(`/proc/${process.pid}/stat`, createError());
+              const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+              setLockFileGetProcessStartTime(getStartTimeSpy);
+
+              expectToAcquireAndDelete(testFolder, otherPidLockFileNames);
+
+              expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [exitedPid]]);
+            }
+          );
+
+          test('runs "ps" for them if /proc/[pid]/stat cannot be read', () => {
+            const testFolder: string = path.join(libTestFolder, '38');
+            const exitedPid: number = getExitedPid();
+            const otherPidLockFileNames: string[] = createOlderLockFiles(
+              testFolder,
+              new Map([[exitedPid, otherPidStartTime]])
+            );
+            mockReadFile(`/proc/${exitedPid}/stat`, createEaccesError());
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndDelete(testFolder, otherPidLockFileNames);
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [exitedPid]]);
+          });
+
+          test("doesn't mark dirtyWhenAcquired if the process releases the lock and exits before /proc is read", () => {
+            const testFolder: string = path.join(libTestFolder, '39');
+            const exitedPid: number = getExitedPid();
+            const [otherPidLockFileName] = createOlderLockFiles(
+              testFolder,
+              new Map([[exitedPid, otherPidStartTime]])
+            );
+            const originalReadFile: typeof FileSystem.readFile = FileSystem.readFile;
+            jest
+              .spyOn(FileSystem, 'readFile')
+              .mockImplementation((filePath: string, options?: IFileSystemReadFileOptions) => {
+                if (filePath === `/proc/${exitedPid}/stat`) {
+                  // The process was running when its lockfile was read.  Since then, it released the lock and exited.
+                  FileSystem.deleteFile(otherPidLockFileName);
+                }
+                return originalReadFile(filePath, options);
+              });
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(false);
+            lock!.release();
+          });
+        });
+
+        describe('when this process acquires locks again', () => {
+          const resourceName: string = 'test';
+          const testFolder: string = path.join(libTestFolder, '18');
+
+          beforeEach(() => {
+            FileSystem.ensureEmptyFolder(testFolder);
+          });
+
+          // Returns what the lockfile of this process contained
+          function acquireAndRelease(): string {
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+            expect(lock).toBeDefined();
+            const contents: string = FileSystem.readFile(LockFile.getLockFilePath(testFolder, resourceName));
+            lock!.release();
+            return contents;
+          }
+
+          test('runs "ps" for the start time of this process only once', () => {
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+            const expectedStartTime: string = getProcessStartTime(process.pid)!;
+
+            for (let i: number = 0; i < 3; i++) {
+              expect(acquireAndRelease()).toEqual(expectedStartTime);
+            }
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid]]);
+          });
+
+          test('runs "ps" again if the boot time changes, as it does when the system clock is set', () => {
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            acquireAndRelease();
+            mockReadFile('/proc/stat', `btime ${getLinuxBootTimeSeconds() - 3600}\n`);
+            acquireAndRelease();
+            acquireAndRelease();
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [process.pid]]);
+          });
+
+          test('runs "ps" again if it did not return the start time', () => {
+            const getStartTimeSpy: jest.Mock = jest
+              .fn(getProcessStartTime)
+              .mockImplementationOnce(() => undefined);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expect(() => LockFile.tryAcquire(testFolder, resourceName)).toThrow(
+              'Unable to calculate start time for current process.'
+            );
+            acquireAndRelease();
+            acquireAndRelease();
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [process.pid]]);
+          });
+
+          test('runs "ps" for other processes each time', () => {
+            const otherPid: number = 999999999;
+            const otherPidStartTime: string = '2012-01-02 12:53:12';
+            const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+            FileSystem.writeFile(otherPidLockFileName, otherPidStartTime);
+            const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+            jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+              return path.resolve(filePath) === otherPidLockFileName
+                ? ({ birthtime: new Date(Date.now() - 60000) } as FileSystemStats)
+                : originalGetStatistics(filePath);
+            });
+            const getStartTimeSpy: jest.Mock = jest.fn((pid: number) =>
+              pid === otherPid ? otherPidStartTime : getProcessStartTime(pid)
+            );
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+            makeProcStatUnreadable(otherPid);
+
+            for (let i: number = 0; i < 3; i++) {
+              expect(LockFile.tryAcquire(testFolder, resourceName)).toBeUndefined();
+            }
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPid], [otherPid], [otherPid]]);
+          });
+
+          test('uses the new function after the function is replaced', () => {
+            setLockFileGetProcessStartTime(() => 'Mon Jan  1 00:00:00 2024');
+            expect(acquireAndRelease()).toEqual('Mon Jan  1 00:00:00 2024');
+
+            setLockFileGetProcessStartTime(() => 'Tue Jan  2 00:00:00 2024');
+            expect(acquireAndRelease()).toEqual('Tue Jan  2 00:00:00 2024');
+          });
+        });
+      }
     });
   }
 
diff --git a/libraries/operation-graph/src/WatchLoop.ts b/libraries/operation-graph/src/WatchLoop.ts
index 302aa21fcdd..496dfda9f1f 100644
--- a/libraries/operation-graph/src/WatchLoop.ts
+++ b/libraries/operation-graph/src/WatchLoop.ts
@@ -14,6 +14,7 @@ import type {
   ISyncEventMessage,
   IRequestRunEventMessage
 } from './protocol.types';
+import { readResidentMemoryBytes } from './readResidentMemoryBytes';
 
 /**
  * Callbacks for the watch loop.
@@ -210,7 +211,7 @@ export class WatchLoop implements IWatchLoopState {
               const afterExecuteMessage: IAfterExecuteEventMessage = {
                 event: 'after-execute',
                 status,
-                residentMemoryBytes: process.memoryUsage().rss
+                residentMemoryBytes: readResidentMemoryBytes()
               };
               tryMessageHost(afterExecuteMessage);
             }
diff --git a/libraries/operation-graph/src/protocol.types.ts b/libraries/operation-graph/src/protocol.types.ts
index ed4e96727ba..7965874c47d 100644
--- a/libraries/operation-graph/src/protocol.types.ts
+++ b/libraries/operation-graph/src/protocol.types.ts
@@ -28,7 +28,10 @@ export interface IRequestRunEventMessage {
 export interface IAfterExecuteEventMessage {
   event: 'after-execute';
   status: OperationStatus;
-  /** The child's measured process RSS at completion, in bytes. Absent for older producers. */
+  /**
+   * The child's measured process RSS at completion, in bytes: on Linux, `VmRSS` from `/proc/self/status`, and
+   * elsewhere `process.memoryUsage.rss()`. Absent for older producers.
+   */
   residentMemoryBytes?: number;
 }
 
diff --git a/libraries/operation-graph/src/readResidentMemoryBytes.ts b/libraries/operation-graph/src/readResidentMemoryBytes.ts
new file mode 100644
index 00000000000..be3417607c1
--- /dev/null
+++ b/libraries/operation-graph/src/readResidentMemoryBytes.ts
@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { FileSystem } from '@rushstack/node-core-library';
+
+const PROCESS_STATUS_PATH: string = '/proc/self/status';
+const RESIDENT_SET_SIZE_PATTERN: RegExp = /^VmRSS:\s*(\d+)\s+kB$/m;
+const BYTES_PER_KIBIBYTE: number = 1024;
+
+function tryReadProcessStatusResidentMemoryBytes(): number | undefined {
+  let status: string;
+  try {
+    status = FileSystem.readFile(PROCESS_STATUS_PATH);
+  } catch {
+    return undefined;
+  }
+  const kibibytes: string | undefined = RESIDENT_SET_SIZE_PATTERN.exec(status)?.[1];
+  if (kibibytes === undefined) {
+    return undefined;
+  }
+  const bytes: number = Number(kibibytes) * BYTES_PER_KIBIBYTE;
+  return Number.isSafeInteger(bytes) && bytes > 0 ? bytes : undefined;
+}
+
+/**
+ * Returns the resident set size of this process, in bytes.
+ *
+ * @remarks
+ * On Linux, this is `VmRSS` from `/proc/self/status`, which recent kernels compute from exact counters.
+ * `process.memoryUsage().rss` reads `/proc/self/stat` instead, whose count leaves out what each CPU has not yet added
+ * to the total, so on a machine with many CPUs it can be off by hundreds of megabytes, in either direction.
+ * On other platforms, or if the file can't be read or parsed, this returns `process.memoryUsage.rss()`.
+ */
+export function readResidentMemoryBytes(): number {
+  return (
+    (process.platform === 'linux' ? tryReadProcessStatusResidentMemoryBytes() : undefined) ??
+    process.memoryUsage.rss()
+  );
+}
diff --git a/libraries/operation-graph/src/test/WatchLoop.test.ts b/libraries/operation-graph/src/test/WatchLoop.test.ts
index 2afdf48fdbc..5ccf1c486dc 100644
--- a/libraries/operation-graph/src/test/WatchLoop.test.ts
+++ b/libraries/operation-graph/src/test/WatchLoop.test.ts
@@ -3,6 +3,7 @@
 
 import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { OperationStatus } from '../OperationStatus';
+import * as ResidentMemory from '../readResidentMemoryBytes';
 import { type IWatchLoopOptions, type IWatchLoopState, WatchLoop } from '../WatchLoop';
 import type {
   CommandMessageFromHost,
@@ -38,6 +39,24 @@ function createWatchLoop(): IMockOptionsAndWatchLoop {
   };
 }
 
+interface IRunOnceIPCHost {
+  ipcHost: IPCHost;
+  sendMock: jest.Mock;
+}
+
+// A host that sends "run" after the first "sync", and "exit" after the first "after-execute".
+function createRunOnceIPCHost(): IRunOnceIPCHost {
+  let messageHandler: ((message: CommandMessageFromHost) => void) | undefined;
+  const onMock: jest.Mock = jest.fn((event: string, handler: (message: CommandMessageFromHost) => void) => {
+    messageHandler = handler;
+  });
+  const sendMock: jest.Mock = jest.fn((message: EventMessageFromClient) => {
+    const command: 'run' | 'exit' = message.event === 'sync' ? 'run' : 'exit';
+    process.nextTick(() => messageHandler!({ command }));
+  });
+  return { ipcHost: { on: onMock, send: sendMock }, sendMock };
+}
+
 describe(WatchLoop.name, () => {
   describe(WatchLoop.prototype.runUntilStableAsync.name, () => {
     it('executes once when no run is requested', async () => {
@@ -317,5 +336,53 @@ describe(WatchLoop.name, () => {
       expect(sendMock).toHaveBeenLastCalledWith(successMessage);
       expect(sendMock.mock.calls[1][0].residentMemoryBytes).toBeGreaterThan(0);
     });
+
+    describe('residentMemoryBytes', () => {
+      const residentMemoryBytes: number = 987654321;
+
+      beforeEach(() => {
+        jest.spyOn(ResidentMemory, 'readResidentMemoryBytes').mockReturnValue(residentMemoryBytes);
+      });
+
+      afterEach(() => {
+        jest.restoreAllMocks();
+      });
+
+      it('reports readResidentMemoryBytes() after a run', async () => {
+        const {
+          watchLoop,
+          mocks: { executeAsync }
+        } = createWatchLoop();
+        executeAsync.mockResolvedValue(OperationStatus.Success);
+        const { ipcHost, sendMock } = createRunOnceIPCHost();
+
+        await watchLoop.runIPCAsync(ipcHost);
+
+        const afterExecuteMessage: IAfterExecuteEventMessage = {
+          event: 'after-execute',
+          status: OperationStatus.Success,
+          residentMemoryBytes
+        };
+        expect(sendMock).toHaveBeenLastCalledWith(afterExecuteMessage);
+      });
+
+      it('reports readResidentMemoryBytes() after a run that throws', async () => {
+        const {
+          watchLoop,
+          mocks: { executeAsync }
+        } = createWatchLoop();
+        executeAsync.mockRejectedValue(new Error('fnord'));
+        const { ipcHost, sendMock } = createRunOnceIPCHost();
+
+        await expect(watchLoop.runIPCAsync(ipcHost)).rejects.toThrow('fnord');
+
+        const afterExecuteMessage: IAfterExecuteEventMessage = {
+          event: 'after-execute',
+          status: OperationStatus.Failure,
+          residentMemoryBytes
+        };
+        expect(sendMock).toHaveBeenLastCalledWith(afterExecuteMessage);
+      });
+    });
   });
 });
diff --git a/libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts b/libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts
new file mode 100644
index 00000000000..292d78b4687
--- /dev/null
+++ b/libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts
@@ -0,0 +1,101 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { FileSystem } from '@rushstack/node-core-library';
+
+import { readResidentMemoryBytes } from '../readResidentMemoryBytes';
+
+const FALLBACK_BYTES: number = 123456789;
+
+// The format of /proc/<pid>/status, in which every memory line has its own value.
+const STATUS_TEXT: string = [
+  'Name:\tnode',
+  'VmPeak:\t    9500 kB',
+  'VmSize:\t    9000 kB',
+  'VmLck:\t       0 kB',
+  'VmHWM:\t    2000 kB',
+  'VmRSS:\t    1500 kB',
+  'RssAnon:\t     900 kB',
+  'RssFile:\t     500 kB',
+  'RssShmem:\t     100 kB',
+  'Threads:\t11',
+  ''
+].join('\n');
+
+function readVmRssBytes(): number {
+  const kibibytes: string | undefined = /^VmRSS:\s*(\d+)\s+kB$/m.exec(
+    fs.readFileSync('/proc/self/status', 'utf8')
+  )?.[1];
+  return Number(kibibytes) * 1024;
+}
+
+describe(readResidentMemoryBytes.name, () => {
+  const platformDescriptor: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+
+  function setPlatform(platform: NodeJS.Platform): void {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: platform });
+  }
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', platformDescriptor);
+    jest.restoreAllMocks();
+  });
+
+  (process.platform === 'linux' ? it : it.skip)('matches VmRSS from /proc/self/status on Linux', () => {
+    const before: number = readVmRssBytes();
+    const bytes: number = readResidentMemoryBytes();
+    const after: number = readVmRssBytes();
+
+    expect(bytes % 1024).toBe(0);
+    expect(bytes).toBeGreaterThanOrEqual(Math.min(before, after));
+    expect(bytes).toBeLessThanOrEqual(Math.max(before, after));
+  });
+
+  describe('with a mocked /proc/self/status', () => {
+    let readFileMock: jest.SpyInstance<string, Parameters<typeof FileSystem.readFile>>;
+
+    beforeEach(() => {
+      setPlatform('linux');
+      readFileMock = jest.spyOn(FileSystem, 'readFile').mockReturnValue(STATUS_TEXT);
+      jest.spyOn(process.memoryUsage, 'rss').mockReturnValue(FALLBACK_BYTES);
+    });
+
+    it('returns VmRSS in bytes', () => {
+      expect(readResidentMemoryBytes()).toBe(1536000);
+      expect(readFileMock).toHaveBeenCalledTimes(1);
+      expect(readFileMock).toHaveBeenCalledWith('/proc/self/status');
+    });
+
+    it('falls back to process.memoryUsage.rss() if the file cannot be read', () => {
+      readFileMock.mockImplementation(() => {
+        throw Object.assign(new Error('ENOENT: no such file or directory'), { code: 'ENOENT' });
+      });
+
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    });
+
+    it('falls back to process.memoryUsage.rss() if there is no VmRSS line', () => {
+      readFileMock.mockReturnValue(STATUS_TEXT.replace('VmRSS:\t    1500 kB\n', ''));
+
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    });
+
+    it('falls back to process.memoryUsage.rss() if VmRSS is 0', () => {
+      readFileMock.mockReturnValue(STATUS_TEXT.replace('VmRSS:\t    1500 kB', 'VmRSS:\t       0 kB'));
+
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    });
+
+    it.each(['darwin', 'win32'] as const)(
+      'returns process.memoryUsage.rss() without reading the file on %s',
+      (platform: NodeJS.Platform) => {
+        setPlatform(platform);
+
+        expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+        expect(readFileMock).not.toHaveBeenCalled();
+      }
+    );
+  });
+});
diff --git a/libraries/package-deps-hash/README.md b/libraries/package-deps-hash/README.md
index 5386749d7a5..53a4479465d 100644
--- a/libraries/package-deps-hash/README.md
+++ b/libraries/package-deps-hash/README.md
@@ -29,6 +29,19 @@ if (_.isEqual(deps, existingDeps)) {
 }
 ```
 
+A long-lived process that reads the state of the same repository repeatedly can use a `RepoStateCache` (beta).
+It returns the same result as `getDetailedRepoStateAsync()`, but keeps a private copy of the Git index and the
+hashes of files that haven't changed between calls, and returns the same object while nothing changes:
+
+```ts
+import { RepoStateCache } from '@rushstack/package-deps-hash';
+
+const cache = new RepoStateCache({ rootDirectory: '/path/to/repo' });
+const state = await cache.getDetailedRepoStateAsync();
+// ...
+cache.dispose();
+```
+
 ## Links
 
 - [CHANGELOG.md](
diff --git a/libraries/package-deps-hash/src/FileStamp.ts b/libraries/package-deps-hash/src/FileStamp.ts
new file mode 100644
index 00000000000..932349543c3
--- /dev/null
+++ b/libraries/package-deps-hash/src/FileStamp.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+/**
+ * A file whose ctime or mtime is newer than this many milliseconds must not be memoized by its stamp.
+ *
+ * @remarks
+ * Every write updates a file's ctime, and userspace can't set it. A stamp recorded for a file whose last change
+ * was already this old can't hide a later write, because that write gets a newer ctime even on a filesystem
+ * whose timestamps have a coarse granularity (a jiffy on Linux, 2 seconds on FAT). The argument assumes that the
+ * filesystem's clock agrees with this process's clock to within this margin, as a local filesystem's does.
+ */
+export const SETTLED_FILE_AGE_MS: number = 3000;
+
+/**
+ * A write gets a newer ctime than a file's last change this many milliseconds earlier, on a filesystem whose
+ * timestamps have a fine granularity. It allows for a jiffy on Linux, and for the lag of the kernel's coarse clock
+ * behind this process's clock.
+ */
+const FINE_TIMESTAMP_MARGIN_MS: number = 100;
+
+/**
+ * Timestamps that are whole multiples of 10 milliseconds may come from a filesystem whose timestamps have a coarse
+ * granularity, such as FAT. Other timestamps have a fine granularity.
+ */
+const COARSE_TIMESTAMP_UNIT_NS: bigint = BigInt(1e7);
+
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1e6);
+
+/**
+ * Whether any write to a file made at or after `timeNs` changes the stamp of the file from the stamp of `stats`.
+ *
+ * @remarks
+ * Every write updates the file's ctime, and userspace can't set it. The write gets a newer ctime unless the file's
+ * last change falls within the granularity of the filesystem's timestamps before it.
+ */
+export function revealsWriteAfter(stats: fs.BigIntStats, timeNs: bigint): boolean {
+  const marginMs: number =
+    stats.ctimeNs % COARSE_TIMESTAMP_UNIT_NS === BigInt(0) ? SETTLED_FILE_AGE_MS : FINE_TIMESTAMP_MARGIN_MS;
+  return stats.ctimeNs < timeNs - BigInt(marginMs) * NANOSECONDS_PER_MILLISECOND;
+}
+
+/**
+ * The current time, in nanoseconds since the epoch, to compare with the times of files.
+ */
+export function getTimeNs(): bigint {
+  return BigInt(Date.now()) * NANOSECONDS_PER_MILLISECOND;
+}
+
+/**
+ * The ctime and mtime a file must be older than for its stamp to be memoized. Take it before examining any of
+ * the files, so that a write made after a file's examination gets a later ctime.
+ */
+export function getSettledBeforeNs(): bigint {
+  return BigInt(Date.now() - SETTLED_FILE_AGE_MS) * BigInt(1e6);
+}
+
+/** Identifies a file's content by the identity, size, nanosecond mtime and ctime of the file. */
+export function getFileStamp(stats: fs.BigIntStats): string {
+  return `${stats.dev}:${stats.ino}:${stats.size}:${stats.mtimeNs}:${stats.ctimeNs}`;
+}
+
+/** Whether a file examined after `settledBeforeNs` was taken may be memoized by its stamp. */
+export function isFileStatSettled(stats: fs.BigIntStats, settledBeforeNs: bigint): boolean {
+  return stats.ctimeNs < settledBeforeNs && stats.mtimeNs < settledBeforeNs;
+}
diff --git a/libraries/package-deps-hash/src/GitIndexFile.ts b/libraries/package-deps-hash/src/GitIndexFile.ts
new file mode 100644
index 00000000000..1d7d914301a
--- /dev/null
+++ b/libraries/package-deps-hash/src/GitIndexFile.ts
@@ -0,0 +1,699 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// The index format packs flags into bits
+/* eslint-disable no-bitwise */
+
+import { createHash, type Hash } from 'node:crypto';
+
+// The format is described in https://git-scm.com/docs/index-format
+const INDEX_SIGNATURE: string = 'DIRC';
+const HEADER_LENGTH: number = 12;
+const MAX_INDEX_LENGTH: number = 2 ** 32 - 1;
+// ctime, mtime, dev, ino, mode, uid, gid and size, 4 bytes each except the 8-byte times
+const ENTRY_STAT_LENGTH: number = 40;
+const ENTRY_MODE_OFFSET: number = 24;
+const ENTRY_MODE_LENGTH: number = 4;
+// The object type bits of the mode: a regular file, a symbolic link or a gitlink
+const ENTRY_MODE_TYPE_SHIFT: number = 12;
+const ENTRY_SIZE_OFFSET: number = 36;
+const ENTRY_SIZE_LENGTH: number = 4;
+const ENTRY_FLAGS_LENGTH: number = 2;
+// "git update-index --assume-unchanged" sets this flag
+const ENTRY_ASSUME_VALID_FLAG: number = 0x8000;
+const ENTRY_EXTENDED_FLAG: number = 0x4000;
+const ENTRY_STAGE_MASK: number = 0x3000;
+// An extended flag, which "git update-index --skip-worktree" and sparse checkouts set
+const ENTRY_SKIP_WORKTREE_FLAG: number = 0x4000;
+// In a version 4 index, each byte of the variable-length integer that starts a path has 7 bits of its value, and a
+// bit that says whether another byte follows
+const VARINT_CONTINUATION_FLAG: number = 0x80;
+const VARINT_VALUE_MASK: number = 0x7f;
+const VARINT_VALUE_BITS_FACTOR: number = 0x80;
+const INITIAL_PATH_BUFFER_LENGTH: number = 4096;
+const ATTRIBUTES_FILE_NAME: Buffer = Buffer.from('.gitattributes');
+const SLASH_CHARACTER_CODE: number = 0x2f;
+const EXTENSION_HEADER_LENGTH: number = 8;
+const SPLIT_INDEX_EXTENSION_SIGNATURE: string = 'link';
+const UNTRACKED_CACHE_EXTENSION_SIGNATURE: string = 'UNTR';
+const FSMONITOR_EXTENSION_SIGNATURE: string = 'FSMN';
+// Git ignores an extension whose signature starts with an uppercase letter if it doesn't understand it
+const FIRST_OPTIONAL_SIGNATURE_CHARACTER_CODE: number = 0x41;
+const LAST_OPTIONAL_SIGNATURE_CHARACTER_CODE: number = 0x5a;
+// A new copy of the index takes the untracked cache and the file system monitor's state from the previous copy. It
+// drops "EOIE", which describes the extensions that follow the entries, since those change, and so also "IEOT", which
+// lets Git read the entries with several threads, since Git only finds it through "EOIE".
+const REPLACED_EXTENSION_SIGNATURES: ReadonlySet<string> = new Set([
+  'EOIE',
+  'IEOT',
+  UNTRACKED_CACHE_EXTENSION_SIGNATURE,
+  FSMONITOR_EXTENSION_SIGNATURE
+]);
+const FSMONITOR_VERSION_1: number = 1;
+const FSMONITOR_VERSION_2: number = 2;
+const FSMONITOR_VERSION_LENGTH: number = 4;
+// Version 1 identifies the state of the file system monitor with a time, and version 2 with a NUL-terminated token
+const FSMONITOR_VERSION_1_TIME_LENGTH: number = 8;
+const FSMONITOR_BITMAP_SIZE_LENGTH: number = 4;
+const SHA256_OBJECT_ID_LENGTH: number = 32;
+
+// An EWAH bitmap is a sequence of 64-bit words, stored as two 32-bit halves in big-endian order. Each "marker" word
+// has the value of a run of identical words (bit 0), the length of the run (bits 1-32) and the number of literal
+// words that follow the marker (bits 33-63). See ewah/ewok_rlw.h in the Git source code.
+const EWAH_HEADER_LENGTH: number = 8;
+const EWAH_WORD_LENGTH: number = 8;
+const EWAH_HALF_WORD_LENGTH: number = 4;
+const EWAH_MARKER_POSITION_LENGTH: number = 4;
+const BITS_PER_EWAH_WORD: number = 64;
+const BITS_PER_EWAH_HALF_WORD: number = 32;
+const MAX_EWAH_RUN_LENGTH: number = 2 ** 32 - 1;
+const MAX_EWAH_LITERAL_WORD_COUNT: number = 2 ** 31 - 1;
+
+/**
+ * A summary of a Git index file.
+ */
+export interface IGitIndexSummary {
+  readonly entryCount: number;
+  /**
+   * A digest of the header and of every entry's mode, object ID, flags and path. It omits the file system data
+   * (times, device, inode, owner and size) that refreshing the index updates, and the extensions, such as the
+   * untracked cache and the file system monitor's token. Two indexes with the same digest describe the same files.
+   */
+  readonly entriesDigest: string;
+  /**
+   * A digest of the size that the index records for each entry. Git considers a file modified, without examining
+   * its content, if the recorded size is not 0 and differs from the size of the file. So two indexes with the same
+   * entries digest may still disagree about which files are modified, unless their sizes digests are the same too.
+   */
+  readonly sizesDigest: string;
+  /**
+   * Whether the index is split: its entries are then completed by a shared index file.
+   */
+  readonly isSplit: boolean;
+  /**
+   * The paths of the `.gitattributes` files that the index marks "assume unchanged" or "skip worktree", in the
+   * order of the index. Git doesn't examine these files, so `git status` doesn't list them, even when they change.
+   */
+  readonly hiddenAttributesFilePaths: ReadonlyArray<string>;
+}
+
+/**
+ * The location of an extension in a Git index file.
+ */
+export interface IGitIndexExtension {
+  readonly signature: string;
+  /**
+   * The offset of the extension's header.
+   */
+  readonly start: number;
+  /**
+   * The offset after the extension's data.
+   */
+  readonly end: number;
+}
+
+/**
+ * The locations of the parts of a Git index file.
+ */
+export interface IGitIndexLayout {
+  readonly version: number;
+  readonly entryCount: number;
+  /**
+   * The offset of each entry, followed by the offset after the last entry.
+   */
+  readonly entryOffsets: Uint32Array;
+  /**
+   * The offset of each entry's path. In a version 4 index, the path starts with the number of characters to remove
+   * from the end of the previous entry's path.
+   */
+  readonly pathOffsets: Uint32Array;
+  /**
+   * The offset of the NUL that ends each entry's path.
+   */
+  readonly pathEndOffsets: Uint32Array;
+  readonly extensions: ReadonlyArray<IGitIndexExtension>;
+  /**
+   * The offset of the checksum, which ends the file.
+   */
+  readonly checksumOffset: number;
+}
+
+/**
+ * Returns the number of entries that the header of a Git index file declares, or `undefined` if the data doesn't
+ * start with the header of a Git index file.
+ */
+export function tryGetGitIndexEntryCount(header: Buffer): number | undefined {
+  if (
+    header.length < HEADER_LENGTH ||
+    header.toString('latin1', 0, INDEX_SIGNATURE.length) !== INDEX_SIGNATURE
+  ) {
+    return undefined;
+  }
+
+  return header.readUInt32BE(8);
+}
+
+/**
+ * Locates the entries and extensions of a Git index file of version 2, 3 or 4.
+ *
+ * @param content - The content of the index file
+ * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
+ */
+export function parseGitIndexLayout(content: Buffer, objectIdLength: number): IGitIndexLayout {
+  const entryCount: number | undefined = tryGetGitIndexEntryCount(content);
+  if (entryCount === undefined) {
+    throw new Error('The file is not a Git index');
+  }
+
+  const version: number = content.readUInt32BE(4);
+  if (version < 2 || version > 4) {
+    throw new Error(`Unsupported Git index version ${version}`);
+  }
+
+  // The offsets are stored in 32 bits
+  if (content.length > MAX_INDEX_LENGTH) {
+    throw new Error('The Git index is too large');
+  }
+
+  const checksumOffset: number = content.length - objectIdLength;
+  // Each entry has at least its file system data, object ID and flags, and a NUL after its path
+  if (
+    HEADER_LENGTH + entryCount * (ENTRY_STAT_LENGTH + objectIdLength + ENTRY_FLAGS_LENGTH + 1) >
+    checksumOffset
+  ) {
+    throw new Error('The Git index ends within an entry');
+  }
+
+  const entryOffsets: Uint32Array = new Uint32Array(entryCount + 1);
+  const pathOffsets: Uint32Array = new Uint32Array(entryCount);
+  const pathEndOffsets: Uint32Array = new Uint32Array(entryCount);
+  let offset: number = HEADER_LENGTH;
+  for (let i: number = 0; i < entryCount; i++) {
+    entryOffsets[i] = offset;
+    const flagsOffset: number = offset + ENTRY_STAT_LENGTH + objectIdLength;
+    if (flagsOffset + ENTRY_FLAGS_LENGTH > checksumOffset) {
+      throw new Error('The Git index ends within an entry');
+    }
+
+    const flags: number = content.readUInt16BE(flagsOffset);
+    let pathOffset: number = flagsOffset + ENTRY_FLAGS_LENGTH;
+    if (flags & ENTRY_EXTENDED_FLAG) {
+      // Extended flags follow, for example "skip-worktree" and "intent-to-add"
+      pathOffset += ENTRY_FLAGS_LENGTH;
+    }
+
+    pathOffsets[i] = pathOffset;
+    if (version === 4) {
+      // The path is prefix-compressed: a variable-length integer, then the rest of the path and a NUL
+      while (pathOffset < checksumOffset && content[pathOffset] & 0x80) {
+        pathOffset++;
+      }
+      pathOffset++;
+    }
+
+    const pathEnd: number = content.indexOf(0, pathOffset);
+    if (pathEnd < 0 || pathEnd >= checksumOffset) {
+      throw new Error('The Git index ends within an entry');
+    }
+
+    pathEndOffsets[i] = pathEnd;
+    // Before version 4, each entry is padded with 1-8 NULs to a multiple of 8 bytes
+    offset = version === 4 ? pathEnd + 1 : offset + ((pathEnd - offset + 8) & ~7);
+  }
+
+  entryOffsets[entryCount] = offset;
+  const extensions: IGitIndexExtension[] = [];
+  while (offset + EXTENSION_HEADER_LENGTH <= checksumOffset) {
+    const start: number = offset;
+    offset += EXTENSION_HEADER_LENGTH + content.readUInt32BE(offset + 4);
+    extensions.push({ signature: content.toString('latin1', start, start + 4), start, end: offset });
+  }
+
+  if (offset !== checksumOffset) {
+    throw new Error('The extensions of the Git index are malformed');
+  }
+
+  return { version, entryCount, entryOffsets, pathOffsets, pathEndOffsets, extensions, checksumOffset };
+}
+
+/**
+ * Summarizes the content of a Git index file of version 2, 3 or 4.
+ *
+ * @param content - The content of the index file
+ * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
+ */
+export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGitIndexSummary {
+  const layout: IGitIndexLayout = parseGitIndexLayout(content, objectIdLength);
+  const { entryCount, entryOffsets, extensions }: IGitIndexLayout = layout;
+  const entriesEnd: number = entryOffsets[entryCount];
+  // A copy of the entries in which the file system data of each entry is cleared, except for the mode
+  const entries: Buffer = Buffer.from(content.subarray(0, entriesEnd));
+  const sizes: Buffer = Buffer.alloc(entryCount * ENTRY_SIZE_LENGTH);
+  const hiddenEntryIndices: number[] = [];
+  for (let i: number = 0; i < entryCount; i++) {
+    const offset: number = entryOffsets[i];
+    sizes.writeUInt32BE(content.readUInt32BE(offset + ENTRY_SIZE_OFFSET), i * ENTRY_SIZE_LENGTH);
+    entries.fill(0, offset, offset + ENTRY_MODE_OFFSET);
+    entries.fill(0, offset + ENTRY_MODE_OFFSET + ENTRY_MODE_LENGTH, offset + ENTRY_STAT_LENGTH);
+    if (isEntryHidden(content, offset + ENTRY_STAT_LENGTH + objectIdLength)) {
+      hiddenEntryIndices.push(i);
+    }
+  }
+
+  return {
+    entryCount,
+    entriesDigest: createHash('sha1').update(entries.subarray(4, entriesEnd)).digest('hex'),
+    sizesDigest: createHash('sha1').update(sizes).digest('hex'),
+    isSplit: extensions.some(
+      ({ signature }: IGitIndexExtension) => signature === SPLIT_INDEX_EXTENSION_SIGNATURE
+    ),
+    hiddenAttributesFilePaths: findAttributesFilePaths(content, layout, hiddenEntryIndices)
+  };
+}
+
+/**
+ * Whether the index marks an entry "assume unchanged" or "skip worktree", so that Git doesn't examine its file.
+ */
+function isEntryHidden(content: Buffer, flagsOffset: number): boolean {
+  const flags: number = content.readUInt16BE(flagsOffset);
+  return (
+    (flags & ENTRY_ASSUME_VALID_FLAG) !== 0 ||
+    ((flags & ENTRY_EXTENDED_FLAG) !== 0 &&
+      (content.readUInt16BE(flagsOffset + ENTRY_FLAGS_LENGTH) & ENTRY_SKIP_WORKTREE_FLAG) !== 0)
+  );
+}
+
+/**
+ * Returns the paths of the given entries that name a `.gitattributes` file, in the order of the entries.
+ */
+function findAttributesFilePaths(
+  content: Buffer,
+  { version, pathOffsets, pathEndOffsets }: IGitIndexLayout,
+  entryIndices: ReadonlyArray<number>
+): string[] {
+  const filePaths: string[] = [];
+  if (entryIndices.length === 0) {
+    return filePaths;
+  }
+
+  if (version !== 4) {
+    for (const i of entryIndices) {
+      if (isAttributesFilePath(content, pathOffsets[i], pathEndOffsets[i])) {
+        filePaths.push(content.toString('utf8', pathOffsets[i], pathEndOffsets[i]));
+      }
+    }
+
+    return filePaths;
+  }
+
+  // Each path only stores how many bytes to remove from the end of the previous path, and the bytes to add after
+  // those that remain, so the paths must be rebuilt in order
+  let filePath: Buffer = Buffer.alloc(INITIAL_PATH_BUFFER_LENGTH);
+  let filePathLength: number = 0;
+  let nextIndex: number = 0;
+  for (let i: number = 0; nextIndex < entryIndices.length; i++) {
+    let offset: number = pathOffsets[i];
+    let byte: number = content[offset++];
+    let removedLength: number = byte & VARINT_VALUE_MASK;
+    while (byte & VARINT_CONTINUATION_FLAG) {
+      byte = content[offset++];
+      removedLength = (removedLength + 1) * VARINT_VALUE_BITS_FACTOR + (byte & VARINT_VALUE_MASK);
+    }
+
+    if (removedLength > filePathLength) {
+      throw new Error('The Git index has a malformed path');
+    }
+
+    const keptLength: number = filePathLength - removedLength;
+    filePathLength = keptLength + pathEndOffsets[i] - offset;
+    if (filePathLength > filePath.length) {
+      const newFilePath: Buffer = Buffer.alloc(Math.max(filePathLength, filePath.length * 2));
+      filePath.copy(newFilePath, 0, 0, keptLength);
+      filePath = newFilePath;
+    }
+
+    content.copy(filePath, keptLength, offset, pathEndOffsets[i]);
+    if (i === entryIndices[nextIndex]) {
+      nextIndex++;
+      if (isAttributesFilePath(filePath, 0, filePathLength)) {
+        filePaths.push(filePath.toString('utf8', 0, filePathLength));
+      }
+    }
+  }
+
+  return filePaths;
+}
+
+function isAttributesFilePath(buffer: Buffer, start: number, end: number): boolean {
+  const nameStart: number = end - ATTRIBUTES_FILE_NAME.length;
+  return (
+    nameStart >= start &&
+    (nameStart === start || buffer[nameStart - 1] === SLASH_CHARACTER_CODE) &&
+    buffer.compare(ATTRIBUTES_FILE_NAME, 0, ATTRIBUTES_FILE_NAME.length, nameStart, end) === 0
+  );
+}
+
+/**
+ * Builds a new copy of a Git index that keeps the untracked cache and the state of the file system monitor of the
+ * previous copy, so that `git status` doesn't examine the folders and files that didn't change since it last
+ * examined the previous copy. The new copy has the header, entries and other extensions of the index.
+ *
+ * @remarks
+ * The untracked cache lists the untracked files in each folder, which depends on which paths the index records.
+ * So the copy keeps it only if the index records the same paths, with the same stages and object types, as the
+ * previous copy. The file system monitor's state says which entries Git needn't examine, because they didn't
+ * change since the monitor's token: the copy marks the entries that differ from those in the previous copy as
+ * changed, and keeps the token of the previous copy, which matches its untracked cache.
+ *
+ * @param content - The content of the index
+ * @param previousContent - The content of the previous copy of the index
+ * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
+ * @returns The content of the new copy, or `undefined` if it can't keep the state of the previous copy: when the
+ * index and the previous copy record different paths, have different versions, or have an extension that Git
+ * requires to understand, such as that of a split or sparse index, or when the previous copy has no untracked
+ * cache.
+ */
+export function tryCarryOverGitIndexCaches(
+  content: Buffer,
+  previousContent: Buffer,
+  objectIdLength: number
+): Buffer | undefined {
+  const layout: IGitIndexLayout = parseGitIndexLayout(content, objectIdLength);
+  const previousLayout: IGitIndexLayout = parseGitIndexLayout(previousContent, objectIdLength);
+  const untrackedCache: IGitIndexExtension | undefined = findExtension(
+    previousLayout,
+    UNTRACKED_CACHE_EXTENSION_SIGNATURE
+  );
+  if (
+    !untrackedCache ||
+    layout.version !== previousLayout.version ||
+    layout.entryCount !== previousLayout.entryCount ||
+    hasRequiredExtension(layout) ||
+    hasRequiredExtension(previousLayout)
+  ) {
+    return undefined;
+  }
+
+  const changedEntries: Uint8Array | undefined = tryFindChangedEntries(
+    content,
+    layout,
+    previousContent,
+    previousLayout,
+    objectIdLength
+  );
+  if (!changedEntries) {
+    return undefined;
+  }
+
+  const parts: Buffer[] = [content.subarray(0, layout.entryOffsets[layout.entryCount])];
+  for (const { signature, start, end } of layout.extensions) {
+    if (!REPLACED_EXTENSION_SIGNATURES.has(signature)) {
+      parts.push(content.subarray(start, end));
+    }
+  }
+
+  parts.push(previousContent.subarray(untrackedCache.start, untrackedCache.end));
+  const fsmonitor: IGitIndexExtension | undefined = findExtension(
+    previousLayout,
+    FSMONITOR_EXTENSION_SIGNATURE
+  );
+  if (fsmonitor) {
+    const fsmonitorExtension: Buffer | undefined = tryUpdateFsmonitorExtension(
+      previousContent.subarray(fsmonitor.start, fsmonitor.end),
+      changedEntries
+    );
+    if (!fsmonitorExtension) {
+      return undefined;
+    }
+
+    parts.push(fsmonitorExtension);
+  }
+
+  // With "index.skipHash", Git writes zeros instead of the checksum
+  const checksum: Buffer = Buffer.alloc(objectIdLength);
+  if (content.subarray(layout.checksumOffset).some((byte: number) => byte !== 0)) {
+    const hash: Hash = createHash(objectIdLength === SHA256_OBJECT_ID_LENGTH ? 'sha256' : 'sha1');
+    for (const part of parts) {
+      hash.update(part);
+    }
+
+    hash.digest().copy(checksum);
+  }
+
+  parts.push(checksum);
+  return Buffer.concat(parts);
+}
+
+function findExtension(layout: IGitIndexLayout, signature: string): IGitIndexExtension | undefined {
+  return layout.extensions.find((extension: IGitIndexExtension) => extension.signature === signature);
+}
+
+function hasRequiredExtension(layout: IGitIndexLayout): boolean {
+  return layout.extensions.some(({ signature }: IGitIndexExtension) => {
+    const characterCode: number = signature.charCodeAt(0);
+    return (
+      characterCode < FIRST_OPTIONAL_SIGNATURE_CHARACTER_CODE ||
+      characterCode > LAST_OPTIONAL_SIGNATURE_CHARACTER_CODE
+    );
+  });
+}
+
+/**
+ * Returns a flag for each entry, which is 1 if the entry differs from the one in the previous copy, or `undefined`
+ * if an entry has a different path, stage or object type.
+ */
+function tryFindChangedEntries(
+  content: Buffer,
+  layout: IGitIndexLayout,
+  previousContent: Buffer,
+  previousLayout: IGitIndexLayout,
+  objectIdLength: number
+): Uint8Array | undefined {
+  const changedEntries: Uint8Array = new Uint8Array(layout.entryCount);
+  for (let i: number = 0; i < layout.entryCount; i++) {
+    const start: number = layout.entryOffsets[i];
+    const previousStart: number = previousLayout.entryOffsets[i];
+    if (
+      content.compare(
+        previousContent,
+        previousStart,
+        previousLayout.entryOffsets[i + 1],
+        start,
+        layout.entryOffsets[i + 1]
+      ) === 0
+    ) {
+      continue;
+    }
+
+    // All previous paths are the same, so in a version 4 index, the same path is compressed the same way
+    const flagsOffset: number = ENTRY_STAT_LENGTH + objectIdLength;
+    if (
+      (content.readUInt16BE(start + flagsOffset) & ENTRY_STAGE_MASK) !==
+        (previousContent.readUInt16BE(previousStart + flagsOffset) & ENTRY_STAGE_MASK) ||
+      content.readUInt32BE(start + ENTRY_MODE_OFFSET) >>> ENTRY_MODE_TYPE_SHIFT !==
+        previousContent.readUInt32BE(previousStart + ENTRY_MODE_OFFSET) >>> ENTRY_MODE_TYPE_SHIFT ||
+      content.compare(
+        previousContent,
+        previousLayout.pathOffsets[i],
+        previousLayout.pathEndOffsets[i],
+        layout.pathOffsets[i],
+        layout.pathEndOffsets[i]
+      ) !== 0
+    ) {
+      return undefined;
+    }
+
+    changedEntries[i] = 1;
+  }
+
+  return changedEntries;
+}
+
+/**
+ * Builds a file system monitor extension with the token of the given one, in which the changed entries are also
+ * marked as changed. Returns `undefined` if the extension is malformed.
+ */
+function tryUpdateFsmonitorExtension(extension: Buffer, changedEntries: Uint8Array): Buffer | undefined {
+  const data: Buffer = extension.subarray(EXTENSION_HEADER_LENGTH);
+  if (data.length < FSMONITOR_VERSION_LENGTH) {
+    return undefined;
+  }
+
+  let bitmapSizeOffset: number;
+  switch (data.readUInt32BE(0)) {
+    case FSMONITOR_VERSION_1:
+      bitmapSizeOffset = FSMONITOR_VERSION_LENGTH + FSMONITOR_VERSION_1_TIME_LENGTH;
+      break;
+    case FSMONITOR_VERSION_2:
+      bitmapSizeOffset = data.indexOf(0, FSMONITOR_VERSION_LENGTH) + 1;
+      if (bitmapSizeOffset === 0) {
+        return undefined;
+      }
+      break;
+    default:
+      return undefined;
+  }
+
+  const bitmapOffset: number = bitmapSizeOffset + FSMONITOR_BITMAP_SIZE_LENGTH;
+  if (bitmapOffset > data.length) {
+    return undefined;
+  }
+
+  const bitmapEnd: number = bitmapOffset + data.readUInt32BE(bitmapSizeOffset);
+  const changedEntriesOfPreviousCopy: Uint8Array | undefined =
+    bitmapEnd <= data.length
+      ? tryReadEwahBitmap(data.subarray(bitmapOffset, bitmapEnd), changedEntries.length)
+      : undefined;
+  if (!changedEntriesOfPreviousCopy) {
+    return undefined;
+  }
+
+  for (let i: number = 0; i < changedEntries.length; i++) {
+    changedEntriesOfPreviousCopy[i] |= changedEntries[i];
+  }
+
+  const bitmap: Buffer = writeEwahBitmap(changedEntriesOfPreviousCopy);
+  const header: Buffer = Buffer.from(extension.subarray(0, EXTENSION_HEADER_LENGTH + bitmapSizeOffset));
+  header.writeUInt32BE(bitmapOffset + bitmap.length, 4);
+  const bitmapSize: Buffer = Buffer.alloc(FSMONITOR_BITMAP_SIZE_LENGTH);
+  bitmapSize.writeUInt32BE(bitmap.length);
+  return Buffer.concat([header, bitmapSize, bitmap]);
+}
+
+/**
+ * Reads an EWAH bitmap, as Git serializes it, into a flag for each bit. Returns `undefined` if the bitmap is
+ * malformed, or has a bit at or beyond the given count.
+ */
+export function tryReadEwahBitmap(data: Buffer, bitCount: number): Uint8Array | undefined {
+  if (data.length < EWAH_HEADER_LENGTH) {
+    return undefined;
+  }
+
+  const bitSize: number = data.readUInt32BE(0);
+  const wordCount: number = data.readUInt32BE(4);
+  if (
+    bitSize > bitCount ||
+    data.length !== EWAH_HEADER_LENGTH + wordCount * EWAH_WORD_LENGTH + EWAH_MARKER_POSITION_LENGTH
+  ) {
+    return undefined;
+  }
+
+  const bits: Uint8Array = new Uint8Array(bitCount);
+  let position: number = 0;
+  let wordIndex: number = 0;
+  while (wordIndex < wordCount) {
+    const markerOffset: number = EWAH_HEADER_LENGTH + wordIndex * EWAH_WORD_LENGTH;
+    const markerHigh: number = data.readUInt32BE(markerOffset);
+    const markerLow: number = data.readUInt32BE(markerOffset + EWAH_HALF_WORD_LENGTH);
+    const runBitCount: number =
+      ((markerLow >>> 1) + (markerHigh & 1) * 2 ** (BITS_PER_EWAH_HALF_WORD - 1)) * BITS_PER_EWAH_WORD;
+    const literalWordCount: number = markerHigh >>> 1;
+    if (markerLow & 1) {
+      if (position + runBitCount > bitSize) {
+        return undefined;
+      }
+
+      bits.fill(1, position, position + runBitCount);
+    }
+
+    position += runBitCount;
+    wordIndex++;
+    if (wordIndex + literalWordCount > wordCount) {
+      return undefined;
+    }
+
+    for (let i: number = 0; i < literalWordCount; i++, wordIndex++) {
+      const wordOffset: number = EWAH_HEADER_LENGTH + wordIndex * EWAH_WORD_LENGTH;
+      if (
+        !trySetBits(bits, data.readUInt32BE(wordOffset + EWAH_HALF_WORD_LENGTH), position, bitSize) ||
+        !trySetBits(bits, data.readUInt32BE(wordOffset), position + BITS_PER_EWAH_HALF_WORD, bitSize)
+      ) {
+        return undefined;
+      }
+
+      position += BITS_PER_EWAH_WORD;
+    }
+  }
+
+  return bits;
+}
+
+function trySetBits(bits: Uint8Array, halfWord: number, position: number, bitSize: number): boolean {
+  for (let bit: number = position; halfWord !== 0; bit++, halfWord >>>= 1) {
+    if (halfWord & 1) {
+      if (bit >= bitSize) {
+        return false;
+      }
+
+      bits[bit] = 1;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Serializes a flag for each bit as an EWAH bitmap, as Git does. The bitmap ends at the last bit that is set.
+ */
+export function writeEwahBitmap(bits: Uint8Array): Buffer {
+  const bitSize: number = bits.lastIndexOf(1) + 1;
+  const literalWordCount: number = Math.ceil(bitSize / BITS_PER_EWAH_WORD);
+  const lowHalves: Uint32Array = new Uint32Array(literalWordCount);
+  const highHalves: Uint32Array = new Uint32Array(literalWordCount);
+  for (let bit: number = 0; bit < bitSize; bit++) {
+    if (bits[bit]) {
+      const halves: Uint32Array = bit % BITS_PER_EWAH_WORD < BITS_PER_EWAH_HALF_WORD ? lowHalves : highHalves;
+      halves[Math.floor(bit / BITS_PER_EWAH_WORD)] |= 1 << bit % BITS_PER_EWAH_HALF_WORD;
+    }
+  }
+
+  // Each marker word is followed by the literal words that it counts. Only runs of words that are 0 are
+  // compressed, so the bitmap has no bit beyond its size. An empty bitmap is one marker word that is 0.
+  const words: number[] = [];
+  let lastMarkerIndex: number = 0;
+  let wordIndex: number = 0;
+  do {
+    const runStart: number = wordIndex;
+    while (
+      wordIndex < literalWordCount &&
+      lowHalves[wordIndex] === 0 &&
+      highHalves[wordIndex] === 0 &&
+      wordIndex - runStart < MAX_EWAH_RUN_LENGTH
+    ) {
+      wordIndex++;
+    }
+
+    const runLength: number = wordIndex - runStart;
+    const literalStart: number = wordIndex;
+    while (
+      wordIndex < literalWordCount &&
+      (lowHalves[wordIndex] !== 0 || highHalves[wordIndex] !== 0) &&
+      wordIndex - literalStart < MAX_EWAH_LITERAL_WORD_COUNT
+    ) {
+      wordIndex++;
+    }
+
+    lastMarkerIndex = words.length / 2;
+    const runLengthHigh: number = Math.floor(runLength / 2 ** (BITS_PER_EWAH_HALF_WORD - 1));
+    words.push(
+      ((wordIndex - literalStart) * 2 + runLengthHigh) >>> 0,
+      ((runLength % 2 ** (BITS_PER_EWAH_HALF_WORD - 1)) * 2) >>> 0
+    );
+    for (let i: number = literalStart; i < wordIndex; i++) {
+      words.push(highHalves[i], lowHalves[i]);
+    }
+  } while (wordIndex < literalWordCount);
+
+  const wordCount: number = words.length / 2;
+  const data: Buffer = Buffer.alloc(
+    EWAH_HEADER_LENGTH + wordCount * EWAH_WORD_LENGTH + EWAH_MARKER_POSITION_LENGTH
+  );
+  data.writeUInt32BE(bitSize, 0);
+  data.writeUInt32BE(wordCount, 4);
+  for (let i: number = 0; i < words.length; i++) {
+    data.writeUInt32BE(words[i], EWAH_HEADER_LENGTH + i * EWAH_HALF_WORD_LENGTH);
+  }
+
+  data.writeUInt32BE(lastMarkerIndex, EWAH_HEADER_LENGTH + wordCount * EWAH_WORD_LENGTH);
+  return data;
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
new file mode 100644
index 00000000000..a2aef6e996b
--- /dev/null
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -0,0 +1,1075 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library/lib/FileSystem';
+
+import {
+  getFileStamp,
+  getSettledBeforeNs,
+  getTimeNs,
+  isFileStatSettled,
+  revealsWriteAfter
+} from './FileStamp';
+import {
+  type IGitIndexSummary,
+  summarizeGitIndex,
+  tryCarryOverGitIndexCaches,
+  tryGetGitIndexEntryCount
+} from './GitIndexFile';
+import {
+  classifyLocallyModifiedFiles,
+  getCleanGitEnvironment,
+  getDetailedRepoStateAsync,
+  getGitLsFilesArgs,
+  getGitStatusArgs,
+  type GitStatusKind,
+  hashFilesAsync,
+  type IDetailedRepoState,
+  type IGitTreeState,
+  type ILocallyModifiedFiles,
+  parseGitLsTree,
+  parseGitStatus,
+  spawnGitAsync,
+  STANDARD_GIT_OPTIONS,
+  tryGetSymbolicLinkHashAsync
+} from './getRepoState';
+
+/**
+ * Options for {@link RepoStateCache}.
+ * @beta
+ */
+export interface IRepoStateCacheOptions {
+  /**
+   * The root directory of the Git repository.
+   */
+  rootDirectory: string;
+  /**
+   * The path to the Git executable.
+   */
+  gitPath?: string;
+  /**
+   * The folder in which to create the folder that holds the copy of the Git index. A relative path is resolved
+   * against the current working directory when the cache is created.
+   * @defaultValue The temporary folder of the operating system
+   */
+  temporaryFolderPath?: string;
+}
+
+// After this many consecutive failures, stop trying to use the cache
+const MAX_CONSECUTIVE_FAILURES: number = 3;
+const SHA256_OBJECT_ID_LENGTH: number = 32;
+const SHA1_OBJECT_ID_LENGTH: number = 20;
+const INDEX_HEADER_LENGTH: number = 12;
+const NANOSECONDS_PER_SECOND: bigint = BigInt(1e9);
+const PRIVATE_FOLDER_PREFIX: string = 'package-deps-hash-';
+const PRIVATE_INDEX_NAME: string = 'index';
+const EMPTY_CONTENT: Buffer = Buffer.alloc(0);
+const ATTRIBUTES_FILE_NAME: string = '.gitattributes';
+
+// Unlike the other commands, "git status" doesn't pass "--no-optional-locks", so that it can save its refreshed
+// copy of the index and the next "git status" doesn't need to examine the files that haven't changed since.
+const PRIVATE_INDEX_STATUS_OPTIONS: readonly string[] = [
+  // Ensure that commands don't run automatic maintenance, since performance of the command itself is paramount
+  '-c',
+  'maintenance.auto=false',
+  // Git only keeps an untracked cache that matches this setting, and "git status -u" lists all untracked files
+  '-c',
+  'status.showUntrackedFiles=all',
+  // Git would save the shared part of a split index in the Git folder of the repository
+  '-c',
+  'core.splitIndex=false',
+  // On Windows, the untracked cache can miss an untracked file in a new folder, so Git examines every folder there
+  ...(process.platform === 'win32' ? ['-c', 'core.untrackedCache=false'] : [])
+];
+
+interface IGitPaths {
+  readonly indexPath: string;
+  readonly objectIdLength: number;
+  /**
+   * The configuration and attributes files that the hashes of files may depend on.
+   */
+  readonly configurationPaths: ReadonlyArray<string>;
+}
+
+interface IConfigurationFile {
+  readonly path: string;
+  /**
+   * The content of the file. Git reads a missing file as an empty one, and ignores one that it can't read, if it
+   * doesn't fail.
+   */
+  readonly content: Buffer;
+  /**
+   * The stamp of the file when the call read it, or the code of the error that prevented examining it.
+   */
+  readonly stamp: string;
+  /**
+   * Whether any later write to the file changes its stamp.
+   */
+  readonly revealsLaterWrite: boolean;
+}
+
+interface IPrivateIndex {
+  readonly path: string;
+  readonly entryCount: number;
+  readonly entriesDigest: string;
+  readonly sizesDigest: string;
+  /**
+   * Identifies the filter of the calls that use the copy. "git status" only refreshes the files within the filter,
+   * and only lists the attributes files within it.
+   */
+  readonly filterKey: string;
+  realIndexStamp: string;
+  isRealIndexStampSettled: boolean;
+  /**
+   * Identifies the attributes files under which the first "git status" refreshed the copy, once it ran.
+   */
+  attributesFingerprint: string | undefined;
+  /**
+   * Whether the attributes files changed since the first "git status", so that the index must be copied again.
+   */
+  hasAttributesChanged: boolean;
+  /**
+   * The attributes files that the index marks "assume unchanged" or "skip worktree". "git status" doesn't list
+   * them, even when they change.
+   */
+  readonly hiddenAttributesFilePaths: ReadonlyArray<string>;
+}
+
+interface ITree {
+  readonly filterKey: string;
+  readonly state: IGitTreeState;
+}
+
+interface ICarriedOverCopy {
+  readonly content: Buffer;
+  /**
+   * The modification time of the previous copy.
+   */
+  readonly previousTimeNs: bigint;
+}
+
+interface IFileHash {
+  readonly stamp: string;
+  readonly hash: string;
+}
+
+interface IResult {
+  readonly tree: ITree;
+  readonly additionalPaths: ReadonlyArray<string>;
+  readonly statusOutput: string;
+  readonly additionalHashes: ReadonlyMap<string, string>;
+  readonly modifiedHashes: ReadonlyMap<string, string>;
+  readonly state: IDetailedRepoState;
+}
+
+function noop(): void {}
+
+/**
+ * Computes the same state of a Git repository as {@link getDetailedRepoStateAsync}, but faster when a process
+ * computes it repeatedly.
+ *
+ * @remarks
+ * The commands that {@link getDetailedRepoStateAsync} runs must not update the Git index, so `git status`
+ * examines every file each time. This class keeps a private copy of the index that `git status` updates, so that
+ * each call only examines the files that changed since the previous call. It copies the index again when the
+ * files that the index records, or the sizes that it records for them, change, but not when Git merely refreshes
+ * the index. While the index records the same paths, a new copy keeps the untracked cache and the file system
+ * monitor's state of the previous copy, so that `git status` doesn't examine every folder and file again after
+ * `git add`, for example. On Windows, where the untracked cache can miss untracked files, `git status` doesn't use
+ * one, so it examines every folder each time and a new copy keeps nothing of the previous copy. While the files
+ * that the index records don't change, it also reuses the list of files in the index.
+ * It reuses the hash of a file while the identity, size and times of the file and of the `.gitattributes` files in
+ * the folders that contain it don't change, and returns the same state as the previous call if nothing changed.
+ *
+ * A call may return the same state as an earlier call, so the state must not be modified.
+ *
+ * The state also depends on the attributes and configuration of Git, under which `git status` refreshed the copy.
+ * The index is copied again, and the files hashed again, when the content of the repository's configuration or
+ * `info/attributes` file changes, or of the user's `.gitconfig` file or the Git configuration or attributes file in
+ * the user's configuration folder, or when one of these files may have been written during the previous call, while
+ * Git read it. A file that is rewritten with the same content, as `git branch -D` rewrites the configuration of the
+ * repository, isn't a change. The index is copied again when a `.gitattributes` file changes that `git status`
+ * lists as modified or untracked; that the index marks "assume unchanged" or "skip worktree", so that `git status`
+ * doesn't list it; or that is in a folder that contains a filter path. The call that detects the
+ * change computes the state without the cache. The index is also copied again when the filter changes. Changes to
+ * the system configuration, to a configuration file included by another, to a custom `core.attributesFile`, or to
+ * an ignored `.gitattributes` file that applies to files that the index records aren't detected. In rare cases,
+ * the state reports uncommitted changes that {@link getDetailedRepoStateAsync} doesn't: when a file whose recorded
+ * size Git refreshed in the copy but not in the index is rewritten with content that Git converts to the same
+ * object, for example with other line endings; or when the attributes change for a file that was modified shortly
+ * before Git wrote the index: the copy is older than the index, so Git examines the file again in the copy, under
+ * the new attributes, but trusts the index.
+ *
+ * Each call examines every `.gitattributes` file that the index marks "assume unchanged" or "skip worktree", with
+ * one file system call for each. In a sparse checkout without a sparse index, the index marks every
+ * `.gitattributes` file outside the sparse checkout "skip worktree", so each call examines all of them. A file that
+ * stays missing from the working tree, as these files do, doesn't cause the index to be copied again.
+ *
+ * Repositories with submodules or a split index fall back to {@link getDetailedRepoStateAsync}, as does a cache
+ * that fails repeatedly.
+ * @beta
+ */
+export class RepoStateCache {
+  readonly #rootDirectory: string;
+  readonly #gitPath: string | undefined;
+  readonly #temporaryFolderPath: string;
+  // Calls run one at a time, in order
+  #queue: Promise<void> = Promise.resolve();
+  #isDisabled: boolean = false;
+  #consecutiveFailureCount: number = 0;
+  #privateFolderPath: string | undefined;
+  #gitPaths: IGitPaths | undefined;
+  #privateIndex: IPrivateIndex | undefined;
+  #tree: ITree | undefined;
+  #previousResult: IResult | undefined;
+  /**
+   * The configuration files as the last call read them, if Git read the same versions of them during that call
+   */
+  #configurationFiles: ReadonlyArray<IConfigurationFile> | undefined;
+  #unsettledFingerprintCount: number = 0;
+  readonly #fileHashes: Map<string, IFileHash> = new Map();
+
+  public constructor(options: IRepoStateCacheOptions) {
+    const { rootDirectory, gitPath, temporaryFolderPath = os.tmpdir() } = options;
+    this.#rootDirectory = rootDirectory;
+    this.#gitPath = gitPath;
+    // Git runs in the root directory, so it would resolve a relative path of the copy of the index there
+    this.#temporaryFolderPath = path.resolve(temporaryFolderPath);
+  }
+
+  /**
+   * Gets the object hashes for all files in the Git repo, combining the current commit with working tree state.
+   * Returns the same result as {@link getDetailedRepoStateAsync}.
+   *
+   * @param additionalRelativePathsToHash - Root-relative file paths to have Git hash and include in the results
+   * @param filterPath - The paths to which to limit the results
+   * @returns The state of the repository. It may be the same object that an earlier call returned, so it must not
+   * be modified.
+   */
+  public async getDetailedRepoStateAsync(
+    additionalRelativePathsToHash: ReadonlyArray<string> = [],
+    filterPath?: ReadonlyArray<string>
+  ): Promise<IDetailedRepoState> {
+    const resultPromise: Promise<IDetailedRepoState> = this.#queue.then(() =>
+      this.#getStateAsync(additionalRelativePathsToHash, filterPath)
+    );
+    this.#queue = resultPromise.then(noop, noop);
+    return await resultPromise;
+  }
+
+  /**
+   * Deletes the copy of the Git index. Later calls compute the state without the cache.
+   */
+  public dispose(): void {
+    this.#disable();
+  }
+
+  async #getStateAsync(
+    additionalPaths: ReadonlyArray<string>,
+    filterPath: ReadonlyArray<string> | undefined
+  ): Promise<IDetailedRepoState> {
+    if (!this.#isDisabled) {
+      let state: IDetailedRepoState | undefined;
+      try {
+        state = await this.#tryGetCachedStateAsync(additionalPaths, filterPath);
+      } catch {
+        this.#reset();
+        // If the state can't be computed without the cache either, report that error instead
+        state = await this.#getUncachedStateAsync(additionalPaths, filterPath);
+        if (++this.#consecutiveFailureCount >= MAX_CONSECUTIVE_FAILURES) {
+          this.#disable();
+        }
+
+        return state;
+      }
+
+      this.#checkConfigurationFiles();
+      if (state) {
+        this.#consecutiveFailureCount = 0;
+        return state;
+      }
+    }
+
+    return await this.#getUncachedStateAsync(additionalPaths, filterPath);
+  }
+
+  async #getUncachedStateAsync(
+    additionalPaths: ReadonlyArray<string>,
+    filterPath: ReadonlyArray<string> | undefined
+  ): Promise<IDetailedRepoState> {
+    return await getDetailedRepoStateAsync(
+      this.#rootDirectory,
+      Array.from(additionalPaths),
+      this.#gitPath,
+      filterPath && Array.from(filterPath)
+    );
+  }
+
+  /**
+   * Returns `undefined` if the cache can't compute the state of this repository.
+   */
+  async #tryGetCachedStateAsync(
+    additionalPaths: ReadonlyArray<string>,
+    filterPath: ReadonlyArray<string> | undefined
+  ): Promise<IDetailedRepoState | undefined> {
+    const settledBeforeNs: bigint = getSettledBeforeNs();
+    const gitPaths: IGitPaths = await this.#getGitPathsAsync();
+    const filterKey: string = JSON.stringify(filterPath ?? []);
+    const configurationFiles: IConfigurationFile[] = readConfigurationFiles(gitPaths.configurationPaths);
+    // Only the content counts. Git rewrites a configuration file with the same content, for example when
+    // "git branch -D" deletes a branch.
+    const hasConfigurationChanged: boolean = !haveSameContent(this.#configurationFiles, configurationFiles);
+    this.#configurationFiles = configurationFiles;
+    if (hasConfigurationChanged) {
+      this.#fileHashes.clear();
+    }
+
+    // Git refreshed the copy of the index under the previous configuration, so it could trust the recorded data of
+    // a file that the new configuration converts differently
+    const privateIndex: IPrivateIndex | undefined = await this.#tryUpdatePrivateIndexAsync(
+      gitPaths,
+      settledBeforeNs,
+      filterKey,
+      hasConfigurationChanged
+    );
+    if (!privateIndex) {
+      return undefined;
+    }
+
+    const environment: NodeJS.ProcessEnv = {
+      ...getCleanGitEnvironment(),
+      GIT_INDEX_FILE: privateIndex.path
+    };
+    // No other process uses the copy of the index, so "git status" may always save it
+    delete environment.GIT_OPTIONAL_LOCKS;
+    // The stamps of the attributes files in the folders that contain the files to hash
+    const attributesStamps: Map<string, string | undefined> = new Map();
+    // Hash the additional files while Git reads the index. Wait for both even if one fails, so that no command
+    // still uses the copy of the index after this call.
+    const [[tree, statusOutput], additionalHashes] = await waitForBothAsync(
+      this.#getTreeAndStatusAsync(privateIndex, filterPath, filterKey, environment),
+      this.#hashFilesAsync(additionalPaths, settledBeforeNs, attributesStamps)
+    );
+    if (!tree) {
+      return undefined;
+    }
+
+    // "git status" and "git ls-files" silently treat a missing index as an empty one
+    if (tryReadGitIndexEntryCount(privateIndex.path) !== privateIndex.entryCount) {
+      throw new Error(`The copy of the Git index at "${privateIndex.path}" was modified by another process`);
+    }
+
+    const locallyModified: Map<string, GitStatusKind> = parseGitStatus(statusOutput);
+    const attributesFingerprint: string = this.#getFingerprint(
+      getAttributesFilePaths(
+        this.#rootDirectory,
+        locallyModified.keys(),
+        privateIndex.hiddenAttributesFilePaths,
+        filterPath
+      ),
+      settledBeforeNs
+    );
+    if (privateIndex.attributesFingerprint === undefined) {
+      privateIndex.attributesFingerprint = attributesFingerprint;
+    } else if (attributesFingerprint !== privateIndex.attributesFingerprint) {
+      // Git refreshed the copy under the previous attributes, so it could trust the recorded data of a file that
+      // the new attributes convert differently. The next call copies the index again.
+      privateIndex.hasAttributesChanged = true;
+      return undefined;
+    }
+
+    const { filesToHash, filesToRemove }: ILocallyModifiedFiles = classifyLocallyModifiedFiles(
+      locallyModified,
+      tree.state.symlinks
+    );
+    const modifiedHashes: Map<string, string> = await this.#hashFilesAsync(
+      filesToHash,
+      settledBeforeNs,
+      attributesStamps
+    );
+
+    const previousResult: IResult | undefined = this.#previousResult;
+    if (
+      previousResult &&
+      previousResult.tree === tree &&
+      previousResult.statusOutput === statusOutput &&
+      areArraysEqual(previousResult.additionalPaths, additionalPaths) &&
+      areMapsEqual(previousResult.additionalHashes, additionalHashes) &&
+      areMapsEqual(previousResult.modifiedHashes, modifiedHashes)
+    ) {
+      return previousResult.state;
+    }
+
+    const files: Map<string, string> = new Map(tree.state.files);
+    const symlinks: Map<string, string> = new Map(tree.state.symlinks);
+    for (const filePath of filesToRemove) {
+      files.delete(filePath);
+      symlinks.delete(filePath);
+    }
+
+    for (const [filePath, hash] of additionalHashes) {
+      files.set(filePath, hash);
+    }
+
+    for (const [filePath, hash] of modifiedHashes) {
+      files.set(filePath, hash);
+    }
+
+    const state: IDetailedRepoState = {
+      hasSubmodules: false,
+      hasUncommittedChanges: locallyModified.size > 0,
+      files,
+      symlinks
+    };
+    this.#previousResult = {
+      tree,
+      additionalPaths: Array.from(additionalPaths),
+      statusOutput,
+      additionalHashes,
+      modifiedHashes,
+      state
+    };
+    return state;
+  }
+
+  /**
+   * Runs `git status` and, unless the list from an earlier call is still current, lists the files in the index.
+   * Returns an undefined tree if the repository has submodules.
+   */
+  async #getTreeAndStatusAsync(
+    privateIndex: IPrivateIndex,
+    filterPath: ReadonlyArray<string> | undefined,
+    filterKey: string,
+    environment: NodeJS.ProcessEnv
+  ): Promise<[ITree | undefined, string]> {
+    const currentTree: ITree | undefined = this.#tree;
+    let treePromise: Promise<ITree>;
+    // An interrupted "git status" may have left its lock file behind, which would stop the next one from saving.
+    // Remove it synchronously, so that Git starts at once: an asynchronous removal would finish only after the
+    // caller examined the additional files, which it starts to do meanwhile.
+    fs.rmSync(`${privateIndex.path}.lock`, { force: true });
+    if (currentTree?.filterKey === filterKey) {
+      treePromise = Promise.resolve(currentTree);
+    } else {
+      this.#tree = undefined;
+      // "git status" may save its refreshed copy of the index while this reads it. Git replaces the file rather
+      // than writing to it, and a refresh changes only what the index records about the files, not which files
+      // it records, so this lists the same files from either version.
+      treePromise = spawnGitAsync(
+        this.#gitPath,
+        STANDARD_GIT_OPTIONS.concat(getGitLsFilesArgs(filterPath)),
+        this.#rootDirectory,
+        undefined,
+        environment
+      ).then((lsFilesOutput: string): ITree => {
+        this.#tree = { filterKey, state: parseGitLsTree(lsFilesOutput) };
+        return this.#tree;
+      });
+    }
+
+    const statusPromise: Promise<string> = spawnGitAsync(
+      this.#gitPath,
+      PRIVATE_INDEX_STATUS_OPTIONS.concat(getGitStatusArgs(filterPath)),
+      this.#rootDirectory,
+      undefined,
+      environment
+    );
+    const [tree, statusOutput] = await waitForBothAsync(treePromise, statusPromise);
+    if (tree.state.submodules.size > 0 && FileSystem.exists(`${this.#rootDirectory}/.gitmodules`)) {
+      this.#disable();
+      return [undefined, ''];
+    }
+
+    return [tree, statusOutput];
+  }
+
+  async #getGitPathsAsync(): Promise<IGitPaths> {
+    if (!this.#gitPaths) {
+      const output: string = await spawnGitAsync(
+        this.#gitPath,
+        STANDARD_GIT_OPTIONS.concat([
+          'rev-parse',
+          '--show-object-format',
+          '--git-path',
+          'index',
+          '--git-path',
+          'info/attributes',
+          '--git-path',
+          'config',
+          '--git-path',
+          'config.worktree'
+        ]),
+        this.#rootDirectory
+      );
+      const [objectFormat, indexPath, ...repositoryConfigurationPaths] = output.trimEnd().split('\n');
+      const homeFolderPath: string = os.homedir();
+      const userConfigurationFolderPath: string =
+        process.env.XDG_CONFIG_HOME || path.join(homeFolderPath, '.config');
+      this.#gitPaths = {
+        indexPath: path.resolve(this.#rootDirectory, indexPath),
+        objectIdLength: objectFormat === 'sha256' ? SHA256_OBJECT_ID_LENGTH : SHA1_OBJECT_ID_LENGTH,
+        configurationPaths: [
+          ...repositoryConfigurationPaths.map((relativePath: string) =>
+            path.resolve(this.#rootDirectory, relativePath)
+          ),
+          path.join(homeFolderPath, '.gitconfig'),
+          path.join(userConfigurationFolderPath, 'git', 'config'),
+          path.join(userConfigurationFolderPath, 'git', 'attributes')
+        ]
+      };
+    }
+
+    return this.#gitPaths;
+  }
+
+  /**
+   * Ensures that the private copy of the index records the same files, with the same sizes, as the index of the
+   * repository, and that Git refreshed it under the current configuration and attributes, and for the same filter.
+   * Returns `undefined` if the repository has no index, or a split index.
+   */
+  async #tryUpdatePrivateIndexAsync(
+    gitPaths: IGitPaths,
+    settledBeforeNs: bigint,
+    filterKey: string,
+    mustCopy: boolean
+  ): Promise<IPrivateIndex | undefined> {
+    let handle: fs.promises.FileHandle;
+    try {
+      handle = await fs.promises.open(gitPaths.indexPath, 'r');
+    } catch (error) {
+      if (FileSystem.isNotExistError(error as Error)) {
+        return undefined;
+      }
+
+      throw error;
+    }
+
+    try {
+      const stats: fs.BigIntStats = await handle.stat({ bigint: true });
+      const stamp: string = getFileStamp(stats);
+      const privateIndex: IPrivateIndex | undefined = this.#privateIndex;
+      const isCopyCurrent: boolean =
+        privateIndex !== undefined &&
+        !mustCopy &&
+        !privateIndex.hasAttributesChanged &&
+        privateIndex.filterKey === filterKey &&
+        tryReadGitIndexEntryCount(privateIndex.path) === privateIndex.entryCount;
+      // A stamp recorded before the index settled could also match a later version of the index
+      if (isCopyCurrent && privateIndex?.isRealIndexStampSettled && privateIndex.realIndexStamp === stamp) {
+        return privateIndex;
+      }
+
+      // Git replaces the index rather than writing to it, so the open file doesn't change
+      const content: Buffer = await handle.readFile();
+      const summary: IGitIndexSummary = summarizeGitIndex(content, gitPaths.objectIdLength);
+      if (summary.isSplit) {
+        this.#disable();
+        return undefined;
+      }
+
+      const isRealIndexStampSettled: boolean = isFileStatSettled(stats, settledBeforeNs);
+      if (privateIndex?.entriesDigest === summary.entriesDigest) {
+        // Refreshing the index, as "git status" does, changes the stamp. It changes the recorded sizes only of files
+        // whose content Git examined, such as a file that was rewritten with other line endings.
+        if (isCopyCurrent && privateIndex.sizesDigest === summary.sizesDigest) {
+          privateIndex.realIndexStamp = stamp;
+          privateIndex.isRealIndexStampSettled = isRealIndexStampSettled;
+          return privateIndex;
+        }
+      } else {
+        // The hashes of files don't depend on the index: "git hash-object" doesn't read it, not even for a
+        // ".gitattributes" file that is missing from the working tree
+        this.#tree = undefined;
+      }
+
+      return await this.#writePrivateIndexAsync(
+        content,
+        stats,
+        summary,
+        filterKey,
+        isRealIndexStampSettled,
+        // Git updated the current copy under the current configuration, and for the same filter
+        isCopyCurrent ? privateIndex : undefined,
+        gitPaths.objectIdLength
+      );
+    } finally {
+      await handle.close();
+    }
+  }
+
+  async #writePrivateIndexAsync(
+    content: Buffer,
+    stats: fs.BigIntStats,
+    summary: IGitIndexSummary,
+    filterKey: string,
+    isRealIndexStampSettled: boolean,
+    previousIndex: IPrivateIndex | undefined,
+    objectIdLength: number
+  ): Promise<IPrivateIndex> {
+    this.#privateIndex = undefined;
+
+    // If the index records the same paths as the previous copy, the new copy keeps the untracked cache and the file
+    // system monitor's state of the previous copy, so that "git status" doesn't examine every folder again
+    const carriedOverCopy: ICarriedOverCopy | undefined =
+      previousIndex && (await tryCarryOverCachesAsync(previousIndex.path, content, objectIdLength));
+    const folderPath: string = this.#getPrivateFolderPath();
+    const indexPath: string = path.join(folderPath, PRIVATE_INDEX_NAME);
+    const temporaryPath: string = `${indexPath}.new`;
+    await fs.promises.writeFile(temporaryPath, carriedOverCopy?.content ?? content);
+    // Git doesn't trust the recorded times and size of a file that changed in the same second as the index was
+    // written, because the file may have changed again after it was recorded. Make the copy older than the index,
+    // so that Git doesn't trust any file in the copy that it wouldn't trust in the index. Git trusts the recorded
+    // times of a folder in the untracked cache by the same rule, so a copy that keeps the untracked cache of the
+    // previous copy must be older than that too.
+    let timeNs: bigint = stats.mtimeNs;
+    if (carriedOverCopy && carriedOverCopy.previousTimeNs < timeNs) {
+      timeNs = carriedOverCopy.previousTimeNs;
+    }
+
+    const timeInSeconds: number = Number(timeNs / NANOSECONDS_PER_SECOND) - 1;
+    await fs.promises.utimes(temporaryPath, timeInSeconds, timeInSeconds);
+    await fs.promises.rename(temporaryPath, indexPath);
+
+    const privateIndex: IPrivateIndex = {
+      path: indexPath,
+      entryCount: summary.entryCount,
+      entriesDigest: summary.entriesDigest,
+      sizesDigest: summary.sizesDigest,
+      filterKey,
+      realIndexStamp: getFileStamp(stats),
+      isRealIndexStampSettled,
+      // The file system monitor's state that the new copy keeps says which files Git found unchanged under the
+      // attributes of the previous copy, so the next call must detect a change since then
+      attributesFingerprint: carriedOverCopy ? previousIndex?.attributesFingerprint : undefined,
+      hasAttributesChanged: false,
+      hiddenAttributesFilePaths: summary.hiddenAttributesFilePaths
+    };
+    this.#privateIndex = privateIndex;
+    return privateIndex;
+  }
+
+  /**
+   * Hashes the files with `git hash-object`, except those whose stamps match the stamps they had when they were
+   * hashed before, and the symbolic links that it can't follow, which get the hashes of their text. The hashes are in
+   * the same order as the files.
+   */
+  async #hashFilesAsync(
+    filePaths: ReadonlyArray<string>,
+    settledBeforeNs: bigint,
+    attributesStamps: Map<string, string | undefined>
+  ): Promise<Map<string, string>> {
+    const hashes: Map<string, string> = new Map();
+    if (filePaths.length === 0) {
+      return hashes;
+    }
+
+    const statsList: (fs.BigIntStats | undefined)[] = await Promise.all(
+      filePaths.map(async (filePath: string) => {
+        try {
+          return await fs.promises.lstat(path.resolve(this.#rootDirectory, filePath), { bigint: true });
+        } catch {
+          // "git hash-object" reports the error
+          return undefined;
+        }
+      })
+    );
+    // The hashes of the symbolic links that "git hash-object" can't follow
+    const linkHashes: (string | undefined)[] = await Promise.all(
+      filePaths.map(async (filePath: string, i: number) =>
+        statsList[i]?.isSymbolicLink()
+          ? await tryGetSymbolicLinkHashAsync(path.resolve(this.#rootDirectory, filePath))
+          : undefined
+      )
+    );
+
+    const filesToHash: string[] = [];
+    const stampsToRecord: Map<string, string | undefined> = new Map();
+    for (let i: number = 0; i < filePaths.length; i++) {
+      const filePath: string = filePaths[i];
+      const stats: fs.BigIntStats | undefined = statsList[i];
+      const linkHash: string | undefined = linkHashes[i];
+      if (linkHash !== undefined) {
+        hashes.set(filePath, linkHash);
+        this.#fileHashes.delete(filePath);
+        continue;
+      }
+
+      // A symbolic link, or a folder, is hashed afresh each time. The hash of a file also depends on the attributes
+      // files in the folders that contain it, including ignored ones, which "git status" doesn't list.
+      let stamp: string | undefined;
+      if (stats?.isFile()) {
+        const attributesStamp: string | undefined = this.#getAttributesStamp(
+          getParentFolderPath(filePath),
+          settledBeforeNs,
+          attributesStamps
+        );
+        if (attributesStamp !== undefined) {
+          stamp = `${getFileStamp(stats)}\n${attributesStamp}`;
+        }
+      }
+
+      const fileHash: IFileHash | undefined = this.#fileHashes.get(filePath);
+      if (stamp !== undefined && fileHash?.stamp === stamp) {
+        hashes.set(filePath, fileHash.hash);
+      } else {
+        // Reserve the position of the file
+        hashes.set(filePath, '');
+        filesToHash.push(filePath);
+        stampsToRecord.set(filePath, stats && isFileStatSettled(stats, settledBeforeNs) ? stamp : undefined);
+      }
+    }
+
+    if (filesToHash.length > 0) {
+      for (const [filePath, hash] of await hashFilesAsync(this.#rootDirectory, filesToHash, this.#gitPath)) {
+        hashes.set(filePath, hash);
+        // The file was examined before it was hashed, so a later change gives it a different stamp
+        const stamp: string | undefined = stampsToRecord.get(filePath);
+        if (stamp === undefined) {
+          this.#fileHashes.delete(filePath);
+        } else {
+          this.#fileHashes.set(filePath, { stamp, hash });
+        }
+      }
+    }
+
+    return hashes;
+  }
+
+  /**
+   * Identifies the versions of the attributes files in the folder and in the folders that contain it, whether or not
+   * they exist. Returns `undefined` if one of them changed recently.
+   */
+  #getAttributesStamp(
+    folderPath: string,
+    settledBeforeNs: bigint,
+    attributesStamps: Map<string, string | undefined>
+  ): string | undefined {
+    if (attributesStamps.has(folderPath)) {
+      return attributesStamps.get(folderPath);
+    }
+
+    let stamp: string | undefined = this.#getAttributesFileStamp(folderPath, settledBeforeNs);
+    if (stamp !== undefined && folderPath) {
+      const parentStamp: string | undefined = this.#getAttributesStamp(
+        getParentFolderPath(folderPath),
+        settledBeforeNs,
+        attributesStamps
+      );
+      stamp = parentStamp === undefined ? undefined : `${parentStamp}/${stamp}`;
+    }
+
+    attributesStamps.set(folderPath, stamp);
+    return stamp;
+  }
+
+  #getAttributesFileStamp(folderPath: string, settledBeforeNs: bigint): string | undefined {
+    let stats: fs.BigIntStats | undefined;
+    try {
+      stats = fs.lstatSync(path.resolve(this.#rootDirectory, folderPath, ATTRIBUTES_FILE_NAME), {
+        bigint: true,
+        throwIfNoEntry: false
+      });
+    } catch (error) {
+      // For example, a file in place of a folder
+      return `!${(error as NodeJS.ErrnoException).code}`;
+    }
+
+    if (!stats) {
+      return '';
+    }
+
+    return isFileStatSettled(stats, settledBeforeNs) ? getFileStamp(stats) : undefined;
+  }
+
+  /**
+   * Git reads the configuration files while a call runs. If one of them may have been written since the call read
+   * it, Git may have read another version of it, so the next call treats the configuration as changed.
+   */
+  #checkConfigurationFiles(): void {
+    if (
+      this.#configurationFiles?.some(
+        ({ path: filePath, stamp, revealsLaterWrite }: IConfigurationFile) =>
+          !revealsLaterWrite || getStampOrErrorStamp(filePath) !== stamp
+      )
+    ) {
+      this.#configurationFiles = undefined;
+    }
+  }
+
+  /**
+   * Identifies the versions of the files. A file that changed recently gets a fingerprint that matches no other.
+   */
+  #getFingerprint(filePaths: Iterable<string>, settledBeforeNs: bigint): string {
+    let fingerprint: string = '';
+    for (const filePath of filePaths) {
+      let stats: fs.BigIntStats | undefined;
+      try {
+        stats = fs.statSync(filePath, { bigint: true });
+      } catch (error) {
+        fingerprint += `${filePath}\0${(error as NodeJS.ErrnoException).code}\n`;
+        continue;
+      }
+
+      if (!isFileStatSettled(stats, settledBeforeNs)) {
+        // The file may change again without changing its stamp
+        return `${++this.#unsettledFingerprintCount}`;
+      }
+
+      fingerprint += `${filePath}\0${getFileStamp(stats)}\n`;
+    }
+
+    return fingerprint;
+  }
+
+  #getPrivateFolderPath(): string {
+    if (this.#isDisabled) {
+      throw new Error('The cache is disabled');
+    }
+
+    if (!this.#privateFolderPath) {
+      fs.mkdirSync(this.#temporaryFolderPath, { recursive: true });
+      this.#privateFolderPath = fs.mkdtempSync(path.join(this.#temporaryFolderPath, PRIVATE_FOLDER_PREFIX));
+      addPrivateFolder(this.#privateFolderPath);
+    }
+
+    return this.#privateFolderPath;
+  }
+
+  #reset(): void {
+    this.#privateIndex = undefined;
+    this.#tree = undefined;
+    this.#previousResult = undefined;
+    this.#configurationFiles = undefined;
+    this.#fileHashes.clear();
+    // Start over in a new folder, in case something deleted this one
+    if (this.#privateFolderPath) {
+      deletePrivateFolder(this.#privateFolderPath);
+      this.#privateFolderPath = undefined;
+    }
+  }
+
+  #disable(): void {
+    this.#isDisabled = true;
+    this.#reset();
+  }
+}
+
+// The folders of all caches share one listener, which is registered while any folder exists
+const privateFolderPaths: Set<string> = new Set();
+
+function addPrivateFolder(folderPath: string): void {
+  if (privateFolderPaths.size === 0) {
+    process.on('exit', deletePrivateFolders);
+  }
+
+  privateFolderPaths.add(folderPath);
+}
+
+function deletePrivateFolder(folderPath: string): void {
+  privateFolderPaths.delete(folderPath);
+  if (privateFolderPaths.size === 0) {
+    process.off('exit', deletePrivateFolders);
+  }
+
+  fs.rmSync(folderPath, { recursive: true, force: true });
+}
+
+function deletePrivateFolders(): void {
+  for (const folderPath of privateFolderPaths) {
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Builds a new copy of the index that keeps the untracked cache and the file system monitor's state of the previous
+ * copy. Returns `undefined` if the index records other paths than the previous copy, or if the previous copy can't
+ * be read, in which case the index is copied as it is.
+ */
+async function tryCarryOverCachesAsync(
+  previousPath: string,
+  content: Buffer,
+  objectIdLength: number
+): Promise<ICarriedOverCopy | undefined> {
+  try {
+    const handle: fs.promises.FileHandle = await fs.promises.open(previousPath, 'r');
+    try {
+      const previousStats: fs.BigIntStats = await handle.stat({ bigint: true });
+      const previousContent: Buffer = await handle.readFile();
+      const newContent: Buffer | undefined = tryCarryOverGitIndexCaches(
+        content,
+        previousContent,
+        objectIdLength
+      );
+      return newContent && { content: newContent, previousTimeNs: previousStats.mtimeNs };
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Reads the number of entries from the header of a Git index file, or returns `undefined` if the file doesn't
+ * exist or isn't a Git index.
+ */
+function tryReadGitIndexEntryCount(indexPath: string): number | undefined {
+  let fileDescriptor: number;
+  try {
+    fileDescriptor = fs.openSync(indexPath, 'r');
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) {
+      return undefined;
+    }
+
+    throw error;
+  }
+
+  try {
+    const header: Buffer = Buffer.alloc(INDEX_HEADER_LENGTH);
+    const bytesRead: number = fs.readSync(fileDescriptor, header, 0, INDEX_HEADER_LENGTH, 0);
+    return tryGetGitIndexEntryCount(header.subarray(0, bytesRead));
+  } finally {
+    fs.closeSync(fileDescriptor);
+  }
+}
+
+/**
+ * Returns the path of the folder that contains the file or folder, or '' for the root folder of the repository.
+ */
+function getParentFolderPath(relativePath: string): string {
+  const separatorIndex: number = Math.max(relativePath.lastIndexOf('/'), relativePath.lastIndexOf('\\'));
+  return separatorIndex < 0 ? '' : relativePath.slice(0, separatorIndex);
+}
+
+function readConfigurationFiles(filePaths: ReadonlyArray<string>): IConfigurationFile[] {
+  // Take the time before examining any of the files, so that a write made after a file's examination is later
+  const timeNs: bigint = getTimeNs();
+  return filePaths.map((filePath: string) => readConfigurationFile(filePath, timeNs));
+}
+
+function readConfigurationFile(filePath: string, timeNs: bigint): IConfigurationFile {
+  let stats: fs.BigIntStats;
+  try {
+    stats = fs.statSync(filePath, { bigint: true });
+  } catch (error) {
+    // Creating the file changes its stamp
+    return { path: filePath, content: EMPTY_CONTENT, stamp: getErrorStamp(error), revealsLaterWrite: true };
+  }
+
+  let content: Buffer = EMPTY_CONTENT;
+  try {
+    content = fs.readFileSync(filePath);
+  } catch {
+    // For example, a folder in place of the file
+  }
+
+  return {
+    path: filePath,
+    content,
+    stamp: getFileStamp(stats),
+    revealsLaterWrite: revealsWriteAfter(stats, timeNs)
+  };
+}
+
+function getStampOrErrorStamp(filePath: string): string {
+  try {
+    return getFileStamp(fs.statSync(filePath, { bigint: true }));
+  } catch (error) {
+    return getErrorStamp(error);
+  }
+}
+
+function getErrorStamp(error: unknown): string {
+  return `!${(error as NodeJS.ErrnoException).code}`;
+}
+
+function haveSameContent(
+  previousFiles: ReadonlyArray<IConfigurationFile> | undefined,
+  files: ReadonlyArray<IConfigurationFile>
+): boolean {
+  // Both lists have a file for each of the same configuration paths, in the same order
+  return (
+    previousFiles?.length === files.length &&
+    files.every(({ content }: IConfigurationFile, i: number) => content.equals(previousFiles[i].content))
+  );
+}
+
+/**
+ * Lists the attributes files that affect how "git status" refreshes the files within the filter: those that it
+ * lists as modified or untracked; those that the index marks "assume unchanged" or "skip worktree", which it doesn't
+ * list even when they change; and those in the folders that contain the filter paths, which it doesn't list either.
+ */
+function* getAttributesFilePaths(
+  rootDirectory: string,
+  modifiedFilePaths: Iterable<string>,
+  hiddenAttributesFilePaths: ReadonlyArray<string>,
+  filterPath: ReadonlyArray<string> | undefined
+): IterableIterator<string> {
+  for (const filePath of modifiedFilePaths) {
+    if (filePath === ATTRIBUTES_FILE_NAME || filePath.endsWith(`/${ATTRIBUTES_FILE_NAME}`)) {
+      yield path.resolve(rootDirectory, filePath);
+    }
+  }
+
+  for (const filePath of hiddenAttributesFilePaths) {
+    yield path.resolve(rootDirectory, filePath);
+  }
+
+  const rootPath: string = path.resolve(rootDirectory);
+  const folderPaths: Set<string> = new Set();
+  for (const filterEntry of filterPath ?? []) {
+    let folderPath: string = path.resolve(rootPath, filterEntry);
+    while (!folderPaths.has(folderPath)) {
+      folderPaths.add(folderPath);
+      const parentFolderPath: string = path.dirname(folderPath);
+      if (folderPath === rootPath || parentFolderPath === folderPath) {
+        break;
+      }
+
+      folderPath = parentFolderPath;
+    }
+  }
+
+  for (const folderPath of folderPaths) {
+    yield path.join(folderPath, ATTRIBUTES_FILE_NAME);
+  }
+}
+
+/**
+ * Waits for both promises to settle, then fails with the first error, if any.
+ */
+async function waitForBothAsync<T1, T2>(promise1: Promise<T1>, promise2: Promise<T2>): Promise<[T1, T2]> {
+  const [result1, result2] = await Promise.allSettled([promise1, promise2]);
+  if (result1.status === 'rejected') {
+    throw result1.reason;
+  }
+
+  if (result2.status === 'rejected') {
+    throw result2.reason;
+  }
+
+  return [result1.value, result2.value];
+}
+
+function areArraysEqual(a: ReadonlyArray<string>, b: ReadonlyArray<string>): boolean {
+  return a.length === b.length && a.every((value: string, i: number) => value === b[i]);
+}
+
+function areMapsEqual(a: ReadonlyMap<string, string>, b: ReadonlyMap<string, string>): boolean {
+  if (a.size !== b.size) {
+    return false;
+  }
+
+  for (const [key, value] of a) {
+    if (b.get(key) !== value) {
+      return false;
+    }
+  }
+
+  return true;
+}
diff --git a/libraries/package-deps-hash/src/getRepoState.ts b/libraries/package-deps-hash/src/getRepoState.ts
index 45cb07a8dd7..a17bd4633e9 100644
--- a/libraries/package-deps-hash/src/getRepoState.ts
+++ b/libraries/package-deps-hash/src/getRepoState.ts
@@ -2,7 +2,10 @@
 // See LICENSE in the project root for license information.
 
 import type * as child_process from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 import { Readable, pipeline } from 'node:stream';
 
 import { Executable, type IExecutableSpawnOptions } from '@rushstack/node-core-library/lib/Executable';
@@ -20,7 +23,11 @@ const MINIMUM_GIT_VERSION: IGitVersion = {
   patch: 0
 };
 
-const STANDARD_GIT_OPTIONS: readonly string[] = [
+/**
+ * The options for every read-only Git command.
+ * @internal
+ */
+export const STANDARD_GIT_OPTIONS: readonly string[] = [
   // Don't request any optional file locks
   '--no-optional-locks',
   // Ensure that commands don't run automatic maintenance, since performance of the command itself is paramount
@@ -79,7 +86,10 @@ const OBJECTMODE_FILE_EXECUTABLE: '100755' = '100755';
 // e.g. 10644 blob <hash>\t<path>
 const GIT_LSTREE_FORMAT: string = '%(objectmode) type %(objectname)%x09%(path)';
 
-interface IGitTreeState {
+/**
+ * @internal
+ */
+export interface IGitTreeState {
   files: Map<string, string>; // type "blob"
   symlinks: Map<string, string>; // type "link"
   submodules: Map<string, string>; // type "commit"
@@ -235,15 +245,26 @@ export function parseGitDiffIndex(output: string): Map<string, IFileDiffStatus>
   return result;
 }
 
+/**
+ * What `git status` reports about a path:
+ * - `deleted`: the path is deleted in the working tree, or deleted in the index and not modified in the working tree.
+ * - `indexOnly`: only the index differs from HEAD. Git uses the object in the index for the working tree, and
+ *   doesn't read the file if sparse checkout leaves it out or if the index marks it "assume unchanged" or
+ *   "skip worktree", so the file may not be on disk.
+ * - `workingTree`: the working tree differs from the index, or the path is untracked or unmerged.
+ * @internal
+ */
+export type GitStatusKind = 'deleted' | 'indexOnly' | 'workingTree';
+
 /**
  * Parses the output of `git status -z -u` to extract the set of files that have changed since HEAD.
  *
  * @param output - The raw output from Git
- * @returns a map of file path to if it exists
+ * @returns a map of file path to what `git status` reports about it
  * @internal
  */
-export function parseGitStatus(output: string): Map<string, boolean> {
-  const result: Map<string, boolean> = new Map();
+export function parseGitStatus(output: string): Map<string, GitStatusKind> {
+  const result: Map<string, GitStatusKind> = new Map();
 
   // Parse the output
   // With the -z modifier, paths are delimited by nulls
@@ -257,12 +278,18 @@ export function parseGitStatus(output: string): Map<string, boolean> {
     // We passed --no-renames above, so a rename will be a delete of the old location and an add at the new.
     // charAt(startOfLine) is the index status, charAt(startOfLine + 1) is the working tree status
     const workingTreeStatus: string = output.charAt(startOfLine + 1);
-    // Deleted in working tree, or not modified in working tree and deleted in index
-    const deleted: boolean =
-      workingTreeStatus === 'D' || (workingTreeStatus === ' ' && output.charAt(startOfLine) === 'D');
+    let kind: GitStatusKind;
+    if (workingTreeStatus === 'D' || (workingTreeStatus === ' ' && output.charAt(startOfLine) === 'D')) {
+      // Deleted in working tree, or not modified in working tree and deleted in index
+      kind = 'deleted';
+    } else if (workingTreeStatus === ' ') {
+      kind = 'indexOnly';
+    } else {
+      kind = 'workingTree';
+    }
 
     const filePath: string = output.slice(startOfLine + 3, eolIndex);
-    result.set(filePath, !deleted);
+    result.set(filePath, kind);
 
     startOfLine = eolIndex + 1;
     eolIndex = output.indexOf('\0', startOfLine);
@@ -273,8 +300,12 @@ export function parseGitStatus(output: string): Map<string, boolean> {
 
 const repoRootCache: Map<string, string> = new Map();
 
-// Strip GIT_DIR/GIT_WORK_TREE: git hooks in linked worktrees set GIT_DIR to the per-worktree metadata dir, causing rev-parse --show-toplevel to return CWD instead of the worktree root.
-function getCleanGitEnvironment(): NodeJS.ProcessEnv {
+/**
+ * Strip GIT_DIR/GIT_WORK_TREE: git hooks in linked worktrees set GIT_DIR to the per-worktree metadata dir, causing
+ * rev-parse --show-toplevel to return CWD instead of the worktree root.
+ * @internal
+ */
+export function getCleanGitEnvironment(): NodeJS.ProcessEnv {
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
   const { GIT_DIR, GIT_WORK_TREE, ...trimmedEnv } = process.env;
   return trimmedEnv;
@@ -323,17 +354,20 @@ export function getRepoRoot(currentWorkingDirectory: string, gitPath?: string):
  * @param args - The process arguments
  * @param currentWorkingDirectory - The working directory. Should be the repository root.
  * @param stdin - An optional Readable stream to use as stdin to the process.
+ * @param environment - The environment of the process. Defaults to {@link getCleanGitEnvironment}.
+ * @internal
  */
-async function spawnGitAsync(
+export async function spawnGitAsync(
   gitPath: string | undefined,
   args: string[],
   currentWorkingDirectory: string,
-  stdin?: Readable
+  stdin?: Readable,
+  environment: NodeJS.ProcessEnv = getCleanGitEnvironment()
 ): Promise<string> {
   const spawnOptions: IExecutableSpawnOptions = {
     currentWorkingDirectory,
     stdio: ['pipe', 'pipe', 'pipe'],
-    environment: getCleanGitEnvironment()
+    environment
   };
 
   let stdout: string = '';
@@ -363,12 +397,29 @@ async function spawnGitAsync(
   if (status !== 0) {
     ensureGitMinimumVersion(gitPath);
 
-    throw new Error(`git ${args[0]} exited with code ${status}:\n${stderr}`);
+    throw new Error(`git ${getGitCommandName(args)} exited with code ${status}:\n${stderr}`);
   }
 
   return stdout;
 }
 
+/**
+ * Returns the Git command in the arguments, rather than the first of the options in front of it.
+ */
+function getGitCommandName(args: ReadonlyArray<string>): string | undefined {
+  for (let i: number = 0; i < args.length; i++) {
+    const arg: string = args[i];
+    if (arg === '-c') {
+      // Skip the value of a configuration option
+      i++;
+    } else if (!arg.startsWith('-')) {
+      return arg;
+    }
+  }
+
+  return undefined;
+}
+
 function isIterable<T>(value: Iterable<T> | AsyncIterable<T>): value is Iterable<T> {
   return Symbol.iterator in value;
 }
@@ -424,6 +475,124 @@ export async function hashFilesAsync(
   return parseGitHashObject(hashObjectResult, hashPaths);
 }
 
+/**
+ * If the path is a symbolic link that doesn't lead to a regular file, returns the object that `git add` records for
+ * it: a blob of the text of the link. Otherwise returns `undefined`.
+ *
+ * @remarks
+ * `git hash-object` follows symbolic links. It fails if the target is missing, is a folder or is a loop of links, and
+ * it waits for a named pipe to be written. A symbolic link to a regular file is left to it.
+ * @param fullPath - The full path of the file
+ * @internal
+ */
+export async function tryGetSymbolicLinkHashAsync(fullPath: string): Promise<string | undefined> {
+  let linkText: Buffer;
+  try {
+    // The text may not be valid UTF-8
+    linkText = await fs.promises.readlink(fullPath, { encoding: 'buffer' });
+  } catch {
+    // Not a symbolic link. "git hash-object" reports any error.
+    return undefined;
+  }
+
+  try {
+    if ((await fs.promises.stat(fullPath)).isFile()) {
+      return undefined;
+    }
+  } catch {
+    // The target is missing, or can't be reached
+  }
+
+  return createHash('sha1').update(`blob ${linkText.length}\0`).update(linkText).digest('hex');
+}
+
+/**
+ * The arguments of the `git ls-files` command that lists the files in the index in the format of `git ls-tree`.
+ * @internal
+ */
+export function getGitLsFilesArgs(filterPath: ReadonlyArray<string> | undefined): string[] {
+  return [
+    'ls-files',
+    // Read from the index only
+    '--cached',
+    // Use NUL as the separator
+    '-z',
+    // Specify the full path to files relative to the root
+    '--full-name',
+    // Match the format of "git ls-tree". The %(objecttype) placeholder requires git 2.51.0+, so not using yet.
+    `--format=${GIT_LSTREE_FORMAT}`,
+    '--',
+    ...(filterPath ?? [])
+  ];
+}
+
+/**
+ * The arguments of the `git status` command that lists the files that differ from the index or from HEAD, and the
+ * untracked files. Its output is parsed by {@link parseGitStatus}.
+ * @internal
+ */
+export function getGitStatusArgs(filterPath: ReadonlyArray<string> | undefined): string[] {
+  return [
+    'status',
+    // Use NUL as the separator
+    '-z',
+    // Include untracked files
+    '-u',
+    // Disable rename detection so that renames show up as add + delete
+    '--no-renames',
+    // Don't process submodules with this command; they'll be handled individually
+    '--ignore-submodules',
+    // Don't compare against the remote
+    '--no-ahead-behind',
+    '--',
+    ...(filterPath ?? [])
+  ];
+}
+
+/**
+ * The locally modified files that `git status` reports, split into those to hash with `git hash-object` and those
+ * to remove from the state of the repository.
+ * @internal
+ */
+export interface ILocallyModifiedFiles {
+  filesToHash: string[];
+  filesToRemove: string[];
+}
+
+/**
+ * Splits the locally modified files that `git status` reports into those to hash and those to remove from the
+ * state of the repository: the deleted files and the files that the index records as symbolic links. A path whose
+ * working tree column is blank is in neither list, so that it keeps the object that the index records for it.
+ * @internal
+ */
+export function classifyLocallyModifiedFiles(
+  locallyModified: ReadonlyMap<string, GitStatusKind>,
+  symlinks: ReadonlyMap<string, string>
+): ILocallyModifiedFiles {
+  const filesToHash: string[] = [];
+  const filesToRemove: string[] = [];
+  const isWindows: boolean = process.platform === 'win32';
+  for (const [filePath, kind] of locallyModified) {
+    if (kind === 'indexOnly') {
+      // Git uses the object in the index, which the list of the index already has. The file may not be on disk.
+      continue;
+    }
+
+    if (kind === 'workingTree' && !symlinks.has(filePath)) {
+      // Skip Windows reserved device names. `git hash-object` cannot open them and would abort
+      // the entire repo-state computation. These are almost always stray artifacts (e.g. a `nul`
+      // file produced by a misdirected shell redirect) rather than meaningful inputs.
+      if (!isWindows || !isWindowsReservedPath(filePath)) {
+        filesToHash.push(filePath);
+      }
+    } else {
+      filesToRemove.push(filePath);
+    }
+  }
+
+  return { filesToHash, filesToRemove };
+}
+
 /**
  * Gets the object hashes for all files in the Git repo, combining the current commit with working tree state.
  * Uses async operations and runs all primary Git calls in parallel.
@@ -455,6 +624,10 @@ export async function getRepoStateAsync(
 export interface IDetailedRepoState {
   /**
    * The Git file hashes for all files in the repository, including uncommitted changes.
+   *
+   * @remarks
+   * A symbolic link that the index doesn't record as one, such as an untracked link, has the hash of the regular file
+   * that it leads to. If it doesn't lead to a regular file, it has the hash of its text, which `git add` would record.
    */
   files: Map<string, string>;
   /**
@@ -487,65 +660,49 @@ export async function getDetailedRepoStateAsync(
 ): Promise<IDetailedRepoState> {
   const statePromise: Promise<IGitTreeState> = spawnGitAsync(
     gitPath,
-    STANDARD_GIT_OPTIONS.concat([
-      'ls-files',
-      // Read from the index only
-      '--cached',
-      // Use NUL as the separator
-      '-z',
-      // Specify the full path to files relative to the root
-      '--full-name',
-      // Match the format of "git ls-tree". The %(objecttype) placeholder requires git 2.51.0+, so not using yet.
-      `--format=${GIT_LSTREE_FORMAT}`,
-      '--',
-      ...(filterPath ?? [])
-    ]),
+    STANDARD_GIT_OPTIONS.concat(getGitLsFilesArgs(filterPath)),
     rootDirectory
   ).then(parseGitLsTree);
-  const locallyModifiedPromise: Promise<Map<string, boolean>> = spawnGitAsync(
+  const locallyModifiedPromise: Promise<Map<string, GitStatusKind>> = spawnGitAsync(
     gitPath,
-    STANDARD_GIT_OPTIONS.concat([
-      'status',
-      // Use NUL as the separator
-      '-z',
-      // Include untracked files
-      '-u',
-      // Disable rename detection so that renames show up as add + delete
-      '--no-renames',
-      // Don't process submodules with this command; they'll be handled individually
-      '--ignore-submodules',
-      // Don't compare against the remote
-      '--no-ahead-behind',
-      '--',
-      ...(filterPath ?? [])
-    ]),
+    STANDARD_GIT_OPTIONS.concat(getGitStatusArgs(filterPath)),
     rootDirectory
   ).then(parseGitStatus);
 
+  // Every path to hash, in order, and the hashes of the symbolic links that "git hash-object" can't follow
+  const pathsToHash: string[] = [];
+  const symbolicLinkHashes: Map<string, string> = new Map();
+
+  async function* filterSymbolicLinksAsync(filePaths: ReadonlyArray<string>): AsyncIterableIterator<string> {
+    const linkHashes: (string | undefined)[] = await Promise.all(
+      filePaths.map((filePath: string) => tryGetSymbolicLinkHashAsync(path.resolve(rootDirectory, filePath)))
+    );
+    for (let i: number = 0; i < filePaths.length; i++) {
+      const filePath: string = filePaths[i];
+      const linkHash: string | undefined = linkHashes[i];
+      pathsToHash.push(filePath);
+      if (linkHash === undefined) {
+        yield filePath;
+      } else {
+        symbolicLinkHashes.set(filePath, linkHash);
+      }
+    }
+  }
+
   async function* getFilesToHash(): AsyncIterableIterator<string> {
     if (additionalRelativePathsToHash) {
-      for (const file of additionalRelativePathsToHash) {
-        yield file;
-      }
+      yield* filterSymbolicLinksAsync(additionalRelativePathsToHash);
     }
 
     const [{ files, symlinks }, locallyModified] = await Promise.all([statePromise, locallyModifiedPromise]);
 
-    const isWindows: boolean = process.platform === 'win32';
-    for (const [filePath, exists] of locallyModified) {
-      if (exists && !symlinks.has(filePath)) {
-        // Skip Windows reserved device names. `git hash-object` cannot open them and would abort
-        // the entire repo-state computation. These are almost always stray artifacts (e.g. a `nul`
-        // file produced by a misdirected shell redirect) rather than meaningful inputs.
-        if (isWindows && isWindowsReservedPath(filePath)) {
-          continue;
-        }
-        yield filePath;
-      } else {
-        files.delete(filePath);
-        symlinks.delete(filePath);
-      }
+    const { filesToHash, filesToRemove } = classifyLocallyModifiedFiles(locallyModified, symlinks);
+    for (const filePath of filesToRemove) {
+      files.delete(filePath);
+      symlinks.delete(filePath);
     }
+
+    yield* filterSymbolicLinksAsync(filesToHash);
   }
 
   const hashObjectPromise: Promise<Iterable<[string, string]>> = hashFilesAsync(
@@ -554,14 +711,22 @@ export async function getDetailedRepoStateAsync(
     gitPath
   );
 
-  const [{ files, symlinks, submodules }, locallyModifiedFiles] = await Promise.all([
+  // Await all three at once. `git hash-object` can fail before the other two finish, for example on an additional
+  // path that does not exist. Its rejection needs a handler right away, or Node reports it as unhandled and exits.
+  const [{ files, symlinks, submodules }, locallyModifiedFiles, hashObjectResult] = await Promise.all([
     statePromise,
-    locallyModifiedPromise
+    locallyModifiedPromise,
+    hashObjectPromise
   ]);
 
-  // The result of "git hash-object" will be a list of file hashes delimited by newlines
-  for (const [filePath, hash] of await hashObjectPromise) {
-    files.set(filePath, hash);
+  // The result of "git hash-object" will be a list of file hashes delimited by newlines. Set the hashes in the order
+  // of the paths, so that new paths are in the same order as in RepoStateCache.
+  const hashes: Map<string, string> = new Map(hashObjectResult);
+  for (const filePath of pathsToHash) {
+    const hash: string | undefined = symbolicLinkHashes.get(filePath) ?? hashes.get(filePath);
+    if (hash !== undefined) {
+      files.set(filePath, hash);
+    }
   }
 
   // Existence check for the .gitmodules file
diff --git a/libraries/package-deps-hash/src/index.ts b/libraries/package-deps-hash/src/index.ts
index 8558d210a4d..4d54497791e 100644
--- a/libraries/package-deps-hash/src/index.ts
+++ b/libraries/package-deps-hash/src/index.ts
@@ -24,3 +24,4 @@ export {
   ensureGitMinimumVersion,
   hashFilesAsync
 } from './getRepoState';
+export { type IRepoStateCacheOptions, RepoStateCache } from './RepoStateCache';
diff --git a/libraries/package-deps-hash/src/test/FileStamp.test.ts b/libraries/package-deps-hash/src/test/FileStamp.test.ts
new file mode 100644
index 00000000000..1b998051c13
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/FileStamp.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+import { getTimeNs, revealsWriteAfter } from '../FileStamp';
+
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1e6);
+
+function getStats(ctimeNs: bigint): fs.BigIntStats {
+  return { ctimeNs } as fs.BigIntStats;
+}
+
+function afterMs(timeNs: bigint, milliseconds: number, nanoseconds: number = 0): bigint {
+  return timeNs + BigInt(milliseconds) * NANOSECONDS_PER_MILLISECOND + BigInt(nanoseconds);
+}
+
+describe(revealsWriteAfter.name, () => {
+  it('reveals a write made more than 100 ms after the last change of a file with fine timestamps', () => {
+    const ctimeNs: bigint = BigInt('1790000000123456789');
+    const stats: fs.BigIntStats = getStats(ctimeNs);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 100, 1))).toBe(true);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 3000))).toBe(true);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 100))).toBe(false);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 50))).toBe(false);
+    expect(revealsWriteAfter(stats, ctimeNs)).toBe(false);
+  });
+
+  it('reveals a write made more than 3 s after the last change of a file whose timestamps may be coarse', () => {
+    // Whole seconds, as on a filesystem that records seconds, and whole multiples of 10 ms
+    for (const ctimeNs of [BigInt('1790000000000000000'), BigInt('1790000000120000000')]) {
+      const stats: fs.BigIntStats = getStats(ctimeNs);
+      expect(revealsWriteAfter(stats, afterMs(ctimeNs, 3000, 1))).toBe(true);
+      expect(revealsWriteAfter(stats, afterMs(ctimeNs, 3000))).toBe(false);
+      expect(revealsWriteAfter(stats, afterMs(ctimeNs, 100, 1))).toBe(false);
+    }
+  });
+});
+
+describe(getTimeNs.name, () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('returns the current time in nanoseconds', () => {
+    jest.spyOn(Date, 'now').mockReturnValue(1790000000123);
+    expect(getTimeNs()).toBe(BigInt('1790000000123000000'));
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/FsmonitorHook.ts b/libraries/package-deps-hash/src/test/FsmonitorHook.ts
new file mode 100644
index 00000000000..1693cd44373
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/FsmonitorHook.ts
@@ -0,0 +1,45 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/**
+ * A file system monitor hook for Git, which reports the paths that a test logs.
+ */
+export interface IFsmonitorHook {
+  /**
+   * The path of the hook, the value of Git's `core.fsmonitor` setting.
+   */
+  readonly hookPath: string;
+  /**
+   * Logs a path that changed, which the hook then reports to Git.
+   */
+  logChange(relativePath: string): void;
+}
+
+/**
+ * Creates a file system monitor hook in the given folder. Its token is the number of paths that were logged when Git
+ * queried it, and it reports every path as changed for a token that it didn't create.
+ */
+export function createFsmonitorHook(folderPath: string): IFsmonitorHook {
+  const hookPath: string = path.join(folderPath, 'fsmonitor-hook');
+  const logPath: string = path.join(folderPath, 'fsmonitor-hook.log');
+  fs.writeFileSync(logPath, '');
+  const script: string = [
+    '#!/bin/sh',
+    `log='${logPath}'`,
+    `count=$(wc -l < "$log" | tr -d ' ')`,
+    `printf 't:%s\\0' "$count"`,
+    'case "$2" in',
+    `  t:*) tail -n "+$((\${2#t:} + 1))" "$log" | tr '\\n' '\\0' ;;`,
+    `  *) printf '/\\0' ;;`,
+    'esac',
+    ''
+  ].join('\n');
+  fs.writeFileSync(hookPath, script, { mode: 0o755 });
+  return {
+    hookPath,
+    logChange: (relativePath: string) => fs.appendFileSync(logPath, `${relativePath}\n`)
+  };
+}
diff --git a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
new file mode 100644
index 00000000000..08e734b06f1
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
@@ -0,0 +1,881 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  type IGitIndexExtension,
+  type IGitIndexSummary,
+  parseGitIndexLayout,
+  summarizeGitIndex,
+  tryCarryOverGitIndexCaches,
+  tryGetGitIndexEntryCount,
+  tryReadEwahBitmap,
+  writeEwahBitmap
+} from '../GitIndexFile';
+import { createFsmonitorHook, type IFsmonitorHook } from './FsmonitorHook';
+
+const SHA1_OBJECT_ID_LENGTH: number = 20;
+const SHA256_OBJECT_ID_LENGTH: number = 32;
+const LONG_FILE_PATH: string = `dir/sub/${'long-name-'.repeat(12)}.txt`;
+
+function getGitEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...process.env };
+  delete environment.GIT_DIR;
+  delete environment.GIT_WORK_TREE;
+  delete environment.GIT_INDEX_FILE;
+  // Let "git status" save the index that it refreshes
+  delete environment.GIT_OPTIONAL_LOCKS;
+  return environment;
+}
+
+let repoPath: string;
+
+function runGit(...args: string[]): string {
+  return execFileSync('git', args, { cwd: repoPath, env: getGitEnvironment(), encoding: 'utf8' });
+}
+
+function runGitWithIndex(indexPath: string, ...args: string[]): string {
+  return execFileSync('git', args, {
+    cwd: repoPath,
+    env: { ...getGitEnvironment(), GIT_INDEX_FILE: indexPath },
+    encoding: 'utf8'
+  });
+}
+
+function writeFile(relativePath: string, content: string): void {
+  const filePath: string = path.join(repoPath, relativePath);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content);
+}
+
+function getIndexPath(): string {
+  return path.join(repoPath, '.git', 'index');
+}
+
+function readIndex(): Buffer {
+  return fs.readFileSync(getIndexPath());
+}
+
+function createRepo(...initArgs: string[]): void {
+  runGit('init', '--quiet', ...initArgs);
+  runGit('config', 'core.fsmonitor', 'false');
+  runGit('config', 'core.untrackedCache', 'true');
+  runGit('config', 'index.skipHash', 'false');
+  // Windows runners turn this on in the system configuration, and Git then warns about each file that it adds
+  runGit('config', 'core.autocrlf', 'false');
+  writeFile('a.txt', 'a\n');
+  writeFile('dir/b.txt', 'b\n');
+  writeFile('dir/sub/c.txt', 'c\n');
+  writeFile(LONG_FILE_PATH, 'd\n');
+  runGit('add', '.');
+}
+
+function commit(): void {
+  runGit('-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Commit');
+}
+
+// Git writes a version 3 index only if an entry has extended flags, and writes a version 2 index otherwise
+function setIndexVersion(version: number): void {
+  if (version === 3) {
+    runGit('update-index', '--skip-worktree', LONG_FILE_PATH);
+  }
+
+  runGit('update-index', `--index-version=${version}`);
+  expect(readIndex().readUInt32BE(4)).toBe(version);
+}
+
+describe(summarizeGitIndex.name, () => {
+  function summarize(objectIdLength: number = SHA1_OBJECT_ID_LENGTH): IGitIndexSummary {
+    return summarizeGitIndex(readIndex(), objectIdLength);
+  }
+
+  beforeEach(() => {
+    repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'git-index-file-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(repoPath, { recursive: true, force: true });
+  });
+
+  it.each([2, 3, 4])('summarizes a version %i index', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+
+    const summary: IGitIndexSummary = summarize();
+    expect(summary.entryCount).toBe(4);
+    expect(summary.entriesDigest).toMatch(/^[0-9a-f]{40}$/);
+    expect(summary.isSplit).toBe(false);
+  });
+
+  it('summarizes the index of a SHA-256 repository', () => {
+    createRepo('--object-format=sha256');
+    runGit('update-index', '--index-version=4');
+
+    const summary: IGitIndexSummary = summarize(SHA256_OBJECT_ID_LENGTH);
+    expect(summary.entryCount).toBe(4);
+    expect(() => summarize(SHA1_OBJECT_ID_LENGTH)).toThrow();
+  });
+
+  it.each([2, 3, 4])('ignores what refreshing a version %i index changes', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+    commit();
+    const initialIndex: Buffer = readIndex();
+    const initialSummary: IGitIndexSummary = summarize();
+
+    // Change the recorded times of a file, and the untracked cache
+    const time: number = Math.floor(Date.now() / 1000) - 100;
+    fs.utimesSync(path.join(repoPath, 'a.txt'), time, time);
+    writeFile('untracked.txt', 'untracked\n');
+    runGit('status', '--porcelain');
+
+    expect(readIndex().equals(initialIndex)).toBe(false);
+    expect(summarize()).toEqual(initialSummary);
+  });
+
+  it.each([2, 3, 4])('changes when the entries of a version %i index change', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+    const initialDigest: string = summarize().entriesDigest;
+    const digests: Set<string> = new Set([initialDigest]);
+
+    runGit('update-index', '--assume-unchanged', 'a.txt');
+    digests.add(summarize().entriesDigest);
+    runGit('update-index', '--no-assume-unchanged', 'a.txt');
+    expect(summarize().entriesDigest).toBe(initialDigest);
+
+    // Extended flags
+    runGit('update-index', '--skip-worktree', 'dir/b.txt');
+    digests.add(summarize().entriesDigest);
+    runGit('update-index', '--no-skip-worktree', 'dir/b.txt');
+    expect(summarize().entriesDigest).toBe(initialDigest);
+
+    runGit('update-index', '--chmod=+x', 'a.txt');
+    digests.add(summarize().entriesDigest);
+    runGit('update-index', '--chmod=-x', 'a.txt');
+    expect(summarize().entriesDigest).toBe(initialDigest);
+
+    writeFile('a.txt', 'changed\n');
+    runGit('add', 'a.txt');
+    digests.add(summarize().entriesDigest);
+
+    runGit('rm', '--cached', '--quiet', 'dir/sub/c.txt');
+    const summary: IGitIndexSummary = summarize();
+    expect(summary.entryCount).toBe(3);
+    digests.add(summary.entriesDigest);
+
+    expect(digests.size).toBe(6);
+  });
+
+  it.each([2, 3, 4])('digests the recorded sizes of a version %i index separately', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+    commit();
+    const initialSummary: IGitIndexSummary = summarize();
+    expect(initialSummary.sizesDigest).toMatch(/^[0-9a-f]{40}$/);
+
+    // Git writes the file with other line endings, and records its new size
+    runGit('config', 'core.autocrlf', 'true');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    expect(fs.readFileSync(path.join(repoPath, 'a.txt'), 'utf8')).toBe('a\r\n');
+    let summary: IGitIndexSummary = summarize();
+    expect(summary.entriesDigest).toBe(initialSummary.entriesDigest);
+    expect(summary.sizesDigest).not.toBe(initialSummary.sizesDigest);
+
+    runGit('config', 'core.autocrlf', 'false');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    summary = summarize();
+    expect(summary.entriesDigest).toBe(initialSummary.entriesDigest);
+    expect(summary.sizesDigest).toBe(initialSummary.sizesDigest);
+  });
+
+  it.each([2, 3, 4])(
+    'lists the .gitattributes files that a version %i index marks "assume unchanged" or "skip worktree"',
+    (version: number) => {
+      createRepo();
+      for (const filePath of [
+        '.gitattributes',
+        'dir/.gitattributes.bak',
+        'dir/not.gitattributes',
+        'dir/sub/.gitattribute',
+        'dir/sub/.gitattributes',
+        'dir/\u00fc/.gitattributes',
+        'visible/.gitattributes'
+      ]) {
+        writeFile(filePath, '# No attributes\n');
+      }
+
+      runGit('add', '.');
+      // A version 4 index stores each path relative to the previous one, even one longer than a file system allows
+      const longFilePath: string = `dir/${'long/'.repeat(1000)}.gitattributes`;
+      const objectId: string = runGit('rev-parse', ':a.txt').trim();
+      runGit('update-index', '--add', '--cacheinfo', `100644,${objectId},${longFilePath}`);
+      setIndexVersion(version);
+      expect(summarize().hiddenAttributesFilePaths).toEqual([]);
+
+      const assumeUnchangedPaths: string[] = [
+        '.gitattributes',
+        'dir/not.gitattributes',
+        'dir/sub/.gitattributes'
+      ];
+      const skipWorktreePaths: string[] = [
+        'dir/.gitattributes.bak',
+        'dir/sub/.gitattribute',
+        'dir/\u00fc/.gitattributes',
+        longFilePath
+      ];
+      if (version === 2) {
+        // Git would write a version 3 index to mark a file "skip worktree"
+        assumeUnchangedPaths.push(...skipWorktreePaths.splice(0));
+      } else {
+        // Another extended flag, which doesn't hide the file
+        writeFile('new/.gitattributes', '# No attributes\n');
+        runGit('add', '--intent-to-add', '--', 'new/.gitattributes');
+      }
+
+      runGit('update-index', '--assume-unchanged', '--', ...assumeUnchangedPaths);
+      if (skipWorktreePaths.length > 0) {
+        runGit('update-index', '--skip-worktree', '--', ...skipWorktreePaths);
+      }
+
+      expect(readIndex().readUInt32BE(4)).toBe(version);
+      expect(summarize().hiddenAttributesFilePaths).toEqual([
+        '.gitattributes',
+        longFilePath,
+        'dir/sub/.gitattributes',
+        'dir/\u00fc/.gitattributes'
+      ]);
+    }
+  );
+
+  it('lists the hidden .gitattributes files in the index of a SHA-256 repository', () => {
+    createRepo('--object-format=sha256');
+    writeFile('dir/.gitattributes', '# No attributes\n');
+    writeFile('dir/sub/.gitattributes', '# No attributes\n');
+    runGit('add', '.');
+    runGit('update-index', '--skip-worktree', '--', 'dir/sub/.gitattributes');
+    runGit('update-index', '--index-version=4');
+
+    expect(summarize(SHA256_OBJECT_ID_LENGTH).hiddenAttributesFilePaths).toEqual(['dir/sub/.gitattributes']);
+  });
+
+  it('rejects a version 4 index whose path removes more bytes than the previous path has', () => {
+    createRepo();
+    runGit('update-index', '--assume-unchanged', '--', 'dir/b.txt');
+    runGit('update-index', '--index-version=4');
+    const index: Buffer = readIndex();
+    // The first path removes a byte from the empty path before it
+    index[parseGitIndexLayout(index, SHA1_OBJECT_ID_LENGTH).pathOffsets[0]] = 1;
+    expect(() => summarizeGitIndex(index, SHA1_OBJECT_ID_LENGTH)).toThrow(
+      'The Git index has a malformed path'
+    );
+  });
+
+  it('detects a split index', () => {
+    createRepo();
+    runGit('update-index', '--split-index');
+    expect(summarize().isSplit).toBe(true);
+
+    runGit('update-index', '--no-split-index');
+    const summary: IGitIndexSummary = summarize();
+    expect(summary.isSplit).toBe(false);
+    expect(summary.entryCount).toBe(4);
+  });
+
+  it('rejects data that is not a supported index', () => {
+    createRepo();
+    const index: Buffer = readIndex();
+    expect(() => summarizeGitIndex(Buffer.from('not an index'), SHA1_OBJECT_ID_LENGTH)).toThrow(
+      'The file is not a Git index'
+    );
+    expect(() => summarizeGitIndex(index.subarray(0, index.length - 30), SHA1_OBJECT_ID_LENGTH)).toThrow();
+
+    const unsupportedIndex: Buffer = Buffer.from(index);
+    unsupportedIndex.writeUInt32BE(5, 4);
+    expect(() => summarizeGitIndex(unsupportedIndex, SHA1_OBJECT_ID_LENGTH)).toThrow(
+      'Unsupported Git index version 5'
+    );
+  });
+
+  it('rejects an entry count that the index is too short to hold, before allocating memory for it', () => {
+    createRepo();
+    const index: Buffer = readIndex();
+    index.writeUInt32BE(0xffffffff, 8);
+    const allocSpy: jest.SpyInstance = jest.spyOn(Buffer, 'alloc').mockImplementation(() => {
+      throw new Error('Unexpected allocation');
+    });
+    try {
+      expect(() => summarizeGitIndex(index, SHA1_OBJECT_ID_LENGTH)).toThrow(
+        'The Git index ends within an entry'
+      );
+      expect(allocSpy).not.toHaveBeenCalled();
+    } finally {
+      allocSpy.mockRestore();
+    }
+  });
+});
+
+describe(tryGetGitIndexEntryCount.name, () => {
+  it('reads the entry count from the header of an index', () => {
+    const header: Buffer = Buffer.alloc(12);
+    header.write('DIRC', 0, 'latin1');
+    header.writeUInt32BE(2, 4);
+    header.writeUInt32BE(236074, 8);
+    expect(tryGetGitIndexEntryCount(header)).toBe(236074);
+  });
+
+  it('returns undefined for data that is not the header of an index', () => {
+    expect(tryGetGitIndexEntryCount(Buffer.alloc(0))).toBeUndefined();
+    expect(tryGetGitIndexEntryCount(Buffer.from('DIRC'))).toBeUndefined();
+    expect(tryGetGitIndexEntryCount(Buffer.from('PACK\0\0\0\x02\0\0\0\x01'))).toBeUndefined();
+  });
+});
+
+interface ITrace2Event {
+  category?: string;
+  key?: string;
+  value?: string;
+}
+
+interface IFsmonitorState {
+  token: string;
+  changedEntries: number[];
+}
+
+function getSetBits(bits: Uint8Array): number[] {
+  const setBits: number[] = [];
+  bits.forEach((bit: number, index: number) => {
+    if (bit) {
+      setBits.push(index);
+    }
+  });
+  return setBits;
+}
+
+function createBits(bitCount: number, setBits: ReadonlyArray<number>): Uint8Array {
+  const bits: Uint8Array = new Uint8Array(bitCount);
+  for (const bit of setBits) {
+    bits[bit] = 1;
+  }
+
+  return bits;
+}
+
+function getRange(start: number, end: number): number[] {
+  const range: number[] = [];
+  for (let i: number = start; i < end; i++) {
+    range.push(i);
+  }
+
+  return range;
+}
+
+describe(tryCarryOverGitIndexCaches.name, () => {
+  const replacedSignatures: ReadonlySet<string> = new Set(['EOIE', 'IEOT', 'UNTR', 'FSMN']);
+  let copyPath: string;
+  let newCopyPath: string;
+
+  function getExtension(
+    content: Buffer,
+    signature: string,
+    objectIdLength: number = SHA1_OBJECT_ID_LENGTH
+  ): Buffer | undefined {
+    const extension: IGitIndexExtension | undefined = parseGitIndexLayout(
+      content,
+      objectIdLength
+    ).extensions.find((candidate: IGitIndexExtension) => candidate.signature === signature);
+    return extension && content.subarray(extension.start, extension.end);
+  }
+
+  function getRequiredExtension(content: Buffer, signature: string): Buffer {
+    const extension: Buffer | undefined = getExtension(content, signature);
+    if (!extension) {
+      throw new Error(`The index has no "${signature}" extension`);
+    }
+
+    return extension;
+  }
+
+  function getSignatures(content: Buffer): string[] {
+    return parseGitIndexLayout(content, SHA1_OBJECT_ID_LENGTH).extensions.map(
+      ({ signature }: IGitIndexExtension) => signature
+    );
+  }
+
+  // Inserts an extension before the checksum, without updating the checksum
+  function insertExtension(content: Buffer, signature: string, data: Buffer): Buffer {
+    const header: Buffer = Buffer.alloc(8);
+    header.write(signature, 0, 'latin1');
+    header.writeUInt32BE(data.length, 4);
+    const checksumOffset: number = content.length - SHA1_OBJECT_ID_LENGTH;
+    return Buffer.concat([
+      content.subarray(0, checksumOffset),
+      header,
+      data,
+      content.subarray(checksumOffset)
+    ]);
+  }
+
+  // Git doesn't trust the recorded times of a file or folder that changed in the same second as the index was saved
+  function settleWorkingTree(folderPath: string, time: number): void {
+    for (const entry of fs.readdirSync(folderPath, { withFileTypes: true })) {
+      if (entry.name !== '.git') {
+        const entryPath: string = path.join(folderPath, entry.name);
+        if (entry.isDirectory()) {
+          settleWorkingTree(entryPath, time);
+        }
+
+        fs.utimesSync(entryPath, time, time);
+      }
+    }
+
+    fs.utimesSync(folderPath, time, time);
+  }
+
+  // Creates a repository with untracked files, and a copy of its index in which Git saved the untracked cache
+  function createRepoWithCopy(version: number, objectIdLength: number = SHA1_OBJECT_ID_LENGTH): void {
+    createRepo(...(objectIdLength === SHA256_OBJECT_ID_LENGTH ? ['--object-format=sha256'] : []));
+    // Git then saves the "EOIE" extension
+    runGit('config', 'index.threads', 'true');
+    setIndexVersion(version);
+    writeFile('untracked.txt', 'untracked\n');
+    writeFile('dir/untracked.txt', 'untracked\n');
+    settleWorkingTree(repoPath, Math.floor(Date.now() / 1000) - 100);
+    runGit('update-index', '--refresh');
+    commit();
+    fs.copyFileSync(getIndexPath(), copyPath);
+    runGitWithIndex(copyPath, 'status', '--porcelain');
+    expect(getExtension(fs.readFileSync(copyPath), 'UNTR', objectIdLength)).toBeDefined();
+  }
+
+  function stageModifiedFile(): void {
+    writeFile('a.txt', 'modified\n');
+    runGit('add', 'a.txt');
+  }
+
+  function carryOver(objectIdLength: number = SHA1_OBJECT_ID_LENGTH): Buffer {
+    const content: Buffer | undefined = tryCarryOverGitIndexCaches(
+      readIndex(),
+      fs.readFileSync(copyPath),
+      objectIdLength
+    );
+    if (!content) {
+      throw new Error('The new copy did not keep the caches of the previous copy');
+    }
+
+    fs.writeFileSync(newCopyPath, content);
+    return content;
+  }
+
+  // Runs "git status", and counts the folders that it read rather than finding their untracked files in the cache
+  function getStatus(indexPath: string, ...configArgs: string[]): [string, number[]] {
+    const tracePath: string = path.join(repoPath, '.git', 'trace2.json');
+    const output: string = execFileSync('git', [...configArgs, 'status', '--porcelain'], {
+      cwd: repoPath,
+      env: {
+        ...getGitEnvironment(),
+        GIT_INDEX_FILE: indexPath,
+        GIT_TRACE2_EVENT: tracePath,
+        // Git reports the statistics of the untracked cache in a nested region
+        GIT_TRACE2_EVENT_NESTING: '10'
+      },
+      encoding: 'utf8'
+    });
+    const events: ITrace2Event[] = fs
+      .readFileSync(tracePath, 'utf8')
+      .split('\n')
+      .filter((line: string) => line)
+      .map((line: string) => JSON.parse(line));
+    fs.unlinkSync(tracePath);
+    const openedFolderCounts: number[] = events
+      .filter(({ category, key }: ITrace2Event) => category === 'read_directory' && key === 'opendir')
+      .map(({ value }: ITrace2Event) => Number(value));
+    return [output, openedFolderCounts];
+  }
+
+  beforeEach(() => {
+    repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'git-index-file-test-'));
+    copyPath = path.join(repoPath, '.git', 'copy');
+    newCopyPath = path.join(repoPath, '.git', 'new-copy');
+  });
+
+  afterEach(() => {
+    fs.rmSync(repoPath, { recursive: true, force: true });
+  });
+
+  it.each([2, 3, 4])(
+    'keeps the untracked cache of the previous copy of a version %i index',
+    (version: number) => {
+      createRepoWithCopy(version);
+      stageModifiedFile();
+      writeFile('dir/b.txt', 'modified\n');
+      const index: Buffer = readIndex();
+      expect(getSignatures(index)).toContain('EOIE');
+
+      const content: Buffer = carryOver();
+      expect(getSignatures(content)).toEqual([
+        ...getSignatures(index).filter((signature: string) => !replacedSignatures.has(signature)),
+        'UNTR'
+      ]);
+      expect(getExtension(content, 'UNTR')).toEqual(getExtension(fs.readFileSync(copyPath), 'UNTR'));
+      expect(content.subarray(-SHA1_OBJECT_ID_LENGTH)).toEqual(
+        createHash('sha1').update(content.subarray(0, -SHA1_OBJECT_ID_LENGTH)).digest()
+      );
+      expect(runGitWithIndex(newCopyPath, 'ls-files', '--stage', '--debug')).toBe(
+        runGit('ls-files', '--stage', '--debug')
+      );
+      const [output, openedFolderCounts] = getStatus(newCopyPath);
+      expect(openedFolderCounts).toEqual([0]);
+      expect(output).toBe(runGit('status', '--porcelain'));
+      expect(output).toBe('M  a.txt\n M dir/b.txt\n?? dir/untracked.txt\n?? untracked.txt\n');
+    }
+  );
+
+  it('keeps the untracked cache of the previous copy of the index of a SHA-256 repository', () => {
+    createRepoWithCopy(4, SHA256_OBJECT_ID_LENGTH);
+    stageModifiedFile();
+
+    const content: Buffer = carryOver(SHA256_OBJECT_ID_LENGTH);
+    expect(getExtension(content, 'UNTR', SHA256_OBJECT_ID_LENGTH)).toEqual(
+      getExtension(fs.readFileSync(copyPath), 'UNTR', SHA256_OBJECT_ID_LENGTH)
+    );
+    expect(content.subarray(-SHA256_OBJECT_ID_LENGTH)).toEqual(
+      createHash('sha256').update(content.subarray(0, -SHA256_OBJECT_ID_LENGTH)).digest()
+    );
+    expect(getStatus(newCopyPath)).toEqual([runGit('status', '--porcelain'), [0]]);
+  });
+
+  it('writes no checksum when Git writes none', () => {
+    createRepoWithCopy(4);
+    runGit('config', 'index.skipHash', 'true');
+    stageModifiedFile();
+    expect(readIndex().subarray(-SHA1_OBJECT_ID_LENGTH)).toEqual(Buffer.alloc(SHA1_OBJECT_ID_LENGTH));
+
+    const content: Buffer = carryOver();
+    expect(content.subarray(-SHA1_OBJECT_ID_LENGTH)).toEqual(Buffer.alloc(SHA1_OBJECT_ID_LENGTH));
+    expect(getStatus(newCopyPath)).toEqual([runGit('status', '--porcelain'), [0]]);
+  });
+
+  it.each<[string, () => void, number]>([
+    ['adds a file', () => runGit('add', 'untracked.txt'), 5],
+    ['removes a file', () => runGit('rm', '--cached', '--quiet', 'a.txt'), 3],
+    // Then the entries of the index are the first entries of the previous copy
+    ['removes the last file', () => runGit('rm', '--cached', '--quiet', LONG_FILE_PATH), 3],
+    ['renames a file', () => runGit('mv', 'a.txt', 'e.txt'), 4],
+    [
+      'records another file in place of one',
+      () => {
+        runGit('rm', '--cached', '--quiet', 'a.txt');
+        runGit('add', 'dir/untracked.txt');
+      },
+      4
+    ],
+    [
+      'records a symbolic link in place of a file',
+      () => {
+        const objectId: string = runGit('rev-parse', 'HEAD:a.txt').trim();
+        runGit('update-index', '--cacheinfo', `120000,${objectId},a.txt`);
+      },
+      4
+    ],
+    [
+      'records a conflict in place of a file',
+      () => {
+        const objectId: string = runGit('rev-parse', 'HEAD:a.txt').trim();
+        execFileSync('git', ['update-index', '--index-info'], {
+          cwd: repoPath,
+          env: getGitEnvironment(),
+          input: `0 ${'0'.repeat(40)}\ta.txt\n100644 ${objectId} 1\ta.txt\n`
+        });
+      },
+      4
+    ]
+  ])('returns undefined when the index %s', (description: string, change: () => void, entryCount: number) => {
+    createRepoWithCopy(4);
+    change();
+    expect(tryGetGitIndexEntryCount(readIndex())).toBe(entryCount);
+    expect(
+      tryCarryOverGitIndexCaches(readIndex(), fs.readFileSync(copyPath), SHA1_OBJECT_ID_LENGTH)
+    ).toBeUndefined();
+  });
+
+  // Unlike a version 4 index, a version 3 index records its paths as a version 2 index does
+  it.each<[number, number]>([
+    [2, 4],
+    [3, 2]
+  ])(
+    'returns undefined when the index and the previous copy have versions %i and %i',
+    (version: number, previousVersion: number) => {
+      createRepoWithCopy(previousVersion);
+      setIndexVersion(version);
+      expect(
+        tryCarryOverGitIndexCaches(readIndex(), fs.readFileSync(copyPath), SHA1_OBJECT_ID_LENGTH)
+      ).toBeUndefined();
+    }
+  );
+
+  it('returns undefined when the previous copy has no untracked cache', () => {
+    createRepoWithCopy(4);
+    runGitWithIndex(copyPath, '-c', 'core.untrackedCache=false', 'status', '--porcelain');
+    const previousContent: Buffer = fs.readFileSync(copyPath);
+    expect(getExtension(previousContent, 'UNTR')).toBeUndefined();
+    stageModifiedFile();
+    expect(tryCarryOverGitIndexCaches(readIndex(), previousContent, SHA1_OBJECT_ID_LENGTH)).toBeUndefined();
+  });
+
+  it('keeps the extensions of the index that Git may ignore, but not those that it must understand', () => {
+    createRepoWithCopy(4);
+    stageModifiedFile();
+    const index: Buffer = insertExtension(readIndex(), 'ZZZZ', Buffer.from('data'));
+    const previousContent: Buffer = fs.readFileSync(copyPath);
+    const content: Buffer | undefined = tryCarryOverGitIndexCaches(
+      index,
+      previousContent,
+      SHA1_OBJECT_ID_LENGTH
+    );
+    expect(content && getSignatures(content)).toEqual(['TREE', 'ZZZZ', 'UNTR']);
+    expect(content && getExtension(content, 'ZZZZ')).toEqual(getExtension(index, 'ZZZZ'));
+
+    // The extensions of a split index and of a sparse index
+    for (const signature of ['link', 'sdir']) {
+      const extensionData: Buffer = Buffer.alloc(signature === 'link' ? SHA1_OBJECT_ID_LENGTH : 0);
+      expect(
+        tryCarryOverGitIndexCaches(
+          insertExtension(index, signature, extensionData),
+          previousContent,
+          SHA1_OBJECT_ID_LENGTH
+        )
+      ).toBeUndefined();
+      expect(
+        tryCarryOverGitIndexCaches(
+          index,
+          insertExtension(previousContent, signature, extensionData),
+          SHA1_OBJECT_ID_LENGTH
+        )
+      ).toBeUndefined();
+    }
+  });
+
+  it('throws when the previous copy is not an index', () => {
+    createRepoWithCopy(4);
+    const previousContent: Buffer = fs.readFileSync(copyPath);
+    expect(() =>
+      tryCarryOverGitIndexCaches(readIndex(), previousContent.subarray(0, 100), SHA1_OBJECT_ID_LENGTH)
+    ).toThrow('The Git index ends within an entry');
+  });
+
+  if (process.platform !== 'win32') {
+    describe('with a file system monitor', () => {
+      let hook: IFsmonitorHook;
+
+      function runGitWithFsmonitor(indexPath: string, ...args: string[]): string {
+        return runGitWithIndex(indexPath, '-c', `core.fsmonitor=${hook.hookPath}`, ...args);
+      }
+
+      function readFsmonitorState(content: Buffer): IFsmonitorState {
+        const data: Buffer = getRequiredExtension(content, 'FSMN').subarray(8);
+        expect(data.readUInt32BE(0)).toBe(2);
+        const tokenEnd: number = data.indexOf(0, 4);
+        const bitmap: Buffer = data.subarray(tokenEnd + 5);
+        expect(bitmap.length).toBe(data.readUInt32BE(tokenEnd + 1));
+        const bits: Uint8Array | undefined = tryReadEwahBitmap(bitmap, content.readUInt32BE(8));
+        return {
+          token: data.toString('latin1', 4, tokenEnd),
+          changedEntries: bits ? getSetBits(bits) : []
+        };
+      }
+
+      function modifyFile(relativePath: string): void {
+        writeFile(relativePath, 'modified\n');
+        hook.logChange(relativePath);
+      }
+
+      it('keeps the token of the previous copy, and marks the entries that differ from it as changed', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        // Git asks the hook for every change, since the copy has no token, and then saves the token of the hook
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        runGitWithFsmonitor(copyPath, 'update-index', '--no-fsmonitor-valid', 'dir/b.txt');
+        expect(readFsmonitorState(fs.readFileSync(copyPath))).toEqual({ token: 't:0', changedEntries: [1] });
+
+        modifyFile('a.txt');
+        runGit('add', 'a.txt');
+        const content: Buffer = carryOver();
+        expect(readFsmonitorState(content)).toEqual({ token: 't:0', changedEntries: [0, 1] });
+        // Git lists the entries that the file system monitor considers unchanged in lowercase
+        expect(runGitWithFsmonitor(newCopyPath, 'ls-files', '-f')).toBe(
+          `H a.txt\nH dir/b.txt\nh dir/sub/c.txt\nh ${LONG_FILE_PATH}\n`
+        );
+        expect(getStatus(newCopyPath, '-c', `core.fsmonitor=${hook.hookPath}`)[0]).toBe(
+          runGit('status', '--porcelain')
+        );
+      });
+
+      it('reads and writes runs of entries that are all marked as changed', () => {
+        const filePaths: string[] = getRange(0, 200).map(
+          (index: number) => `f/${String(index).padStart(3, '0')}`
+        );
+        for (const filePath of filePaths) {
+          writeFile(filePath, `${filePath}\n`);
+        }
+
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        runGitWithFsmonitor(copyPath, 'update-index', '--no-fsmonitor-valid', ...filePaths);
+        const previousContent: Buffer = fs.readFileSync(copyPath);
+        const previousState: IFsmonitorState = readFsmonitorState(previousContent);
+        expect(previousState).toEqual({ token: 't:0', changedEntries: getRange(4, 204) });
+
+        modifyFile('a.txt');
+        runGit('add', 'a.txt');
+        const content: Buffer = carryOver();
+        const state: IFsmonitorState = readFsmonitorState(content);
+        expect(state).toEqual({ token: 't:0', changedEntries: [0, ...getRange(4, 204)] });
+        // Git compresses runs of words whose bits are all set, but the new copy doesn't
+        expect(getRequiredExtension(content, 'FSMN').length).toBeGreaterThan(
+          getRequiredExtension(previousContent, 'FSMN').length
+        );
+        expect(runGitWithFsmonitor(newCopyPath, 'ls-files', '-f')).toBe(
+          [
+            'H a.txt',
+            'h dir/b.txt',
+            'h dir/sub/c.txt',
+            `h ${LONG_FILE_PATH}`,
+            ...filePaths.map((filePath: string) => `H ${filePath}`),
+            ''
+          ].join('\n')
+        );
+      });
+
+      it('keeps the token of the previous copy rather than that of the index', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        // Git saves the index with a later token, after the untracked file was created
+        writeFile('dir/new.txt', 'new\n');
+        hook.logChange('dir/new.txt');
+        runGitWithFsmonitor(getIndexPath(), 'status', '--porcelain');
+        modifyFile('a.txt');
+        runGitWithFsmonitor(getIndexPath(), 'add', 'a.txt');
+        expect(readFsmonitorState(readIndex()).token).toBe('t:2');
+
+        const content: Buffer = carryOver();
+        expect(readFsmonitorState(content).token).toBe('t:0');
+        const [output] = getStatus(newCopyPath, '-c', `core.fsmonitor=${hook.hookPath}`);
+        expect(output).toBe(runGitWithFsmonitor(getIndexPath(), 'status', '--porcelain'));
+        expect(output).toContain('?? dir/new.txt\n');
+      });
+
+      it('drops the state of the file system monitor of the index', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        modifyFile('a.txt');
+        runGitWithFsmonitor(getIndexPath(), 'add', 'a.txt');
+        expect(getExtension(readIndex(), 'FSMN')).toBeDefined();
+
+        expect(getExtension(carryOver(), 'FSMN')).toBeUndefined();
+      });
+
+      it('returns undefined when the state of the file system monitor of the previous copy is malformed', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        stageModifiedFile();
+        const previousContent: Buffer = fs.readFileSync(copyPath);
+        expect(tryCarryOverGitIndexCaches(readIndex(), previousContent, SHA1_OBJECT_ID_LENGTH)).toBeDefined();
+
+        // An unknown version
+        const malformedContent: Buffer = Buffer.from(previousContent);
+        const extensionOffset: number = previousContent.indexOf(
+          getRequiredExtension(previousContent, 'FSMN')
+        );
+        malformedContent.writeUInt32BE(3, extensionOffset + 8);
+        expect(
+          tryCarryOverGitIndexCaches(readIndex(), malformedContent, SHA1_OBJECT_ID_LENGTH)
+        ).toBeUndefined();
+      });
+    });
+  }
+});
+
+describe(writeEwahBitmap.name, () => {
+  it('writes an empty bitmap as Git does', () => {
+    expect(writeEwahBitmap(new Uint8Array(3)).toString('hex')).toBe(
+      ['00000000', '00000001', '0000000000000000', '00000000'].join('')
+    );
+  });
+
+  it('writes a bitmap as Git does', () => {
+    // As Git saved it for an index of 4 entries, in which it marked the second entry as changed
+    expect(writeEwahBitmap(createBits(4, [1])).toString('hex')).toBe(
+      ['00000002', '00000002', '0000000200000000', '0000000000000002', '00000000'].join('')
+    );
+  });
+
+  it('compresses runs of words that are 0', () => {
+    const bits: Uint8Array = createBits(100000, [5, 99999]);
+    const data: Buffer = writeEwahBitmap(bits);
+    // A marker and a literal word, then a marker for the run and a literal word
+    expect(data.length).toBe(8 + 4 * 8 + 4);
+    expect(tryReadEwahBitmap(data, bits.length)).toEqual(bits);
+  });
+
+  it('writes bitmaps that it reads back', () => {
+    let seed: number = 1;
+    for (const bitCount of [1, 31, 32, 63, 64, 65, 200, 5000]) {
+      for (const density of [0, 0.01, 0.5, 0.99, 1]) {
+        const bits: Uint8Array = new Uint8Array(bitCount);
+        for (let i: number = 0; i < bitCount; i++) {
+          seed = (seed * 1103515245 + 12345) % 2 ** 31;
+          bits[i] = seed / 2 ** 31 < density ? 1 : 0;
+        }
+
+        expect(tryReadEwahBitmap(writeEwahBitmap(bits), bitCount)).toEqual(bits);
+      }
+    }
+  });
+});
+
+describe(tryReadEwahBitmap.name, () => {
+  it('reads runs of words whose bits are all set', () => {
+    // As Git saved it for an index of 132 entries, in which it marked every entry as changed
+    const data: Buffer = Buffer.from(
+      ['00000084', '00000002', '0000000200000005', '000000000000000f', '00000000'].join(''),
+      'hex'
+    );
+    expect(tryReadEwahBitmap(data, 132)).toEqual(new Uint8Array(132).fill(1));
+    expect(tryReadEwahBitmap(data, 131)).toBeUndefined();
+  });
+
+  it('rejects a malformed bitmap', () => {
+    const data: Buffer = writeEwahBitmap(createBits(4, [1]));
+    expect(tryReadEwahBitmap(data, 4)).toEqual(createBits(4, [1]));
+    expect(tryReadEwahBitmap(data.subarray(0, 4), 4)).toBeUndefined();
+    expect(tryReadEwahBitmap(data.subarray(0, data.length - 1), 4)).toBeUndefined();
+
+    // A bit beyond the size of the bitmap
+    const bitBeyondSize: Buffer = Buffer.from(data);
+    bitBeyondSize.writeUInt32BE(1, 0);
+    expect(tryReadEwahBitmap(bitBeyondSize, 4)).toBeUndefined();
+
+    // More literal words than the bitmap has
+    const missingLiteralWord: Buffer = Buffer.from(data);
+    missingLiteralWord.writeUInt32BE(4, 8);
+    expect(tryReadEwahBitmap(missingLiteralWord, 4)).toBeUndefined();
+
+    // A run of words whose bits are all set, beyond the size of the bitmap
+    const runBeyondSize: Buffer = Buffer.from(
+      ['00000004', '00000001', '0000000000000003', '00000000'].join(''),
+      'hex'
+    );
+    expect(tryReadEwahBitmap(runBeyondSize, 64)).toBeUndefined();
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
new file mode 100644
index 00000000000..bb128e75906
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -0,0 +1,1486 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { type ChildProcess, execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { Executable, type IExecutableSpawnOptions } from '@rushstack/node-core-library';
+
+import * as GitIndexFile from '../GitIndexFile';
+import { getDetailedRepoStateAsync, type IDetailedRepoState } from '../getRepoState';
+import { RepoStateCache } from '../RepoStateCache';
+import { createFsmonitorHook, type IFsmonitorHook } from './FsmonitorHook';
+
+const originalDateNow: () => number = Date.now;
+const originalSpawn: typeof Executable.spawn = Executable.spawn;
+
+function getGitEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...process.env };
+  delete environment.GIT_DIR;
+  delete environment.GIT_WORK_TREE;
+  delete environment.GIT_INDEX_FILE;
+  // Let "git status" save the index that it refreshes
+  delete environment.GIT_OPTIONAL_LOCKS;
+  return environment;
+}
+
+interface IComparableState {
+  hasSubmodules: boolean;
+  hasUncommittedChanges: boolean;
+  files: [string, string][];
+  symlinks: [string, string][];
+}
+
+function toComparable(state: IDetailedRepoState): IComparableState {
+  return {
+    hasSubmodules: state.hasSubmodules,
+    hasUncommittedChanges: state.hasUncommittedChanges,
+    files: Array.from(state.files),
+    symlinks: Array.from(state.symlinks)
+  };
+}
+
+interface IGitCommand {
+  command: string | undefined;
+  usesPrivateIndex: boolean;
+}
+
+interface ITrace2Event {
+  category?: string;
+  key?: string;
+  value?: string;
+}
+
+function getExtension(content: Buffer, signature: string): Buffer | undefined {
+  const extension: GitIndexFile.IGitIndexExtension | undefined = GitIndexFile.parseGitIndexLayout(
+    content,
+    20
+  ).extensions.find((candidate: GitIndexFile.IGitIndexExtension) => candidate.signature === signature);
+  return extension && content.subarray(extension.start, extension.end);
+}
+
+// Sets environment variables, and returns a function that restores their previous values
+function setEnvironmentVariables(variables: Record<string, string>): () => void {
+  const previousValues: [string, string | undefined][] = Object.keys(variables).map((name: string) => [
+    name,
+    process.env[name]
+  ]);
+  Object.assign(process.env, variables);
+  return () => {
+    for (const [name, value] of previousValues) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+  };
+}
+
+function getGitCommand(
+  args: ReadonlyArray<string>,
+  options: IExecutableSpawnOptions | undefined
+): IGitCommand {
+  let command: string | undefined;
+  for (let i: number = 0; i < args.length && !command; i++) {
+    if (args[i] === '-c') {
+      // Skip the value of a configuration option
+      i++;
+    } else if (!args[i].startsWith('-')) {
+      command = args[i];
+    }
+  }
+
+  return { command, usesPrivateIndex: !!options?.environment?.GIT_INDEX_FILE };
+}
+
+describe(RepoStateCache.name, () => {
+  let repoPath: string;
+  let temporaryFolderPath: string;
+  let cache: RepoStateCache;
+  let gitCommands: IGitCommand[];
+  let isRecordingGitCommands: boolean;
+  let beforeSpawn: ((gitCommand: IGitCommand) => void) | undefined;
+  let afterSpawn: ((gitCommand: IGitCommand, childProcess: ChildProcess) => void) | undefined;
+
+  function runGit(...args: string[]): string {
+    return execFileSync('git', args, { cwd: repoPath, env: getGitEnvironment(), encoding: 'utf8' });
+  }
+
+  function writeFile(relativePath: string, content: string): void {
+    const filePath: string = path.join(repoPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  function commit(): void {
+    runGit('add', '--all');
+    runGit('commit', '--quiet', '--allow-empty', '-m', 'Commit');
+  }
+
+  function getPrivateIndexPath(): string {
+    const [folderName] = fs.readdirSync(temporaryFolderPath);
+    return path.join(temporaryFolderPath, folderName, 'index');
+  }
+
+  // Treat every file as settled, so that the cache memoizes the hashes of files that just changed
+  function settleFiles(): void {
+    jest.spyOn(Date, 'now').mockImplementation(() => originalDateNow() + 10000);
+  }
+
+  // Treat every file as changed recently, however slowly the test runs
+  function unsettleFiles(): void {
+    jest.spyOn(Date, 'now').mockImplementation(() => originalDateNow() - 60000);
+  }
+
+  // Changes the recorded times of a file, but not its content, so that "git status" saves the refreshed index
+  function touchSettledFile(relativePath: string): void {
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    fs.utimesSync(path.join(repoPath, relativePath), time, time);
+  }
+
+  function takeGitCommands(): IGitCommand[] {
+    const commands: IGitCommand[] = gitCommands;
+    gitCommands = [];
+    return commands;
+  }
+
+  // The commands that the cache ran, sorted, since some run concurrently
+  function takeGitCommandNames(): (string | undefined)[] {
+    return takeGitCommands()
+      .map(({ command }: IGitCommand) => command)
+      .sort();
+  }
+
+  function takeUsesPrivateIndex(): boolean {
+    return takeGitCommands().some(({ usesPrivateIndex }: IGitCommand) => usesPrivateIndex);
+  }
+
+  async function getStateAsync(
+    additionalRelativePathsToHash?: string[],
+    filterPath?: string[]
+  ): Promise<IDetailedRepoState> {
+    return await cache.getDetailedRepoStateAsync(additionalRelativePathsToHash, filterPath);
+  }
+
+  async function expectUncachedStateAsync(
+    state: IDetailedRepoState,
+    additionalRelativePathsToHash?: string[],
+    filterPath?: string[]
+  ): Promise<void> {
+    isRecordingGitCommands = false;
+    try {
+      const expected: IDetailedRepoState = await getDetailedRepoStateAsync(
+        repoPath,
+        additionalRelativePathsToHash,
+        undefined,
+        filterPath
+      );
+      expect(toComparable(state)).toEqual(toComparable(expected));
+    } finally {
+      isRecordingGitCommands = true;
+    }
+  }
+
+  beforeEach(() => {
+    repoPath = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'repo-state-cache-test-')));
+    temporaryFolderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-state-cache-private-'));
+    runGit('init', '--quiet');
+    runGit('config', 'user.name', 'Test');
+    runGit('config', 'user.email', 'test@example.com');
+    runGit('config', 'commit.gpgSign', 'false');
+    runGit('config', 'core.autocrlf', 'false');
+    runGit('config', 'core.safecrlf', 'false');
+    runGit('config', 'core.fsmonitor', 'false');
+    runGit('config', 'core.untrackedCache', 'true');
+    runGit('config', 'maintenance.auto', 'false');
+    writeFile('a.txt', 'a\n');
+    writeFile('b.txt', 'b\n');
+    writeFile('dir/c.txt', 'c\n');
+    commit();
+
+    cache = new RepoStateCache({ rootDirectory: repoPath, temporaryFolderPath });
+    gitCommands = [];
+    isRecordingGitCommands = true;
+    beforeSpawn = undefined;
+    afterSpawn = undefined;
+    jest
+      .spyOn(Executable, 'spawn')
+      .mockImplementation((filename: string, args: string[], options?: IExecutableSpawnOptions) => {
+        const gitCommand: IGitCommand = getGitCommand(args, options);
+        beforeSpawn?.(gitCommand);
+        if (isRecordingGitCommands) {
+          gitCommands.push(gitCommand);
+        }
+
+        const childProcess: ChildProcess = originalSpawn.call(Executable, filename, args, options);
+        afterSpawn?.(gitCommand, childProcess);
+        return childProcess;
+      });
+  });
+
+  afterEach(() => {
+    cache.dispose();
+    jest.restoreAllMocks();
+    fs.rmSync(repoPath, { recursive: true, force: true });
+    fs.rmSync(temporaryFolderPath, { recursive: true, force: true });
+  });
+
+  it('returns the same state as getDetailedRepoStateAsync, and the same object while nothing changes', async () => {
+    writeFile('a.txt', 'modified\n');
+    writeFile('untracked.txt', 'untracked\n');
+    settleFiles();
+
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(
+      takeGitCommands()
+        .map(({ command, usesPrivateIndex }: IGitCommand) => `${command} ${usesPrivateIndex}`)
+        .sort()
+    ).toEqual(['hash-object false', 'hash-object false', 'ls-files true', 'rev-parse false', 'status true']);
+    await expectUncachedStateAsync(state, ['untracked.txt']);
+    expect(state.hasUncommittedChanges).toBe(true);
+
+    await expect(getStateAsync(['untracked.txt'])).resolves.toBe(state);
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('follows changes to the working tree', async () => {
+    let previousState: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(previousState);
+    expect(previousState.hasUncommittedChanges).toBe(false);
+
+    const changes: (() => void)[] = [
+      () => writeFile('a.txt', 'modified\n'),
+      () => writeFile('a.txt', 'modified again\n'),
+      () => writeFile('new.txt', 'new\n'),
+      () => fs.unlinkSync(path.join(repoPath, 'b.txt')),
+      () => runGit('checkout', '--', 'b.txt'),
+      () => fs.unlinkSync(path.join(repoPath, 'new.txt')),
+      () => runGit('checkout', '--', 'a.txt')
+    ];
+    for (const change of changes) {
+      change();
+      const state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state).not.toBe(previousState);
+      previousState = state;
+    }
+
+    expect(previousState.hasUncommittedChanges).toBe(false);
+  });
+
+  it('hashes a file that changed recently each time', async () => {
+    unsettleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    takeGitCommands();
+
+    // The file may change again without changing its stamp
+    await getStateAsync();
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('hashes a settled file only while its stamp changes', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    writeFile('untracked.txt', 'untracked\n');
+    await getStateAsync(['untracked.txt']);
+    takeGitCommands();
+
+    await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['status']);
+
+    writeFile('untracked.txt', 'untracked and modified\n');
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+    await expectUncachedStateAsync(state, ['untracked.txt']);
+  });
+
+  it('hashes a file that changed recently again even when its stamp stays the same', async () => {
+    settleFiles();
+    writeFile('untracked.txt', 'one\n');
+    const filePath: string = path.join(repoPath, 'untracked.txt');
+    // Only this file changed recently. Its stamp stays the same when it changes again, as it can when the file
+    // changes twice within the granularity of the file times.
+    const recentTimeNs: bigint = BigInt(Date.now()) * BigInt(1e6);
+    const recentStats: fs.BigIntStats = Object.create(fs.lstatSync(filePath, { bigint: true }), {
+      mtimeNs: { value: recentTimeNs },
+      ctimeNs: { value: recentTimeNs }
+    });
+    const lstatAsync: typeof fs.promises.lstat = fs.promises.lstat;
+    jest
+      .spyOn(fs.promises, 'lstat')
+      .mockImplementation(async (lstatPath: fs.PathLike, options?: fs.StatOptions) =>
+        lstatPath === filePath ? recentStats : await lstatAsync(lstatPath, options)
+      );
+    await getStateAsync(['untracked.txt']);
+
+    writeFile('untracked.txt', 'two\n');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'hash-object', 'status']);
+    expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
+  });
+
+  it('hashes a file that changed recently again even when only its change time is recent', async () => {
+    settleFiles();
+    writeFile('untracked.txt', 'one\n');
+    const filePath: string = path.join(repoPath, 'untracked.txt');
+    // As after a write that put back the modification time of the file. The stamp stays the same when the file
+    // changes again within the granularity of the file times.
+    const recentTimeNs: bigint = BigInt(Date.now()) * BigInt(1e6);
+    const oldTimeNs: bigint = BigInt(originalDateNow() - 100000) * BigInt(1e6);
+    const recentStats: fs.BigIntStats = Object.create(fs.lstatSync(filePath, { bigint: true }), {
+      mtimeNs: { value: oldTimeNs },
+      ctimeNs: { value: recentTimeNs }
+    });
+    const lstatAsync: typeof fs.promises.lstat = fs.promises.lstat;
+    jest
+      .spyOn(fs.promises, 'lstat')
+      .mockImplementation(async (lstatPath: fs.PathLike, options?: fs.StatOptions) =>
+        lstatPath === filePath ? recentStats : await lstatAsync(lstatPath, options)
+      );
+    await getStateAsync(['untracked.txt']);
+
+    writeFile('untracked.txt', 'two\n');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'hash-object', 'status']);
+    expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
+  });
+
+  it('hashes a settled file again when it changes at the same size and its modification time is put back', async () => {
+    settleFiles();
+    const filePath: string = path.join(repoPath, 'untracked.txt');
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    writeFile('untracked.txt', 'one\n');
+    fs.utimesSync(filePath, time, time);
+    await getStateAsync(['untracked.txt']);
+
+    // Only the change time of the file reveals the change, since userspace can't set it
+    writeFile('untracked.txt', 'two\n');
+    fs.utimesSync(filePath, time, time);
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+    expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
+  });
+
+  it('copies the index again when the files that it records change', async () => {
+    settleFiles();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    await getStateAsync();
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+
+    writeFile('a.txt', 'modified\n');
+    runGit('add', 'a.txt');
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(takeGitCommandNames()).toContain('ls-files');
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+
+    // Committing doesn't change the files that the index records
+    runGit('commit', '--quiet', '-m', 'Modify');
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+
+    runGit('rm', '--cached', '--quiet', 'b.txt');
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('follows a checkout between commits that record the same files with the same sizes', async () => {
+    settleFiles();
+    const firstCommit: string = runGit('rev-parse', 'HEAD').trim();
+    writeFile('a.txt', 'A\n');
+    commit();
+    const secondCommit: string = runGit('rev-parse', 'HEAD').trim();
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('a.txt')).toBe(hashText('A\n'));
+
+    // The working tree stays clean, so "git status" reports the same output each time. Only the list of the
+    // files in the index tells the states apart.
+    runGit('reset', '--quiet', '--hard', firstCommit);
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(state.files.get('a.txt')).toBe(hashText('a\n'));
+
+    runGit('checkout', '--quiet', secondCommit);
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(state.files.get('a.txt')).toBe(hashText('A\n'));
+  });
+
+  it('lists the files in the copy of the index while "git status" refreshes it', async () => {
+    await getStateAsync();
+    writeFile('a.txt', 'modified\n');
+    runGit('add', 'a.txt');
+    const events: string[] = [];
+    afterSpawn = ({ command }: IGitCommand, childProcess: ChildProcess) => {
+      if (command === 'ls-files' || command === 'status') {
+        events.push(`start ${command}`);
+        childProcess.once('exit', () => events.push(`exit ${command}`));
+      }
+    };
+
+    const state: IDetailedRepoState = await getStateAsync();
+    afterSpawn = undefined;
+    await expectUncachedStateAsync(state);
+    // Both commands start before either one exits
+    expect(events.slice(0, 2).sort()).toEqual(['start ls-files', 'start status']);
+    expect(events.slice(2).sort()).toEqual(['exit ls-files', 'exit status']);
+  });
+
+  it('keeps the copy of the index when Git only refreshes the index', async () => {
+    settleFiles();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    await getStateAsync();
+
+    const indexPath: string = path.join(repoPath, '.git', 'index');
+    const indexInode: number = fs.statSync(indexPath).ino;
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    fs.utimesSync(path.join(repoPath, 'a.txt'), time, time);
+    runGit('status', '--porcelain');
+    // Git replaced the index
+    expect(fs.statSync(indexPath).ino).not.toBe(indexInode);
+
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(takeGitCommandNames()).toEqual(['status']);
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('detects a change that the recorded times and size of a file cannot reveal', async () => {
+    // Git then compares only the whole seconds of the modification time, and the size
+    runGit('config', 'core.trustctime', 'false');
+    runGit('config', 'core.checkStat', 'minimal');
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    const filePath: string = path.join(repoPath, 'a.txt');
+    fs.utimesSync(filePath, time, time);
+    runGit('update-index', '--refresh');
+    // The index was saved in the same second as the file changed, so Git must not trust the recorded times
+    fs.utimesSync(path.join(repoPath, '.git', 'index'), time, time);
+    fs.writeFileSync(filePath, 'A\n');
+    fs.utimesSync(filePath, time, time);
+
+    const state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(runGit('hash-object', 'a.txt').trim());
+  });
+
+  it('detects a change that the recorded times and size of a file cannot reveal, even where Git trusts them', async () => {
+    runGit('config', 'core.trustctime', 'false');
+    runGit('config', 'core.checkStat', 'minimal');
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    const filePath: string = path.join(repoPath, 'a.txt');
+    fs.utimesSync(filePath, time, time);
+    runGit('update-index', '--refresh');
+    // The index was saved a second after the file changed, so Git trusts the recorded times and size, and
+    // getDetailedRepoStateAsync misses the change. The copy of the index is older.
+    fs.utimesSync(path.join(repoPath, '.git', 'index'), time + 1, time + 1);
+    fs.writeFileSync(filePath, 'A\n');
+    fs.utimesSync(filePath, time, time);
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('a.txt')).toBe(runGit('hash-object', 'a.txt').trim());
+  });
+
+  it('copies the index again when the recorded size of a file changes', async () => {
+    settleFiles();
+    runGit('config', 'core.autocrlf', 'true');
+    const additionalPaths: string[] = ['b.txt'];
+    await getStateAsync(additionalPaths);
+    writeFile('a.txt', 'modified\n');
+    await expectUncachedStateAsync(await getStateAsync(additionalPaths), additionalPaths);
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git writes the file with other line endings, and records its new size in the index but not in the copy
+    runGit('checkout', '--', 'a.txt');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    // The files that the index records didn't change, so the list of files and the hashes are reused
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('copies the index again when the configuration of the repository changes', async () => {
+    settleFiles();
+    runGit('config', 'core.autocrlf', 'true');
+    // Git writes the file with CRLF line endings
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    await getStateAsync();
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('a.txt');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git no longer converts the line endings, so the file no longer matches the index
+    runGit('config', 'core.autocrlf', 'false');
+    takeGitCommands();
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('a\r\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('copies the index again on each call while the configuration of the repository may still change', async () => {
+    runGit('config', 'core.autocrlf', 'true');
+    // Git writes the file with CRLF line endings
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('a.txt');
+    // The configuration may change again without changing its stamp
+    unsettleFiles();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('a\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+
+    const changes: [string, string][] = [
+      ['false', 'a\r\n'],
+      ['true', 'a\n']
+    ];
+    for (const [autocrlf, content] of changes) {
+      runGit('config', 'core.autocrlf', autocrlf);
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('a.txt')).toBe(hashText(content));
+    }
+
+    expect(writeFileSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('copies the index again when a .gitattributes file changes, after computing the state without the cache', async () => {
+    settleFiles();
+    writeFile('crlf.txt', 'a\r\n');
+    commit();
+    await getStateAsync();
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('crlf.txt');
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git now converts the line endings of the file, so it no longer matches the index
+    writeFile('.gitattributes', '*.txt text eol=lf\n');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('crlf.txt')).toBe(hashText('a\n'));
+    expect(writeFileSpy).not.toHaveBeenCalled();
+
+    takeGitCommands();
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('copies the index again when a .gitattributes file in a folder that contains the filter changes', async () => {
+    settleFiles();
+    writeFile('sub/.gitattributes', '*.txt -text\n');
+    writeFile('sub/dir/crlf.txt', 'a\r\n');
+    writeFile('sub/dir/modified.txt', 'm\n');
+    commit();
+    const filterPath: string[] = ['sub/dir'];
+    await getStateAsync([], filterPath);
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('sub/dir/crlf.txt');
+    writeFile('sub/dir/modified.txt', 'modified\r\n');
+    let state: IDetailedRepoState = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+
+    // "git status" doesn't list the file, which is outside the filter
+    writeFile('sub/.gitattributes', '*.txt text eol=lf\n');
+    state = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+    expect(state.files.get('sub/dir/crlf.txt')).toBe(hashText('a\n'));
+    expect(state.files.get('sub/dir/modified.txt')).toBe(hashText('modified\n'));
+
+    takeGitCommands();
+    state = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+    expect(takeUsesPrivateIndex()).toBe(true);
+  });
+
+  it.each([
+    ['--assume-unchanged', '.gitattributes', 2],
+    ['--assume-unchanged', 'dir/.gitattributes', 2],
+    ['--assume-unchanged', 'dir/.gitattributes', 4],
+    ['--skip-worktree', '.gitattributes', 3],
+    ['--skip-worktree', 'dir/.gitattributes', 3],
+    ['--skip-worktree', 'dir/.gitattributes', 4]
+  ])(
+    'copies the index again when a .gitattributes file that the index marks %s changes (%s, index version %i)',
+    async (flag: string, attributesPath: string, indexVersion: number) => {
+      settleFiles();
+      writeFile('dir/crlf.txt', 'a\r\n');
+      writeFile(attributesPath, '# No attributes\n');
+      commit();
+      runGit('update-index', flag, '--', attributesPath);
+      runGit('update-index', `--index-version=${indexVersion}`);
+      expect(fs.readFileSync(path.join(repoPath, '.git', 'index')).readUInt32BE(4)).toBe(indexVersion);
+      await getStateAsync();
+      // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+      touchSettledFile('dir/crlf.txt');
+      await getStateAsync();
+      takeGitCommands();
+      await getStateAsync();
+      expect(takeGitCommandNames()).toEqual(['status']);
+
+      // "git status" doesn't list the attributes file, since Git doesn't examine it. Git now converts the line
+      // endings of the other file, so it no longer matches the index.
+      writeFile(attributesPath, '*.txt text eol=lf\n');
+      let state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('dir/crlf.txt')).toBe(hashText('a\n'));
+
+      takeGitCommands();
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(takeUsesPrivateIndex()).toBe(true);
+    }
+  );
+
+  it('copies the index again when a .gitattributes file within the filter that the index marks --skip-worktree changes', async () => {
+    settleFiles();
+    writeFile('sub/dir/crlf.txt', 'a\r\n');
+    writeFile('sub/dir/.gitattributes', '# No attributes\n');
+    commit();
+    runGit('update-index', '--skip-worktree', '--', 'sub/dir/.gitattributes');
+    const filterPath: string[] = ['sub'];
+    await getStateAsync([], filterPath);
+    touchSettledFile('sub/dir/crlf.txt');
+    await getStateAsync([], filterPath);
+
+    // The attributes file is neither listed by "git status" nor in a folder that contains the filter
+    writeFile('sub/dir/.gitattributes', '*.txt text eol=lf\n');
+    const state: IDetailedRepoState = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+    expect(state.files.get('sub/dir/crlf.txt')).toBe(hashText('a\n'));
+  });
+
+  it('copies the index again when the filter changes, instead of computing the state without the cache', async () => {
+    settleFiles();
+    writeFile('dir/crlf.txt', 'a\r\n');
+    commit();
+    await getStateAsync();
+    touchSettledFile('dir/crlf.txt');
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // An untracked file outside the filter, which "git status" doesn't list
+    writeFile('.gitattributes', '*.txt text eol=lf\n');
+    const state: IDetailedRepoState = await getStateAsync([], ['dir']);
+    await expectUncachedStateAsync(state, [], ['dir']);
+    expect(state.files.get('dir/crlf.txt')).toBe(hashText('a\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('hashes a file again when an ignored .gitattributes file in a folder that contains it changes', async () => {
+    settleFiles();
+    writeFile('.gitignore', 'ignored/\n');
+    commit();
+    writeFile('ignored/dir/crlf.txt', 'a\r\n');
+    const additionalPaths: string[] = ['ignored/dir/crlf.txt'];
+    let state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('ignored/dir/crlf.txt')).toBe(hashText('a\r\n'));
+
+    // "git status" doesn't list the ignored file
+    writeFile('ignored/.gitattributes', '*.txt text eol=lf\n');
+    takeGitCommands();
+    state = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('ignored/dir/crlf.txt')).toBe(hashText('a\n'));
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+
+    await getStateAsync(additionalPaths);
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('hashes a file each time while a .gitattributes file in a folder that contains it may still change', async () => {
+    settleFiles();
+    writeFile('.gitignore', 'ignored/\n');
+    writeFile('.gitattributes', '*.txt -text\n');
+    commit();
+    writeFile('ignored/crlf.txt', 'a\r\n');
+    // The attributes file changes after the calls start, but "git status" doesn't list it
+    const time: number = Math.floor(originalDateNow() / 1000) + 60;
+    fs.utimesSync(path.join(repoPath, '.gitattributes'), time, time);
+    const additionalPaths: string[] = ['ignored/crlf.txt'];
+    await getStateAsync(additionalPaths);
+    takeGitCommands();
+
+    await getStateAsync(additionalPaths);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('hashes files again when a modified .gitattributes file changes', async () => {
+    settleFiles();
+    writeFile('.gitattributes', '# No attributes\n');
+    // "git status" doesn't report an ignored file, so only the additional files include it
+    writeFile('.gitignore', 'ignored.txt\n');
+    commit();
+    writeFile('a.txt', 'modified\r\n');
+    writeFile('untracked.txt', 'untracked\r\n');
+    writeFile('ignored.txt', 'ignored\r\n');
+    const additionalPaths: string[] = ['untracked.txt', 'ignored.txt'];
+    await expectUncachedStateAsync(await getStateAsync(additionalPaths), additionalPaths);
+
+    writeFile('.gitattributes', '*.txt text eol=lf\n');
+    let state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
+    expect(state.files.get('ignored.txt')).toBe(hashText('ignored\n'));
+
+    runGit('checkout', '--', '.gitattributes');
+    state = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\r\n'));
+    expect(state.files.get('ignored.txt')).toBe(hashText('ignored\r\n'));
+  });
+
+  it('hashes files again when the configuration of the repository changes', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\r\n');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\r\n'));
+
+    runGit('config', 'core.autocrlf', 'true');
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
+  });
+
+  it('reuses the copy of the index and the hashes when Git rewrites its configuration with the same content', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    const configurationPath: string = path.join(repoPath, '.git', 'config');
+    const { ino } = fs.statSync(configurationPath);
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git writes a new file with the same content when it deletes a branch that has no configuration
+    runGit('branch', 'other');
+    runGit('branch', '-D', 'other');
+    expect(fs.statSync(configurationPath).ino).not.toBe(ino);
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('reuses the copy of the index when a missing configuration file is created empty', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git reads a missing file as an empty one
+    writeFile('.git/info/attributes', '');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('reads a configuration file that cannot be read as an empty one, as Git does', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    // Git ignores a folder in place of the file
+    const attributesPath: string = path.join(repoPath, '.git', 'info', 'attributes');
+    fs.mkdirSync(attributesPath, { recursive: true });
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    takeGitCommands();
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+
+    fs.rmdirSync(attributesPath);
+    writeFile('.git/info/attributes', '');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('hashes files again when a configuration file changes during a call, even if it changes back', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\r\n');
+    await getStateAsync();
+    const configurationPath: string = path.join(repoPath, '.git', 'config');
+    const configuration: Buffer = fs.readFileSync(configurationPath);
+    // The next call hashes the file under another configuration, which is gone again when the call ends
+    writeFile('a.txt', 'changed\r\n');
+    beforeSpawn = ({ command }: IGitCommand) => {
+      if (command === 'hash-object') {
+        runGit('config', 'core.autocrlf', 'true');
+      }
+    };
+    afterSpawn = ({ command }: IGitCommand, childProcess: ChildProcess) => {
+      if (command === 'hash-object') {
+        childProcess.once('exit', () => fs.writeFileSync(configurationPath, configuration));
+      }
+    };
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('a.txt')).toBe(hashText('changed\n'));
+    expect(fs.readFileSync(configurationPath)).toEqual(configuration);
+
+    beforeSpawn = undefined;
+    afterSpawn = undefined;
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    takeGitCommands();
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('changed\r\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('copies the index again after a call that started while a configuration file could change unseen', async () => {
+    const configurationPath: string = path.join(repoPath, '.git', 'config');
+    const changeTimeMs: number = Number(
+      fs.statSync(configurationPath, { bigint: true }).ctimeNs / BigInt(1e6)
+    );
+    // A write right after the last change might not change the stamp of the file
+    const dateNowSpy: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(changeTimeMs + 50);
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+
+    // Any later write changes the stamp, so the call after the next one reuses the copy
+    dateNowSpy.mockReturnValue(changeTimeMs + 5000);
+    await getStateAsync();
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('reads the index again while its stamp may still change', async () => {
+    settleFiles();
+    const summarizeSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'summarizeGitIndex');
+    // The index changes after the calls start, but the configuration doesn't
+    const indexPath: string = path.join(repoPath, '.git', 'index');
+    const futureTime: number = Math.floor(originalDateNow() / 1000) + 60;
+    fs.utimesSync(indexPath, futureTime, futureTime);
+    await getStateAsync();
+    await getStateAsync();
+    expect(summarizeSpy).toHaveBeenCalledTimes(2);
+
+    const pastTime: number = Math.floor(originalDateNow() / 1000) - 100;
+    fs.utimesSync(indexPath, pastTime, pastTime);
+    await getStateAsync();
+    expect(summarizeSpy).toHaveBeenCalledTimes(3);
+    await getStateAsync();
+    expect(summarizeSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('reuses the hashes of files when the files that the index records change', async () => {
+    settleFiles();
+    const additionalPaths: string[] = ['b.txt'];
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync(additionalPaths);
+
+    runGit('add', 'a.txt');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    // "git status" still lists the staged file
+    expect(takeGitCommandNames()).toEqual(['ls-files', 'status']);
+  });
+
+  it('reuses the hash of a file when only the index has the .gitattributes file that applies to it', async () => {
+    settleFiles();
+    writeFile('.gitignore', 'ignored/\n');
+    writeFile('.gitattributes', '*.txt -text\n');
+    commit();
+    writeFile('ignored/crlf.txt', 'a\r\n');
+    fs.unlinkSync(path.join(repoPath, '.gitattributes'));
+    const additionalPaths: string[] = ['ignored/crlf.txt'];
+    await getStateAsync(additionalPaths);
+
+    // "git status" uses the version in the index in place of the missing file, but "git hash-object" doesn't
+    writeFile('attributes.tmp', '*.txt text eol=lf\n');
+    const objectId: string = runGit('hash-object', '-w', 'attributes.tmp').trim();
+    fs.unlinkSync(path.join(repoPath, 'attributes.tmp'));
+    runGit('update-index', '--cacheinfo', `100644,${objectId},.gitattributes`);
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('ignored/crlf.txt')).toBe(hashText('a\r\n'));
+    expect(takeGitCommandNames()).toEqual(['ls-files', 'status']);
+  });
+
+  it('copies the index again when its copy is deleted or emptied', async () => {
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    await getStateAsync();
+
+    fs.unlinkSync(getPrivateIndexPath());
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+
+    runGit('rm', '--cached', '--quiet', '-r', '.');
+    fs.copyFileSync(path.join(repoPath, '.git', 'index'), getPrivateIndexPath());
+    runGit('reset', '--quiet');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('copies the index to a new folder when its folder is deleted', async () => {
+    await getStateAsync();
+    fs.rmSync(path.dirname(getPrivateIndexPath()), { recursive: true });
+
+    takeGitCommands();
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeUsesPrivateIndex()).toBe(true);
+    expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
+  });
+
+  it('creates the temporary folder', async () => {
+    fs.rmSync(temporaryFolderPath, { recursive: true });
+    await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(true);
+    expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
+  });
+
+  it('resolves a relative temporary folder path against the current working directory, since Git runs in the repository', async () => {
+    // A file that Git takes from the index, since it isn't on disk
+    runGit('update-index', '--assume-unchanged', 'b.txt');
+    fs.unlinkSync(path.join(repoPath, 'b.txt'));
+    // The temp folder of the package is under the current working directory, and the repository isn't
+    const packageTemporaryFolderPath: string = path.resolve(__dirname, '../../temp/test/RepoStateCache');
+    fs.mkdirSync(packageTemporaryFolderPath, { recursive: true });
+    const absoluteFolderPath: string = fs.mkdtempSync(path.join(packageTemporaryFolderPath, 'relative-'));
+    const relativeFolderPath: string = path.relative(process.cwd(), absoluteFolderPath);
+    expect(path.isAbsolute(relativeFolderPath)).toBe(false);
+
+    const relativeCache: RepoStateCache = new RepoStateCache({
+      rootDirectory: repoPath,
+      temporaryFolderPath: relativeFolderPath
+    });
+    try {
+      const state: IDetailedRepoState = await relativeCache.getDetailedRepoStateAsync();
+      expect(takeUsesPrivateIndex()).toBe(true);
+      expect(fs.readdirSync(absoluteFolderPath)).toHaveLength(1);
+      // Only the copy of the index records the file that isn't on disk
+      expect(state.files.has('b.txt')).toBe(true);
+      expect(state.hasUncommittedChanges).toBe(false);
+      await expectUncachedStateAsync(state);
+    } finally {
+      relativeCache.dispose();
+      fs.rmSync(absoluteFolderPath, { recursive: true, force: true });
+    }
+  });
+
+  it('falls back to getDetailedRepoStateAsync when the copy of the index disappears while Git reads it', async () => {
+    await getStateAsync();
+    let isPrivateIndexDeleted: boolean = false;
+    beforeSpawn = ({ command, usesPrivateIndex }: IGitCommand) => {
+      if (command === 'status' && usesPrivateIndex && !isPrivateIndexDeleted) {
+        isPrivateIndexDeleted = true;
+        fs.rmSync(getPrivateIndexPath());
+      }
+    };
+
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(isPrivateIndexDeleted).toBe(true);
+    takeGitCommands();
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeUsesPrivateIndex()).toBe(true);
+  });
+
+  it('removes a lock file that an interrupted "git status" left behind', async () => {
+    await getStateAsync();
+    const privateIndexContent: Buffer = fs.readFileSync(getPrivateIndexPath());
+    const lockPath: string = `${getPrivateIndexPath()}.lock`;
+    fs.writeFileSync(lockPath, '');
+    touchSettledFile('a.txt');
+
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(fs.existsSync(lockPath)).toBe(false);
+    expect(fs.readFileSync(getPrivateIndexPath())).not.toEqual(privateIndexContent);
+  });
+
+  it('starts "git status" before it examines the additional files', async () => {
+    const additionalPaths: string[] = ['b.txt', 'dir/c.txt'];
+    await getStateAsync(additionalPaths);
+    const lstatSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'lstat');
+    let lstatCallCountAtStatus: number | undefined;
+    beforeSpawn = ({ command, usesPrivateIndex }: IGitCommand) => {
+      if (command === 'status' && usesPrivateIndex) {
+        lstatCallCountAtStatus = lstatSpy.mock.calls.length;
+      }
+    };
+
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    expect(lstatCallCountAtStatus).toBe(0);
+    expect(lstatSpy).toHaveBeenCalledTimes(additionalPaths.length);
+    await expectUncachedStateAsync(state, additionalPaths);
+  });
+
+  it('lets "git status" save the copy of the index when the environment disables optional locks', async () => {
+    const optionalLocks: string | undefined = process.env.GIT_OPTIONAL_LOCKS;
+    process.env.GIT_OPTIONAL_LOCKS = '0';
+    try {
+      await getStateAsync();
+      const privateIndexContent: Buffer = fs.readFileSync(getPrivateIndexPath());
+      touchSettledFile('a.txt');
+
+      await expectUncachedStateAsync(await getStateAsync());
+      expect(fs.readFileSync(getPrivateIndexPath())).not.toEqual(privateIndexContent);
+    } finally {
+      if (optionalLocks === undefined) {
+        delete process.env.GIT_OPTIONAL_LOCKS;
+      } else {
+        process.env.GIT_OPTIONAL_LOCKS = optionalLocks;
+      }
+    }
+  });
+
+  it('limits the state to the filter', async () => {
+    settleFiles();
+    writeFile('dir/d.txt', 'd\n');
+    writeFile('e.txt', 'e\n');
+    const state: IDetailedRepoState = await getStateAsync([], ['dir/']);
+    takeGitCommands();
+    await expectUncachedStateAsync(state, [], ['dir/']);
+    expect(Array.from(state.files.keys())).toEqual(['dir/c.txt', 'dir/d.txt']);
+
+    await expect(getStateAsync([], ['dir/'])).resolves.toBe(state);
+    expect(takeGitCommandNames()).toEqual(['status']);
+
+    // The files outside the filter
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'ls-files', 'status']);
+
+    await expectUncachedStateAsync(await getStateAsync([], ['dir/']), [], ['dir/']);
+    expect(takeGitCommandNames()).toEqual(['ls-files', 'status']);
+  });
+
+  it('computes the state of a repository without an index', async () => {
+    fs.unlinkSync(path.join(repoPath, '.git', 'index'));
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(state);
+
+    runGit('reset', '--quiet');
+    state = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(true);
+    await expectUncachedStateAsync(state);
+  });
+
+  it('stops using the cache for a split index', async () => {
+    await getStateAsync();
+    runGit('update-index', '--split-index');
+    writeFile('a.txt', 'modified\n');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+
+    runGit('update-index', '--no-split-index');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(state);
+  });
+
+  it('stops using the cache for a repository with submodules', async () => {
+    const submodulePath: string = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-state-cache-submodule-'));
+    try {
+      execFileSync('git', ['init', '--quiet'], { cwd: submodulePath, env: getGitEnvironment() });
+      fs.writeFileSync(path.join(submodulePath, 'inner.txt'), 'inner\n');
+      execFileSync('git', ['-c', 'core.autocrlf=false', 'add', '--all'], {
+        cwd: submodulePath,
+        env: getGitEnvironment()
+      });
+      execFileSync(
+        'git',
+        ['-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Inner'],
+        { cwd: submodulePath, env: getGitEnvironment() }
+      );
+      runGit('-c', 'protocol.file.allow=always', 'submodule', '--quiet', 'add', submodulePath, 'sub');
+      commit();
+
+      const state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.hasSubmodules).toBe(true);
+      expect(state.files.has('sub/inner.txt')).toBe(true);
+      expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+    } finally {
+      fs.rmSync(submodulePath, { recursive: true, force: true });
+    }
+  });
+
+  it('falls back to getDetailedRepoStateAsync when it fails, and stops after repeated failures', async () => {
+    // Read the index on every call
+    unsettleFiles();
+    const summarizeSpy: jest.SpyInstance = jest
+      .spyOn(GitIndexFile, 'summarizeGitIndex')
+      .mockImplementation(() => {
+        throw new Error('Test failure');
+      });
+    writeFile('a.txt', 'modified\n');
+    await expectUncachedStateAsync(await getStateAsync());
+    await expectUncachedStateAsync(await getStateAsync());
+
+    // A success resets the count
+    summarizeSpy.mockRestore();
+    await getStateAsync();
+    jest.spyOn(GitIndexFile, 'summarizeGitIndex').mockImplementation(() => {
+      throw new Error('Test failure');
+    });
+    await expectUncachedStateAsync(await getStateAsync());
+    await expectUncachedStateAsync(await getStateAsync());
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(GitIndexFile.summarizeGitIndex).toHaveBeenCalledTimes(3);
+
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(GitIndexFile.summarizeGitIndex).toHaveBeenCalledTimes(3);
+    expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+  });
+
+  it('reports the error of getDetailedRepoStateAsync, without counting it as a failure of the cache', async () => {
+    const expectedError: Error = await getDetailedRepoStateAsync(repoPath, ['missing.txt']).then(
+      () => new Error('Expected an error'),
+      (error: Error) => error
+    );
+    expect(expectedError.message).toMatch(/^git hash-object exited with code/);
+
+    for (let i: number = 0; i < 4; i++) {
+      await expect(getStateAsync(['missing.txt'])).rejects.toThrow(expectedError.message);
+    }
+
+    takeGitCommands();
+    await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(true);
+  });
+
+  it('computes the state without the cache after it is disposed', async () => {
+    const exitListenerCount: number = process.listenerCount('exit');
+    await getStateAsync();
+    expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
+    expect(process.listenerCount('exit')).toBe(exitListenerCount + 1);
+
+    cache.dispose();
+    expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+    expect(process.listenerCount('exit')).toBe(exitListenerCount);
+
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(state);
+  });
+
+  it('shares one exit listener between caches', async () => {
+    const exitListeners: NodeJS.ExitListener[] = process.listeners('exit');
+    const otherCache: RepoStateCache = new RepoStateCache({ rootDirectory: repoPath, temporaryFolderPath });
+    try {
+      await getStateAsync();
+      await otherCache.getDetailedRepoStateAsync();
+      expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(2);
+      const addedExitListeners: NodeJS.ExitListener[] = process
+        .listeners('exit')
+        .filter((listener: NodeJS.ExitListener) => !exitListeners.includes(listener));
+      expect(addedExitListeners).toHaveLength(1);
+
+      addedExitListeners[0](0);
+      expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+
+      cache.dispose();
+      expect(process.listenerCount('exit')).toBe(exitListeners.length + 1);
+    } finally {
+      otherCache.dispose();
+    }
+
+    expect(process.listenerCount('exit')).toBe(exitListeners.length);
+  });
+
+  it('runs one call at a time', async () => {
+    writeFile('a.txt', 'modified\n');
+    const states: IDetailedRepoState[] = await Promise.all([
+      getStateAsync(),
+      getStateAsync(),
+      getStateAsync()
+    ]);
+    await expectUncachedStateAsync(states[0]);
+    expect(states[1]).toBe(states[0]);
+    expect(states[2]).toBe(states[0]);
+  });
+
+  if (process.platform !== 'win32') {
+    it('removes a symbolic link that was replaced by a file', async () => {
+      fs.symlinkSync('a.txt', path.join(repoPath, 'link'));
+      commit();
+      let state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.symlinks.has('link')).toBe(true);
+
+      fs.unlinkSync(path.join(repoPath, 'link'));
+      writeFile('link', 'not a link\n');
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.symlinks.has('link')).toBe(false);
+    });
+  }
+
+  describe('when the index records the same paths as the copy', () => {
+    // "git status" keeps no untracked cache on Windows, so no copy keeps that of the previous copy there
+    const itUnlessWindows: jest.It = process.platform === 'win32' ? it.skip : it;
+
+    // Git doesn't trust the recorded times of a folder that changed in the same second as the index was saved
+    function settleFolders(...relativePaths: string[]): void {
+      const time: number = Math.floor(originalDateNow() / 1000) - 100;
+      for (const relativePath of relativePaths) {
+        fs.utimesSync(path.join(repoPath, relativePath), time, time);
+      }
+    }
+
+    // Returns the state, and the numbers of folders that "git status" read rather than finding their untracked
+    // files in the untracked cache
+    async function getStateAndOpenedFolderCountsAsync(): Promise<[IDetailedRepoState, number[]]> {
+      const tracePath: string = path.join(repoPath, '.git', 'trace2.json');
+      const restoreEnvironment: () => void = setEnvironmentVariables({
+        GIT_TRACE2_EVENT: tracePath,
+        // Git reports the statistics of the untracked cache in a nested region
+        GIT_TRACE2_EVENT_NESTING: '10'
+      });
+      let state: IDetailedRepoState;
+      try {
+        state = await getStateAsync();
+      } finally {
+        restoreEnvironment();
+      }
+
+      const events: ITrace2Event[] = fs
+        .readFileSync(tracePath, 'utf8')
+        .split('\n')
+        .filter((line: string) => line)
+        .map((line: string) => JSON.parse(line));
+      fs.unlinkSync(tracePath);
+      const openedFolderCounts: number[] = events
+        .filter(({ category, key }: ITrace2Event) => category === 'read_directory' && key === 'opendir')
+        .map(({ value }: ITrace2Event) => Number(value));
+      return [state, openedFolderCounts];
+    }
+
+    beforeEach(() => {
+      // Otherwise the configuration files may still change, and the cache copies the index as it is
+      settleFiles();
+    });
+
+    itUnlessWindows('keeps the untracked cache of the previous copy', async () => {
+      writeFile('untracked.txt', 'untracked\n');
+      writeFile('dir/untracked.txt', 'untracked\n');
+      settleFolders('.', 'dir');
+      await getStateAsync();
+      const previousPath: string = getPrivateIndexPath();
+      const previousContent: Buffer = fs.readFileSync(previousPath);
+      expect(getExtension(previousContent, 'UNTR')).toBeDefined();
+      // Git saved the copy after the index
+      const previousTime: number = Math.floor(originalDateNow() / 1000) - 50;
+      fs.utimesSync(previousPath, previousTime, previousTime);
+
+      writeFile('a.txt', 'modified\n');
+      runGit('add', 'a.txt');
+      const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+      const utimesSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'utimes');
+      const [state, openedFolderCounts] = await getStateAndOpenedFolderCountsAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('dir/untracked.txt')).toBe(hashText('untracked\n'));
+      expect(openedFolderCounts).toEqual([0]);
+      expect(writeFileSpy).toHaveBeenCalledTimes(1);
+      expect(getExtension(writeFileSpy.mock.calls[0][1], 'UNTR')).toEqual(
+        getExtension(previousContent, 'UNTR')
+      );
+      // The new copy is older than the previous copy, so that Git doesn't trust the recorded times of any folder
+      // that it didn't trust in the previous copy
+      expect(utimesSpy).toHaveBeenCalledWith(expect.any(String), previousTime - 1, previousTime - 1);
+    });
+
+    it('finds the untracked files that changed since the previous copy', async () => {
+      writeFile('untracked.txt', 'untracked\n');
+      settleFolders('.', 'dir');
+      await getStateAsync();
+
+      writeFile('dir/untracked.txt', 'untracked\n');
+      fs.unlinkSync(path.join(repoPath, 'untracked.txt'));
+      writeFile('a.txt', 'modified\n');
+      runGit('add', 'a.txt');
+      const [state, openedFolderCounts] = await getStateAndOpenedFolderCountsAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('dir/untracked.txt')).toBe(hashText('untracked\n'));
+      expect(state.files.has('untracked.txt')).toBe(false);
+      // Git counts the folders only while it uses an untracked cache
+      expect(openedFolderCounts).toEqual(process.platform === 'win32' ? [] : [2]);
+    });
+
+    it('copies the index as it is when the index records other paths', async () => {
+      writeFile('untracked.txt', 'untracked\n');
+      settleFolders('.', 'dir');
+      await getStateAsync();
+
+      // The index records as many files as the copy
+      runGit('rm', '--cached', '--quiet', 'b.txt');
+      runGit('add', 'untracked.txt');
+      const carryOverSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'tryCarryOverGitIndexCaches');
+      const state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('b.txt')).toBe(hashText('b\n'));
+      expect(carryOverSpy.mock.results).toEqual([{ type: 'return', value: undefined }]);
+    });
+
+    it('returns the same state as getDetailedRepoStateAsync after each command', async () => {
+      const carryOverSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'tryCarryOverGitIndexCaches');
+      const commands: (() => void)[] = [
+        () => writeFile('untracked.txt', 'untracked\n'),
+        () => writeFile('a.txt', 'modified\n'),
+        () => runGit('add', 'a.txt'),
+        () => runGit('restore', '--staged', 'a.txt'),
+        () => runGit('stash', '--quiet'),
+        () => runGit('stash', 'pop', '--quiet'),
+        () => runGit('checkout', '--', 'a.txt'),
+        () => writeFile('dir/sub/untracked.txt', 'untracked\n'),
+        () => runGit('add', 'dir/sub/untracked.txt'),
+        () => fs.unlinkSync(path.join(repoPath, 'untracked.txt')),
+        () => runGit('rm', '--cached', '--quiet', 'b.txt'),
+        () => runGit('mv', 'dir/c.txt', 'dir/d.txt'),
+        () => writeFile('dir/d.txt', 'modified\n'),
+        () => runGit('add', '--all')
+      ];
+      await getStateAsync();
+      for (const command of commands) {
+        command();
+        await expectUncachedStateAsync(await getStateAsync());
+      }
+
+      if (process.platform !== 'win32') {
+        expect(
+          carryOverSpy.mock.results.filter(({ value }: jest.MockResult<Buffer | undefined>) => value)
+        ).not.toHaveLength(0);
+      }
+    });
+
+    itUnlessWindows(
+      'computes the state without the cache when the attributes changed since the previous copy',
+      async () => {
+        writeFile('crlf.txt', 'a\r\n');
+        // A time in the future makes Git examine the file again, under the new attributes, in both the index and the
+        // older copy. Otherwise, if the second changed between this write and commit(), Git would examine it only in
+        // the copy.
+        const futureTime: number = Math.floor(originalDateNow() / 1000) + 3600;
+        fs.utimesSync(path.join(repoPath, 'crlf.txt'), futureTime, futureTime);
+        commit();
+        await getStateAsync();
+        const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+        writeFile('.gitattributes', '*.txt text eol=lf\n');
+        writeFile('a.txt', 'modified\n');
+        runGit('add', 'a.txt');
+        takeGitCommands();
+        let state: IDetailedRepoState = await getStateAsync();
+        await expectUncachedStateAsync(state);
+        expect(writeFileSpy).toHaveBeenCalledTimes(1);
+        // The cache ran "git status" on the new copy, and then computed the state without it
+        expect(takeGitCommands().some(({ usesPrivateIndex }: IGitCommand) => !usesPrivateIndex)).toBe(true);
+
+        takeGitCommands();
+        state = await getStateAsync();
+        await expectUncachedStateAsync(state);
+        expect(writeFileSpy).toHaveBeenCalledTimes(2);
+        expect(takeUsesPrivateIndex()).toBe(true);
+      }
+    );
+
+    if (process.platform !== 'win32') {
+      describe('with a file system monitor', () => {
+        let hook: IFsmonitorHook;
+        let restoreEnvironment: () => void;
+
+        function modifyFile(relativePath: string): void {
+          writeFile(relativePath, 'modified\n');
+          hook.logChange(relativePath);
+        }
+
+        beforeEach(() => {
+          hook = createFsmonitorHook(path.join(repoPath, '.git'));
+          // Git applies the configuration in the environment after that of the repository
+          const count: number = Number(process.env.GIT_CONFIG_COUNT || 0);
+          restoreEnvironment = setEnvironmentVariables({
+            [`GIT_CONFIG_KEY_${count}`]: 'core.fsmonitor',
+            [`GIT_CONFIG_VALUE_${count}`]: hook.hookPath,
+            GIT_CONFIG_COUNT: String(count + 1)
+          });
+        });
+
+        afterEach(() => {
+          restoreEnvironment();
+        });
+
+        it('marks the files whose entries changed as changed', async () => {
+          const carryOverSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'tryCarryOverGitIndexCaches');
+          await getStateAsync();
+          modifyFile('a.txt');
+          await expectUncachedStateAsync(await getStateAsync());
+          runGit('add', 'a.txt');
+          await expectUncachedStateAsync(await getStateAsync());
+          // Git found the file unchanged since it was added, but the index no longer records its content
+          expect(runGit('ls-files', '-f', 'a.txt')).toBe('H a.txt\n');
+          runGit('restore', '--staged', 'a.txt');
+
+          const state: IDetailedRepoState = await getStateAsync();
+          await expectUncachedStateAsync(state);
+          expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
+          expect(
+            carryOverSpy.mock.results.map(({ value }: jest.MockResult<Buffer | undefined>) => !!value)
+          ).toEqual([true, true]);
+        });
+
+        it('keeps the token of the previous copy rather than that of the index', async () => {
+          await getStateAsync();
+          // Git saves the index with a later token, after the untracked file was created
+          writeFile('dir/new.txt', 'new\n');
+          hook.logChange('dir/new.txt');
+          runGit('status', '--porcelain');
+          modifyFile('b.txt');
+          runGit('add', 'b.txt');
+
+          const state: IDetailedRepoState = await getStateAsync();
+          await expectUncachedStateAsync(state);
+          expect(state.files.get('dir/new.txt')).toBe(hashText('new\n'));
+        });
+      });
+    }
+  });
+
+  function hashText(text: string): string {
+    return execFileSync('git', ['hash-object', '--stdin', '--no-filters'], {
+      cwd: repoPath,
+      env: getGitEnvironment(),
+      input: text,
+      encoding: 'utf8'
+    }).trim();
+  }
+});
diff --git a/libraries/package-deps-hash/src/test/UnhashablePaths.test.ts b/libraries/package-deps-hash/src/test/UnhashablePaths.test.ts
new file mode 100644
index 00000000000..76701a04a75
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/UnhashablePaths.test.ts
@@ -0,0 +1,309 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import * as getRepoState from '../getRepoState';
+import type { IDetailedRepoState } from '../getRepoState';
+import { RepoStateCache } from '../RepoStateCache';
+
+// Each test makes its repository in the temp folder of the package
+const TEST_FOLDER_PATH: string = path.resolve(__dirname, '../../temp/test/UnhashablePaths');
+const PIPE_OPEN_INTERVAL_MS: number = 1000;
+
+const itUnlessWindows: jest.It = process.platform === 'win32' ? it.skip : it;
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+function getGitEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...process.env };
+  delete environment.GIT_DIR;
+  delete environment.GIT_WORK_TREE;
+  delete environment.GIT_INDEX_FILE;
+  delete environment.GIT_OPTIONAL_LOCKS;
+  return environment;
+}
+
+interface IComparableState {
+  hasSubmodules: boolean;
+  hasUncommittedChanges: boolean;
+  files: [string, string][];
+  symlinks: [string, string][];
+}
+
+function toComparable(state: IDetailedRepoState): IComparableState {
+  return {
+    hasSubmodules: state.hasSubmodules,
+    hasUncommittedChanges: state.hasUncommittedChanges,
+    files: Array.from(state.files),
+    symlinks: Array.from(state.symlinks)
+  };
+}
+
+describe('paths that "git hash-object" cannot hash', () => {
+  let testCount: number = 0;
+  let testFolderPath: string;
+  let repoPath: string;
+
+  function runGit(...args: string[]): string {
+    return execFileSync('git', ['-c', 'core.fsmonitor=false', ...args], {
+      cwd: repoPath,
+      env: getGitEnvironment(),
+      encoding: 'utf8',
+      stdio: 'pipe'
+    });
+  }
+
+  function writeFile(relativePath: string, content: string): void {
+    const filePath: string = path.join(repoPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  function createSymbolicLink(target: string | Buffer, relativePath: string): void {
+    fs.symlinkSync(target, path.join(repoPath, relativePath));
+  }
+
+  function commit(): void {
+    runGit('add', '--all');
+    runGit('commit', '--quiet', '-m', 'Commit');
+  }
+
+  // The object that the index records for the path
+  function getStagedObject(relativePath: string): string {
+    return runGit('rev-parse', `:${relativePath}`).trim();
+  }
+
+  // The object that "git add" records for the path
+  function addAndGetStagedObject(relativePath: string): string {
+    runGit('add', '--force', '--', relativePath);
+    return getStagedObject(relativePath);
+  }
+
+  // Gets the state both without and with the cache, and checks that they are the same
+  async function getStateAsync(additionalRelativePathsToHash?: string[]): Promise<IDetailedRepoState> {
+    const state: IDetailedRepoState = await getRepoState.getDetailedRepoStateAsync(
+      repoPath,
+      additionalRelativePathsToHash
+    );
+    const cache: RepoStateCache = new RepoStateCache({
+      rootDirectory: repoPath,
+      temporaryFolderPath: testFolderPath
+    });
+    const uncachedSpy: jest.SpyInstance = jest.spyOn(getRepoState, 'getDetailedRepoStateAsync');
+    try {
+      const cachedState: IDetailedRepoState = await cache.getDetailedRepoStateAsync(
+        additionalRelativePathsToHash
+      );
+      // The cache used its copy of the index, rather than falling back to the state without the cache
+      expect(uncachedSpy).not.toHaveBeenCalled();
+      expect(toComparable(cachedState)).toEqual(toComparable(state));
+    } finally {
+      uncachedSpy.mockRestore();
+      cache.dispose();
+    }
+
+    return state;
+  }
+
+  async function expectStagedObjectsAsync(...relativePaths: string[]): Promise<void> {
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.hasUncommittedChanges).toBe(true);
+    for (const relativePath of relativePaths) {
+      expect(state.files.get(relativePath)).toEqual(getStagedObject(relativePath));
+      expect(state.symlinks.has(relativePath)).toBe(false);
+    }
+  }
+
+  async function expectLinkTextObjectAsync(
+    relativePath: string,
+    additionalRelativePathsToHash?: string[]
+  ): Promise<void> {
+    const state: IDetailedRepoState = await getStateAsync(additionalRelativePathsToHash);
+    expect(state.files.get(relativePath)).toEqual(addAndGetStagedObject(relativePath));
+    expect(state.symlinks.has(relativePath)).toBe(false);
+  }
+
+  beforeEach(() => {
+    testFolderPath = path.join(TEST_FOLDER_PATH, `${++testCount}`);
+    fs.rmSync(testFolderPath, { recursive: true, force: true });
+    fs.mkdirSync(path.join(testFolderPath, 'repo'), { recursive: true });
+    repoPath = fs.realpathSync(path.join(testFolderPath, 'repo'));
+    runGit('init', '--quiet');
+    runGit('config', 'user.name', 'Test');
+    runGit('config', 'user.email', 'test@example.com');
+    runGit('config', 'commit.gpgSign', 'false');
+    runGit('config', 'core.fsmonitor', 'false');
+    runGit('config', 'maintenance.auto', 'false');
+    writeFile('a.txt', 'a\n');
+    commit();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(testFolderPath, { recursive: true, force: true });
+  });
+
+  it('uses the staged object of a file that a sparse checkout leaves out of the working tree', async () => {
+    writeFile('docs/readme.md', 'committed\n');
+    commit();
+    writeFile('docs/readme.md', 'staged\n');
+    commit();
+    runGit('sparse-checkout', 'set', '--no-cone', '/*', '!/docs/');
+    runGit('reset', '--quiet', '--soft', 'HEAD~1');
+    expect(fs.existsSync(path.join(repoPath, 'docs/readme.md'))).toBe(false);
+
+    await expectStagedObjectsAsync('docs/readme.md');
+  });
+
+  it('uses the staged object of a deleted file that the index marks "assume unchanged"', async () => {
+    writeFile('a.txt', 'staged\n');
+    runGit('add', 'a.txt');
+    runGit('update-index', '--assume-unchanged', 'a.txt');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+
+    await expectStagedObjectsAsync('a.txt');
+  });
+
+  it('uses the staged object of a deleted file that the index marks "skip worktree"', async () => {
+    writeFile('a.txt', 'staged\n');
+    runGit('add', 'a.txt');
+    runGit('update-index', '--skip-worktree', 'a.txt');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+
+    await expectStagedObjectsAsync('a.txt');
+  });
+
+  it('uses the staged object of a staged file that is on disk', async () => {
+    writeFile('a.txt', 'staged\n');
+    writeFile('b.txt', 'added\n');
+    runGit('add', 'a.txt', 'b.txt');
+
+    await expectStagedObjectsAsync('a.txt', 'b.txt');
+  });
+
+  it('uses the staged object of an "assume unchanged" file that changed on disk after it was staged', async () => {
+    writeFile('a.txt', 'staged\n');
+    runGit('add', 'a.txt');
+    runGit('update-index', '--assume-unchanged', 'a.txt');
+    writeFile('a.txt', 'changed after it was staged\n');
+    expect(runGit('hash-object', '--', 'a.txt').trim()).not.toEqual(getStagedObject('a.txt'));
+
+    await expectStagedObjectsAsync('a.txt');
+  });
+
+  itUnlessWindows('keeps a staged symbolic link in symlinks, with its staged object', async () => {
+    createSymbolicLink('a.txt', 'link');
+    runGit('add', 'link');
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.symlinks.get('link')).toEqual(getStagedObject('link'));
+    expect(state.files.has('link')).toBe(false);
+  });
+
+  itUnlessWindows('hashes the text of an untracked symbolic link whose target is missing', async () => {
+    createSymbolicLink('missing.txt', 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itUnlessWindows('hashes the text of an untracked symbolic link to a folder', async () => {
+    writeFile('folder/b.txt', 'b\n');
+    commit();
+    createSymbolicLink('folder', 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itUnlessWindows(
+    'hashes the text of a symbolic link, whose target is missing, that replaced a tracked file',
+    async () => {
+      fs.unlinkSync(path.join(repoPath, 'a.txt'));
+      createSymbolicLink('missing.txt', 'a.txt');
+
+      await expectLinkTextObjectAsync('a.txt');
+    }
+  );
+
+  itUnlessWindows('hashes the text of a symbolic link that points to itself', async () => {
+    createSymbolicLink('link', 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itOnLinux('hashes the text of a symbolic link to a named pipe', async () => {
+    const pipePath: string = path.join(testFolderPath, 'pipe');
+    execFileSync('mkfifo', [pipePath]);
+    createSymbolicLink('../pipe', 'link');
+    // Reading the pipe waits for a writer. Open the pipe for writing from time to time, without waiting for a reader,
+    // so that a reader reads nothing instead of waiting forever.
+    const interval: NodeJS.Timeout = setInterval(() => {
+      try {
+        // eslint-disable-next-line no-bitwise
+        fs.closeSync(fs.openSync(pipePath, fs.constants.O_WRONLY | fs.constants.O_NONBLOCK));
+      } catch {
+        // Nothing is reading the pipe
+      }
+    }, PIPE_OPEN_INTERVAL_MS);
+    try {
+      await expectLinkTextObjectAsync('link');
+    } finally {
+      clearInterval(interval);
+    }
+  });
+
+  itOnLinux('hashes the bytes of a symbolic link whose text is not UTF-8', async () => {
+    createSymbolicLink(Buffer.concat([Buffer.from('missing-'), Buffer.from([0xff]), Buffer.from('.txt')]), 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itUnlessWindows(
+    'hashes the text of an additional path that is a symbolic link whose target is missing',
+    async () => {
+      writeFile('.gitignore', 'ignored/\n');
+      commit();
+      fs.mkdirSync(path.join(repoPath, 'ignored'));
+      createSymbolicLink('missing.txt', 'ignored/link');
+
+      await expectLinkTextObjectAsync('ignored/link', ['ignored/link']);
+    }
+  );
+
+  itUnlessWindows('still hashes an untracked symbolic link to a file through to the file', async () => {
+    createSymbolicLink('a.txt', 'link');
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('link')).toEqual(getStagedObject('a.txt'));
+    expect(state.symlinks.has('link')).toBe(false);
+  });
+
+  itUnlessWindows('keeps the same order of paths in both implementations', async () => {
+    writeFile('.gitignore', 'ignored/\n');
+    commit();
+    createSymbolicLink('missing.txt', 'a-link');
+    writeFile('b.txt', 'b\n');
+    writeFile('ignored/y.txt', 'y\n');
+    createSymbolicLink('missing.txt', 'ignored/z-link');
+
+    const newPaths: string[] = ['ignored/z-link', 'ignored/y.txt', 'a-link', 'b.txt'];
+    const state: IDetailedRepoState = await getStateAsync(['ignored/z-link', 'ignored/y.txt']);
+    expect(Array.from(state.files.keys())).toEqual(['.gitignore', 'a.txt', ...newPaths]);
+    for (const newPath of newPaths) {
+      expect(state.files.get(newPath)).toEqual(addAndGetStagedObject(newPath));
+    }
+  });
+
+  itUnlessWindows('still drops a tracked symbolic link that changed', async () => {
+    createSymbolicLink('a.txt', 'link');
+    commit();
+    fs.unlinkSync(path.join(repoPath, 'link'));
+    createSymbolicLink('missing.txt', 'link');
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.hasUncommittedChanges).toBe(true);
+    expect(state.files.has('link')).toBe(false);
+    expect(state.symlinks.has('link')).toBe(false);
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/getRepoDeps.test.ts b/libraries/package-deps-hash/src/test/getRepoDeps.test.ts
index c78e034386b..2694e2dbe63 100644
--- a/libraries/package-deps-hash/src/test/getRepoDeps.test.ts
+++ b/libraries/package-deps-hash/src/test/getRepoDeps.test.ts
@@ -2,7 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
-import { execSync, type SpawnSyncReturns } from 'node:child_process';
+import { execSync, type ChildProcess, type SpawnSyncReturns } from 'node:child_process';
 
 import {
   getDetailedRepoStateAsync,
@@ -12,7 +12,7 @@ import {
   parseGitHashObject
 } from '../getRepoState';
 
-import { Executable, FileSystem } from '@rushstack/node-core-library';
+import { Executable, FileSystem, type IExecutableSpawnOptions } from '@rushstack/node-core-library';
 
 const SOURCE_PATH: string = path
   .join(__dirname)
@@ -326,4 +326,76 @@ describe(getDetailedRepoStateAsync.name, () => {
       FileSystem.deleteFile(tempFilePath1);
     }
   });
+
+  it('rejects when git hash-object fails, without waiting for git ls-files and git status', async () => {
+    // `git hash-object` fails fast on an additional path that does not exist. Its promise used to be awaited only
+    // after `git ls-files` and `git status` finished, so until then its rejection had no handler. Under Node's
+    // default `--unhandled-rejections=throw`, that ended the process (a Rush daemon, in the reported crash).
+    //
+    // To make the ordering deterministic, the 'close' events of ls-files and status are held back until the end.
+    let releaseHeldProcesses: () => void = () => {};
+    const heldProcessesReleased: Promise<void> = new Promise((resolve) => {
+      releaseHeldProcesses = resolve;
+    });
+    let onHashObjectClosed: () => void = () => {};
+    const hashObjectClosed: Promise<void> = new Promise((resolve) => {
+      onHashObjectClosed = resolve;
+    });
+
+    const spawn: typeof Executable.spawn = Executable.spawn.bind(Executable);
+    const spawnSpy: jest.SpyInstance = jest
+      .spyOn(Executable, 'spawn')
+      .mockImplementation(
+        (filename: string, args: string[], options?: IExecutableSpawnOptions): ChildProcess => {
+          const childProcess: ChildProcess = spawn(filename, args, options);
+          const emit: ChildProcess['emit'] = childProcess.emit.bind(childProcess);
+          const isHashObject: boolean = args.includes('hash-object');
+          childProcess.emit = ((eventName: string | symbol, ...eventArgs: unknown[]): boolean => {
+            if (eventName === 'close' && !isHashObject) {
+              void heldProcessesReleased.then(() => emit(eventName, ...eventArgs));
+              return true;
+            }
+            const hadListeners: boolean = emit(eventName, ...eventArgs);
+            if (eventName === 'close') {
+              onHashObjectClosed();
+            }
+            return hadListeners;
+          }) as ChildProcess['emit'];
+          return childProcess;
+        }
+      );
+
+    let outcome: { error: unknown } | undefined;
+    const settled: Promise<void> = getDetailedRepoStateAsync(
+      SOURCE_PATH,
+      [`${TEST_PREFIX}testProject/does-not-exist.txt`],
+      undefined,
+      FILTERS
+    ).then(
+      () => {
+        outcome = { error: undefined };
+      },
+      (error: unknown) => {
+        outcome = { error };
+      }
+    );
+
+    try {
+      await hashObjectClosed;
+      // Every step from the hash-object exit to the rejection runs as a microtask, so one macrotask is enough.
+      await new Promise<void>((resolve) => setImmediate(resolve));
+
+      expect(spawnSpy).toHaveBeenCalledTimes(3);
+      // Before the fix, the promise was still pending at this point.
+      expect(outcome).toEqual({
+        error: expect.objectContaining({
+          message: expect.stringMatching(/^git hash-object exited with code 128:[\s\S]*does-not-exist\.txt/)
+        })
+      });
+    } finally {
+      releaseHeldProcesses();
+      await settled;
+      spawnSpy.mockRestore();
+    }
+  });
 });
diff --git a/libraries/package-deps-hash/src/test/getRepoState.test.ts b/libraries/package-deps-hash/src/test/getRepoState.test.ts
index 573657feb36..96cfec43581 100644
--- a/libraries/package-deps-hash/src/test/getRepoState.test.ts
+++ b/libraries/package-deps-hash/src/test/getRepoState.test.ts
@@ -1,7 +1,13 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { isWindowsReservedPath, parseGitStatus, parseGitVersion } from '../getRepoState';
+import {
+  classifyLocallyModifiedFiles,
+  type GitStatusKind,
+  isWindowsReservedPath,
+  parseGitStatus,
+  parseGitVersion
+} from '../getRepoState';
 
 describe(parseGitVersion.name, () => {
   it('Can parse valid git version responses', () => {
@@ -40,51 +46,55 @@ describe(parseGitVersion.name, () => {
 
 describe(parseGitStatus.name, () => {
   it('Finds index entries', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [`A  ${files[0]}`, `D  ${files[1]}`, `M  ${files[2]}`, ''].join('\0');
+    const input: string = [`A  A.ts`, `D  B.ts`, `M  C.ts`, `T  D.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(true);
-    expect(result.get(files[1])).toEqual(false);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'indexOnly'],
+      ['B.ts', 'deleted'],
+      ['C.ts', 'indexOnly'],
+      ['D.ts', 'indexOnly']
+    ]);
   });
 
   it('Finds working tree entries', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [` A ${files[0]}`, ` D ${files[1]}`, ` M ${files[2]}`, ''].join('\0');
+    const input: string = [` A A.ts`, ` D B.ts`, ` M C.ts`, ` T D.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(true);
-    expect(result.get(files[1])).toEqual(false);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'workingTree'],
+      ['B.ts', 'deleted'],
+      ['C.ts', 'workingTree'],
+      ['D.ts', 'workingTree']
+    ]);
   });
 
   it('Can handle untracked files', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [`?? ${files[0]}`, `?? ${files[1]}`, `?? ${files[2]}`, ''].join('\0');
+    const input: string = [`?? A.ts`, `?? B.ts`, `?? C.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(true);
-    expect(result.get(files[1])).toEqual(true);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'workingTree'],
+      ['B.ts', 'workingTree'],
+      ['C.ts', 'workingTree']
+    ]);
   });
 
   it('Can handle files modified in both index and working tree', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [`D  ${files[0]}`, `AD ${files[1]}`, `DA ${files[2]}`, ''].join('\0');
+    const input: string = [`D  A.ts`, `AD B.ts`, `DA C.ts`, `MM D.ts`, `UU E.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(false);
-    expect(result.get(files[1])).toEqual(false);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'deleted'],
+      ['B.ts', 'deleted'],
+      ['C.ts', 'workingTree'],
+      ['D.ts', 'workingTree'],
+      ['E.ts', 'workingTree']
+    ]);
   });
 });
 
@@ -116,3 +126,57 @@ describe(isWindowsReservedPath.name, () => {
     expect(isWindowsReservedPath('packages/nul-suffix/index.ts')).toBe(false);
   });
 });
+
+describe(classifyLocallyModifiedFiles.name, () => {
+  const platformDescriptor: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+
+  // "nul" is a reserved name on Windows
+  const locallyModified: ReadonlyMap<string, GitStatusKind> = new Map<string, GitStatusKind>([
+    ['modified.txt', 'workingTree'],
+    ['deleted.txt', 'deleted'],
+    ['link', 'workingTree'],
+    ['deleted-link', 'deleted'],
+    ['apps/nul', 'workingTree'],
+    ['apps/con.txt', 'deleted'],
+    ['staged.txt', 'indexOnly'],
+    ['staged-link', 'indexOnly']
+  ]);
+  const symlinks: ReadonlyMap<string, string> = new Map([
+    ['link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391'],
+    ['deleted-link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391'],
+    ['staged-link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391']
+  ]);
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', platformDescriptor);
+  });
+
+  it('hashes the files that exist, and removes the deleted files and the symbolic links', () => {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: 'linux' });
+    expect(classifyLocallyModifiedFiles(locallyModified, symlinks)).toEqual({
+      filesToHash: ['modified.txt', 'apps/nul'],
+      filesToRemove: ['deleted.txt', 'link', 'deleted-link', 'apps/con.txt']
+    });
+  });
+
+  it('neither hashes nor removes a file with a reserved name on Windows', () => {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: 'win32' });
+    expect(classifyLocallyModifiedFiles(locallyModified, symlinks)).toEqual({
+      filesToHash: ['modified.txt'],
+      filesToRemove: ['deleted.txt', 'link', 'deleted-link', 'apps/con.txt']
+    });
+  });
+
+  it('neither hashes nor removes a path whose working tree column is blank', () => {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: 'linux' });
+    const { filesToHash, filesToRemove } = classifyLocallyModifiedFiles(
+      new Map<string, GitStatusKind>([
+        ['staged.txt', 'indexOnly'],
+        ['staged-link', 'indexOnly']
+      ]),
+      symlinks
+    );
+    expect(filesToHash).toEqual([]);
+    expect(filesToRemove).toEqual([]);
+  });
+});
diff --git a/libraries/rig-package/src/RigConfig.ts b/libraries/rig-package/src/RigConfig.ts
index e3b5e928477..a92075dc984 100644
--- a/libraries/rig-package/src/RigConfig.ts
+++ b/libraries/rig-package/src/RigConfig.ts
@@ -532,7 +532,7 @@ function _validateSchema(json: IRigConfigJson): void {
 
   if (!_rigNameRegExp.test(json.rigPackageName)) {
     throw new Error(
-      `The "rigPackageName" value is missing the "-rig" suffix: ` + JSON.stringify(json.rigProfile)
+      `The "rigPackageName" value is missing the "-rig" suffix: ` + JSON.stringify(json.rigPackageName)
     );
   }
 
diff --git a/libraries/rig-package/src/test/RigConfig.test.ts b/libraries/rig-package/src/test/RigConfig.test.ts
index 0e1edd227f1..36c785ecb5f 100644
--- a/libraries/rig-package/src/test/RigConfig.test.ts
+++ b/libraries/rig-package/src/test/RigConfig.test.ts
@@ -151,6 +151,32 @@ describe(RigConfig.name, () => {
     });
   });
 
+  describe('reports a rigPackageName without the "-rig" suffix', () => {
+    it('synchronously', () => {
+      expect(() =>
+        RigConfig.loadForProjectFolder({
+          projectFolderPath: testProjectFolder,
+          overrideRigJsonObject: {
+            rigPackageName: 'example-package',
+            rigProfile: 'web-app'
+          }
+        })
+      ).toThrow('The "rigPackageName" value is missing the "-rig" suffix: "example-package"');
+    });
+
+    it('asynchronously', async () => {
+      await expect(
+        RigConfig.loadForProjectFolderAsync({
+          projectFolderPath: testProjectFolder,
+          overrideRigJsonObject: {
+            rigPackageName: 'example-package',
+            rigProfile: 'web-app'
+          }
+        })
+      ).rejects.toThrow('The "rigPackageName" value is missing the "-rig" suffix: "example-package"');
+    });
+  });
+
   describe('resolves a config file path', () => {
     it('synchronously', () => {
       const rigConfig: RigConfig = RigConfig.loadForProjectFolder({
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 4dced7838c8..ab11ca63094 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -12,7 +12,9 @@ This package has no
 capabilities and admission settings before startup. `DaemonClient.connectAsync()`
 negotiates hello, subscribes capabilities, and awaits a matching pong.
 `executeAsync()` uses one fresh connection per invocation and closes it after the
-authoritative result. Async stdout/stderr/event callbacks are awaited in wire order,
+authoritative result. On POSIX, a request to a peer before 0.12 leaves out `XDG_RUNTIME_DIR`,
+`TMPDIR`, `TMP` and `TEMP`, because such a daemon restarts into the runtime folder they name,
+where current clients never look; its operations see the daemon's own values. Async stdout/stderr/event callbacks are awaited in wire order,
 so slow destinations backpressure the transport. Log callbacks receive raw bytes
 and the protocol's operation ID. The calling client owns terminal presentation.
 
@@ -28,10 +30,24 @@ never reasons to replay possibly executed work. Only pre-execution `unsupported`
 acknowledged only after applying them. Input listeners and raw state are restored
 on success, cancellation, disconnect and failure. No resize messages are sent.
 
+The optional `liveness` check tells a caller that the daemon stopped responding while its request runs, for
+example because the daemon's process was stopped. Once the daemon has sent nothing for 10 s (by default), the
+client pings it, with one ping at a time, and asks it to leave the warm set out of the reply, which only has
+to arrive. Once it has sent nothing for 30 s, not even the reply,
+`onUnresponsive` is called with its PID, and `onResponsive` follows if it sends anything again. Time that the
+client spends in its own callbacks does not count, nor does a stall of the client's event loop, for example
+while the client's process was stopped. The check stops when the client asks the daemon to cancel the
+request. It requires 0.13: an older daemon that received a ping while it closed the connection could send a
+protocol error ahead of the request's result.
+
 `executeWithDaemonRestartAsync(readyClient, connectionOptions, executionOptions)`
 retries an explicit `retryAfterRestart: true` result a bounded number of times. Before
 each hand-off it captures the endpoint's PID/start identity, requires protocol 0.10,
 waits for that ownership to be released, and reconnects through the same startup mutex.
+The restarting daemon launches the successor it selected after that release, so while
+its process lives the client only connects: starting a daemon itself could win the
+startup mutex with the client's own environment instead of the one the restart was for.
+It starts one only if that process exits without a ready successor.
 Retries after the first use jittered backoff, and the backoff, the successor hand-off
 and the resubmitted request all share the request's admission deadline.
 The original immutable request and unread input are preserved. Output, events,
@@ -40,55 +56,212 @@ error messages. When the retry bound or the admission deadline is exhausted, it
 returns a `restartRetriesExhausted` fallback outcome so the caller can run in-process.
 Cancellation stops waiting without killing a daemon. Disabling auto-start still
 permits waiting for a host-started successor, but never lets the client spawn one.
+A result may say why the daemon restarts (`restartReason`); for `installationChanged`,
+the daemon's installation was removed or replaced, so it exits without a successor and
+the client's own `startCommand` starts one. Such a daemon answers only once the requests
+ahead of the request finish; meanwhile `onQueuePositionAsync` gets the reason as its second
+argument. It does so for each request that waits for a restart, with the wait's details as its
+third argument: `scriptCount`, how many of the requests ahead run a rushx script, and
+`restartsForAnotherRequest`, set for a rushx script that waits for another request's restart.
+`formatDaemonRestartCause` words a reason as the end of "the daemon restarts ...", for the
+request or for such a script, and `onInputAdmittedAsync` reports when the daemon first admits
+the request's input, which for a rushx script is when the script starts. While the request
+waits for a Rush process that the daemon does not run to release the repository's lock,
+`onQueuePositionAsync` gets that process as its fourth argument (`nativeLockHolder`).
+While it waits only for operations that earlier requests left running after their result, such as
+those of a failed build that returned early, it gets them as its fifth argument
+(`continuingOperations`: how many there are, and the first three names), and the daemon reports
+the position again each time that number gets smaller.
+`findNativeLockHolder` finds it the way the daemon does, from the `rush#<pid>.lock` files in the
+common temp folder: on Linux, the live process with the oldest one, and its program and action
+from `/proc`, such as `rush install`, never its other arguments; elsewhere, nothing.
+`formatNativeLockHolder` words it, for example `another Rush process (PID 12345: rush install)`. On Linux, it also
+reads that process's state, and says when it is stopped, for example `another Rush process (PID 12345: rush install;
+it is stopped (state T), for example by SIGSTOP)`, since a stopped process cannot release the lock. After each hand-off
+to a ready successor, the optional `onRestartAsync` callback gets the restart number, the
+reason (`undefined` when the daemon gave none, as older daemons do) and the successor's PID,
+before the request is resubmitted.
+
+If the daemon exits while the request waits in its queue, the request has not run when
+`DaemonClient.queuedWithoutStarting` is true: the daemon reported a queue position and says
+when it starts a request (protocol 0.14), but has not said so, no output, event, terminal
+control or stdin admission arrived, and the client did not ask it to cancel. Before the
+client fails the request for a closed connection, it handles the frames that it had received
+by then, so a `requestStarted` that arrived just before the daemon exited still counts. A
+connection that closed without reading everything that the daemon sent (see
+`DaemonFrameConnection.closedAfterReadingAll`), for example one that reset while a frame
+waited unread, makes `queuedWithoutStarting` false too, because that frame may have said that
+the request started. When it is true, `executeWithDaemonRestartAsync()` sends the request to
+a new daemon, started as
+`connectOrStartDaemonAsync()` would after the exited daemon is reclaimed (see below), once per
+call and within the request's admission deadline. Before that daemon starts, `onRestartAsync`
+gets the exited daemon's PID as `exitedPid`, with no `successorPid`. The request is not sent
+again if the connection cannot start a daemon or the admission deadline has passed. Each
+client that waited sends its own request, so the requests reach the new daemon in the order
+in which their clients noticed the exit, not in the order of the exited daemon's queue; two
+requests that each needed the workspace to themselves may run in the other order.
+
+A connection lost before the result stays a `disconnected` `DaemonClientError`. Its message
+starts with "Daemon disconnected before delivering a result; the command was not retried."
+and `executeWithDaemonRestartAsync()` appends what happened to the daemon that served the
+attempt, identified by its pong PID. If that process exited within about a second (on Linux,
+an exited process that is not reaped yet counts), the message names the PID, `rush-client
+daemon logs` and `--no-daemon` (`rushx-client` for Rushx requests), and adds a second line
+with the first fatal error that `<lockfilePath>.log` gained after the request was sent: a
+Node.js uncaught-exception report or a V8 `FATAL ERROR:` line, clipped to one printable line.
+Before it returns that error, it reclaims the exited daemon as the next daemon start would, so
+that on Linux, running the command again, with or without the daemon, does not race the operations
+the daemon left running. While the ownership record names that process, it takes the start mutex
+and, unless a startup is reserved, calls `reclaimStaleDaemonAsync()`, which removes the ownership
+record and socket. On Linux, it first terminates the orphaned operation process groups (and those
+that other dead daemons recorded but that no ownership record names any more). Where `/proc` shows
+that every process left in a
+group has exited but is not reaped yet (a zombie), the group counts as stopped, because no signal
+can end it. Each set of groups that it stops is
+passed to the connection's optional `onOrphansReaped(reap)` (the daemon's PID, the process groups,
+and whether they were `terminated` or `killed`), so that the caller can say so in its own words;
+without it, each is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. A recorded operation
+group that the reclaim cannot prove still runs an operation of the daemon gets no signal; when it still
+has a live process, the client appends a line to the launcher log that names the group and the daemon
+and says which check the group failed, and reports nothing else about it. The reclaim before
+a daemon start reports the same way. It waits up to 5 seconds while another client holds the start
+mutex, and up to 1 second while the exited process is not reaped yet: its parent, usually init or a
+subreaper, reaps it at once, and one that has not by then may never do so. If the reclaim fails or
+times out, the message is the same, and the next daemon start reclaims the daemon instead.
+If the process still runs, the message says that only the connection closed. After the abort
+signal fires, the error is unchanged, so the caller reports the cancellation.
+A request that waited in the queue of the daemon that exited is instead sent to a new daemon
+(see above). If it cannot be, the message says that the daemon exited while the command was
+queued. If the connection to the new daemon is lost too, the message starts with "Daemon
+disconnected before delivering a result; the command was already sent to a new daemon once."
 
 `connectOrStartDaemonAsync()` accepts an **explicit, version-selected** executable,
 arguments, environment and cwd. It does not discover or install a Rush version.
+It adds `RUSHD_RUNTIME_DIR`, set to the base of `paths.runtimeDir`, to that environment, so the
+daemon resolves the same paths as its clients whatever environment it inherits.
+A runtime folder that is a symbolic link, is not a directory or belongs to another user, or
+whose socket path is too long for a socket address (from a long `RUSHD_RUNTIME_DIR`), is
+refused as `startupFailed` before anything in it is trusted or created
+(`assertDaemonRuntimeFolderIsPrivate()`); one that others can open is made owner-only.
 It reuses transport paths/reclaim checks and node-core-library's process-identity
 aware `LockFile` for the first-start mutex, including kernel-enforced exclusive
 file sharing on Windows. The winning client rechecks readiness,
-reclaims only an absent/dead owner, and reserves `<lockfilePath>.starting` before
-handing the explicit command to a detached startup helper. The helper spawns without
-a shell and holds that reservation until the daemon completes hello/ping readiness,
-independently of whether the requesting client survives. Clients still await
-hello/pong under bounded backoff. Stdout/stderr go to `<lockfilePath>.log`. No PID
-is killed. While holding the mutex with no startup reservation, stale leftovers are
-reclaimed only when provably safe: a socket without an ownership record, or a corrupt
+reclaims only an absent/dead owner, spawns a detached startup helper, and reserves
+`<lockfilePath>.starting` for it (recording the helper's PID and start time) before
+handing it the explicit command. The helper spawns the launcher without
+a shell and retains that reservation until the daemon completes hello/ping readiness,
+independently of whether the requesting client survives. It tries to connect every 50 ms, so it
+releases the reservation within about 50 ms of the daemon's readiness. On Linux, the helper first
+closes the file descriptors that it inherited without close-on-exec, other than its IPC channel, so
+that the daemon does not hold them for as long as it runs: for example the pipe of a bash process
+substitution (`rush-client build 2> >(sed …)`), whose reader would otherwise wait for the daemon to
+exit, or a lock file that a script opened. On other platforms it closes nothing. A daemon that a
+client from an earlier release started still holds what it inherited. If the daemon is from an
+earlier release too, so does the successor that it starts when it restarts itself (after an
+environment change, for example), because it starts that successor through its own helper. The
+helper waits for a live launcher for
+at least 120 seconds, even when the requesting client's own deadline is shorter, so a slow
+first start (for example while Windows scans newly installed files) is still handed off to
+later clients instead of leaving an abandoned reservation. The starting client holds the start
+mutex, so it keeps a connection only after its helper releases the reservation, which the helper
+does just before it exits; it therefore retries as soon as its helper exits, not at the end of a
+backoff step. A client that waits for another client's start drops each connection while the
+reservation remains, so it checks the reservation every 25 milliseconds and retries as soon as it
+is released. Otherwise clients await hello/pong with a backoff that doubles from 50 to 500
+milliseconds. Stdout/stderr go to `<lockfilePath>.log`. No PID
+is killed. While holding the mutex with no startup reservation (or after taking over an
+abandoned one, see below), stale leftovers are reclaimed only when provably safe: a socket without an ownership record, or a corrupt
 record, once a connection attempt is refused (no listener exists); and, on Linux, a
 record whose PID now belongs to a process that started after the record's `startedAt`
-(PID reuse, detected from `/proc`). Any other live PID with an unreachable socket fails
-closed, pointing to `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`),
-which removes the record, socket and reservation after the same no-listener/no-live-owner checks.
+(PID reuse, detected from `/proc`). Once that record is gone, nothing names the operations that the
+owner left running, so before it removes the record it stops the operation process groups that the
+owner recorded (`reapReusedOwnerOperationGroupsAsync()`), with the proof of each group that
+`reclaimStaleDaemonAsync()` requires, but never the process group whose ID is the recorded PID, which
+the later process may lead. Each recorded group that it leaves running gets a line in the launcher log,
+as above. If they cannot be stopped, the start fails and removes nothing.
+Any other live PID with an unreachable socket fails
+closed, and never signals that process. The error says on its first line what that process is doing and
+on its last line what to do about it. On Linux the first line comes from `/proc`: whether the process
+looks like a Rush daemon (else its command line), its state (for example `it is stopped (state T), for
+example by SIGSTOP`), whether its socket is missing, and when it started. The last line, for example, says
+to resume a stopped daemon with `kill -CONT <pid>`, or to delete the record of a process that is not a
+Rush daemon. It names a signal to send only to a Rush daemon that has this workspace's ownership record
+open (from the links in `/proc/<pid>/fd`), as the daemon that wrote the record does for as long as it
+owns it, also after its socket file is deleted: the recorded PID could otherwise belong to another
+process, such as another workspace's daemon, which has only its own record open. For any other
+process, and outside Linux, it says to end that process if it is this workspace's daemon, and else to
+delete the record, and that until then each command that uses the daemon first waits 15 s (the default
+startup deadline) for a daemon to answer. For a process that has exited but is not reaped yet (state Z),
+it names the parent that has not reaped it, says that the next command reclaims the daemon's files once
+that parent does, and says the same about the 15 s. A starting client waits for a live owner until its deadline, with one exception on Linux:
+when the recorded owner has the record open, as above, and every sample of its state over 1.5 s (one
+every 100 ms) reads stopped, by a signal (T) or a tracer (t), with the same start time, the client fails
+with that error once the 1.5 s have passed. Until something resumes that process, it cannot answer. The
+client samples it while its first connection attempt runs, and not at all when less than 1.5 s remains
+before its deadline. A shorter stop, such as Ctrl+Z and then `fg`, only delays the start, as before.
+`describeLiveDaemonOwner(paths, purpose)` returns the same two lines for the live process
+that the record names (`purpose` is `use` or `stop`), or `undefined` when there is none.
+`isDaemonOwnerStoppedAsync(paths, deadline)` samples that process in the same way, and resolves `true`
+only when it has the record open and stays stopped for the 1.5 s; `rush-client daemon stop` uses it to
+stop waiting for such a daemon to exit.
+`resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`) removes the record, socket and
+reservation after the same no-listener/no-live-owner checks, so it refuses while that process runs, and
+says the same.
+On Linux, when the recorded PID no longer exists, the reset first stops the operations that the owner
+left running, as `reclaimStaleDaemonAsync()` does before the next start; when a process that started later
+has it, the reset stops the recorded operation process groups as the start does. Both report what they
+stop to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings), and each recorded
+group that they leave running to `options.onOperationGroupLeftRunning` (or else to a line in the launcher
+log). The reset removes nothing when they cannot be stopped, and it never signals a process otherwise.
+The reset stats the socket with `{ bigint: true }`. After a plain stat of a socket, a `require()` in the
+same process, made while the reset awaits the reclaim, would not resolve symlinks.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
-readiness. The explicit launcher's cwd is unchanged.
-
-The startup reservation is bounded and verifiable. It is a JSON record of its token,
-creation time, startup timeout, the process responsible for releasing it (the starting
-client until the helper is spawned, then the helper, with its start time) and the
-launcher PID once spawned. The reservation is released when:
-
-- the daemon completes hello/ping readiness (by the helper);
-- no executable could be started, or the launcher the helper started exits before
-  publishing an endpoint (by the helper). The client reports this immediately with the
-  last lines of `<lockfilePath>.log`, such as the launcher's own error;
-- any client finds a ready endpoint whose published ownership record matches the
-  hello/ping status while the reservation's owner is gone. Such an endpoint is used even
-  while a reservation exists; a live helper releases its own reservation;
-- a client holding the first-start mutex finds it stale: neither its owner nor its
-  launcher is alive, or it has outlived its own startup timeout by a fixed 60-second
-  grace period (this bounds PID reuse and a wedged launcher). Unrecognized records, such
-  as token-only reservations from older clients, have no verifiable owner and become
-  stale by file age. A stale reservation is reclaimed without waiting for the deadline.
-
-Every check-then-write of the reservation (owner/launcher updates, release, stale
-reclaim, and cleanup after a dead owner) holds a short `<lockfile>-reservation` lock,
-so a resumed stale owner can never overwrite or remove a replacement reservation.
-
-Otherwise, a live reservation makes later starts wait for readiness, then fail with the
-reservation's owner/launcher state instead of launching a second daemon. A launcher that
-misses the deadline but later binds is still accepted. If a stale reservation is
-reclaimed while an old launcher is merely suspended, the transport's bind-time ownership
-check still rejects whichever daemon binds second, so one workspace never has two
-serving daemons. Cancellation stops the client waiting, not the detached handoff.
+readiness. The explicit launcher's cwd is unchanged. If the daemon exits after its helper saw it ready
+but before the starting client connected, for example because `rush-client daemon stop` stopped it,
+the client fails with `startupFailed` at once instead of at its deadline: the helper has exited 0, and
+neither an ownership record nor a startup reservation remains.
+
+While its helper runs before its recorded readiness deadline plus a 60-second grace period,
+a startup reservation is never taken over, however long startup takes. Only a known spawn failure
+(no executable started) releases the reservation
+immediately. If the helper cannot establish readiness (its launcher exited, or it timed
+out), it exits and leaves the reservation. The starting client's error then quotes up to three
+lines that `<lockfilePath>.log` gained during that attempt, preferring error lines, such as the
+launcher's own error. An arbitrary launcher can spawn descendants, so
+neither exit proves that no daemon can still publish an endpoint. A reservation whose helper
+is provably gone is therefore taken over only once its relaunch time has passed (15 seconds
+after the helper was launched) and while nothing listens at the endpoint; the starting client
+logs that it took the reservation over and launches the daemon again. This is safe even if a
+daemon of the gone helper is still starting: a daemon listens before it publishes the endpoint,
+publishes it only with link(2) (or as the first instance of a named pipe), and reclaims it
+only from a dead owner that does not accept a connection. So of two such daemons, the one
+that publishes second finds the other and exits, and the readiness of either releases the new
+reservation. Before the relaunch time, clients refuse another launch at once, so that a
+daemon that fails the same way each time (for example because of a configuration error) is
+not launched by every client, and their callers can run without it. Normal successful startup
+releases the reservation automatically. Cancellation stops the client waiting, not the
+detached handoff.
+
+A client resolves a reservation on the same evidence the helper waits for, so a daemon
+that became ready after its helper stopped waiting (for example a first start slower than
+120 seconds) is still used: holding the start mutex, the client needs a daemon that
+completes hello/ping at the endpoint and whose pong PID is the live owner in the
+ownership record for that socket, and it removes the reservation only if it is unchanged.
+Reservations written by older clients, without a helper, are resolved the same way.
+The recorded helper decides how long a refused launch waits: while it is alive and within
+its readiness deadline plus grace period, a starting client waits for it until the client's
+own deadline; once it is provably gone (its PID no longer exists, was reused, is defunct on
+Linux, or is past that deadline plus grace), nothing else can release the reservation, so clients
+refuse another launch at once until the relaunch time, and then take the reservation over
+as described above (while something listens at the endpoint, they wait for it until their
+deadline instead). `inspectDaemonStartupReservation(paths)` reports the reservation, its
+helper's state and, once the helper exited, the relaunch time (`relaunchAfter`) without
+changing it (`rush-client daemon status`), and
+`requestDaemonShutdownAsync()` resolves a reservation for the attested daemon before it
+sends shutdown, so that its successor can start. `resolveDaemonStartupReservationAsync(client,
+paths)` does the same for a caller that stops the daemon without replacing it (`rush-client
+daemon stop`): it returns false and keeps the reservation when the daemon is not the attested
+owner, the reservation changed, or another client holds the start mutex past the timeout.
 
 If a wire-compatible daemon reports the wrong implementation version and an explicit
 replacement launcher is available, startup serializes replacement under that same mutex.
@@ -102,12 +275,70 @@ Socket resets and broken pipes during hello/ping readiness are retried within th
 a closing host may still retain its listener while joining owned resources. This applies only before
 `requestStart`; a connection failure after execution begins still never permits replay.
 
+`connectOrAwaitDaemonStartupAsync()` wraps `connectOrStartDaemonAsync()` for a caller that runs Rush
+in-process when no daemon is available, as the CLI client does. A `startupFailed` or `timeout` error
+alone does not make that safe while a live process can still make the daemon ready: a listener at the
+endpoint that did not complete hello/ping in time, a recorded startup helper that is still running, or
+another client that holds the start mutex. In-process Rush would take the repository lock that the
+daemon's requests need. The wrapper instead keeps connecting (and starting, through the same mutex and
+reservation) until one more startup deadline has passed. If the daemon is still not ready, it rejects
+with `DaemonStartupPendingError`, which is not a `DaemonClientError`: the message is the startup error
+followed by the process that is still live, and `cause` is that error. When the startup error is that
+the process that the ownership record names still runs but did not answer, the message instead leads
+with what that process is doing, says on the next line that Rush was not run in-process, and ends with
+what to do about it, as above. When that error comes from a
+stopped owner at the endpoint (see above), and the owner is still stopped, the wrapper rejects so without
+waiting for another deadline. When none remains, it rejects at
+once with the original `DaemonClientError`, for example when auto-start is disabled and nothing listens,
+or when the helper has exited. An ownership record alone does not count, because a daemon publishes it
+only after binding. The exception is a Rush daemon, named by the record, that still has that record open
+where no client can reach it, for example after its socket file was deleted (Linux only):
+it cannot become ready there, but in-process Rush would compete with it, so the wrapper rejects at once
+with `DaemonStartupPendingError`, whose message says what that daemon is doing, as above. Other errors,
+such as `versionMismatch`, pass through unchanged. Before it keeps
+waiting, it calls the optional `onAwaitStartup(owner, waitMs)` once, with the live process and the
+remaining wait, so that the caller can say why the command has not started yet.
+
+`connectToStartingDaemonAsync()` connects without starting anything, for a caller that must not leave
+a daemon running, such as `rush-client daemon stop`. One refused connection does not show that no daemon
+runs: while one of the same live processes can still make a daemon ready at the endpoint, it waits up
+to one startup deadline for that daemon and connects once it completes hello/ping, whatever its
+implementation version. It resolves `undefined` when nothing listens and none of those processes
+remains, and rejects with `DaemonStartupPendingError` when one is still live at the deadline. It calls
+`onAwaitStartup(owner, waitMs)` once before it waits.
+
+`reclaimCrashedDaemonAsync(paths)` is for a caller that is about to run Rush in-process, as the CLI
+client does for `--no-daemon` and for each fallback. A daemon that crashed or was killed while it ran
+a command leaves its operations running, and they could overwrite the in-process command's outputs.
+When the ownership record names a PID that no longer exists (on Linux, also an exited process that is
+not reaped yet), it reclaims that daemon as described above for a lost connection: under the start
+mutex, only when no startup is reserved, and waiting up to 5 seconds for the mutex and up to 1 second
+for the exited process to be reaped. It does nothing when there is no
+record, when a process with the recorded PID runs, or when the runtime folder is not private, and it
+never throws. Its optional `options.onOrphansReaped` receives what it stopped, as above, and its optional
+`options.onOperationGroupLeftRunning` receives each recorded group that it left running, instead of the
+launcher log.
+
 `getDaemonLogFilePath(paths)` is the shared stable path used by both the launcher
 and the CLI's local `daemon logs` reader. Child stdout/stderr are appended across
 restarts, including startup failures; the parent always closes its descriptor
 after spawn or failure. On POSIX the launcher enforces `0600` permissions on a
 regular, unshared, current-user-owned file and refuses symlink destinations.
-This is a text launcher log, not structured request observability.
+A log that it cannot open for writing, such as a symlink, a directory, a FIFO
+without a reader or a read-only file, rejects the start with a `startupFailed`
+error that names the log and the error code, as a log that fails those checks
+does, before anything is spawned. The client stats the log with
+`{ bigint: true }`: a plain stat of a FIFO would stop a later `require()` in the
+same process, such as by Rush run in-process, from resolving symlinks.
+This is a text launcher log, not structured request observability. A client that reclaims a daemon
+that exited without shutting down, after a lost connection or in `reclaimCrashedDaemonAsync()`,
+appends a line that names the daemon's PID to it, under the same file checks. Once the reclaim has
+removed the ownership record, `findReclaimedDaemonPid(paths)` returns that PID from the log's last
+64 KiB, unless a daemon wrote its `rushd ready at` line after it or `resetDaemonArtifactsAsync()`
+cleared the report with a line of its own; `rush-client daemon status` uses it. A reclaim that leaves a
+recorded operation group running appends a line such as `left process group 4242 running, which the
+exited daemon (PID 4000) recorded for an operation: the process with PID 4242 now is not the leader that
+the daemon recorded.`, which does not change what `findReclaimedDaemonPid` returns.
 
 `shutdownAsync()` requires a fresh connection with negotiated minor >= 6. It sends
 the existing `shutdown` control and resolves only after `shutdownAck` and EOF,
@@ -149,5 +380,6 @@ graph reference client. A successful handshake is still transport readiness, not
 guarantee that every command or configuration is supported. Version-selected daemon
 installation and incompatible-protocol replacement remain
 separate integration work; this core package does not construct an engine.
-The startup helper and bounded pre-bind reservation protect concurrent first-invocations
-even if the original client dies. They do not add a new daemon protocol.
+The startup helper and durable pre-bind reservation protect concurrent first-invocations
+even if the original client dies. They do not add a new daemon protocol or authorize
+automatic recovery of ambiguous launcher failures.
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 9cdc0e5b219..3c4de3c0949 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -6,9 +6,11 @@ import type { Readable } from 'node:stream';
 import {
   DAEMON_INPUT_LIFECYCLE_PROTOCOL_MINOR,
   DAEMON_INVOCATION_KIND_PROTOCOL_MINOR,
+  DAEMON_KEEPALIVE_PROTOCOL_MINOR,
   DAEMON_LIFECYCLE_PROTOCOL_MINOR,
   DAEMON_PROTOCOL_VERSION,
   DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR,
   DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR,
   DaemonFrameType,
   DaemonProtocolError,
@@ -18,10 +20,13 @@ import {
   encodeDaemonControlMessage,
   encodeDaemonStdinChunk,
   type DaemonControlMessage,
+  type DaemonRestartReason,
   type IDaemonClientCaps,
   type IDaemonCommandResult,
+  type IDaemonContinuingOperations,
   type IDaemonEventEnvelope,
   type IDaemonFrame,
+  type IDaemonNativeLockHolder,
   type IDaemonPongMessage,
   type IDaemonProtocolVersion,
   type IDaemonRequestEnvelope,
@@ -30,9 +35,14 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import { connectDaemonAsync, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
-import { DaemonClientError } from './DaemonClientError';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientError';
+import { adaptDaemonRequestToPeer } from './DaemonRequestEnvironment';
 
 const MAX_STDIN_CHUNK_BYTES: number = 64 * 1024;
+const DEFAULT_PING_AFTER_MS: number = 10_000;
+const DEFAULT_UNRESPONSIVE_AFTER_MS: number = 30_000;
+/** The liveness check looks at least this often, so that it reports a silent daemon at most this late. */
+const MAX_LIVENESS_CHECK_INTERVAL_MS: number = 1000;
 
 /** Options for a fresh connection; readiness includes both hello and ping. @beta */
 export interface IDaemonClientConnectOptions {
@@ -41,6 +51,30 @@ export interface IDaemonClientConnectOptions {
   readonly expectedDaemonVersion?: string;
   /** Deadline for connection and handshake, in milliseconds. Defaults to 5000. */
   readonly timeoutMs?: number;
+  /**
+   * Asks the daemon to leave its warm set out of the reply that proves the connection ready, which
+   * {@link DaemonClient.status} returns. The warm set names every retained, protected and watched project, so a
+   * client that doesn't report it should set this. Older daemons send it anyway. Defaults to false. The pings of
+   * the liveness check always ask to leave it out; see {@link IDaemonClientLivenessOptions}.
+   */
+  readonly omitWarmSetStatus?: boolean;
+}
+
+/**
+ * What a request that waits for a daemon restart waits for, as its queue position reports it. Older daemons omit
+ * these fields.
+ *
+ * @beta
+ */
+export interface IDaemonRestartWaitDetails {
+  /**
+   * How many of the requests that the queue position counts run a rushx script. Without a restart reason, the
+   * request waits for that many running rushx scripts to exit before it runs, because it restarts the daemon once
+   * it ends (a native `install` or `update`), which would end them.
+   */
+  readonly scriptCount?: number;
+  /** The request, a rushx script, waits for another request's restart rather than its own. */
+  readonly restartsForAnotherRequest?: boolean;
 }
 
 /** One request's backpressured destinations. Callback order is wire order. @beta */
@@ -49,7 +83,32 @@ export interface IDaemonClientExecuteOptions {
   readonly onStdoutAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
   readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
   readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
-  readonly onQueuePositionAsync?: (position: number) => Promise<void>;
+  /**
+   * Called with the request's one-based queue position whenever it changes, or when the daemon reports it again
+   * because what the request waits for changed. `restartReason` is set while the request waits for a daemon restart
+   * for that reason, and `restartWait` then says more about the wait. Without one, `restartWait.scriptCount` is set
+   * while the request waits for rushx scripts to exit, since it restarts the daemon once it ends.
+   */
+  readonly onQueuePositionAsync?: (
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails,
+    /**
+     * Set while the request waits for a Rush process that the daemon does not run to release the repository's lock,
+     * with what the daemon knows about that process.
+     */
+    nativeLockHolder?: IDaemonNativeLockHolder,
+    /**
+     * Set while the request waits only for the operations that an earlier failed command left running after its
+     * early result, with their count and up to three of their names, in name order.
+     */
+    continuingOperations?: IDaemonContinuingOperations
+  ) => Promise<void>;
+  /**
+   * Called once, when the daemon first admits the request's input. For a rushx script, that is when the script
+   * starts. Only daemons that negotiate the input lifecycle admit input.
+   */
+  readonly onInputAdmittedAsync?: () => Promise<void>;
   readonly abortSignal?: AbortSignal;
   /** Protocol 0.7 input waits for stdinReady credits; older peers use the legacy raw-mode/terminal policy. */
   readonly stdin?: Readable;
@@ -61,6 +120,58 @@ export interface IDaemonClientExecuteOptions {
   readonly cancelOnCtrlC?: boolean;
   /** Time allowed to finish cancellation. Defaults to 5000 milliseconds. */
   readonly cancellationTimeoutMs?: number;
+  /**
+   * Called once, synchronously, when the client asks the daemon to cancel the request: after `abortSignal` aborts,
+   * or on a raw Ctrl+C with `cancelOnCtrlC`. The daemon then has `timeoutMs` to deliver its final result; after
+   * that, the client disconnects without it. Not called for a request that was never sent.
+   */
+  readonly onCancelRequested?: (timeoutMs: number) => void;
+  /**
+   * Checks that the daemon still responds while the request runs. Daemons older than protocol 0.13 are not
+   * checked. The check stops when the client asks the daemon to cancel the request.
+   */
+  readonly liveness?: IDaemonClientLivenessOptions;
+}
+
+/**
+ * How long a daemon has sent nothing to a request's connection.
+ *
+ * @beta
+ */
+export interface IDaemonSilence {
+  /** The daemon's process ID, when it reported one. */
+  readonly pid: number | undefined;
+  /** How long the daemon has sent nothing, in milliseconds. */
+  readonly silentForMs: number;
+}
+
+/**
+ * A check that the daemon still responds while a request runs. Once the daemon has sent nothing for `pingAfterMs`,
+ * the client pings it, with one ping at a time, and asks it to leave the warm set out of the reply. Only time in
+ * which the client could read what the daemon sent counts: not time spent in the client's own callbacks, and not
+ * time in which the client's event loop stalled, for example while its process was stopped.
+ *
+ * @beta
+ */
+export interface IDaemonClientLivenessOptions {
+  /** Defaults to 10000 milliseconds. */
+  readonly pingAfterMs?: number;
+  /** Defaults to 30000 milliseconds. */
+  readonly unresponsiveAfterMs?: number;
+  /** Called once the daemon has sent nothing, not even the reply to a ping, for `unresponsiveAfterMs`. */
+  readonly onUnresponsive: (silence: IDaemonSilence) => void;
+  /** Called when the daemon sends something after `onUnresponsive`, with how long it had sent nothing. */
+  readonly onResponsive?: (silence: IDaemonSilence) => void;
+}
+
+/** A running liveness check; see {@link IDaemonClientLivenessOptions}. */
+interface ILivenessCheck {
+  readonly options: IDaemonClientLivenessOptions;
+  readonly pingAfterMs: number;
+  readonly unresponsiveAfterMs: number;
+  readonly intervalMs: number;
+  /** When the check last ran, as a `performance.now()` value. */
+  lastCheckAtMs: number;
 }
 
 /** Only explicit, pre-execution rejections permit in-process fallback. @beta */
@@ -115,6 +226,11 @@ export class DaemonClient {
   #observedExecution: boolean = false;
   #inputEnded: boolean = false;
   #supportsInputLifecycle: boolean = false;
+  #supportsRequestStarted: boolean = false;
+  #queued: boolean = false;
+  #requestStarted: boolean = false;
+  /** Whether the connection closed before the client read everything that the daemon sent. */
+  #closedBeforeReadingAll: boolean = false;
   #inputAcknowledgement: IDeferred<void> | undefined;
   #inputTail: Promise<void> = Promise.resolve();
   #rawModeChanged: boolean = false;
@@ -122,25 +238,39 @@ export class DaemonClient {
   #cancelTimer: ReturnType<typeof setTimeout> | undefined;
   #cancelSent: boolean = false;
   #wasInputPaused: boolean = true;
+  #daemonPid: number | undefined;
+  /** When the client last received a frame, or finished handling one, as a `performance.now()` value. */
+  #lastHeardAtMs: number = 0;
+  #frameInFlight: boolean = false;
+  /** The handling of the last frame that the transport handed over. */
+  #frameHandled: Promise<void> = Promise.resolve();
+  #livenessTimer: ReturnType<typeof setInterval> | undefined;
+  #pingPending: boolean = false;
+  #silenceReported: boolean = false;
 
   private constructor(connection: DaemonFrameConnection, options: IDaemonClientConnectOptions) {
     this.#connection = connection;
     this.#connectOptions = options;
-    connection.onFrame((frame) => this.#onFrameAsync(frame));
+    connection.onFrame((frame) => (this.#frameHandled = this.#receiveFrameAsync(frame)));
     connection.onClosed((error) => {
       if (this.#shutdown && this.#shutdownAcknowledged && !error) {
         this.#shutdown.resolve(undefined);
         return;
       }
-      this.#fail(
+      const lost: Error =
         error ??
-          new DaemonClientError(
-            'disconnected',
-            this.#shutdown
-              ? 'Daemon disconnected before acknowledging shutdown.'
-              : 'Daemon disconnected before delivering a result; the command was not retried.'
-          )
-      );
+        new DaemonClientError(
+          'disconnected',
+          this.#shutdown ? 'Daemon disconnected before acknowledging shutdown.' : DAEMON_DISCONNECTED_MESSAGE
+        );
+      // A frame that the close discarded may have said that the request left the queue.
+      this.#closedBeforeReadingAll = !connection.closedAfterReadingAll;
+      if (!this.queuedWithoutStarting) {
+        this.#fail(lost);
+        return;
+      }
+      // A frame that arrived before the close may still say that the request left the queue.
+      void this.#settleReceivedFramesAsync().then(() => this.#fail(lost));
     });
   }
 
@@ -178,7 +308,10 @@ export class DaemonClient {
     }
   }
 
-  /** The reply that proved this connection ready. */
+  /**
+   * The reply that proved this connection ready. It has no `workspace.warmSet` when the connection set
+   * {@link IDaemonClientConnectOptions.omitWarmSetStatus} and the daemon supports it.
+   */
   public get status(): Promise<IDaemonPongMessage['payload']> {
     return this.#ready.promise;
   }
@@ -188,6 +321,28 @@ export class DaemonClient {
     return this.#peerProtocolVersion!;
   }
 
+  /**
+   * Whether the request waited in the daemon's queue and is known not to have started: the daemon reported a queue
+   * position and says when it starts a request (protocol 0.14), but has not said so, no output, event, terminal
+   * control or stdin admission arrived, and the client did not ask it to cancel. If the daemon exits then, the
+   * request has not run. Once the connection has closed, this is also false unless the client read everything
+   * that the daemon sent (see `DaemonFrameConnection.closedAfterReadingAll`), because a frame that the close
+   * discarded may have said that the request started.
+   */
+  public get queuedWithoutStarting(): boolean {
+    return (
+      this.#supportsRequestStarted &&
+      this.#queued &&
+      !this.#requestStarted &&
+      !this.#observedExecution &&
+      !this.#inputAdmitted &&
+      !this.#inputStarted &&
+      !this.#rawModeChanged &&
+      !this.#cancelSent &&
+      !this.#closedBeforeReadingAll
+    );
+  }
+
   /**
    * Requests shutdown on a fresh connection and waits for acknowledgement followed by EOF.
    * @remarks This confirms acceptance and connection closure, not successful workspace cleanup.
@@ -230,6 +385,8 @@ export class DaemonClient {
     options.abortSignal?.addEventListener('abort', cancel, { once: true });
     try {
       validateTimeout(options.cancellationTimeoutMs ?? 5000);
+      validateTimeout(options.liveness?.pingAfterMs ?? DEFAULT_PING_AFTER_MS);
+      validateTimeout(options.liveness?.unresponsiveAfterMs ?? DEFAULT_UNRESPONSIVE_AFTER_MS);
       if (options.stdin?.readableEncoding) {
         throw new Error('Daemon stdin must supply raw bytes; do not use setEncoding().');
       }
@@ -272,13 +429,18 @@ export class DaemonClient {
         };
       }
       this.#result = deferred();
+      this.#startLivenessCheck(options.liveness);
       await Promise.all([
-        this.#sendControlAsync({ kind: 'requestStart', payload: options.request }),
+        this.#sendControlAsync({
+          kind: 'requestStart',
+          payload: adaptDaemonRequestToPeer(options.request, this.protocolVersion, process.platform)
+        }),
         this.#result.promise
       ]);
       return await this.#result.promise;
     } finally {
       this.#finished = true;
+      this.#stopLivenessCheck();
       clearTimeout(this.#cancelTimer);
       options.abortSignal?.removeEventListener('abort', cancel);
       this.#stopInput();
@@ -297,7 +459,9 @@ export class DaemonClient {
   #cancel(): void {
     if (this.#cancelSent || this.#finished || !this.#execution) return;
     this.#cancelSent = true;
+    this.#stopLivenessCheck();
     this.#stopInput();
+    const timeoutMs: number = this.#execution.cancellationTimeoutMs ?? 5000;
     this.#cancelTimer = setTimeout(() => {
       this.#connection.abort(
         new DaemonClientError(
@@ -305,11 +469,93 @@ export class DaemonClient {
           'Daemon did not finish cancellation; disconnected without retrying the command.'
         )
       );
-    }, this.#execution.cancellationTimeoutMs ?? 5000);
+    }, timeoutMs);
     void this.#sendControlAsync({
       kind: 'requestCancel',
       payload: { requestId: this.#execution.request.requestId }
     }).catch((error: Error) => this.#fail(error));
+    this.#execution.onCancelRequested?.(timeoutMs);
+  }
+
+  /** Handles a frame; while it does, the client reads nothing more, so the daemon's silence is not measured. */
+  async #receiveFrameAsync(frame: IDaemonFrame): Promise<void> {
+    const nowMs: number = performance.now();
+    if (this.#silenceReported) {
+      this.#silenceReported = false;
+      this.#execution?.liveness?.onResponsive?.({
+        pid: this.#daemonPid,
+        silentForMs: nowMs - this.#lastHeardAtMs
+      });
+    }
+    this.#frameInFlight = true;
+    try {
+      await this.#onFrameAsync(frame);
+    } finally {
+      this.#frameInFlight = false;
+      this.#lastHeardAtMs = performance.now();
+    }
+  }
+
+  /**
+   * Waits until the client has handled the frames that it received before its connection closed, or until one of
+   * them shows that the request left the queue. The transport hands decoded frames over without waiting for I/O, so
+   * once no frame is in flight after a turn of the event loop, none is left.
+   */
+  async #settleReceivedFramesAsync(): Promise<void> {
+    while (this.queuedWithoutStarting) {
+      if (this.#frameInFlight) {
+        await this.#frameHandled.catch(() => undefined);
+      } else {
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        if (!this.#frameInFlight) return;
+      }
+    }
+  }
+
+  #startLivenessCheck(options: IDaemonClientLivenessOptions | undefined): void {
+    if (!options || this.protocolVersion.minor < DAEMON_KEEPALIVE_PROTOCOL_MINOR) return;
+    const pingAfterMs: number = options.pingAfterMs ?? DEFAULT_PING_AFTER_MS;
+    const unresponsiveAfterMs: number = options.unresponsiveAfterMs ?? DEFAULT_UNRESPONSIVE_AFTER_MS;
+    const check: ILivenessCheck = {
+      options,
+      pingAfterMs,
+      unresponsiveAfterMs,
+      intervalMs: Math.min(MAX_LIVENESS_CHECK_INTERVAL_MS, pingAfterMs, unresponsiveAfterMs),
+      lastCheckAtMs: performance.now()
+    };
+    this.#lastHeardAtMs = check.lastCheckAtMs;
+    this.#livenessTimer = setInterval(() => this.#checkLiveness(check), check.intervalMs);
+    this.#livenessTimer.unref?.();
+  }
+
+  #checkLiveness(check: ILivenessCheck): void {
+    const nowMs: number = performance.now();
+    // A check that runs this late means that the client's own event loop stalled, for example while the process
+    // was stopped. Frames that the daemon sent meanwhile may still wait to be read, so that is not its silence.
+    const stalledMs: number = nowMs - check.lastCheckAtMs - check.intervalMs;
+    check.lastCheckAtMs = nowMs;
+    if (stalledMs > check.intervalMs) {
+      this.#lastHeardAtMs = Math.min(nowMs, this.#lastHeardAtMs + stalledMs);
+    }
+    if (this.#finished || this.#frameInFlight) return;
+    const silentForMs: number = nowMs - this.#lastHeardAtMs;
+    if (silentForMs >= check.pingAfterMs && !this.#pingPending) {
+      this.#pingPending = true;
+      // A send that fails closes the connection, which fails the request. Only the pong's arrival counts, so the
+      // daemon need not read or send its warm set.
+      this.#sendControlAsync({ kind: 'ping', payload: { omitWarmSet: true } }).catch(() => undefined);
+    }
+    if (silentForMs >= check.unresponsiveAfterMs && !this.#silenceReported) {
+      this.#silenceReported = true;
+      check.options.onUnresponsive({ pid: this.#daemonPid, silentForMs });
+    }
+  }
+
+  /** Once stopped, the check reports nothing more, not even that the daemon responds again. */
+  #stopLivenessCheck(): void {
+    clearInterval(this.#livenessTimer);
+    this.#livenessTimer = undefined;
+    this.#silenceReported = false;
   }
 
   async #onFrameAsync(frame: IDaemonFrame): Promise<void> {
@@ -354,6 +600,7 @@ export class DaemonClient {
       this.#supportsInputLifecycle =
         this.#peerProtocolVersion.minor >= DAEMON_INPUT_LIFECYCLE_PROTOCOL_MINOR &&
         this.#connectOptions.capabilities?.supportsInputLifecycle !== false;
+      this.#supportsRequestStarted = this.#peerProtocolVersion.minor >= DAEMON_REQUEST_STARTED_PROTOCOL_MINOR;
       await this.#sendControlAsync({
         kind: 'subscribe',
         payload: {
@@ -362,10 +609,14 @@ export class DaemonClient {
           supportsInteractiveIO: true,
           supportsInputLifecycle: this.#supportsInputLifecycle,
           supportsRequestAdmission: true,
-          supportsRequestLifecycle: true
+          supportsRequestLifecycle: true,
+          supportsRequestStarted: this.#supportsRequestStarted
         }
       });
-      await this.#sendControlAsync({ kind: 'ping', payload: {} });
+      await this.#sendControlAsync({
+        kind: 'ping',
+        payload: this.#connectOptions.omitWarmSetStatus ? { omitWarmSet: true } : {}
+      });
       return;
     }
     if (message.kind === 'pong' && !this.#used) {
@@ -376,9 +627,15 @@ export class DaemonClient {
           `Expected daemon ${expected}, received ${message.payload.daemonVersion ?? 'unknown'}. Stop the old daemon before retrying; no PID was killed.`
         );
       }
+      this.#daemonPid = message.payload.pid;
       this.#ready.resolve(message.payload);
       return;
     }
+    // The reply to the liveness check's ping, which can also arrive after the result.
+    if (message.kind === 'pong' && this.#pingPending) {
+      this.#pingPending = false;
+      return;
+    }
     if (message.kind === 'shutdownAck') {
       if (!this.#shutdown || this.#shutdownAcknowledged) {
         throw new DaemonProtocolError('malformedControlMessage', 'Unexpected shutdown acknowledgement.');
@@ -430,6 +687,7 @@ export class DaemonClient {
         if (!this.#inputAdmitted) {
           this.#inputAdmitted = true;
           this.#startInput();
+          await execution.onInputAdmittedAsync?.();
         } else if (this.#inputAcknowledgement) {
           const acknowledgement: IDeferred<void> = this.#inputAcknowledgement;
           this.#inputAcknowledgement = undefined;
@@ -438,9 +696,31 @@ export class DaemonClient {
           throw new DaemonProtocolError('malformedControlMessage', 'Unexpected stdin write acknowledgement.');
         }
         return;
-      case 'queuePosition':
-        await execution.onQueuePositionAsync?.(message.payload.position);
+      case 'requestStarted':
+        if (!this.#supportsRequestStarted) {
+          throw new DaemonProtocolError('malformedControlMessage', 'Unexpected request start notice.');
+        }
+        this.#requestStarted = true;
+        return;
+      case 'queuePosition': {
+        this.#queued = true;
+        const {
+          position,
+          restartReason,
+          scriptCount,
+          restartsForAnotherRequest,
+          nativeLockHolder,
+          continuingOperations
+        } = message.payload;
+        await execution.onQueuePositionAsync?.(
+          position,
+          restartReason,
+          { scriptCount, restartsForAnotherRequest },
+          nativeLockHolder,
+          continuingOperations
+        );
         return;
+      }
       default:
         throw new DaemonProtocolError(
           'malformedControlMessage',
diff --git a/libraries/rush-client-core/src/DaemonClientError.ts b/libraries/rush-client-core/src/DaemonClientError.ts
index 09b21b881f9..b08b984e320 100644
--- a/libraries/rush-client-core/src/DaemonClientError.ts
+++ b/libraries/rush-client-core/src/DaemonClientError.ts
@@ -4,7 +4,18 @@
 /** A failure before readiness, or a connection lost without an authoritative result. @beta */
 export type DaemonClientErrorCode = 'timeout' | 'versionMismatch' | 'disconnected' | 'startupFailed';
 
-/** An actionable client failure. Never replay a request following a disconnect. @beta */
+/** Guidance and tools match this sentence, so explanations of a lost connection are appended after it. */
+export const DAEMON_DISCONNECTED_MESSAGE: string =
+  'Daemon disconnected before delivering a result; the command was not retried.';
+
+/**
+ * Replaces {@link DAEMON_DISCONNECTED_MESSAGE} when the command was sent to a new daemon because the previous one
+ * exited while the command was queued.
+ */
+export const DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE: string =
+  'Daemon disconnected before delivering a result; the command was already sent to a new daemon once.';
+
+/** An actionable client failure. A request is sent again after a disconnect only when it never ran. @beta */
 export class DaemonClientError extends Error {
   public readonly code: DaemonClientErrorCode;
 
diff --git a/libraries/rush-client-core/src/DaemonDisconnect.ts b/libraries/rush-client-core/src/DaemonDisconnect.ts
new file mode 100644
index 00000000000..b41e50db8b1
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonDisconnect.ts
@@ -0,0 +1,218 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from './DaemonClient';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientError';
+import { getDaemonLogFilePath } from './DaemonLogFile';
+import { isOwnerProcessAlive } from './DaemonOwnership';
+import { reclaimExitedDaemonAsync } from './ExitedDaemonReclaim';
+import { isProcessDefunct } from './ProcessStartTime';
+
+/** A process closes its connections while it exits, so it can briefly outlive them. */
+const EXIT_WAIT_MS: number = 1000;
+const EXIT_POLL_INTERVAL_MS: number = 20;
+/** A crash report is the last thing a daemon writes; a successor started since then writes little. */
+const MAX_LOG_READ_BYTES: number = 64 * 1024;
+const MAX_LOGGED_ERROR_LENGTH: number = 240;
+
+const V8_FATAL_ERROR: RegExp = /^FATAL ERROR: \S/;
+const NODE_REPORT_TRAILER: RegExp = /^Node\.js v\d+\.\d+\.\d+/;
+const SOURCE_LOCATION: RegExp = /:\d+$/;
+const SOURCE_ARROW: RegExp = /^\s*\^[\^~]*\s*$/;
+const STACK_FRAME: RegExp = /^\s+at /;
+const TRACE_UNCAUGHT_HINT: string = '(Use `node --trace-uncaught';
+const CONTROL_CHARACTERS: RegExp = /\p{Cc}/gu;
+
+/** The daemon process that serves a request, and the size of its launcher log when the request was sent. */
+export interface IServingDaemon {
+  readonly pid: number;
+  /** The ownership record's start time when the record names this process; it detects a reused PID. */
+  readonly startedAt: string | undefined;
+  readonly logFilePath: string;
+  readonly logOffset: number | undefined;
+  /** The workspace's daemon files, which are reclaimed if the process exits. */
+  readonly paths: IDaemonPaths;
+}
+
+/** Identifies the daemon behind a ready client, or returns undefined for a peer that does not report its PID. */
+export async function observeServingDaemonAsync(
+  client: DaemonClient,
+  paths: IDaemonPaths
+): Promise<IServingDaemon | undefined> {
+  const { pid } = await client.status;
+  if (pid === undefined) return undefined;
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
+  const logFilePath: string = getDaemonLogFilePath(paths);
+  return {
+    pid,
+    startedAt: owner?.pid === pid ? owner.startedAt : undefined,
+    logFilePath,
+    logOffset: tryGetFileSize(logFilePath),
+    paths
+  };
+}
+
+/**
+ * The explanation of a connection lost while the request waited in the queue of a daemon that then exited, so that
+ * the request has not run. `executeWithDaemonRestartAsync` sends such a request to a new daemon once.
+ */
+export class DaemonExitedWhileQueuedError extends DaemonClientError {
+  /** The process ID of the daemon that exited. */
+  public readonly daemonPid: number;
+
+  public constructor(daemonPid: number, message: string, options?: ErrorOptions) {
+    super('disconnected', message, options);
+    this.daemonPid = daemonPid;
+  }
+}
+
+/**
+ * Explains a connection lost before a request's result by what happened to the daemon process: whether it
+ * exited, the fatal error its launcher log recorded, and how to recover. This never sends the request again.
+ * Other errors are returned unchanged. With `queuedWithoutStarting` (see `DaemonClient.queuedWithoutStarting`),
+ * the explanation of a daemon that exited says that the command was queued, and is a
+ * {@link DaemonExitedWhileQueuedError}.
+ * @remarks If the daemon exited, this first reclaims it as the next daemon start would, so that running the
+ * command again, with or without the daemon, cannot race the operations the daemon left running.
+ */
+export async function explainLostConnectionAsync(
+  error: unknown,
+  daemon: IServingDaemon | undefined,
+  request: IDaemonRequestEnvelope,
+  reclaimOptions?: IDaemonReclaimOptions,
+  queuedWithoutStarting: boolean = false
+): Promise<unknown> {
+  if (!daemon || !isConnectionLoss(error)) return error;
+  const exited: boolean | undefined = await waitForExitAsync(daemon);
+  if (exited === undefined) return error;
+  if (!exited) {
+    return new DaemonClientError(
+      'disconnected',
+      `${DAEMON_DISCONNECTED_MESSAGE} The connection to rushd (PID ${daemon.pid}) closed, but the daemon is still running; run the command again.`,
+      { cause: error }
+    );
+  }
+  const loggedError: string | undefined = readLoggedFatalError(daemon);
+  await reclaimExitedDaemonAsync(daemon, reclaimOptions);
+  const client: string = request.invocationKind === 'rushx' ? 'rushx-client' : 'rush-client';
+  const message: string =
+    `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${daemon.pid}) exited while ` +
+    `${queuedWithoutStarting ? 'the command was queued' : 'it ran the command'}; ` +
+    `"rush-client daemon logs" ${loggedError ? 'shows' : 'may show'} why. Run the command again; ` +
+    `if the daemon exits again, run the command with "${client} --no-daemon".`;
+  const explanation: string = loggedError ? `${message}\nThe daemon log reports: ${loggedError}` : message;
+  return queuedWithoutStarting
+    ? new DaemonExitedWhileQueuedError(daemon.pid, explanation, { cause: error })
+    : new DaemonClientError('disconnected', explanation, { cause: error });
+}
+
+/**
+ * Returns the first fatal error in launcher log lines: V8's `FATAL ERROR:` line, or the message of Node's report
+ * of an uncaught exception (its location, source line and caret, the error with its stack, then the Node.js
+ * version). Returns undefined when the first report does not have that shape.
+ */
+export function findLoggedFatalError(lines: ReadonlyArray<string>): string | undefined {
+  for (let index: number = 0; index < lines.length; index++) {
+    if (V8_FATAL_ERROR.test(lines[index])) return lines[index].trim();
+    if (NODE_REPORT_TRAILER.test(lines[index])) return findUncaughtErrorMessage(lines, index);
+  }
+  return undefined;
+}
+
+function findUncaughtErrorMessage(lines: ReadonlyArray<string>, trailer: number): string | undefined {
+  let arrow: number = trailer - 1;
+  while (arrow >= 2 && !SOURCE_ARROW.test(lines[arrow])) arrow--;
+  if (arrow < 2 || !SOURCE_LOCATION.test(lines[arrow - 2])) return undefined;
+  const message: string[] = [];
+  for (let index: number = arrow + 1; index < trailer && !STACK_FRAME.test(lines[index]); index++) {
+    const line: string = lines[index].trim();
+    if (line && !line.startsWith(TRACE_UNCAUGHT_HINT)) message.push(line);
+  }
+  return message.length ? message.join(' ') : undefined;
+}
+
+function isConnectionLoss(error: unknown): boolean {
+  if (error instanceof DaemonClientError) return error.code === 'disconnected';
+  if (error instanceof DaemonTransportError) return error.code === DaemonTransportErrorCode.transportClosed;
+  const code: unknown =
+    typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+  return code === 'ECONNRESET' || code === 'EPIPE';
+}
+
+/** Resolves true once the process is gone, false if it still runs after the wait, or undefined if unknown. */
+async function waitForExitAsync(daemon: IServingDaemon): Promise<boolean | undefined> {
+  const deadline: number = Date.now() + EXIT_WAIT_MS;
+  for (;;) {
+    try {
+      if (!isOwnerProcessAlive(daemon) || isProcessDefunct(daemon.pid)) return true;
+    } catch {
+      // For example EPERM: the PID exists but cannot be inspected.
+      return undefined;
+    }
+    if (Date.now() >= deadline) return false;
+    await delayAsync(EXIT_POLL_INTERVAL_MS);
+  }
+}
+
+/** The fatal error that the launcher log gained since the request was sent, clipped to one printable line. */
+function readLoggedFatalError(daemon: IServingDaemon): string | undefined {
+  if (daemon.logOffset === undefined) return undefined;
+  const text: string | undefined = readLogTail(daemon.logFilePath, daemon.logOffset);
+  const loggedError: string | undefined = text && findLoggedFatalError(text.split(/\r?\n/));
+  if (!loggedError) return undefined;
+  const printable: string = loggedError.replace(CONTROL_CHARACTERS, '');
+  return printable.length > MAX_LOGGED_ERROR_LENGTH
+    ? `${printable.slice(0, MAX_LOGGED_ERROR_LENGTH - 1)}…`
+    : printable;
+}
+
+/** Reads at most the last {@link MAX_LOG_READ_BYTES} after `offset`; undefined when the log cannot be read. */
+function readLogTail(logFilePath: string, offset: number): string | undefined {
+  let fd: number | undefined;
+  try {
+    fd = fs.openSync(
+      logFilePath,
+      // These distinct native flags have non-overlapping values.
+      fs.constants.O_RDONLY +
+        (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK)
+    );
+    // A bigint stat; see tryGetFileSize.
+    const stats: fs.BigIntStats = fs.fstatSync(fd, { bigint: true });
+    const size: number = Number(stats.size);
+    if (!stats.isFile() || size < offset) return undefined;
+    const start: number = Math.max(offset, size - MAX_LOG_READ_BYTES);
+    const buffer: Buffer = Buffer.alloc(size - start);
+    return buffer.toString('utf8', 0, fs.readSync(fd, buffer, 0, buffer.length, start));
+  } catch {
+    return undefined;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+/**
+ * A plain stat would leave the file's type in Node's shared stat array, which Node's cached realpath reads: after
+ * a FIFO or socket, a later require() in this process, such as by Rush run in-process, would not resolve symlinks.
+ * A bigint stat fills another array.
+ */
+function tryGetFileSize(filePath: string): number | undefined {
+  try {
+    const stats: fs.BigIntStats = fs.statSync(filePath, { bigint: true });
+    return stats.isFile() ? Number(stats.size) : undefined;
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-client-core/src/DaemonLogFile.ts b/libraries/rush-client-core/src/DaemonLogFile.ts
index e5a209cad87..084a1a44524 100644
--- a/libraries/rush-client-core/src/DaemonLogFile.ts
+++ b/libraries/rush-client-core/src/DaemonLogFile.ts
@@ -14,11 +14,6 @@ export function getDaemonLogFilePath(paths: IDaemonPaths): string {
   return `${paths.lockfilePath}.log`;
 }
 
-/** Returns the log's current size, used to scope later diagnostics to one startup attempt. */
-export function getDaemonLogFileSize(paths: IDaemonPaths): number {
-  return fs.statSync(getDaemonLogFilePath(paths), { throwIfNoEntry: false })?.size ?? 0;
-}
-
 /**
  * Formats the last launcher log lines written after `fromOffset`, preferring error lines and omitting
  * stack frames, so startup failures show their real cause. Returns an empty string if nothing is available.
diff --git a/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts b/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
new file mode 100644
index 00000000000..e628addd35d
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
@@ -0,0 +1,346 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from './DaemonClientError';
+import { tryGetProcessStartTimeMs, tryGetProcessState, type IProcessState } from './ProcessStartTime';
+
+/**
+ * What a hint about a live daemon owner is for: a command that uses the daemon (`use`), or one that stops it
+ * (`stop`).
+ * @beta
+ */
+export type DaemonOwnerHintPurpose = 'use' | 'stop';
+
+/** Reads what a diagnosis reports about a process. Only Linux `/proc` shows its state and command line. */
+export interface IOwnerProcessReaders {
+  readonly platform: NodeJS.Platform;
+  readonly now: () => number;
+  readonly readState: (pid: number) => IProcessState | undefined;
+  readonly readStartTimeMs: (pid: number) => number | undefined;
+  readonly readCommandLine: (pid: number) => ReadonlyArray<string> | undefined;
+  readonly isPresent: (filePath: string) => boolean;
+  /** Whether the process has the file at the path open; `undefined` when that cannot be read. */
+  readonly hasFileOpen: (pid: number, filePath: string) => boolean | undefined;
+}
+
+/** What a live process that a daemon ownership record names is doing. It never signals that process. */
+export interface IDaemonOwnerDiagnosis {
+  readonly pid: number;
+  readonly socketPath: string;
+  /** For example `rushd (PID 123)`, or `PID 123 ("sleep 600")` for a process that is not a Rush daemon. */
+  readonly subject: string;
+  /** Undefined when its command line cannot be read, for example outside Linux or after it exited. */
+  readonly isRushDaemon: boolean | undefined;
+  /**
+   * Whether it is a Rush daemon that has this workspace's ownership record open. A daemon opens the record that
+   * it wrote and keeps it open for as long as it owns it, also after its socket file is deleted. Only such a
+   * process is named in a signal hint: the recorded PID could otherwise belong to another process, for example
+   * after a PID reuse that the start-time check could not detect.
+   */
+  readonly isWorkspaceDaemon: boolean;
+  readonly state: IProcessState | undefined;
+  readonly isSocketMissing: boolean;
+  /** For example `: it is stopped (state T), for example by SIGSTOP, and it started 5 min ago`, or empty. */
+  readonly facts: string;
+}
+
+/** A process that a signal (state T) or a tracer (state t) keeps stopped. */
+export interface IStoppedProcess {
+  readonly pid: number;
+  /** When it started, which tells it from a later process with the same PID. */
+  readonly startTicks: number;
+}
+
+/**
+ * A live process owns this workspace's daemon files, but no daemon answered. The message says what that process
+ * is doing on its first line, and what to do about it on the next.
+ */
+export class LiveDaemonOwnerError extends DaemonClientError {
+  /** The first line of the message: what the process is doing. */
+  public readonly description: string;
+  /** The last line of the message: what to do about it. */
+  public readonly hint: string;
+  /** Set when that process has the ownership record open and stayed stopped while a client sampled it. */
+  public readonly stoppedProcess: IStoppedProcess | undefined;
+
+  public constructor(description: string, hint: string, stoppedProcess?: IStoppedProcess) {
+    super('startupFailed', `${description}\n${hint}`);
+    this.description = description;
+    this.hint = hint;
+    this.stoppedProcess = stoppedProcess;
+  }
+}
+
+const RUSH_DAEMON_PACKAGE_FOLDER: string = 'rush-daemon';
+const RUSH_DAEMON_BIN: string = 'rushd';
+const PATH_SEPARATOR_REGEXP: RegExp = /[\\/]+/;
+const MAX_COMMAND_LINE_LENGTH: number = 60;
+const SECONDS_PER_MINUTE: number = 60;
+const MINUTES_PER_HOUR: number = 60;
+/**
+ * Beside an owner that is not proven to be this workspace's daemon, including one that exited but is not reaped
+ * yet, each command that uses the daemon waits for one to answer until its startup deadline, 15 s unless the
+ * client sets another.
+ */
+const WAIT_UNTIL_THEN: string =
+  'Until then, each command that uses the daemon first waits 15 s for a daemon to answer.';
+
+export function getDefaultOwnerProcessReaders(): IOwnerProcessReaders {
+  return {
+    platform: process.platform,
+    now: Date.now,
+    readState: tryGetProcessState,
+    readStartTimeMs: tryGetProcessStartTimeMs,
+    readCommandLine: tryReadCommandLine,
+    isPresent,
+    hasFileOpen: tryHasFileOpen
+  };
+}
+
+/**
+ * What `pid`, which the ownership record at `paths.lockfilePath` names, is doing. Throws nothing: whatever cannot
+ * be read is left out.
+ */
+export function diagnoseDaemonOwner(
+  pid: number,
+  paths: IDaemonPaths,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders()
+): IDaemonOwnerDiagnosis {
+  const { socketPath, lockfilePath } = paths;
+  const commandLine: ReadonlyArray<string> | undefined = readers.readCommandLine(pid);
+  const isRushDaemon: boolean | undefined = commandLine && isRushDaemonCommandLine(commandLine);
+  const state: IProcessState | undefined = readers.readState(pid);
+  const startTimeMs: number | undefined = readers.readStartTimeMs(pid);
+  // Windows names a pipe, which leaves no file to check.
+  const isSocketMissing: boolean = readers.platform !== 'win32' && !readers.isPresent(socketPath);
+  const clauses: string[] = [];
+  if (isSocketMissing) clauses.push('its socket is missing, so no client can reach it');
+  const activity: string[] = [];
+  if (state) activity.push(describeState(state));
+  if (startTimeMs !== undefined) activity.push(`it started ${formatAge(readers.now() - startTimeMs)} ago`);
+  if (activity.length > 0) clauses.push(activity.join(', and '));
+  return {
+    pid,
+    socketPath,
+    subject: describeSubject(pid, isRushDaemon, commandLine),
+    isRushDaemon,
+    isWorkspaceDaemon: isRushDaemon === true && readers.hasFileOpen(pid, lockfilePath) === true,
+    state,
+    isSocketMissing,
+    facts: clauses.length > 0 ? `: ${clauses.join('; ')}` : ''
+  };
+}
+
+/** Describes an owner after the daemon did not answer at its endpoint. */
+export function describeUnresponsiveOwner(diagnosis: IDaemonOwnerDiagnosis): string {
+  const { socketPath, subject, facts } = diagnosis;
+  return diagnosis.isWorkspaceDaemon
+    ? `The daemon, ${subject}, did not answer at ${socketPath}${facts}.`
+    : `The daemon did not answer at ${socketPath}, and its ownership record names ${subject}${facts}.`;
+}
+
+/** Describes the owner that the ownership record at `lockfilePath` names. */
+export function describeRecordOwner(diagnosis: IDaemonOwnerDiagnosis, lockfilePath: string): string {
+  return `${diagnosis.subject} still owns ${lockfilePath}${diagnosis.facts}.`;
+}
+
+/**
+ * Says what makes the daemon answer again, or lets the next command start a new one. It names a signal to send
+ * only to a process that is proven to be this workspace's daemon.
+ */
+export function getDaemonOwnerHint(
+  diagnosis: IDaemonOwnerDiagnosis,
+  lockfilePath: string,
+  purpose: DaemonOwnerHintPurpose
+): string {
+  const { state } = diagnosis;
+  if (state?.code === 'Z' || state?.code === 'X') {
+    const parent: string = state.parentPid === undefined ? 'its parent process' : `PID ${state.parentPid}`;
+    return `The next command reclaims its files once ${parent} reaps it. ${WAIT_UNTIL_THEN}`;
+  }
+  if (diagnosis.isRushDaemon === false) {
+    return `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${lockfilePath}; the next command then starts a new daemon. ${WAIT_UNTIL_THEN}`;
+  }
+  if (!diagnosis.isWorkspaceDaemon) {
+    return `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${lockfilePath}. Either way, the next command then starts a new daemon. ${WAIT_UNTIL_THEN}`;
+  }
+  return getRushDaemonHint(diagnosis, purpose);
+}
+
+/** The error for live owner `pid` after no daemon answered at `paths.socketPath`. */
+export function createUnresponsiveOwnerError(
+  pid: number,
+  paths: IDaemonPaths,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders(),
+  stoppedProcess?: IStoppedProcess
+): LiveDaemonOwnerError {
+  const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(pid, paths, readers);
+  return new LiveDaemonOwnerError(
+    describeUnresponsiveOwner(diagnosis),
+    getDaemonOwnerHint(diagnosis, paths.lockfilePath, 'use'),
+    stoppedProcess
+  );
+}
+
+function getRushDaemonHint(diagnosis: IDaemonOwnerDiagnosis, purpose: DaemonOwnerHintPurpose): string {
+  const { pid } = diagnosis;
+  switch (diagnosis.state?.code) {
+    case 'T':
+      if (diagnosis.isSocketMissing) {
+        return `Run "kill ${pid}", then "kill -CONT ${pid}": it then cancels its running requests and exits, and the next command starts a new daemon.`;
+      }
+      return purpose === 'stop'
+        ? `Resume it with "kill -CONT ${pid}", then run "rush-client daemon stop" again.`
+        : `Resume it with "kill -CONT ${pid}"; it then serves the next command.`;
+    case 't':
+      return 'It answers once the debugger or tracer lets it run.';
+    case 'D':
+      return 'It handles no signal until that wait ends; retry then.';
+    default:
+      return diagnosis.isSocketMissing
+        ? `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
+        : `It may be busy or shutting down; "rush-client daemon logs" shows its last lines. "kill ${pid}" asks it to cancel its running requests and exit; the next command then starts a new daemon.`;
+  }
+}
+
+function describeSubject(
+  pid: number,
+  isRushDaemon: boolean | undefined,
+  commandLine: ReadonlyArray<string> | undefined
+): string {
+  if (isRushDaemon) return `rushd (PID ${pid})`;
+  if (!commandLine) return `PID ${pid}`;
+  const joined: string = commandLine.join(' ');
+  const shown: string =
+    joined.length > MAX_COMMAND_LINE_LENGTH ? `${joined.slice(0, MAX_COMMAND_LINE_LENGTH - 3)}...` : joined;
+  return `PID ${pid} ("${shown}")`;
+}
+
+/**
+ * Says that a process is stopped, by a signal (state T) or by a debugger or tracer (state t), for example
+ * `it is stopped (state T), for example by SIGSTOP`. Returns `undefined` for any other state: a stopped process does
+ * nothing, such as answer or release a lock, until something resumes it.
+ */
+export function describeStoppedState(state: IProcessState | undefined): string | undefined {
+  switch (state?.code) {
+    case 'T':
+      return 'it is stopped (state T), for example by SIGSTOP';
+    case 't':
+      return 'it is stopped by a debugger or tracer (state t)';
+    default:
+      return undefined;
+  }
+}
+
+function describeState(state: IProcessState): string {
+  const stopped: string | undefined = describeStoppedState(state);
+  if (stopped !== undefined) return stopped;
+  switch (state.code) {
+    case 'D':
+      return 'it is waiting in the kernel (state D), for example on a slow disk or network file system';
+    case 'Z': {
+      const parent: string =
+        state.parentPid === undefined ? 'its parent process' : `its parent process (PID ${state.parentPid})`;
+      return `it has exited, but ${parent} has not reaped it (state Z)`;
+    }
+    case 'R':
+      return 'it is running (state R)';
+    case 'S':
+      return 'it is waiting (state S)';
+    default:
+      return `it is in state ${state.code}`;
+  }
+}
+
+function formatAge(ageMs: number): string {
+  const seconds: number = Math.floor(Math.max(0, ageMs) / 1000);
+  if (seconds < SECONDS_PER_MINUTE) return `${seconds} s`;
+  const minutes: number = Math.floor(seconds / SECONDS_PER_MINUTE);
+  if (minutes < MINUTES_PER_HOUR) return `${minutes} min`;
+  return `${Math.floor(minutes / MINUTES_PER_HOUR)} h ${minutes % MINUTES_PER_HOUR} min`;
+}
+
+/**
+ * rushd runs as a `rushd` bin, or as node with its script in the `rush-daemon` package, for example
+ * `node …/rush-daemon/lib-commonjs/SelectedDaemonBootstrap.js --launch …`. Another argument that names that folder,
+ * or a script in a package that `rush-daemon` depends on (such as a tool that builds it), does not count.
+ */
+function isRushDaemonCommandLine(commandLine: ReadonlyArray<string>): boolean {
+  const [executable = '', ...args] = commandLine;
+  if (getFileName(executable) === RUSH_DAEMON_BIN) return true;
+  const script: string | undefined = args.find((arg) => !arg.startsWith('-'));
+  if (script === undefined) return false;
+  const segments: string[] = script.split(PATH_SEPARATOR_REGEXP);
+  const packageIndex: number = segments.lastIndexOf(RUSH_DAEMON_PACKAGE_FOLDER);
+  return (
+    segments[segments.length - 1] === RUSH_DAEMON_BIN ||
+    (packageIndex >= 0 &&
+      packageIndex < segments.length - 1 &&
+      !segments.slice(packageIndex + 1).includes('node_modules'))
+  );
+}
+
+function getFileName(filePath: string): string {
+  const segments: string[] = filePath.split(PATH_SEPARATOR_REGEXP);
+  return segments[segments.length - 1];
+}
+
+/** The arguments of `pid` on Linux; `undefined` elsewhere, or when they are unreadable or empty (a zombie). */
+function tryReadCommandLine(pid: number): ReadonlyArray<string> | undefined {
+  if (process.platform !== 'linux') return undefined;
+  let raw: string;
+  try {
+    raw = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8');
+  } catch {
+    return undefined;
+  }
+  const args: string[] = raw.split('\0').filter((arg) => arg.length > 0);
+  return args.length > 0 ? args : undefined;
+}
+
+/**
+ * Whether `pid` has the file at `filePath` open, on Linux: whether a link in `/proc/<pid>/fd` reads the file's real
+ * path. Such a link reads the current path of the file that the process opened, with " (deleted)" appended once
+ * that file is removed, so a file that took the path later does not count. Only the links are read, never the
+ * files that they lead to, which could block, for example on a network file system that does not answer.
+ */
+function tryHasFileOpen(pid: number, filePath: string): boolean | undefined {
+  if (process.platform !== 'linux') return undefined;
+  let realPath: string;
+  let descriptors: string[];
+  try {
+    realPath = fs.realpathSync.native(filePath);
+    descriptors = fs.readdirSync(`/proc/${pid}/fd`);
+  } catch {
+    return undefined;
+  }
+  return descriptors.some((descriptor) => tryReadLink(`/proc/${pid}/fd/${descriptor}`) === realPath);
+}
+
+function tryReadLink(linkPath: string): string | undefined {
+  try {
+    return fs.readlinkSync(linkPath);
+  } catch {
+    // For example a descriptor that was closed after it was listed.
+    return undefined;
+  }
+}
+
+/**
+ * The stat uses `{ bigint: true }`, which fills a stat array of its own. A plain stat of the socket would leave its
+ * type in the array that Node 22's cached `fs.realpathSync` reads (nodejs/node#65113), and the next `require()` in
+ * this process, for example of the daemon launcher after a failed command, could then load a package through its
+ * symbolic link and not find the package's dependencies.
+ */
+function isPresent(filePath: string): boolean {
+  try {
+    return fs.lstatSync(filePath, { bigint: true, throwIfNoEntry: false }) !== undefined;
+  } catch {
+    // Unknown is not missing.
+    return true;
+  }
+}
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index a7226d0ee9b..772a0e9635b 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -6,11 +6,30 @@ import * as net from 'node:net';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import type { IDaemonLockfile, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  reapReusedOwnerOperationGroupsAsync,
+  reclaimStaleDaemonAsync,
+  type IDaemonLockfile,
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
 
 import { DaemonClientError } from './DaemonClientError';
+import {
+  createUnresponsiveOwnerError,
+  describeRecordOwner,
+  describeUnresponsiveOwner,
+  diagnoseDaemonOwner,
+  getDaemonOwnerHint,
+  LiveDaemonOwnerError,
+  type DaemonOwnerHintPurpose,
+  type IDaemonOwnerDiagnosis
+} from './DaemonOwnerDiagnosis';
 import { getDaemonStartupFilePath } from './DaemonStartup';
 import { isProcessStartedAfter } from './ProcessStartTime';
+import { clearReclaimedDaemonReport, getClientReclaimOptions } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 const PROBE_TIMEOUT_MS: number = 1000;
@@ -18,7 +37,7 @@ const RESET_RETRY_MS: number = 100;
 
 /** Printed wherever automatic recovery fails closed. */
 export const DAEMON_RESET_HINT: string =
-  'If no daemon is running for this workspace, run "rush-client daemon stop --force" to remove its stale files.';
+  'If "rush-client daemon status" cannot connect, run "rush-client daemon stop --force" to remove this workspace\'s stale daemon files.';
 
 export type DaemonOwnership = Pick<IDaemonLockfile, 'pid' | 'startedAt'>;
 
@@ -28,8 +47,11 @@ type OwnershipState =
   | { readonly kind: 'owned'; readonly raw: string; readonly owner: DaemonOwnership };
 
 /** Options for {@link resetDaemonArtifactsAsync}. @beta */
-export interface IDaemonArtifactResetOptions {
-  /** How long to keep re-checking a bound listener, live owner, or held start mutex. Defaults to 0. */
+export interface IDaemonArtifactResetOptions extends IDaemonReclaimOptions {
+  /**
+   * How long to keep re-checking a bound listener, a live owner, a held start mutex, or another process that
+   * reclaims the files of an owner that exited. Defaults to 0.
+   */
   readonly waitTimeoutMs?: number;
 }
 
@@ -94,18 +116,72 @@ export function isOwnerProcessAlive(owner: { readonly pid: number; readonly star
 }
 
 /**
- * Makes stale ownership reclaimable when that is provably safe. The caller must hold the start mutex and
- * have observed no startup reservation, so no legitimate daemon can be between bind and record publication;
- * a refused connection then proves no listener exists.
+ * Describes the live process that this workspace's daemon ownership record names, for a command that could not
+ * use or stop the daemon: on the first line, what that process is doing (on Linux, for example that a signal
+ * stopped it), and on the second, what to do about it. It never signals that process.
+ * @returns `undefined` when there is no record, it cannot be read, or the process that it names is gone.
+ * @beta
  */
-export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promise<void> {
+export function describeLiveDaemonOwner(
+  paths: IDaemonPaths,
+  purpose: DaemonOwnerHintPurpose
+): string | undefined {
+  const owner: DaemonOwnership | undefined = tryReadLiveOwner(paths);
+  if (!owner) return undefined;
+  const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(owner.pid, paths);
+  const description: string = describeRecordOwner(diagnosis, paths.lockfilePath);
+  return `${description}\n${getDaemonOwnerHint(diagnosis, paths.lockfilePath, purpose)}`;
+}
+
+/**
+ * The error for this workspace's daemon when it still runs but no client can reach it at the endpoint, for
+ * example because its socket file was deleted: the process that the ownership record names is rushd, and it has
+ * that record open, as a daemon does for as long as it owns it (which only Linux shows). Otherwise `undefined`.
+ */
+export function findUnreachableDaemon(paths: IDaemonPaths): LiveDaemonOwnerError | undefined {
+  const owner: DaemonOwnership | undefined = tryReadLiveOwner(paths);
+  if (!owner) return undefined;
+  const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(owner.pid, paths);
+  if (!diagnosis.isWorkspaceDaemon) return undefined;
+  return new LiveDaemonOwnerError(
+    describeUnresponsiveOwner(diagnosis),
+    getDaemonOwnerHint(diagnosis, paths.lockfilePath, 'use')
+  );
+}
+
+/**
+ * The recorded owner, or `undefined` when there is no readable record or the process that it names is gone.
+ */
+function tryReadLiveOwner(paths: IDaemonPaths): DaemonOwnership | undefined {
+  try {
+    const owner: DaemonOwnership | undefined = readDaemonOwnership(paths.lockfilePath);
+    return owner && isOwnerProcessAlive(owner) ? owner : undefined;
+  } catch {
+    // For example EPERM: a process that another user runs is no evidence about this workspace's daemon.
+    return undefined;
+  }
+}
+
+/**
+ * Makes stale ownership reclaimable when that is provably safe. The caller must hold the start mutex and have
+ * observed no startup reservation, or taken over one whose helper is gone. A daemon publishes its endpoint only
+ * after it listens, so a refused connection then proves no listener exists. A daemon that a gone helper
+ * launched may still publish later; of two daemons that publish, the second finds the first and exits.
+ * When a process that started after the record was written now has the recorded PID, the owner exited without
+ * shutting down, and once its record is gone no reclaim finds the operations that it recorded. So they are
+ * stopped first, with the proof that `reclaimStaleDaemonAsync` requires of each group but never the group of
+ * that process, and reported to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings).
+ * A recorded group that it leaves running goes to `options.onOperationGroupLeftRunning`, or else to a line in
+ * the launcher log (`logOperationGroupLeftRunning`). If they cannot be stopped, it throws and removes nothing.
+ */
+export async function reclaimAbandonedOwnershipAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
   const state: OwnershipState = inspectOwnership(paths.lockfilePath);
   if (state.kind === 'owned' && !isProcessAlive(state.owner.pid)) return;
   if (state.kind === 'owned' && !isProcessStartedAfter(state.owner.pid, state.owner.startedAt)) {
-    throw new DaemonClientError(
-      'startupFailed',
-      `PID ${state.owner.pid} still exists but the daemon is not ready. It may be a daemon that is still shutting down, or a reused PID; refusing to kill it or remove ${paths.lockfilePath}. ${DAEMON_RESET_HINT}`
-    );
+    throw createUnresponsiveOwnerError(state.owner.pid, paths);
   }
   if (state.kind === 'absent' && (process.platform === 'win32' || !fs.existsSync(paths.socketPath))) return;
   if (!(await isEndpointUnboundAsync(paths.socketPath))) {
@@ -114,6 +190,13 @@ export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promi
       `${describeOwnership(state, paths)}, but ${paths.socketPath} did not refuse a connection; refusing automatic reclaim. ${DAEMON_RESET_HINT}`
     );
   }
+  if (state.kind === 'owned') {
+    await reapReusedOwnerOperationGroupsAsync(
+      paths,
+      state.owner.pid,
+      getClientReclaimOptions(paths, options)
+    );
+  }
   // The transport reclaim then removes the unbound socket under its own two-factor checks.
   if (state.kind !== 'absent') removeIfUnchanged(paths.lockfilePath, state.raw);
 }
@@ -121,9 +204,19 @@ export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promi
 /**
  * Removes this workspace's leftover daemon files (ownership record, socket, and startup reservation)
  * after verifying that no listener is bound and that the recorded owner, if any, is gone.
- * @remarks Never kills a process. Fails when another client holds the start mutex, a listener is bound,
- * or the recorded owner is alive; with `waitTimeoutMs`, those conditions are re-checked until the deadline
- * (for example, while a daemon that just acknowledged shutdown finishes its cleanup).
+ * @remarks When the recorded PID no longer exists, or a process that started after the record was written has
+ * it now, the owner exited without shutting down and may have left operations running, which only its records
+ * name. So the reset first stops them, as the next daemon start would (`reclaimStaleDaemonAsync`), but never
+ * the process group of a process that has the recorded PID now, and reports each set of process groups that it
+ * stops to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. Each recorded
+ * operation group that it leaves running, because it cannot prove that the group is still the owner's, goes to
+ * `options.onOperationGroupLeftRunning`, or else to a line in the launcher log. When the operations cannot be
+ * stopped, it throws and removes nothing. Otherwise it never signals a process. Fails when another
+ * client holds the start mutex, a listener is bound, the recorded owner is alive, or another process reclaims
+ * the files of the owner that exited; with `waitTimeoutMs`, those conditions are re-checked until the deadline
+ * (for example, while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears the
+ * report of a daemon that a client reclaimed after it exited without shutting down
+ * ({@link findReclaimedDaemonPid}).
  * @beta
  */
 export async function resetDaemonArtifactsAsync(
@@ -132,7 +225,10 @@ export async function resetDaemonArtifactsAsync(
 ): Promise<IDaemonArtifactResetResult> {
   const deadline: number = Date.now() + (options?.waitTimeoutMs ?? 0);
   while (true) {
-    const outcome: IDaemonArtifactResetResult | DaemonClientError = await tryResetDaemonArtifactsAsync(paths);
+    const outcome: IDaemonArtifactResetResult | DaemonClientError = await tryResetDaemonArtifactsAsync(
+      paths,
+      options
+    );
     if (!(outcome instanceof DaemonClientError)) return outcome;
     if (Date.now() >= deadline) throw outcome;
     await delayAsync(Math.min(RESET_RETRY_MS, Math.max(1, deadline - Date.now())));
@@ -141,14 +237,15 @@ export async function resetDaemonArtifactsAsync(
 
 /** Returns a (not thrown) error for conditions that may clear on their own. */
 async function tryResetDaemonArtifactsAsync(
-  paths: IDaemonPaths
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions | undefined
 ): Promise<IDaemonArtifactResetResult | DaemonClientError> {
   if (!fs.existsSync(path.dirname(paths.lockfilePath))) return { removedPaths: [] };
   const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
   if (!lock) {
     return new DaemonClientError(
       'startupFailed',
-      `Another client is starting the daemon for ${paths.lockfilePath}; retry after it finishes.`
+      `Another client is starting or resetting the daemon for ${paths.lockfilePath}; retry after it finishes.`
     );
   }
   try {
@@ -160,26 +257,124 @@ async function tryResetDaemonArtifactsAsync(
     }
     const state: OwnershipState = inspectOwnership(paths.lockfilePath);
     if (state.kind === 'owned' && isOwnerProcessAlive(state.owner)) {
-      return new DaemonClientError(
-        'startupFailed',
-        `PID ${state.owner.pid} still owns ${paths.lockfilePath}; it may be a daemon that is shutting down. Wait for it to exit (or stop that process yourself), then retry. No process was killed.`
+      const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(state.owner.pid, paths);
+      return new LiveDaemonOwnerError(
+        `${describeRecordOwner(diagnosis, paths.lockfilePath)} No process was killed.`,
+        getDaemonOwnerHint(diagnosis, paths.lockfilePath, 'stop')
       );
     }
+    // A reclaim removes the record and the socket itself, right after its own checks.
+    const reclaimed: ReadonlySet<string> | DaemonClientError | undefined = await stopOwnerLeftoversAsync(
+      paths,
+      state,
+      options
+    );
+    if (reclaimed instanceof DaemonClientError) return reclaimed;
     const removedPaths: string[] = [];
-    if (state.kind !== 'absent' && removeIfUnchanged(paths.lockfilePath, state.raw)) {
+    if (
+      reclaimed
+        ? reclaimed.has(paths.lockfilePath)
+        : state.kind !== 'absent' && removeIfUnchanged(paths.lockfilePath, state.raw)
+    ) {
       removedPaths.push(paths.lockfilePath);
     }
-    const others: string[] = [getDaemonStartupFilePath(paths)];
-    if (process.platform !== 'win32') others.push(paths.socketPath);
-    for (const filePath of others) {
-      if (tryUnlink(filePath)) removedPaths.push(filePath);
+    const startupFilePath: string = getDaemonStartupFilePath(paths);
+    if (tryUnlink(startupFilePath)) removedPaths.push(startupFilePath);
+    if (
+      process.platform !== 'win32' &&
+      (reclaimed ? reclaimed.has(paths.socketPath) : tryUnlink(paths.socketPath))
+    ) {
+      removedPaths.push(paths.socketPath);
     }
+    clearReclaimedDaemonReport(paths);
     return { removedPaths };
   } finally {
     await lock.releaseAsync();
   }
 }
 
+/**
+ * Stops what an owner that exited without shutting down left running, before its record is removed. When its PID
+ * no longer exists, that is a reclaim ({@link reclaimExitedOwnerAsync}), which returns the files that it
+ * removed. When a process that started after the record was written has its PID (the caller has ruled out a
+ * live owner), only the operation groups that the owner recorded are stopped, never that process, and the
+ * caller removes the record. Returns a (not thrown) error while another process reclaims the owner's files.
+ */
+async function stopOwnerLeftoversAsync(
+  paths: IDaemonPaths,
+  state: OwnershipState,
+  options: IDaemonReclaimOptions | undefined
+): Promise<ReadonlySet<string> | DaemonClientError | undefined> {
+  if (state.kind !== 'owned') return undefined;
+  const ownerPid: number = state.owner.pid;
+  if (!isProcessAlive(ownerPid)) return await reclaimExitedOwnerAsync(paths, ownerPid, options);
+  return await tryReclaimOwnerAsync(paths, ownerPid, () =>
+    reapReusedOwnerOperationGroupsAsync(paths, ownerPid, getClientReclaimOptions(paths, options))
+  );
+}
+
+/**
+ * Stops the operations that an owner that exited left running, and removes its record and socket, as the next
+ * daemon start would. Returns the files that it removed, or a (not thrown) error while another process
+ * reclaims them. Removing the record without this would strand those operations: nothing else names them.
+ */
+async function reclaimExitedOwnerAsync(
+  paths: IDaemonPaths,
+  ownerPid: number,
+  options: IDaemonReclaimOptions | undefined
+): Promise<ReadonlySet<string> | DaemonClientError> {
+  const files: string[] =
+    process.platform === 'win32' ? [paths.lockfilePath] : [paths.lockfilePath, paths.socketPath];
+  const present: string[] = files.filter((filePath) => isPresent(filePath));
+  const failure: DaemonClientError | undefined = await tryReclaimOwnerAsync(paths, ownerPid, () =>
+    reclaimStaleDaemonAsync(paths, getClientReclaimOptions(paths, options))
+  );
+  return failure ?? new Set(present.filter((filePath) => !isPresent(filePath)));
+}
+
+/**
+ * Runs `reclaimAsync` for the files of owner `ownerPid`, which exited without shutting down. Returns a (not
+ * thrown) error while another process reclaims them, and throws when the operations that the owner left running
+ * cannot be stopped.
+ */
+async function tryReclaimOwnerAsync(
+  paths: IDaemonPaths,
+  ownerPid: number,
+  reclaimAsync: () => Promise<void>
+): Promise<DaemonClientError | undefined> {
+  try {
+    await reclaimAsync();
+    return undefined;
+  } catch (error) {
+    // Another process holds the reclaim lock, or a daemon started since the checks above.
+    if (
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.daemonAlreadyRunning
+    ) {
+      return new DaemonClientError(
+        'startupFailed',
+        `Another process is reclaiming the files of rushd (PID ${ownerPid}), which exited without shutting down, or a daemon is starting at ${paths.socketPath}; retry after it finishes.`,
+        { cause: error }
+      );
+    }
+    const reason: string = error instanceof Error ? error.message : String(error);
+    throw new DaemonClientError(
+      'startupFailed',
+      `rushd (PID ${ownerPid}) exited without shutting down, and stopping the operations that it left running failed, so no file was removed: ${reason}`,
+      { cause: error }
+    );
+  }
+}
+
+/**
+ * A plain stat of the socket would leave its file type in Node's shared stat array, which Node's cached realpath
+ * reads (nodejs/node#65113): while the reclaim awaits its connection probe, a require() in this process would not
+ * resolve symlinks. A bigint stat fills another array.
+ */
+function isPresent(filePath: string): boolean {
+  return fs.lstatSync(filePath, { bigint: true, throwIfNoEntry: false }) !== undefined;
+}
+
 /** Resolves true only when a connection attempt proves that nothing listens at the endpoint. */
 export function isEndpointUnboundAsync(socketPath: string): Promise<boolean> {
   return new Promise<boolean>((resolve) => {
@@ -191,7 +386,9 @@ export function isEndpointUnboundAsync(socketPath: string): Promise<boolean> {
     socket.setTimeout(PROBE_TIMEOUT_MS);
     socket.once('connect', () => settle(false));
     socket.once('timeout', () => settle(false));
-    socket.once('error', (error) => settle(hasErrorCode(error, 'ECONNREFUSED') || hasErrorCode(error, 'ENOENT')));
+    socket.once('error', (error) =>
+      settle(hasErrorCode(error, 'ECONNREFUSED') || hasErrorCode(error, 'ENOENT'))
+    );
   });
 }
 
@@ -242,7 +439,10 @@ function removeIfUnchanged(filePath: string, expected: string): boolean {
     throw error;
   }
   if (current !== expected) {
-    throw new DaemonClientError('startupFailed', `${filePath} changed during reclaim; refusing to remove it.`);
+    throw new DaemonClientError(
+      'startupFailed',
+      `${filePath} changed during reclaim; refusing to remove it.`
+    );
   }
   return tryUnlink(filePath);
 }
diff --git a/libraries/rush-client-core/src/DaemonRequestEnvironment.ts b/libraries/rush-client-core/src/DaemonRequestEnvironment.ts
new file mode 100644
index 00000000000..dee83b52bc4
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonRequestEnvironment.ts
@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR,
+  type IDaemonProtocolVersion,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+// Before protocol 0.12, a daemon listened in XDG_RUNTIME_DIR or else in os.tmpdir(), which reads TMPDIR, then
+// TMP, then TEMP. It restarted when a request's XDG_RUNTIME_DIR or TMPDIR differed from its own, and its
+// successor listened in the folder that the request named.
+const RUNTIME_FOLDER_VARIABLES: readonly string[] = ['XDG_RUNTIME_DIR', 'TMPDIR', 'TMP', 'TEMP'];
+
+/**
+ * Returns the request to send to a daemon that negotiated `peer`.
+ *
+ * @remarks
+ * A daemon older than protocol 0.12 would restart into a folder that current clients never look in when a
+ * request names another runtime folder, and every later client of the checkout would then wait for a daemon it
+ * cannot find. On POSIX, its requests leave those variables out, so that it serves them with its own values.
+ * Windows is unchanged: its pipe name does not depend on them, and its builds need `TMP` and `TEMP`.
+ */
+export function adaptDaemonRequestToPeer(
+  request: IDaemonRequestEnvelope,
+  peer: IDaemonProtocolVersion,
+  platform: NodeJS.Platform
+): IDaemonRequestEnvelope {
+  if (platform === 'win32' || peer.minor >= DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR) return request;
+  const environment: Record<string, string> = { ...request.environment };
+  for (const name of RUNTIME_FOLDER_VARIABLES) delete environment[name];
+  return { ...request, environment };
+}
diff --git a/libraries/rush-client-core/src/DaemonRestartCause.ts b/libraries/rush-client-core/src/DaemonRestartCause.ts
new file mode 100644
index 00000000000..78cf1843349
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonRestartCause.ts
@@ -0,0 +1,81 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  DaemonRestartReason,
+  IDaemonWorkspaceInputsChangedRestartReason
+} from '@rushstack/rush-daemon-protocol';
+
+/** A list names at most this many items, then says how many more there are. */
+const MAX_LISTED_NAMES: number = 4;
+
+/**
+ * Which request needs the restart that a cause explains: the request that waits for it, or another request, which a
+ * rushx script waits for so that the restart does not wait for the script, or which a request is queued behind.
+ *
+ * @beta
+ */
+export type DaemonRestartRequester = 'thisRequest' | 'anotherRequest';
+
+/**
+ * Says why the daemon restarts, completing "the daemon restarts <cause>", for example
+ * `because common/config/rush/pnpm-lock.yaml changed`. Names environment variables, never their values.
+ *
+ * @returns `undefined` for a reason kind that this version does not know.
+ * @beta
+ */
+export function formatDaemonRestartCause(
+  reason: DaemonRestartReason,
+  requester: DaemonRestartRequester
+): string | undefined {
+  const anotherRequest: boolean = requester === 'anotherRequest';
+  switch (reason.kind) {
+    case 'installationChanged':
+      return (
+        `because ${anotherRequest ? "the daemon's" : 'its'} installation at ${reason.folder} was ` +
+        `${reason.change}`
+      );
+    case 'environmentChanged': {
+      const names: string = reason.variableNames.length ? ` in ${formatList(reason.variableNames)}` : '';
+      return `because ${anotherRequest ? 'its' : "this request's"} environment differs from the daemon's${names}`;
+    }
+    case 'workspaceInputsChanged':
+      return `because ${formatList(getWorkspaceInputClauses(reason, anotherRequest), Infinity)}`;
+    case 'nativeMutation':
+      return `because ${anotherRequest ? 'it' : 'this request'} runs rush ${reason.commandName}`;
+    default:
+      return undefined;
+  }
+}
+
+function getWorkspaceInputClauses(
+  reason: IDaemonWorkspaceInputsChangedRestartReason,
+  anotherRequest: boolean
+): string[] {
+  const { installationFiles, implementationFiles, selectedRushVersion } = reason;
+  const clauses: string[] = [];
+  if (installationFiles) {
+    clauses.push(
+      installationFiles.length
+        ? `${formatList(installationFiles)} changed`
+        : "the workspace's installation changed"
+    );
+  }
+  if (implementationFiles) {
+    const files: string = implementationFiles.length ? ` (${formatList(implementationFiles)})` : '';
+    clauses.push(`the code of Rush or a Rush plugin changed${files}`);
+  }
+  if (selectedRushVersion !== undefined) {
+    clauses.push(`${anotherRequest ? 'it' : 'this request'} selects Rush ${selectedRushVersion}`);
+  }
+  if (!clauses.length) clauses.push('the inputs that the daemon started with changed');
+  return clauses;
+}
+
+/** Joins items as "a", "a and b" or "a, b and c", naming at most `maxListed` of them. */
+function formatList(items: ReadonlyArray<string>, maxListed: number = MAX_LISTED_NAMES): string {
+  const listed: string[] = items.slice(0, maxListed);
+  const more: number = items.length - listed.length;
+  if (more > 0) listed.push(`${more} more`);
+  return listed.length > 1 ? `${listed.slice(0, -1).join(', ')} and ${listed[listed.length - 1]}` : listed[0];
+}
diff --git a/libraries/rush-client-core/src/DaemonRuntimeFolder.ts b/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
new file mode 100644
index 00000000000..d7583e70c37
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  assertDaemonRuntimeDirIsPrivate,
+  ensureDaemonRuntimeDir,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from './DaemonClientError';
+
+const RUNTIME_FOLDER_ERROR_CODES: ReadonlySet<DaemonTransportErrorCode> = new Set([
+  DaemonTransportErrorCode.unsafeRuntimeDirectory,
+  DaemonTransportErrorCode.socketPathTooLong
+]);
+
+function toClientError(error: unknown): unknown {
+  return error instanceof DaemonTransportError && RUNTIME_FOLDER_ERROR_CODES.has(error.code)
+    ? new DaemonClientError('startupFailed', error.message, { cause: error })
+    : error;
+}
+
+/**
+ * Checks the daemon runtime folder, when it exists, before a client trusts the socket, lockfile or log inside
+ * it (see `assertDaemonRuntimeDirIsPrivate` in `@rushstack/rush-daemon-transport`). This includes a socket
+ * path too long to connect to, which only a long `RUSHD_RUNTIME_DIR` produces.
+ *
+ * @throws {@link DaemonClientError} with code `startupFailed` when the folder is unsafe or the socket path is
+ * too long, so that a caller that falls back to in-process Rush for startup failures also does so here, before
+ * it starts a daemon that no client could reach.
+ *
+ * @beta
+ */
+export function assertDaemonRuntimeFolderIsPrivate(paths: IDaemonPaths): void {
+  try {
+    assertDaemonRuntimeDirIsPrivate(paths);
+  } catch (error) {
+    throw toClientError(error);
+  }
+}
+
+/** Creates and checks the runtime folder, reporting an unsafe one as {@link assertDaemonRuntimeFolderIsPrivate} does. */
+export function ensureDaemonRuntimeFolder(paths: IDaemonPaths): void {
+  try {
+    ensureDaemonRuntimeDir(paths);
+  } catch (error) {
+    throw toClientError(error);
+  }
+}
+
+/**
+ * Adds the base of the runtime folder that this client looks in to a daemon's start environment, so the daemon
+ * listens there whatever `XDG_RUNTIME_DIR`, `TMPDIR` or `RUSHD_RUNTIME_DIR` it would otherwise inherit.
+ */
+export function withDaemonRuntimeFolder(
+  environment: Readonly<Record<string, string>>,
+  paths: IDaemonPaths
+): Readonly<Record<string, string>> {
+  if (paths.runtimeDir === undefined) return environment;
+  return { ...environment, [DAEMON_RUNTIME_DIR_ENV_VAR]: path.dirname(paths.runtimeDir) };
+}
diff --git a/libraries/rush-client-core/src/DaemonStartup.ts b/libraries/rush-client-core/src/DaemonStartup.ts
index a3573ef683a..13673ca5f3c 100644
--- a/libraries/rush-client-core/src/DaemonStartup.ts
+++ b/libraries/rush-client-core/src/DaemonStartup.ts
@@ -2,7 +2,9 @@
 // See LICENSE in the project root for license information.
 
 import { spawn, type ChildProcess } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
+import * as fs from 'node:fs';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import {
@@ -14,18 +16,6 @@ import {
 import type { IDaemonStartCommand } from './connectOrStartDaemon';
 import { DaemonClient } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
-import {
-  assertDaemonStartupReservation,
-  getDaemonStartupFilePath,
-  releaseDaemonStartup,
-  updateDaemonStartupReservation
-} from './DaemonStartupReservation';
-
-export {
-  getDaemonStartupFilePath,
-  releaseDaemonStartup,
-  reserveDaemonStartup
-} from './DaemonStartupReservation';
 
 export interface IDaemonStartupOptions {
   readonly paths: IDaemonPaths;
@@ -35,15 +25,172 @@ export interface IDaemonStartupOptions {
 }
 
 /**
- * Runs independently of the requesting client. The reservation records this helper and its launcher PID,
- * so later starters can verify whether the startup can still make progress. Protocol readiness releases
- * the reservation; so does a launcher that exits without publishing an endpoint. A deadline miss while the
- * launcher is still alive keeps the reservation, which later becomes stale when both processes are gone or
- * the bounded grace period elapses.
+ * The detached startup helper recorded in a reservation. Only this process releases the reservation after
+ * readiness, so once it is provably gone, waiting for it cannot help.
+ */
+export interface IDaemonStartupHelper {
+  readonly pid: number;
+  /** Recorded after the helper was spawned, so a later process that reuses the PID is detectable. */
+  readonly startedAt: string;
+  /**
+   * When the helper stops waiting for daemon readiness.
+   * @remarks Older clients did not record this. Readers derive their deadline from `startedAt` for those records.
+   */
+  readonly readinessDeadline?: string;
+}
+
+/** A startup reservation as found on disk. */
+export interface IDaemonStartupReservation {
+  /** The exact contents, compared before removal; undefined when the entry cannot be read as a file. */
+  readonly contents: string | undefined;
+  /** Undefined for a reservation that does not record a helper, for example one written by an older client. */
+  readonly helper: IDaemonStartupHelper | undefined;
+}
+
+interface IDaemonStartupRecord {
+  readonly token: string;
+  readonly helperPid: number;
+  readonly helperStartedAt: string;
+  readonly helperReadinessDeadline?: string;
+}
+
+export function getDaemonStartupFilePath(paths: IDaemonPaths): string {
+  return `${paths.lockfilePath}.starting`;
+}
+
+/**
+ * Reserves startup for a spawned helper that has not yet received its options, so the reservation names
+ * the helper before any launcher can start.
+ */
+export function reserveDaemonStartup(paths: IDaemonPaths, helper: IDaemonStartupHelper): string {
+  const token: string = randomUUID();
+  const record: IDaemonStartupRecord = {
+    token,
+    helperPid: helper.pid,
+    helperStartedAt: helper.startedAt,
+    ...(helper.readinessDeadline ? { helperReadinessDeadline: helper.readinessDeadline } : {})
+  };
+  fs.writeFileSync(getDaemonStartupFilePath(paths), JSON.stringify(record), { flag: 'wx', mode: 0o600 });
+  return token;
+}
+
+export function readDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservation | undefined {
+  const filePath: string = getDaemonStartupFilePath(paths);
+  let contents: string;
+  try {
+    contents = fs.readFileSync(filePath, 'utf8');
+  } catch (error) {
+    // Any other entry (for example a directory or a dangling link) still refuses another launch.
+    return isNotFound(error) && !fs.lstatSync(filePath, { throwIfNoEntry: false })
+      ? undefined
+      : { contents: undefined, helper: undefined };
+  }
+  const record: IDaemonStartupRecord | undefined = parseStartupRecord(contents);
+  return {
+    contents,
+    helper:
+      record &&
+      ({
+        pid: record.helperPid,
+        startedAt: record.helperStartedAt,
+        ...(record.helperReadinessDeadline ? { readinessDeadline: record.helperReadinessDeadline } : {})
+      } satisfies IDaemonStartupHelper)
+  };
+}
+
+/**
+ * Removes `reservation` unless it changed since it was read, and reports whether it is gone.
+ * The caller must hold the start mutex, so the only concurrent change is the helper's own release.
+ */
+export function removeDaemonStartupIfUnchanged(
+  paths: IDaemonPaths,
+  reservation: IDaemonStartupReservation
+): boolean {
+  const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!current) return true;
+  if (reservation.contents === undefined || current.contents !== reservation.contents) return false;
+  unlinkIfPresent(getDaemonStartupFilePath(paths));
+  return true;
+}
+
+function assertReservation(paths: IDaemonPaths, token: string): void {
+  const contents: string = fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8');
+  if (parseStartupRecord(contents)?.token !== token) {
+    throw new DaemonClientError('startupFailed', 'The daemon startup reservation changed ownership.');
+  }
+}
+
+/**
+ * Releases the helper's own reservation. A missing reservation is already resolved: clients remove one only
+ * under the start mutex, after the same readiness evidence the helper waits for.
+ */
+export function releaseDaemonStartup(paths: IDaemonPaths, token: string): void {
+  try {
+    assertReservation(paths, token);
+  } catch (error) {
+    if (isNotFound(error)) return;
+    throw error;
+  }
+  unlinkIfPresent(getDaemonStartupFilePath(paths));
+}
+
+function parseStartupRecord(contents: string): IDaemonStartupRecord | undefined {
+  let record: unknown;
+  try {
+    record = JSON.parse(contents);
+  } catch {
+    return undefined;
+  }
+  if (typeof record !== 'object' || record === null) return undefined;
+  const { token, helperPid, helperStartedAt, helperReadinessDeadline } = record as Partial<
+    Record<keyof IDaemonStartupRecord, unknown>
+  >;
+  return typeof token === 'string' &&
+    typeof helperPid === 'number' &&
+    Number.isSafeInteger(helperPid) &&
+    helperPid > 0 &&
+    typeof helperStartedAt === 'string' &&
+    Number.isFinite(Date.parse(helperStartedAt)) &&
+    (helperReadinessDeadline === undefined ||
+      (typeof helperReadinessDeadline === 'string' && Number.isFinite(Date.parse(helperReadinessDeadline))))
+    ? {
+        token,
+        helperPid,
+        helperStartedAt,
+        ...(helperReadinessDeadline ? { helperReadinessDeadline } : {})
+      }
+    : undefined;
+}
+
+function unlinkIfPresent(filePath: string): void {
+  try {
+    fs.unlinkSync(filePath);
+  } catch (error) {
+    if (!isNotFound(error)) throw error;
+  }
+}
+
+function isNotFound(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
+}
+
+/**
+ * The startup helper's wait between readiness attempts. Until the daemon publishes its endpoint, an attempt
+ * fails at once, so a short fixed wait costs little. The helper then releases the reservation within about this
+ * long of readiness, instead of up to a doubled backoff step later.
+ */
+const READINESS_POLL_INTERVAL_MS: number = 50;
+
+/**
+ * Runs independently of the requesting client. Once spawn succeeds, only protocol readiness releases
+ * the reservation: an arbitrary launcher may outlive its parent or spawn descendants.
+ * Failure before readiness deliberately leaves the reservation instead of guessing that a PID is safe.
+ * The reservation records this helper, so once it exits, the next client that starts the daemon takes the
+ * reservation over instead of waiting for a release that cannot happen.
  */
 export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Promise<void> {
   const { paths, startCommand: start, token, timeoutMs } = options;
-  assertDaemonStartupReservation(paths, token);
+  assertReservation(paths, token);
   let child: ChildProcess;
   let closed: Promise<void> | undefined;
   try {
@@ -63,11 +210,13 @@ export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Pro
     throw error;
   }
   child.unref();
-  if (child.pid !== undefined) updateDaemonStartupReservation(paths, token, { launcherPid: child.pid });
 
   const deadline: number = Date.now() + timeoutMs;
-  let backoffMs: number = 50;
   while (Date.now() < deadline) {
+    // Sampled before connecting: a launcher can exit because another daemon published this endpoint first (for
+    // example one that an abandoned reservation's helper launched before a client took the reservation over).
+    // That daemon already listens by then, so the attempt below finds it.
+    const launcherExited: boolean = child.exitCode !== null || child.signalCode !== null;
     let client: DaemonClient | undefined;
     try {
       client = await DaemonClient.connectAsync({
@@ -94,26 +243,22 @@ export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Pro
       }
       return;
     }
-    if (child.exitCode !== null || child.signalCode !== null) {
+    if (launcherExited) {
       await closed;
-      // The launcher this helper started is gone without publishing an endpoint. If it left a descendant
-      // that binds later, the transport's bind-time ownership check still rejects a second daemon.
-      releaseDaemonStartup(paths, token);
       throw new DaemonClientError(
         'startupFailed',
-        `Daemon launcher ${describeExit(child)} before protocol readiness; startup reservation released.`
+        `Launcher ${describeExit(child)} before protocol readiness; startup reservation retained.`
       );
     }
-    await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())));
-    backoffMs = Math.min(500, backoffMs * 2);
+    await delayAsync(Math.min(READINESS_POLL_INTERVAL_MS, Math.max(1, deadline - Date.now())));
   }
   throw new DaemonClientError(
     'startupFailed',
-    `Timed out awaiting daemon readiness; the startup reservation at ${getDaemonStartupFilePath(paths)} ` +
-      `is kept while launcher PID ${child.pid} is alive and becomes stale when it exits.`
+    `Timed out awaiting daemon readiness; startup reservation retained at ${getDaemonStartupFilePath(paths)}.`
   );
 }
 
+/** Describes how a child process ended, for example "exited (1)" or "was terminated (SIGKILL)". */
 export function describeExit(child: ChildProcess): string {
   return child.signalCode ? `was terminated (${child.signalCode})` : `exited (${child.exitCode})`;
 }
diff --git a/libraries/rush-client-core/src/DaemonStartupReservation.ts b/libraries/rush-client-core/src/DaemonStartupReservation.ts
index a4e0903b1bd..0766e73a7f7 100644
--- a/libraries/rush-client-core/src/DaemonStartupReservation.ts
+++ b/libraries/rush-client-core/src/DaemonStartupReservation.ts
@@ -1,234 +1,180 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { randomUUID } from 'node:crypto';
-import * as fs from 'node:fs';
-
-import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
-
-import { DaemonClientError } from './DaemonClientError';
-import { withStartupReservationLock } from './StartupLock';
+import {
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from './DaemonClient';
+import { isDaemonOwnership, isEndpointUnboundAsync, isOwnerProcessAlive } from './DaemonOwnership';
+import {
+  getDaemonStartupFilePath,
+  readDaemonStartupReservation,
+  removeDaemonStartupIfUnchanged,
+  type IDaemonStartupHelper,
+  type IDaemonStartupReservation
+} from './DaemonStartup';
+import { isProcessDefunct } from './ProcessStartTime';
+import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 /**
- * How long a reservation may outlive its own startup deadline while a recorded process is still alive.
- * This bounds PID reuse and a wedged launcher; the transport's bind-time ownership check still prevents
- * two daemons from serving one endpoint if the original launcher later resumes.
+ * How long after a launch a client that starts the daemon may take over its reservation once the helper exited.
+ * It matches the default startup timeout. A daemon that fails to start the same way each time, for example
+ * because of a configuration error, is then launched at most once per interval however many clients start it;
+ * the others are refused at once and can run without it.
  */
-export const DAEMON_STARTUP_RESERVATION_GRACE_MS: number = 60000;
-
-/** The durable `<lockfile>.starting` record. */
-export interface IDaemonStartupReservation {
-  readonly token: string;
-  readonly createdAt: string;
-  readonly timeoutMs: number;
-  /** The process responsible for releasing the reservation: the starting client, then the detached helper. */
-  readonly ownerPid: number;
-  readonly ownerStartedAt: string;
-  /** The explicit launcher (typically the daemon itself) once the helper has spawned it. */
-  readonly launcherPid?: number;
-}
-
-export function getDaemonStartupFilePath(paths: IDaemonPaths): string {
-  return `${paths.lockfilePath}.starting`;
-}
+const ABANDONED_STARTUP_RELAUNCH_DELAY_MS: number = 15000;
+/** Older reservations did not record their deadline; this matches the helper's minimum readiness timeout. */
+const LEGACY_STARTUP_HELPER_READINESS_TIMEOUT_MS: number = 120_000;
+/** A helper whose readiness deadline passed this long ago is treated as exited even if its PID is alive. */
+const STARTUP_HELPER_READINESS_DEADLINE_GRACE_MS: number = 60_000;
 
-export function reserveDaemonStartup(paths: IDaemonPaths, timeoutMs: number): string {
-  const now: string = new Date().toISOString();
-  const reservation: IDaemonStartupReservation = {
-    token: randomUUID(),
-    createdAt: now,
-    timeoutMs,
-    ownerPid: process.pid,
-    ownerStartedAt: new Date(Date.now() - process.uptime() * 1000).toISOString()
-  };
-  fs.writeFileSync(getDaemonStartupFilePath(paths), JSON.stringify(reservation), {
-    flag: 'wx',
-    mode: 0o600
-  });
-  return reservation.token;
+/**
+ * What a startup reservation's recorded helper can still do. `running`: it may still release the reservation.
+ * `exited`: it is provably gone, so it never will. A client that finds the daemon ready removes the reservation,
+ * and so does a client that starts the daemon after `relaunchAfter` while nothing listens at the endpoint (it
+ * takes the reservation over). `unknown`: the reservation records no helper, for example because an older client
+ * wrote it.
+ * @beta
+ */
+export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
+
+/** A daemon startup reservation (`<lockfilePath>.starting`), as reported by diagnostics. @beta */
+export interface IDaemonStartupReservationInfo {
+  /** The reservation file. */
+  readonly path: string;
+  /** The detached startup helper that releases the reservation once the daemon is ready, when recorded. */
+  readonly helperPid?: number;
+  /** Whether the helper can still release the reservation. */
+  readonly helperState: DaemonStartupHelperState;
+  /**
+   * When the helper exited: the time (ISO 8601) after which a client that starts the daemon takes the reservation
+   * over and launches the daemon again, provided that nothing listens at the endpoint then.
+   */
+  readonly relaunchAfter?: string;
 }
 
-/** Marks a reservation file that is present but is not a recognized record. */
-export const UNRECOGNIZED_DAEMON_STARTUP_RESERVATION: 'unrecognized' = 'unrecognized';
-
-export type DaemonStartupReservationRecord =
-  | IDaemonStartupReservation
-  | typeof UNRECOGNIZED_DAEMON_STARTUP_RESERVATION
-  | undefined;
-
-/** Returns the parsed reservation, `undefined` if absent, or `UNRECOGNIZED_DAEMON_STARTUP_RESERVATION`. */
-export function readDaemonStartupReservation(
+/**
+ * Reads this workspace's startup reservation without changing it.
+ * @returns `undefined` when no reservation exists.
+ * @beta
+ */
+export function inspectDaemonStartupReservation(
   paths: IDaemonPaths
-): DaemonStartupReservationRecord {
-  let text: string;
-  try {
-    text = fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8');
-  } catch (error) {
-    if (hasErrorCode(error, 'ENOENT')) return undefined;
-    throw error;
-  }
-  try {
-    const record: unknown = JSON.parse(text);
-    return isReservation(record) ? record : UNRECOGNIZED_DAEMON_STARTUP_RESERVATION;
-  } catch {
-    return UNRECOGNIZED_DAEMON_STARTUP_RESERVATION;
-  }
-}
-
-function assertOwnedReservation(paths: IDaemonPaths, token: string): IDaemonStartupReservation {
-  const reservation: DaemonStartupReservationRecord = readDaemonStartupReservation(paths);
-  if (typeof reservation !== 'object' || reservation.token !== token) {
-    throw new DaemonClientError('startupFailed', 'The daemon startup reservation changed ownership.');
-  }
-  return reservation;
+): IDaemonStartupReservationInfo | undefined {
+  const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!reservation) return undefined;
+  const { helper } = reservation;
+  const helperState: DaemonStartupHelperState = getStartupHelperState(reservation);
+  return {
+    path: getDaemonStartupFilePath(paths),
+    ...(helper ? { helperPid: helper.pid } : {}),
+    helperState,
+    ...(helper && helperState === 'exited'
+      ? { relaunchAfter: new Date(getStartupRelaunchTime(helper)).toISOString() }
+      : {})
+  };
 }
 
-export function assertDaemonStartupReservation(paths: IDaemonPaths, token: string): void {
-  assertOwnedReservation(paths, token);
+export function getStartupHelperState(reservation: IDaemonStartupReservation): DaemonStartupHelperState {
+  if (!reservation.helper) return 'unknown';
+  return isStartupHelperAlive(reservation.helper) ? 'running' : 'exited';
 }
 
 /**
- * Atomically records a new owner or launcher PID, but only while the token still owns the reservation.
- * All reservation mutations hold the reservation lock, so a resumed stale owner can never overwrite or
- * remove a replacement reservation between its ownership check and its write.
+ * The time (milliseconds since the epoch) after which a client that starts the daemon may take over a reservation
+ * of `helper` once that helper exited. The helper was recorded when it was launched.
  */
-export function updateDaemonStartupReservation(
-  paths: IDaemonPaths,
-  token: string,
-  update: Partial<Pick<IDaemonStartupReservation, 'ownerPid' | 'ownerStartedAt' | 'launcherPid'>>
-): void {
-  withStartupReservationLock(paths, () => replaceOwnedReservation(paths, token, update));
+export function getStartupRelaunchTime(helper: IDaemonStartupHelper): number {
+  return Date.parse(helper.startedAt) + ABANDONED_STARTUP_RELAUNCH_DELAY_MS;
 }
 
-function replaceOwnedReservation(
-  paths: IDaemonPaths,
-  token: string,
-  update: Partial<IDaemonStartupReservation>
-): void {
-  const reservation: IDaemonStartupReservation = assertOwnedReservation(paths, token);
-  const filePath: string = getDaemonStartupFilePath(paths);
-  const temporaryPath: string = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
-  fs.writeFileSync(temporaryPath, JSON.stringify({ ...reservation, ...update }), {
-    flag: 'wx',
-    mode: 0o600
-  });
+function isStartupHelperAlive(helper: IDaemonStartupHelper): boolean {
+  if (Date.now() >= getStartupHelperReadinessExpirationTime(helper)) return false;
+  if (isProcessDefunct(helper.pid)) return false;
   try {
-    fs.renameSync(temporaryPath, filePath);
-  } catch (error) {
-    fs.rmSync(temporaryPath, { force: true });
-    throw error;
+    return isOwnerProcessAlive(helper);
+  } catch {
+    // For example EPERM: the PID exists but belongs to another user, so the helper cannot be shown to be gone.
+    return true;
   }
 }
 
-export function releaseDaemonStartup(paths: IDaemonPaths, token: string): void {
-  withStartupReservationLock(paths, () => {
-    assertOwnedReservation(paths, token);
-    fs.rmSync(getDaemonStartupFilePath(paths), { force: true });
-  });
-}
-
-/** True if the process responsible for releasing the reservation is gone. */
-export function isDaemonStartupOwnerGone(reservation: IDaemonStartupReservation): boolean {
-  return !isProcessAlive(reservation.ownerPid);
+function getStartupHelperReadinessExpirationTime(helper: IDaemonStartupHelper): number {
+  const deadline: number = helper.readinessDeadline
+    ? Date.parse(helper.readinessDeadline)
+    : Date.parse(helper.startedAt) + LEGACY_STARTUP_HELPER_READINESS_TIMEOUT_MS;
+  return deadline + STARTUP_HELPER_READINESS_DEADLINE_GRACE_MS;
 }
 
 /**
- * A reservation is stale when neither its owner nor its launcher is alive, or when it has outlived its own
- * startup deadline by the grace period. Unrecognized (for example legacy token-only) records have no
- * verifiable owner, so only their age counts.
+ * Removes a retained startup reservation on the evidence that its helper waits for: a daemon that completed
+ * hello/ping at this endpoint. This also requires `pid` to be the live owner in the ownership record, so the
+ * endpoint cannot be handed to a second launch. The caller must hold the start mutex; a reservation made
+ * after this check is never removed.
+ * @returns true when no reservation remains.
  */
-function isDaemonStartupReservationStale(paths: IDaemonPaths, timeoutMs: number): boolean {
-  const reservation: DaemonStartupReservationRecord = readDaemonStartupReservation(paths);
-  if (reservation === undefined) return false;
-  if (reservation === UNRECOGNIZED_DAEMON_STARTUP_RESERVATION) {
-    const stats: fs.Stats | undefined = fs.statSync(getDaemonStartupFilePath(paths), {
-      throwIfNoEntry: false
-    });
-    return !!stats && Date.now() - stats.mtimeMs > timeoutMs + DAEMON_STARTUP_RESERVATION_GRACE_MS;
-  }
-  const expiresAt: number =
-    Date.parse(reservation.createdAt) + reservation.timeoutMs + DAEMON_STARTUP_RESERVATION_GRACE_MS;
-  const launcherGone: boolean =
-    reservation.launcherPid === undefined || !isProcessAlive(reservation.launcherPid);
-  return (isDaemonStartupOwnerGone(reservation) && launcherGone) || Date.now() > expiresAt;
-}
-
-/** Removes the reservation if it is stale, atomically with respect to other reservation mutations. */
-export function reclaimStaleDaemonStartupReservation(paths: IDaemonPaths, timeoutMs: number): boolean {
-  return withStartupReservationLock(paths, () => {
-    if (!isDaemonStartupReservationStale(paths, timeoutMs)) return false;
-    fs.rmSync(getDaemonStartupFilePath(paths), { force: true });
-    return true;
-  });
+export function resolveStartupReservationForReadyDaemon(
+  paths: IDaemonPaths,
+  pid: number | undefined
+): boolean {
+  const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!reservation) return true;
+  if (pid === undefined || !isAttestedDaemonOwner(paths, pid)) return false;
+  return removeDaemonStartupIfUnchanged(paths, reservation);
 }
 
 /**
- * Removes the reservation file only if it still matches the observed record, so a concurrent new
- * reservation is never removed.
+ * Removes a reservation whose helper is provably gone, once its relaunch time has passed and while nothing listens
+ * at the endpoint, so that the caller can launch the daemon again. Only the helper releases a reservation, so this
+ * one would otherwise refuse every automatic start. The caller must hold the start mutex, which keeps other clients
+ * from taking it over or from reserving startup at the same time.
+ * @remarks A daemon that the gone helper launched may still be starting. Launching another is still safe: a daemon
+ * publishes the endpoint only with link(2), or as the first instance of a named pipe, and only after it listens,
+ * and it reclaims the endpoint only from an owner that is dead and does not accept a connection. So whichever
+ * daemon publishes second finds the other and exits, and a helper releases its reservation once either daemon
+ * completes hello/ping.
+ * @returns true when this call removed `reservation`.
  */
-export function removeDaemonStartupReservation(
+export async function tryTakeOverAbandonedStartupReservationAsync(
   paths: IDaemonPaths,
-  observed: DaemonStartupReservationRecord
-): void {
-  withStartupReservationLock(paths, () => removeMatchingReservation(paths, observed));
-}
-
-function removeMatchingReservation(paths: IDaemonPaths, observed: DaemonStartupReservationRecord): void {
-  const current: DaemonStartupReservationRecord = readDaemonStartupReservation(paths);
-  if (current === undefined || observed === undefined) return;
-  const matches: boolean =
-    typeof observed === 'object'
-      ? typeof current === 'object' && current.token === observed.token
-      : current === observed;
-  if (!matches) return;
-  fs.rmSync(getDaemonStartupFilePath(paths), { force: true });
-}
-
-export function describeDaemonStartupReservation(paths: IDaemonPaths): string {
-  const reservation: DaemonStartupReservationRecord = readDaemonStartupReservation(paths);
-  if (typeof reservation !== 'object') return 'unrecognized reservation record';
-  const ageSeconds: number = Math.max(0, Math.round((Date.now() - Date.parse(reservation.createdAt)) / 1000));
-  const launcher: string =
-    reservation.launcherPid === undefined
-      ? 'not spawned'
-      : `PID ${reservation.launcherPid} ${isProcessAlive(reservation.launcherPid) ? 'alive' : 'exited'}`;
-  return (
-    `owner PID ${reservation.ownerPid} ${isProcessAlive(reservation.ownerPid) ? 'alive' : 'exited'}, ` +
-    `launcher ${launcher}, age ${ageSeconds}s`
-  );
-}
-
-function isReservation(record: unknown): record is IDaemonStartupReservation {
-  if (typeof record !== 'object' || record === null) return false;
-  const value: Partial<Record<keyof IDaemonStartupReservation, unknown>> = record as Partial<
-    Record<keyof IDaemonStartupReservation, unknown>
-  >;
-  return (
-    typeof value.token === 'string' &&
-    typeof value.createdAt === 'string' &&
-    Number.isFinite(Date.parse(value.createdAt)) &&
-    typeof value.timeoutMs === 'number' &&
-    Number.isFinite(value.timeoutMs) &&
-    isPid(value.ownerPid) &&
-    typeof value.ownerStartedAt === 'string' &&
-    (value.launcherPid === undefined || isPid(value.launcherPid))
-  );
+  reservation: IDaemonStartupReservation
+): Promise<boolean> {
+  const { helper } = reservation;
+  if (!helper || getStartupHelperState(reservation) !== 'exited') return false;
+  if (Date.now() < getStartupRelaunchTime(helper)) return false;
+  if (!(await isEndpointUnboundAsync(paths.socketPath))) return false;
+  // The helper may have released its reservation just before it exited.
+  const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!current || current.contents !== reservation.contents) return false;
+  return removeDaemonStartupIfUnchanged(paths, current);
 }
 
-function isPid(value: unknown): value is number {
-  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
-}
-
-function isProcessAlive(pid: number): boolean {
+/**
+ * {@link resolveStartupReservationForReadyDaemon} for a connected client, taking the start mutex without waiting.
+ * Returns false, keeping the reservation, while another client or this process holds the mutex.
+ */
+export async function tryResolveStartupReservationAsync(
+  client: DaemonClient,
+  paths: IDaemonPaths
+): Promise<boolean> {
+  const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+  if (!lock) return false;
   try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    // EPERM means the PID exists but belongs to another user.
-    return !hasErrorCode(error, 'ESRCH');
+    return resolveStartupReservationForReadyDaemon(paths, (await client.status).pid);
+  } finally {
+    await lock.releaseAsync();
   }
 }
 
-function hasErrorCode(error: unknown, code: string): boolean {
-  return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
+function isAttestedDaemonOwner(paths: IDaemonPaths, pid: number): boolean {
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
+  if (!isDaemonOwnership(owner) || owner.pid !== pid || owner.socketPath !== paths.socketPath) return false;
+  try {
+    return isOwnerProcessAlive(owner);
+  } catch {
+    return false;
+  }
 }
diff --git a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
new file mode 100644
index 00000000000..9556e0435a1
--- /dev/null
+++ b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
@@ -0,0 +1,164 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  assertDaemonRuntimeDirIsPrivate,
+  readDaemonLockfile,
+  reclaimStaleDaemonAsync,
+  type IDaemonLockfile,
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
+
+import { isProcessAlive, reclaimAbandonedOwnershipAsync } from './DaemonOwnership';
+import { readDaemonStartupReservation } from './DaemonStartup';
+import { isProcessDefunct, isProcessStartedAfter } from './ProcessStartTime';
+import { getClientReclaimOptions, logReclaimedDaemon } from './ReclaimedDaemonLog';
+import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+
+/**
+ * How long to wait while another client reclaims the exited daemon. A reclaim sends SIGTERM to orphaned
+ * operations, then SIGKILL to those still running 2 seconds later.
+ */
+const RECLAIM_WAIT_MS: number = 5000;
+/**
+ * How long to wait while the exited daemon's process is not reaped yet. Its parent, usually init or a subreaper,
+ * reaps it at once. A parent that has not reaped it within a second may never do so, for example PID 1 in a
+ * container that does not reap the processes it adopts, and each command that runs Rush in-process until then
+ * would wait all of it.
+ */
+const REAP_WAIT_MS: number = 1000;
+const RECLAIM_POLL_INTERVAL_MS: number = 50;
+
+/** A daemon process that has exited, and the workspace files that may still name it. */
+export interface IExitedDaemon {
+  readonly pid: number;
+  /** The ownership record's start time when known; a record with another start time names another process. */
+  readonly startedAt: string | undefined;
+  readonly paths: IDaemonPaths;
+}
+
+/**
+ * Reclaims the workspace's daemon when its ownership record names a process that no longer runs, such as a
+ * daemon that crashed or was killed while it ran a command, including when another process has its PID now.
+ * This stops the operations that the daemon left running, so that they cannot overwrite the outputs of a
+ * command that then runs without the daemon.
+ *
+ * @remarks
+ * Call it before Rush runs in-process. Like the next daemon start, it terminates the daemon's orphaned
+ * operation process groups and removes the ownership record and socket. Each set of groups that it stops is
+ * reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. Each
+ * recorded group that it leaves running, because it cannot prove that the group still runs an operation of the
+ * daemon, goes to `options.onOperationGroupLeftRunning`, or else to a line in the launcher log. It does so
+ * only under the start mutex and when no startup is reserved. It waits up to 5 seconds while another client
+ * holds the mutex, and up to 1 second while the exited process is not reaped yet. It does nothing when there is
+ * no record or the runtime folder is not private. When a process with the recorded PID runs, it acts only when
+ * that process started after the record was written and the daemon's endpoint refuses a connection, as the next
+ * daemon start requires: after the wall clock jumps forward, a running daemon can seem to have started later,
+ * but it still accepts connections. It never throws.
+ *
+ * A reclaim appends a line that names the daemon to the launcher log, so that `rush-client daemon status` can
+ * still say that it exited without shutting down once its ownership record is gone.
+ *
+ * @beta
+ */
+export async function reclaimCrashedDaemonAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
+  let owner: IDaemonLockfile | undefined;
+  try {
+    // Every daemon command checks the folder before it trusts the records in it.
+    assertDaemonRuntimeDirIsPrivate(paths);
+    owner = readDaemonLockfile(paths.lockfilePath);
+    // The reclaim refuses a PID that still exists, except that an exited process may not be reaped yet.
+    if (!owner) return;
+    if (isProcessAlive(owner.pid) && !isProcessDefunct(owner.pid)) {
+      if (!isProcessStartedAfter(owner.pid, owner.startedAt)) return;
+      await reclaimReusedDaemonAsync({ pid: owner.pid, startedAt: owner.startedAt, paths }, options);
+      return;
+    }
+  } catch {
+    // For example EPERM: the PID exists but cannot be inspected.
+    return;
+  }
+  await reclaimExitedDaemonAsync({ pid: owner.pid, startedAt: owner.startedAt, paths }, options);
+}
+
+async function reclaimReusedDaemonAsync(
+  daemon: IExitedDaemon,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
+  const startedAt: number = Date.now();
+  try {
+    while (isRecordedOwner(daemon)) {
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(daemon.paths);
+      if (lock) {
+        try {
+          if (isRecordedOwner(daemon) && !readDaemonStartupReservation(daemon.paths)) {
+            // The same reclaim as the next daemon start's, which throws unless the endpoint refuses a connection.
+            await reclaimAbandonedOwnershipAsync(daemon.paths, options);
+            await reclaimStaleDaemonAsync(daemon.paths, getClientReclaimOptions(daemon.paths, options));
+            logReclaimedDaemon(daemon.paths, daemon.pid);
+          }
+        } finally {
+          await lock.releaseAsync();
+        }
+        return;
+      }
+      if (Date.now() - startedAt >= RECLAIM_WAIT_MS) return;
+      await delayAsync(RECLAIM_POLL_INTERVAL_MS);
+    }
+  } catch {
+    // For example, the endpoint accepted a connection, or a process group could not be stopped.
+  }
+}
+
+/**
+ * Stops the operations that an exited daemon left running, and removes its ownership record and socket, as
+ * the next daemon start would (`options.onOrphansReaped` or `RUSH_DAEMON_ORPHANS_REAPED` warnings say what was
+ * stopped, and `options.onOperationGroupLeftRunning` or the launcher log what was left running). Best effort:
+ * it acts only while the ownership record names that daemon, under the start mutex, and when no startup is
+ * reserved. While another client holds the mutex, for example to reclaim the same daemon, it waits up to 5
+ * seconds, and it waits up to 1 second for the exited process to be reaped. A reclaim is logged
+ * ({@link logReclaimedDaemon}).
+ */
+export async function reclaimExitedDaemonAsync(
+  daemon: IExitedDaemon,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
+  const startedAt: number = Date.now();
+  try {
+    while (isRecordedOwner(daemon)) {
+      // The reclaim refuses a PID that still exists, which includes an exited process that is not reaped yet.
+      const isDefunct: boolean = isProcessDefunct(daemon.pid);
+      if (!isDefunct) {
+        const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(daemon.paths);
+        if (lock) {
+          try {
+            if (isRecordedOwner(daemon) && !readDaemonStartupReservation(daemon.paths)) {
+              await reclaimStaleDaemonAsync(daemon.paths, getClientReclaimOptions(daemon.paths, options));
+              logReclaimedDaemon(daemon.paths, daemon.pid);
+            }
+          } finally {
+            await lock.releaseAsync();
+          }
+          return;
+        }
+      }
+      if (Date.now() - startedAt >= (isDefunct ? REAP_WAIT_MS : RECLAIM_WAIT_MS)) return;
+      await delayAsync(RECLAIM_POLL_INTERVAL_MS);
+    }
+  } catch {
+    // For example, the PID was reused, or another process holds the reclaim's mutex; the next start retries.
+  }
+}
+
+function isRecordedOwner(daemon: IExitedDaemon): boolean {
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(daemon.paths.lockfilePath);
+  return (
+    owner?.pid === daemon.pid && (daemon.startedAt === undefined || owner.startedAt === daemon.startedAt)
+  );
+}
diff --git a/libraries/rush-client-core/src/InheritedFileDescriptors.ts b/libraries/rush-client-core/src/InheritedFileDescriptors.ts
new file mode 100644
index 00000000000..365e4e95287
--- /dev/null
+++ b/libraries/rush-client-core/src/InheritedFileDescriptors.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+/** The open file flag that Linux reports in /proc/self/fdinfo for a descriptor marked close-on-exec. */
+const LINUX_O_CLOEXEC: number = 0o2000000;
+
+/**
+ * Lists the file descriptors above stderr that a program this process starts would inherit: those not marked
+ * close-on-exec, other than the IPC channel.
+ *
+ * @remarks
+ * Node marks descriptors 0 through 15 close-on-exec when it starts, and then each later one up to the first that
+ * is closed. A descriptor after that gap stays inheritable, for example the pipe of a bash process substitution
+ * (`2> >(sed …)`, usually descriptor 63) or a lock file that a script opened with `exec 200>file`.
+ *
+ * Returns `undefined` when it cannot tell: on any platform but Linux, or when /proc/self/fdinfo does not show
+ * close-on-exec on a descriptor that Node opened (Node opens every descriptor close-on-exec).
+ */
+export function listInheritedFileDescriptors(): number[] | undefined {
+  if (process.platform !== 'linux') return undefined;
+  const probe: number = fs.openSync('/dev/null', 'r');
+  try {
+    const probeFlags: number | undefined = readFileDescriptorFlags(probe);
+    if (probeFlags === undefined || !isCloseOnExec(probeFlags)) return undefined;
+  } finally {
+    fs.closeSync(probe);
+  }
+  // @types/node does not declare the descriptor of the IPC channel.
+  const channelFd: number | undefined = (process.channel as { fd?: number } | undefined)?.fd;
+  const inherited: number[] = [];
+  for (const entry of fs.readdirSync('/proc/self/fd')) {
+    const fd: number = Number(entry);
+    if (fd <= 2 || fd === channelFd) continue;
+    const flags: number | undefined = readFileDescriptorFlags(fd);
+    // For example the descriptor that listed the folder, which is closed by now.
+    if (flags === undefined) continue;
+    if (!isCloseOnExec(flags)) inherited.push(fd);
+  }
+  return inherited;
+}
+
+/**
+ * Closes the file descriptors that {@link listInheritedFileDescriptors} lists, so that a program this process
+ * starts does not inherit them, and returns them. Returns `undefined`, and closes nothing, where they cannot be
+ * listed.
+ */
+export function closeInheritedFileDescriptors(): number[] | undefined {
+  const inherited: number[] | undefined = listInheritedFileDescriptors();
+  for (const fd of inherited ?? []) {
+    try {
+      fs.closeSync(fd);
+    } catch {
+      // Linux releases a descriptor even when closing it reports an error.
+    }
+  }
+  return inherited;
+}
+
+/** Whether the flags include O_CLOEXEC, which is a single bit. */
+function isCloseOnExec(flags: number): boolean {
+  return Math.floor(flags / LINUX_O_CLOEXEC) % 2 === 1;
+}
+
+/** Reads the open file flags of a descriptor of this process, or `undefined` if it is not open. */
+function readFileDescriptorFlags(fd: number): number | undefined {
+  let fdinfo: string;
+  try {
+    fdinfo = fs.readFileSync(`/proc/self/fdinfo/${fd}`, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+    throw error;
+  }
+  const match: RegExpMatchArray | null = fdinfo.match(/^flags:\s*([0-7]+)$/m);
+  return match ? parseInt(match[1], 8) : undefined;
+}
diff --git a/libraries/rush-client-core/src/NativeLockHolder.ts b/libraries/rush-client-core/src/NativeLockHolder.ts
new file mode 100644
index 00000000000..6b8a91d3f08
--- /dev/null
+++ b/libraries/rush-client-core/src/NativeLockHolder.ts
@@ -0,0 +1,120 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+
+import { describeStoppedState } from './DaemonOwnerDiagnosis';
+import { tryGetProcessStartTimeMs, tryGetProcessState } from './ProcessStartTime';
+
+/** The name of each lock file that LockFile.acquire(folder, 'rush') writes on Linux and macOS. */
+const LOCK_FILE_PATTERN: RegExp = /^rush#(\d+)\.lock$/;
+const SCRIPT_EXTENSION_PATTERN: RegExp = /\.[cm]?js$/;
+const PROGRAM_PATTERN: RegExp = /^[\w@.+-]{1,40}$/;
+const ACTION_PATTERN: RegExp = /^[a-z][\w:.-]{0,39}$/i;
+/** A process that began this long after a lock file was written cannot have written it: its PID was reused. */
+const PID_REUSE_MARGIN_MS: number = 2000;
+const HOLDER_DESCRIPTION: string = 'another Rush process';
+
+interface ILockFileCandidate {
+  readonly pid: number;
+  readonly writtenMs: number;
+}
+
+/**
+ * Names the process that holds Rush's repository lock in `lockFolder`, the common temp folder, as far as this
+ * platform can tell. Like LockFile, it treats the live process with the oldest lock file as the holder, and it
+ * ignores `ownPid`, empty lock files (processes still trying to acquire) and lock files of exited processes.
+ * Only Linux can tell a live holder from a stale lock file, so other platforms name no holder.
+ *
+ * The command is the program and its action, such as `rush install`. Later arguments can hold secrets, so they
+ * are never included. This reads files only, and never signals any process.
+ * @beta
+ */
+export function findNativeLockHolder(
+  lockFolder: string,
+  ownPid: number = process.pid
+): IDaemonNativeLockHolder {
+  if (process.platform !== 'linux') return {};
+  const holder: ILockFileCandidate | undefined = readLockFileCandidates(lockFolder, ownPid)
+    .sort((a, b) => a.writtenMs - b.writtenMs)
+    .find(isWrittenByLiveProcess);
+  if (!holder) return {};
+  const command: string | undefined = formatNativeLockCommand(readCommandLine(holder.pid));
+  return command === undefined ? { pid: holder.pid } : { pid: holder.pid, command };
+}
+
+/**
+ * Shortens the command line of a Node.js process to its program and action, for example
+ * `node /home/u/.rush/node_modules/@microsoft/rush/bin/rush install --bypass-policy` to `rush install`.
+ * Returns `undefined` when the command line does not run a script, or its program name is unusual.
+ * @beta
+ */
+export function formatNativeLockCommand(argv: readonly string[]): string | undefined {
+  const [, script, ...args] = argv;
+  if (!script || script.startsWith('-')) return undefined;
+  const program: string = path.basename(script).replace(SCRIPT_EXTENSION_PATTERN, '');
+  if (!PROGRAM_PATTERN.test(program)) return undefined;
+  // Only the first argument that is not an option can be the action; what follows it is never shown.
+  const action: string | undefined = args.find((arg) => !arg.startsWith('-'));
+  return action !== undefined && ACTION_PATTERN.test(action) ? `${program} ${action}` : program;
+}
+
+/**
+ * Describes the Rush process that holds the repository lock, for example
+ * `another Rush process (PID 12345: rush install)`, naming only what is known. On Linux, it also says when that
+ * process is stopped, which keeps it from releasing the lock until something resumes it, for example
+ * `another Rush process (PID 12345: rush install; it is stopped (state T), for example by SIGSTOP)`.
+ * @beta
+ */
+export function formatNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): string {
+  const pid: string | undefined = holder?.pid === undefined ? undefined : `PID ${holder.pid}`;
+  const details: string = [pid, holder?.command].filter((detail) => detail !== undefined).join(': ');
+  const stopped: string | undefined =
+    holder?.pid === undefined ? undefined : describeStoppedState(tryGetProcessState(holder.pid));
+  if (!details) return HOLDER_DESCRIPTION;
+  return stopped ? `${HOLDER_DESCRIPTION} (${details}; ${stopped})` : `${HOLDER_DESCRIPTION} (${details})`;
+}
+
+function readLockFileCandidates(lockFolder: string, ownPid: number): ILockFileCandidate[] {
+  let names: string[];
+  try {
+    names = fs.readdirSync(lockFolder);
+  } catch {
+    return [];
+  }
+  const candidates: ILockFileCandidate[] = [];
+  for (const name of names) {
+    const pid: number = Number(LOCK_FILE_PATTERN.exec(name)?.[1]);
+    if (!Number.isSafeInteger(pid) || pid === ownPid) continue;
+    const candidate: ILockFileCandidate | undefined = tryReadCandidate(path.join(lockFolder, name), pid);
+    if (candidate) candidates.push(candidate);
+  }
+  return candidates;
+}
+
+function tryReadCandidate(filePath: string, pid: number): ILockFileCandidate | undefined {
+  try {
+    const stats: fs.Stats = fs.statSync(filePath);
+    // A process writes its start time into its lock file right after creating it, and before it can hold the lock.
+    return stats.size > 0 ? { pid, writtenMs: stats.mtimeMs } : undefined;
+  } catch {
+    // The process released the lock and deleted its lock file.
+    return undefined;
+  }
+}
+
+function isWrittenByLiveProcess({ pid, writtenMs }: ILockFileCandidate): boolean {
+  const startMs: number | undefined = tryGetProcessStartTimeMs(pid);
+  return startMs !== undefined && startMs <= writtenMs + PID_REUSE_MARGIN_MS;
+}
+
+function readCommandLine(pid: number): string[] {
+  try {
+    return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0$/, '').split('\0');
+  } catch {
+    return [];
+  }
+}
diff --git a/libraries/rush-client-core/src/ProcessStartTime.ts b/libraries/rush-client-core/src/ProcessStartTime.ts
index a258752e5d2..e85c73b20b9 100644
--- a/libraries/rush-client-core/src/ProcessStartTime.ts
+++ b/libraries/rush-client-core/src/ProcessStartTime.ts
@@ -6,6 +6,8 @@ import { performance } from 'node:perf_hooks';
 
 // USER_HZ is fixed at 100 on mainstream Linux ABIs; it is verified against this process before use.
 const USER_HZ: number = 100;
+const PROC_STAT_STATE_FIELD: number = 3;
+const PROC_STAT_PARENT_PID_FIELD: number = 4;
 const PROC_STAT_START_TIME_FIELD: number = 22;
 const MAX_CALIBRATION_ERROR_MS: number = 1000;
 /** A process that began this long after a record was written cannot be the record's writer. */
@@ -48,7 +50,49 @@ function readUptimeSeconds(): number | undefined {
   }
 }
 
+/**
+ * True only on Linux when `pid` has exited but its parent has not reaped it yet. Such a zombie still accepts
+ * signal 0, but it can no longer run or hold connections.
+ */
+export function isProcessDefunct(pid: number): boolean {
+  if (process.platform !== 'linux') return false;
+  const state: string | undefined = readStatFields(pid)?.[PROC_STAT_STATE_FIELD - 3];
+  return state === 'Z' || state === 'X';
+}
+
+/** The scheduling state of a process, as Linux `/proc/<pid>/stat` shows it. */
+export interface IProcessState {
+  /** One letter, for example `R` (running), `S` (sleeping), `D` (waiting in the kernel) or `T` (stopped). */
+  readonly code: string;
+  readonly parentPid: number | undefined;
+  /** When it started, in clock ticks after boot, which tells it from a later process with the same PID. */
+  readonly startTicks?: number;
+}
+
+/** Returns the state of `pid` on Linux, or `undefined` when it cannot be read. */
+export function tryGetProcessState(pid: number): IProcessState | undefined {
+  if (process.platform !== 'linux') return undefined;
+  const fields: string[] | undefined = readStatFields(pid);
+  const code: string | undefined = fields?.[PROC_STAT_STATE_FIELD - 3];
+  if (!fields || !code) return undefined;
+  const parentPid: number = Number(fields[PROC_STAT_PARENT_PID_FIELD - 3]);
+  const startTicks: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
+  return {
+    code,
+    parentPid: Number.isSafeInteger(parentPid) && parentPid > 0 ? parentPid : undefined,
+    startTicks: Number.isSafeInteger(startTicks) && startTicks >= 0 ? startTicks : undefined
+  };
+}
+
 function readStartSeconds(pid: number | 'self'): number | undefined {
+  const fields: string[] | undefined = readStatFields(pid);
+  if (!fields) return undefined;
+  const jiffies: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
+  return Number.isSafeInteger(jiffies) && jiffies >= 0 ? jiffies / USER_HZ : undefined;
+}
+
+/** The fields of `/proc/<pid>/stat` from field 3 (the process state) on. */
+function readStatFields(pid: number | 'self'): string[] | undefined {
   let stat: string;
   try {
     stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
@@ -58,10 +102,8 @@ function readStartSeconds(pid: number | 'self'): number | undefined {
   // The command name (field 2) may contain spaces and parentheses; fields after it never do.
   const commandEnd: number = stat.lastIndexOf(')');
   if (commandEnd < 0) return undefined;
-  const fields: string[] = stat
+  return stat
     .slice(commandEnd + 1)
     .trim()
     .split(' ');
-  const jiffies: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
-  return Number.isSafeInteger(jiffies) && jiffies >= 0 ? jiffies / USER_HZ : undefined;
 }
diff --git a/libraries/rush-client-core/src/ReclaimedDaemonLog.ts b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
new file mode 100644
index 00000000000..39991e012f6
--- /dev/null
+++ b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
@@ -0,0 +1,195 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import {
+  formatOperationGroupLeftRunning,
+  type IDaemonOperationGroupLeftRunning,
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
+
+import { getDaemonLogFilePath } from './DaemonLogFile';
+
+/** Only the end of the log matters: once a daemon became ready after the reclaim, nothing is reported. */
+const MAX_LOG_READ_BYTES: number = 64 * 1024;
+const RECLAIM_LINE: RegExp =
+  /^\S+ rush-client \(PID \d+\): rushd \(PID (\d+)\) exited without shutting down;/;
+const RESET_LINE: RegExp = /^\S+ rush-client \(PID \d+\): reset the daemon's files;/;
+/** Every daemon writes this line once it is ready, with or without a time and PID before and after it. */
+const READY_LINE: RegExp = /\brushd ready at /;
+
+/**
+ * Appends a line to the workspace's launcher log that says that the daemon with this PID exited without shutting
+ * down and that this client reclaimed it. The reclaim removed the ownership record that named the daemon, so this
+ * line is what `rush-client daemon status` reads afterwards ({@link findReclaimedDaemonPid}). Best effort: it
+ * writes only to a regular, unshared file of this user, as the launcher does, and it never throws.
+ */
+export function logReclaimedDaemon(paths: IDaemonPaths, pid: number): void {
+  appendClientLine(
+    paths,
+    `rushd (PID ${pid}) exited without shutting down; stopped the operations it left running that could be ` +
+      'proven to be its own, and removed its ownership record and socket.'
+  );
+}
+
+/**
+ * Appends a line to the workspace's launcher log that names a process group that an exited daemon recorded
+ * for an operation and that a reclaim by this client left running, and says why
+ * (`formatOperationGroupLeftRunning`). Nothing goes to the terminal, because the group may be another
+ * program's; whoever later finds its processes can read here why they still run. Best effort; it never throws.
+ */
+export function logOperationGroupLeftRunning(
+  paths: IDaemonPaths,
+  group: IDaemonOperationGroupLeftRunning
+): void {
+  appendClientLine(paths, `${formatOperationGroupLeftRunning(group)}.`);
+}
+
+/**
+ * Returns the options for a reclaim of the workspace's daemon files by this client: `options.onOrphansReaped`
+ * as given, and `options.onOperationGroupLeftRunning`, or else {@link logOperationGroupLeftRunning} for each
+ * operation group that the reclaim leaves running. No other field of `options` reaches the transport.
+ */
+export function getClientReclaimOptions(
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions | undefined
+): IDaemonReclaimOptions {
+  return {
+    onOrphansReaped: options?.onOrphansReaped,
+    onOperationGroupLeftRunning:
+      options?.onOperationGroupLeftRunning ??
+      ((group: IDaemonOperationGroupLeftRunning) => logOperationGroupLeftRunning(paths, group))
+  };
+}
+
+/**
+ * Clears the report of the daemon that a client last reclaimed, if one is reported ({@link findReclaimedDaemonPid}),
+ * with a line in the launcher log, for a reset of the workspace's daemon files. Best effort; it never throws.
+ */
+export function clearReclaimedDaemonReport(paths: IDaemonPaths): void {
+  const pid: number | undefined = findReclaimedDaemonPid(paths);
+  if (pid !== undefined) {
+    appendClientLine(
+      paths,
+      `reset the daemon's files; the report that rushd (PID ${pid}) exited without shutting down is cleared.`
+    );
+  }
+}
+
+/**
+ * Returns the PID of the daemon that a client last reclaimed because it exited without shutting down, as the
+ * workspace's launcher log records it, unless a daemon became ready after that or `resetDaemonArtifactsAsync()`
+ * (`rush-client daemon stop --force`) cleared the report.
+ *
+ * @remarks
+ * A client reclaims such a daemon after it lost the connection to it, or before Rush runs in-process; the reclaim
+ * removes the daemon's ownership record and socket, and appends a line that names the daemon to the launcher log.
+ * This reads at most the log's last 64 KiB. It returns undefined when the log cannot be read, and never throws.
+ *
+ * @beta
+ */
+export function findReclaimedDaemonPid(paths: IDaemonPaths): number | undefined {
+  const lines: string[] | undefined = readLogTailLines(getDaemonLogFilePath(paths));
+  if (!lines) return undefined;
+  for (let index: number = lines.length - 1; index >= 0; index--) {
+    if (READY_LINE.test(lines[index]) || RESET_LINE.test(lines[index])) return undefined;
+    const match: RegExpExecArray | null = RECLAIM_LINE.exec(lines[index]);
+    if (match) {
+      const pid: number = Number(match[1]);
+      return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined;
+    }
+  }
+  return undefined;
+}
+
+interface IAppendableLog {
+  readonly fd: number;
+  /** Whether the log was also opened for reading. */
+  readonly readable: boolean;
+}
+
+/**
+ * Appends one line in the form of the launcher's own lines, under the launcher's checks of the log file. When
+ * the log ends inside a line, for example after a daemon that was killed before it finished one, the line starts
+ * on a line of its own, so that {@link findReclaimedDaemonPid} can read it; that needs a log this user may read.
+ */
+function appendClientLine(paths: IDaemonPaths, text: string): void {
+  let log: IAppendableLog | undefined;
+  try {
+    log = openLogForAppend(getDaemonLogFilePath(paths));
+    const stats: fs.BigIntStats = statOpenLog(log.fd);
+    if (!stats.isFile() || stats.nlink !== 1n) return;
+    if (process.platform !== 'win32') {
+      if (Number(stats.uid) !== process.getuid?.()) return;
+      fs.fchmodSync(log.fd, 0o600);
+    }
+    const separator: string = log.readable && endsInsideLine(log.fd, Number(stats.size)) ? '\n' : '';
+    fs.writeSync(
+      log.fd,
+      `${separator}${new Date().toISOString()} rush-client (PID ${process.pid}): ${text}\n`
+    );
+  } catch {
+    // Whatever the line reports is done; only the report of it is lost.
+  } finally {
+    if (log !== undefined) fs.closeSync(log.fd);
+  }
+}
+
+/** Opens the log to read it too when this user may, and else, as the launcher does, only to write to it. */
+function openLogForAppend(logFilePath: string): IAppendableLog {
+  // These distinct native flags have non-overlapping values.
+  const flags: number =
+    fs.constants.O_APPEND +
+    fs.constants.O_CREAT +
+    (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK);
+  try {
+    return { fd: fs.openSync(logFilePath, fs.constants.O_RDWR + flags, 0o600), readable: true };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'EACCES') throw error;
+    return { fd: fs.openSync(logFilePath, fs.constants.O_WRONLY + flags, 0o600), readable: false };
+  }
+}
+
+function endsInsideLine(fd: number, size: number): boolean {
+  if (size === 0) return false;
+  const lastByte: Buffer = Buffer.alloc(1);
+  return fs.readSync(fd, lastByte, 0, 1, size - 1) === 1 && lastByte[0] !== 0x0a;
+}
+
+/**
+ * Stats the open log. A plain stat would leave the log's file type in Node's shared stat array, and Node's cached
+ * realpath reads that array: after a FIFO, the next require() in this process would not resolve symlinks, so a
+ * package that pnpm installed could not find its dependencies. A bigint stat fills another array.
+ */
+function statOpenLog(fd: number): fs.BigIntStats {
+  return fs.fstatSync(fd, { bigint: true });
+}
+
+function readLogTailLines(logFilePath: string): string[] | undefined {
+  let fd: number | undefined;
+  try {
+    fd = fs.openSync(
+      logFilePath,
+      // These distinct native flags have non-overlapping values.
+      fs.constants.O_RDONLY +
+        (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK)
+    );
+    const stats: fs.BigIntStats = statOpenLog(fd);
+    if (!stats.isFile()) return undefined;
+    const size: number = Number(stats.size);
+    const start: number = Math.max(0, size - MAX_LOG_READ_BYTES);
+    const buffer: Buffer = Buffer.alloc(size - start);
+    const lines: string[] = buffer
+      .toString('utf8', 0, fs.readSync(fd, buffer, 0, buffer.length, start))
+      .split(/\r?\n/);
+    // A read that starts inside the log can start inside a line.
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return undefined;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
diff --git a/libraries/rush-client-core/src/StartupLock.ts b/libraries/rush-client-core/src/StartupLock.ts
index 6937b8bf1a5..1c5645726a5 100644
--- a/libraries/rush-client-core/src/StartupLock.ts
+++ b/libraries/rush-client-core/src/StartupLock.ts
@@ -1,53 +1,43 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
-import { DaemonClientError } from './DaemonClientError';
-
 export interface IStartupLock {
   releaseAsync(): Promise<void>;
 }
 
 export async function tryAcquireStartupLockAsync(paths: IDaemonPaths): Promise<IStartupLock | undefined> {
   const folder: string = path.dirname(paths.lockfilePath);
-  const lock: LockFile | undefined = LockFile.tryAcquire(
-    folder,
-    `${path.basename(paths.lockfilePath)}-start`
-  );
+  const lock: LockFile | undefined = LockFile.tryAcquire(folder, getStartupLockResourceName(paths));
   return lock ? { releaseAsync: async () => lock.release() } : undefined;
 }
 
-const RESERVATION_LOCK_TIMEOUT_MS: number = 5000;
-const RESERVATION_LOCK_RETRY_MS: number = 10;
-
 /**
- * Runs a short, synchronous read-check-write of the startup reservation while holding a dedicated lock.
- * The start lock cannot be used because a waiting client holds it for the whole startup, while the helper
- * must still be able to update or release its own reservation.
+ * Returns false when no process holds the start mutex. A `LockFile` owner keeps its file in the folder
+ * (`<resource>#<pid>.lock`, or `<resource>.lock` on Windows; see `LockFile.getLockFilePath()`), so without one
+ * the mutex is free. Unlike `tryAcquireStartupLockAsync()`, this runs no `ps` to learn the process start time.
+ * True means the mutex may be held, for example by a process that has exited without releasing it, or that the
+ * folder cannot be read.
  */
-export function withStartupReservationLock<T>(paths: IDaemonPaths, action: () => T): T {
-  const folder: string = path.dirname(paths.lockfilePath);
-  const name: string = `${path.basename(paths.lockfilePath)}-reservation`;
-  const deadline: number = Date.now() + RESERVATION_LOCK_TIMEOUT_MS;
-  const sleeper: Int32Array = new Int32Array(new SharedArrayBuffer(4));
-  let lock: LockFile | undefined = LockFile.tryAcquire(folder, name);
-  while (!lock) {
-    if (Date.now() >= deadline) {
-      throw new DaemonClientError(
-        'startupFailed',
-        `Timed out waiting for the daemon startup reservation lock in ${folder}.`
-      );
-    }
-    Atomics.wait(sleeper, 0, 0, RESERVATION_LOCK_RETRY_MS);
-    lock = LockFile.tryAcquire(folder, name);
-  }
+export function isStartupLockFilePresent(paths: IDaemonPaths): boolean {
+  const resourceName: string = getStartupLockResourceName(paths);
+  let names: string[];
   try {
-    return action();
-  } finally {
-    lock.release();
+    names = fs.readdirSync(path.dirname(paths.lockfilePath));
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code !== 'ENOENT';
   }
+  return names.some(
+    (name: string) =>
+      name === `${resourceName}.lock` || (name.startsWith(`${resourceName}#`) && name.endsWith('.lock'))
+  );
+}
+
+function getStartupLockResourceName(paths: IDaemonPaths): string {
+  return `${path.basename(paths.lockfilePath)}-start`;
 }
diff --git a/libraries/rush-client-core/src/StoppedDaemonOwner.ts b/libraries/rush-client-core/src/StoppedDaemonOwner.ts
new file mode 100644
index 00000000000..f00d110ecf3
--- /dev/null
+++ b/libraries/rush-client-core/src/StoppedDaemonOwner.ts
@@ -0,0 +1,109 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import {
+  getDefaultOwnerProcessReaders,
+  type IOwnerProcessReaders,
+  type IStoppedProcess
+} from './DaemonOwnerDiagnosis';
+import { isOwnerProcessAlive, readDaemonOwnership, type DaemonOwnership } from './DaemonOwnership';
+import type { IProcessState } from './ProcessStartTime';
+
+/**
+ * How long the recorded owner must stay stopped before a client stops waiting for it. A stop under job control
+ * (Ctrl+Z, then `fg`), a STOP/CONT pair or a tracer that stops the process at each system call is shorter.
+ */
+export const STOPPED_OWNER_WINDOW_MS: number = 1500;
+const STOPPED_OWNER_SAMPLE_INTERVAL_MS: number = 100;
+
+/**
+ * The daemon owner that the record at `paths.lockfilePath` names, when it has that record open, as the daemon that
+ * wrote it does for as long as it owns it (also after its socket file was deleted), and every sample of its state
+ * over {@link STOPPED_OWNER_WINDOW_MS} reads T or t, with the same start time. Until something resumes it, it
+ * cannot answer, and while it lives, no client starts another daemon. On Linux only.
+ * @returns `undefined` otherwise, including when a sample cannot be read, when the process resumed or its PID
+ * now names another process, when less than that window remains before `deadline`, and once `signal` aborts.
+ * The first sample ends the sampling for any other owner, or none.
+ */
+export async function findStoppedDaemonOwnerAsync(
+  paths: IDaemonPaths,
+  deadline: number,
+  signal?: AbortSignal,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders()
+): Promise<IStoppedProcess | undefined> {
+  if (deadline - Date.now() < STOPPED_OWNER_WINDOW_MS) return undefined;
+  const stopped: IStoppedProcess | undefined = readStoppedDaemonOwner(paths, readers);
+  if (!stopped) return undefined;
+  const end: number = Date.now() + STOPPED_OWNER_WINDOW_MS;
+  while (Date.now() < end) {
+    try {
+      await delayAsync(Math.min(STOPPED_OWNER_SAMPLE_INTERVAL_MS, Math.max(1, end - Date.now())), undefined, {
+        signal
+      });
+    } catch {
+      // Aborted: the caller no longer waits for the answer.
+      return undefined;
+    }
+    if (!isStillStopped(stopped, readers)) return undefined;
+  }
+  return stopped;
+}
+
+/**
+ * Whether this workspace's daemon cannot exit or answer before something resumes it: on Linux, the process that
+ * the ownership record at `paths.lockfilePath` names has that record open, as the daemon that wrote it does, and
+ * every sample of its state over 1.5 seconds reads stopped, by a signal (T) or a tracer (t), with the same start
+ * time. `rush-client daemon stop` uses it to stop waiting for such a daemon to exit.
+ * @returns `false` otherwise, including outside Linux, and at once when less than 1.5 seconds remain before
+ * `deadline`. The first sample ends the sampling for any other owner, or none.
+ * @beta
+ */
+export async function isDaemonOwnerStoppedAsync(paths: IDaemonPaths, deadline: number): Promise<boolean> {
+  return (await findStoppedDaemonOwnerAsync(paths, deadline)) !== undefined;
+}
+
+/**
+ * Whether the record at `paths.lockfilePath` still names `stopped`, which still has that record open and is still
+ * stopped (state T or t, with the same start time).
+ */
+export function isDaemonOwnerStillStopped(
+  paths: IDaemonPaths,
+  stopped: IStoppedProcess,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders()
+): boolean {
+  const current: IStoppedProcess | undefined = readStoppedDaemonOwner(paths, readers);
+  return current?.pid === stopped.pid && current.startTicks === stopped.startTicks;
+}
+
+function readStoppedDaemonOwner(
+  paths: IDaemonPaths,
+  readers: IOwnerProcessReaders
+): IStoppedProcess | undefined {
+  let owner: DaemonOwnership | undefined;
+  try {
+    owner = readDaemonOwnership(paths.lockfilePath);
+    if (!owner || !isOwnerProcessAlive(owner)) return undefined;
+  } catch {
+    // An unreadable record or a process of another user is no evidence of a stopped owner.
+    return undefined;
+  }
+  const state: IProcessState | undefined = readers.readState(owner.pid);
+  if (!state || !isStoppedState(state) || state.startTicks === undefined) return undefined;
+  // Only the daemon that wrote the record has it open, which ties the record to that process rather than to a
+  // reused PID.
+  if (readers.hasFileOpen(owner.pid, paths.lockfilePath) !== true) return undefined;
+  return { pid: owner.pid, startTicks: state.startTicks };
+}
+
+function isStillStopped(stopped: IStoppedProcess, readers: IOwnerProcessReaders): boolean {
+  const state: IProcessState | undefined = readers.readState(stopped.pid);
+  return state !== undefined && isStoppedState(state) && state.startTicks === stopped.startTicks;
+}
+
+function isStoppedState(state: IProcessState): boolean {
+  return state.code === 'T' || state.code === 't';
+}
diff --git a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
new file mode 100644
index 00000000000..baeaf6f1750
--- /dev/null
+++ b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
@@ -0,0 +1,245 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from './DaemonClient';
+import { DaemonClientError } from './DaemonClientError';
+import { LiveDaemonOwnerError, type IStoppedProcess } from './DaemonOwnerDiagnosis';
+import { DAEMON_RESET_HINT, findUnreachableDaemon, isEndpointUnboundAsync } from './DaemonOwnership';
+import { readDaemonStartupReservation, type IDaemonStartupReservation } from './DaemonStartup';
+import { getStartupHelperState } from './DaemonStartupReservation';
+import {
+  connectOrStartDaemonAsync,
+  tryConnectEndpointAsync,
+  type IConnectOrStartDaemonOptions
+} from './connectOrStartDaemon';
+import { isStartupLockFilePresent, tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+import { isDaemonOwnerStillStopped } from './StoppedDaemonOwner';
+
+/** A live process that can still make this workspace's daemon ready. */
+interface ILiveStartupOwner {
+  /** A listener at the endpoint, a startup helper that still waits for its daemon, or a start mutex holder. */
+  readonly kind: 'listener' | 'helper' | 'starter';
+  /** For example "Its startup helper (PID 123) is still waiting for the daemon". */
+  readonly description: string;
+}
+
+/** Matches the default of {@link IConnectOrStartDaemonOptions.startupTimeoutMs}. */
+const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
+/** Keeps a retry that fails at once from spinning until the deadline. */
+const RETRY_DELAY_MS: number = 100;
+const NOT_RUN_IN_PROCESS: string =
+  'Rush was not run in-process, where it would compete with that daemon for the repository.';
+
+/**
+ * Daemon startup did not finish in time, but a live process can still make the daemon ready, or this workspace's
+ * daemon still runs where no client can reach it. Unlike a {@link DaemonClientError}, this does not mean that
+ * running Rush in-process is safe: it would compete with that daemon for the repository.
+ * @beta
+ */
+export class DaemonStartupPendingError extends Error {
+  public constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'DaemonStartupPendingError';
+  }
+}
+
+/**
+ * Options for {@link connectOrAwaitDaemonStartupAsync}.
+ * @beta
+ */
+export interface IConnectOrAwaitDaemonStartupOptions extends IConnectOrStartDaemonOptions {
+  /**
+   * Called at most once, when startup did not finish in time but a live process can still make the daemon
+   * ready, just before this waits up to `waitMs` more for it. `owner` describes that process, for example
+   * "Its startup helper (PID 123) is still waiting for the daemon". A caller can say why it is still waiting.
+   */
+  onAwaitStartup?: (owner: string, waitMs: number) => void;
+}
+
+/**
+ * {@link connectOrStartDaemonAsync} for a caller that runs Rush in-process when the daemon is unavailable.
+ * @remarks When startup fails while a live process can still make the daemon ready (a listener at the endpoint,
+ * a startup helper that still waits for its daemon, or another client that holds the start mutex), this retries
+ * for one more startup deadline. If the daemon is still not ready, it rejects with a
+ * {@link DaemonStartupPendingError}. It rejects with a {@link DaemonClientError} only when no such process
+ * remains, so that the caller can run Rush in-process without competing with a daemon for the repository.
+ * When none remains but this workspace's daemon still runs where no client can reach it, for example after its
+ * socket file was deleted (on Linux: the process that the ownership record names is rushd and has that record
+ * open, as a daemon does for as long as it owns it), it rejects at once with a {@link DaemonStartupPendingError}
+ * that says what that daemon does. When the recorded owner has that record open, and a signal or a tracer kept it
+ * stopped while the last attempt sampled it (on Linux), it rejects with a {@link DaemonStartupPendingError}
+ * without waiting.
+ * @beta
+ */
+export async function connectOrAwaitDaemonStartupAsync(
+  options: IConnectOrAwaitDaemonStartupOptions
+): Promise<DaemonClient> {
+  try {
+    return await connectOrStartDaemonAsync(options);
+  } catch (error) {
+    if (!isStartupFailure(error)) throw error;
+    return await awaitLiveStartupAsync(options, error);
+  }
+}
+
+async function awaitLiveStartupAsync(
+  options: IConnectOrAwaitDaemonStartupOptions,
+  firstError: DaemonClientError
+): Promise<DaemonClient> {
+  const deadline: number = Date.now() + (options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS);
+  let lastError: DaemonClientError = firstError;
+  for (let attempt: number = 0; ; attempt++) {
+    const owner: ILiveStartupOwner | undefined = await findLiveStartupOwnerAsync(options.paths);
+    if (owner === undefined) {
+      // This workspace's daemon can still run where no client reaches it, for example after its socket file was
+      // deleted. It cannot become ready there, but in-process Rush would still compete with it.
+      const unreachable: LiveDaemonOwnerError | undefined = findUnreachableDaemon(options.paths);
+      if (unreachable)
+        throw new DaemonStartupPendingError(describeLiveOwner(unreachable), { cause: lastError });
+      throw lastError;
+    }
+    if (Date.now() >= deadline || isStoppedListener(options.paths, lastError, owner)) {
+      throw new DaemonStartupPendingError(describePendingStartup(lastError, owner), { cause: lastError });
+    }
+    if (attempt === 0) {
+      options.onAwaitStartup?.(owner.description, deadline - Date.now());
+    } else {
+      await delayAsync(Math.min(RETRY_DELAY_MS, Math.max(1, deadline - Date.now())), undefined, {
+        signal: options.abortSignal
+      });
+    }
+    try {
+      return await connectOrStartDaemonAsync({
+        ...options,
+        startupTimeoutMs: Math.max(1, deadline - Date.now())
+      });
+    } catch (error) {
+      if (!isStartupFailure(error)) throw error;
+      lastError = error;
+    }
+  }
+}
+
+/**
+ * Whether the last attempt found the recorded owner stopped while it had the ownership record open, as the daemon
+ * that wrote it does, and it still is: until something resumes it, it cannot answer, so waiting would only delay the
+ * same error.
+ */
+function isStoppedListener(
+  paths: IDaemonPaths,
+  lastError: DaemonClientError,
+  owner: ILiveStartupOwner
+): boolean {
+  const stopped: IStoppedProcess | undefined =
+    lastError instanceof LiveDaemonOwnerError ? lastError.stoppedProcess : undefined;
+  return stopped !== undefined && owner.kind === 'listener' && isDaemonOwnerStillStopped(paths, stopped);
+}
+
+/**
+ * When a live process owns the daemon's files, the message leads with what that process is doing and ends with
+ * what to do about it. The line between says that Rush was not run in-process, and first names a startup helper or
+ * a start mutex holder that it waited for, but not a listener at the endpoint: the first line already says that the
+ * daemon did not answer there.
+ */
+function describePendingStartup(lastError: DaemonClientError, owner: ILiveStartupOwner): string {
+  if (!(lastError instanceof LiveDaemonOwnerError)) {
+    return `${lastError.message} ${owner.description}, so ${NOT_RUN_IN_PROCESS} "rush-client daemon status" reports when the daemon is ready. ${DAEMON_RESET_HINT}`;
+  }
+  return describeLiveOwner(lastError, owner.kind === 'listener' ? '' : `${owner.description}, so `);
+}
+
+/**
+ * What the live owner is doing, that Rush was not run in-process, and what to do about it, each on a line of its
+ * own, so that a caller that shortens long lines, as agent output does, still shows all three.
+ */
+function describeLiveOwner(error: LiveDaemonOwnerError, reason: string = ''): string {
+  return `${error.description}\n${reason}${NOT_RUN_IN_PROCESS}\n${error.hint}`;
+}
+
+/**
+ * Connects to the daemon at this workspace's endpoint without starting one. When none listens but a live process
+ * can still make one ready there (a listener that has not completed hello/ping yet, a recorded startup helper
+ * that still waits for its daemon, or another client that holds the start mutex), this waits for that daemon
+ * and connects once it completes hello/ping, for up to `startupTimeoutMs` (15000 milliseconds by default).
+ * @remarks A caller that must not leave a daemon running, such as `rush-client daemon stop`, uses this instead
+ * of concluding from one refused connection that none runs: a daemon that is still starting becomes ready
+ * afterwards. It connects to a daemon of any implementation version, and never uses `startCommand`. Before it
+ * waits, it calls the optional `onAwaitStartup(owner, waitMs)` once.
+ * @returns `undefined` when nothing listens and no live process can still make a daemon ready.
+ * @throws {@link DaemonStartupPendingError} when such a process is still live at the deadline.
+ * @beta
+ */
+export async function connectToStartingDaemonAsync(
+  options: IConnectOrAwaitDaemonStartupOptions
+): Promise<DaemonClient | undefined> {
+  const timeoutMs: number = options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+  const deadline: number = Date.now() + timeoutMs;
+  const endpoint: IConnectOrStartDaemonOptions = { ...options, expectedDaemonVersion: undefined };
+  for (let attempt: number = 0; ; attempt++) {
+    const client: DaemonClient | undefined = await tryConnectEndpointAsync(endpoint, deadline);
+    if (client) return client;
+    const owner: ILiveStartupOwner | undefined = await findLiveStartupOwnerAsync(options.paths);
+    if (owner === undefined) {
+      // A startup that finished between the two checks leaves a ready daemon.
+      return await tryConnectEndpointAsync(endpoint, Math.max(deadline, Date.now() + 1000));
+    }
+    if (Date.now() >= deadline) {
+      throw new DaemonStartupPendingError(
+        `The daemon at ${options.paths.socketPath} is still starting after ${Math.round(timeoutMs / 1000)} s. ${owner.description}.`
+      );
+    }
+    if (attempt === 0) options.onAwaitStartup?.(owner.description, deadline - Date.now());
+    await delayAsync(Math.min(RETRY_DELAY_MS, Math.max(1, deadline - Date.now())), undefined, {
+      signal: options.abortSignal
+    });
+  }
+}
+
+function isStartupFailure(error: unknown): error is DaemonClientError {
+  return error instanceof DaemonClientError && (error.code === 'startupFailed' || error.code === 'timeout');
+}
+
+/**
+ * Describes a live process that can still make this workspace's daemon ready, or returns `undefined`.
+ * An ownership record alone is not such evidence: a daemon publishes it only after it binds, so a record
+ * next to an unbound endpoint belongs to a daemon that is shutting down or to a reused PID.
+ */
+async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<ILiveStartupOwner | undefined> {
+  if (!fs.existsSync(path.dirname(paths.lockfilePath))) return undefined;
+  if (!(await isEndpointUnboundAsync(paths.socketPath))) {
+    return {
+      kind: 'listener',
+      description: `A process listens at ${paths.socketPath} but was not ready in time`
+    };
+  }
+  let reservation: IDaemonStartupReservation | undefined;
+  try {
+    reservation = readDaemonStartupReservation(paths);
+  } catch {
+    // An unreadable reservation is no evidence of a live helper.
+  }
+  if (reservation?.helper && getStartupHelperState(reservation) === 'running') {
+    return {
+      kind: 'helper',
+      description: `Its startup helper (PID ${reservation.helper.pid}) is still waiting for the daemon`
+    };
+  }
+  // Without a lock file nothing holds the start mutex, and an idle `daemon stop` needs no `ps` run to tell.
+  if (!isStartupLockFilePresent(paths)) return undefined;
+  let lock: IStartupLock | undefined;
+  try {
+    lock = await tryAcquireStartupLockAsync(paths);
+  } catch {
+    // A start mutex that cannot be checked is no evidence of a live starter.
+    return undefined;
+  }
+  if (!lock) return { kind: 'starter', description: 'Another client is still starting the daemon' };
+  await lock.releaseAsync();
+  return undefined;
+}
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index f4848ab167a..cbe0d7479a7 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -11,17 +11,18 @@ import { DAEMON_LIFECYCLE_PROTOCOL_MINOR } from '@rushstack/rush-daemon-protocol
 import {
   DaemonTransportError,
   DaemonTransportErrorCode,
-  ensureDaemonRuntimeDir,
   reclaimStaleDaemonAsync,
   readDaemonLockfile,
   type IDaemonLockfile,
+  type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
 import { DaemonClient, type IDaemonClientConnectOptions } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
 import { formatDaemonLogTail, getDaemonLogFilePath } from './DaemonLogFile';
-import { describeExit, type IDaemonStartupOptions } from './DaemonStartup';
+import { createUnresponsiveOwnerError, type IStoppedProcess } from './DaemonOwnerDiagnosis';
+import { describeExit } from './DaemonStartup';
 import {
   DAEMON_RESET_HINT,
   hasErrorCode,
@@ -32,26 +33,50 @@ import {
   type DaemonOwnership
 } from './DaemonOwnership';
 import {
-  describeDaemonStartupReservation,
+  assertDaemonRuntimeFolderIsPrivate,
+  ensureDaemonRuntimeFolder,
+  withDaemonRuntimeFolder
+} from './DaemonRuntimeFolder';
+import {
   getDaemonStartupFilePath,
-  isDaemonStartupOwnerGone,
   readDaemonStartupReservation,
-  reclaimStaleDaemonStartupReservation,
-  releaseDaemonStartup,
-  removeDaemonStartupReservation,
   reserveDaemonStartup,
-  updateDaemonStartupReservation,
-  type DaemonStartupReservationRecord
+  type IDaemonStartupHelper,
+  type IDaemonStartupOptions,
+  type IDaemonStartupReservation
+} from './DaemonStartup';
+import {
+  getStartupHelperState,
+  getStartupRelaunchTime,
+  resolveStartupReservationForReadyDaemon,
+  tryResolveStartupReservationAsync,
+  tryTakeOverAbandonedStartupReservationAsync,
+  type DaemonStartupHelperState
 } from './DaemonStartupReservation';
+import { getClientReclaimOptions } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+import { findStoppedDaemonOwnerAsync } from './StoppedDaemonOwner';
 
 interface IStartupHelper {
   readonly child: ChildProcess;
   readonly closed: Promise<void>;
-  /** Launcher log size before this startup, so failures report only this attempt's output. */
+  /** The launcher log's size when the helper started, so its errors quote only this attempt's lines. */
   readonly logOffset: number;
 }
 
+/**
+ * The minimum time the detached helper waits for a live launcher to become ready. It is independent of the
+ * requesting client's deadline: a slow first start (for example while Windows scans newly installed files)
+ * would otherwise leave a retained reservation that keeps every later client from using the ready daemon.
+ */
+const STARTUP_HELPER_READINESS_TIMEOUT_MS: number = 120_000;
+
+/** Matches the default of {@link DaemonClient.shutdownAsync}. */
+const DEFAULT_SHUTDOWN_TIMEOUT_MS: number = 15000;
+
+/** How often a client that waits for another client's startup checks whether a startup reservation remains. */
+const STARTUP_RESERVATION_POLL_MS: number = 25;
+
 /** A version-selected launch command supplied by the embedding application, never guessed by the core. @beta */
 export interface IDaemonStartCommand {
   readonly command: string;
@@ -79,6 +104,12 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
   readonly startupTimeoutMs?: number;
   /** Cancels waiting/startup, without stopping startup already handed off to the detached helper. */
   readonly abortSignal?: AbortSignal;
+  /**
+   * Receives the operations that a reclaim stopped because the daemon that left them running had exited: before
+   * a daemon start, or after a connection to a daemon that exited was lost. When omitted, each is reported as a
+   * `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+   */
+  readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
 }
 
 /**
@@ -89,6 +120,26 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
  */
 export async function connectOrStartDaemonAsync(
   options: IConnectOrStartDaemonOptions
+): Promise<DaemonClient> {
+  return await connectOrStartAsync(options, false);
+}
+
+/**
+ * Like {@link connectOrStartDaemonAsync}, after `previousDaemon` answered a request with `retryAfterRestart`.
+ * @remarks That daemon releases its ownership and then launches the successor it selected, and its process exits
+ * only once that launch settles. A client that started a daemon meanwhile would race that launch, and if it won,
+ * the successor would have this client's environment rather than the one the restart was for. So while the
+ * previous process lives, this only connects; after it exits without a ready successor, this may start one.
+ */
+export async function connectToPlannedSuccessorAsync(
+  options: IConnectOrStartDaemonOptions & { readonly previousDaemon: DaemonOwnership }
+): Promise<DaemonClient> {
+  return await connectOrStartAsync(options, true);
+}
+
+async function connectOrStartAsync(
+  options: IConnectOrStartDaemonOptions,
+  previousStartsSuccessor: boolean
 ): Promise<DaemonClient> {
   const timeoutMs: number = options.startupTimeoutMs ?? 15000;
   if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 0x7fffffff) {
@@ -96,9 +147,18 @@ export async function connectOrStartDaemonAsync(
   }
   const deadline: number = Date.now() + timeoutMs;
   options.abortSignal?.throwIfAborted();
+  assertDaemonRuntimeFolderIsPrivate(options.paths);
   await waitForPreviousDaemonAsync(options.paths, options.previousDaemon, deadline, options.abortSignal);
-  const initial: DaemonClient | undefined = await tryConnectAsync(options, deadline);
+  const initial: DaemonClient | undefined = await tryConnectUnlessOwnerStoppedAsync(options, deadline);
   if (initial) return initial;
+  if (previousStartsSuccessor && options.previousDaemon) {
+    const successor: DaemonClient | undefined = await waitForPlannedSuccessorAsync(
+      options,
+      options.previousDaemon,
+      deadline
+    );
+    if (successor) return successor;
+  }
   const startCommand: IDaemonStartCommand | undefined =
     options.startCommand ?? (await options.resolveStartCommandAsync?.());
   if (!startCommand) {
@@ -116,52 +176,38 @@ export async function connectOrStartDaemonAsync(
       `No ready daemon at ${options.paths.socketPath}; auto-start is disabled.`
     );
   }
-  return await startDaemonAsync(
-    { ...options, startCommand, resolveStartCommandAsync: undefined },
-    deadline,
-    timeoutMs
-  );
+  return await startDaemonAsync({ ...options, startCommand, resolveStartCommandAsync: undefined }, deadline);
 }
 
 async function startDaemonAsync(
   options: IConnectOrStartDaemonOptions & { readonly startCommand: IDaemonStartCommand },
-  deadline: number,
-  timeoutMs: number
+  deadline: number
 ): Promise<DaemonClient> {
-  ensureDaemonRuntimeDir(options.paths);
+  ensureDaemonRuntimeFolder(options.paths);
   let lock: IStartupLock | undefined;
   let backoffMs: number = 50;
+  // Whether a startup reservation remained when this client last checked.
+  let reserved: boolean = false;
   while (Date.now() < deadline) {
     options.abortSignal?.throwIfAborted();
     lock = await tryAcquireStartupLockAsync(options.paths);
     if (lock) break;
-    await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
-      signal: options.abortSignal
-    });
+    reserved = await delayUntilStartupReleasedAsync(
+      options.paths,
+      reserved,
+      Math.min(backoffMs, Math.max(1, deadline - Date.now())),
+      options.abortSignal
+    );
     backoffMs = Math.min(500, backoffMs * 2);
     const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
     if (ready) return ready;
   }
   if (!lock) throw startupError(options, 'timed out waiting for another starting client');
   try {
-    while (fs.lstatSync(getDaemonStartupFilePath(options.paths), { throwIfNoEntry: false })) {
-      const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
-      if (ready) return ready;
-      // Holding the start lock, a verifiably abandoned reservation can be reclaimed without waiting.
-      if (reclaimStaleDaemonStartupReservation(options.paths, timeoutMs)) continue;
-      if (Date.now() >= deadline) {
-        throw startupError(
-          options,
-          `has an unresolved startup handoff at ${getDaemonStartupFilePath(options.paths)} ` +
-            `(${describeDaemonStartupReservation(options.paths)}); refusing another launch until it ` +
-            `becomes ready or stale. ${DAEMON_RESET_HINT}`,
-          formatDaemonLogTail(options.paths)
-        );
-      }
-      await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
-        signal: options.abortSignal
-      });
-    }
+    const abandonedHelper: IDaemonStartupHelper | undefined = await waitForStartupReservationAsync(
+      options,
+      deadline
+    );
     const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
     if (ready) return ready;
     const replacement: DaemonClient | undefined = await replaceMismatchedDaemonAsync(options, deadline);
@@ -169,15 +215,20 @@ async function startDaemonAsync(
     const handoff: DaemonClient | undefined = await waitForHandoffAsync(options, deadline);
     if (handoff) return handoff;
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before reclaim');
-    await reclaimAbandonedOwnershipAsync(options.paths);
-    await reclaimStaleDaemonAsync(options.paths);
+    await reclaimAbandonedOwnershipAsync(options.paths, { onOrphansReaped: options.onOrphansReaped });
+    await reclaimStaleDaemonAsync(
+      options.paths,
+      getClientReclaimOptions(options.paths, { onOrphansReaped: options.onOrphansReaped })
+    );
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before spawn');
     options.abortSignal?.throwIfAborted();
-    const helper: IStartupHelper = await spawnDetachedAsync(options, deadline);
+    const helper: IStartupHelper = await spawnDetachedAsync(options, deadline, abandonedHelper);
     const { child } = helper;
     backoffMs = 50;
     while (Date.now() < deadline) {
       options.abortSignal?.throwIfAborted();
+      // Read before connecting: the helper exits 0 only after it saw the daemon ready.
+      const helperSawReady: boolean = child.exitCode === 0;
       const client: DaemonClient | undefined = await tryConnectAsync(options, deadline);
       if (client) {
         try {
@@ -189,6 +240,13 @@ async function startDaemonAsync(
           throw error;
         }
       }
+      if (helperSawReady && hasReadyDaemonExited(options.paths)) {
+        await waitForHelperExitAsync(helper, options, deadline);
+        throw startupError(
+          options,
+          'failed: the daemon became ready but exited before this client connected, for example because "rush-client daemon stop" stopped it'
+        );
+      }
       if ((child.exitCode !== null && child.exitCode !== 0) || child.signalCode !== null) {
         await waitForHelperExitAsync(helper, options, deadline);
         throw startupError(
@@ -197,9 +255,13 @@ async function startDaemonAsync(
           formatDaemonLogTail(options.paths, helper.logOffset)
         );
       }
-      await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
-        signal: options.abortSignal
-      });
+      const delayMs: number = Math.min(backoffMs, Math.max(1, deadline - Date.now()));
+      // This process holds the start mutex, so it keeps a connection only after the helper releases the
+      // reservation, which the helper does just before it exits 0. So wake when the helper exits instead of
+      // sleeping out the step, unless it had exited 0 before this attempt, which then saw the release.
+      await (helperSawReady
+        ? delayAsync(delayMs, undefined, { signal: options.abortSignal })
+        : delayUntilHelperExitAsync(helper, delayMs, options.abortSignal));
       backoffMs = Math.min(500, backoffMs * 2);
     }
     throw startupError(
@@ -212,6 +274,103 @@ async function startDaemonAsync(
   }
 }
 
+/**
+ * Whether a daemon that answered hello has since exited. A daemon writes its lockfile before it can answer
+ * hello and removes it as it exits, so a missing lockfile with no startup in progress means it is gone.
+ * Waiting out the deadline instead would report a stop that won the race at readiness as a startup timeout.
+ */
+function hasReadyDaemonExited(paths: IDaemonPaths): boolean {
+  return !fs.existsSync(paths.lockfilePath) && !readDaemonStartupReservation(paths);
+}
+
+/**
+ * Holding the start mutex, waits until no startup reservation remains. The helper releases its reservation once
+ * the daemon completes hello/ping, and this client resolves it on the same evidence, so a daemon that became
+ * ready after its helper stopped waiting is still used. Once the helper is provably gone, nothing else will
+ * release the reservation: this client refuses another launch at once until the reservation's relaunch time, and
+ * then takes the reservation over as soon as nothing listens at the endpoint. Otherwise another launch is refused
+ * at the deadline.
+ * @returns the helper of a reservation that this client took over, if any.
+ */
+async function waitForStartupReservationAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
+): Promise<IDaemonStartupHelper | undefined> {
+  while (true) {
+    options.abortSignal?.throwIfAborted();
+    const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(options.paths);
+    if (!reservation) return undefined;
+    if (await tryResolveForReadyDaemonAsync(options, deadline)) continue;
+    if (await tryTakeOverAbandonedStartupReservationAsync(options.paths, reservation))
+      return reservation.helper;
+    const helperState: DaemonStartupHelperState = getStartupHelperState(reservation);
+    const now: number = Date.now();
+    const relaunchTime: number | undefined =
+      helperState === 'exited' ? getStartupRelaunchTime(reservation.helper!) : undefined;
+    const pendingRelaunchTime: number | undefined =
+      relaunchTime !== undefined && now < relaunchTime ? relaunchTime : undefined;
+    if (now >= deadline || pendingRelaunchTime !== undefined) {
+      // The helper may have released its reservation just before it exited or before the deadline.
+      const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(options.paths);
+      if (!current || current.contents !== reservation.contents) continue;
+      throw startupError(
+        options,
+        describeUnresolvedReservation(options.paths, reservation, helperState, pendingRelaunchTime),
+        formatDaemonLogTail(options.paths)
+      );
+    }
+    await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
+      signal: options.abortSignal
+    });
+  }
+}
+
+/**
+ * Resolves the startup reservation if a daemon of any version completes hello/ping at the endpoint, which is
+ * the readiness the helper waits for; the normal flow then replaces a mismatched daemon. The caller holds the
+ * start mutex.
+ */
+async function tryResolveForReadyDaemonAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
+): Promise<boolean> {
+  let client: DaemonClient | undefined;
+  try {
+    client = await tryConnectEndpointAsync({ ...options, expectedDaemonVersion: undefined }, deadline);
+  } catch (error) {
+    // Nor would the helper treat a daemon with an incompatible protocol as ready.
+    if (error instanceof DaemonClientError && error.code === 'versionMismatch') return false;
+    throw error;
+  }
+  if (!client) return false;
+  try {
+    return resolveStartupReservationForReadyDaemon(options.paths, (await client.status).pid);
+  } finally {
+    await client.closeAsync();
+  }
+}
+
+/** `pendingRelaunchTime` is the relaunch time of a helper that exited, while that time has not passed yet. */
+function describeUnresolvedReservation(
+  paths: IDaemonPaths,
+  reservation: IDaemonStartupReservation,
+  helperState: DaemonStartupHelperState,
+  pendingRelaunchTime: number | undefined
+): string {
+  const prefix: string = `has an unresolved startup handoff at ${getDaemonStartupFilePath(paths)}`;
+  const helperPid: number | undefined = reservation.helper?.pid;
+  switch (helperState) {
+    case 'exited':
+      return pendingRelaunchTime !== undefined
+        ? `${prefix}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch until ${new Date(pendingRelaunchTime).toISOString()}, so that a daemon that cannot start is not launched by every command.`
+        : `${prefix}: its startup helper (PID ${helperPid}) exited before the daemon became ready, but a process still accepts connections at ${paths.socketPath}; refusing another launch. ${DAEMON_RESET_HINT}`;
+    case 'running':
+      return `${prefix}: its startup helper (PID ${helperPid}) is still waiting for the daemon to become ready; refusing another launch`;
+    default:
+      return `${prefix}; refusing another launch. ${DAEMON_RESET_HINT}`;
+  }
+}
+
 /**
  * Captures attested ownership and requests shutdown without claiming that cleanup has finished.
  * Pass the returned identity as previousDaemon to connectOrStartDaemonAsync before replacement.
@@ -237,10 +396,79 @@ export async function requestDaemonShutdownAsync(
     pid: owner.pid,
     startedAt: owner.startedAt
   };
+  await resolveReservationBeforeShutdownAsync(paths, pid, timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS);
   await client.shutdownAsync(timeoutMs);
   return previousDaemon;
 }
 
+/**
+ * A retained startup reservation would refuse the successor's launch, so it is resolved first; `pid` answered
+ * hello/ping and is attested as the owner. Waits for the start mutex, since another client may be resolving it.
+ */
+async function resolveReservationBeforeShutdownAsync(
+  paths: IDaemonPaths,
+  pid: number,
+  timeoutMs: number
+): Promise<void> {
+  if (!readDaemonStartupReservation(paths)) return;
+  const lock: IStartupLock | undefined = await waitForStartupLockAsync(paths, timeoutMs);
+  if (!lock) {
+    throw new DaemonClientError(
+      'startupFailed',
+      `Another client is starting or resetting the daemon for ${paths.lockfilePath}; shutdown was not sent.`
+    );
+  }
+  try {
+    if (!resolveStartupReservationForReadyDaemon(paths, pid)) {
+      throw new DaemonClientError(
+        'startupFailed',
+        `The daemon startup reservation at ${getDaemonStartupFilePath(paths)} could not be resolved for PID ${pid}; shutdown was not sent.`
+      );
+    }
+  } finally {
+    await lock.releaseAsync();
+  }
+}
+
+/**
+ * Resolves a startup reservation that remains next to a connected, ready daemon before that daemon is stopped.
+ * Afterwards no ready daemon would prove the reservation stale, so it would refuse every automatic start. The
+ * daemon must be the live owner in the ownership record for the endpoint, and the reservation is removed only
+ * if unchanged. Waits for the start mutex for up to `timeoutMs` (15000 milliseconds by default), since another
+ * client may be resolving it.
+ * @returns true when no reservation remains; false when one is kept.
+ * @beta
+ */
+export async function resolveDaemonStartupReservationAsync(
+  client: DaemonClient,
+  paths: IDaemonPaths,
+  timeoutMs: number = DEFAULT_SHUTDOWN_TIMEOUT_MS
+): Promise<boolean> {
+  if (!readDaemonStartupReservation(paths)) return true;
+  const { pid } = await client.status;
+  const lock: IStartupLock | undefined = await waitForStartupLockAsync(paths, timeoutMs);
+  if (!lock) return false;
+  try {
+    return resolveStartupReservationForReadyDaemon(paths, pid);
+  } finally {
+    await lock.releaseAsync();
+  }
+}
+
+/** Returns undefined when another client still holds the start mutex after `timeoutMs`. */
+async function waitForStartupLockAsync(
+  paths: IDaemonPaths,
+  timeoutMs: number
+): Promise<IStartupLock | undefined> {
+  const deadline: number = Date.now() + timeoutMs;
+  let lock: IStartupLock | undefined;
+  while (!(lock = await tryAcquireStartupLockAsync(paths))) {
+    if (Date.now() >= deadline) return undefined;
+    await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())));
+  }
+  return lock;
+}
+
 async function replaceMismatchedDaemonAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
@@ -269,27 +497,73 @@ async function replaceMismatchedDaemonAsync(
   return await tryConnectAsync(options, deadline);
 }
 
+/**
+ * Like {@link tryConnectAsync}, but when the recorded owner has the ownership record open, as the daemon that wrote
+ * it does, and a signal or a tracer keeps it stopped, it samples that process meanwhile, and throws what it is
+ * doing once it stayed stopped for 1.5 s: waiting longer for a daemon that cannot answer until something resumes
+ * it would only delay the same error. For any other owner, or none, the first sample ends the sampling, so a ready
+ * daemon or an endpoint that refuses connections costs no wait.
+ */
+async function tryConnectUnlessOwnerStoppedAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
+): Promise<DaemonClient | undefined> {
+  const connecting: Promise<DaemonClient | undefined> = tryConnectAsync(options, deadline);
+  const sampling: AbortController = new AbortController();
+  const stoppedOwner: Promise<IStoppedProcess | undefined> = findStoppedDaemonOwnerAsync(
+    options.paths,
+    deadline,
+    options.abortSignal ? AbortSignal.any([options.abortSignal, sampling.signal]) : sampling.signal
+  );
+  try {
+    const client: DaemonClient | undefined = await connecting;
+    if (client) return client;
+    throwIfOwnerStopped(options.paths, await stoppedOwner);
+    return undefined;
+  } finally {
+    sampling.abort();
+    await stoppedOwner;
+  }
+}
+
+function throwIfOwnerStopped(paths: IDaemonPaths, stopped: IStoppedProcess | undefined): void {
+  if (stopped) throw createUnresponsiveOwnerError(stopped.pid, paths, undefined, stopped);
+}
+
 async function tryConnectAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
+): Promise<DaemonClient | undefined> {
+  const client: DaemonClient | undefined = await tryConnectEndpointAsync(options, deadline);
+  if (!client) return undefined;
+  // Do not expose a just-started daemon to shutdown/restart until its startup reservation is resolved:
+  // by the helper, or here once the daemon is ready. This never waits for the start mutex. The mutex
+  // holder resolves an earlier reservation itself before it spawns a helper, then waits for that helper
+  // to release the new one.
+  let usable: boolean = false;
+  try {
+    options.abortSignal?.throwIfAborted();
+    usable =
+      !readDaemonStartupReservation(options.paths) ||
+      (await tryResolveStartupReservationAsync(client, options.paths));
+  } finally {
+    if (!usable) await client.closeAsync();
+  }
+  return usable ? client : undefined;
+}
+
+/** Connects and completes hello/ping, whether or not a startup reservation remains. */
+export async function tryConnectEndpointAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
 ): Promise<DaemonClient | undefined> {
   options.abortSignal?.throwIfAborted();
   try {
-    const client: DaemonClient = await DaemonClient.connectAsync({
+    return await DaemonClient.connectAsync({
       ...options,
       socketPath: options.paths.socketPath,
       timeoutMs: Math.min(options.timeoutMs ?? 1000, Math.max(1, deadline - Date.now()))
     });
-    // A reservation normally means the helper has not finished the handoff. An endpoint that answers
-    // hello/ping and matches the published ownership record is nevertheless ready, so accept it.
-    let accepted: boolean = false;
-    try {
-      options.abortSignal?.throwIfAborted();
-      accepted = await isReadyDespiteReservationAsync(client, options.paths);
-    } finally {
-      if (!accepted) await client.closeAsync();
-    }
-    return accepted ? client : undefined;
   } catch (error) {
     options.abortSignal?.throwIfAborted();
     if (
@@ -317,17 +591,26 @@ async function tryConnectAsync(
   }
 }
 
-async function isReadyDespiteReservationAsync(client: DaemonClient, paths: IDaemonPaths): Promise<boolean> {
-  const reservation: DaemonStartupReservationRecord = readDaemonStartupReservation(paths);
-  if (reservation === undefined) return true;
-  const { pid } = await client.status;
-  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
-  if (!isDaemonOwnership(owner) || owner.pid !== pid || owner.socketPath !== paths.socketPath) return false;
-  // A live helper releases its own reservation; clean up only after an owner that can no longer do so.
-  if (typeof reservation !== 'object' || isDaemonStartupOwnerGone(reservation)) {
-    removeDaemonStartupReservation(paths, reservation);
+/** Connects to a successor while the previous daemon process lives; undefined once it has exited without one. */
+async function waitForPlannedSuccessorAsync(
+  options: IConnectOrStartDaemonOptions,
+  previous: DaemonOwnership,
+  deadline: number
+): Promise<DaemonClient | undefined> {
+  while (isOwnerProcessAlive(previous)) {
+    if (Date.now() >= deadline) {
+      throw startupError(
+        options,
+        `timed out waiting for the successor that the previous daemon (PID ${previous.pid}) is starting`
+      );
+    }
+    await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
+      signal: options.abortSignal
+    });
+    const successor: DaemonClient | undefined = await tryConnectAsync(options, deadline);
+    if (successor) return successor;
   }
-  return true;
+  return undefined;
 }
 
 async function waitForHandoffAsync(
@@ -345,6 +628,10 @@ async function waitForHandoffAsync(
       !isOwnerProcessAlive(owner)
     )
       return undefined;
+    throwIfOwnerStopped(
+      options.paths,
+      await findStoppedDaemonOwnerAsync(options.paths, deadline, options.abortSignal)
+    );
     await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
       signal: options.abortSignal
     });
@@ -359,10 +646,7 @@ async function waitForHandoffAsync(
 function assertNoLiveOwner(paths: IDaemonPaths): void {
   const owner: DaemonOwnership | undefined = readDaemonOwnership(paths.lockfilePath);
   if (!owner || !isOwnerProcessAlive(owner)) return;
-  throw new DaemonClientError(
-    'startupFailed',
-    `PID ${owner.pid} still exists but the daemon is not ready. It may be a daemon that is still shutting down, or a reused PID; refusing to kill it or remove ${paths.lockfilePath}. ${DAEMON_RESET_HINT}`
-  );
+  throw createUnresponsiveOwnerError(owner.pid, paths);
 }
 
 async function readHandoffOwnershipAsync(
@@ -430,11 +714,13 @@ async function waitForPreviousDaemonAsync(
 
 async function spawnDetachedAsync(
   options: IConnectOrStartDaemonOptions,
-  deadline: number
+  deadline: number,
+  abandonedHelper: IDaemonStartupHelper | undefined
 ): Promise<IStartupHelper> {
   const start: IDaemonStartCommand = {
     ...options.startCommand!,
-    cwd: path.resolve(options.startCommand!.cwd)
+    cwd: path.resolve(options.startCommand!.cwd),
+    environment: withDaemonRuntimeFolder(options.startCommand!.environment, options.paths)
   };
   const logFilePath: string = getDaemonLogFilePath(options.paths);
   // These distinct native flags have non-overlapping values.
@@ -443,23 +729,42 @@ async function spawnDetachedAsync(
     fs.constants.O_APPEND +
     fs.constants.O_CREAT +
     (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK);
-  const logFd: number = fs.openSync(logFilePath, flags, 0o600);
+  let logFd: number;
   try {
-    const stats: fs.Stats = fs.fstatSync(logFd);
-    if (!stats.isFile() || stats.nlink !== 1) {
+    logFd = fs.openSync(logFilePath, flags, 0o600);
+  } catch (error) {
+    // For example a symlink, a directory, a FIFO without a reader, or a file that this user may not write to.
+    throw new DaemonClientError(
+      'startupFailed',
+      `Launcher log cannot be opened for writing (${(error as NodeJS.ErrnoException).code}): ${logFilePath}`,
+      { cause: error }
+    );
+  }
+  try {
+    // A plain stat would leave the log's file type in Node's shared stat array, which Node's cached realpath reads:
+    // after a FIFO, a later require() in this process, such as by Rush run in-process, would not resolve symlinks.
+    const stats: fs.BigIntStats = fs.fstatSync(logFd, { bigint: true });
+    if (!stats.isFile() || stats.nlink !== 1n) {
       throw new DaemonClientError(
         'startupFailed',
         `Launcher log must be a regular, unshared file: ${logFilePath}`
       );
     }
     if (process.platform !== 'win32') {
-      if (stats.uid !== process.getuid?.()) {
+      if (Number(stats.uid) !== process.getuid?.()) {
         throw new DaemonClientError('startupFailed', `Launcher log is owned by another user: ${logFilePath}`);
       }
       fs.fchmodSync(logFd, 0o600);
     }
-    const logOffset: number = stats.size;
-    const token: string = reserveDaemonStartup(options.paths, Math.max(1, deadline - Date.now()));
+    let logOffset: number = Number(stats.size);
+    if (abandonedHelper) {
+      logOffset += fs.writeSync(
+        logFd,
+        `${new Date().toISOString()} rush-client (PID ${process.pid}): took over the startup reservation of ` +
+          `startup helper PID ${abandonedHelper.pid} (started ${abandonedHelper.startedAt}), which exited ` +
+          'before the daemon became ready; starting the daemon again.\n'
+      );
+    }
     let helper: IStartupHelper | undefined;
     try {
       const child: ChildProcess = spawn(process.execPath, [path.join(__dirname, 'runDaemonStartup.js')], {
@@ -476,7 +781,6 @@ async function spawnDetachedAsync(
       await once(child, 'spawn');
     } catch (error) {
       if (helper) await helper.closed;
-      releaseDaemonStartup(options.paths, token);
       throw new DaemonClientError(
         'startupFailed',
         `Unable to start ${start.command}; inspect ${logFilePath}.`,
@@ -484,20 +788,33 @@ async function spawnDetachedAsync(
       );
     }
     const { child } = helper;
+    const helperTimeoutMs: number = Math.max(STARTUP_HELPER_READINESS_TIMEOUT_MS, deadline - Date.now());
+    const helperStartedAt: string = new Date().toISOString();
+    const helperReadinessDeadline: string = new Date(Date.now() + helperTimeoutMs).toISOString();
+    let token: string;
+    try {
+      // The helper launches nothing until it receives its options, so the reservation can name it first.
+      // Its start time is taken after the spawn, so the helper can never look like a later reuse of its PID.
+      token = reserveDaemonStartup(options.paths, {
+        pid: child.pid!,
+        startedAt: helperStartedAt,
+        readinessDeadline: helperReadinessDeadline
+      });
+    } catch (error) {
+      // Disconnected without options, the helper exits without launching.
+      child.disconnect();
+      await helper.closed;
+      throw error;
+    }
     child.unref();
     const startup: IDaemonStartupOptions = {
       paths: options.paths,
       startCommand: start,
       token,
-      timeoutMs: Math.max(1, deadline - Date.now())
+      timeoutMs: helperTimeoutMs
     };
     let delivered: boolean = false;
     try {
-      // Record the helper before handing off, so the reservation stays live exactly as long as the helper.
-      updateDaemonStartupReservation(options.paths, token, {
-        ownerPid: child.pid!,
-        ownerStartedAt: new Date().toISOString()
-      });
       await new Promise<void>((resolve, reject) => {
         child.send(startup, (error) => (error ? reject(error) : resolve()));
       });
@@ -537,13 +854,56 @@ async function waitForHelperExitAsync(
   }
 }
 
+/** Waits `delayMs`, or until the startup helper exits if that is sooner, and then cancels the timer. */
+async function delayUntilHelperExitAsync(
+  helper: IStartupHelper,
+  delayMs: number,
+  abortSignal: AbortSignal | undefined
+): Promise<void> {
+  const timer: AbortController = new AbortController();
+  const signal: AbortSignal = abortSignal ? AbortSignal.any([abortSignal, timer.signal]) : timer.signal;
+  try {
+    await Promise.race([delayAsync(delayMs, undefined, { signal }), helper.closed]);
+  } finally {
+    timer.abort();
+  }
+}
+
+/**
+ * Waits `delayMs`, or until a startup reservation that this client saw is released if that is sooner. While another
+ * client holds the start mutex, this client drops each connection as long as a reservation remains (see
+ * `tryConnectAsync()`), and the reservation is released once the daemon completes hello/ping, so the next
+ * connection can be kept. Checks every {@link STARTUP_RESERVATION_POLL_MS} milliseconds, since a reservation can
+ * also appear during the wait. `wasReserved` tells whether a reservation remained at this client's previous check,
+ * which may have been in an earlier wait.
+ * @returns Whether a reservation remained at the last check.
+ */
+async function delayUntilStartupReleasedAsync(
+  paths: IDaemonPaths,
+  wasReserved: boolean,
+  delayMs: number,
+  abortSignal: AbortSignal | undefined
+): Promise<boolean> {
+  const end: number = Date.now() + delayMs;
+  let previous: boolean = wasReserved;
+  while (true) {
+    const reserved: boolean = readDaemonStartupReservation(paths) !== undefined;
+    const remainingMs: number = end - Date.now();
+    if ((previous && !reserved) || remainingMs <= 0) return reserved;
+    previous = reserved;
+    await delayAsync(Math.min(STARTUP_RESERVATION_POLL_MS, remainingMs), undefined, { signal: abortSignal });
+  }
+}
+
+/** `logTail` is the launcher log's last lines from {@link formatDaemonLogTail}, which often name the real cause. */
 function startupError(
   options: IConnectOrStartDaemonOptions,
   reason: string,
   logTail: string = ''
 ): DaemonClientError {
+  const sentence: string = /[.!?]$/.test(reason) ? reason : `${reason}.`;
   return new DaemonClientError(
     'startupFailed',
-    `Daemon startup ${reason}. Inspect ${getDaemonLogFilePath(options.paths)} and retry, or use --no-daemon.${logTail}`
+    `Daemon startup ${sentence} Inspect ${getDaemonLogFilePath(options.paths)} and retry, or use --no-daemon.${logTail}`
   );
 }
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index e0d85636480..4ccd8e0c2da 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -3,13 +3,32 @@
 
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from '@rushstack/rush-daemon-protocol';
+import {
+  DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR,
+  type DaemonRestartReason,
+  type IDaemonRequestAdmissionOptions,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
-import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
+import {
+  connectOrStartDaemonAsync,
+  connectToPlannedSuccessorAsync,
+  type IConnectOrStartDaemonOptions
+} from './connectOrStartDaemon';
 import { captureDaemonRequest } from './captureDaemonRequest';
 import type { DaemonClient, DaemonClientOutcome, IDaemonClientExecuteOptions } from './DaemonClient';
-import { DaemonClientError } from './DaemonClientError';
+import {
+  DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE,
+  DAEMON_DISCONNECTED_MESSAGE,
+  DaemonClientError
+} from './DaemonClientError';
+import {
+  DaemonExitedWhileQueuedError,
+  explainLostConnectionAsync,
+  observeServingDaemonAsync,
+  type IServingDaemon
+} from './DaemonDisconnect';
 
 /**
  * The maximum number of successors a single request follows. Each restart serves at least one other
@@ -22,29 +41,129 @@ const RETRY_JITTER_MAX_MS: number = 1000;
 const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
 
 /**
- * Executes on a ready client, retrying only for a typed pre-execution restart.
- * Preserves the original request, callbacks and unread input; never retries connection loss.
- * Restarts are retried with jittered backoff inside the request's admission deadline; once the
- * retries or the deadline are exhausted, a `fallback` outcome lets the caller run in-process instead.
+ * A new daemon that a request followed: a successor that a daemon restart started, or, with `exitedPid`, a new daemon
+ * that the request is sent to because the previous one exited while the request waited in its queue. That notice
+ * comes before the new daemon starts, so that the wait for it is not silent.
+ * @beta
+ */
+export interface IDaemonRestartNotice {
+  /** 1 for the first new daemon that the request followed. */
+  readonly restart: number;
+  /** Why the previous daemon asked for the restart; `undefined` when it did not say, or with `exitedPid`. */
+  readonly reason: DaemonRestartReason | undefined;
+  /** The process ID of the daemon that the request is sent to next; `undefined` with `exitedPid`. */
+  readonly successorPid: number | undefined;
+  /**
+   * Set when the previous daemon exited while the request waited in its queue, before it started the request: that
+   * daemon's process ID.
+   */
+  readonly exitedPid?: number;
+}
+
+/**
+ * Options for {@link executeWithDaemonRestartAsync}.
+ * @beta
+ */
+export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOptions {
+  /** Called after a new daemon is ready, before the request is sent to it. */
+  readonly onRestartAsync?: (notice: IDaemonRestartNotice) => Promise<void>;
+}
+
+/**
+ * Thrown by {@link executeWithDaemonRestartAsync} when the previous daemon said why it restarted and the daemon that
+ * replaces it did not become ready. Its code and message are those of the startup error, which is its cause.
+ * @beta
+ */
+export class DaemonRestartFailedError extends DaemonClientError {
+  /** Why the previous daemon asked for the restart. */
+  public readonly restartReason: DaemonRestartReason;
+
+  public constructor(startupError: DaemonClientError, restartReason: DaemonRestartReason) {
+    super(startupError.code, startupError.message, { cause: startupError });
+    this.name = 'DaemonRestartFailedError';
+    this.restartReason = restartReason;
+  }
+}
+
+/**
+ * Executes on a ready client, retrying for a typed pre-execution restart, and once for a daemon that exited while
+ * the request waited in its queue.
+ * Preserves the original request, callbacks and unread input; retries no other connection loss.
+ * Restarts are retried with jittered backoff inside the request's explicit admission deadline, if any (a
+ * client-default timeout applies to each daemon separately); once the retries or the deadline are exhausted,
+ * a `fallback` outcome lets the caller run in-process instead.
  * The connection options must select the request's expected daemon and startup environment.
+ * A connection lost before the result is reported as a `disconnected` error that says whether the daemon
+ * process exited, what its launcher log recorded and how to recover, unless the request was aborted first.
+ * If the daemon exited while the request waited in its queue and had not started it (see
+ * {@link DaemonClient.queuedWithoutStarting}), the request is instead sent to a new daemon, started as
+ * `connectOrStartDaemonAsync` would. Before that daemon starts, `onRestartAsync` gets the exited daemon's PID as
+ * `exitedPid`. That happens once per call, and within an explicit admission deadline.
  * @beta
  */
 export async function executeWithDaemonRestartAsync(
   client: DaemonClient,
   connection: IConnectOrStartDaemonOptions,
-  execution: IDaemonClientExecuteOptions
+  options: IExecuteWithDaemonRestartOptions
 ): Promise<DaemonClientOutcome> {
+  const { onRestartAsync, ...execution } = options;
   const startedAt: number = Date.now();
   const abortSignal: AbortSignal | undefined =
     execution.abortSignal && connection.abortSignal
       ? AbortSignal.any([execution.abortSignal, connection.abortSignal])
       : (execution.abortSignal ?? connection.abortSignal);
-  const waitTimeoutMs: number | undefined = execution.request.admission?.waitTimeoutMs;
+  const admission: IDaemonRequestAdmissionOptions | undefined = execution.request.admission;
+  // A client-default timeout applies to each daemon's own admission, not to following its restarts: a daemon
+  // restarts only after the requests it serves finish, which is progress, so each successor gets the original
+  // request. An explicit timeout is one deadline across restarts.
+  const waitTimeoutMs: number | undefined = admission?.waitTimeoutIsDefault
+    ? undefined
+    : admission?.waitTimeoutMs;
+  const attempts: IRequestAttempts = {
+    connection,
+    execution: { ...execution, abortSignal },
+    onRestartAsync,
+    getRemainingMs: () =>
+      waitTimeoutMs === undefined ? undefined : waitTimeoutMs - (Date.now() - startedAt),
+    followed: 0
+  };
+  try {
+    return await followRestartsAsync(client, execution.request, attempts);
+  } catch (error) {
+    if (!(error instanceof DaemonExitedWhileQueuedError)) throw error;
+    return await resendAfterExitAsync(error, attempts);
+  }
+}
+
+/** One call's state across the daemons that its request is sent to. */
+interface IRequestAttempts {
+  readonly connection: IConnectOrStartDaemonOptions;
+  /** The execution options, with an abort signal that also observes the connection's. */
+  readonly execution: IDaemonClientExecuteOptions;
+  readonly onRestartAsync: IExecuteWithDaemonRestartOptions['onRestartAsync'];
+  /** The time left before the explicit admission deadline, or `undefined` without one. */
+  readonly getRemainingMs: () => number | undefined;
+  /** How many new daemons the request has followed. */
+  followed: number;
+}
+
+/** Sends `request` to `client`, then to each successor that a typed pre-execution restart names. */
+async function followRestartsAsync(
+  client: DaemonClient,
+  request: IDaemonRequestEnvelope,
+  attempts: IRequestAttempts
+): Promise<DaemonClientOutcome> {
+  const { connection, execution, onRestartAsync, getRemainingMs } = attempts;
+  const { abortSignal } = execution;
   let owner: IDaemonLockfile | undefined = await attestOwnerAsync(client, connection);
-  let outcome: DaemonClientOutcome = await client.executeAsync({ ...execution, abortSignal });
+  let outcome: DaemonClientOutcome = await executeOnDaemonAsync(client, connection, {
+    ...execution,
+    request
+  });
   let previous: DaemonClient | undefined;
   try {
     for (let retry: number = 1; outcome.kind === 'result' && outcome.result.retryAfterRestart; retry++) {
+      const reason: DaemonRestartReason | undefined = outcome.result.restartReason;
       if (!owner) {
         throw new DaemonClientError(
           'startupFailed',
@@ -52,8 +171,6 @@ export async function executeWithDaemonRestartAsync(
         );
       }
       if (abortSignal?.aborted) return abortedOutcome(execution);
-      const getRemainingMs = (): number | undefined =>
-        waitTimeoutMs === undefined ? undefined : waitTimeoutMs - (Date.now() - startedAt);
       if (retry > MAX_RESTART_RETRIES || isExpired(getRemainingMs())) {
         return restartExhaustedOutcome(retry - 1);
       }
@@ -70,25 +187,23 @@ export async function executeWithDaemonRestartAsync(
         const startupTimeoutMs: number = connection.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
         // The successor handoff shares the request's admission deadline rather than starting a fresh one.
         boundedByAdmission = remainingMs !== undefined && remainingMs < startupTimeoutMs;
-        successor = await connectOrStartDaemonAsync({
+        // The restarting daemon launches the successor itself; this only connects while that process lives.
+        successor = await connectToPlannedSuccessorAsync({
           ...connection,
           startupTimeoutMs: boundedByAdmission ? Math.max(1, Math.ceil(remainingMs!)) : startupTimeoutMs,
           previousDaemon: { pid: owner.pid, startedAt: owner.startedAt },
           abortSignal
         });
       } catch (error) {
-        if (
-          abortSignal?.aborted &&
-          (error === abortSignal.reason ||
-            (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ABORT_ERR'))
-        ) {
-          return abortedOutcome(execution);
-        }
+        if (isAbortError(error, abortSignal)) return abortedOutcome(execution);
         // A startup error after the admission deadline expired is the deadline, not a new failure mode.
         if (boundedByAdmission && error instanceof DaemonClientError && isExpired(getRemainingMs())) {
           return restartExhaustedOutcome(retry);
         }
-        throw error;
+        // The reason tells a user whose environment keeps the new daemon from starting what to change.
+        throw reason && error instanceof DaemonClientError
+          ? new DaemonRestartFailedError(error, reason)
+          : error;
       } finally {
         await previous?.closeAsync().catch(() => undefined);
         previous = undefined;
@@ -97,16 +212,15 @@ export async function executeWithDaemonRestartAsync(
       const remainingMs: number | undefined = getRemainingMs();
       if (isExpired(remainingMs)) return restartExhaustedOutcome(retry);
       owner = await attestOwnerAsync(successor, connection);
-      outcome = await successor.executeAsync({
+      attempts.followed++;
+      await onRestartAsync?.({
+        restart: attempts.followed,
+        reason,
+        successorPid: (await successor.status).pid
+      });
+      outcome = await executeOnDaemonAsync(successor, connection, {
         ...execution,
-        abortSignal,
-        request:
-          remainingMs === undefined
-            ? execution.request
-            : captureDaemonRequest({
-                ...execution.request,
-                admission: { ...execution.request.admission, waitTimeoutMs: Math.floor(remainingMs) }
-              })
+        request: withRemainingAdmission(execution.request, remainingMs)
       });
     }
     return outcome;
@@ -115,6 +229,119 @@ export async function executeWithDaemonRestartAsync(
   }
 }
 
+/**
+ * Sends the request to a new daemon once, after the daemon that had it exited while the request waited in its
+ * queue. Throws `exit` if the connection cannot start a daemon, or if the admission deadline expires first.
+ */
+async function resendAfterExitAsync(
+  exit: DaemonExitedWhileQueuedError,
+  attempts: IRequestAttempts
+): Promise<DaemonClientOutcome> {
+  const { connection, execution, onRestartAsync, getRemainingMs } = attempts;
+  const { abortSignal } = execution;
+  if (abortSignal?.aborted) return abortedOutcome(execution);
+  if (!connection.startCommand && !connection.resolveStartCommandAsync) throw exit;
+  const remainingMs: number | undefined = getRemainingMs();
+  if (isExpired(remainingMs)) throw exit;
+  const startupTimeoutMs: number = connection.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+  const limitedByAdmission: boolean = remainingMs !== undefined && remainingMs < startupTimeoutMs;
+  attempts.followed++;
+  await onRestartAsync?.({
+    restart: attempts.followed,
+    reason: undefined,
+    successorPid: undefined,
+    exitedPid: exit.daemonPid
+  });
+  let successor: DaemonClient;
+  try {
+    // The daemon that exited planned no successor, and explaining its exit reclaimed its files.
+    successor = await connectOrStartDaemonAsync({
+      ...connection,
+      startupTimeoutMs: limitedByAdmission ? Math.max(1, Math.ceil(remainingMs!)) : startupTimeoutMs,
+      abortSignal
+    });
+  } catch (error) {
+    if (isAbortError(error, abortSignal)) return abortedOutcome(execution);
+    if (limitedByAdmission && error instanceof DaemonClientError && isExpired(getRemainingMs())) throw exit;
+    throw error instanceof DaemonClientError
+      ? new DaemonClientError(
+          error.code,
+          `rushd (PID ${exit.daemonPid}) exited while the command was queued, and a new daemon did not start: ` +
+            error.message,
+          { cause: error }
+        )
+      : error;
+  }
+  try {
+    const resendRemainingMs: number | undefined = getRemainingMs();
+    if (isExpired(resendRemainingMs)) throw exit;
+    return await followRestartsAsync(
+      successor,
+      withRemainingAdmission(execution.request, resendRemainingMs),
+      attempts
+    );
+  } catch (error) {
+    throw error === exit ? error : withResentMessage(error);
+  } finally {
+    await successor.closeAsync().catch(() => undefined);
+  }
+}
+
+/** A lost connection after the resend says that the command was sent to a new daemon, not that it was not retried. */
+function withResentMessage(error: unknown): unknown {
+  if (!(error instanceof DaemonClientError) || !error.message.startsWith(DAEMON_DISCONNECTED_MESSAGE)) {
+    return error;
+  }
+  return new DaemonClientError(
+    error.code,
+    DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE + error.message.slice(DAEMON_DISCONNECTED_MESSAGE.length),
+    { cause: error.cause ?? error }
+  );
+}
+
+/** Executes one attempt; a lost connection is explained by what happened to the daemon that served it. */
+async function executeOnDaemonAsync(
+  client: DaemonClient,
+  connection: IConnectOrStartDaemonOptions,
+  execution: IDaemonClientExecuteOptions
+): Promise<DaemonClientOutcome> {
+  const daemon: IServingDaemon | undefined = await observeServingDaemonAsync(client, connection.paths);
+  try {
+    return await client.executeAsync(execution);
+  } catch (error) {
+    // After cancellation the caller reports the cancellation, whatever the connection did afterwards.
+    if (execution.abortSignal?.aborted) throw error;
+    throw await explainLostConnectionAsync(
+      error,
+      daemon,
+      execution.request,
+      { onOrphansReaped: connection.onOrphansReaped },
+      client.queuedWithoutStarting
+    );
+  }
+}
+
+/** The request with an explicit admission deadline of `remainingMs`, or unchanged without one. */
+function withRemainingAdmission(
+  request: IDaemonRequestEnvelope,
+  remainingMs: number | undefined
+): IDaemonRequestEnvelope {
+  return remainingMs === undefined
+    ? request
+    : captureDaemonRequest({
+        ...request,
+        admission: { ...request.admission, waitTimeoutMs: Math.floor(remainingMs) }
+      });
+}
+
+function isAbortError(error: unknown, abortSignal: AbortSignal | undefined): boolean {
+  return (
+    !!abortSignal?.aborted &&
+    (error === abortSignal.reason ||
+      (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ABORT_ERR'))
+  );
+}
+
 function isExpired(remainingMs: number | undefined): boolean {
   return remainingMs !== undefined && remainingMs <= 0;
 }
@@ -157,4 +384,4 @@ function abortedOutcome(execution: IDaemonClientExecuteOptions): DaemonClientOut
     kind: 'result',
     result: { requestId: execution.request.requestId, exitCode: 130, outcome: 'aborted', aborted: true }
   };
-}
\ No newline at end of file
+}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index 7597de72ab2..7d58878bb5f 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -11,19 +11,47 @@ export {
   DaemonClient,
   type DaemonClientOutcome,
   type IDaemonClientConnectOptions,
-  type IDaemonClientExecuteOptions
+  type IDaemonClientExecuteOptions,
+  type IDaemonClientLivenessOptions,
+  type IDaemonRestartWaitDetails,
+  type IDaemonSilence
 } from './DaemonClient';
+export { formatDaemonRestartCause, type DaemonRestartRequester } from './DaemonRestartCause';
 export { DaemonClientError, type DaemonClientErrorCode } from './DaemonClientError';
 export { getDaemonLogFilePath } from './DaemonLogFile';
+export { findReclaimedDaemonPid } from './ReclaimedDaemonLog';
 export {
+  describeLiveDaemonOwner,
   resetDaemonArtifactsAsync,
   type IDaemonArtifactResetOptions,
   type IDaemonArtifactResetResult
 } from './DaemonOwnership';
-export { executeWithDaemonRestartAsync } from './executeWithDaemonRestart';
+export type { DaemonOwnerHintPurpose } from './DaemonOwnerDiagnosis';
+export { assertDaemonRuntimeFolderIsPrivate } from './DaemonRuntimeFolder';
+export {
+  inspectDaemonStartupReservation,
+  type DaemonStartupHelperState,
+  type IDaemonStartupReservationInfo
+} from './DaemonStartupReservation';
+export { reclaimCrashedDaemonAsync } from './ExitedDaemonReclaim';
+export {
+  DaemonRestartFailedError,
+  executeWithDaemonRestartAsync,
+  type IDaemonRestartNotice,
+  type IExecuteWithDaemonRestartOptions
+} from './executeWithDaemonRestart';
+export {
+  connectOrAwaitDaemonStartupAsync,
+  connectToStartingDaemonAsync,
+  DaemonStartupPendingError,
+  type IConnectOrAwaitDaemonStartupOptions
+} from './connectOrAwaitDaemonStartup';
 export {
   connectOrStartDaemonAsync,
   requestDaemonShutdownAsync,
+  resolveDaemonStartupReservationAsync,
   type IConnectOrStartDaemonOptions,
   type IDaemonStartCommand
 } from './connectOrStartDaemon';
+export { findNativeLockHolder, formatNativeLockHolder } from './NativeLockHolder';
+export { isDaemonOwnerStoppedAsync } from './StoppedDaemonOwner';
diff --git a/libraries/rush-client-core/src/runDaemonStartup.ts b/libraries/rush-client-core/src/runDaemonStartup.ts
index e71da1359f4..6c141218b1f 100644
--- a/libraries/rush-client-core/src/runDaemonStartup.ts
+++ b/libraries/rush-client-core/src/runDaemonStartup.ts
@@ -2,6 +2,15 @@
 // See LICENSE in the project root for license information.
 
 import { runDaemonStartupAsync, type IDaemonStartupOptions } from './DaemonStartup';
+import { closeInheritedFileDescriptors } from './InheritedFileDescriptors';
+
+// The daemon would otherwise hold, for as long as it runs, what the client's caller left open without
+// close-on-exec: for example a pipe that a shell waits to reach end-of-file, or a lock file.
+try {
+  closeInheritedFileDescriptors();
+} catch (error) {
+  process.stderr.write(`Unable to close inherited file descriptors: ${(error as Error).stack}\n`);
+}
 
 process.once('message', (options: IDaemonStartupOptions) => {
   process.channel?.unref();
diff --git a/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts b/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
new file mode 100644
index 00000000000..21b6420d5c1
--- /dev/null
+++ b/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
@@ -0,0 +1,122 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonTransportErrorCode,
+  tryAcquireReclaimLock,
+  type IDaemonOperationGroupLeftRunning,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { reclaimAbandonedOwnershipAsync } from '../DaemonOwnership';
+import {
+  describeGroupLeftRunning,
+  isRunning,
+  readClientLogTexts,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+describe(`${reclaimAbandonedOwnershipAsync.name} when a process that started later has the recorded PID`, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+  let reaps: IDaemonOrphanReap[];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+    reaps.push(reap);
+  };
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-abandoned-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    operationPids = [];
+    reaps = [];
+  });
+
+  afterEach(async () => {
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  /**
+   * Records an owner whose PID a process that started later has now, as if the owner recorded that process's
+   * group and one group that it started. Returns the PIDs of that process and of the recorded group's leader.
+   */
+  async function recordReusedOwnerAsync(): Promise<[number, number]> {
+    // Each leads a process group and session of its own, as an operation does.
+    const unrelated: number = await startDetachedOperationAsync(operationPids);
+    const recorded: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+    recordOperationGroup(paths.lockfilePath, unrelated, unrelated, readProcessStartTime(unrelated));
+    recordOperationGroup(paths.lockfilePath, unrelated, recorded, readProcessStartTime(recorded));
+    return [unrelated, recorded];
+  }
+
+  linuxIt('stops the recorded operations before it removes the record, but never that process', async () => {
+    const [unrelated, recorded] = await recordReusedOwnerAsync();
+    await reclaimAbandonedOwnershipAsync(paths, { onOrphansReaped });
+    expect(isRunning(recorded)).toBe(false);
+    expect(isRunning(unrelated)).toBe(true);
+    expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+    // The group of that process is left running, and the launcher log says why.
+    expect(readClientLogTexts(paths)).toEqual([
+      describeGroupLeftRunning(unrelated, unrelated, 'daemonPidInUse')
+    ]);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
+  });
+
+  linuxIt(
+    'gives a recorded group that it leaves running to onOperationGroupLeftRunning instead',
+    async () => {
+      const [unrelated, recorded] = await recordReusedOwnerAsync();
+      const groups: IDaemonOperationGroupLeftRunning[] = [];
+      await reclaimAbandonedOwnershipAsync(paths, {
+        onOrphansReaped,
+        onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => groups.push(group)
+      });
+      expect(isRunning(recorded)).toBe(false);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(groups).toEqual([{ daemonPid: unrelated, processGroupId: unrelated, reason: 'daemonPidInUse' }]);
+      expect(readClientLogTexts(paths)).toEqual([]);
+    }
+  );
+
+  linuxIt(
+    'keeps the record and signals nothing while the recorded operations cannot be stopped',
+    async () => {
+      const [unrelated, recorded] = await recordReusedOwnerAsync();
+      const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      // For example, a daemon that starts reclaims the endpoint under this lock.
+      const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+      expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+      try {
+        await expect(reclaimAbandonedOwnershipAsync(paths, { onOrphansReaped })).rejects.toMatchObject({
+          code: DaemonTransportErrorCode.daemonAlreadyRunning
+        });
+      } finally {
+        fs.unlinkSync(reclaimLockPath);
+      }
+      expect(isRunning(recorded)).toBe(true);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([]);
+      expect(readClientLogTexts(paths)).toEqual([]);
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(true);
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
new file mode 100644
index 00000000000..75f04197c39
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
@@ -0,0 +1,345 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  tryAcquireReclaimLock,
+  type IDaemonOperationGroupLeftRunning,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
+import { getDaemonStartupFilePath } from '../DaemonStartup';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  describeGroupLeftRunning,
+  isRunning,
+  readClientLogTexts,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  startExitedProcessAsync,
+  startOrphanedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+
+function getDaemonPaths(runtimeDir: string): IDaemonPaths {
+  return {
+    runtimeDir,
+    socketPath: path.join(runtimeDir, 'd.sock'),
+    lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+  };
+}
+
+/** A listener that was killed without cleanup leaves a socket file that refuses connections. */
+async function leaveStaleSocketAsync(socketPath: string): Promise<void> {
+  const listener: ChildProcess = spawn(
+    process.execPath,
+    [
+      '-e',
+      `require('net').createServer().listen(${JSON.stringify(socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+    ],
+    { stdio: 'ignore' }
+  );
+  await once(listener, 'close');
+}
+
+describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutting down`, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+  let warning: jest.SpyInstance;
+  let reaps: IDaemonOrphanReap[];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+    reaps.push(reap);
+  };
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reset-'));
+    paths = getDaemonPaths(folder);
+    operationPids = [];
+    reaps = [];
+    warning = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  });
+
+  afterEach(async () => {
+    warning.mockRestore();
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  linuxIt('stops the operations that the owner left running before it removes its files', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    await leaveStaleSocketAsync(paths.socketPath);
+    recordDaemonOwner(paths, daemonPid);
+    fs.writeFileSync(getDaemonStartupFilePath(paths), 'abandoned');
+    expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+      removedPaths: [paths.lockfilePath, getDaemonStartupFilePath(paths), paths.socketPath]
+    });
+    expect(isRunning(operationPid)).toBe(false);
+    expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    expect(warning).not.toHaveBeenCalled();
+    expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({ removedPaths: [] });
+    expect(reaps).toHaveLength(1);
+  });
+
+  // For example, a host that serves other requests while it awaits the reset. Jest resolves modules itself, so a
+  // Node process of its own makes the calls.
+  posixIt('leaves require() resolving symlinks while it awaits the reclaim of a stale socket', async () => {
+    const daemonPid: number = await startExitedProcessAsync();
+    await leaveStaleSocketAsync(paths.socketPath);
+    recordDaemonOwner(paths, daemonPid);
+    const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+      folder,
+      [
+        'const [modulePath, pathsJson] = args;',
+        "const net = require('node:net');",
+        "const path = require('node:path');",
+        'const { resetDaemonArtifactsAsync } = require(modulePath);',
+        'const connect = net.Socket.prototype.connect;',
+        'let connections = 0;',
+        // The first connection finds the endpoint unbound. The reset awaits the second, the reclaim's probe.
+        'net.Socket.prototype.connect = function (...connectArgs) {',
+        '  if (++connections === 2) {',
+        "    try { process.stdout.write(`${require('./app/node_modules/symlinked-package')}\\n`); }",
+        '    catch (error) { process.stdout.write(`${error.code}\\n`); }',
+        '  }',
+        '  return connect.apply(this, connectArgs);',
+        '};',
+        'const { removedPaths } = await resetDaemonArtifactsAsync(JSON.parse(pathsJson));',
+        "process.stdout.write(`${removedPaths.map((removed) => path.basename(removed)).join(' ')}\\n`);"
+      ].join('\n'),
+      [require.resolve('../DaemonOwnership'), JSON.stringify(paths)]
+    );
+    expect(result).toEqual({ status: 0, stdout: 'found\ndaemon.pid.json d.sock\nfound', stderr: '' });
+  });
+
+  linuxIt(
+    'stops a recorded operation group but never one whose leader has another start time, and removes the records',
+    async () => {
+      const daemonPid: number = await startExitedProcessAsync();
+      const recorded: number = await startDetachedOperationAsync(operationPids);
+      const other: number = await startDetachedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      recordOperationGroup(paths.lockfilePath, daemonPid, recorded, readProcessStartTime(recorded));
+      // As if the daemon recorded an operation whose PID a process that started later now has.
+      const earlier: string = String(Number(readProcessStartTime(other)) - 1);
+      recordOperationGroup(paths.lockfilePath, daemonPid, other, earlier);
+      expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [paths.lockfilePath] });
+      expect(isRunning(recorded)).toBe(false);
+      expect(isRunning(other)).toBe(true);
+      expect(readClientLogTexts(paths)).toEqual([
+        describeGroupLeftRunning(daemonPid, other, 'leaderChanged')
+      ]);
+      // Without onOrphansReaped, each set of stopped groups is reported as a process warning.
+      expect(warning.mock.calls).toEqual([
+        [
+          `Reclaimed dead daemon ${daemonPid}: its orphaned operation process groups ${recorded} were terminated.`,
+          expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+        ]
+      ]);
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${daemonPid}`)).toBe(false);
+    }
+  );
+
+  linuxIt(
+    'waits while another process reclaims the owner, and signals and removes nothing until then',
+    async () => {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      // For example, a daemon that starts reclaims the endpoint of the owner that exited under this lock.
+      const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+      expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+      await expect(resetDaemonArtifactsAsync(paths, { onOrphansReaped })).rejects.toThrow(
+        `Another process is reclaiming the files of rushd (PID ${daemonPid})`
+      );
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+      expect(reaps).toEqual([]);
+      const release: NodeJS.Timeout = setTimeout(() => fs.unlinkSync(reclaimLockPath), 300);
+      try {
+        expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped, waitTimeoutMs: 5000 })).toEqual({
+          removedPaths: [paths.lockfilePath]
+        });
+      } finally {
+        clearTimeout(release);
+      }
+      expect(isRunning(operationPid)).toBe(false);
+      expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    }
+  );
+
+  linuxIt('signals and removes nothing when it cannot reclaim the owner', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    await leaveStaleSocketAsync(paths.socketPath);
+    recordDaemonOwner(paths, daemonPid);
+    fs.writeFileSync(getDaemonStartupFilePath(paths), 'abandoned');
+    const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+    // The reclaim trusts no record in a runtime folder that it reaches through a symbolic link.
+    const link: string = path.join(folder, 'link');
+    fs.symlinkSync(folder, link);
+    await expect(resetDaemonArtifactsAsync(getDaemonPaths(link), { onOrphansReaped })).rejects.toThrow(
+      `rushd (PID ${daemonPid}) exited without shutting down, and stopping the operations that it left ` +
+        `running failed, so no file was removed: The daemon runtime folder ${link} is unsafe`
+    );
+    expect(isRunning(operationPid)).toBe(true);
+    expect(reaps).toEqual([]);
+    expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(true);
+    expect(fs.existsSync(paths.socketPath)).toBe(true);
+  });
+
+  /**
+   * Records an owner whose PID a process that started later now has, as if the owner recorded that process's
+   * group (with its start time), one group `recorded` that it started, and one group whose leader has another
+   * start time than the recorded one. Returns those three PIDs.
+   */
+  async function recordReusedOwnerAsync(): Promise<[number, number, number]> {
+    // Each leads a process group and session of its own, as an operation does.
+    const unrelated: number = await startDetachedOperationAsync(operationPids);
+    const recorded: number = await startDetachedOperationAsync(operationPids);
+    const other: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+    recordOperationGroup(paths.lockfilePath, unrelated, unrelated, readProcessStartTime(unrelated));
+    recordOperationGroup(paths.lockfilePath, unrelated, recorded, readProcessStartTime(recorded));
+    const earlier: string = String(Number(readProcessStartTime(other)) - 1);
+    recordOperationGroup(paths.lockfilePath, unrelated, other, earlier);
+    return [unrelated, recorded, other];
+  }
+
+  linuxIt(
+    'stops the proven operation groups of an owner whose PID a later process has, but never that process',
+    async () => {
+      const [unrelated, recorded, other] = await recordReusedOwnerAsync();
+      expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(recorded)).toBe(false);
+      expect(isRunning(other)).toBe(true);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+      expect(warning).not.toHaveBeenCalled();
+      // The records are read in no set order.
+      expect(readClientLogTexts(paths).sort()).toEqual(
+        [
+          describeGroupLeftRunning(unrelated, unrelated, 'daemonPidInUse'),
+          describeGroupLeftRunning(unrelated, other, 'leaderChanged')
+        ].sort()
+      );
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
+    }
+  );
+
+  /**
+   * Records an owner that exited, or one whose PID a later process has, that recorded a group whose leader has
+   * another start time. Returns the owner's PID and the group's.
+   */
+  async function recordChangedLeaderAsync(owner: string): Promise<[number, number]> {
+    if (owner === 'reused') {
+      const [unrelated, , other] = await recordReusedOwnerAsync();
+      return [unrelated, other];
+    }
+    const daemonPid: number = await startExitedProcessAsync();
+    const other: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    recordOperationGroup(
+      paths.lockfilePath,
+      daemonPid,
+      other,
+      String(Number(readProcessStartTime(other)) - 1)
+    );
+    return [daemonPid, other];
+  }
+
+  linuxIt.each(['exited', 'reused'])(
+    'gives a recorded group that it leaves running to onOperationGroupLeftRunning instead (%s owner)',
+    async (owner: string) => {
+      const [ownerPid, other] = await recordChangedLeaderAsync(owner);
+      const groups: IDaemonOperationGroupLeftRunning[] = [];
+      const onOperationGroupLeftRunning = (group: IDaemonOperationGroupLeftRunning): void => {
+        groups.push(group);
+      };
+      expect(await resetDaemonArtifactsAsync(paths, { onOperationGroupLeftRunning })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(other)).toBe(true);
+      expect(groups).toContainEqual({ daemonPid: ownerPid, processGroupId: other, reason: 'leaderChanged' });
+      expect(readClientLogTexts(paths)).toEqual([]);
+    }
+  );
+
+  linuxIt(
+    'signals and removes nothing while another process reclaims, when a later process has the PID',
+    async () => {
+      const [unrelated, recorded] = await recordReusedOwnerAsync();
+      const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+      expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+      try {
+        await expect(resetDaemonArtifactsAsync(paths, { onOrphansReaped })).rejects.toThrow(
+          `Another process is reclaiming the files of rushd (PID ${unrelated})`
+        );
+      } finally {
+        fs.unlinkSync(reclaimLockPath);
+      }
+      expect(isRunning(recorded)).toBe(true);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([]);
+      expect(readClientLogTexts(paths)).toEqual([]);
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(true);
+    }
+  );
+
+  linuxIt(
+    'removes a record whose PID a process that started later now has, and signals nothing',
+    async () => {
+      // It leads a process group of its own, so a signal to the group that the record names would stop it.
+      const unrelated: number = await startDetachedOperationAsync(operationPids);
+      recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+      expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([]);
+      expect(warning).not.toHaveBeenCalled();
+    }
+  );
+
+  linuxIt(
+    'says that another client may be resetting the daemon while it holds the start mutex, and signals nothing',
+    async () => {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      // For example, a concurrent "daemon stop --force" that still stops what the owner left running.
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      expect(lock).toBeDefined();
+      try {
+        await expect(resetDaemonArtifactsAsync(paths, { onOrphansReaped })).rejects.toThrow(
+          `Another client is starting or resetting the daemon for ${paths.lockfilePath}; retry after it finishes.`
+        );
+        expect(isRunning(operationPid)).toBe(true);
+        expect(reaps).toEqual([]);
+      } finally {
+        await lock!.releaseAsync();
+      }
+      expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(operationPid)).toBe(false);
+      expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index 9a2ccc6af8d..acc377920cb 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -4,12 +4,15 @@
 import * as net from 'node:net';
 import { PassThrough } from 'node:stream';
 import {
+  DAEMON_KEEPALIVE_PROTOCOL_MINOR,
   DAEMON_PROTOCOL_VERSION,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR,
   DaemonFrameType,
   decodeDaemonControlMessage,
   decodeDaemonStdinChunk,
   encodeDaemonControlMessage,
   encodeDaemonEventFrame,
+  encodeDaemonFrame,
   encodeDaemonLogChunk,
   type DaemonControlMessage,
   type IDaemonProtocolVersion,
@@ -18,8 +21,12 @@ import {
 import { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { DaemonClient } from '../DaemonClient';
+import type { IDaemonClientLivenessOptions, IDaemonSilence } from '../DaemonClient';
+import { adaptDaemonRequestToPeer } from '../DaemonRequestEnvironment';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 
+const DAEMON_PID: number = 4242;
+
 describe('DaemonClient', () => {
   let server: net.Server;
   let connection: DaemonFrameConnection | undefined;
@@ -27,6 +34,7 @@ describe('DaemonClient', () => {
   let controls: DaemonControlMessage[];
   let peerVersion: IDaemonProtocolVersion;
   let acknowledgeInput: boolean;
+  let answerPings: boolean;
   let onRequest: (message: DaemonControlMessage) => Promise<void>;
   let onStdin: (bytes: Uint8Array) => Promise<void>;
 
@@ -34,6 +42,7 @@ describe('DaemonClient', () => {
     controls = [];
     peerVersion = DAEMON_PROTOCOL_VERSION;
     acknowledgeInput = true;
+    answerPings = true;
     address =
       process.platform === 'win32'
         ? `\\\\.\\pipe\\rush-client-test-${process.pid}-${Math.random()}`
@@ -58,7 +67,13 @@ describe('DaemonClient', () => {
             payload: { protocolVersion: peerVersion, sessionId: 'test' }
           });
         } else if (message.kind === 'ping') {
-          await sendAsync({ kind: 'pong', payload: { uptimeMs: 1, daemonVersion: 'test' } });
+          // The readiness ping is always answered.
+          if (answerPings || !controls.some((control) => control.kind === 'requestStart')) {
+            await sendAsync({
+              kind: 'pong',
+              payload: { uptimeMs: 1, daemonVersion: 'test', pid: DAEMON_PID }
+            });
+          }
         } else {
           await onRequest(message);
         }
@@ -187,6 +202,46 @@ describe('DaemonClient', () => {
     expect(stdin.read().toString()).toBe('untouched');
   });
 
+  const RUNTIME_FOLDER_ENVIRONMENT: Readonly<Record<string, string>> = {
+    TEST: 'one',
+    XDG_RUNTIME_DIR: '/run/user/1000',
+    TMPDIR: '/scratch/tmp',
+    TMP: '/scratch/tmp',
+    TEMP: '/scratch/tmp'
+  };
+
+  (process.platform === 'win32' ? it.skip : it).each([
+    [11, ['TEST']],
+    [12, ['TEMP', 'TEST', 'TMP', 'TMPDIR', 'XDG_RUNTIME_DIR']]
+  ])('sends a protocol 0.%s daemon only the runtime folder variables it can use', async (minor, names) => {
+    peerVersion = { major: 0, minor: Number(minor) };
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId: message.payload.requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    const envelope = captureDaemonRequest({ ...request(), environment: RUNTIME_FOLDER_ENVIRONMENT });
+    expect(await client.executeAsync({ request: envelope })).toMatchObject({ kind: 'result' });
+    const start: DaemonControlMessage | undefined = controls.find(
+      (message) => message.kind === 'requestStart'
+    );
+    expect(Object.keys(start?.kind === 'requestStart' ? start.payload.environment : {}).sort()).toEqual(
+      names
+    );
+    expect(envelope.environment).toEqual(RUNTIME_FOLDER_ENVIRONMENT);
+  });
+
+  it('keeps the runtime folder variables for an older daemon on Windows', () => {
+    const envelope = captureDaemonRequest({ ...request(), environment: RUNTIME_FOLDER_ENVIRONMENT });
+    expect(adaptDaemonRequestToPeer(envelope, { major: 0, minor: 11 }, 'win32')).toBe(envelope);
+    expect(adaptDaemonRequestToPeer(envelope, { major: 0, minor: 11 }, 'darwin').environment).toEqual({
+      TEST: 'one'
+    });
+  });
+
   it.each(['output', 'event', 'stdin', 'raw-mode', 'old-peer'])(
     'does not authorize restart replay after %s',
     async (mode) => {
@@ -271,9 +326,12 @@ describe('DaemonClient', () => {
   it('cancels on abort and waits for the authoritative result', async () => {
     const abort = new AbortController();
     const envelope = request();
+    const cancelRequests: number[] = [];
+    let cancelRequestsBeforeCancel: number | undefined;
     onRequest = async (message) => {
       if (message.kind === 'requestStart') abort.abort();
       if (message.kind === 'requestCancel') {
+        cancelRequestsBeforeCancel = cancelRequests.length;
         await sendAsync({
           kind: 'requestResult',
           payload: { requestId: envelope.requestId, exitCode: 130, aborted: true, outcome: 'aborted' }
@@ -281,11 +339,384 @@ describe('DaemonClient', () => {
       }
     };
     const client = await DaemonClient.connectAsync({ socketPath: address });
-    expect(await client.executeAsync({ request: envelope, abortSignal: abort.signal })).toMatchObject({
+    expect(
+      await client.executeAsync({
+        request: envelope,
+        abortSignal: abort.signal,
+        onCancelRequested: (timeoutMs) => cancelRequests.push(timeoutMs)
+      })
+    ).toMatchObject({
       kind: 'result',
       result: { exitCode: 130 }
     });
     expect(controls.filter((message) => message.kind === 'requestCancel')).toHaveLength(1);
+    // The caller hears of the cancellation, and its default deadline, before the daemon does.
+    expect(cancelRequests).toEqual([5000]);
+    expect(cancelRequestsBeforeCancel).toBe(1);
+  });
+
+  it('disconnects without a result when the daemon does not finish cancellation in time', async () => {
+    const abort = new AbortController();
+    const cancelRequests: number[] = [];
+    onRequest = async (message) => {
+      if (message.kind === 'requestStart') abort.abort();
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await expect(
+      client.executeAsync({
+        request: request(),
+        abortSignal: abort.signal,
+        cancellationTimeoutMs: 50,
+        onCancelRequested: (timeoutMs) => cancelRequests.push(timeoutMs)
+      })
+    ).rejects.toMatchObject({
+      code: 'timeout',
+      message: expect.stringContaining('did not finish cancellation')
+    });
+    expect(cancelRequests).toEqual([50]);
+    expect(controls.filter((message) => message.kind === 'requestCancel')).toHaveLength(1);
+  });
+
+  it('reports why a queued request waits when the daemon restarts after the requests ahead of it', async () => {
+    const restartReason = {
+      kind: 'installationChanged',
+      change: 'removed',
+      folder: '/snapshots/s9'
+    } as const;
+    const inputsReason = {
+      kind: 'workspaceInputsChanged',
+      installationFiles: ['common/config/rush/pnpm-lock.yaml']
+    } as const;
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      const { requestId } = message.payload;
+      await sendAsync({ kind: 'queuePosition', payload: { position: 2, requestId } });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 2, requestId, restartReason: inputsReason, scriptCount: 1 }
+      });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, restartReason: inputsReason, restartsForAnotherRequest: true }
+      });
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId, restartReason } });
+      await sendAsync({
+        kind: 'requestResult',
+        payload: {
+          requestId,
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          retryAfterRestart: true,
+          restartReason
+        }
+      });
+    };
+    const positions: unknown[] = [];
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    const outcome = await client.executeAsync({
+      request: request(),
+      onQueuePositionAsync: async (position, reason, wait) => {
+        positions.push([position, reason, wait]);
+      }
+    });
+    expect(positions).toEqual([
+      [2, undefined, {}],
+      [2, inputsReason, { scriptCount: 1 }],
+      [1, inputsReason, { restartsForAnotherRequest: true }],
+      [1, restartReason, {}]
+    ]);
+    expect(outcome).toMatchObject({ kind: 'result', result: { retryAfterRestart: true, restartReason } });
+  });
+
+  it('reports which Rush process a request waits for when it holds the repository lock', async () => {
+    const holder = { pid: 4242, command: 'rush install' } as const;
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      const { requestId } = message.payload;
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, nativeLockHolder: holder }
+      });
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId, nativeLockHolder: {} } });
+      await sendAsync({ kind: 'queuePosition', payload: { position: 2, requestId } });
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    };
+    const positions: unknown[] = [];
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await client.executeAsync({
+      request: request(),
+      onQueuePositionAsync: async (...args: unknown[]) => {
+        positions.push([args[0], args[1], args[3]]);
+      }
+    });
+    expect(positions).toEqual([
+      [1, undefined, holder],
+      [1, undefined, {}],
+      [2, undefined, undefined]
+    ]);
+  });
+
+  it('reports the operations that earlier requests left running while the request waits only for them', async () => {
+    const continuing = { count: 4, names: ['a (build)', 'b (build)', 'c (build)'] } as const;
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      const { requestId } = message.payload;
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId } });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, continuingOperations: continuing }
+      });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, continuingOperations: { count: 1, names: ['c (build)'] } }
+      });
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    };
+    const positions: unknown[] = [];
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await client.executeAsync({
+      request: request(),
+      onQueuePositionAsync: async (...args: unknown[]) => {
+        positions.push([args[0], args[3], args[4]]);
+      }
+    });
+    expect(positions).toEqual([
+      [1, undefined, undefined],
+      [1, undefined, continuing],
+      [1, undefined, { count: 1, names: ['c (build)'] }]
+    ]);
+  });
+
+  it('reports once, before any input is forwarded, that the daemon admitted input', async () => {
+    const stdin = new PassThrough();
+    const seen: string[] = [];
+    const envelope = { ...request(), terminal: { ...request().terminal, acceptsStdin: true } };
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId: envelope.requestId } });
+      await sendAsync({ kind: 'stdinReady', payload: { requestId: envelope.requestId } });
+    };
+    onStdin = async (bytes) => {
+      seen.push(`stdin ${Buffer.from(bytes)}`);
+      if (seen.filter((entry) => entry.startsWith('stdin')).length < 2) return;
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId: envelope.requestId, exitCode: 0, aborted: false, outcome: 'success' }
+      });
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    const execution = client.executeAsync({
+      request: envelope,
+      stdin,
+      onQueuePositionAsync: async () => {
+        seen.push('queued');
+      },
+      onInputAdmittedAsync: async () => {
+        seen.push('admitted');
+        // Written only after admission, so the second chunk needs the first chunk's acknowledgement.
+        stdin.write('a');
+        setTimeout(() => stdin.write('b'), 10);
+      }
+    });
+    await execution;
+    expect(seen).toEqual(['queued', 'admitted', 'stdin a', 'stdin b']);
+  });
+
+  it.each([
+    [DAEMON_KEEPALIVE_PROTOCOL_MINOR, false],
+    [DAEMON_REQUEST_STARTED_PROTOCOL_MINOR, true]
+  ])('subscribes to a protocol 0.%s daemon with supportsRequestStarted %s', async (minor, supported) => {
+    peerVersion = { major: 0, minor };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await client.closeAsync();
+    const subscribe: DaemonControlMessage | undefined = controls.find(
+      (message) => message.kind === 'subscribe'
+    );
+    expect(subscribe?.payload).toMatchObject({ supportsRequestStarted: supported });
+  });
+
+  it('rejects requestStarted from a daemon that did not negotiate it', async () => {
+    peerVersion = { major: 0, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR };
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      await sendAsync({ kind: 'requestStarted', payload: { requestId: message.payload.requestId } });
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await expect(client.executeAsync({ request: request() })).rejects.toThrow(
+      'Unexpected request start notice.'
+    );
+  });
+
+  describe('queuedWithoutStarting', () => {
+    /** The queue position that the daemon sends last, after which the test closes the connection. */
+    const BARRIER_POSITION: number = 9;
+    type Step = 'started' | 'output' | 'event' | 'input' | 'rawMode';
+
+    async function sendStepAsync(step: Step, requestId: string): Promise<void> {
+      switch (step) {
+        case 'started':
+          await sendAsync({ kind: 'requestStarted', payload: { requestId } });
+          return;
+        case 'output':
+          await connection!.sendFrameAsync({
+            kind: DaemonFrameType.logStdout,
+            payload: encodeDaemonLogChunk({ operationId: requestId, chunk: Buffer.from('ran') })
+          });
+          return;
+        case 'event':
+          await connection!.sendFrameAsync({
+            kind: DaemonFrameType.event,
+            payload: encodeDaemonEventFrame({
+              protocolVersion: { major: 0, minor: 1 },
+              eventId: 'event',
+              sessionId: 'test',
+              sequence: 1,
+              timestamp: new Date().toISOString(),
+              source: { packageName: 'test', packageVersion: '1.0.0' },
+              privacy: 'public',
+              required: true,
+              type: 'commandStarted',
+              payload: {}
+            })
+          });
+          return;
+        case 'input':
+          await sendAsync({ kind: 'stdinReady', payload: { requestId } });
+          return;
+        case 'rawMode':
+          await sendAsync({ kind: 'setRawMode', payload: { requestId, enabled: true } });
+          return;
+      }
+    }
+
+    /**
+     * Runs a request that the daemon answers with `steps`, then a queue position, and then by closing the connection
+     * once the client handled that queue position, or with `cancel`, once the client asked to cancel.
+     */
+    async function runUntilLostAsync(
+      steps: ReadonlyArray<Step>,
+      cancel: boolean = false
+    ): Promise<DaemonClient> {
+      const abort: AbortController = new AbortController();
+      let barrierSeen: () => void = () => {};
+      const barrier: Promise<void> = new Promise((resolve) => {
+        barrierSeen = resolve;
+      });
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') {
+          const { requestId } = message.payload;
+          for (const step of steps) await sendStepAsync(step, requestId);
+          await sendAsync({ kind: 'queuePosition', payload: { position: BARRIER_POSITION, requestId } });
+          await barrier;
+          if (!cancel) await connection!.closeAsync();
+        } else if (message.kind === 'requestCancel') {
+          await connection!.closeAsync();
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      await expect(
+        client.executeAsync({
+          request: { ...request(), terminal: { ...request().terminal, acceptsStdin: true } },
+          stdin: new PassThrough(),
+          abortSignal: abort.signal,
+          setRawMode: () => {},
+          onStdoutAsync: async () => {},
+          onEventAsync: async () => {},
+          onQueuePositionAsync: async (position) => {
+            if (position !== BARRIER_POSITION) return;
+            if (cancel) abort.abort();
+            barrierSeen();
+          }
+        })
+      ).rejects.toThrow();
+      return client;
+    }
+
+    it('is true once the daemon reported a queue position and nothing else', async () => {
+      expect((await runUntilLostAsync([])).queuedWithoutStarting).toBe(true);
+    });
+
+    it('is false before the daemon reported a queue position', async () => {
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') await connection!.closeAsync();
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      await expect(client.executeAsync({ request: request() })).rejects.toThrow('not retried');
+      expect(client.queuedWithoutStarting).toBe(false);
+    });
+
+    it.each<Step>(['started', 'output', 'event', 'input', 'rawMode'])(
+      'is false after the daemon sent %s',
+      async (step: Step) => {
+        expect((await runUntilLostAsync([step])).queuedWithoutStarting).toBe(false);
+      }
+    );
+
+    it('is false after the client asked the daemon to cancel', async () => {
+      expect((await runUntilLostAsync([], true)).queuedWithoutStarting).toBe(false);
+    });
+
+    it('is false for a daemon that does not say when it starts a request', async () => {
+      peerVersion = { major: 0, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR };
+      expect((await runUntilLostAsync([])).queuedWithoutStarting).toBe(false);
+    });
+
+    /**
+     * Runs a request that the daemon answers with `messages` in one write, after which it closes the connection. The
+     * client takes `QUEUE_POSITION_HANDLER_MS` to handle a queue position, so the connection closes while the frames
+     * after it wait in the transport. Returns whether the request counted as queued when it failed.
+     */
+    async function queuedWhenLostAsync(
+      messages: (requestId: string) => ReadonlyArray<DaemonControlMessage>
+    ): Promise<boolean> {
+      const QUEUE_POSITION_HANDLER_MS: number = 200;
+      onRequest = async (message) => {
+        if (message.kind !== 'requestStart') return;
+        const frames: Buffer[] = messages(message.payload.requestId).map((control: DaemonControlMessage) =>
+          Buffer.from(
+            encodeDaemonFrame({
+              kind: DaemonFrameType.controlJson,
+              payload: encodeDaemonControlMessage(control)
+            })
+          )
+        );
+        connection!.socket.write(Buffer.concat(frames));
+        await connection!.closeAsync();
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      await expect(
+        client.executeAsync({
+          request: request(),
+          onQueuePositionAsync: () => new Promise((resolve) => setTimeout(resolve, QUEUE_POSITION_HANDLER_MS))
+        })
+      ).rejects.toThrow('not retried');
+      return client.queuedWithoutStarting;
+    }
+
+    it('handles a start notice that arrived before the connection closed before it fails the request', async () => {
+      expect(
+        await queuedWhenLostAsync((requestId: string) => [
+          { kind: 'queuePosition', payload: { position: 1, requestId } },
+          { kind: 'requestStarted', payload: { requestId } }
+        ])
+      ).toBe(false);
+    });
+
+    it('is true when the frames that arrived before the connection closed say only that the request waits', async () => {
+      expect(
+        await queuedWhenLostAsync((requestId: string) => [
+          { kind: 'queuePosition', payload: { position: 2, requestId } },
+          { kind: 'queuePosition', payload: { position: 1, requestId } }
+        ])
+      ).toBe(true);
+    });
   });
 
   it('forwards raw stdin only after acknowledgement and restores raw mode', async () => {
@@ -506,6 +937,17 @@ describe('DaemonClient', () => {
     expect(controls.some((message) => message.kind === 'ping')).toBe(true);
   });
 
+  it.each([
+    [{}, undefined],
+    [{}, false],
+    [{ omitWarmSet: true }, true]
+  ])('pings with %j when omitWarmSetStatus is %s', async (payload, omitWarmSetStatus) => {
+    const client = await DaemonClient.connectAsync({ socketPath: address, omitWarmSetStatus });
+    await client.closeAsync();
+    const pings: DaemonControlMessage[] = controls.filter((message) => message.kind === 'ping');
+    expect(pings.map((message) => message.payload)).toEqual([payload]);
+  });
+
   it('rejects peers without the request lifecycle capability', async () => {
     peerVersion = { major: 0, minor: 4 };
     await expect(DaemonClient.connectAsync({ socketPath: address })).rejects.toThrow(
@@ -568,13 +1010,15 @@ describe('DaemonClient', () => {
 
   it('does not send an already cancelled request or leak a rejected completion promise', async () => {
     const client = await DaemonClient.connectAsync({ socketPath: address });
-    expect(await client.executeAsync({ request: request(), abortSignal: AbortSignal.abort() })).toMatchObject(
-      {
-        kind: 'result',
-        result: { exitCode: 130, aborted: true }
-      }
-    );
+    const onCancelRequested: jest.Mock = jest.fn();
+    expect(
+      await client.executeAsync({ request: request(), abortSignal: AbortSignal.abort(), onCancelRequested })
+    ).toMatchObject({
+      kind: 'result',
+      result: { exitCode: 130, aborted: true }
+    });
     expect(controls.some((message) => message.kind === 'requestStart')).toBe(false);
+    expect(onCancelRequested).not.toHaveBeenCalled();
   });
 
   it('turns raw Ctrl+C into cancellation when enabled by the CLI', async () => {
@@ -593,14 +1037,275 @@ describe('DaemonClient', () => {
       }
     };
     const client = await DaemonClient.connectAsync({ socketPath: address });
+    const cancelRequests: number[] = [];
     expect(
       await client.executeAsync({
         request: envelope,
         stdin,
         cancelOnCtrlC: true,
-        setRawMode: () => {}
+        setRawMode: () => {},
+        onCancelRequested: (timeoutMs) => cancelRequests.push(timeoutMs)
       })
     ).toMatchObject({ kind: 'result', result: { exitCode: 130 } });
+    // A raw Ctrl+C raises no signal, so only the client can say that it cancels.
+    expect(cancelRequests).toEqual([5000]);
+  });
+
+  describe('liveness check', () => {
+    const PING_AFTER_MS: number = 100;
+    const UNRESPONSIVE_AFTER_MS: number = 300;
+
+    function sleepAsync(ms: number): Promise<void> {
+      return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+
+    async function waitForAsync(condition: () => boolean): Promise<void> {
+      while (!condition()) await sleepAsync(5);
+    }
+
+    /** Blocks this thread, and with it the client, as if the client's process was stopped. */
+    function blockThread(ms: number): void {
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    }
+
+    function countPingsAfter(kind: DaemonControlMessage['kind']): number {
+      const index: number = controls.findIndex((message) => message.kind === kind);
+      return index < 0 ? 0 : controls.slice(index).filter((message) => message.kind === 'ping').length;
+    }
+
+    /** Sends later, so that the fake daemon, which reads nothing while it handles a message, still reads. */
+    function sendLater(ms: number, send: () => Promise<void>): void {
+      setTimeout(() => {
+        send().catch(() => undefined);
+      }, ms);
+    }
+
+    function sendResultAsync(requestId: string): Promise<void> {
+      return sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    }
+
+    function sendAbortedResultAsync(requestId: string): Promise<void> {
+      return sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 130, aborted: true, outcome: 'aborted' }
+      });
+    }
+
+    function liveness(overrides: Partial<IDaemonClientLivenessOptions> = {}): IDaemonClientLivenessOptions {
+      return {
+        pingAfterMs: PING_AFTER_MS,
+        unresponsiveAfterMs: UNRESPONSIVE_AFTER_MS,
+        onUnresponsive: () => undefined,
+        ...overrides
+      };
+    }
+
+    it('pings a silent daemon one ping at a time, reports its silence once, and reports when it responds', async () => {
+      answerPings = false;
+      const envelope = request();
+      const unresponsive: IDaemonSilence[] = [];
+      const responsive: IDaemonSilence[] = [];
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = client.executeAsync({
+        request: envelope,
+        liveness: liveness({
+          onUnresponsive: (silence) => unresponsive.push(silence),
+          onResponsive: (silence) => responsive.push(silence)
+        })
+      });
+      // A failed expectation must not leave this rejection to the next test.
+      outcome.catch(() => undefined);
+      await waitForAsync(() => unresponsive.length > 0);
+      await sleepAsync(2 * UNRESPONSIVE_AFTER_MS);
+      expect(countPingsAfter('requestStart')).toBe(1);
+      expect(unresponsive).toEqual([{ pid: DAEMON_PID, silentForMs: expect.any(Number) }]);
+      expect(unresponsive[0].silentForMs).toBeGreaterThanOrEqual(UNRESPONSIVE_AFTER_MS);
+      expect(responsive).toEqual([]);
+      // The daemon answers the ping late, as a stopped daemon does once it continues.
+      await sendAsync({ kind: 'pong', payload: { uptimeMs: 2, pid: DAEMON_PID } });
+      await waitForAsync(() => responsive.length > 0);
+      expect(responsive).toEqual([{ pid: DAEMON_PID, silentForMs: expect.any(Number) }]);
+      expect(responsive[0].silentForMs).toBeGreaterThanOrEqual(unresponsive[0].silentForMs);
+      await sendResultAsync(envelope.requestId);
+      expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    });
+
+    it.each([false, true])(
+      'asks the daemon to leave the warm set out of the reply to its ping (omitWarmSetStatus: %s)',
+      async (omitWarmSetStatus) => {
+        answerPings = false;
+        const envelope = request();
+        const client = await DaemonClient.connectAsync({ socketPath: address, omitWarmSetStatus });
+        const outcome = client.executeAsync({ request: envelope, liveness: liveness() });
+        // A failed expectation must not leave this rejection to the next test.
+        outcome.catch(() => undefined);
+        await waitForAsync(() => countPingsAfter('requestStart') > 0);
+        await sendResultAsync(envelope.requestId);
+        expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+        // Only the readiness ping follows omitWarmSetStatus, since DaemonClient.status returns its reply.
+        expect(
+          controls.filter((message) => message.kind === 'ping').map((message) => message.payload)
+        ).toEqual([omitWarmSetStatus ? { omitWarmSet: true } : {}, { omitWarmSet: true }]);
+      }
+    );
+
+    it('does not check a daemon that predates the check', async () => {
+      peerVersion = { major: DAEMON_PROTOCOL_VERSION.major, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR - 1 };
+      answerPings = false;
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') {
+          sendLater(2 * UNRESPONSIVE_AFTER_MS, () => sendResultAsync(envelope.requestId));
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({ request: envelope, liveness: liveness({ onUnresponsive }) })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(countPingsAfter('requestStart')).toBe(0);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it('does not report a daemon that answers its pings while a long request runs', async () => {
+      // 1000 ms, not the file's 300 ms: a check runs every PING_AFTER_MS, so a ping can go out only after about
+      // 2 * PING_AFTER_MS of silence, and a pong that a busy host delays by another PING_AFTER_MS would reach 300 ms.
+      const unresponsiveAfterMs: number = 1000;
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') {
+          sendLater(2 * unresponsiveAfterMs, () => sendResultAsync(envelope.requestId));
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({
+          request: envelope,
+          liveness: liveness({ unresponsiveAfterMs, onUnresponsive })
+        })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      // The request outlasts the silence limit, and only the pongs keep the daemon from counting as silent.
+      expect(countPingsAfter('requestStart')).toBeGreaterThan(1);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it("does not count the time that the client's own callbacks take as the daemon's silence", async () => {
+      answerPings = false;
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind !== 'requestStart') return;
+        await connection!.sendFrameAsync({
+          kind: DaemonFrameType.logStdout,
+          payload: encodeDaemonLogChunk({ operationId: 'op', chunk: Buffer.from('slow') })
+        });
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = await client.executeAsync({
+        request: envelope,
+        onStdoutAsync: async () => {
+          // The daemon sends its result while the client still writes the output before it.
+          await sendResultAsync(envelope.requestId);
+          await sleepAsync(2 * UNRESPONSIVE_AFTER_MS);
+        },
+        liveness: liveness({ onUnresponsive })
+      });
+      expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(countPingsAfter('requestStart')).toBe(0);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it("does not count a stall of the client's own event loop as the daemon's silence", async () => {
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind !== 'requestStart') return;
+        blockThread(2 * UNRESPONSIVE_AFTER_MS);
+        sendLater(PING_AFTER_MS / 2, () => sendResultAsync(envelope.requestId));
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({ request: envelope, liveness: liveness({ onUnresponsive }) })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it('stops checking once the client asks the daemon to cancel the request', async () => {
+      answerPings = false;
+      const abort = new AbortController();
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') abort.abort();
+        if (message.kind === 'requestCancel') {
+          sendLater(2 * UNRESPONSIVE_AFTER_MS, () => sendAbortedResultAsync(envelope.requestId));
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({
+          request: envelope,
+          abortSignal: abort.signal,
+          liveness: liveness({ onUnresponsive })
+        })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 130 } });
+      expect(countPingsAfter('requestCancel')).toBe(0);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it('does not report that a silent daemon responds again once the client has asked it to cancel', async () => {
+      answerPings = false;
+      const abort = new AbortController();
+      const envelope = request();
+      const unresponsive: IDaemonSilence[] = [];
+      const onResponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestCancel') {
+          await sendAsync({ kind: 'pong', payload: { uptimeMs: 2, pid: DAEMON_PID } });
+          await sendAbortedResultAsync(envelope.requestId);
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = client.executeAsync({
+        request: envelope,
+        abortSignal: abort.signal,
+        liveness: liveness({ onUnresponsive: (silence) => unresponsive.push(silence), onResponsive })
+      });
+      // A failed expectation must not leave this rejection to the next test.
+      outcome.catch(() => undefined);
+      await waitForAsync(() => unresponsive.length > 0);
+      abort.abort();
+      expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 130 } });
+      expect(onResponsive).not.toHaveBeenCalled();
+    });
+
+    it('accepts the reply to its ping after the result', async () => {
+      answerPings = false;
+      const envelope = request();
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = client.executeAsync({ request: envelope, liveness: liveness() });
+      // A failed expectation must not leave this rejection to the next test.
+      outcome.catch(() => undefined);
+      await waitForAsync(() => countPingsAfter('requestStart') > 0);
+      await sendResultAsync(envelope.requestId);
+      await sendAsync({ kind: 'pong', payload: { uptimeMs: 2, pid: DAEMON_PID } });
+      expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    });
+
+    it.each([{ pingAfterMs: 0 }, { unresponsiveAfterMs: 1.5 }, { unresponsiveAfterMs: 0x80000000 }])(
+      'rejects %p before it sends the request',
+      async (durations) => {
+        const client = await DaemonClient.connectAsync({ socketPath: address });
+        await expect(
+          client.executeAsync({ request: request(), liveness: liveness(durations) })
+        ).rejects.toThrow(RangeError);
+        expect(controls.some((message) => message.kind === 'requestStart')).toBe(false);
+      }
+    );
   });
 });
 
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
new file mode 100644
index 00000000000..d391be745e7
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -0,0 +1,438 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
+import {
+  DaemonExitedWhileQueuedError,
+  explainLostConnectionAsync,
+  findLoggedFatalError,
+  observeServingDaemonAsync,
+  type IServingDaemon
+} from '../DaemonDisconnect';
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { reserveDaemonStartup } from '../DaemonStartup';
+import { isProcessDefunct } from '../ProcessStartTime';
+import { findReclaimedDaemonPid } from '../ReclaimedDaemonLog';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  isRunning,
+  recordDaemonOwner,
+  startOrphanedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+
+/** The lines that this Node.js version writes to stderr when `script` fails with an uncaught error. */
+function getCrashReport(script: string): string[] {
+  const { status, stderr } = spawnSync(process.execPath, ['-e', script], { encoding: 'utf8' });
+  expect(status).not.toBe(0);
+  return stderr.split(/\r?\n/);
+}
+
+describe(findLoggedFatalError.name, () => {
+  it('returns the message of an uncaught error without its stack', () => {
+    const report: string[] = getCrashReport("setImmediate(() => { throw new Error('first\\nsecond'); })");
+    expect(findLoggedFatalError(['rushd started', ...report])).toBe('Error: first second');
+  });
+
+  it('returns the message of an unhandled rejection', () => {
+    expect(findLoggedFatalError(getCrashReport("Promise.reject(new TypeError('rejected'))"))).toBe(
+      'TypeError: rejected'
+    );
+    expect(findLoggedFatalError(getCrashReport("Promise.reject('reason')"))).toMatch(
+      /^UnhandledPromiseRejection: .* "reason"\.$/
+    );
+  });
+
+  it('returns a thrown value that is not an error', () => {
+    expect(findLoggedFatalError(getCrashReport("throw 'a plain string'"))).toBe('a plain string');
+  });
+
+  it("returns V8's fatal error line", () => {
+    const lines: string[] = [
+      '<--- JS stacktrace --->',
+      '',
+      'FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory',
+      '----- Native stack trace -----'
+    ];
+    expect(findLoggedFatalError(lines)).toBe(
+      'FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory'
+    );
+  });
+
+  it('returns the first report', () => {
+    const lines: string[] = [
+      ...getCrashReport("throw new Error('first')"),
+      ...getCrashReport("throw new Error('second')")
+    ];
+    expect(findLoggedFatalError(lines)).toBe('Error: first');
+  });
+
+  it('returns undefined without a complete report', () => {
+    const report: string[] = getCrashReport("throw new Error('boom')");
+    const trailer: number = report.findIndex((line) => line.startsWith('Node.js v'));
+    expect(trailer).toBeGreaterThan(0);
+    expect(findLoggedFatalError(report.slice(0, trailer))).toBeUndefined();
+    expect(findLoggedFatalError(report.slice(3))).toBeUndefined();
+    expect(findLoggedFatalError(['rushd started', 'Node.js v22.0.0'])).toBeUndefined();
+  });
+});
+
+describe(explainLostConnectionAsync.name, () => {
+  const request: IDaemonRequestEnvelope = captureDaemonRequest({
+    argv: ['build'],
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    cwd: os.tmpdir(),
+    environment: {},
+    terminal: { isTTY: false, supportsColor: false }
+  });
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-disconnect-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    operationPids = [];
+  });
+
+  afterEach(async () => {
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  function getServingDaemon(pid: number, startedAt?: string): IServingDaemon {
+    return { pid, startedAt, logFilePath: path.join(folder, 'missing.log'), logOffset: undefined, paths };
+  }
+
+  function getLostConnection(): DaemonTransportError {
+    return new DaemonTransportError(
+      DaemonTransportErrorCode.transportClosed,
+      'The daemon connection closed.'
+    );
+  }
+
+  function getExitMessage(pid: number): string {
+    return `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while it ran the command; "rush-client daemon logs" may show why. Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".`;
+  }
+
+  it('returns other failures, and failures without a known daemon, unchanged', async () => {
+    const timeout: DaemonClientError = new DaemonClientError('timeout', 'The daemon did not answer.');
+    expect(await explainLostConnectionAsync(timeout, getServingDaemon(process.pid), request)).toBe(timeout);
+    const lost: DaemonClientError = new DaemonClientError('disconnected', DAEMON_DISCONNECTED_MESSAGE);
+    expect(await explainLostConnectionAsync(lost, undefined, request)).toBe(lost);
+  });
+
+  it('says that the command was queued when the daemon exited before it started the request', async () => {
+    // A process that has exited.
+    const exitedPid: number = spawnSync(process.execPath, ['-e', '']).pid!;
+    const closed: DaemonTransportError = getLostConnection();
+    const explained: unknown = await explainLostConnectionAsync(
+      closed,
+      getServingDaemon(exitedPid),
+      request,
+      undefined,
+      true
+    );
+    expect(explained).toBeInstanceOf(DaemonExitedWhileQueuedError);
+    expect(explained).toMatchObject({
+      code: 'disconnected',
+      cause: closed,
+      daemonPid: exitedPid,
+      message: getExitMessage(exitedPid).replace('while it ran the command', 'while the command was queued')
+    });
+    const ran: unknown = await explainLostConnectionAsync(closed, getServingDaemon(exitedPid), request);
+    expect(ran).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+    expect(ran).toMatchObject({ code: 'disconnected', message: getExitMessage(exitedPid) });
+  });
+
+  linuxIt('treats a daemon that exited but is not reaped yet as exited', async () => {
+    await withUnreapedChildAsync(async (child) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      const closed: DaemonTransportError = getLostConnection();
+      const startedAt: number = Date.now();
+      const explained: unknown = await explainLostConnectionAsync(closed, getServingDaemon(child), request);
+      expect(Date.now() - startedAt).toBeLessThan(500);
+      expect(explained).toBeInstanceOf(DaemonClientError);
+      expect(explained).toMatchObject({
+        code: 'disconnected',
+        cause: closed,
+        message: getExitMessage(child)
+      });
+    });
+  });
+
+  linuxIt(
+    'stops the operations that an exited daemon left running, and removes its files, first',
+    async () => {
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      try {
+        const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+        recordDaemonOwner(paths, daemonPid);
+        const explained: unknown = await explainLostConnectionAsync(
+          getLostConnection(),
+          getServingDaemon(daemonPid),
+          request
+        );
+        expect(explained).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+        expect(isRunning(operationPid)).toBe(false);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+        expect(warning).toHaveBeenCalledWith(
+          expect.stringContaining(`Reclaimed dead daemon ${daemonPid}:`),
+          expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+        );
+      } finally {
+        warning.mockRestore();
+      }
+    }
+  );
+
+  linuxIt('reports what the reclaim stopped to onOrphansReaped instead of a process warning', async () => {
+    const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+    try {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      const reaps: IDaemonOrphanReap[] = [];
+      const explained: unknown = await explainLostConnectionAsync(
+        getLostConnection(),
+        getServingDaemon(daemonPid),
+        request,
+        { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) }
+      );
+      expect(explained).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+      expect(isRunning(operationPid)).toBe(false);
+      // The stand-in daemon's operation shares its process group, as a phased operation does.
+      expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+      expect(warning).not.toHaveBeenCalled();
+    } finally {
+      warning.mockRestore();
+    }
+  });
+
+  linuxIt('reclaims an exited daemon that is not reaped yet once it is reaped', async () => {
+    await withUnreapedChildAsync(async (child, parentPid) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      recordDaemonOwner(paths, child);
+      let settled: boolean = false;
+      const explained: Promise<unknown> = explainLostConnectionAsync(
+        getLostConnection(),
+        getServingDaemon(child),
+        request
+      ).finally(() => {
+        settled = true;
+      });
+      // The reclaim waits up to 1 s for the process to be reaped.
+      await delayAsync(100);
+      expect(settled).toBe(false);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      // Once its parent exits, init or a subreaper reaps it.
+      process.kill(parentPid, 'SIGTERM');
+      expect(await explained).toMatchObject({ message: getExitMessage(child) });
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    });
+  });
+
+  linuxIt('waits while another client holds the start mutex, and leaves the reclaim to it', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+    expect(lock).toBeDefined();
+    let settled: boolean = false;
+    const explained: Promise<unknown> = explainLostConnectionAsync(
+      getLostConnection(),
+      getServingDaemon(daemonPid),
+      request
+    ).finally(() => {
+      settled = true;
+    });
+    await delayAsync(300);
+    expect(settled).toBe(false);
+    // The other client's reclaim ends by removing the ownership record.
+    fs.unlinkSync(paths.lockfilePath);
+    await lock!.releaseAsync();
+    expect(await explained).toMatchObject({ message: getExitMessage(daemonPid) });
+    expect(isRunning(operationPid)).toBe(true);
+  });
+
+  linuxIt(
+    'gives up after a few seconds while another client keeps the start mutex',
+    async () => {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      expect(lock).toBeDefined();
+      try {
+        const startedAt: number = Date.now();
+        expect(
+          await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+        ).toMatchObject({ message: getExitMessage(daemonPid) });
+        expect(Date.now() - startedAt).toBeGreaterThanOrEqual(4500);
+        expect(Date.now() - startedAt).toBeLessThan(10000);
+        expect(isRunning(operationPid)).toBe(true);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      } finally {
+        await lock!.releaseAsync();
+      }
+    },
+    20000
+  );
+
+  linuxIt('leaves an exited daemon to the startup that is reserved', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    reserveDaemonStartup(paths, { pid: process.pid, startedAt: new Date().toISOString() });
+    const startedAt: number = Date.now();
+    expect(
+      await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+    ).toMatchObject({ message: getExitMessage(daemonPid) });
+    expect(Date.now() - startedAt).toBeLessThan(1000);
+    expect(isRunning(operationPid)).toBe(true);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    expect(fs.existsSync(getDaemonLogFilePath(paths))).toBe(false);
+  });
+
+  linuxIt('leaves the files alone when the ownership record names another daemon', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    // A process that has exited, which the record does not name.
+    const otherPid: number = spawnSync(process.execPath, ['-e', '']).pid!;
+    // The same PID, but a record written for another process.
+    for (const daemon of [
+      getServingDaemon(otherPid),
+      getServingDaemon(daemonPid, '2000-01-01T00:00:00.000Z')
+    ]) {
+      expect(await explainLostConnectionAsync(getLostConnection(), daemon, request)).toMatchObject({
+        message: getExitMessage(daemon.pid)
+      });
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    }
+  });
+
+  linuxIt('still explains the exit when the reclaim fails', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    // Another process, such as a starting daemon, holds the reclaim's own mutex, so the reclaim throws.
+    fs.writeFileSync(`${paths.lockfilePath}.reclaim`, JSON.stringify({ mutexPid: process.pid }));
+    expect(
+      await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+    ).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+    expect(isRunning(operationPid)).toBe(true);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    expect(fs.existsSync(getDaemonLogFilePath(paths))).toBe(false);
+  });
+
+  linuxIt('logs the reclaim, so that the daemon can be named after its record is gone', async () => {
+    const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+    try {
+      const { daemonPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      expect(
+        await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+      ).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+      expect(warning).toHaveBeenCalledWith(
+        expect.stringContaining(`Reclaimed dead daemon ${daemonPid}:`),
+        expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+      );
+      expect(fs.readFileSync(getDaemonLogFilePath(paths), 'utf8').split('\n')).toEqual([
+        expect.stringMatching(
+          new RegExp(
+            `^\\S+Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${daemonPid}\\) exited without`
+          )
+        ),
+        ''
+      ]);
+      expect(findReclaimedDaemonPid(paths)).toBe(daemonPid);
+    } finally {
+      warning.mockRestore();
+    }
+  });
+
+  // For example, Rush that runs in-process after the daemon exited. Jest resolves modules itself, so a Node
+  // process of its own makes the call.
+  posixIt('leaves require() resolving symlinks after it read a launcher log that is a FIFO', () => {
+    const logFilePath: string = getDaemonLogFilePath(paths);
+    expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0);
+    // A process that has exited.
+    const pid: number = spawnSync(process.execPath, ['-e', '']).pid!;
+    const daemon: IServingDaemon = { pid, startedAt: undefined, logFilePath, logOffset: 0, paths };
+    const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+      folder,
+      [
+        'const [modulePath, daemonJson, requestJson] = args;',
+        "const lost = Object.assign(new Error('read ECONNRESET'), { code: 'ECONNRESET' });",
+        'const { explainLostConnectionAsync } = require(modulePath);',
+        'const explained = await explainLostConnectionAsync(lost, JSON.parse(daemonJson), JSON.parse(requestJson));',
+        'process.stdout.write(`${explained.message}\\n`);'
+      ].join('\n'),
+      [require.resolve('../DaemonDisconnect'), JSON.stringify(daemon), JSON.stringify(request)]
+    );
+    expect(result).toEqual({ status: 0, stdout: `${getExitMessage(pid)}\nfound`, stderr: '' });
+  });
+});
+
+describe(observeServingDaemonAsync.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-serving-daemon-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  // For example, Rush that runs in-process after the daemon exited. Jest resolves modules itself, so a Node
+  // process of its own makes the call.
+  posixIt('leaves require() resolving symlinks after it measured a launcher log that is a FIFO', () => {
+    expect(spawnSync('mkfifo', ['-m', '600', getDaemonLogFilePath(paths)]).status).toBe(0);
+    const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+      folder,
+      [
+        'const [modulePath, pathsJson] = args;',
+        'const client = { status: Promise.resolve({ pid: process.pid }) };',
+        'const { observeServingDaemonAsync } = require(modulePath);',
+        'const daemon = await observeServingDaemonAsync(client, JSON.parse(pathsJson));',
+        'process.stdout.write(`${daemon.logOffset}\\n`);'
+      ].join('\n'),
+      [require.resolve('../DaemonDisconnect'), JSON.stringify(paths)]
+    );
+    // The log is not a regular file, so the client does not read it later.
+    expect(result).toEqual({ status: 0, stdout: 'undefined\nfound', stderr: '' });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts b/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
new file mode 100644
index 00000000000..8ce9fff1a7e
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
@@ -0,0 +1,357 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameListener, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from '../DaemonClientError';
+import {
+  createUnresponsiveOwnerError,
+  describeRecordOwner,
+  describeUnresponsiveOwner,
+  diagnoseDaemonOwner,
+  getDaemonOwnerHint,
+  getDefaultOwnerProcessReaders,
+  LiveDaemonOwnerError,
+  type IDaemonOwnerDiagnosis,
+  type IOwnerProcessReaders
+} from '../DaemonOwnerDiagnosis';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
+
+const PID: number = 4242;
+const SOCKET: string = '/run/user/1000/rush/abc.sock';
+const LOCKFILE: string = '/run/user/1000/rush/abc.pid.json';
+const PATHS: IDaemonPaths = {
+  runtimeDir: '/run/user/1000/rush',
+  socketPath: SOCKET,
+  lockfilePath: LOCKFILE
+};
+const NOW: number = Date.parse('2026-09-29T10:00:00.000Z');
+const RUSHD: string[] = ['/usr/bin/node', '/x/node_modules/@rushstack/rush-daemon/lib-commonjs/start.js'];
+const HEDGED_HINT: string = `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${LOCKFILE}. Either way, the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`;
+
+function readers(overrides: Partial<IOwnerProcessReaders> = {}): IOwnerProcessReaders {
+  return {
+    platform: 'linux',
+    now: () => NOW,
+    readState: () => ({ code: 'S', parentPid: 1 }),
+    readStartTimeMs: () => NOW - 3 * 60_000,
+    readCommandLine: () => RUSHD,
+    isPresent: () => true,
+    hasFileOpen: (pid: number, filePath: string) => pid === PID && filePath === LOCKFILE,
+    ...overrides
+  };
+}
+
+function diagnose(overrides: Partial<IOwnerProcessReaders> = {}): IDaemonOwnerDiagnosis {
+  return diagnoseDaemonOwner(PID, PATHS, readers(overrides));
+}
+
+function hint(diagnosis: IDaemonOwnerDiagnosis, purpose: 'use' | 'stop' = 'use'): string {
+  return getDaemonOwnerHint(diagnosis, LOCKFILE, purpose);
+}
+
+describe('diagnoseDaemonOwner', () => {
+  it('says that a signal stopped the daemon, and how to resume it', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({ readState: () => ({ code: 'T', parentPid: 1 }) });
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon, rushd (PID ${PID}), did not answer at ${SOCKET}: it is stopped (state T), for example by SIGSTOP, and it started 3 min ago.`
+    );
+    expect(hint(diagnosis)).toBe(`Resume it with "kill -CONT ${PID}"; it then serves the next command.`);
+    expect(hint(diagnosis, 'stop')).toBe(
+      `Resume it with "kill -CONT ${PID}", then run "rush-client daemon stop" again.`
+    );
+  });
+
+  it('asks a stopped daemon without a socket to exit once it resumes', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({
+      readState: () => ({ code: 'T', parentPid: 1 }),
+      isPresent: () => false
+    });
+    expect(describeRecordOwner(diagnosis, LOCKFILE)).toBe(
+      `rushd (PID ${PID}) still owns ${LOCKFILE}: its socket is missing, so no client can reach it; it is stopped (state T), for example by SIGSTOP, and it started 3 min ago.`
+    );
+    expect(hint(diagnosis, 'use')).toBe(hint(diagnosis, 'stop'));
+    expect(hint(diagnosis)).toBe(
+      `Run "kill ${PID}", then "kill -CONT ${PID}": it then cancels its running requests and exits, and the next command starts a new daemon.`
+    );
+  });
+
+  it.each([
+    [
+      't',
+      'it is stopped by a debugger or tracer (state t)',
+      'It answers once the debugger or tracer lets it run.'
+    ],
+    [
+      'D',
+      'it is waiting in the kernel (state D), for example on a slow disk or network file system',
+      'It handles no signal until that wait ends; retry then.'
+    ]
+  ])('describes state %s', (code: string, description: string, expectedHint: string) => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({ readState: () => ({ code, parentPid: 1 }) });
+    expect(diagnosis.facts).toBe(`: ${description}, and it started 3 min ago`);
+    expect(hint(diagnosis)).toBe(expectedHint);
+  });
+
+  it('names the parent that has not reaped an owner that exited', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({
+      readState: () => ({ code: 'Z', parentPid: 77 }),
+      // A zombie has no command line.
+      readCommandLine: () => undefined
+    });
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID}: it has exited, but its parent process (PID 77) has not reaped it (state Z), and it started 3 min ago.`
+    );
+    expect(hint(diagnosis)).toBe(
+      'The next command reclaims its files once PID 77 reaps it. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.'
+    );
+  });
+
+  it('tells a busy daemon from one that lost its socket', () => {
+    const busy: IDaemonOwnerDiagnosis = diagnose({ readState: () => ({ code: 'R', parentPid: 1 }) });
+    expect(busy.facts).toBe(': it is running (state R), and it started 3 min ago');
+    expect(hint(busy)).toBe(
+      `It may be busy or shutting down; "rush-client daemon logs" shows its last lines. "kill ${PID}" asks it to cancel its running requests and exit; the next command then starts a new daemon.`
+    );
+    const socketless: IDaemonOwnerDiagnosis = diagnose({ isPresent: () => false });
+    expect(socketless.facts).toBe(
+      `: its socket is missing, so no client can reach it; it is waiting (state S), and it started 3 min ago`
+    );
+    expect(hint(socketless)).toBe(
+      `It may exit on its own once its running requests finish; "kill ${PID}" asks it to cancel them and exit. The next command then starts a new daemon.`
+    );
+  });
+
+  it('says so when the owner is not a Rush daemon, and shows its command line', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({ readCommandLine: () => ['sleep', '600'] });
+    expect(diagnosis.isRushDaemon).toBe(false);
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID} ("sleep 600"): it is waiting (state S), and it started 3 min ago.`
+    );
+    expect(hint(diagnosis, 'stop')).toBe(
+      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${LOCKFILE}; the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
+    );
+    // A command that uses the daemon, and runs Rush in-process after that wait, gets the same hint.
+    expect(hint(diagnosis)).toBe(hint(diagnosis, 'stop'));
+    const long: IDaemonOwnerDiagnosis = diagnose({ readCommandLine: () => ['x'.repeat(40), 'y'.repeat(40)] });
+    expect(long.subject).toBe(`PID ${PID} ("${'x'.repeat(40)} ${'y'.repeat(16)}...")`);
+  });
+
+  it("names no signal for a Rush daemon that does not have this workspace's record open", () => {
+    for (const hasFileOpen of [(): false => false, (): undefined => undefined]) {
+      const diagnosis: IDaemonOwnerDiagnosis = diagnose({
+        readState: () => ({ code: 'T', parentPid: 1 }),
+        hasFileOpen
+      });
+      expect(diagnosis.isRushDaemon).toBe(true);
+      expect(diagnosis.isWorkspaceDaemon).toBe(false);
+      expect(describeUnresponsiveOwner(diagnosis)).toBe(
+        `The daemon did not answer at ${SOCKET}, and its ownership record names rushd (PID ${PID}): it is stopped (state T), for example by SIGSTOP, and it started 3 min ago.`
+      );
+      expect(hint(diagnosis)).toBe(HEDGED_HINT);
+      expect(hint(diagnosis, 'stop')).toBe(HEDGED_HINT);
+    }
+  });
+
+  it.each([
+    [['node', '/home/u/.rush/node-v22/@rushstack/rush-daemon/lib-commonjs/start.js'], true],
+    [
+      [
+        '/usr/bin/node',
+        '/r/common/temp/node_modules/.pnpm/@rushstack+rush-daemon@0.1.0/node_modules/@rushstack/rush-daemon/lib-commonjs/SelectedDaemonBootstrap.js',
+        '--launch',
+        '/r/package.json',
+        '5.179.0',
+        '/r'
+      ],
+      true
+    ],
+    [['node', '--max-old-space-size=4096', '/w/libraries/rush-daemon/lib-commonjs/start.js'], true],
+    [['C:\\node.exe', 'C:\\x\\rush-daemon\\lib-commonjs\\start.js'], true],
+    [['rushd'], true],
+    [['/usr/local/bin/rushd', '--foreground'], true],
+    [['node', '/w/common/temp/node_modules/.bin/rushd'], true],
+    [['node', '/home/u/src/my-rush-daemon/start.js'], false],
+    [['node', '/home/u/src/rush-daemon-protocol/lib/index.js'], false],
+    // A tool that builds or tests the rush-daemon package is not a Rush daemon.
+    [['node', '/w/libraries/rush-daemon/node_modules/.bin/../@rushstack/heft/bin/heft', 'build'], false],
+    [['node', '/w/libraries/rush-daemon/node_modules/jest/bin/jest.js'], false],
+    [
+      ['node', '/w/common/temp/heft/lib/start.js', '--cwd', '/w/libraries/rush-daemon/lib-commonjs/start.js'],
+      false
+    ],
+    [['/w/libraries/rush-daemon/node_modules/.bin/tsc'], false],
+    [['node', '/w/libraries/rush-daemon'], false],
+    [['node', '--inspect'], false],
+    [[], false]
+  ])('recognizes a Rush daemon by its command line %j', (commandLine: string[], expected: boolean) => {
+    expect(diagnose({ readCommandLine: () => commandLine }).isRushDaemon).toBe(expected);
+  });
+
+  it('reports only what it can read', () => {
+    const unknown: Partial<IOwnerProcessReaders> = {
+      readState: () => undefined,
+      readStartTimeMs: () => undefined,
+      readCommandLine: () => undefined
+    };
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose(unknown);
+    expect(diagnosis.isRushDaemon).toBeUndefined();
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID}.`
+    );
+    expect(hint(diagnosis)).toBe(HEDGED_HINT);
+    // Windows names a pipe, which leaves no file to check.
+    const windows: IDaemonOwnerDiagnosis = diagnose({
+      ...unknown,
+      platform: 'win32',
+      isPresent: () => false,
+      hasFileOpen: () => undefined
+    });
+    expect(windows.facts).toBe('');
+    expect(hint(windows, 'stop')).toBe(HEDGED_HINT);
+  });
+
+  it.each([
+    [-5000, '0 s'],
+    [59_999, '59 s'],
+    [60_000, '1 min'],
+    [3_599_999, '59 min'],
+    [2 * 3_600_000 + 5 * 60_000, '2 h 5 min']
+  ])('formats an age of %d ms as %s', (ageMs: number, expected: string) => {
+    expect(diagnose({ readStartTimeMs: () => NOW - ageMs }).facts).toBe(
+      `: it is waiting (state S), and it started ${expected} ago`
+    );
+  });
+
+  it('builds the error that a client throws when the owner did not answer', () => {
+    const error: LiveDaemonOwnerError = createUnresponsiveOwnerError(
+      PID,
+      PATHS,
+      readers({ readState: () => ({ code: 'T', parentPid: 1 }) })
+    );
+    expect(error).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect(error.code).toBe('startupFailed');
+    expect(error.message).toBe(`${error.description}\n${error.hint}`);
+    expect(error.description).toContain(
+      `rushd (PID ${PID}), did not answer at ${SOCKET}: it is stopped (state T)`
+    );
+    expect(error.hint).toContain(`kill -CONT ${PID}`);
+  });
+
+  (process.platform === 'linux' ? it : it.skip)('reads this process from /proc', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(
+      process.pid,
+      { socketPath: __filename, lockfilePath: __filename },
+      getDefaultOwnerProcessReaders()
+    );
+    expect(diagnosis.isRushDaemon).toBe(false);
+    expect(diagnosis.isWorkspaceDaemon).toBe(false);
+    expect(diagnosis.isSocketMissing).toBe(false);
+    expect(diagnosis.subject).toMatch(new RegExp(`^PID ${process.pid} \\(".+"\\)$`));
+    expect(diagnosis.facts).toMatch(
+      /^: it is (running|waiting) \(state [RS]\), and it started \d+ (s|min) ago$/
+    );
+  });
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'proves from /proc which process has a daemon ownership record open',
+    async () => {
+      const { hasFileOpen } = getDefaultOwnerProcessReaders();
+      const folder: string = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'rush-owner-'));
+      const link: string = `${folder}-link`;
+      await fs.promises.symlink(folder, link);
+      const paths: IDaemonPaths = {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'd.pid.json')
+      };
+      const otherFile: string = path.join(folder, 'other.pid.json');
+      await fs.promises.writeFile(otherFile, '');
+      let listener: DaemonFrameListener | undefined;
+      let other: ChildProcess | undefined;
+      try {
+        // As rushd does: it publishes its socket, then writes its record and keeps it open.
+        listener = await DaemonFrameListener.listenAsync(paths, {
+          protocolVersion: DAEMON_PROTOCOL_VERSION,
+          onConnection: () => undefined
+        });
+        expect(hasFileOpen(process.pid, paths.lockfilePath)).toBe(true);
+        // The kernel names the file by its real path.
+        expect(hasFileOpen(process.pid, path.join(link, 'd.pid.json'))).toBe(true);
+        expect(hasFileOpen(process.pid, otherFile)).toBe(false);
+        await fs.promises.unlink(paths.socketPath);
+        expect(hasFileOpen(process.pid, paths.lockfilePath)).toBe(true);
+        // Another process, which has another file open.
+        other = spawn(
+          process.execPath,
+          [
+            '-e',
+            "require('node:fs').openSync(process.argv[1], 'r'); console.log('open'); setInterval(() => {}, 1000)",
+            otherFile
+          ],
+          { stdio: ['ignore', 'pipe', 'ignore'] }
+        );
+        await once(other.stdout!, 'data');
+        expect(hasFileOpen(other.pid!, otherFile)).toBe(true);
+        expect(hasFileOpen(other.pid!, paths.lockfilePath)).toBe(false);
+        // A file that took the record's path later is not the one that this process has open.
+        await fs.promises.unlink(paths.lockfilePath);
+        await fs.promises.writeFile(paths.lockfilePath, '{}');
+        expect(hasFileOpen(process.pid, paths.lockfilePath)).toBe(false);
+      } finally {
+        await listener?.closeAsync();
+        if (other && other.exitCode === null && other.signalCode === null) {
+          const exited: Promise<unknown> = once(other, 'exit');
+          // Only the process that this test started, by its PID.
+          other.kill('SIGKILL');
+          await exited;
+        }
+      }
+      expect(hasFileOpen(process.pid, otherFile)).toBe(false);
+      expect(hasFileOpen(process.pid, path.join(folder, 'missing'))).toBeUndefined();
+      await fs.promises.rm(link);
+      await fs.promises.rm(folder, { recursive: true, force: true });
+    }
+  );
+
+  // A failed command can load the daemon launcher only after the diagnosis found the socket.
+  (process.platform === 'win32' ? it.skip : it)(
+    'leaves require() resolving symlinks after it finds the socket',
+    async () => {
+      // Short, as a socket path must be.
+      const folder: string = await fs.promises.mkdtemp('/tmp/rush-owner-require-');
+      try {
+        const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+          folder,
+          [
+            "const net = require('node:net');",
+            'const [modulePath, socketPath, lockfilePath] = args;',
+            'const server = net.createServer();',
+            'await new Promise((resolve) => server.listen(socketPath, resolve));',
+            'const { diagnoseDaemonOwner } = require(modulePath);',
+            "const paths = { runtimeDir: '', socketPath, lockfilePath };",
+            'process.stdout.write(`${diagnoseDaemonOwner(process.pid, paths).isSocketMissing} `);',
+            'server.close();'
+          ].join('\n'),
+          [
+            require.resolve('../DaemonOwnerDiagnosis'),
+            path.join(folder, 'd.sock'),
+            path.join(folder, 'd.pid.json')
+          ]
+        );
+
+        expect(result).toEqual({ status: 0, stdout: 'false found', stderr: '' });
+      } finally {
+        await fs.promises.rm(folder, { recursive: true, force: true });
+      }
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts b/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
new file mode 100644
index 00000000000..81a8a96e927
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
@@ -0,0 +1,99 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
+import { formatDaemonRestartCause } from '../DaemonRestartCause';
+
+describe(formatDaemonRestartCause.name, () => {
+  it.each<[DaemonRestartReason, string, string]>([
+    [
+      { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+      'because its installation at /snapshots/s9 was removed',
+      "because the daemon's installation at /snapshots/s9 was removed"
+    ],
+    [
+      { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS'] },
+      "because this request's environment differs from the daemon's in NODE_OPTIONS",
+      "because its environment differs from the daemon's in NODE_OPTIONS"
+    ],
+    [
+      { kind: 'environmentChanged', variableNames: [] },
+      "because this request's environment differs from the daemon's",
+      "because its environment differs from the daemon's"
+    ],
+    [
+      { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/pnpm-lock.yaml'] },
+      'because common/config/rush/pnpm-lock.yaml changed',
+      'because common/config/rush/pnpm-lock.yaml changed'
+    ],
+    [
+      { kind: 'workspaceInputsChanged', installationFiles: [] },
+      "because the workspace's installation changed",
+      "because the workspace's installation changed"
+    ],
+    [
+      { kind: 'workspaceInputsChanged', implementationFiles: ['common/autoinstallers/p/lib/index.js'] },
+      'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/lib/index.js)',
+      'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/lib/index.js)'
+    ],
+    [
+      { kind: 'workspaceInputsChanged', implementationFiles: [] },
+      'because the code of Rush or a Rush plugin changed',
+      'because the code of Rush or a Rush plugin changed'
+    ],
+    [
+      { kind: 'workspaceInputsChanged', selectedRushVersion: '5.180.0' },
+      'because this request selects Rush 5.180.0',
+      'because it selects Rush 5.180.0'
+    ],
+    [
+      { kind: 'workspaceInputsChanged' },
+      'because the inputs that the daemon started with changed',
+      'because the inputs that the daemon started with changed'
+    ],
+    [
+      { kind: 'nativeMutation', commandName: 'install' },
+      'because this request runs rush install',
+      'because it runs rush install'
+    ],
+    [
+      { kind: 'nativeMutation', commandName: 'update' },
+      'because this request runs rush update',
+      'because it runs rush update'
+    ]
+  ])('explains %j', (reason, forThisRequest, forAnotherRequest) => {
+    expect(formatDaemonRestartCause(reason, 'thisRequest')).toBe(forThisRequest);
+    expect(formatDaemonRestartCause(reason, 'anotherRequest')).toBe(forAnotherRequest);
+  });
+
+  it('joins every changed input, and lists at most four names of each', () => {
+    expect(
+      formatDaemonRestartCause(
+        {
+          kind: 'workspaceInputsChanged',
+          installationFiles: ['a', 'b'],
+          implementationFiles: ['c'],
+          selectedRushVersion: '5.180.0'
+        },
+        'thisRequest'
+      )
+    ).toBe(
+      'because a and b changed, the code of Rush or a Rush plugin changed (c) and this request selects Rush 5.180.0'
+    );
+    expect(
+      formatDaemonRestartCause(
+        { kind: 'environmentChanged', variableNames: ['A', 'B', 'C', 'D', 'E', 'F'] },
+        'thisRequest'
+      )
+    ).toBe("because this request's environment differs from the daemon's in A, B, C, D and 2 more");
+    expect(
+      formatDaemonRestartCause({ kind: 'environmentChanged', variableNames: ['A', 'B', 'C'] }, 'thisRequest')
+    ).toBe("because this request's environment differs from the daemon's in A, B and C");
+  });
+
+  it('does not explain a reason kind that it does not know', () => {
+    const reason: unknown = { kind: 'futureInputsChanged' };
+    expect(formatDaemonRestartCause(reason as DaemonRestartReason, 'thisRequest')).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts b/libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts
new file mode 100644
index 00000000000..b7f67d1a509
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts
@@ -0,0 +1,124 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient } from '../DaemonClient';
+import { DaemonClientError } from '../DaemonClientError';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { DaemonRestartFailedError, executeWithDaemonRestartAsync } from '../executeWithDaemonRestart';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+function readLines(filePath: string): string[] {
+  return fs.readFileSync(filePath, 'utf8').trim().split('\n');
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe(DaemonRestartFailedError.name, () => {
+  let folder: string;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-restart-failed-'));
+    const paths: IDaemonPaths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-restart-failed-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = readLines(path.join(folder, 'starts'));
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(readLines(path.join(folder, 'parents')));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  it('keeps the code and message of a startup error whose code is timeout', async () => {
+    // The daemon asks for a restart because its installation was removed, and then keeps its ownership.
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-installation-held']
+      }
+    };
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false }
+    });
+    let error: unknown;
+    try {
+      // The handoff times out while the previous daemon still owns the lockfile, which is a `timeout` error.
+      error = await executeWithDaemonRestartAsync(
+        client,
+        { ...connection, startupTimeoutMs: 100 },
+        { request }
+      ).catch((caught: unknown) => caught);
+    } finally {
+      await client.closeAsync();
+    }
+    expect(error).toBeInstanceOf(DaemonRestartFailedError);
+    const { cause, code, message, restartReason } = error as DaemonRestartFailedError;
+    expect(cause).toBeInstanceOf(DaemonClientError);
+    expect(cause).not.toBeInstanceOf(DaemonRestartFailedError);
+    expect((cause as DaemonClientError).code).toBe('timeout');
+    expect(code).toBe('timeout');
+    expect(message).toBe((cause as DaemonClientError).message);
+    expect(message).toContain('The previous daemon still owns');
+    expect(restartReason).toEqual({
+      kind: 'installationChanged',
+      change: 'removed',
+      folder: path.join(folder, 'gone')
+    });
+    expect(readLines(path.join(folder, 'starts'))).toHaveLength(1);
+    expect(readLines(path.join(folder, 'requests'))).toHaveLength(1);
+    // The daemon kept its ownership: it did not stop as if for an ordinary restart.
+    expect(readIfPresent(path.join(folder, 'restarted'))).toBe('');
+  });
+});
diff --git a/libraries/rush-client-core/src/test/DaemonStartup.test.ts b/libraries/rush-client-core/src/test/DaemonStartup.test.ts
new file mode 100644
index 00000000000..37420061e71
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonStartup.test.ts
@@ -0,0 +1,141 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage,
+  type DaemonControlMessage
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameConnection, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { getDaemonStartupFilePath, reserveDaemonStartup, runDaemonStartupAsync } from '../DaemonStartup';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(5);
+  }
+}
+
+function isProcessGone(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ESRCH') return true;
+    throw error;
+  }
+}
+
+describe(runDaemonStartupAsync.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-startup-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    await removeTestFolderAsync(folder);
+  });
+
+  it('releases its reservation for a ready daemon although its own launcher exited during the last attempt', async () => {
+    // Like a daemon that another launch published while this helper's launcher found it and exited: the launcher
+    // exits while a connection attempt is pending, that attempt fails, and the next one finds a ready daemon.
+    const pending: DaemonFrameConnection[] = [];
+    const closedConnections: Set<DaemonFrameConnection> = new Set();
+    let answering: boolean = false;
+    const sockets: Set<net.Socket> = new Set();
+    const server: net.Server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+      const connection: DaemonFrameConnection = new DaemonFrameConnection(socket);
+      connection.onClosed(() => closedConnections.add(connection));
+      connection.onFrame(async (frame) => {
+        if (frame.kind !== DaemonFrameType.controlJson) return;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        let reply: DaemonControlMessage | undefined;
+        if (message.kind === 'hello') {
+          if (!answering) {
+            pending.push(connection);
+            return;
+          }
+          reply = {
+            kind: 'helloAck',
+            payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'test' }
+          };
+        } else if (message.kind === 'ping') {
+          reply = { kind: 'pong', payload: { uptimeMs: 1, daemonVersion: 'test' } };
+        }
+        if (reply) {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage(reply)
+          });
+        }
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(paths.socketPath, resolve));
+    try {
+      const token: string = reserveDaemonStartup(paths, {
+        pid: process.pid,
+        startedAt: new Date().toISOString()
+      });
+      const launcherPidPath: string = path.join(folder, 'launcher-pid');
+      const exitNowPath: string = path.join(folder, 'exit-now');
+      const launcher: string = [
+        "const fs = require('fs');",
+        'fs.writeFileSync(process.argv[1], String(process.pid));',
+        'setInterval(() => { if (fs.existsSync(process.argv[2])) process.exit(1); }, 5);'
+      ].join('\n');
+      const outcome: Promise<string> = runDaemonStartupAsync({
+        paths,
+        token,
+        timeoutMs: 10000,
+        startCommand: {
+          command: process.execPath,
+          args: ['-e', launcher, launcherPidPath, exitNowPath],
+          cwd: folder,
+          environment: { PATH: process.env.PATH ?? '', SystemRoot: process.env.SystemRoot ?? '' }
+        }
+      }).then(
+        () => 'resolved',
+        (error: Error) => error.message
+      );
+
+      await waitUntilAsync(() => pending.length > 0 && fs.existsSync(launcherPidPath), 'the first attempt');
+      const attempt: DaemonFrameConnection = pending[pending.length - 1];
+      const launcherPid: number = Number(fs.readFileSync(launcherPidPath, 'utf8'));
+      fs.writeFileSync(exitNowPath, '');
+      // This process spawned the launcher, so once its PID is gone, the helper has observed its exit.
+      await waitUntilAsync(() => isProcessGone(launcherPid), 'the launcher is reaped');
+      expect(closedConnections.has(attempt)).toBe(false);
+      answering = true;
+      await attempt.closeAsync();
+
+      expect(await outcome).toBe('resolved');
+      expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+});
diff --git a/libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts b/libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts
new file mode 100644
index 00000000000..40f0fcc8b6b
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts
@@ -0,0 +1,200 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage,
+  type DaemonControlMessage
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameConnection, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClient } from '../DaemonClient';
+import { getDaemonStartupFilePath, reserveDaemonStartup, runDaemonStartupAsync } from '../DaemonStartup';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+// Late enough that a readiness backoff doubling from 50 ms would already wait 500 ms between attempts.
+const LISTEN_AFTER_MS: number = 1000;
+
+interface ILateReadiness {
+  readonly outcome: string;
+  /** When each connection attempt before the daemon listened started, in ms since the helper started. */
+  readonly failedAttemptStarts: number[];
+  /** From the daemon starting to listen to its first connection, in ms. */
+  readonly connectionDelayMs: number;
+  readonly reservationRemains: boolean;
+}
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(5);
+  }
+}
+
+function isProcessGone(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ESRCH') return true;
+    throw error;
+  }
+}
+
+function createReadyDaemon(onConnection: () => void, sockets: Set<net.Socket>): net.Server {
+  return net.createServer((socket) => {
+    onConnection();
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+    const connection: DaemonFrameConnection = new DaemonFrameConnection(socket);
+    connection.onFrame(async (frame) => {
+      if (frame.kind !== DaemonFrameType.controlJson) return;
+      const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+      let reply: DaemonControlMessage | undefined;
+      if (message.kind === 'hello') {
+        reply = {
+          kind: 'helloAck',
+          payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'test' }
+        };
+      } else if (message.kind === 'ping') {
+        reply = { kind: 'pong', payload: { uptimeMs: 1, daemonVersion: 'test' } };
+      }
+      if (reply) {
+        await connection.sendFrameAsync({
+          kind: DaemonFrameType.controlJson,
+          payload: encodeDaemonControlMessage(reply)
+        });
+      }
+    });
+  });
+}
+
+describe(`${runDaemonStartupAsync.name} readiness polling`, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-startup-poll-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    await removeTestFolderAsync(folder);
+  });
+
+  /**
+   * Runs the helper against a launcher that stays alive while nothing listens, like a daemon that is still
+   * starting. The daemon starts listening right after the first failed attempt that began `LISTEN_AFTER_MS`
+   * after the helper, and answers hello and ping from then on.
+   */
+  async function runWithLateReadinessAsync(): Promise<ILateReadiness> {
+    const sockets: Set<net.Socket> = new Set();
+    let firstConnectionAt: number | undefined;
+    const server: net.Server = createReadyDaemon(() => {
+      firstConnectionAt ??= performance.now();
+    }, sockets);
+    let listenedAt: number | undefined;
+    const failedAttemptStarts: number[] = [];
+    const startedAt: number = performance.now();
+    const connectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync.bind(DaemonClient);
+    jest.spyOn(DaemonClient, 'connectAsync').mockImplementation(async (options) => {
+      const attemptStart: number = performance.now() - startedAt;
+      try {
+        return await connectAsync(options);
+      } catch (error) {
+        if (listenedAt === undefined) {
+          failedAttemptStarts.push(attemptStart);
+          if (attemptStart >= LISTEN_AFTER_MS) {
+            // listen() binds before it returns, so the endpoint accepts connections from here on.
+            server.listen(paths.socketPath);
+            listenedAt = performance.now();
+          }
+        }
+        throw error;
+      }
+    });
+
+    const launcherPidPath: string = path.join(folder, 'launcher-pid');
+    const exitNowPath: string = path.join(folder, 'exit-now');
+    const launcher: string = [
+      "const fs = require('fs');",
+      'fs.writeFileSync(process.argv[1], String(process.pid));',
+      'setInterval(() => { if (fs.existsSync(process.argv[2])) process.exit(0); }, 5);'
+    ].join('\n');
+    try {
+      const token: string = reserveDaemonStartup(paths, {
+        pid: process.pid,
+        startedAt: new Date().toISOString()
+      });
+      const outcome: string = await runDaemonStartupAsync({
+        paths,
+        token,
+        timeoutMs: 10000,
+        startCommand: {
+          command: process.execPath,
+          args: ['-e', launcher, launcherPidPath, exitNowPath],
+          cwd: folder,
+          environment: { PATH: process.env.PATH ?? '', SystemRoot: process.env.SystemRoot ?? '' }
+        }
+      }).then(
+        () => 'resolved',
+        (error: Error) => error.message
+      );
+      if (listenedAt === undefined || firstConnectionAt === undefined) {
+        throw new Error(`The daemon never listened or was never reached (${outcome}).`);
+      }
+      return {
+        outcome,
+        failedAttemptStarts,
+        connectionDelayMs: firstConnectionAt - listenedAt,
+        reservationRemains: fs.existsSync(getDaemonStartupFilePath(paths))
+      };
+    } finally {
+      fs.writeFileSync(exitNowPath, '');
+      if (fs.existsSync(launcherPidPath)) {
+        const launcherPid: number = Number(fs.readFileSync(launcherPidPath, 'utf8'));
+        await waitUntilAsync(() => isProcessGone(launcherPid), 'the launcher exits');
+      }
+      for (const socket of sockets) socket.destroy();
+      if (server.listening) await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  }
+
+  it('connects within one short poll after the daemon starts listening late in its start', async () => {
+    const result: ILateReadiness = await runWithLateReadinessAsync();
+
+    expect(result.outcome).toBe('resolved');
+    expect(result.reservationRemains).toBe(false);
+    expect(result.connectionDelayMs).toBeLessThan(150);
+  });
+
+  it('waits between readiness attempts instead of spinning', async () => {
+    const { outcome, failedAttemptStarts }: ILateReadiness = await runWithLateReadinessAsync();
+
+    expect(outcome).toBe('resolved');
+    const shortGaps: number[] = [];
+    for (let i: number = 1; i < failedAttemptStarts.length; i++) {
+      const gap: number = failedAttemptStarts[i] - failedAttemptStarts[i - 1];
+      if (gap < 25) shortGaps.push(Math.round(gap));
+    }
+    expect(failedAttemptStarts.length).toBeGreaterThan(1);
+    expect(shortGaps).toEqual([]);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/DaemonStartupReservation.test.ts b/libraries/rush-client-core/src/test/DaemonStartupReservation.test.ts
index 2662680f0df..2a208563f1c 100644
--- a/libraries/rush-client-core/src/test/DaemonStartupReservation.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonStartupReservation.test.ts
@@ -4,59 +4,96 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import {
   getDaemonStartupFilePath,
-  reclaimStaleDaemonStartupReservation,
-  releaseDaemonStartup,
+  readDaemonStartupReservation,
   reserveDaemonStartup,
-  updateDaemonStartupReservation
+  type IDaemonStartupReservation
+} from '../DaemonStartup';
+import {
+  getStartupHelperState,
+  tryTakeOverAbandonedStartupReservationAsync
 } from '../DaemonStartupReservation';
+import { isProcessDefunct } from '../ProcessStartTime';
+import { removeTestFolderAsync } from './TestProcessExit';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+function getDaemonPaths(runtimeDir: string): IDaemonPaths {
+  return {
+    runtimeDir,
+    socketPath:
+      process.platform === 'win32'
+        ? `\\\\.\\pipe\\rush-client-reservation-${path.basename(runtimeDir)}`
+        : path.join(runtimeDir, 'd.sock'),
+    lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+  };
+}
 
-describe('daemon startup reservation mutations', () => {
+function getIsoOffset(offsetMs: number): string {
+  return new Date(Date.now() + offsetMs).toISOString();
+}
+
+describe('daemon startup reservations', () => {
   let folder: string;
   let paths: IDaemonPaths;
 
   beforeEach(() => {
-    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reservation-'));
-    paths = {
-      runtimeDir: folder,
-      socketPath: path.join(folder, 'd.sock'),
-      lockfilePath: path.join(folder, 'daemon.pid.json')
-    };
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-reservation-'));
+    paths = getDaemonPaths(folder);
   });
 
-  afterEach(() => {
-    fs.rmSync(folder, { recursive: true, force: true });
+  afterEach(async () => {
+    await removeTestFolderAsync(folder);
   });
 
-  it('never lets a stale owner update or release a replacement reservation', () => {
-    const staleToken: string = reserveDaemonStartup(paths, 0);
-    fs.rmSync(getDaemonStartupFilePath(paths));
-    reserveDaemonStartup(paths, 1000);
-    const replacement: string = fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8');
-    expect(() => updateDaemonStartupReservation(paths, staleToken, { launcherPid: 1 })).toThrow(
-      'changed ownership'
-    );
-    expect(() => releaseDaemonStartup(paths, staleToken)).toThrow('changed ownership');
-    expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(replacement);
+  it('takes over an expired helper readiness deadline even when the recorded PID is live', async () => {
+    reserveDaemonStartup(paths, {
+      pid: process.pid,
+      startedAt: getIsoOffset(-180_000),
+      readinessDeadline: getIsoOffset(-61_000)
+    });
+    const reservation = getRequiredReservation();
+
+    await expect(tryTakeOverAbandonedStartupReservationAsync(paths, reservation)).resolves.toBe(true);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
   });
 
-  it('serializes reclaim with other reservation mutations', () => {
-    reserveDaemonStartup(paths, 1000);
-    const lock: LockFile | undefined = LockFile.tryAcquire(folder, 'daemon.pid.json-reservation');
-    expect(lock).toBeDefined();
-    const started: number = Date.now();
-    try {
-      expect(() => reclaimStaleDaemonStartupReservation(paths, 1000)).toThrow('reservation lock');
-    } finally {
-      lock?.release();
-    }
-    expect(Date.now() - started).toBeGreaterThanOrEqual(4000);
-    expect(reclaimStaleDaemonStartupReservation(paths, 1000)).toBe(false);
+  it('keeps a live helper reservation within its readiness deadline', async () => {
+    reserveDaemonStartup(paths, {
+      pid: process.pid,
+      startedAt: getIsoOffset(-1_000),
+      readinessDeadline: getIsoOffset(60_000)
+    });
+    const reservation = getRequiredReservation();
+
+    await expect(tryTakeOverAbandonedStartupReservationAsync(paths, reservation)).resolves.toBe(false);
     expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(true);
-  }, 15000);
+  });
+
+  linuxIt('treats a defunct startup helper as exited', async () => {
+    await withUnreapedChildAsync(async (pid) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(pid) && Date.now() < deadline) await delayAsync(20);
+      expect(isProcessDefunct(pid)).toBe(true);
+      reserveDaemonStartup(paths, {
+        pid,
+        startedAt: getIsoOffset(-1_000),
+        readinessDeadline: getIsoOffset(60_000)
+      });
+
+      expect(getStartupHelperState(getRequiredReservation())).toBe('exited');
+    });
+  });
+
+  function getRequiredReservation(): IDaemonStartupReservation {
+    const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+    if (!reservation) throw new Error('Expected a startup reservation.');
+    return reservation;
+  }
 });
diff --git a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
new file mode 100644
index 00000000000..5fb3a8c4471
--- /dev/null
+++ b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
@@ -0,0 +1,281 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { reclaimCrashedDaemonAsync } from '../ExitedDaemonReclaim';
+import { isProcessDefunct } from '../ProcessStartTime';
+import { findReclaimedDaemonPid } from '../ReclaimedDaemonLog';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  isRunning,
+  readClientLogTexts,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  startExitedProcessAsync,
+  startOrphanedOperationAsync,
+  startStandInDaemonAsync,
+  stopOperationIfRunning,
+  type IStandInDaemon
+} from './OrphanedOperation';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+function getDaemonPaths(runtimeDir: string): IDaemonPaths {
+  return {
+    runtimeDir,
+    socketPath: path.join(runtimeDir, 'd.sock'),
+    lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+  };
+}
+
+describe(reclaimCrashedDaemonAsync.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+  let warning: jest.SpyInstance;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-crash-reclaim-'));
+    paths = getDaemonPaths(folder);
+    operationPids = [];
+    warning = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  });
+
+  afterEach(async () => {
+    warning.mockRestore();
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  it('does nothing, and creates no runtime folder, when there is no ownership record', async () => {
+    const runtimeDir: string = path.join(folder, 'runtime');
+    await reclaimCrashedDaemonAsync(getDaemonPaths(runtimeDir));
+    expect(fs.existsSync(runtimeDir)).toBe(false);
+    expect(warning).not.toHaveBeenCalled();
+  });
+
+  linuxIt('stops the operations that a crashed daemon left running, and removes its files', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    await reclaimCrashedDaemonAsync(paths);
+    expect(isRunning(operationPid)).toBe(false);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(warning).toHaveBeenCalledWith(
+      expect.stringContaining(`Reclaimed dead daemon ${daemonPid}:`),
+      expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+    );
+  });
+
+  linuxIt('reports what it stopped to onOrphansReaped instead of a process warning', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    const reaps: IDaemonOrphanReap[] = [];
+    await reclaimCrashedDaemonAsync(paths, {
+      onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+    });
+    expect(isRunning(operationPid)).toBe(false);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    expect(warning).not.toHaveBeenCalled();
+  });
+
+  /**
+   * Records an exited owner that recorded one operation group whose leader has another start time, as if a
+   * process that started later has the PID of the group's leader now. Returns the owner's PID and that PID.
+   */
+  async function recordChangedLeaderAsync(): Promise<[number, number]> {
+    const daemonPid: number = await startExitedProcessAsync();
+    const other: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    const earlier: string = String(Number(readProcessStartTime(other)) - 1);
+    recordOperationGroup(paths.lockfilePath, daemonPid, other, earlier);
+    return [daemonPid, other];
+  }
+
+  linuxIt('logs a recorded group that it leaves running, before the line that names the daemon', async () => {
+    const [daemonPid, other] = await recordChangedLeaderAsync();
+    await reclaimCrashedDaemonAsync(paths);
+    expect(isRunning(other)).toBe(true);
+    expect(readClientLogTexts(paths)).toEqual([
+      `left process group ${other} running, which the exited daemon (PID ${daemonPid}) recorded for an ` +
+        `operation: the process with PID ${other} now is not the leader that the daemon recorded.`,
+      `rushd (PID ${daemonPid}) exited without shutting down; stopped the operations it left running that ` +
+        'could be proven to be its own, and removed its ownership record and socket.'
+    ]);
+    expect(findReclaimedDaemonPid(paths)).toBe(daemonPid);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(fs.existsSync(`${paths.lockfilePath}.groups-${daemonPid}`)).toBe(false);
+    expect(warning).not.toHaveBeenCalled();
+  });
+
+  linuxIt(
+    'gives a recorded group that it leaves running to onOperationGroupLeftRunning instead',
+    async () => {
+      const [daemonPid, other] = await recordChangedLeaderAsync();
+      const groups: IDaemonOperationGroupLeftRunning[] = [];
+      await reclaimCrashedDaemonAsync(paths, {
+        onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => groups.push(group)
+      });
+      expect(isRunning(other)).toBe(true);
+      expect(groups).toEqual([{ daemonPid, processGroupId: other, reason: 'leaderChanged' }]);
+      expect(readClientLogTexts(paths)).toEqual([
+        expect.stringMatching(new RegExp(`^rushd \\(PID ${daemonPid}\\) exited without shutting down;`))
+      ]);
+    }
+  );
+
+  linuxIt(
+    'leaves a running daemon alone, without waiting while another client holds the start mutex',
+    async () => {
+      const { daemon, operationPid }: IStandInDaemon = await startStandInDaemonAsync(operationPids);
+      // For example, a client that starts or replaces the daemon.
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      try {
+        expect(lock).toBeDefined();
+        recordDaemonOwner(paths, daemon.pid!);
+        const startedAt: number = Date.now();
+        await reclaimCrashedDaemonAsync(paths);
+        expect(Date.now() - startedAt).toBeLessThan(1000);
+        expect(isRunning(daemon.pid!)).toBe(true);
+        expect(isRunning(operationPid)).toBe(true);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+        expect(warning).not.toHaveBeenCalled();
+      } finally {
+        await lock?.releaseAsync();
+        daemon.kill('SIGKILL');
+      }
+    }
+  );
+
+  linuxIt('reclaims operation groups when the recorded daemon PID was reused', async () => {
+    const operationPid: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, process.pid, '1970-01-01T00:00:00.000Z');
+    recordOperationGroup(paths.lockfilePath, process.pid, operationPid, readProcessStartTime(operationPid));
+
+    await reclaimCrashedDaemonAsync(paths);
+
+    expect(isRunning(operationPid)).toBe(false);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(warning).toHaveBeenCalledWith(
+      expect.stringContaining(`Reclaimed dead daemon ${process.pid}:`),
+      expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+    );
+  });
+
+  linuxIt('leaves a daemon whose endpoint accepts connections, even when its PID seems reused', async () => {
+    // After the wall clock jumps forward, a running daemon can seem to have started after its record.
+    const endpoint: net.Server = net.createServer((socket: net.Socket) => socket.destroy());
+    await new Promise<void>((resolve) => endpoint.listen(paths.socketPath, resolve));
+    try {
+      const operationPid: number = await startDetachedOperationAsync(operationPids);
+      recordDaemonOwner(paths, process.pid, '1970-01-01T00:00:00.000Z');
+      recordOperationGroup(paths.lockfilePath, process.pid, operationPid, readProcessStartTime(operationPid));
+
+      await reclaimCrashedDaemonAsync(paths);
+
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      expect(readClientLogTexts(paths)).toEqual([]);
+      expect(warning).not.toHaveBeenCalled();
+    } finally {
+      await new Promise<void>((resolve) => endpoint.close(() => resolve()));
+    }
+  });
+
+  linuxIt('reclaims a crashed daemon that is not reaped yet once it is reaped', async () => {
+    await withUnreapedChildAsync(async (child, parentPid) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      recordDaemonOwner(paths, child);
+      let settled: boolean = false;
+      const reclaimed: Promise<void> = reclaimCrashedDaemonAsync(paths).finally(() => {
+        settled = true;
+      });
+      // It waits up to 1 s for the process to be reaped.
+      await delayAsync(100);
+      expect(settled).toBe(false);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      // Once its parent exits, init or a subreaper reaps it.
+      process.kill(parentPid, 'SIGTERM');
+      await reclaimed;
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    });
+  });
+
+  linuxIt('gives up after 1 s on a crashed daemon that is not reaped, and keeps its files', async () => {
+    await withUnreapedChildAsync(async (child) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      recordDaemonOwner(paths, child);
+      const startedAt: number = Date.now();
+      await reclaimCrashedDaemonAsync(paths);
+      const waitedMs: number = Date.now() - startedAt;
+      // Its parent never reaps it, so a longer wait would only delay the command.
+      expect(waitedMs).toBeGreaterThanOrEqual(1000);
+      expect(waitedMs).toBeLessThan(4000);
+      expect(isProcessDefunct(child)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      expect(warning).not.toHaveBeenCalled();
+    });
+  });
+
+  linuxIt('does not act on the records in a runtime folder that is not private', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    // Another user could have created a link like this one, for example in /tmp.
+    const link: string = path.join(os.tmpdir(), `${path.basename(folder)}-link`);
+    fs.symlinkSync(folder, link);
+    const linkPaths: IDaemonPaths = getDaemonPaths(link);
+    // It does not even wait for the start mutex there.
+    const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(linkPaths);
+    try {
+      expect(lock).toBeDefined();
+      const startedAt: number = Date.now();
+      await reclaimCrashedDaemonAsync(linkPaths);
+      expect(Date.now() - startedAt).toBeLessThan(1000);
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      expect(warning).not.toHaveBeenCalled();
+      expect(fs.existsSync(getDaemonLogFilePath(paths))).toBe(false);
+    } finally {
+      await lock?.releaseAsync();
+      fs.unlinkSync(link);
+    }
+  });
+
+  linuxIt('logs the reclaim once, so that the daemon can be named after its record is gone', async () => {
+    const { daemonPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    await reclaimCrashedDaemonAsync(paths);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    const logFilePath: string = getDaemonLogFilePath(paths);
+    const logged: string = fs.readFileSync(logFilePath, 'utf8');
+    expect(logged).toMatch(
+      new RegExp(
+        `^\\S+Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${daemonPid}\\) exited without shutting down; ` +
+          'stopped the operations it left running that could be proven to be its own, and removed its ' +
+          'ownership record and socket\\.\\n$'
+      )
+    );
+    expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
+    expect(findReclaimedDaemonPid(paths)).toBe(daemonPid);
+    // Without a record there is nothing to reclaim, or to log.
+    await reclaimCrashedDaemonAsync(paths);
+    expect(fs.readFileSync(logFilePath, 'utf8')).toBe(logged);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts b/libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts
new file mode 100644
index 00000000000..31b9e5679ab
--- /dev/null
+++ b/libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts
@@ -0,0 +1,198 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess, type StdioOptions } from 'node:child_process';
+import { once } from 'node:events';
+import fs from 'node:fs';
+import type { Socket } from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { listInheritedFileDescriptors } from '../InheritedFileDescriptors';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+const LINUX_O_CLOEXEC: number = 0o2000000;
+// Each after a gap in the child's table, like the pipe of bash's `2> >(…)`, so Node does not mark it close-on-exec.
+const CHANNEL_FD: number = 40;
+const PIPE_FD: number = 63;
+const FILE_FD: number = 200;
+
+/** Whether each descriptor of a process is marked close-on-exec, from its /proc folder. */
+function readCloseOnExec(pid: number): Map<number, boolean> {
+  const descriptors: Map<number, boolean> = new Map();
+  for (const entry of fs.readdirSync(`/proc/${pid}/fd`)) {
+    let fdinfo: string;
+    try {
+      fdinfo = fs.readFileSync(`/proc/${pid}/fdinfo/${entry}`, 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    const flags: number = parseInt(/^flags:\s*([0-7]+)$/m.exec(fdinfo)![1], 8);
+    descriptors.set(Number(entry), Math.floor(flags / LINUX_O_CLOEXEC) % 2 === 1);
+  }
+  return descriptors;
+}
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(10);
+  }
+}
+
+/** The child's next message. Fails at once if the child exits first, for example because it closed its channel. */
+function receiveAsync<T>(child: ChildProcess): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const onExit = (code: number | null, signal: NodeJS.Signals | null): void =>
+      reject(new Error(`The child exited (${code ?? signal}) before it answered.`));
+    child.once('exit', onExit);
+    child.once('message', (message: T) => {
+      child.off('exit', onExit);
+      resolve(message);
+    });
+  });
+}
+
+describe('inherited file descriptors', () => {
+  let folder: string;
+  let running: { child: ChildProcess; closed: Promise<unknown[]> } | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-inherited-fds-'));
+    running = undefined;
+  });
+
+  afterEach(async () => {
+    if (running) {
+      // Without its channel, the child has nothing left to wait for and exits.
+      if (running.child.connected) running.child.disconnect();
+      await running.closed;
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  linuxIt(
+    'closes the descriptors that a started program would inherit, and keeps its own and its IPC channel',
+    async () => {
+      const stdio: (string | number)[] = new Array(FILE_FD + 1).fill('ignore');
+      stdio[2] = 'pipe';
+      stdio[CHANNEL_FD] = 'ipc';
+      stdio[PIPE_FD] = 'pipe';
+      const lockFd: number = fs.openSync(path.join(folder, 'lock'), 'w');
+      let child: ChildProcess;
+      try {
+        stdio[FILE_FD] = lockFd;
+        child = spawn(
+          process.execPath,
+          [path.join(__dirname, 'fixtures/inheritedDescriptors.js'), path.join(folder, 'own')],
+          { stdio: stdio as StdioOptions }
+        );
+      } finally {
+        fs.closeSync(lockFd);
+      }
+      running = { child, closed: once(child, 'close') };
+      let stderr: string = '';
+      child.stderr!.on('data', (chunk: Buffer) => {
+        stderr += chunk.toString();
+      });
+      const pipe: Socket = child.stdio[PIPE_FD] as Socket;
+      let pipeEnded: boolean = false;
+      pipe.once('end', () => {
+        pipeEnded = true;
+      });
+      pipe.resume();
+
+      const { ownFd } = await receiveAsync<{ ownFd: number }>(child);
+      const before: Map<number, boolean> = readCloseOnExec(child.pid!);
+      expect([CHANNEL_FD, PIPE_FD, FILE_FD, ownFd].map((fd) => before.get(fd))).toEqual([
+        false,
+        false,
+        false,
+        true
+      ]);
+
+      child.send('close');
+      const { closed } = await receiveAsync<{ closed: number[] }>(child);
+      expect(closed).toEqual(expect.arrayContaining([PIPE_FD, FILE_FD]));
+      // Nothing that was close-on-exec.
+      expect(closed.filter((fd) => before.get(fd) !== false)).toEqual([]);
+      const after: Map<number, boolean> = readCloseOnExec(child.pid!);
+      expect([...after].filter(([fd, closeOnExec]) => fd > 2 && fd !== CHANNEL_FD && !closeOnExec)).toEqual(
+        []
+      );
+      expect([after.has(CHANNEL_FD), after.has(ownFd)]).toEqual([true, true]);
+      // The pipe's reader sees end-of-file while the child still runs.
+      await waitUntilAsync(() => pipeEnded, 'the pipe ends');
+      expect(child.exitCode).toBeNull();
+
+      child.send('exit');
+      const [code] = await running.closed;
+      expect({ code, stderr, own: fs.readFileSync(path.join(folder, 'own'), 'utf8') }).toEqual({
+        code: 0,
+        stderr: '',
+        own: 'still open'
+      });
+    },
+    20000
+  );
+
+  describe('in this process', () => {
+    const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+    const channel: PropertyDescriptor | undefined = Object.getOwnPropertyDescriptor(process, 'channel');
+
+    beforeEach(() => {
+      // Jest gives the tests a copy of the process, whose copy of the IPC channel cannot report its descriptor.
+      Object.defineProperty(process, 'channel', { value: undefined, configurable: true });
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+      Object.defineProperty(process, 'platform', platform);
+      if (channel) {
+        Object.defineProperty(process, 'channel', channel);
+      } else {
+        delete (process as { channel?: unknown }).channel;
+      }
+    });
+
+    linuxIt('lists them where /proc/self/fdinfo reports close-on-exec, as Linux does', () => {
+      expect(listInheritedFileDescriptors()).toEqual(expect.any(Array));
+    });
+
+    it('lists nothing on a platform other than Linux', () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      const openSync: jest.SpyInstance = jest.spyOn(fs, 'openSync');
+      expect(listInheritedFileDescriptors()).toBeUndefined();
+      expect(openSync).not.toHaveBeenCalled();
+    });
+
+    // Where /proc is missing or reports something else, it would otherwise close descriptors that Node uses.
+    const fdinfoReaders: [string, (fdinfoPath: string) => string][] = [
+      ['has no close-on-exec flag for a descriptor that Node opened', () => 'pos:\t0\nflags:\t0100002\n'],
+      ['has no flags', () => 'pos:\t0\n'],
+      [
+        'is missing',
+        (fdinfoPath: string) => {
+          throw Object.assign(new Error(`ENOENT: no such file or directory, open '${fdinfoPath}'`), {
+            code: 'ENOENT'
+          });
+        }
+      ]
+    ];
+    linuxIt.each(fdinfoReaders)('lists nothing when /proc/self/fdinfo %s', (kind, readFdinfo) => {
+      const readFileSync: typeof fs.readFileSync = fs.readFileSync;
+      jest
+        .spyOn(fs, 'readFileSync')
+        .mockImplementation(((filePath: string, options: BufferEncoding) =>
+          String(filePath).startsWith('/proc/self/fdinfo/')
+            ? readFdinfo(String(filePath))
+            : readFileSync(filePath, options)) as typeof fs.readFileSync);
+      expect(listInheritedFileDescriptors()).toBeUndefined();
+    });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/NativeLockHolder.test.ts b/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
new file mode 100644
index 00000000000..0bd0fab08cf
--- /dev/null
+++ b/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
@@ -0,0 +1,216 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { findNativeLockHolder, formatNativeLockCommand, formatNativeLockHolder } from '../NativeLockHolder';
+import { tryGetProcessState } from '../ProcessStartTime';
+
+// The tests start Node.js processes, which can take longer than Jest's default 5 seconds on a busy machine.
+jest.setTimeout(30_000);
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/native-lock-holder');
+const HOUR_MS: number = 60 * 60 * 1000;
+/** No process has this PID: Linux gives PIDs below 4194304, the most that pid_max can be. */
+const NO_SUCH_PID: number = 4194304;
+
+function createLockFolder(name: string): string {
+  const folder: string = path.join(TEST_FOLDER, name);
+  fs.rmSync(folder, { recursive: true, force: true });
+  fs.mkdirSync(folder, { recursive: true });
+  return folder;
+}
+
+/** Writes a lock file as LockFile.acquire does, with its owner's start time, and dates it `ageMs` back. */
+function writeLockFile(
+  folder: string,
+  pid: number,
+  ageMs: number = 0,
+  content: string = 'start time',
+  resourceName: string = 'rush'
+): void {
+  const filePath: string = path.join(folder, `${resourceName}#${pid}.lock`);
+  fs.writeFileSync(filePath, content);
+  const time: Date = new Date(Date.now() - ageMs);
+  fs.utimesSync(filePath, time, time);
+}
+
+/** Starts a process that looks like `<program> <args>` to /proc, and runs until its stdin ends. */
+async function startProgramAsync(folder: string, program: string, args: string[]): Promise<ChildProcess> {
+  const script: string = path.join(folder, program);
+  fs.writeFileSync(script, "process.stdin.resume();process.stdin.on('end',()=>process.exit(0));");
+  const child: ChildProcess = spawn(process.execPath, [script, ...args], {
+    stdio: ['pipe', 'ignore', 'ignore']
+  });
+  await once(child, 'spawn');
+  return child;
+}
+
+async function stopProgramAsync(child: ChildProcess): Promise<void> {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  const closed: Promise<unknown[]> = once(child, 'close');
+  child.stdin!.end();
+  await closed;
+}
+
+/** Waits until the state of `pid` in /proc satisfies `isExpected`. */
+async function waitForStateAsync(
+  pid: number,
+  isExpected: (code: string | undefined) => boolean
+): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!isExpected(tryGetProcessState(pid)?.code)) {
+    if (Date.now() > deadline) throw new Error(`PID ${pid} stayed in state ${tryGetProcessState(pid)?.code}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+async function getExitedPidAsync(): Promise<number> {
+  const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+  await once(exited, 'close');
+  return exited.pid!;
+}
+
+describe(formatNativeLockHolder.name, () => {
+  it.each([
+    [
+      { pid: NO_SUCH_PID, command: 'rush install' },
+      `another Rush process (PID ${NO_SUCH_PID}: rush install)`
+    ],
+    [{ pid: NO_SUCH_PID }, `another Rush process (PID ${NO_SUCH_PID})`],
+    [{ command: 'rush install' }, 'another Rush process (rush install)'],
+    [{}, 'another Rush process'],
+    [undefined, 'another Rush process']
+  ])('names %j as %j', (holder, expected) => {
+    expect(formatNativeLockHolder(holder)).toBe(expected);
+  });
+
+  linuxIt(
+    'says that the process is stopped for as long as it is, since it cannot release the lock',
+    async () => {
+      const folder: string = createLockFolder('stopped');
+      const holder: ChildProcess = await startProgramAsync(folder, 'rush', ['install']);
+      const pid: number = holder.pid!;
+      try {
+        holder.kill('SIGSTOP');
+        await waitForStateAsync(pid, (code) => code === 'T');
+        expect(formatNativeLockHolder({ pid, command: 'rush install' })).toBe(
+          `another Rush process (PID ${pid}: rush install; it is stopped (state T), for example by SIGSTOP)`
+        );
+        expect(formatNativeLockHolder({ pid })).toBe(
+          `another Rush process (PID ${pid}; it is stopped (state T), for example by SIGSTOP)`
+        );
+
+        holder.kill('SIGCONT');
+        await waitForStateAsync(pid, (code) => code !== 'T');
+        expect(formatNativeLockHolder({ pid, command: 'rush install' })).toBe(
+          `another Rush process (PID ${pid}: rush install)`
+        );
+      } finally {
+        holder.kill('SIGCONT');
+        await stopProgramAsync(holder);
+      }
+    }
+  );
+});
+
+describe(formatNativeLockCommand.name, () => {
+  it.each([
+    [
+      ['node', '/home/u/.rush/node_modules/@microsoft/rush/bin/rush', 'install', '--bypass-policy'],
+      'rush install'
+    ],
+    [
+      ['/usr/bin/node', '/repo/common/scripts/install-run-rush.js', '--debug', 'build'],
+      'install-run-rush build'
+    ],
+    [['node', '/opt/rush-client', '--wait-timeout', '30', 'build'], 'rush-client'],
+    [['node', '/repo/node_modules/.bin/rushx'], 'rushx'],
+    [['node', '/repo/rush', 'publish:beta'], 'rush publish:beta'],
+    [['node', '-e', 'require("x")'], undefined],
+    [['node'], undefined],
+    [['node', '/weird path/rush (copy)', 'build'], undefined]
+  ])('shortens %j to %j', (argv: string[], expected: string | undefined) => {
+    expect(formatNativeLockCommand(argv)).toBe(expected);
+  });
+
+  it('keeps no argument after the action, which could hold a secret', () => {
+    expect(formatNativeLockCommand(['node', '/repo/rush', 'publish', '--npm-auth-token', 'secret'])).toBe(
+      'rush publish'
+    );
+  });
+});
+
+describe(findNativeLockHolder.name, () => {
+  const children: ChildProcess[] = [];
+
+  afterEach(async () => {
+    await Promise.all(children.splice(0).map(stopProgramAsync));
+  });
+
+  linuxIt('names the live process with the oldest lock file, and its command', async () => {
+    const folder: string = createLockFolder('holder');
+    const holder: ChildProcess = await startProgramAsync(folder, 'rush', ['install', '--bypass-policy']);
+    const contender: ChildProcess = await startProgramAsync(folder, 'rush.js', ['build']);
+    children.push(holder, contender);
+    // An older lock file of an exited process is stale, and the daemon's own lock file is its own.
+    writeLockFile(folder, await getExitedPidAsync(), 3000);
+    writeLockFile(folder, process.pid, 2000);
+    writeLockFile(folder, holder.pid!, 1000);
+    writeLockFile(folder, contender.pid!, 0);
+    // PID 1 runs, and began long ago, but its lock file is for another resource.
+    writeLockFile(folder, 1, 4000, 'start time', 'other');
+
+    expect(findNativeLockHolder(folder)).toEqual({ pid: holder.pid, command: 'rush install' });
+  });
+
+  linuxIt(
+    'skips a lock file whose PID now belongs to a process that started after it was written',
+    async () => {
+      const folder: string = createLockFolder('reused-pid');
+      const reused: ChildProcess = await startProgramAsync(folder, 'rush', ['build']);
+      const holder: ChildProcess = await startProgramAsync(folder, 'rush', ['update']);
+      children.push(reused, holder);
+      writeLockFile(folder, reused.pid!, HOUR_MS);
+      writeLockFile(folder, holder.pid!, 0);
+
+      expect(findNativeLockHolder(folder)).toEqual({ pid: holder.pid, command: 'rush update' });
+    }
+  );
+
+  linuxIt(
+    'skips an empty lock file, which a process writes before it knows whether it acquired the lock',
+    async () => {
+      const folder: string = createLockFolder('empty');
+      const contender: ChildProcess = await startProgramAsync(folder, 'rush', ['build']);
+      children.push(contender);
+      writeLockFile(folder, contender.pid!, 0, '');
+
+      expect(findNativeLockHolder(folder)).toEqual({});
+    }
+  );
+
+  linuxIt('names only the PID of a holder whose command it cannot shorten', async () => {
+    const folder: string = createLockFolder('no-command');
+    const holder: ChildProcess = spawn(process.execPath, ['-e', 'process.stdin.resume()'], {
+      stdio: ['pipe', 'ignore', 'ignore']
+    });
+    await once(holder, 'spawn');
+    children.push(holder);
+    writeLockFile(folder, holder.pid!);
+
+    expect(findNativeLockHolder(folder)).toEqual({ pid: holder.pid });
+  });
+
+  it('names no holder when the folder has no live lock file, or cannot be read', async () => {
+    const folder: string = createLockFolder('none');
+    writeLockFile(folder, await getExitedPidAsync());
+
+    expect(findNativeLockHolder(folder)).toEqual({});
+    expect(findNativeLockHolder(path.join(folder, 'missing'))).toEqual({});
+  });
+});
diff --git a/libraries/rush-client-core/src/test/OrphanedOperation.ts b/libraries/rush-client-core/src/test/OrphanedOperation.ts
new file mode 100644
index 00000000000..7fe5994ec77
--- /dev/null
+++ b/libraries/rush-client-core/src/test/OrphanedOperation.ts
@@ -0,0 +1,162 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import {
+  formatOperationGroupLeftRunning,
+  isDaemonProcessAlive,
+  writeDaemonLockfile,
+  type DaemonOperationGroupLeftRunningReason,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { isProcessDefunct } from '../ProcessStartTime';
+
+/** An operation process that a stand-in daemon starts; it exits by itself after a minute. */
+export const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+// A stand-in daemon: like a phased operation, which is spawned without `detached`, its operation process
+// inherits the daemon's process group. It prints that process's PID.
+const FAKE_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process')" +
+  `.spawn(process.execPath,['-e','${OPERATION_SCRIPT}'],{stdio:'ignore'});` +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+
+/** A stand-in daemon that this test process started, and the operation process that it started. */
+export interface IStandInDaemon {
+  readonly daemon: ChildProcess;
+  readonly operationPid: number;
+}
+
+/**
+ * Starts a stand-in daemon in its own process group, and waits for its operation process. The operation's PID
+ * is added to `operationPids` first, so that {@link stopOperationIfRunning} can clean it up. POSIX only.
+ */
+export async function startStandInDaemonAsync(operationPids: number[]): Promise<IStandInDaemon> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', FAKE_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const stdout: Readable = daemon.stdout!;
+  const [chunk] = (await once(stdout, 'data')) as [Buffer];
+  stdout.destroy();
+  const operationPid: number = Number(chunk.toString().trim());
+  operationPids.push(operationPid);
+  return { daemon, operationPid };
+}
+
+/** Starts a stand-in daemon and SIGKILLs only it, so its operation process keeps running. POSIX only. */
+export async function startOrphanedOperationAsync(
+  operationPids: number[]
+): Promise<{ daemonPid: number; operationPid: number }> {
+  const { daemon, operationPid } = await startStandInDaemonAsync(operationPids);
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  if (!isRunning(operationPid)) throw new Error(`The orphaned operation ${operationPid} is not running.`);
+  return { daemonPid: daemon.pid!, operationPid };
+}
+
+/**
+ * Starts an operation process that leads its own process group and session, as Rush starts an operation. Its PID
+ * is added to `operationPids` first, so that {@link stopOperationIfRunning} can clean it up. POSIX only.
+ */
+export async function startDetachedOperationAsync(operationPids: number[]): Promise<number> {
+  const operation: ChildProcess = spawn(process.execPath, ['-e', OPERATION_SCRIPT], {
+    detached: true,
+    stdio: 'ignore'
+  });
+  await once(operation, 'spawn');
+  operationPids.push(operation.pid!);
+  return operation.pid!;
+}
+
+/** Starts a process and waits until it has exited and was reaped, so that its PID names no process. */
+export async function startExitedProcessAsync(): Promise<number> {
+  const child: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+  await once(child, 'exit');
+  return child.pid!;
+}
+
+// Fields after the ")" that ends the command name in /proc/<pid>/stat; starttime is field 22 of the record.
+const START_TIME_INDEX: number = 20;
+
+/** The start time that a daemon records for an operation process group (clock ticks after boot). Linux only. */
+export function readProcessStartTime(pid: number): string {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  // The command name may contain spaces and ")".
+  return stat.slice(stat.lastIndexOf(')')).split(' ')[START_TIME_INDEX];
+}
+
+/**
+ * Records the operation process group `groupId` of daemon `daemonPid` as the daemon does: an empty file named
+ * `<groupId>-<startTime>` in the folder `<lockfile>.groups-<daemonPid>`.
+ */
+export function recordOperationGroup(
+  lockfilePath: string,
+  daemonPid: number,
+  groupId: number,
+  startTime: string
+): void {
+  const folder: string = `${lockfilePath}.groups-${daemonPid}`;
+  fs.mkdirSync(folder, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(path.join(folder, `${groupId}-${startTime}`), '', { mode: 0o600 });
+}
+
+/** Writes the ownership record that a daemon with this PID would write. */
+export function recordDaemonOwner(
+  paths: IDaemonPaths,
+  pid: number,
+  startedAt: string = new Date().toISOString()
+): void {
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt,
+    socketPath: paths.socketPath
+  });
+}
+
+/** True while the process exists and has not exited. */
+export function isRunning(pid: number): boolean {
+  return isDaemonProcessAlive(pid) && !isProcessDefunct(pid);
+}
+
+/** SIGKILLs an operation process that a stand-in daemon started, unless it has exited. Linux only. */
+export function stopOperationIfRunning(pid: number): void {
+  try {
+    // Only the operation process that this test started, not a process that reused its PID.
+    if (fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').includes(OPERATION_SCRIPT)) {
+      process.kill(pid, 'SIGKILL');
+    }
+  } catch {
+    // It has exited.
+  }
+}
+
+// A line that a client appends to the launcher log.
+const CLIENT_LOG_LINE: RegExp = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z rush-client \(PID (\d+)\): (.*)$/;
+
+/** The texts of the lines that this process appended to the launcher log, in order. */
+export function readClientLogTexts(paths: IDaemonPaths): string[] {
+  const logFilePath: string = getDaemonLogFilePath(paths);
+  const lines: string[] = fs.existsSync(logFilePath) ? fs.readFileSync(logFilePath, 'utf8').split('\n') : [];
+  return lines.flatMap((line: string) => {
+    const match: RegExpExecArray | null = CLIENT_LOG_LINE.exec(line);
+    return match && Number(match[1]) === process.pid ? [match[2]] : [];
+  });
+}
+
+/** The text of the line that a client appends for a recorded group that its reclaim left running. */
+export function describeGroupLeftRunning(
+  daemonPid: number,
+  processGroupId: number,
+  reason: DaemonOperationGroupLeftRunningReason
+): string {
+  return `${formatOperationGroupLeftRunning({ daemonPid, processGroupId, reason })}.`;
+}
diff --git a/libraries/rush-client-core/src/test/PendingDelays.ts b/libraries/rush-client-core/src/test/PendingDelays.ts
new file mode 100644
index 00000000000..a0225347ba9
--- /dev/null
+++ b/libraries/rush-client-core/src/test/PendingDelays.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { setTimeout as delayAsync } from 'node:timers/promises';
+
+export interface IPendingDelays {
+  /** The `node:timers/promises` delays that have begun but not yet settled. */
+  readonly pending: ReadonlySet<Promise<unknown>>;
+  readonly restore: () => void;
+}
+
+export interface IPendingDelaysOptions {
+  /**
+   * Whether a delay of `delayMs` that begins now lasts until its signal aborts instead, however long that is.
+   */
+  readonly hold?: (delayMs: number | undefined) => boolean;
+}
+
+// The longest delay that Node's timers accept.
+const MAX_DELAY_MS: number = 2 ** 31 - 1;
+
+/** Tracks the delays that are pending until `restore` is called. */
+export function trackPendingDelays(options: IPendingDelaysOptions = {}): IPendingDelays {
+  const timersPromises = jest.requireActual<typeof import('node:timers/promises')>('node:timers/promises');
+  const originalDelayAsync: typeof delayAsync = timersPromises.setTimeout;
+  const pending: Set<Promise<unknown>> = new Set();
+  const spy = jest.spyOn(timersPromises, 'setTimeout').mockImplementation((delayMs, value, delayOptions) => {
+    // A held delay doesn't keep the process alive.
+    const delay: Promise<unknown> = options.hold?.(delayMs)
+      ? originalDelayAsync(MAX_DELAY_MS, value, { ...delayOptions, ref: false })
+      : originalDelayAsync(delayMs, value, delayOptions);
+    pending.add(delay);
+    const settle = (): void => {
+      pending.delete(delay);
+    };
+    void delay.then(settle, settle);
+    return delay;
+  });
+  return { pending, restore: () => spy.mockRestore() };
+}
diff --git a/libraries/rush-client-core/src/test/ProcessStartTime.test.ts b/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
index a7a9ff44183..f2d1db45cb9 100644
--- a/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
+++ b/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
@@ -4,8 +4,10 @@
 import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
 import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { isProcessStartedAfter, tryGetProcessStartTimeMs } from '../ProcessStartTime';
+import { isProcessDefunct, isProcessStartedAfter, tryGetProcessStartTimeMs } from '../ProcessStartTime';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
 
 const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
 
@@ -28,4 +30,14 @@ describe('process start time', () => {
     expect(isProcessStartedAfter(exited.pid!, new Date(0).toISOString())).toBe(false);
     expect(isProcessStartedAfter(process.pid, 'not a timestamp')).toBe(false);
   });
+
+  linuxIt('detects an exited process that its parent has not reaped', async () => {
+    await withUnreapedChildAsync(async (child, parent) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      expect(isProcessDefunct(child)).toBe(true);
+      expect(isProcessDefunct(parent)).toBe(false);
+      expect(isProcessDefunct(process.pid)).toBe(false);
+    });
+  });
 });
diff --git a/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts b/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
new file mode 100644
index 00000000000..4b1c442a024
--- /dev/null
+++ b/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
@@ -0,0 +1,465 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  encodeDaemonControlMessage,
+  encodeDaemonFrame,
+  type DaemonControlMessage,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClient, type DaemonClientOutcome } from '../DaemonClient';
+import {
+  DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE,
+  DAEMON_DISCONNECTED_MESSAGE,
+  DaemonClientError
+} from '../DaemonClientError';
+import { DaemonExitedWhileQueuedError } from '../DaemonDisconnect';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { executeWithDaemonRestartAsync, type IDaemonRestartNotice } from '../executeWithDaemonRestart';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe('a request that waited in the queue of a daemon that exited', () => {
+  let folder: string;
+  let options: IConnectOrStartDaemonOptions;
+
+  /** The lines of the file that fixture daemons write in the test folder. */
+  function readLines(name: string): string[] {
+    return fs.readFileSync(path.join(folder, name), 'utf8').trim().split('\n');
+  }
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-resend-'));
+    const paths: IDaemonPaths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-resend-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = readLines('starts');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(readLines('parents'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  /** The connection options of a fixture daemon that behaves as `mode` says. */
+  function withMode(mode: string): IConnectOrStartDaemonOptions {
+    return {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+    };
+  }
+
+  function captureRequest(): IDaemonRequestEnvelope {
+    return captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false }
+    });
+  }
+
+  function exitedMessage(pid: number): string {
+    return (
+      `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while it ran the command; ` +
+      '"rush-client daemon logs" shows why. Run the command again; ' +
+      'if the daemon exits again, run the command with "rush-client --no-daemon".'
+    );
+  }
+
+  const queuedMessage = (prefix: string, pid: number): string =>
+    `${prefix} rushd (PID ${pid}) exited while the command was queued; "rush-client daemon logs" shows why. ` +
+    'Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".\n' +
+    'The daemon log reports: Error: fixture daemon crash while running the request';
+
+  function withWaitTimeout(waitTimeoutMs: number): IDaemonRequestEnvelope {
+    return captureDaemonRequest({ ...captureRequest(), admission: { waitTimeoutMs } });
+  }
+
+  it('tells the caller which daemon exited before it starts a new daemon, and sends the request there once', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    const notices: IDaemonRestartNotice[] = [];
+    const outcome: DaemonClientOutcome = await executeWithDaemonRestartAsync(client, connection, {
+      request: captureRequest(),
+      onRestartAsync: async (notice) => {
+        // No new daemon has started yet.
+        expect(readLines('starts')).toHaveLength(1);
+        expect(readLines('requests')).toHaveLength(1);
+        notices.push(notice);
+      }
+    });
+    expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    expect(readLines('starts').map(Number)).toEqual([pid, expect.any(Number)]);
+    expect(notices).toEqual([{ restart: 1, reason: undefined, successorPid: undefined, exitedPid: pid }]);
+    expect(readLines('requests')).toHaveLength(2);
+  });
+
+  it('passes on what remains of an explicit wait deadline', async () => {
+    const waitTimeoutMs: number = 10000;
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    expect(
+      await executeWithDaemonRestartAsync(client, connection, { request: withWaitTimeout(waitTimeoutMs) })
+    ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    const waits: number[] = readLines('waits').map(Number);
+    expect(waits).toHaveLength(2);
+    expect(waits[0]).toBe(waitTimeoutMs);
+    expect(waits[1]).toBeLessThan(waitTimeoutMs);
+    expect(waits[1]).toBeGreaterThan(0);
+  });
+
+  it('sends the request only once when the new daemon also exits while the request waits', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const notices: IDaemonRestartNotice[] = [];
+    const error: unknown = await executeWithDaemonRestartAsync(client, connection, {
+      request: captureRequest(),
+      onRestartAsync: async (notice) => {
+        notices.push(notice);
+      }
+    }).catch((failure: unknown) => failure);
+    const starts: number[] = readLines('starts').map(Number);
+    expect(starts).toHaveLength(2);
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect(error).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+    expect(error).toMatchObject({
+      code: 'disconnected',
+      message: queuedMessage(DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE, starts[1])
+    });
+    expect(notices).toHaveLength(1);
+    expect(readLines('requests')).toHaveLength(2);
+  });
+
+  it('does not send the request again once the daemon said that it started the request', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-after-start-notice');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message:
+        `${exitedMessage(pid!)}\n` +
+        'The daemon log reports: Error: fixture daemon crash while running the request'
+    });
+    expect(readLines('starts')).toHaveLength(1);
+  });
+
+  it('does not send the request again while the daemon that closed the connection still runs', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('close-while-queued');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message: `${DAEMON_DISCONNECTED_MESSAGE} The connection to rushd (PID ${pid}) closed, but the daemon is still running; run the command again.`
+    });
+    expect(readLines('starts')).toHaveLength(1);
+    expect(readLines('requests')).toHaveLength(1);
+  });
+
+  it('does not send the request again without a way to start a daemon', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(
+        client,
+        { ...connection, startCommand: undefined },
+        { request: captureRequest() }
+      )
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message: queuedMessage(DAEMON_DISCONNECTED_MESSAGE, pid!)
+    });
+    expect(readLines('starts')).toHaveLength(1);
+  });
+
+  it('does not send the request again once its explicit wait deadline expired', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(client, connection, { request: withWaitTimeout(1) })
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message: queuedMessage(DAEMON_DISCONNECTED_MESSAGE, pid!)
+    });
+    expect(readLines('starts')).toHaveLength(1);
+  });
+
+  it('returns the aborted result when the request is cancelled while a new daemon starts', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    // The new daemon waits before it listens.
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1500');
+    const abort: AbortController = new AbortController();
+    const notices: IDaemonRestartNotice[] = [];
+    const pending: Promise<DaemonClientOutcome> = executeWithDaemonRestartAsync(client, connection, {
+      request: captureRequest(),
+      abortSignal: abort.signal,
+      onRestartAsync: async (notice) => {
+        notices.push(notice);
+      }
+    });
+    const deadline: number = Date.now() + 5000;
+    while (readLines('starts').length < 2 && Date.now() < deadline) await delayAsync(20);
+    expect(readLines('starts')).toHaveLength(2);
+    expect(notices).toHaveLength(1);
+    abort.abort();
+    expect(await pending).toMatchObject({
+      kind: 'result',
+      result: { exitCode: 130, outcome: 'aborted', aborted: true }
+    });
+    expect(readLines('requests')).toHaveLength(1);
+  });
+
+  it('says that a new daemon did not start', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    // The new daemon waits longer before it listens than the client waits for it.
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '2000');
+    const notices: IDaemonRestartNotice[] = [];
+    const error: unknown = await executeWithDaemonRestartAsync(
+      client,
+      { ...connection, startupTimeoutMs: 300 },
+      {
+        request: captureRequest(),
+        onRestartAsync: async (notice) => {
+          notices.push(notice);
+        }
+      }
+    ).catch((failure: unknown) => failure);
+    // The failure follows the notice that the command is sent to a new daemon.
+    expect(notices).toEqual([{ restart: 1, reason: undefined, successorPid: undefined, exitedPid: pid }]);
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect((error as DaemonClientError).message).toMatch(
+      new RegExp(
+        `^rushd \\(PID ${pid}\\) exited while the command was queued, and a new daemon did not start: .`
+      )
+    );
+    expect((error as DaemonClientError).cause).toBeInstanceOf(DaemonClientError);
+    expect(readLines('requests')).toHaveLength(1);
+    // The new daemon still starts. Once it records itself, the cleanup stops it before it removes the folder, which
+    // Windows keeps busy while the daemon runs there.
+    const deadline: number = Date.now() + 10000;
+    while (readLines('starts').length < 2 && Date.now() < deadline) await delayAsync(20);
+    expect(readLines('starts')).toHaveLength(2);
+  }, 15000);
+
+  // A write-only daemon never reads, so the client's bytes wait unread and its close resets the connection. The
+  // client then loses what it had not read yet. A Unix socket stands in for the daemon's.
+  describe('whose connection reset', () => {
+    const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+
+    interface IResetRow {
+      /** Whether the client's queue position handler holds, so that the connection pauses, until the reset. */
+      readonly holdQueuePosition: boolean;
+      /** Whether the daemon sends requestStarted after the queue position. */
+      readonly sendRequestStarted: boolean;
+    }
+
+    interface IResetOutcome {
+      readonly error: unknown;
+      readonly exitedPid: number;
+      readonly queuedWithoutStarting: boolean;
+      readonly restarts: number;
+    }
+
+    function writeControlAsync(socket: net.Socket, message: DaemonControlMessage): Promise<void> {
+      const bytes: Uint8Array = encodeDaemonFrame({
+        kind: DaemonFrameType.controlJson,
+        payload: encodeDaemonControlMessage(message)
+      });
+      return new Promise<void>((resolve, reject) => {
+        socket.write(bytes, (error: Error | null | undefined) => (error ? reject(error) : resolve()));
+      });
+    }
+
+    function exitedText(pid: number, whileQueued: boolean): string {
+      return (
+        `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while ` +
+        `${whileQueued ? 'the command was queued' : 'it ran the command'}; "rush-client daemon logs" may show ` +
+        'why. Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".'
+      );
+    }
+
+    /** Sends a request without a way to start a new daemon, and resets the connection once the frames are sent. */
+    async function runResetRowAsync({
+      holdQueuePosition,
+      sendRequestStarted
+    }: IResetRow): Promise<IResetOutcome> {
+      // The daemon reports the PID of a process that has exited, so the client finds it gone after the reset.
+      const exitedPid: number = spawnSync(process.execPath, ['-e', '']).pid;
+      let accept!: (socket: net.Socket) => void;
+      const accepted: Promise<net.Socket> = new Promise<net.Socket>((resolve) => (accept = resolve));
+      const server: net.Server = net.createServer({ pauseOnConnect: true }, (socket: net.Socket) => {
+        socket.on('error', () => undefined);
+        accept(socket);
+      });
+      await new Promise<void>((resolve) => server.listen(options.paths.socketPath, resolve));
+      const clientPromise: Promise<DaemonClient> = DaemonClient.connectAsync({
+        socketPath: options.paths.socketPath
+      });
+      const peer: net.Socket = await accepted;
+      try {
+        await writeControlAsync(peer, {
+          kind: 'helloAck',
+          payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'write-only' }
+        });
+        await writeControlAsync(peer, {
+          kind: 'pong',
+          payload: { uptimeMs: 1, daemonVersion: 'fixture', pid: exitedPid }
+        });
+        const client: DaemonClient = await clientPromise;
+        const request: IDaemonRequestEnvelope = captureRequest();
+        let queuePositionSeen!: () => void;
+        const seen: Promise<void> = new Promise<void>((resolve) => (queuePositionSeen = resolve));
+        let release!: () => void;
+        const released: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+        let restarts: number = 0;
+        const settled: Promise<unknown> = executeWithDaemonRestartAsync(
+          client,
+          { ...options, startCommand: undefined },
+          {
+            request,
+            onQueuePositionAsync: async () => {
+              queuePositionSeen();
+              if (holdQueuePosition) await released;
+            },
+            onRestartAsync: async () => {
+              restarts++;
+            }
+          }
+        ).then(
+          (outcome: DaemonClientOutcome) => outcome,
+          (error: unknown) => error
+        );
+        try {
+          // The client has sent the request once its callbacks ran.
+          await new Promise<void>((resolve) => setImmediate(resolve));
+          const { requestId } = request;
+          await writeControlAsync(peer, { kind: 'queuePosition', payload: { position: 1, requestId } });
+          await seen;
+          if (sendRequestStarted) {
+            await writeControlAsync(peer, { kind: 'requestStarted', payload: { requestId } });
+          }
+          await delayAsync(50);
+          peer.destroy();
+          // The client reads the reset while the queue position handler still holds.
+          await delayAsync(50);
+        } finally {
+          release();
+        }
+        const error: unknown = await settled;
+        return { error, exitedPid, queuedWithoutStarting: client.queuedWithoutStarting, restarts };
+      } finally {
+        peer.destroy();
+        await new Promise<void>((resolve) => server.close(() => resolve()));
+      }
+    }
+
+    posixIt(
+      'does not say that the request was queued when the reset discarded a requestStarted',
+      async () => {
+        const outcome: IResetOutcome = await runResetRowAsync({
+          holdQueuePosition: true,
+          sendRequestStarted: true
+        });
+        expect(outcome.error).toBeInstanceOf(DaemonClientError);
+        expect(outcome.error).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+        expect(outcome.error).toMatchObject({
+          code: 'disconnected',
+          message: exitedText(outcome.exitedPid, false)
+        });
+        expect(outcome.queuedWithoutStarting).toBe(false);
+        expect(outcome.restarts).toBe(0);
+      }
+    );
+
+    posixIt(
+      'says that the request ran when the client read the requestStarted before the reset',
+      async () => {
+        const outcome: IResetOutcome = await runResetRowAsync({
+          holdQueuePosition: false,
+          sendRequestStarted: true
+        });
+        expect(outcome.error).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+        expect(outcome.error).toMatchObject({
+          code: 'disconnected',
+          message: exitedText(outcome.exitedPid, false)
+        });
+        expect(outcome.queuedWithoutStarting).toBe(false);
+      }
+    );
+
+    posixIt('says that the request was queued when the client read everything before the reset', async () => {
+      const outcome: IResetOutcome = await runResetRowAsync({
+        holdQueuePosition: false,
+        sendRequestStarted: false
+      });
+      expect(outcome.error).toBeInstanceOf(DaemonExitedWhileQueuedError);
+      expect(outcome.error).toMatchObject({
+        code: 'disconnected',
+        message: exitedText(outcome.exitedPid, true)
+      });
+      expect(outcome.queuedWithoutStarting).toBe(true);
+      expect(outcome.restarts).toBe(0);
+    });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
new file mode 100644
index 00000000000..baa25b5be27
--- /dev/null
+++ b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
@@ -0,0 +1,296 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonPaths,
+  IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
+
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { resetDaemonArtifactsAsync, type IDaemonArtifactResetOptions } from '../DaemonOwnership';
+import {
+  findReclaimedDaemonPid,
+  getClientReclaimOptions,
+  logOperationGroupLeftRunning,
+  logReclaimedDaemon
+} from '../ReclaimedDaemonLog';
+
+const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+
+/** The line that a client appends after it reclaimed the daemon with this PID. */
+function getReclaimLine(pid: number): RegExp {
+  return new RegExp(
+    `^\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${pid}\\) ` +
+      'exited without shutting down; stopped the operations it left running that could be proven to be its own, ' +
+      'and removed its ownership record and socket\\.$'
+  );
+}
+
+describe(findReclaimedDaemonPid.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let logFilePath: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reclaim-log-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    logFilePath = getDaemonLogFilePath(paths);
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  function readLogLines(): string[] {
+    return fs.readFileSync(logFilePath, 'utf8').split('\n');
+  }
+
+  it('returns the PID that the last reclaim logged', () => {
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    logReclaimedDaemon(paths, 101);
+    expect(readLogLines()).toEqual([expect.stringMatching(getReclaimLine(101)), '']);
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    // For example, the output of a daemon that failed to start.
+    fs.appendFileSync(logFilePath, 'Error: listen EADDRINUSE\n');
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    logReclaimedDaemon(paths, 102);
+    expect(readLogLines()).toEqual([
+      expect.stringMatching(getReclaimLine(101)),
+      'Error: listen EADDRINUSE',
+      expect.stringMatching(getReclaimLine(102)),
+      ''
+    ]);
+    expect(findReclaimedDaemonPid(paths)).toBe(102);
+  });
+
+  it('returns undefined once a daemon became ready after the reclaim', () => {
+    for (const ready of [
+      'rushd ready at /run/d.sock (Rush 5.0.0)',
+      '2026-09-29T00:00:00.000Z rushd ready at /run/d.sock (Rush 5.0.0, PID 7)'
+    ]) {
+      logReclaimedDaemon(paths, 101);
+      fs.appendFileSync(logFilePath, `${ready}\n`);
+      expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    }
+    logReclaimedDaemon(paths, 103);
+    expect(findReclaimedDaemonPid(paths)).toBe(103);
+  });
+
+  it("ignores a daemon's output that quotes the line", () => {
+    fs.writeFileSync(
+      logFilePath,
+      'Error: 2026-09-29T00:00:00.000Z rush-client (PID 1): rushd (PID 99) exited without shutting down; x\n'
+    );
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+  });
+
+  it('reads only the complete lines in the last 64 KiB of the log', () => {
+    logReclaimedDaemon(paths, 104);
+    const lineLength: number = fs.statSync(logFilePath).size;
+    // The read then starts 5 bytes into the line, after "2026-"; the rest of it would still look like a reclaim.
+    fs.appendFileSync(logFilePath, `${'x'.repeat(64 * 1024 - lineLength + 4)}\n`);
+    expect(fs.statSync(logFilePath).size - 64 * 1024).toBe(5);
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    logReclaimedDaemon(paths, 105);
+    expect(findReclaimedDaemonPid(paths)).toBe(105);
+  });
+
+  it('starts its line on a line of its own when the log ends inside a line', async () => {
+    // For example, the output of a daemon that was killed before it finished a line.
+    fs.writeFileSync(logFilePath, 'Error: boom');
+    logReclaimedDaemon(paths, 109);
+    expect(readLogLines()).toEqual(['Error: boom', expect.stringMatching(getReclaimLine(109)), '']);
+    expect(findReclaimedDaemonPid(paths)).toBe(109);
+    fs.appendFileSync(logFilePath, '    at boom');
+    await resetDaemonArtifactsAsync(paths);
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    expect(readLogLines()).toEqual([
+      'Error: boom',
+      expect.stringMatching(getReclaimLine(109)),
+      '    at boom',
+      expect.stringMatching(/^\S+Z rush-client \(PID \d+\): reset the daemon's files; /),
+      ''
+    ]);
+  });
+
+  posixIt('writes only to a regular file of this user that has no other links', () => {
+    const target: string = path.join(folder, 'target.log');
+    fs.writeFileSync(target, 'kept\n');
+    fs.symlinkSync(target, logFilePath);
+    logReclaimedDaemon(paths, 106);
+    expect(fs.readFileSync(target, 'utf8')).toBe('kept\n');
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    fs.unlinkSync(logFilePath);
+    fs.linkSync(target, logFilePath);
+    logReclaimedDaemon(paths, 106);
+    expect(fs.readFileSync(target, 'utf8')).toBe('kept\n');
+    fs.unlinkSync(logFilePath);
+    // As the launcher does, it makes the log private.
+    fs.writeFileSync(logFilePath, '');
+    fs.chmodSync(logFilePath, 0o644);
+    logReclaimedDaemon(paths, 106);
+    expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
+    expect(findReclaimedDaemonPid(paths)).toBe(106);
+    // Also a log that it may only write, which the launcher opens too.
+    fs.chmodSync(logFilePath, 0o200);
+    logReclaimedDaemon(paths, 110);
+    expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
+    expect(findReclaimedDaemonPid(paths)).toBe(110);
+  });
+
+  // For example, Rush that runs in-process after the client reclaimed a daemon. Jest resolves modules itself, so
+  // a Node process of its own runs the function and then requires a package the way Node does.
+  posixIt.each([logReclaimedDaemon.name, findReclaimedDaemonPid.name])(
+    'leaves require() resolving symlinks after %s met a log that is a FIFO',
+    (functionName: string) => {
+      // As pnpm installs them: the package finds its dependency only from its real path.
+      const store: string = path.join(folder, 'store', 'node_modules');
+      fs.mkdirSync(path.join(store, 'reclaim-log-dependency'), { recursive: true });
+      fs.writeFileSync(path.join(store, 'reclaim-log-dependency', 'index.js'), "module.exports = 'found';");
+      fs.mkdirSync(path.join(store, 'reclaim-log-package'));
+      fs.writeFileSync(
+        path.join(store, 'reclaim-log-package', 'index.js'),
+        "module.exports = require('reclaim-log-dependency');"
+      );
+      fs.mkdirSync(path.join(folder, 'app', 'node_modules'), { recursive: true });
+      fs.symlinkSync(
+        path.join(store, 'reclaim-log-package'),
+        path.join(folder, 'app', 'node_modules', 'reclaim-log-package')
+      );
+      fs.writeFileSync(
+        path.join(folder, 'main.js'),
+        'const [modulePath, pathsJson, functionName] = process.argv.slice(2);\n' +
+          'require(modulePath)[functionName](JSON.parse(pathsJson), 111);\n' +
+          "try { process.stdout.write(require('./app/node_modules/reclaim-log-package')); }\n" +
+          'catch (error) { process.stdout.write(error.code); }\n'
+      );
+      expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0);
+      const child: SpawnSyncReturns<string> = spawnSync(
+        process.execPath,
+        [
+          path.join(folder, 'main.js'),
+          require.resolve('../ReclaimedDaemonLog'),
+          JSON.stringify(paths),
+          functionName
+        ],
+        {
+          cwd: folder,
+          encoding: 'utf8',
+          env: { ...process.env, NODE_OPTIONS: undefined, NODE_PRESERVE_SYMLINKS: undefined },
+          timeout: 10000
+        }
+      );
+      expect({ status: child.status, stdout: child.stdout, stderr: child.stderr }).toEqual({
+        status: 0,
+        stdout: 'found',
+        stderr: ''
+      });
+    }
+  );
+
+  it('is cleared by a reset of the daemon files', async () => {
+    logReclaimedDaemon(paths, 107);
+    expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [] });
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    expect(readLogLines()).toEqual([
+      expect.stringMatching(getReclaimLine(107)),
+      expect.stringMatching(
+        new RegExp(
+          `^\\S+Z rush-client \\(PID ${process.pid}\\): reset the daemon's files; the report that rushd ` +
+            '\\(PID 107\\) exited without shutting down is cleared\\.$'
+        )
+      ),
+      ''
+    ]);
+    // Without a report, a reset adds nothing.
+    await resetDaemonArtifactsAsync(paths);
+    expect(readLogLines()).toHaveLength(3);
+    logReclaimedDaemon(paths, 108);
+    expect(findReclaimedDaemonPid(paths)).toBe(108);
+  });
+});
+
+describe(getClientReclaimOptions.name, () => {
+  const group: IDaemonOperationGroupLeftRunning = {
+    daemonPid: 4000,
+    processGroupId: 4242,
+    reason: 'otherSession'
+  };
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reclaim-options-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  function readLogLines(): string[] {
+    return fs.readFileSync(getDaemonLogFilePath(paths), 'utf8').split('\n');
+  }
+
+  it('logs each group that a reclaim leaves running, in a line that names no reclaimed or ready daemon', () => {
+    const options: IDaemonReclaimOptions = getClientReclaimOptions(paths, undefined);
+    expect(Object.keys(options).sort()).toEqual(['onOperationGroupLeftRunning', 'onOrphansReaped']);
+    expect(options.onOrphansReaped).toBeUndefined();
+    options.onOperationGroupLeftRunning!(group);
+    expect(readLogLines()).toEqual([
+      expect.stringMatching(
+        new RegExp(
+          `^\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z rush-client \\(PID ${process.pid}\\): ` +
+            'left process group 4242 running, which the exited daemon \\(PID 4000\\) recorded for an operation: ' +
+            'its leader has exited, and a process of the group is in another session\\.$'
+        )
+      ),
+      ''
+    ]);
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    // A later reclaim may log a group that it leaves running after the line of a reclaimed daemon.
+    logReclaimedDaemon(paths, 101);
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    logOperationGroupLeftRunning(paths, group);
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    expect(readLogLines()).toHaveLength(4);
+  });
+
+  it("passes on only the caller's callbacks, which replace the log", () => {
+    const onOrphansReaped: jest.Mock = jest.fn();
+    const onOperationGroupLeftRunning: jest.Mock = jest.fn();
+    const resetOptions: IDaemonArtifactResetOptions = {
+      onOrphansReaped,
+      onOperationGroupLeftRunning,
+      waitTimeoutMs: 5000
+    };
+    const options: IDaemonReclaimOptions = getClientReclaimOptions(paths, resetOptions);
+    expect(options).toStrictEqual({ onOrphansReaped, onOperationGroupLeftRunning });
+    expect(options.onOperationGroupLeftRunning).toBe(onOperationGroupLeftRunning);
+    const reapOnly: IDaemonReclaimOptions = getClientReclaimOptions(paths, { onOrphansReaped });
+    expect(reapOnly.onOrphansReaped).toBe(onOrphansReaped);
+    reapOnly.onOperationGroupLeftRunning!(group);
+    expect(readLogLines()).toEqual([expect.stringContaining('left process group 4242 running'), '']);
+  });
+
+  it('never throws when it cannot write the log', () => {
+    fs.mkdirSync(getDaemonLogFilePath(paths));
+    expect(() => logOperationGroupLeftRunning(paths, group)).not.toThrow();
+    const missing: IDaemonPaths = { ...paths, lockfilePath: path.join(folder, 'missing', 'daemon.pid.json') };
+    expect(() => logOperationGroupLeftRunning(missing, group)).not.toThrow();
+  });
+});
diff --git a/libraries/rush-client-core/src/test/StartupLock.test.ts b/libraries/rush-client-core/src/test/StartupLock.test.ts
index 60e39c852c1..54a881914cc 100644
--- a/libraries/rush-client-core/src/test/StartupLock.test.ts
+++ b/libraries/rush-client-core/src/test/StartupLock.test.ts
@@ -5,9 +5,10 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
-import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import { isStartupLockFilePresent, tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import { removeTestFolderAsync } from './TestProcessExit';
 
 it('holds startup exclusively until the owning lock is released', async () => {
@@ -32,3 +33,68 @@ it('holds startup exclusively until the owning lock is released', async () => {
     await removeTestFolderAsync(folder);
   }
 });
+
+it('reports a start mutex lock file without acquiring the mutex', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-start-lock-'));
+  const paths: IDaemonPaths = {
+    lockfilePath: path.join(folder, 'daemon.pid.json'),
+    socketPath:
+      process.platform === 'win32'
+        ? `\\\\.\\pipe\\${path.basename(folder)}`
+        : path.join(folder, 'daemon.sock')
+  };
+  let lock: IStartupLock | undefined;
+  try {
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    // Lock files of other resources in the same folder don't count.
+    fs.writeFileSync(path.join(folder, 'daemon.pid.json#1.lock'), '');
+    fs.writeFileSync(path.join(folder, 'other.pid.json-start#1.lock'), '');
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    lock = await tryAcquireStartupLockAsync(paths);
+    expect(lock).toBeDefined();
+    expect(isStartupLockFilePresent(paths)).toBe(true);
+    await lock!.releaseAsync();
+    lock = undefined;
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    expect(
+      isStartupLockFilePresent({ ...paths, lockfilePath: path.join(folder, 'missing', 'daemon.pid.json') })
+    ).toBe(false);
+  } finally {
+    await lock?.releaseAsync();
+    await removeTestFolderAsync(folder);
+  }
+});
+
+it('reports a start mutex lock file with the name that LockFile gives it on Windows', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-start-lock-'));
+  const paths: IDaemonPaths = {
+    lockfilePath: path.join(folder, 'daemon.pid.json'),
+    socketPath:
+      process.platform === 'win32'
+        ? `\\\\.\\pipe\\${path.basename(folder)}`
+        : path.join(folder, 'daemon.sock')
+  };
+  const windowsLockPath: string = getWindowsLockFilePath(folder, 'daemon.pid.json-start');
+  try {
+    expect(path.basename(windowsLockPath)).toBe('daemon.pid.json-start.lock');
+    // Names that only begin like it don't count.
+    fs.writeFileSync(path.join(folder, 'daemon.pid.json-starter.lock'), '');
+    fs.writeFileSync(`${windowsLockPath}.tmp`, '');
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    fs.writeFileSync(windowsLockPath, '');
+    expect(isStartupLockFilePresent(paths)).toBe(true);
+  } finally {
+    await removeTestFolderAsync(folder);
+  }
+});
+
+/** The lock file that `LockFile` names without a PID, as it does on Windows. */
+function getWindowsLockFilePath(folder: string, resourceName: string): string {
+  const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+  Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+  try {
+    return LockFile.getLockFilePath(folder, resourceName);
+  } finally {
+    Object.defineProperty(process, 'platform', platform);
+  }
+}
diff --git a/libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts b/libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts
new file mode 100644
index 00000000000..e5b05dccdbc
--- /dev/null
+++ b/libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts
@@ -0,0 +1,220 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import type { IOwnerProcessReaders, IStoppedProcess } from '../DaemonOwnerDiagnosis';
+import type { IProcessState } from '../ProcessStartTime';
+import {
+  findStoppedDaemonOwnerAsync,
+  isDaemonOwnerStillStopped,
+  STOPPED_OWNER_WINDOW_MS
+} from '../StoppedDaemonOwner';
+import { recordDaemonOwner } from './OrphanedOperation';
+
+const START_TICKS: number = 4242;
+const STOPPED: IProcessState = { code: 'T', parentPid: 1, startTicks: START_TICKS };
+const TRACED: IProcessState = { code: 't', parentPid: 1, startTicks: START_TICKS };
+const WAITING: IProcessState = { code: 'S', parentPid: 1, startTicks: START_TICKS };
+
+describe('StoppedDaemonOwner', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-stopped-owner-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    // The record names this live process; the readers say what it is doing.
+    recordDaemonOwner(paths, process.pid);
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  /** A `readState` that returns `states` in turn, and then the last one. */
+  function statesReader(
+    states: ReadonlyArray<IProcessState | undefined>
+  ): jest.Mock<IProcessState | undefined, [number]> {
+    let next: number = 0;
+    return jest.fn((pid: number) => states[Math.min(next++, states.length - 1)]);
+  }
+
+  function readers(overrides: Partial<IOwnerProcessReaders> = {}): IOwnerProcessReaders {
+    return {
+      platform: 'linux',
+      now: Date.now,
+      readState: () => STOPPED,
+      readStartTimeMs: () => undefined,
+      readCommandLine: () => undefined,
+      isPresent: () => true,
+      hasFileOpen: (pid: number, filePath: string) => pid === process.pid && filePath === paths.lockfilePath,
+      ...overrides
+    };
+  }
+
+  async function findAsync(
+    overrides: Partial<IOwnerProcessReaders>,
+    deadline: number = Date.now() + 15000,
+    signal?: AbortSignal
+  ): Promise<{ stopped: IStoppedProcess | undefined; elapsedMs: number }> {
+    const start: number = Date.now();
+    const stopped: IStoppedProcess | undefined = await findStoppedDaemonOwnerAsync(
+      paths,
+      deadline,
+      signal,
+      readers(overrides)
+    );
+    return { stopped, elapsedMs: Date.now() - start };
+  }
+
+  describe('findStoppedDaemonOwnerAsync', () => {
+    it('finds an owner that has the record open and stays stopped for the whole window', async () => {
+      const readState: jest.Mock = statesReader([STOPPED]);
+
+      const { stopped, elapsedMs } = await findAsync({ readState });
+
+      expect(stopped).toEqual({ pid: process.pid, startTicks: START_TICKS });
+      expect(elapsedMs).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS);
+      expect(readState.mock.calls.length).toBeGreaterThanOrEqual(3);
+      expect(readState.mock.calls.every(([pid]) => pid === process.pid)).toBe(true);
+    });
+
+    it('finds an owner that a tracer keeps stopped (state t)', async () => {
+      expect((await findAsync({ readState: () => TRACED })).stopped).toEqual({
+        pid: process.pid,
+        startTicks: START_TICKS
+      });
+    });
+
+    it('ends at the first sample that shows the owner resumed', async () => {
+      const readState: jest.Mock = statesReader([STOPPED, STOPPED, STOPPED, WAITING, STOPPED]);
+
+      const { stopped, elapsedMs } = await findAsync({ readState });
+
+      expect(stopped).toBeUndefined();
+      expect(readState).toHaveBeenCalledTimes(4);
+      expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+    });
+
+    it('ends when the PID names a process with another start time', async () => {
+      const readState: jest.Mock = statesReader([
+        STOPPED,
+        STOPPED,
+        { ...STOPPED, startTicks: START_TICKS + 1 }
+      ]);
+
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      expect(readState).toHaveBeenCalledTimes(3);
+    });
+
+    it('ends when a sample cannot be read', async () => {
+      const readState: jest.Mock = statesReader([STOPPED, undefined, STOPPED]);
+
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      expect(readState).toHaveBeenCalledTimes(2);
+    });
+
+    it('does not sample an owner that is not stopped or whose start time is unknown', async () => {
+      for (const state of [WAITING, { code: 'T', parentPid: 1 }, undefined]) {
+        const readState: jest.Mock = statesReader([state, STOPPED]);
+        const hasFileOpen: jest.Mock = jest.fn(() => true);
+
+        const { stopped, elapsedMs } = await findAsync({ readState, hasFileOpen });
+
+        expect(stopped).toBeUndefined();
+        expect(readState).toHaveBeenCalledTimes(1);
+        expect(hasFileOpen).not.toHaveBeenCalled();
+        expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+      }
+    });
+
+    it('does not sample an owner that does not provably have the record open', async () => {
+      // For example the daemon of another workspace, whose PID an old record names, or no /proc/<pid>/fd.
+      for (const isOpen of [false, undefined]) {
+        const readState: jest.Mock = statesReader([STOPPED]);
+        const hasFileOpen: jest.Mock = jest.fn(() => isOpen);
+
+        const { stopped, elapsedMs } = await findAsync({ readState, hasFileOpen });
+
+        expect(stopped).toBeUndefined();
+        expect(hasFileOpen.mock.calls).toEqual([[process.pid, paths.lockfilePath]]);
+        expect(readState).toHaveBeenCalledTimes(1);
+        expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+      }
+    });
+
+    it('needs a readable record that names a live process', async () => {
+      const readState: jest.Mock = statesReader([STOPPED]);
+
+      fs.unlinkSync(paths.lockfilePath);
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      fs.writeFileSync(paths.lockfilePath, 'not json');
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      const exitedPid: number = spawnSync(process.execPath, ['-e', '']).pid;
+      recordDaemonOwner(paths, exitedPid);
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+
+      expect(readState).not.toHaveBeenCalled();
+    });
+
+    it('does not sample when less than the window remains before the deadline', async () => {
+      const readState: jest.Mock = statesReader([STOPPED]);
+
+      const { stopped } = await findAsync({ readState }, Date.now() + STOPPED_OWNER_WINDOW_MS - 100);
+
+      expect(stopped).toBeUndefined();
+      expect(readState).not.toHaveBeenCalled();
+    });
+
+    it('stops sampling once the signal aborts', async () => {
+      const aborted: AbortController = new AbortController();
+      aborted.abort();
+      expect((await findAsync({}, undefined, aborted.signal)).stopped).toBeUndefined();
+
+      const later: AbortController = new AbortController();
+      setTimeout(() => later.abort(), 200);
+      const { stopped, elapsedMs } = await findAsync({}, undefined, later.signal);
+
+      expect(stopped).toBeUndefined();
+      expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+    });
+  });
+
+  describe('isDaemonOwnerStillStopped', () => {
+    const stopped: IStoppedProcess = { pid: process.pid, startTicks: START_TICKS };
+
+    it('holds while the record names the same stopped process, which has the record open', () => {
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers())).toBe(true);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ readState: () => TRACED }))).toBe(true);
+    });
+
+    it('ends once that process resumes, exits or no longer has the record open, or the record changes', () => {
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ readState: () => WAITING }))).toBe(false);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ readState: () => undefined }))).toBe(false);
+      expect(
+        isDaemonOwnerStillStopped(
+          paths,
+          stopped,
+          readers({ readState: () => ({ ...STOPPED, startTicks: START_TICKS + 1 }) })
+        )
+      ).toBe(false);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ hasFileOpen: () => false }))).toBe(false);
+
+      // The record names another live process, even one that is stopped and has the record open.
+      recordDaemonOwner(paths, process.ppid);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ hasFileOpen: () => true }))).toBe(false);
+      fs.unlinkSync(paths.lockfilePath);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers())).toBe(false);
+    });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts b/libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts
new file mode 100644
index 00000000000..b3f8925c713
--- /dev/null
+++ b/libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts
@@ -0,0 +1,63 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** How the Node process of {@link runThenRequireSymlinkedPackage} ended. */
+export interface IRequireAfterScriptResult {
+  /** The exit code, or undefined when a signal ended the process. */
+  readonly status: number | undefined;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * Runs `script`, the body of an async function, in a Node process of its own, and then requires a package that is
+ * installed as pnpm installs it, as Rush does when it runs in-process: the package finds its dependency only from
+ * its real path. The process writes `found` to stdout when the dependency resolved, or else the error's code.
+ * @remarks Jest resolves modules itself, so only such a process shows whether a stat that the script made breaks
+ * `require()`. Node's `fs.realpathSync()` stops at a directory that it has cached when the last stat without
+ * `{ bigint: true }` found a FIFO or a socket, and then returns a path whose symlinks it did not resolve.
+ * The script reads the strings that follow the script's path on the command line from `args`.
+ */
+export function runThenRequireSymlinkedPackage(
+  folder: string,
+  script: string,
+  args: ReadonlyArray<string>
+): IRequireAfterScriptResult {
+  const store: string = path.join(folder, 'store', 'node_modules');
+  fs.mkdirSync(path.join(store, 'symlinked-package-dependency'), { recursive: true });
+  fs.writeFileSync(path.join(store, 'symlinked-package-dependency', 'index.js'), "module.exports = 'found';");
+  fs.mkdirSync(path.join(store, 'symlinked-package'));
+  fs.writeFileSync(
+    path.join(store, 'symlinked-package', 'index.js'),
+    "module.exports = require('symlinked-package-dependency');"
+  );
+  fs.mkdirSync(path.join(folder, 'app', 'node_modules'), { recursive: true });
+  fs.symlinkSync(
+    path.join(store, 'symlinked-package'),
+    path.join(folder, 'app', 'node_modules', 'symlinked-package')
+  );
+  // The script runs from the folder, so that Node has cached the folder's path as one without symlinks.
+  fs.writeFileSync(
+    path.join(folder, 'main.js'),
+    'const args = process.argv.slice(2);\n' +
+      `(async () => {\n${script}\n})().then(() => {\n` +
+      "  try { process.stdout.write(require('./app/node_modules/symlinked-package')); }\n" +
+      '  catch (error) { process.stdout.write(error.code); }\n' +
+      '});\n'
+  );
+  const child: SpawnSyncReturns<string> = spawnSync(
+    process.execPath,
+    [path.join(folder, 'main.js'), ...args],
+    {
+      cwd: folder,
+      encoding: 'utf8',
+      env: { ...process.env, NODE_OPTIONS: undefined, NODE_PRESERVE_SYMLINKS: undefined },
+      timeout: 20000
+    }
+  );
+  return { status: child.status ?? undefined, stdout: child.stdout, stderr: child.stderr };
+}
diff --git a/libraries/rush-client-core/src/test/UnreapedChildProcess.ts b/libraries/rush-client-core/src/test/UnreapedChildProcess.ts
new file mode 100644
index 00000000000..b5767015fb7
--- /dev/null
+++ b/libraries/rush-client-core/src/test/UnreapedChildProcess.ts
@@ -0,0 +1,26 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+
+/**
+ * Runs `callbackAsync` with the PID of a process that exits after 200 ms but stays unreaped, because its parent
+ * never waits for it, and the parent's PID. POSIX only.
+ */
+export async function withUnreapedChildAsync(
+  callbackAsync: (pid: number, parentPid: number) => Promise<void>
+): Promise<void> {
+  // The shell starts a short-lived child, then becomes a process that never reaps it.
+  const parent: ChildProcess = spawn('/bin/sh', ['-c', 'sleep 0.2 & echo $!; exec sleep 10'], {
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const closed: Promise<unknown[]> = once(parent, 'close');
+  try {
+    const [output] = await once(parent.stdout!, 'data');
+    await callbackAsync(Number(String(output).trim()), parent.pid!);
+  } finally {
+    parent.kill();
+    await closed;
+  }
+}
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
new file mode 100644
index 00000000000..f2e847985d4
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
@@ -0,0 +1,477 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { LockFile } from '@rushstack/node-core-library';
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient } from '../DaemonClient';
+import { DaemonClientError } from '../DaemonClientError';
+import * as DaemonOwnership from '../DaemonOwnership';
+import { getDaemonStartupFilePath } from '../DaemonStartup';
+import {
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync,
+  connectToStartingDaemonAsync
+} from '../connectOrAwaitDaemonStartup';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+interface IAwaitingResult {
+  readonly kind: 'connected' | 'pending' | 'fallback' | 'error';
+  readonly pid?: number;
+  readonly message?: string;
+  readonly elapsedMs: number;
+  readonly notices: { owner: string; waitMs: number }[];
+}
+
+describe('connectOrAwaitDaemonStartupAsync', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+  let children: ChildProcess[];
+
+  beforeEach(() => {
+    children = [];
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-await-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-await-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    for (const child of children) {
+      if (child.exitCode === null && child.signalCode === null) {
+        const closed: Promise<unknown[]> = once(child, 'close');
+        child.kill('SIGKILL');
+        await closed;
+      }
+    }
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  function run(
+    fixture: string,
+    args: string[]
+  ): { child: ChildProcess; result: Promise<{ code: number | null; stdout: string; stderr: string }> } {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [path.join(__dirname, 'fixtures', fixture), ...args],
+      {
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
+    );
+    children.push(child);
+    let stdout: string = '';
+    let stderr: string = '';
+    child.stdout!.on('data', (chunk: Buffer) => {
+      stdout += chunk.toString();
+    });
+    child.stderr!.on('data', (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+    return { child, result: once(child, 'close').then(([code]) => ({ code, stdout, stderr })) };
+  }
+
+  async function runAwaitingAsync(
+    startOptions: IConnectOrStartDaemonOptions,
+    signalFolder?: string
+  ): Promise<IAwaitingResult> {
+    const { code, stdout, stderr } = await run(
+      'awaitingStarter.js',
+      signalFolder ? [JSON.stringify(startOptions), signalFolder] : [JSON.stringify(startOptions)]
+    ).result;
+    expect({ code, stderr }).toEqual({ code: 0, stderr: '' });
+    return JSON.parse(stdout);
+  }
+
+  async function waitForFileAsync(filePath: string): Promise<string> {
+    const deadline: number = Date.now() + 10000;
+    while (!fs.existsSync(filePath) && Date.now() < deadline) await delayAsync(20);
+    return fs.readFileSync(filePath, 'utf8');
+  }
+
+  async function waitForLinesAsync(filePath: string, count: number): Promise<void> {
+    const deadline: number = Date.now() + 30000;
+    const countLines = (): number =>
+      fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').trim().split('\n').length : 0;
+    while (countLines() < count && Date.now() < deadline) await delayAsync(20);
+  }
+
+  it('keeps every client on the daemon when it becomes ready only after their first startup deadline', async () => {
+    const clientCount: number = 8;
+    // On a loaded host, the first attempts end up to about 2 seconds apart, and the daemon takes up to about
+    // 3 seconds after its release to serve every client, so the earliest client's second deadline needs room.
+    const startupTimeoutMs: number = 10000;
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const burst: IConnectOrStartDaemonOptions = { ...options, startupTimeoutMs };
+    // A client that does not wait shows that the first deadline expires before the daemon listens.
+    const control = run('starter.js', [JSON.stringify(burst)]);
+    const results: Promise<IAwaitingResult[]> = Promise.all(
+      Array.from({ length: clientCount }, () => runAwaitingAsync(burst, folder))
+    );
+    // The clients start together, so that their first deadlines expire together even on a loaded host.
+    await waitForLinesAsync(path.join(folder, 'clients'), clientCount);
+    fs.writeFileSync(path.join(folder, 'go'), '');
+    const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+    // A client's first deadline has expired once it says that it keeps waiting.
+    await waitForLinesAsync(path.join(folder, 'notices'), clientCount);
+    const controlResult = await control.result;
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+
+    expect(controlResult.code).toBe(1);
+    expect(controlResult.stderr).toContain('Daemon startup');
+    for (const result of await results) {
+      expect(result).toMatchObject({ kind: 'connected', pid: daemonPid });
+      expect(result.elapsedMs).toBeGreaterThan(startupTimeoutMs);
+      // Each client said once why it kept waiting: the daemon binds only after every client has done so.
+      expect(result.notices).toHaveLength(1);
+      expect(result.notices[0].owner).toMatch(
+        /^(Its startup helper \(PID \d+\) is still waiting for the daemon|Another client is still starting the daemon)$/
+      );
+      expect(result.notices[0].waitMs).toBeGreaterThan(0);
+      expect(result.notices[0].waitMs).toBeLessThanOrEqual(startupTimeoutMs);
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 60000);
+
+  it('fails without permitting in-process Rush while the startup helper still waits after a second deadline', async () => {
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const result: IAwaitingResult = await runAwaitingAsync({ ...options, startupTimeoutMs: 2000 });
+    const daemonPid: number = Number(fs.readFileSync(path.join(folder, 'prebind'), 'utf8'));
+    const helperPid: number = Number(fs.readFileSync(path.join(folder, 'parents'), 'utf8'));
+    expect(result.kind).toBe('pending');
+    expect(result.elapsedMs).toBeGreaterThanOrEqual(4000);
+    expect(result.message).toContain(
+      `Its startup helper (PID ${helperPid}) is still waiting for the daemon, so Rush was not run in-process`
+    );
+    expect(result.message).toContain('use --no-daemon');
+    expect(result.message).toContain('"rush-client daemon status"');
+    expect(result.notices).toEqual([
+      {
+        owner: `Its startup helper (PID ${helperPid}) is still waiting for the daemon`,
+        waitMs: expect.any(Number)
+      }
+    ]);
+
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    const client = await connectOrStartDaemonAsync(options);
+    expect((await client.status).pid).toBe(daemonPid);
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+  }, 30000);
+
+  it('fails without permitting in-process Rush while a listener does not become ready', async () => {
+    // Accepts connections but never answers, like a daemon whose event loop is blocked.
+    const sockets: Set<net.Socket> = new Set();
+    const listener: net.Server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+    });
+    await new Promise<void>((resolve) => listener.listen(paths.socketPath, resolve));
+    const onAwaitStartup: jest.Mock = jest.fn();
+    try {
+      const error: unknown = await connectOrAwaitDaemonStartupAsync({
+        ...options,
+        startupTimeoutMs: 2000,
+        onAwaitStartup
+      }).then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      expect(error).toBeInstanceOf(DaemonStartupPendingError);
+      expect(error).not.toBeInstanceOf(DaemonClientError);
+      expect((error as Error).message).toContain(
+        `A process listens at ${paths.socketPath} but was not ready in time, so Rush was not run in-process`
+      );
+      expect(onAwaitStartup.mock.calls).toEqual([
+        [`A process listens at ${paths.socketPath} but was not ready in time`, expect.any(Number)]
+      ]);
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => listener.close(() => resolve()));
+    }
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  }, 30000);
+
+  it('fails without permitting in-process Rush while another client holds the start mutex', async () => {
+    const holder = run('startLockHolder.js', [JSON.stringify(paths)]);
+    await waitForFileAsync(path.join(folder, 'lock-held'));
+    const started: number = Date.now();
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const error: unknown = await connectOrAwaitDaemonStartupAsync({
+      ...options,
+      startupTimeoutMs: 2000,
+      onAwaitStartup
+    }).then(
+      () => undefined,
+      (rejection: unknown) => rejection
+    );
+    expect(Date.now() - started).toBeGreaterThanOrEqual(4000);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect((error as Error).message).toContain(
+      'Another client is still starting the daemon, so Rush was not run in-process'
+    );
+    expect(error).toHaveProperty('cause.code', 'startupFailed');
+    expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+    expect(onAwaitStartup.mock.calls[0][0]).toBe('Another client is still starting the daemon');
+    expect(onAwaitStartup.mock.calls[0][1]).toBeGreaterThan(0);
+    expect(onAwaitStartup.mock.calls[0][1]).toBeLessThanOrEqual(2000);
+
+    fs.writeFileSync(path.join(folder, 'release-lock'), '');
+    expect(await holder.result).toEqual({ code: 0, stdout: '', stderr: '' });
+    // Once the starter is gone, the same failure permits in-process Rush again, without a notice.
+    await expect(
+      connectOrAwaitDaemonStartupAsync({
+        paths,
+        expectedDaemonVersion: 'fixture',
+        startupTimeoutMs: 500,
+        onAwaitStartup
+      })
+    ).rejects.toBeInstanceOf(DaemonClientError);
+    expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  }, 30000);
+
+  it('rejects at once with the startup error when nothing live owns the workspace', async () => {
+    const started: number = Date.now();
+    const onAwaitStartup: jest.Mock = jest.fn();
+    await expect(
+      connectOrAwaitDaemonStartupAsync({ paths, expectedDaemonVersion: 'fixture', onAwaitStartup })
+    ).rejects.toThrow(
+      new DaemonClientError(
+        'startupFailed',
+        `No ready daemon at ${paths.socketPath}; auto-start is disabled.`
+      )
+    );
+
+    // A launcher that exits before readiness leaves a reservation whose helper has exited.
+    const failing: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
+    };
+    const failure: unknown = await connectOrAwaitDaemonStartupAsync({ ...failing, onAwaitStartup }).catch(
+      (error: unknown) => error
+    );
+    expect(failure).toBeInstanceOf(DaemonClientError);
+    expect((failure as Error).message).toContain('Unable to start');
+    const refusal: unknown = await connectOrAwaitDaemonStartupAsync({ ...options, onAwaitStartup }).catch(
+      (error: unknown) => error
+    );
+    expect(refusal).toBeInstanceOf(DaemonClientError);
+    // Until the relaunch time, the refusal is at once, so that the caller can run without the daemon.
+    expect((refusal as Error).message).toContain(
+      'exited before the daemon became ready; refusing another launch until '
+    );
+    expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  }, 30000);
+
+  it('leaves a version mismatch to the caller as before', async () => {
+    const running = await connectOrStartDaemonAsync(options);
+    await running.closeAsync();
+    await expect(
+      connectOrAwaitDaemonStartupAsync({ paths, expectedDaemonVersion: 'replacement' })
+    ).rejects.toMatchObject({ code: 'versionMismatch' });
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+
+  describe('connectToStartingDaemonAsync', () => {
+    it('returns at once without starting a daemon when nothing is starting', async () => {
+      const started: number = Date.now();
+      const onAwaitStartup: jest.Mock = jest.fn();
+      // Without a start mutex lock file, nothing tries to acquire the mutex (LockFile runs `ps` to do that).
+      const tryAcquire: jest.SpyInstance = jest.spyOn(LockFile, 'tryAcquire');
+      await expect(connectToStartingDaemonAsync({ ...options, onAwaitStartup })).resolves.toBeUndefined();
+      expect(tryAcquire).not.toHaveBeenCalled();
+      // A reservation whose startup helper has exited names no live starter either, and neither does a start
+      // mutex lock file that the helper left behind.
+      const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+      await once(exited, 'close');
+      fs.writeFileSync(
+        getDaemonStartupFilePath(paths),
+        JSON.stringify({ token: 'fixture', helperPid: exited.pid, helperStartedAt: new Date().toISOString() })
+      );
+      fs.writeFileSync(
+        path.join(folder, `${path.basename(paths.lockfilePath)}-start#${exited.pid}.lock`),
+        'Mon Jan  1 00:00:00 2024'
+      );
+      await expect(connectToStartingDaemonAsync({ ...options, onAwaitStartup })).resolves.toBeUndefined();
+      expect(tryAcquire).toHaveBeenCalled();
+      tryAcquire.mockRestore();
+      expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
+      expect(onAwaitStartup).not.toHaveBeenCalled();
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    });
+
+    it('waits for a daemon that another client is starting and connects to it, whatever its version', async () => {
+      fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1500');
+      const starter = run('starter.js', [JSON.stringify(options)]);
+      await waitForFileAsync(getDaemonStartupFilePath(paths));
+      const onAwaitStartup: jest.Mock = jest.fn();
+      const client: DaemonClient | undefined = await connectToStartingDaemonAsync({
+        ...options,
+        expectedDaemonVersion: 'replacement',
+        onAwaitStartup
+      });
+      expect(client).toBeDefined();
+      const { pid } = await client!.status;
+      await client!.closeAsync();
+      expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+      expect(onAwaitStartup.mock.calls[0][0]).toMatch(
+        /^(Its startup helper \(PID \d+\) is still waiting for the daemon|Another client is still starting the daemon)$/
+      );
+      expect(onAwaitStartup.mock.calls[0][1]).toBeGreaterThan(0);
+      expect(onAwaitStartup.mock.calls[0][1]).toBeLessThanOrEqual(options.startupTimeoutMs!);
+      expect(await starter.result).toEqual({ code: 0, stdout: '', stderr: '' });
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${pid}\n`);
+    }, 30000);
+
+    it('rejects with DaemonStartupPendingError while the daemon is still starting at the deadline', async () => {
+      fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+      const starter = run('starter.js', [JSON.stringify(options)]);
+      const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+      const helperPid: number = Number(fs.readFileSync(path.join(folder, 'parents'), 'utf8'));
+      const onAwaitStartup: jest.Mock = jest.fn();
+      const started: number = Date.now();
+      const error: unknown = await connectToStartingDaemonAsync({
+        ...options,
+        startupTimeoutMs: 1000,
+        onAwaitStartup
+      }).then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1000);
+      expect(error).toBeInstanceOf(DaemonStartupPendingError);
+      expect((error as Error).message).toBe(
+        `The daemon at ${paths.socketPath} is still starting after 1 s. Its startup helper (PID ${helperPid}) is still waiting for the daemon.`
+      );
+      expect(onAwaitStartup.mock.calls).toEqual([
+        [`Its startup helper (PID ${helperPid}) is still waiting for the daemon`, expect.any(Number)]
+      ]);
+
+      fs.unlinkSync(path.join(folder, 'hold-prebind'));
+      expect(await starter.result).toEqual({ code: 0, stdout: '', stderr: '' });
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    }, 30000);
+
+    it('connects to a daemon that became ready between its first connect and its check for a live owner', async () => {
+      // The daemon waits to listen until this client has found nothing listening, and is ready before that check
+      // returns. Then nothing owns a startup, so only the last connect can find the ready daemon.
+      fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+      const daemon = run('daemon.js', [JSON.stringify(paths)]);
+      const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+      // This test, not a startup helper, is the daemon's parent, so afterEach must not wait for it to exit.
+      expect(fs.readFileSync(path.join(folder, 'parents'), 'utf8')).toBe(`${process.pid}\n`);
+      fs.unlinkSync(path.join(folder, 'parents'));
+      const isEndpointUnboundAsync: (socketPath: string) => Promise<boolean> =
+        DaemonOwnership.isEndpointUnboundAsync;
+      const endpointCheck: jest.SpyInstance = jest
+        .spyOn(DaemonOwnership, 'isEndpointUnboundAsync')
+        .mockImplementation(async (socketPath: string) => {
+          const unbound: boolean = await isEndpointUnboundAsync(socketPath);
+          fs.unlinkSync(path.join(folder, 'hold-prebind'));
+          const deadline: number = Date.now() + 10000;
+          while ((await isEndpointUnboundAsync(socketPath)) && Date.now() < deadline) await delayAsync(20);
+          return unbound;
+        });
+      const onAwaitStartup: jest.Mock = jest.fn();
+      try {
+        const client: DaemonClient | undefined = await connectToStartingDaemonAsync({
+          ...options,
+          onAwaitStartup
+        });
+        expect(endpointCheck).toHaveBeenCalledTimes(1);
+        expect(client).toBeDefined();
+        const { pid } = await client!.status;
+        await client!.closeAsync();
+        expect(pid).toBe(daemonPid);
+      } finally {
+        endpointCheck.mockRestore();
+      }
+      expect(onAwaitStartup).not.toHaveBeenCalled();
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      expect(await daemon.result).toEqual({
+        code: 0,
+        stdout: 'launcher stdout\n',
+        stderr: 'launcher stderr\n'
+      });
+    }, 30000);
+
+    it('waits while another client holds the start mutex, until it is released or the wait is aborted', async () => {
+      const holder = run('startLockHolder.js', [JSON.stringify(paths)]);
+      await waitForFileAsync(path.join(folder, 'lock-held'));
+      const abort: AbortController = new AbortController();
+      const aborted: Promise<unknown> = connectToStartingDaemonAsync({
+        ...options,
+        abortSignal: abort.signal
+      }).then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      await delayAsync(300);
+      abort.abort();
+      expect(await aborted).toMatchObject({ name: 'AbortError' });
+
+      const onAwaitStartup: jest.Mock = jest.fn();
+      const started: number = Date.now();
+      const waiting: Promise<DaemonClient | undefined> = connectToStartingDaemonAsync({
+        ...options,
+        onAwaitStartup
+      });
+      await delayAsync(500);
+      fs.writeFileSync(path.join(folder, 'release-lock'), '');
+      await expect(waiting).resolves.toBeUndefined();
+      expect(Date.now() - started).toBeGreaterThanOrEqual(500);
+      expect(onAwaitStartup.mock.calls).toEqual([
+        ['Another client is still starting the daemon', expect.any(Number)]
+      ]);
+      expect(await holder.result).toEqual({ code: 0, stdout: '', stderr: '' });
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    }, 30000);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts
new file mode 100644
index 00000000000..8b7d34ab2b5
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts
@@ -0,0 +1,123 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from '../DaemonClient';
+import { DaemonClientError } from '../DaemonClientError';
+import * as DaemonOwnership from '../DaemonOwnership';
+import * as DaemonStartup from '../DaemonStartup';
+import * as DaemonStartupReservation from '../DaemonStartupReservation';
+import * as StartupLock from '../StartupLock';
+import * as ConnectOrStartDaemon from '../connectOrStartDaemon';
+import {
+  connectOrAwaitDaemonStartupAsync,
+  type IConnectOrAwaitDaemonStartupOptions
+} from '../connectOrAwaitDaemonStartup';
+
+const STARTUP_TIMEOUT_MS: number = 10000;
+const HELPER_OWNER: string = 'Its startup helper (PID 4242) is still waiting for the daemon';
+
+// The fixture daemon can't make a startup attempt fail at once, or with a `timeout` error, so these tests
+// replace the startup attempt and the checks for a live owner. The owner is a running startup helper.
+describe('connectOrAwaitDaemonStartupAsync with startup attempts that fail at once', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let connect: jest.SpyInstance;
+  let notices: { owner: string; waitMs: number }[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-retry-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    notices = [];
+    jest.spyOn(DaemonOwnership, 'isEndpointUnboundAsync').mockResolvedValue(true);
+    jest.spyOn(DaemonStartup, 'readDaemonStartupReservation').mockReturnValue({
+      contents: 'reservation',
+      helper: { pid: 4242, startedAt: 'Tue Sep 29 04:00:00 2026' }
+    });
+    jest.spyOn(DaemonStartupReservation, 'getStartupHelperState').mockReturnValue('running');
+    // Nobody else holds the start mutex.
+    jest.spyOn(StartupLock, 'tryAcquireStartupLockAsync').mockResolvedValue({ releaseAsync: async () => {} });
+    connect = jest.spyOn(ConnectOrStartDaemon, 'connectOrStartDaemonAsync');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createOptions(): IConnectOrAwaitDaemonStartupOptions {
+    return {
+      paths,
+      startupTimeoutMs: STARTUP_TIMEOUT_MS,
+      onAwaitStartup: (owner: string, waitMs: number): void => {
+        notices.push({ owner, waitMs });
+      }
+    };
+  }
+
+  it('keeps waiting through a timeout error, as through a failed startup', async () => {
+    const client: DaemonClient = {} as DaemonClient;
+    connect
+      .mockRejectedValueOnce(
+        new DaemonClientError('timeout', 'Daemon startup timed out awaiting hello/ping readiness.')
+      )
+      .mockRejectedValueOnce(
+        new DaemonClientError('timeout', 'Daemon startup timed out awaiting hello/ping readiness.')
+      )
+      .mockResolvedValueOnce(client);
+
+    await expect(connectOrAwaitDaemonStartupAsync(createOptions())).resolves.toBe(client);
+    expect(connect).toHaveBeenCalledTimes(3);
+    expect(notices).toEqual([{ owner: HELPER_OWNER, waitMs: expect.any(Number) }]);
+  });
+
+  it('says once that it waits, and retries every 100 ms with only the time left', async () => {
+    const client: DaemonClient = {} as DaemonClient;
+    const attempts: { at: number; startupTimeoutMs: number | undefined }[] = [];
+    connect.mockImplementation(
+      async (options: ConnectOrStartDaemon.IConnectOrStartDaemonOptions): Promise<DaemonClient> => {
+        attempts.push({ at: Date.now(), startupTimeoutMs: options.startupTimeoutMs });
+        if (attempts.length < 5) {
+          throw new DaemonClientError('startupFailed', 'Daemon startup failed.');
+        }
+        return client;
+      }
+    );
+
+    await expect(connectOrAwaitDaemonStartupAsync(createOptions())).resolves.toBe(client);
+    expect(notices).toEqual([{ owner: HELPER_OWNER, waitMs: expect.any(Number) }]);
+    expect(notices[0].waitMs).toBeLessThanOrEqual(STARTUP_TIMEOUT_MS);
+
+    // The first attempt is the caller's own. The first retry follows it at once, with at most the whole
+    // second deadline, and each later retry waits about 100 ms and gets only what is left of that deadline.
+    expect(attempts).toHaveLength(5);
+    expect(attempts[0].startupTimeoutMs).toBe(STARTUP_TIMEOUT_MS);
+    expect(attempts[1].startupTimeoutMs).toBeLessThanOrEqual(STARTUP_TIMEOUT_MS);
+    for (let i: number = 2; i < attempts.length; i++) {
+      expect(attempts[i].at - attempts[i - 1].at).toBeGreaterThanOrEqual(90);
+      expect(attempts[i].startupTimeoutMs).toBeLessThanOrEqual(attempts[i - 1].startupTimeoutMs! - 90);
+      expect(attempts[i].startupTimeoutMs).toBeGreaterThan(0);
+    }
+  });
+
+  it('counts a startup reservation that cannot be read as no owner, so the caller can run in-process', async () => {
+    jest.spyOn(DaemonStartup, 'readDaemonStartupReservation').mockImplementation(() => {
+      throw new Error('EACCES: permission denied');
+    });
+    const startupError: DaemonClientError = new DaemonClientError('startupFailed', 'Daemon startup failed.');
+    connect.mockRejectedValueOnce(startupError);
+
+    await expect(connectOrAwaitDaemonStartupAsync(createOptions())).rejects.toBe(startupError);
+    expect(connect).toHaveBeenCalledTimes(1);
+    expect(notices).toEqual([]);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 633bb9b87fe..f0fbcae3748 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -2,29 +2,73 @@
 // See LICENSE in the project root for license information.
 
 import { spawn, type ChildProcess } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
 import * as net from 'node:net';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { FileSystem } from '@rushstack/node-core-library';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import {
   readDaemonLockfile,
   type IDaemonLockfile,
+  type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
-import { DaemonClient } from '../DaemonClient';
+import { DaemonClient, type DaemonClientOutcome } from '../DaemonClient';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
-import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
-import { executeWithDaemonRestartAsync } from '../executeWithDaemonRestart';
-import { getDaemonStartupFilePath } from '../DaemonStartup';
+import {
+  connectOrStartDaemonAsync,
+  connectToPlannedSuccessorAsync,
+  requestDaemonShutdownAsync,
+  resolveDaemonStartupReservationAsync,
+  type IConnectOrStartDaemonOptions,
+  type IDaemonStartCommand
+} from '../connectOrStartDaemon';
+import {
+  DaemonRestartFailedError,
+  executeWithDaemonRestartAsync,
+  type IDaemonRestartNotice
+} from '../executeWithDaemonRestart';
+import {
+  getDaemonStartupFilePath,
+  readDaemonStartupReservation,
+  releaseDaemonStartup,
+  reserveDaemonStartup,
+  type IDaemonStartupReservation
+} from '../DaemonStartup';
+import {
+  inspectDaemonStartupReservation,
+  tryTakeOverAbandonedStartupReservationAsync
+} from '../DaemonStartupReservation';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  describeGroupLeftRunning,
+  isRunning,
+  readClientLogTexts,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  startOrphanedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
+/** How long after a launch a client may take over its reservation once the helper exited. */
+const RELAUNCH_DELAY_MS: number = 15000;
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
 describe('detached daemon startup', () => {
   let folder: string;
   let paths: IDaemonPaths;
@@ -77,6 +121,8 @@ describe('detached daemon startup', () => {
       await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
       expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
     }
+    // A test that expects a fixture daemon to fail checks and removes this record.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
     if (fs.existsSync(path.join(folder, 'parents'))) {
       const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
       await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
@@ -134,12 +180,119 @@ describe('detached daemon startup', () => {
     return daemonPid;
   }
 
+  async function getExitedPidAsync(): Promise<number> {
+    const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+    await once(exited, 'close');
+    return exited.pid!;
+  }
+
+  function writeReservation(helperPid: number, helperStartedAt: string = new Date().toISOString()): string {
+    const contents: string = JSON.stringify({ token: randomUUID(), helperPid, helperStartedAt });
+    fs.writeFileSync(getDaemonStartupFilePath(paths), contents);
+    return contents;
+  }
+
+  /** Records the reservation's launch as one relaunch delay earlier, so that its relaunch time has passed. */
+  function ageReservation(): string {
+    const record: { helperStartedAt: string } = JSON.parse(
+      fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')
+    );
+    const helperStartedAt: string = new Date(
+      Date.parse(record.helperStartedAt) - RELAUNCH_DELAY_MS
+    ).toISOString();
+    const contents: string = JSON.stringify({ ...record, helperStartedAt });
+    fs.writeFileSync(getDaemonStartupFilePath(paths), contents);
+    return helperStartedAt;
+  }
+
+  function readTakeOverLines(): string[] {
+    return readIfPresent(getDaemonLogFilePath(paths))
+      .split('\n')
+      .filter((line) => line.includes('took over the startup reservation'));
+  }
+
+  /** Unlike waitForTestProcessExitAsync, a zombie does not count: until it is reaped, its PID looks alive. */
+  async function waitForProcessGoneAsync(pid: number): Promise<void> {
+    const deadline: number = Date.now() + 5000;
+    while (true) {
+      try {
+        process.kill(pid, 0);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ESRCH') return;
+        throw error;
+      }
+      if (Date.now() >= deadline) throw new Error(`Process ${pid} was not reaped in time.`);
+      await delayAsync(10);
+    }
+  }
+
+  async function waitForFileAsync(filePath: string): Promise<string> {
+    const deadline: number = Date.now() + 5000;
+    while (!fs.existsSync(filePath) && Date.now() < deadline) await delayAsync(20);
+    return fs.readFileSync(filePath, 'utf8');
+  }
+
+  /**
+   * Leaves a daemon held before it listens, whose startup helper was killed after its client gave up, and a
+   * reservation whose relaunch time has passed.
+   */
+  async function abandonStartupBeforeBindAsync(): Promise<{ daemonPid: number; helperPid: number }> {
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 1000 })).rejects.toThrow(
+      'timed out awaiting hello/ping readiness'
+    );
+    const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+    const { helperPid } = JSON.parse(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8'));
+    expect(fs.readFileSync(path.join(folder, 'parents'), 'utf8')).toBe(`${helperPid}\n`);
+    // This test started the helper (through connectOrStartDaemonAsync), so it may signal that PID.
+    process.kill(helperPid, 'SIGKILL');
+    await waitForProcessGoneAsync(helperPid);
+    expect(inspectDaemonStartupReservation(paths)).toMatchObject({ helperPid, helperState: 'exited' });
+    ageReservation();
+    return { daemonPid, helperPid };
+  }
+
+  /** The start command of a second fixture daemon, which waits before it listens while "hold-prebind-b" exists. */
+  function getSecondDaemonOptions(): IConnectOrStartDaemonOptions {
+    const startCommand: IDaemonStartCommand = options.startCommand!;
+    return {
+      ...options,
+      startCommand: {
+        ...startCommand,
+        environment: { ...startCommand.environment, FIXTURE_HOLD_PREBIND: 'hold-prebind-b' }
+      }
+    };
+  }
+
+  /** Waits for the fixture daemon that lost the race for the endpoint to exit, and checks why it failed. */
+  async function expectLostEndpointRaceAsync(loserPid: number, winnerPid: number): Promise<void> {
+    await waitForTestProcessExitAsync(loserPid);
+    const failuresPath: string = path.join(folder, 'failures');
+    expect(readIfPresent(failuresPath)).toMatch(
+      new RegExp(`^${loserPid} (Daemon process ${winnerPid} still owns |A live daemon already listens at )`)
+    );
+    expect(readIfPresent(failuresPath).trim().split('\n')).toHaveLength(1);
+    fs.unlinkSync(failuresPath);
+  }
+
+  async function startFixtureDaemonAsync(): Promise<number> {
+    const client: DaemonClient = await connectOrStartDaemonAsync(options);
+    const { pid } = await client.status;
+    await client.closeAsync();
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    return pid!;
+  }
+
   it('fails closed for successor starters while the original detached daemon remains pre-bind', async () => {
     const daemonPid: number = await killStarterBeforeBindAsync();
     const results = await Promise.all(
       Array.from({ length: 4 }, () => startClient({ ...options, startupTimeoutMs: 700 }).result)
     );
     expect(results.every(({ code }) => code !== 0)).toBe(true);
+    // The helper is alive, so the client that holds the start lock waits for it until its own deadline.
+    expect(
+      results.some(({ stderr }) => stderr.includes('is still waiting for the daemon to become ready'))
+    ).toBe(true);
     expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
     expect(fs.existsSync(paths.lockfilePath)).toBe(false);
 
@@ -163,11 +316,25 @@ describe('detached daemon startup', () => {
     });
     expect((await client.status).pid).toBe(daemonPid);
     await client.closeAsync();
-    // Successors accept the ready daemon at once; the live helper then releases its own reservation.
-    const releaseDeadline: number = Date.now() + 5000;
-    while (fs.existsSync(getDaemonStartupFilePath(paths)) && Date.now() < releaseDeadline) {
-      await delayAsync(20);
-    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 15000);
+
+  it('lets the detached helper finish a startup that outlasts the requesting client', async () => {
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const first = startClient({ ...options, startupTimeoutMs: 1000 });
+    const barrier: string = path.join(folder, 'prebind');
+    const deadline: number = Date.now() + 5000;
+    while (!fs.existsSync(barrier) && Date.now() < deadline) await delayAsync(20);
+    const daemonPid: number = Number(fs.readFileSync(barrier, 'utf8'));
+    expect((await first.result).code).not.toBe(0);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(true);
+
+    // The launcher becomes ready only after the first client has given up.
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    const client = await connectOrStartDaemonAsync(options);
+    expect((await client.status).pid).toBe(daemonPid);
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
     expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
   }, 15000);
 
@@ -185,94 +352,450 @@ describe('detached daemon startup', () => {
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
   });
 
-  it('releases the reservation and reports the launcher error when it exits before readiness', async () => {
+  it('does not infer safe retry from a launcher exiting before ownership publication', async () => {
     const startupPath: string = getDaemonStartupFilePath(paths);
     const failing: IConnectOrStartDaemonOptions = {
       ...options,
       startCommand: { ...options.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
     };
-    const started: number = Date.now();
-    await expect(connectOrStartDaemonAsync(failing)).rejects.toThrow(
-      /helper exited \(1\) before readiness[\s\S]*Last launcher log lines:[\s\S]*startup reservation released/
+    await expect(connectOrStartDaemonAsync(failing)).rejects.toThrow('Unable to start');
+    const contents: string = fs.readFileSync(startupPath, 'utf8');
+    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 100 })).rejects.toThrow(
+      'unresolved startup handoff'
     );
-    expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
-    expect(fs.existsSync(startupPath)).toBe(false);
+    expect(fs.readFileSync(startupPath, 'utf8')).toBe(contents);
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
-    const client = await connectOrStartDaemonAsync(options);
-    await client.closeAsync();
-    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
   });
 
-  async function getExitedPidAsync(): Promise<number> {
-    const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
-    await once(exited, 'exit');
-    return exited.pid!;
-  }
-
-  function writeReservation(ownerPid: number, launcherPid?: number): string {
-    const contents: string = JSON.stringify({
-      token: 'fixture',
-      createdAt: new Date().toISOString(),
-      timeoutMs: 1000,
-      ownerPid,
-      ownerStartedAt: new Date().toISOString(),
-      launcherPid
+  it('refuses another launch at once after the startup helper exited, until the relaunch time', async () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    const failing: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
+    };
+    await expect(connectOrStartDaemonAsync(failing)).rejects.toThrow('Unable to start');
+    const contents: string = fs.readFileSync(startupPath, 'utf8');
+    const { helperPid, helperStartedAt } = JSON.parse(contents);
+    const relaunchAfter: string = new Date(Date.parse(helperStartedAt) + RELAUNCH_DELAY_MS).toISOString();
+    expect(inspectDaemonStartupReservation(paths)).toEqual({
+      path: startupPath,
+      helperPid,
+      helperState: 'exited',
+      relaunchAfter
     });
-    fs.writeFileSync(getDaemonStartupFilePath(paths), contents);
-    return contents;
-  }
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 20000 }).then(
+      () => new Error('Expected startup to be refused.'),
+      (refusal: Error) => refusal
+    );
+    expect(Date.now() - started).toBeLessThan(3000);
+    expect(error.message).toContain(
+      `unresolved startup handoff at ${startupPath}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch until ${relaunchAfter}, so that a daemon that cannot start is not launched by every command.`
+    );
+    expect(error.message).not.toContain('..');
+    expect(fs.readFileSync(startupPath, 'utf8')).toBe(contents);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    expect(readTakeOverLines()).toEqual([]);
 
-  it('reclaims a stale reservation whose owner and launcher are dead and starts at once', async () => {
-    writeReservation(await getExitedPidAsync(), await getExitedPidAsync());
+    // Once the relaunch time has passed, the next client takes the reservation over and starts the daemon.
+    const agedStartedAt: string = ageReservation();
+    const daemonPid: number = await startFixtureDaemonAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    const takeOvers: string[] = readTakeOverLines();
+    expect(takeOvers).toHaveLength(1);
+    expect(takeOvers[0]).toMatch(/^\d{4}-\d\d-\d\dT[\d:.]+Z rush-client /);
+    expect(takeOvers[0]).toContain(
+      `rush-client (PID ${process.pid}): took over the startup reservation of startup helper PID ${helperPid} (started ${agedStartedAt}), which exited before the daemon became ready; starting the daemon again.`
+    );
+  });
+
+  it('reports at once a daemon that became ready but was stopped before this client connected', async () => {
+    // The daemon reports another version, so every connect by this client misses its ready window; the helper,
+    // which does not check the version, sees it ready. The daemon then stops like one reached by "daemon stop".
     const started: number = Date.now();
-    const client = await connectOrStartDaemonAsync(options);
-    await client.closeAsync();
-    expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
-    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    const error: Error = await connectOrStartDaemonAsync({
+      ...options,
+      startupTimeoutMs: 6000,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'other', 'stop-when-ready']
+      }
+    }).then(
+      () => new Error('Expected startup to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toContain(
+      'Daemon startup failed: the daemon became ready but exited before this client connected'
+    );
+    expect(Date.now() - started).toBeLessThan(3500);
     expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 15000);
+
+  it('waits out its deadline for a daemon that became ready and still has its lockfile', async () => {
+    // As above, the helper sees the daemon ready and this client never connects, but the daemon stays up.
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({
+      ...options,
+      startupTimeoutMs: 3000,
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'other'] }
+    }).then(
+      () => new Error('Expected startup to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toContain('Daemon startup timed out awaiting hello/ping readiness.');
+    expect(Date.now() - started).toBeGreaterThanOrEqual(3000);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 15000);
+
+  it('waits out its deadline while another startup is reserved after the daemon that became ready exited', async () => {
+    // As above, but the daemon exits once it has reserved another startup, as a successor's starter would.
+    // It reserves under its own PID, so its owner has exited too: this pins only that a reservation file
+    // makes the client wait. If the client ever checks that the owner is alive, this test must change.
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({
+      ...options,
+      startupTimeoutMs: 3000,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'other', 'reserve-and-stop-when-ready']
+      }
+    }).then(
+      () => new Error('Expected startup to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toContain('Daemon startup timed out awaiting hello/ping readiness.');
+    expect(Date.now() - started).toBeGreaterThanOrEqual(3000);
+    const daemonPids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+    expect(daemonPids).toHaveLength(1);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(JSON.parse(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8'))).toMatchObject({
+      helperPid: Number(daemonPids[0])
+    });
+  }, 15000);
+
+  it('refuses a relaunch while a process accepts connections at the endpoint', async () => {
+    const sockets: Set<net.Socket> = new Set();
+    // Accepts connections but never completes hello, like a daemon that listens but is not ready.
+    const server: net.Server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+    });
+    await new Promise<void>((resolve) => server.listen(paths.socketPath, resolve));
+    try {
+      const helperPid: number = await getExitedPidAsync();
+      const contents: string = writeReservation(
+        helperPid,
+        new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString()
+      );
+      const started: number = Date.now();
+      const error: Error = await connectOrStartDaemonAsync({
+        ...options,
+        startupTimeoutMs: 1500,
+        timeoutMs: 200
+      }).then(
+        () => new Error('Expected startup to be refused.'),
+        (refusal: Error) => refusal
+      );
+      // It keeps checking until the deadline, since that process may still become ready.
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1400);
+      expect(error.message).toContain(
+        `its startup helper (PID ${helperPid}) exited before the daemon became ready, but a process still accepts connections at ${paths.socketPath}; refusing another launch.`
+      );
+      expect(error.message).toContain('daemon stop --force');
+      expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+      expect(readTakeOverLines()).toEqual([]);
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
   });
 
-  it('reclaims an unrecognized reservation only after the bounded age', async () => {
-    const startupPath: string = getDaemonStartupFilePath(paths);
-    fs.writeFileSync(startupPath, 'legacy-token');
-    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 200 })).rejects.toThrow(
-      'unresolved startup handoff'
+  it('never takes over a reservation whose startup helper still runs, however old', async () => {
+    // Recorded when this process started, so the reservation names this process, which still runs.
+    const helperStartedAt: number = performance.timeOrigin;
+    const age: number = Date.now() - helperStartedAt;
+    if (age <= RELAUNCH_DELAY_MS + 1000) await delayAsync(RELAUNCH_DELAY_MS + 1000 - age);
+    const contents: string = writeReservation(process.pid, new Date(helperStartedAt).toISOString());
+    expect(inspectDaemonStartupReservation(paths)).toMatchObject({ helperState: 'running' });
+    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 500 })).rejects.toThrow(
+      `its startup helper (PID ${process.pid}) is still waiting for the daemon to become ready; refusing another launch`
     );
-    const old: Date = new Date(Date.now() - 10 * 60 * 1000);
-    fs.utimesSync(startupPath, old, old);
-    const client = await connectOrStartDaemonAsync(options);
-    await client.closeAsync();
+    expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    expect(readTakeOverLines()).toEqual([]);
+  }, 30000);
+
+  it('takes over only the reservation that it found abandoned, not one that replaced it since', async () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    writeReservation(await getExitedPidAsync(), new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString());
+    const abandoned: IDaemonStartupReservation = readDaemonStartupReservation(paths)!;
+    // After the caller read it, the reservation was replaced by one whose helper still runs.
+    const replacement: string = writeReservation(process.pid);
+    expect(await tryTakeOverAbandonedStartupReservationAsync(paths, abandoned)).toBe(false);
+    expect(fs.readFileSync(startupPath, 'utf8')).toBe(replacement);
+
+    // Unchanged, the same reservation is taken over.
+    fs.writeFileSync(startupPath, abandoned.contents!);
+    expect(await tryTakeOverAbandonedStartupReservationAsync(paths, abandoned)).toBe(true);
     expect(fs.existsSync(startupPath)).toBe(false);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
   });
 
-  it('keeps waiting on a reservation whose launcher is still alive', async () => {
-    const contents: string = writeReservation(await getExitedPidAsync(), process.pid);
-    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 200 })).rejects.toThrow(
-      /unresolved startup handoff .*launcher PID \d+ alive/
+  it('lets exactly one of several clients take over a reservation whose helper exited', async () => {
+    const helperPid: number = await getExitedPidAsync();
+    writeReservation(helperPid, new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString());
+    const results = await Promise.all(Array.from({ length: 4 }, () => startClient().result));
+    expect(results).toEqual(Array.from({ length: 4 }, () => ({ code: 0, stderr: '' })));
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    const takeOvers: string[] = readTakeOverLines();
+    expect(takeOvers).toHaveLength(1);
+    expect(takeOvers[0]).toContain(`took over the startup reservation of startup helper PID ${helperPid} `);
+  }, 15000);
+
+  it('keeps one daemon when a relaunch outpaces the daemon of a killed startup helper', async () => {
+    const { daemonPid, helperPid } = await abandonStartupBeforeBindAsync();
+    const client: DaemonClient = await connectOrStartDaemonAsync(getSecondDaemonOptions());
+    let successorPid: number;
+    try {
+      successorPid = (await client.status).pid!;
+    } finally {
+      await client.closeAsync();
+    }
+    expect(successorPid).not.toBe(daemonPid);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n${successorPid}\n`);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    expect(readTakeOverLines()).toHaveLength(1);
+    expect(readTakeOverLines()[0]).toContain(`startup helper PID ${helperPid} `);
+
+    // The first daemon finds the successor at the endpoint and exits.
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    await expectLostEndpointRaceAsync(daemonPid, successorPid);
+    const next: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await next.status).pid).toBe(successorPid);
+    } finally {
+      await next.closeAsync();
+    }
+  }, 20000);
+
+  it('keeps one daemon when the daemon of a killed startup helper outpaces the relaunch', async () => {
+    const { daemonPid } = await abandonStartupBeforeBindAsync();
+    fs.writeFileSync(path.join(folder, 'hold-prebind-b'), '');
+    const relaunch: Promise<DaemonClient> = connectOrStartDaemonAsync(getSecondDaemonOptions());
+    const successorPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind-b')));
+    expect(successorPid).not.toBe(daemonPid);
+
+    // The first daemon publishes the endpoint first, so the relaunch's helper finds it ready.
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    const client: DaemonClient = await relaunch;
+    try {
+      expect((await client.status).pid).toBe(daemonPid);
+    } finally {
+      await client.closeAsync();
+    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+
+    fs.unlinkSync(path.join(folder, 'hold-prebind-b'));
+    await expectLostEndpointRaceAsync(successorPid, daemonPid);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n${successorPid}\n`);
+    const next: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await next.status).pid).toBe(daemonPid);
+    } finally {
+      await next.closeAsync();
+    }
+  }, 20000);
+
+  it.each(['legacy', 'exited helper', 'no auto-start'])(
+    'uses and resolves a ready daemon next to a retained startup reservation (%s)',
+    async (kind) => {
+      const daemonPid: number = await startFixtureDaemonAsync();
+      if (kind === 'legacy') {
+        fs.writeFileSync(getDaemonStartupFilePath(paths), randomUUID());
+      } else {
+        writeReservation(await getExitedPidAsync());
+      }
+      const started: number = Date.now();
+      const client: DaemonClient = await connectOrStartDaemonAsync(
+        kind === 'no auto-start' ? { paths, expectedDaemonVersion: 'fixture' } : options
+      );
+      try {
+        expect((await client.status).pid).toBe(daemonPid);
+      } finally {
+        await client.closeAsync();
+      }
+      expect(Date.now() - started).toBeLessThan(3000);
+      expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    }
+  );
+
+  it('resolves a retained startup reservation before replacing a mismatched ready daemon', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    fs.writeFileSync(getDaemonStartupFilePath(paths), randomUUID());
+    const replacement: DaemonClient = await connectOrStartDaemonAsync({
+      ...options,
+      expectedDaemonVersion: 'replacement',
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'replacement'] }
+    });
+    try {
+      const status = await replacement.status;
+      expect(status.daemonVersion).toBe('replacement');
+      expect(status.pid).not.toBe(daemonPid);
+    } finally {
+      await replacement.closeAsync();
+    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
+  });
+
+  it('keeps a startup reservation next to a ready daemon that is not the attested owner', async () => {
+    await startFixtureDaemonAsync();
+    const owner: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+    fs.writeFileSync(paths.lockfilePath, JSON.stringify({ ...JSON.parse(owner), pid: process.pid }));
+    const contents: string = writeReservation(await getExitedPidAsync());
+    try {
+      await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 2000 })).rejects.toThrow(
+        'unresolved startup handoff'
+      );
+      await expect(connectOrStartDaemonAsync({ paths, expectedDaemonVersion: 'fixture' })).rejects.toThrow(
+        'auto-start is disabled'
+      );
+      expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+    } finally {
+      fs.writeFileSync(paths.lockfilePath, owner);
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+
+  it('resolves a retained startup reservation before shutdown so that a successor can start', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    writeReservation(await getExitedPidAsync());
+    const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+    const previousDaemon = await requestDaemonShutdownAsync(running, paths).finally(() =>
+      running.closeAsync()
     );
+    expect(previousDaemon.pid).toBe(daemonPid);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    const successor: DaemonClient = await connectOrStartDaemonAsync({ ...options, previousDaemon });
+    try {
+      expect((await successor.status).pid).not.toBe(daemonPid);
+    } finally {
+      await successor.closeAsync();
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
+  });
+
+  it('does not request shutdown while the start lock keeps a startup reservation unresolved', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    const contents: string = writeReservation(await getExitedPidAsync());
+    const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+    expect(lock).toBeDefined();
+    const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+    try {
+      await expect(requestDaemonShutdownAsync(running, paths, 300)).rejects.toThrow(
+        `Another client is starting or resetting the daemon for ${paths.lockfilePath}; shutdown was not sent.`
+      );
+    } finally {
+      await running.closeAsync();
+      await lock!.releaseAsync();
+    }
     expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
-    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    const client: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await client.status).pid).toBe(daemonPid);
+    } finally {
+      await client.closeAsync();
+    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
   });
 
-  it.each([
-    { behavior: 'cleans up after a dead owner', liveOwner: false },
-    { behavior: 'leaves a live owner to release', liveOwner: true }
-  ])('accepts a ready daemon despite a reservation and $behavior', async ({ liveOwner }) => {
-    const first = await connectOrStartDaemonAsync(options);
-    const { pid } = await first.status;
-    await first.closeAsync();
-    const contents: string = writeReservation(liveOwner ? process.pid : await getExitedPidAsync());
-    const started: number = Date.now();
-    const client = await connectOrStartDaemonAsync({ ...options, startCommand: undefined });
-    expect((await client.status).pid).toBe(pid);
-    await client.closeAsync();
-    expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
-    if (liveOwner) {
+  it('resolves a startup reservation before a plain stop only for the attested ready daemon', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+    try {
+      await expect(resolveDaemonStartupReservationAsync(running, paths)).resolves.toBe(true);
+      const contents: string = writeReservation(await getExitedPidAsync());
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      expect(lock).toBeDefined();
+      try {
+        await expect(resolveDaemonStartupReservationAsync(running, paths, 300)).resolves.toBe(false);
+      } finally {
+        await lock!.releaseAsync();
+      }
+      const owner: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      fs.writeFileSync(paths.lockfilePath, JSON.stringify({ ...JSON.parse(owner), pid: process.pid }));
+      try {
+        await expect(resolveDaemonStartupReservationAsync(running, paths)).resolves.toBe(false);
+      } finally {
+        fs.writeFileSync(paths.lockfilePath, owner);
+      }
       expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
-    } else {
+      await expect(resolveDaemonStartupReservationAsync(running, paths)).resolves.toBe(true);
       expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+      await running.shutdownAsync();
+    } finally {
+      await running.closeAsync();
     }
-    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    // With the reservation resolved, a later start launches a new daemon instead of being refused.
+    await waitForTestProcessExitAsync(daemonPid);
+    const successor: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await successor.status).pid).not.toBe(daemonPid);
+    } finally {
+      await successor.closeAsync();
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
+  });
+
+  it('reports a startup reservation and whether its helper can still release it', async () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    expect(inspectDaemonStartupReservation(paths)).toBeUndefined();
+    fs.writeFileSync(startupPath, randomUUID());
+    expect(inspectDaemonStartupReservation(paths)).toEqual({ path: startupPath, helperState: 'unknown' });
+    writeReservation(process.pid);
+    expect(inspectDaemonStartupReservation(paths)).toEqual({
+      path: startupPath,
+      helperPid: process.pid,
+      helperState: 'running'
+    });
+    const exitedPid: number = await getExitedPidAsync();
+    const helperStartedAt: Date = new Date();
+    writeReservation(exitedPid, helperStartedAt.toISOString());
+    expect(inspectDaemonStartupReservation(paths)).toEqual({
+      path: startupPath,
+      helperPid: exitedPid,
+      helperState: 'exited',
+      relaunchAfter: new Date(helperStartedAt.getTime() + RELAUNCH_DELAY_MS).toISOString()
+    });
+    if (process.platform === 'linux') {
+      // This process started after the recorded helper, so it merely reuses the PID.
+      writeReservation(process.pid, new Date(Date.now() - 3600000).toISOString());
+      expect(inspectDaemonStartupReservation(paths)).toMatchObject({ helperState: 'exited' });
+    }
+    fs.unlinkSync(startupPath);
+    fs.mkdirSync(startupPath);
+    expect(inspectDaemonStartupReservation(paths)).toEqual({ path: startupPath, helperState: 'unknown' });
+    fs.rmdirSync(startupPath);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  });
+
+  it('lets a startup helper release only its own reservation, tolerating one already resolved', () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    const helper = { pid: process.pid, startedAt: new Date().toISOString() };
+    const token: string = reserveDaemonStartup(paths, helper);
+    expect(() => reserveDaemonStartup(paths, helper)).toThrow('EEXIST');
+    expect(() => releaseDaemonStartup(paths, randomUUID())).toThrow('changed ownership');
+    expect(fs.existsSync(startupPath)).toBe(true);
+    releaseDaemonStartup(paths, token);
+    expect(fs.existsSync(startupPath)).toBe(false);
+    releaseDaemonStartup(paths, token);
+    expect(fs.existsSync(startupPath)).toBe(false);
   });
 
   it.each([false, true])(
@@ -404,6 +927,53 @@ describe('detached daemon startup', () => {
     await client.closeAsync();
   }, 15000);
 
+  // On Linux, LockFile checks the owners of other lockfiles. It used to run "ps" for each of them on every attempt,
+  // and "ps" reads every process on the system, so clients that started at once timed out on a busy machine.
+  (process.platform === 'linux' ? it : it.skip)(
+    'connects 32 concurrent clients to a daemon that takes 8 seconds to start, running "ps" once per client',
+    async () => {
+      const clientCount: number = 32;
+      fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '8000');
+      // A "ps" script ahead of the real one on the PATH records the client that runs each "ps" command.
+      const binFolder: string = path.join(folder, 'bin');
+      const psCallsPath: string = path.join(folder, 'ps-calls');
+      fs.mkdirSync(binFolder);
+      fs.writeFileSync(
+        path.join(binFolder, 'ps'),
+        `#!/bin/sh\necho "$PPID" >> '${psCallsPath}'\nPATH='${process.env.PATH}' exec ps "$@"\n`,
+        { mode: 0o755 }
+      );
+      // The default deadline, instead of the 7 seconds that this suite uses.
+      const startOptions: IConnectOrStartDaemonOptions = { ...options, startupTimeoutMs: 15000 };
+      const starters: ChildProcess[] = Array.from({ length: clientCount }, () =>
+        spawn(process.execPath, [path.join(__dirname, 'fixtures/starter.js'), JSON.stringify(startOptions)], {
+          // With another locale, "ps" can print localized names, and LockFile then runs "ps" to check them.
+          env: { ...process.env, PATH: `${binFolder}${path.delimiter}${process.env.PATH}`, LC_ALL: 'C' },
+          stdio: ['ignore', 'ignore', 'pipe']
+        })
+      );
+      starterProcesses.push(...starters);
+      const results = await Promise.all(
+        starters.map(async (starter) => {
+          let stderr: string = '';
+          starter.stderr!.on('data', (chunk: Buffer) => {
+            stderr += chunk.toString();
+          });
+          const [code] = await once(starter, 'close');
+          return { code, stderr };
+        })
+      );
+
+      expect(results).toEqual(Array.from({ length: clientCount }, () => ({ code: 0, stderr: '' })));
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+      // Each client runs "ps" once, for its own start time. Lockfiles of other clients are checked with /proc.
+      const psCalls: number = fs.readFileSync(psCallsPath, 'utf8').trim().split('\n').length;
+      expect(psCalls).toBeGreaterThan(0);
+      expect(psCalls).toBeLessThan(2 * clientCount);
+    },
+    30000
+  );
+
   it('replaces a mismatched daemon exactly once for concurrent clients before requests start', async () => {
     const old = await connectOrStartDaemonAsync(options);
     const previous = await old.status;
@@ -483,8 +1053,9 @@ describe('detached daemon startup', () => {
   it.each(['restart-once', 'restart-twice', 'restart-always', 'restart-held'])(
     'retries only the typed pre-execution result for %s after ownership release',
     async (mode) => {
-      // restart-always exhausts the deadline; the others need room for loaded CI machines.
-      const waitTimeoutMs: number = mode === 'restart-always' ? 1000 : 10000;
+      // restart-always runs out of retries or of this deadline, which leaves a successor time to start on a loaded
+      // CI machine. The others need more room.
+      const waitTimeoutMs: number = mode === 'restart-always' ? 5000 : 10000;
       const connection: IConnectOrStartDaemonOptions = {
         ...options,
         startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
@@ -523,13 +1094,16 @@ describe('detached daemon startup', () => {
           restarts + 1
         );
       } else if (mode === 'restart-always') {
-        // Every successor asks again: bounded retries inside the admission deadline, then a fallback.
+        // Every successor asks again: a limited number of retries inside the admission deadline, then a fallback.
         expect(await pending).toMatchObject({ kind: 'fallback', reason: 'restartRetriesExhausted' });
         const starts: number = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n').length;
         expect(starts).toBeGreaterThanOrEqual(2);
         expect(starts).toBeLessThanOrEqual(7);
         // The deadline may expire after the last successor started but before the request was resubmitted.
-        const requests: number = fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n').length;
+        const requests: number = fs
+          .readFileSync(path.join(folder, 'requests'), 'utf8')
+          .trim()
+          .split('\n').length;
         expect(requests).toBeGreaterThanOrEqual(starts - 1);
         expect(requests).toBeLessThanOrEqual(starts);
       } else {
@@ -541,6 +1115,105 @@ describe('detached daemon startup', () => {
     15000
   );
 
+  it.each([
+    ['restart-once', false],
+    ['restart-installation', true]
+  ])('tells the caller about the restart that it followed for %s', async (mode, reported) => {
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+    };
+    const client = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false }
+    });
+    const notices: IDaemonRestartNotice[] = [];
+    const outcome = await executeWithDaemonRestartAsync(client, connection, {
+      request,
+      onRestartAsync: async (notice) => {
+        // The successor has not received the request yet.
+        expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
+        notices.push(notice);
+      }
+    });
+    expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    const starts: number[] = fs
+      .readFileSync(path.join(folder, 'starts'), 'utf8')
+      .trim()
+      .split('\n')
+      .map(Number);
+    expect(starts).toHaveLength(2);
+    expect(notices).toEqual([
+      {
+        restart: 1,
+        reason: reported
+          ? { kind: 'installationChanged', change: 'removed', folder: path.join(folder, 'gone') }
+          : undefined,
+        successorPid: starts[1]
+      }
+    ]);
+  });
+
+  it.each([
+    ['restart-installation', true],
+    ['restart-once', false]
+  ])(
+    'says why the daemon restarted when the daemon that replaces it does not start, for %s',
+    async (mode, reported) => {
+      const connection: IConnectOrStartDaemonOptions = {
+        ...options,
+        startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+      };
+      const client = await connectOrStartDaemonAsync(connection);
+      const request = captureDaemonRequest({
+        argv: ['test'],
+        commandName: 'test',
+        commandOrigin: 'custom',
+        cwd: folder,
+        environment: {},
+        terminal: { isTTY: false, supportsColor: false }
+      });
+      // The successor's entry point is missing, so it exits before it becomes ready.
+      const failing: IConnectOrStartDaemonOptions = {
+        ...connection,
+        startCommand: { ...connection.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
+      };
+      const notices: IDaemonRestartNotice[] = [];
+      const error: unknown = await executeWithDaemonRestartAsync(client, failing, {
+        request,
+        onRestartAsync: async (notice) => {
+          notices.push(notice);
+        }
+      }).catch((caught: unknown) => caught);
+      expect(notices).toEqual([]);
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect((error as DaemonClientError).code).toBe('startupFailed');
+      expect((error as DaemonClientError).message).toContain(getDaemonLogFilePath(paths));
+      if (reported) {
+        expect(error).toBeInstanceOf(DaemonRestartFailedError);
+        const { cause, message, restartReason } = error as DaemonRestartFailedError;
+        expect(restartReason).toEqual({
+          kind: 'installationChanged',
+          change: 'removed',
+          folder: path.join(folder, 'gone')
+        });
+        // The startup error is the cause, and its message is kept as it is.
+        expect(cause).toBeInstanceOf(DaemonClientError);
+        expect(cause).not.toBeInstanceOf(DaemonRestartFailedError);
+        expect(message).toBe((cause as DaemonClientError).message);
+      } else {
+        expect(error).not.toBeInstanceOf(DaemonRestartFailedError);
+      }
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+      expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
+    }
+  );
+
   it.each(['execution', 'connection'])(
     'cancels successor waiting using the %s signal without replay',
     async (source) => {
@@ -606,6 +1279,44 @@ describe('detached daemon startup', () => {
     expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
   });
 
+  it.each([
+    ['a client-default timeout, which each successor applies afresh', true],
+    ['not an explicit timeout', false]
+  ])('follows a restart that takes longer than %s', async (name, isDefault) => {
+    // The first daemon answers only after the timeout, like one that restarts after a long build.
+    fs.writeFileSync(path.join(folder, 'drain-ms'), '800');
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-once']
+      }
+    };
+    const client = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['build'],
+      commandName: 'build',
+      commandOrigin: 'built-in',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false },
+      admission: isDefault ? { waitTimeoutMs: 300, waitTimeoutIsDefault: true } : { waitTimeoutMs: 300 }
+    });
+    const outcome = await executeWithDaemonRestartAsync(client, connection, { request });
+    const starts: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+    const waits: string[] = fs.readFileSync(path.join(folder, 'waits'), 'utf8').trim().split('\n');
+    if (isDefault) {
+      expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(starts).toHaveLength(2);
+      expect(waits).toEqual(['300', '300']);
+      expect(fs.readFileSync(path.join(folder, 'default-waits'), 'utf8').trim().split('\n')).toHaveLength(2);
+    } else {
+      expect(outcome).toMatchObject({ kind: 'fallback', reason: 'restartRetriesExhausted' });
+      expect(starts).toHaveLength(1);
+      expect(waits).toEqual(['300']);
+    }
+  });
+
   it('refuses restart retry if ownership was not attested before submitting', async () => {
     const connection: IConnectOrStartDaemonOptions = {
       ...options,
@@ -634,6 +1345,147 @@ describe('detached daemon startup', () => {
     }
   });
 
+  describe('when the connection is lost before the result', () => {
+    const exitedMessage = (pid: number, logged: boolean, client: string = 'rush-client'): string =>
+      `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while it ran the command; ` +
+      `"rush-client daemon logs" ${logged ? 'shows' : 'may show'} why. Run the command again; ` +
+      `if the daemon exits again, run the command with "${client} --no-daemon".`;
+
+    function withMode(mode: string): IConnectOrStartDaemonOptions {
+      return {
+        ...options,
+        startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+      };
+    }
+
+    function captureRequest(invocationKind?: 'rushx'): IDaemonRequestEnvelope {
+      return captureDaemonRequest({
+        argv: ['test'],
+        commandName: 'test',
+        commandOrigin: 'custom',
+        cwd: folder,
+        environment: {},
+        terminal: { isTTY: false, supportsColor: false },
+        invocationKind
+      });
+    }
+
+    async function waitForRequestAsync(): Promise<void> {
+      const deadline: number = Date.now() + 5000;
+      while (!fs.existsSync(path.join(folder, 'requests')) && Date.now() < deadline) await delayAsync(20);
+      expect(fs.existsSync(path.join(folder, 'requests'))).toBe(true);
+    }
+
+    it('says that rushd exited and quotes the error it logged, without retrying', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('crash-on-request');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const { pid } = await client.status;
+      const error: unknown = await executeWithDaemonRestartAsync(client, connection, {
+        request: captureRequest()
+      }).catch((failure: unknown) => failure);
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect(error).toMatchObject({
+        code: 'disconnected',
+        message:
+          `${exitedMessage(pid!, true)}\n` +
+          'The daemon log reports: Error: fixture daemon crash while running the request'
+      });
+      expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8')).toBe('fixture\n');
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${pid}\n`);
+    });
+
+    it('ignores log output from before the request and names the rushx client', async () => {
+      const earlierCrash: string = [
+        '/earlier/daemon.js:1',
+        "throw new Error('an earlier crash');",
+        '^',
+        '',
+        'Error: an earlier crash',
+        '    at /earlier/daemon.js:1:7',
+        '',
+        'Node.js v22.0.0',
+        ''
+      ].join('\n');
+      fs.writeFileSync(getDaemonLogFilePath(paths), earlierCrash);
+      const connection: IConnectOrStartDaemonOptions = withMode('kill-on-request');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const { pid } = await client.status;
+      await expect(
+        executeWithDaemonRestartAsync(client, connection, { request: captureRequest('rushx') })
+      ).rejects.toMatchObject({ code: 'disconnected', message: exitedMessage(pid!, false, 'rushx-client') });
+      expect(fs.readFileSync(getDaemonLogFilePath(paths), 'utf8')).toContain(earlierCrash);
+    });
+
+    (process.platform === 'linux' ? it : it.skip)(
+      'reports the operations that rushd left running to onOrphansReaped',
+      async () => {
+        const reaps: IDaemonOrphanReap[] = [];
+        const connection: IConnectOrStartDaemonOptions = {
+          ...withMode('orphan-and-kill-on-request'),
+          onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+        };
+        const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+        const { pid } = await client.status;
+        const operationsPath: string = path.join(folder, 'operations');
+        try {
+          await expect(
+            executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+          ).rejects.toMatchObject({ code: 'disconnected', message: exitedMessage(pid!, false) });
+          expect(isRunning(Number(fs.readFileSync(operationsPath, 'utf8')))).toBe(false);
+          expect(reaps).toEqual([{ daemonPid: pid, processGroupIds: [pid], outcome: 'terminated' }]);
+        } finally {
+          if (fs.existsSync(operationsPath)) {
+            stopOperationIfRunning(Number(fs.readFileSync(operationsPath, 'utf8')));
+          }
+        }
+      }
+    );
+
+    it('says the connection closed while rushd still runs', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('close-on-request');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const { pid } = await client.status;
+      await expect(
+        executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+      ).rejects.toMatchObject({
+        code: 'disconnected',
+        message: `${DAEMON_DISCONNECTED_MESSAGE} The connection to rushd (PID ${pid}) closed, but the daemon is still running; run the command again.`
+      });
+      expect(fs.existsSync(path.join(folder, `stopped-${pid}`))).toBe(false);
+    });
+
+    it('keeps the plain text after the request was cancelled', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('crash-on-cancel');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const abort: AbortController = new AbortController();
+      const pending: Promise<DaemonClientOutcome> = executeWithDaemonRestartAsync(client, connection, {
+        request: captureRequest(),
+        abortSignal: abort.signal
+      });
+      await waitForRequestAsync();
+      abort.abort();
+      await expect(pending).rejects.toMatchObject({
+        code: 'disconnected',
+        message: DAEMON_DISCONNECTED_MESSAGE
+      });
+    });
+
+    it('keeps the aborted result that an orderly shutdown sends', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('hold-until-shutdown');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const pending: Promise<DaemonClientOutcome> = executeWithDaemonRestartAsync(client, connection, {
+        request: captureRequest()
+      });
+      await waitForRequestAsync();
+      const stopping: DaemonClient = await connectOrStartDaemonAsync(connection);
+      await stopping.shutdownAsync();
+      expect(await pending).toMatchObject({
+        kind: 'result',
+        result: { exitCode: 130, outcome: 'aborted', aborted: true }
+      });
+    });
+  });
+
   it('waits through published ownership handoff even without a captured predecessor', async () => {
     const running = await connectOrStartDaemonAsync({
       ...options,
@@ -675,6 +1527,102 @@ describe('detached daemon startup', () => {
     }
   });
 
+  it('lets a restarting daemon start its planned successor while the clients that follow it only connect', async () => {
+    // The old daemon launches only after both clients could have started one, so a race would always be lost.
+    fs.writeFileSync(path.join(folder, 'planned-requests'), '2');
+    fs.writeFileSync(path.join(folder, 'planned-launch-delay-ms'), '1500');
+    const planned: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-planned']
+      }
+    };
+    const clients: DaemonClient[] = [
+      await connectOrStartDaemonAsync(planned),
+      await connectOrStartDaemonAsync(planned)
+    ];
+    const { pid: restartingPid } = await clients[0].status;
+    const outcomes = await Promise.all(
+      clients.map((client, index) =>
+        executeWithDaemonRestartAsync(client, options, {
+          request: captureDaemonRequest({
+            requestId: `follower-${index}`,
+            argv: ['test'],
+            commandName: 'test',
+            commandOrigin: 'custom',
+            cwd: folder,
+            environment: {},
+            terminal: { isTTY: false, supportsColor: false }
+          })
+        })
+      )
+    );
+    await Promise.all(clients.map((client) => client.closeAsync()));
+    expect(outcomes).toMatchObject([
+      { kind: 'result', result: { exitCode: 0 } },
+      { kind: 'result', result: { exitCode: 0 } }
+    ]);
+    // The restarting daemon exits only after it attests the successor it launched.
+    await waitForTestProcessExitAsync(restartingPid!);
+    const identities: string[] = fs.readFileSync(path.join(folder, 'identities'), 'utf8').trim().split('\n');
+    expect(identities.map((line) => line.split(' ')[1])).toEqual(['client', 'planned']);
+    expect(fs.readFileSync(path.join(folder, 'planned-successor'), 'utf8')).toBe(identities[1].split(' ')[0]);
+    expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(4);
+  }, 15000);
+
+  it('connects to the successor that another process starts while the restarting predecessor lives', async () => {
+    const waiting = connectToPlannedSuccessorAsync({
+      ...options,
+      previousDaemon: { pid: process.pid, startedAt: new Date().toISOString() }
+    });
+    await delayAsync(300);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    const starter = await connectOrStartDaemonAsync(options);
+    try {
+      const follower = await waiting;
+      expect((await follower.status).pid).toBe((await starter.status).pid);
+      await follower.closeAsync();
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    } finally {
+      await starter.closeAsync();
+    }
+  });
+
+  it('never starts a daemon while the restarting predecessor lives, even when its deadline expires', async () => {
+    await expect(
+      connectToPlannedSuccessorAsync({
+        ...options,
+        previousDaemon: { pid: process.pid, startedAt: new Date().toISOString() },
+        startupTimeoutMs: 300
+      })
+    ).rejects.toThrow(`timed out waiting for the successor that the previous daemon (PID ${process.pid})`);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  });
+
+  it('starts a daemon once the restarting predecessor exits without a successor', async () => {
+    // The predecessor exits only when its stdin ends, so it provably lives during the first check.
+    const predecessor: ChildProcess = spawn(process.execPath, ['-e', 'process.stdin.resume()'], {
+      stdio: ['pipe', 'ignore', 'ignore']
+    });
+    await once(predecessor, 'spawn');
+    const exited: Promise<unknown[]> = once(predecessor, 'exit');
+    const pending = connectToPlannedSuccessorAsync({
+      ...options,
+      previousDaemon: { pid: predecessor.pid!, startedAt: new Date().toISOString() }
+    });
+    try {
+      await delayAsync(300);
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    } finally {
+      predecessor.stdin!.end();
+    }
+    await exited;
+    const client = await pending;
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+
   it('does not stop a mismatched daemon with unverifiable ownership', async () => {
     const running = await connectOrStartDaemonAsync(options);
     await running.closeAsync();
@@ -728,6 +1676,63 @@ describe('detached daemon startup', () => {
     expect(fs.readFileSync(logFilePath, 'utf8')).toContain('Cannot find module');
   });
 
+  it('tells the daemon it starts which runtime folder its clients look in', async () => {
+    const client = await connectOrStartDaemonAsync(options);
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'runtime-base'), 'utf8')).toBe(path.dirname(folder));
+  });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'reports a linked runtime folder as a startup failure without starting a daemon',
+    async () => {
+      const link: string = `${folder}-link`;
+      fs.symlinkSync(folder, link);
+      try {
+        const failure: Promise<DaemonClient> = connectOrStartDaemonAsync({
+          ...options,
+          paths: {
+            runtimeDir: link,
+            socketPath: path.join(link, 'd.sock'),
+            lockfilePath: path.join(link, 'daemon.pid.json')
+          }
+        });
+        await expect(failure).rejects.toBeInstanceOf(DaemonClientError);
+        await expect(failure).rejects.toMatchObject({ code: 'startupFailed' });
+        await expect(failure).rejects.toThrow(
+          `The daemon runtime folder ${link} is unsafe: it is a symbolic link`
+        );
+        expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+      } finally {
+        fs.unlinkSync(link);
+      }
+    }
+  );
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'reports a socket path too long to connect to as a startup failure without starting a daemon',
+    async () => {
+      // Node cuts a socket path longer than sun_path (108 bytes on Linux, 104 on macOS) short, so no client
+      // could reach a daemon published there.
+      const base: string = path.join(folder, 'r'.repeat(100));
+      const runtimeDir: string = path.join(base, `rushd-${process.getuid?.()}`);
+      const failure: Promise<DaemonClient> = connectOrStartDaemonAsync({
+        ...options,
+        paths: {
+          runtimeDir,
+          socketPath: path.join(runtimeDir, 'd.sock'),
+          lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+        }
+      });
+      await expect(failure).rejects.toBeInstanceOf(DaemonClientError);
+      await expect(failure).rejects.toMatchObject({ code: 'startupFailed' });
+      await expect(failure).rejects.toThrow(
+        /^The daemon socket path .*\/d\.sock is \d+ bytes long, but this platform allows at most 10[48]\. Set RUSHD_RUNTIME_DIR to an absolute path of at most \d+ bytes, or unset it\.$/
+      );
+      expect(fs.existsSync(base)).toBe(false);
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    }
+  );
+
   (process.platform === 'win32' ? it.skip : it)(
     'refuses linked log destinations without changing their target',
     async () => {
@@ -736,7 +1741,10 @@ describe('detached daemon startup', () => {
       fs.writeFileSync(target, 'unchanged', { mode: 0o644 });
       fs.chmodSync(target, 0o644);
       fs.symlinkSync(target, logFilePath);
-      await expect(connectOrStartDaemonAsync(options)).rejects.toMatchObject({ code: 'ELOOP' });
+      await expect(connectOrStartDaemonAsync(options)).rejects.toMatchObject({
+        code: 'startupFailed',
+        cause: { code: 'ELOOP' }
+      });
       fs.unlinkSync(logFilePath);
       fs.linkSync(target, logFilePath);
       await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('regular, unshared file');
@@ -783,10 +1791,12 @@ describe('detached daemon startup', () => {
   it('never reclaims a live PID that may still own the record', async () => {
     const record: string = JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
     fs.writeFileSync(paths.lockfilePath, record);
-    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('or a reused PID');
-    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('daemon stop --force');
+    // The error names that process and says when removing the record is safe.
+    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow(`PID ${process.pid}`);
+    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow(`delete ${paths.lockfilePath}`);
     expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
-    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow(`PID ${process.pid} still owns`);
+    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow(`still owns ${paths.lockfilePath}`);
+    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow('No process was killed.');
     expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
   });
 
@@ -827,6 +1837,41 @@ describe('detached daemon startup', () => {
     }
   );
 
+  (process.platform === 'linux' ? it : it.skip)(
+    'reports the operations that a crashed daemon left running to onOrphansReaped, and logs a recorded group that it leaves running, before a start',
+    async () => {
+      const operationPids: number[] = [];
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      try {
+        const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+        // A start time that its leader does not have, as if a later process had the recorded PID.
+        const other: number = await startDetachedOperationAsync(operationPids);
+        recordOperationGroup(paths.lockfilePath, daemonPid, other, '1');
+        await leaveStaleSocketAsync();
+        recordDaemonOwner(paths, daemonPid);
+        const reaps: IDaemonOrphanReap[] = [];
+        const client: DaemonClient = await connectOrStartDaemonAsync({
+          ...options,
+          onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+        });
+        await client.closeAsync();
+        expect(isRunning(operationPid)).toBe(false);
+        expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+        expect(isRunning(other)).toBe(true);
+        expect(readClientLogTexts(paths)).toEqual([
+          describeGroupLeftRunning(daemonPid, other, 'leaderChanged')
+        ]);
+        expect(warning).not.toHaveBeenCalled();
+        expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+      } finally {
+        warning.mockRestore();
+        operationPids.forEach(stopOperationIfRunning);
+      }
+    }
+  );
+
   (process.platform === 'linux' ? it : it.skip)(
     'reclaims a record whose live PID started after the record was written',
     async () => {
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
new file mode 100644
index 00000000000..6493ee7f84b
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
@@ -0,0 +1,261 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClient } from '../DaemonClient';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { trackPendingDelays, type IPendingDelays } from './PendingDelays';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+/** Times from `performance.now()`. */
+interface IStartupTimeline {
+  /** When each connection attempt by this process began. */
+  readonly attempts: number[];
+  /** How many failed attempts were held open until the startup helper closed. */
+  held: number;
+  /** When the startup helper that this process spawned started. */
+  helperSpawnedAt?: number;
+  /** When the startup helper that this process spawned closed. */
+  helperClosedAt?: number;
+}
+
+/**
+ * Records a startup timeline until `restore` is called. A connection attempt that begins at least
+ * `holdFailedAttemptsAfterMs` after the startup helper spawned, and fails while the helper runs, fails only
+ * once the helper has closed.
+ */
+function recordStartupTimeline(holdFailedAttemptsAfterMs: number = Infinity): {
+  timeline: IStartupTimeline;
+  restore: () => void;
+} {
+  const childProcess = jest.requireActual<typeof import('node:child_process')>('node:child_process');
+  const originalSpawn: typeof spawn = childProcess.spawn;
+  const originalConnectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync;
+  const timeline: IStartupTimeline = { attempts: [], held: 0 };
+  let helperClosed: Promise<void> | undefined;
+  const observer = jest.spyOn(childProcess, 'spawn').mockImplementation((command, args, spawnOptions) => {
+    const child = originalSpawn(command, args, spawnOptions);
+    if (args?.includes(require.resolve('../runDaemonStartup'))) {
+      timeline.helperSpawnedAt = performance.now();
+      // This listener runs before the one that tells the client that the helper closed.
+      helperClosed = new Promise<void>((resolve) =>
+        child.once('close', () => {
+          timeline.helperClosedAt = performance.now();
+          resolve();
+        })
+      );
+    }
+    return child;
+  });
+  const connect = jest.spyOn(DaemonClient, 'connectAsync').mockImplementation(async (connectOptions) => {
+    const startedAt: number = performance.now();
+    timeline.attempts.push(startedAt);
+    try {
+      return await originalConnectAsync.call(DaemonClient, connectOptions);
+    } catch (error) {
+      if (
+        helperClosed &&
+        timeline.helperClosedAt === undefined &&
+        startedAt - timeline.helperSpawnedAt! >= holdFailedAttemptsAfterMs
+      ) {
+        timeline.held++;
+        await helperClosed;
+      }
+      throw error;
+    }
+  });
+  return {
+    timeline,
+    restore: () => {
+      connect.mockRestore();
+      observer.mockRestore();
+    }
+  };
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe('detached daemon startup while the startup helper runs', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-helper-exit-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-helper-exit-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  it.each<{ signalUse: string; abortSignal: AbortSignal | undefined }>([
+    { signalUse: 'without', abortSignal: undefined },
+    { signalUse: 'with', abortSignal: new AbortController().signal }
+  ])(
+    'connects when its startup helper exits, not at the end of a backoff step ($signalUse an abort signal)',
+    async ({ abortSignal }) => {
+      // The daemon listens after a second. This client holds the start mutex, so it drops each connection
+      // until the helper releases the reservation, just before the helper exits. A connection that begins in
+      // between is kept: a backoff step that ended there would connect this client before it sees the helper
+      // close. Here each step of 500 milliseconds or less that begins while the helper runs lasts until it is
+      // aborted, so only the helper's exit can wake this client.
+      fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1000');
+      const { timeline, restore } = recordStartupTimeline();
+      let heldSteps: number = 0;
+      const delays: IPendingDelays = trackPendingDelays({
+        hold: (delayMs) => {
+          const hold: boolean =
+            delayMs !== undefined &&
+            delayMs <= 500 &&
+            timeline.helperSpawnedAt !== undefined &&
+            timeline.helperClosedAt === undefined;
+          if (hold) heldSteps++;
+          return hold;
+        }
+      });
+      try {
+        const client: DaemonClient = await connectOrStartDaemonAsync({ ...options, abortSignal });
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        // A backoff timer left running would keep a client process alive for the rest of its step.
+        expect(delays.pending.size).toBe(0);
+        await client.closeAsync();
+        const { attempts, helperClosedAt } = timeline;
+        expect(heldSteps).toBe(1);
+        expect(helperClosedAt).toBeDefined();
+        const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
+        expect(afterExit).toHaveLength(1);
+        expect(afterExit[0] - helperClosedAt!).toBeLessThan(100);
+      } finally {
+        restore();
+        delays.restore();
+      }
+    }
+  );
+
+  it('retries at once when its startup helper exits during a failed connection attempt', async () => {
+    // The daemon listens after a second. Attempts that fail from 300 milliseconds after the spawn end only
+    // once the helper has closed, so the helper exits while an attempt runs, not while this client sleeps.
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1000');
+    const { timeline, restore } = recordStartupTimeline(300);
+    try {
+      const client: DaemonClient = await connectOrStartDaemonAsync(options);
+      await client.closeAsync();
+      const { attempts, held, helperClosedAt } = timeline;
+      expect(held).toBe(1);
+      expect(helperClosedAt).toBeDefined();
+      const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
+      expect(afterExit).toHaveLength(1);
+      expect(afterExit[0] - helperClosedAt!).toBeLessThan(100);
+    } finally {
+      restore();
+    }
+  });
+
+  it('waits a whole backoff step between attempts once its startup helper has exited', async () => {
+    // The daemon reports another version, so this client never connects, but the helper sees it ready
+    // and exits.
+    const { timeline, restore } = recordStartupTimeline();
+    try {
+      await expect(
+        connectOrStartDaemonAsync({
+          ...options,
+          startupTimeoutMs: 3000,
+          startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'other'] }
+        })
+      ).rejects.toThrow('Daemon startup timed out awaiting hello/ping readiness.');
+      const { attempts, helperClosedAt } = timeline;
+      expect(helperClosedAt).toBeDefined();
+      const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
+      // Only the first attempt after the exit comes early. Each later one waits a whole step, so fewer
+      // than 10 fit in the rest of the deadline.
+      expect(afterExit.length).toBeGreaterThan(1);
+      expect(afterExit.length).toBeLessThan(10);
+    } finally {
+      restore();
+    }
+  }, 15000);
+
+  it('stops at once when aborted while it waits for its startup helper', async () => {
+    // The daemon waits before it listens, so this client sleeps between refused connection attempts.
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const abort: AbortController = new AbortController();
+    const reason: Error = new Error('cancelled while the daemon starts');
+    const { timeline, restore } = recordStartupTimeline();
+    try {
+      const pending: Promise<unknown> = connectOrStartDaemonAsync({
+        ...options,
+        abortSignal: abort.signal
+      }).then(
+        () => new Error('Expected startup to be aborted.'),
+        (rejection: unknown) => rejection
+      );
+      const barrier: string = path.join(folder, 'prebind');
+      const deadline: number = Date.now() + 5000;
+      while (!fs.existsSync(barrier) && Date.now() < deadline) await delayAsync(20);
+      expect(fs.existsSync(barrier)).toBe(true);
+      // Abort 20 milliseconds after an attempt begins: a refused attempt ends at once, and each step lasts 50
+      // milliseconds or more.
+      const attemptCount: number = timeline.attempts.length;
+      while (timeline.attempts.length === attemptCount && Date.now() < deadline) await delayAsync(1);
+      expect(timeline.attempts.length).toBeGreaterThan(attemptCount);
+      await delayAsync(20);
+      abort.abort(reason);
+      const abortedAt: number = performance.now();
+      expect(await pending).toMatchObject({ name: 'AbortError', cause: reason });
+      expect(performance.now() - abortedAt).toBeLessThan(100);
+    } finally {
+      restore();
+    }
+  }, 10000);
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts
new file mode 100644
index 00000000000..18d1374c30d
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts
@@ -0,0 +1,133 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess, type StdioOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Socket } from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+// Where bash puts the pipe of `2> >(…)`, and where a script might open its lock file (`exec 200>lockfile`).
+const PIPE_FD: number = 63;
+const FILE_FD: number = 200;
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(10);
+  }
+}
+
+describe('detached daemon startup from a client that inherited descriptors without close-on-exec', () => {
+  let folder: string;
+  let options: IConnectOrStartDaemonOptions;
+  let starter: { exited: Promise<unknown[]>; pipe: Socket } | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-inherited-'));
+    const paths: IDaemonPaths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+    starter = undefined;
+  });
+
+  afterEach(async () => {
+    if (starter) {
+      await starter.exited;
+      starter.pipe.destroy();
+    }
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  }, 15000);
+
+  linuxIt(
+    'starts a daemon that holds neither a pipe nor a file of the client, so the pipe ends with the client',
+    async () => {
+      const stdio: (string | number)[] = new Array(FILE_FD + 1).fill('ignore');
+      stdio[2] = 'pipe';
+      stdio[PIPE_FD] = 'pipe';
+      const lockFd: number = fs.openSync(path.join(folder, 'lock'), 'w');
+      let child: ChildProcess;
+      try {
+        stdio[FILE_FD] = lockFd;
+        child = spawn(
+          process.execPath,
+          [path.join(__dirname, 'fixtures/starter.js'), JSON.stringify(options)],
+          { stdio: stdio as StdioOptions }
+        );
+      } finally {
+        fs.closeSync(lockFd);
+      }
+      const pipe: Socket = child.stdio[PIPE_FD] as Socket;
+      starter = { exited: once(child, 'exit'), pipe };
+      let pipeEnded: boolean = false;
+      pipe.once('end', () => {
+        pipeEnded = true;
+      });
+      pipe.resume();
+      let stderr: string = '';
+      child.stderr!.on('data', (chunk: Buffer) => {
+        stderr += chunk.toString();
+      });
+      const stderrEnded: Promise<unknown[]> = once(child.stderr!, 'end');
+
+      const [code] = await starter.exited;
+      await stderrEnded;
+      expect({ code, stderr }).toEqual({ code: 0, stderr: '' });
+      const daemonPid: number = Number(fs.readFileSync(path.join(folder, 'starts'), 'utf8'));
+      const daemonFds: string[] = fs.readdirSync(`/proc/${daemonPid}/fd`);
+      expect(daemonFds).toContain('1');
+      expect(daemonFds.filter((fd) => fd === String(PIPE_FD) || fd === String(FILE_FD))).toEqual([]);
+      // Its reader sees end-of-file while the daemon still runs.
+      await waitUntilAsync(() => pipeEnded, 'the pipe ends');
+      expect(fs.existsSync(path.join(folder, `stopped-${daemonPid}`))).toBe(false);
+    },
+    30000
+  );
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts
new file mode 100644
index 00000000000..946d4dc20e5
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts
@@ -0,0 +1,135 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+describe('detached daemon startup and its launcher log', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let startedFilePath: string;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-launcher-log-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    startedFilePath = path.join(folder, 'started');
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      // A daemon that it started would leave this file.
+      startCommand: {
+        command: process.execPath,
+        args: ['-e', "require('node:fs').writeFileSync(process.argv[1], '')", startedFilePath],
+        cwd: folder,
+        environment: {}
+      }
+    };
+  });
+
+  afterEach(async () => {
+    await removeTestFolderAsync(folder);
+  });
+
+  it("quotes this attempt's launcher log lines when the launcher exits before readiness", async () => {
+    const logFilePath: string = getDaemonLogFilePath(paths);
+    fs.writeFileSync(logFilePath, 'Error: left by an earlier startup\n');
+    const failing: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: ['-e', "console.error('Error: the launcher cannot start'); process.exit(2);"]
+      }
+    };
+    await expect(connectOrStartDaemonAsync(failing)).rejects.toMatchObject({
+      code: 'startupFailed',
+      message:
+        `Daemon startup failed: Unable to start ${process.execPath}; startup helper exited (1) before readiness. ` +
+        `Inspect ${logFilePath} and retry, or use --no-daemon.\n` +
+        'Last launcher log lines:\n' +
+        '  Error: the launcher cannot start\n' +
+        '  DaemonClientError: Launcher exited (2) before protocol readiness; startup reservation retained.\n'
+    });
+  });
+
+  // For example, a file that the user put there. A caller then runs Rush in-process and prints the reason, as it
+  // does for a log that opens but is not a regular, unshared file.
+  const unopenableLogs: [string, string, (logFilePath: string) => void][] = [
+    ['a symlink', 'ELOOP', (logFilePath: string) => fs.symlinkSync(`${logFilePath}.target`, logFilePath)],
+    [
+      'a FIFO without a reader',
+      'ENXIO',
+      (logFilePath: string) => expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0)
+    ],
+    ['a directory', 'EISDIR', (logFilePath: string) => fs.mkdirSync(logFilePath)]
+  ];
+  // Root may write to any file.
+  if (process.getuid?.() !== 0) {
+    unopenableLogs.push([
+      'a file that this user may not write to',
+      'EACCES',
+      (logFilePath: string) => fs.writeFileSync(logFilePath, 'unchanged', { mode: 0o444 })
+    ]);
+  }
+  (process.platform === 'win32' ? it.skip : it).each(unopenableLogs)(
+    'reports a launcher log that is %s and cannot be opened (%s), and starts nothing',
+    async (kind: string, code: string, createLog: (logFilePath: string) => void) => {
+      const logFilePath: string = getDaemonLogFilePath(paths);
+      createLog(logFilePath);
+      const entries: string[] = fs.readdirSync(folder);
+      const { ino, mode, size, mtimeMs } = fs.lstatSync(logFilePath);
+      await expect(connectOrStartDaemonAsync(options)).rejects.toMatchObject({
+        code: 'startupFailed',
+        message: `Launcher log cannot be opened for writing (${code}): ${logFilePath}`,
+        cause: expect.objectContaining({ code })
+      });
+      // No helper, reservation, symlink target or lock file was left behind, and the log is as it was.
+      expect(fs.readdirSync(folder)).toEqual(entries);
+      expect(fs.lstatSync(logFilePath)).toMatchObject({ ino, mode, size, mtimeMs });
+    }
+  );
+
+  // For example, Rush that runs in-process after the client refused a log that is a FIFO, which another process
+  // reads. Jest resolves modules itself, so a Node process of its own makes the call.
+  (process.platform === 'win32' ? it.skip : it)(
+    'leaves require() resolving symlinks after it refused a launcher log that is a FIFO',
+    () => {
+      const logFilePath: string = getDaemonLogFilePath(paths);
+      expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0);
+      const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+        folder,
+        [
+          'const [modulePath, optionsJson, logFilePath] = args;',
+          "const fs = require('node:fs');",
+          '// With a reader, the client can open the FIFO for writing.',
+          'fs.openSync(logFilePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);',
+          'const { connectOrStartDaemonAsync } = require(modulePath);',
+          'await connectOrStartDaemonAsync(JSON.parse(optionsJson)).catch((error) => {',
+          '  process.stdout.write(`${error.message}\\n`);',
+          '});'
+        ].join('\n'),
+        [require.resolve('../connectOrStartDaemon'), JSON.stringify(options), logFilePath]
+      );
+      expect(result).toEqual({
+        status: 0,
+        stdout: `Launcher log must be a regular, unshared file: ${logFilePath}\nfound`,
+        stderr: ''
+      });
+      expect(fs.existsSync(startedFilePath)).toBe(false);
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
new file mode 100644
index 00000000000..ae017ea368f
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
@@ -0,0 +1,467 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClientError } from '../DaemonClientError';
+import { LiveDaemonOwnerError } from '../DaemonOwnerDiagnosis';
+import { describeLiveDaemonOwner, resetDaemonArtifactsAsync } from '../DaemonOwnership';
+import { DaemonStartupPendingError, connectOrAwaitDaemonStartupAsync } from '../connectOrAwaitDaemonStartup';
+import type { IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { STOPPED_OWNER_WINDOW_MS, isDaemonOwnerStoppedAsync } from '../StoppedDaemonOwner';
+import { recordDaemonOwner } from './OrphanedOperation';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+const NOT_RUN_IN_PROCESS: string =
+  'Rush was not run in-process, where it would compete with that daemon for the repository.';
+
+/** Listens as rushd does, with the paths in its last argument, and never answers. */
+const FAKE_DAEMON_SCRIPT: string = [
+  'const [transport, protocol, paths] = process.argv.slice(2);',
+  'require(transport)',
+  '  .DaemonFrameListener.listenAsync(JSON.parse(paths), {',
+  '    protocolVersion: require(protocol).DAEMON_PROTOCOL_VERSION,',
+  '    onConnection: () => undefined',
+  '  })',
+  "  .then(() => console.log('listening'));",
+  ''
+].join('\n');
+
+async function rejectionOf(promise: Promise<unknown>): Promise<Error> {
+  return await promise.then(
+    () => new Error('Expected a rejection.'),
+    (error: Error) => error
+  );
+}
+
+function readState(pid: number): string | undefined {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  return stat.slice(stat.lastIndexOf(')') + 2)[0];
+}
+
+/** Field 22 of `/proc/<pid>/stat`: when the process started, in clock ticks after boot. */
+function readStartTicks(pid: number): number {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  return Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19]);
+}
+
+async function waitForStateAsync(pid: number, code: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (readState(pid) !== code) {
+    if (Date.now() >= deadline) throw new Error(`PID ${pid} did not reach state ${code}.`);
+    await delayAsync(10);
+  }
+}
+
+async function waitForFileAsync(filePath: string): Promise<void> {
+  const deadline: number = Date.now() + 10000;
+  while (!fs.existsSync(filePath)) {
+    if (Date.now() >= deadline) throw new Error(`${filePath} was not written.`);
+    await delayAsync(10);
+  }
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Unlinks the sockets that killed daemons left in `folder`, without a stat: after a plain stat of a socket, which
+ * removing the folder would make, the next `require()` in this process could fail to find a package's dependencies
+ * (nodejs/node#65113).
+ */
+function unlinkSockets(folder: string): void {
+  for (const entry of fs.readdirSync(folder, { withFileTypes: true })) {
+    if (entry.isSocket()) fs.unlinkSync(path.join(folder, entry.name));
+  }
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit. It needs
+// /proc to tell what the live owner is doing.
+(process.platform === 'linux' ? describe : describe.skip)('a live daemon owner that does not answer', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+  let children: ChildProcess[];
+
+  beforeEach(() => {
+    children = [];
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-live-owner-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 1500,
+      timeoutMs: 200,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    for (const child of children) {
+      if (child.exitCode !== null || child.signalCode !== null) continue;
+      // Only this test's own children, by their PIDs: resume a stopped one so that it can exit.
+      process.kill(child.pid!, 'SIGCONT');
+      child.kill('SIGKILL');
+      await waitForTestProcessExitAsync(child.pid!);
+    }
+    // No daemon was started or replaced.
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    unlinkSockets(folder);
+    await removeTestFolderAsync(folder);
+  });
+
+  /**
+   * A process whose command line looks like rushd's, which listens as rushd does with `daemonPaths` (by default
+   * this workspace's), but never answers: it binds its socket under a private name, links the endpoint to it,
+   * then writes its ownership record and keeps it open. Its listen backlog accepts connections even while a
+   * signal stops it.
+   */
+  async function startFakeDaemonAsync(daemonPaths: IDaemonPaths = paths): Promise<number> {
+    const script: string = path.join(folder, 'rush-daemon', 'fake.js');
+    fs.mkdirSync(path.dirname(script), { recursive: true });
+    fs.writeFileSync(script, FAKE_DAEMON_SCRIPT);
+    const child: ChildProcess = await startChildAsync(process.execPath, [
+      script,
+      require.resolve('@rushstack/rush-daemon-transport'),
+      require.resolve('@rushstack/rush-daemon-protocol'),
+      JSON.stringify(daemonPaths)
+    ]);
+    await once(child.stdout!, 'data');
+    return child.pid!;
+  }
+
+  /** The paths of another workspace's daemon, in the same runtime folder. */
+  function getOtherWorkspacePaths(): IDaemonPaths {
+    return {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'other.sock'),
+      lockfilePath: path.join(folder, 'other.pid.json')
+    };
+  }
+
+  async function startChildAsync(command: string, args: string[]): Promise<ChildProcess> {
+    const child: ChildProcess = spawn(command, args, { stdio: ['ignore', 'pipe', 'ignore'] });
+    children.push(child);
+    await once(child, 'spawn');
+    return child;
+  }
+
+  async function stopChildAsync(pid: number): Promise<void> {
+    process.kill(pid, 'SIGSTOP');
+    await waitForStateAsync(pid, 'T');
+  }
+
+  function resumeHint(pid: number): string {
+    return `Resume it with "kill -CONT ${pid}"; it then serves the next command.`;
+  }
+
+  it('says that a signal stopped the daemon and how to resume it, without running Rush in-process', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+    const onAwaitStartup: jest.Mock = jest.fn();
+
+    // A deadline shorter than the 1.5 s for which a client samples a stopped daemon leaves no time to sample
+    // it, so this waits for two such deadlines, as a client did before it sampled.
+    const error: Error = await rejectionOf(
+      connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 1000, onAwaitStartup })
+    );
+
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error).not.toBeInstanceOf(DaemonClientError);
+    expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
+      )
+    );
+    expect(error.message.split('\n')[2]).toBe(resumeHint(pid));
+    expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toBeUndefined();
+    expect(onAwaitStartup.mock.calls).toEqual([
+      [`A process listens at ${paths.socketPath} but was not ready in time`, expect.any(Number)]
+    ]);
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  it('stops waiting for a daemon that stays stopped, without running Rush in-process', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const start: number = Date.now();
+
+    const error: Error = await rejectionOf(
+      connectOrAwaitDaemonStartupAsync({
+        ...options,
+        startupTimeoutMs: 15000,
+        timeoutMs: 2000,
+        onAwaitStartup
+      })
+    );
+
+    // The first connection attempt times out after 2 s, and the 1.5 s for which the client samples the daemon
+    // overlap it. Sampling after that attempt would take about 3.5 s; not sampling, two 15 s deadlines.
+    const elapsedMs: number = Date.now() - start;
+    expect(elapsedMs).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS);
+    expect(elapsedMs).toBeLessThan(3000);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
+    expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toEqual({
+      pid,
+      startTicks: readStartTicks(pid)
+    });
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n${escapeRegExp(resumeHint(pid))}$`
+      )
+    );
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  it('stops waiting once a signal stops the daemon that it waits for', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const start: number = Date.now();
+
+    const rejected: Promise<Error> = rejectionOf(
+      connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 10000, onAwaitStartup })
+    );
+    await delayAsync(500);
+    await stopChildAsync(pid);
+    const error: Error = await rejected;
+
+    // Well before its first 10 s deadline.
+    expect(Date.now() - start).toBeLessThan(7000);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toEqual({
+      pid,
+      startTicks: readStartTicks(pid)
+    });
+    expect(error.message.split('\n')[2]).toBe(resumeHint(pid));
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+  }, 30000);
+
+  it('keeps waiting for another client that holds the start mutex while the owner stays stopped', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+    // The daemon still runs, with its record open, but nothing listens at the endpoint.
+    fs.unlinkSync(paths.socketPath);
+    await startChildAsync(process.execPath, [
+      path.join(__dirname, 'fixtures/startLockHolder.js'),
+      JSON.stringify(paths)
+    ]);
+    await waitForFileAsync(path.join(folder, 'lock-held'));
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const start: number = Date.now();
+
+    const error: Error = await rejectionOf(
+      connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 3000, onAwaitStartup })
+    );
+
+    // Only a stopped owner at the endpoint ends the wait early: that client may still start a daemon.
+    expect(Date.now() - start).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS + 2500);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error.message).toContain(
+      'Another client is still starting the daemon, so Rush was not run in-process'
+    );
+    expect(onAwaitStartup.mock.calls).toEqual([
+      ['Another client is still starting the daemon', expect.any(Number)]
+    ]);
+    fs.writeFileSync(path.join(folder, 'release-lock'), '');
+  }, 30000);
+
+  it('keeps waiting while the stopped process that the record names does not have the record open', async () => {
+    // This process listens at the endpoint without answering. The process that this workspace's record names,
+    // stopped, is another workspace's daemon, which has only its own record open.
+    const server: net.Server = net.createServer((socket: net.Socket) => socket.on('error', () => undefined));
+    server.listen(paths.socketPath);
+    await once(server, 'listening');
+    try {
+      const pid: number = await startFakeDaemonAsync(getOtherWorkspacePaths());
+      await stopChildAsync(pid);
+      recordDaemonOwner(paths, pid);
+      const onAwaitStartup: jest.Mock = jest.fn();
+
+      const error: Error = await rejectionOf(
+        connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 3000, onAwaitStartup })
+      );
+
+      expect(error).toBeInstanceOf(DaemonStartupPendingError);
+      expect(error.message).toMatch(
+        new RegExp(
+          `^The daemon did not answer at ${escapeRegExp(paths.socketPath)}, and its ownership record names rushd \\(PID ${pid}\\): it is stopped \\(state T\\)`
+        )
+      );
+      expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toBeUndefined();
+      expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+    } finally {
+      server.close();
+    }
+  }, 30000);
+
+  it('does not run Rush in-process beside a daemon that lost its socket', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    // The daemon still runs, with its record open, but no client can reach it.
+    fs.unlinkSync(paths.socketPath);
+    const onAwaitStartup: jest.Mock = jest.fn();
+
+    const error: Error = await rejectionOf(connectOrAwaitDaemonStartupAsync({ ...options, onAwaitStartup }));
+
+    // Nothing can make the daemon ready, but it still runs, so the caller must not run Rush in-process.
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started \\d+ s ago\\.\\n${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
+      )
+    );
+    expect(error.message.split('\n')[2]).toBe(
+      `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
+    );
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+    expect(readDaemonRecordPid()).toBe(pid);
+  }, 30000);
+
+  it("names no signal to send to a daemon that does not have this workspace's record open", async () => {
+    // For example the daemon of another workspace, whose PID an old record of this workspace names: it has only its
+    // own record open. Nothing shows that it is this workspace's daemon, so the caller may run Rush in-process.
+    const pid: number = await startFakeDaemonAsync(getOtherWorkspacePaths());
+    await stopChildAsync(pid);
+    recordDaemonOwner(paths, pid);
+
+    const error: Error = await rejectionOf(connectOrAwaitDaemonStartupAsync(options));
+
+    expect(error).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon did not answer at ${escapeRegExp(paths.socketPath)}, and its ownership record names rushd \\(PID ${pid}\\): its socket is missing, so no client can reach it; it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
+    );
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  it('names the parent that has not reaped an owner that exited', async () => {
+    // "sleep 0" exits at once, and the shell, now "sleep 600", never reaps it.
+    const parent: ChildProcess = await startChildAsync('sh', ['-c', 'sleep 0 & echo $!; exec sleep 600']);
+    const [output] = await once(parent.stdout!, 'data');
+    const zombie: number = Number(String(output));
+    await waitForStateAsync(zombie, 'Z');
+    recordDaemonOwner(paths, zombie);
+
+    const error: Error = await rejectionOf(connectOrAwaitDaemonStartupAsync(options));
+
+    expect(error).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon did not answer at ${escapeRegExp(paths.socketPath)}, and its ownership record names PID ${zombie}: its socket is missing, so no client can reach it; it has exited, but its parent process \\(PID ${parent.pid}\\) has not reaped it \\(state Z\\), and it started \\d+ s ago\\.\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `The next command reclaims its files once PID ${parent.pid} reaps it. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
+    );
+
+    // Once that parent is gone, another process reaps it, and it no longer owns anything.
+    const exited: Promise<unknown> = once(parent, 'exit');
+    parent.kill('SIGKILL');
+    await exited;
+    const deadline: number = Date.now() + 5000;
+    while (fs.existsSync(`/proc/${zombie}`)) {
+      if (Date.now() >= deadline) throw new Error(`PID ${zombie} was not reaped.`);
+      await delayAsync(10);
+    }
+    expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
+  }, 30000);
+
+  it('names a process that is not a daemon when a reset refuses to remove its record', async () => {
+    const pid: number = (await startChildAsync('sleep', ['600'])).pid!;
+    // Just after the spawn event, sleep can still be starting: running, and without its command line yet.
+    await waitForStateAsync(pid, 'S');
+    recordDaemonOwner(paths, pid);
+
+    const error: Error = await rejectionOf(resetDaemonArtifactsAsync(paths));
+
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^PID ${pid} \\("sleep 600"\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is waiting \\(state S\\), and it started \\d+ s ago\\. No process was killed\\.\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${paths.lockfilePath}; the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
+    );
+    expect(readDaemonRecordPid()).toBe(pid);
+    expect(readState(pid)).toBe('S');
+  });
+
+  it('describes the live owner for a command that could not stop the daemon', async () => {
+    expect(describeLiveDaemonOwner(paths, 'stop')).toBeUndefined();
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+
+    expect(describeLiveDaemonOwner(paths, 'stop')).toMatch(
+      new RegExp(
+        `^rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\nResume it with "kill -CONT ${pid}", then run "rush-client daemon stop" again\\.$`
+      )
+    );
+
+    // Nothing to describe once that process is gone (and reaped), or when the record cannot be read.
+    const child: ChildProcess = children[0];
+    const exited: Promise<unknown> = once(child, 'exit');
+    process.kill(pid, 'SIGCONT');
+    child.kill('SIGKILL');
+    await exited;
+    expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
+    fs.writeFileSync(paths.lockfilePath, 'not json');
+    expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
+  });
+
+  it('tells a command that waits for the daemon to exit whether the daemon stays stopped', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    let start: number = Date.now();
+
+    // The first sample ends the sampling for a daemon that is not stopped.
+    expect(await isDaemonOwnerStoppedAsync(paths, start + 15000)).toBe(false);
+    expect(Date.now() - start).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+
+    await stopChildAsync(pid);
+    start = Date.now();
+    expect(await isDaemonOwnerStoppedAsync(paths, start + 15000)).toBe(true);
+    expect(Date.now() - start).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS);
+    // Too little time before the deadline to sample it.
+    expect(await isDaemonOwnerStoppedAsync(paths, Date.now() + STOPPED_OWNER_WINDOW_MS - 100)).toBe(false);
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  function readDaemonRecordPid(): number {
+    return JSON.parse(fs.readFileSync(paths.lockfilePath, 'utf8')).pid;
+  }
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts
new file mode 100644
index 00000000000..a8bbbb9c229
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts
@@ -0,0 +1,266 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClient } from '../DaemonClient';
+import { getDaemonStartupFilePath, reserveDaemonStartup } from '../DaemonStartup';
+import * as StartupLock from '../StartupLock';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { trackPendingDelays, type IPendingDelays } from './PendingDelays';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+interface IFixture {
+  readonly child: ChildProcess;
+  /** The exit code is undefined when the process was killed by a signal. */
+  readonly result: Promise<{ code: number | undefined; stdout: string; stderr: string }>;
+}
+
+describe('detached daemon startup while another client starts the daemon', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+  let children: ChildProcess[];
+  let holder: IFixture;
+  /** Stops this client waiting when a test ends early. */
+  let abort: AbortController;
+  /** When each connection attempt by this process began, from `performance.now()`. */
+  let attempts: number[];
+  let connectSpy: jest.SpyInstance;
+
+  function run(fixture: string, args: string[]): IFixture {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [path.join(__dirname, 'fixtures', fixture), ...args],
+      {
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
+    );
+    children.push(child);
+    let stdout: string = '';
+    let stderr: string = '';
+    child.stdout!.on('data', (chunk: Buffer) => {
+      stdout += chunk.toString();
+    });
+    child.stderr!.on('data', (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+    return {
+      child,
+      result: once(child, 'close').then(([code]) => ({ code: code ?? undefined, stdout, stderr }))
+    };
+  }
+
+  async function waitUntilAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = Date.now() + 10000;
+    while (!condition() && Date.now() < deadline) await delayAsync(5);
+    expect(condition()).toBe(true);
+  }
+
+  /** Reserves startup like the helper of the client that holds the start mutex. */
+  function reserveStartup(): void {
+    reserveDaemonStartup(paths, { pid: holder.child.pid!, startedAt: new Date().toISOString() });
+  }
+
+  function releaseStartup(): number {
+    fs.unlinkSync(getDaemonStartupFilePath(paths));
+    return performance.now();
+  }
+
+  /**
+   * Starts a fixture daemon, which listens after 250 milliseconds (or the number in the "startup-delay-ms" file),
+   * and not before the "hold-prebind" file is removed if it exists. No startup helper waits for it.
+   */
+  function startDaemon(): void {
+    run('daemon.js', [JSON.stringify(paths)]);
+  }
+
+  /**
+   * Waits until this client has begun its fifth connection attempt and 100 milliseconds more. Its backoff steps
+   * last 50, 100, 200 and 400 milliseconds, so it is then 100 milliseconds into a step of 500.
+   */
+  async function waitIntoLongStepAsync(): Promise<void> {
+    await waitUntilAsync(() => attempts.length >= 5);
+    await delayAsync(100);
+  }
+
+  beforeEach(async () => {
+    children = [];
+    attempts = [];
+    abort = new AbortController();
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-waiter-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-waiter-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      abortSignal: abort.signal,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+    const originalConnectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync;
+    connectSpy = jest.spyOn(DaemonClient, 'connectAsync').mockImplementation(async (connectOptions) => {
+      attempts.push(performance.now());
+      return await originalConnectAsync.call(DaemonClient, connectOptions);
+    });
+    // Another client holds the start mutex, so this one never starts a daemon.
+    holder = run('startLockHolder.js', [JSON.stringify(paths)]);
+    await waitUntilAsync(() => fs.existsSync(path.join(folder, 'lock-held')));
+  });
+
+  afterEach(async () => {
+    abort.abort();
+    connectSpy.mockRestore();
+    fs.writeFileSync(path.join(folder, 'release-lock'), '');
+    expect(await holder.result).toEqual({ code: 0, stdout: '', stderr: '' });
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await Promise.all(
+      children.map((child) =>
+        child.exitCode === null && child.signalCode === null ? once(child, 'close') : undefined
+      )
+    );
+    // A fixture daemon that fails a check records it here.
+    const failuresPath: string = path.join(folder, 'failures');
+    expect(fs.existsSync(failuresPath) ? fs.readFileSync(failuresPath, 'utf8') : '').toBe('');
+    await removeTestFolderAsync(folder);
+  });
+
+  it('connects as soon as the startup reservation is released, not at the end of a backoff step', async () => {
+    // The daemon is ready, but this client drops each connection while the reservation remains.
+    reserveStartup();
+    startDaemon();
+    await waitUntilAsync(() => fs.existsSync(paths.lockfilePath));
+    const delays: IPendingDelays = trackPendingDelays();
+    try {
+      const connecting: Promise<DaemonClient> = connectOrStartDaemonAsync(options);
+      await waitIntoLongStepAsync();
+      // Checking for the reservation does not connect: attempts still follow the backoff steps.
+      expect(attempts.length).toBeLessThanOrEqual(6);
+      const releasedAt: number = releaseStartup();
+      const client: DaemonClient = await connecting;
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      // A timer left running would keep a client process alive for the rest of its step.
+      expect(delays.pending.size).toBe(0);
+      await client.closeAsync();
+      const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt);
+      expect(afterRelease).toHaveLength(1);
+      expect(afterRelease[0] - releasedAt).toBeLessThan(100);
+    } finally {
+      delays.restore();
+    }
+  });
+
+  it('retries at once when the startup reservation is released between two waits', async () => {
+    // The reservation is released while this client tries the start mutex for a connection that it then drops,
+    // before its next wait begins.
+    reserveStartup();
+    startDaemon();
+    await waitUntilAsync(() => fs.existsSync(paths.lockfilePath));
+    const tryAcquireStartupLockAsync: typeof StartupLock.tryAcquireStartupLockAsync =
+      StartupLock.tryAcquireStartupLockAsync;
+    let releasedAt: number | undefined;
+    const lockSpy: jest.SpyInstance = jest
+      .spyOn(StartupLock, 'tryAcquireStartupLockAsync')
+      .mockImplementation(async (lockPaths: IDaemonPaths) => {
+        const lock: StartupLock.IStartupLock | undefined = await tryAcquireStartupLockAsync(lockPaths);
+        if (releasedAt === undefined && attempts.length >= 5) releasedAt = releaseStartup();
+        return lock;
+      });
+    try {
+      const client: DaemonClient = await connectOrStartDaemonAsync(options);
+      await client.closeAsync();
+    } finally {
+      lockSpy.mockRestore();
+    }
+    expect(releasedAt).toBeDefined();
+    const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt!);
+    expect(afterRelease).toHaveLength(1);
+    expect(afterRelease[0] - releasedAt!).toBeLessThan(100);
+  });
+
+  it('connects as soon as a startup reservation that appeared during a backoff step is released', async () => {
+    // Nothing listens and nothing is reserved when this client's step of 500 milliseconds begins.
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '0');
+    startDaemon();
+    await waitUntilAsync(() => fs.existsSync(path.join(folder, 'prebind')));
+    const connecting: Promise<DaemonClient> = connectOrStartDaemonAsync(options);
+    await waitUntilAsync(() => attempts.length >= 5);
+    await delayAsync(50);
+    reserveStartup();
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    await waitUntilAsync(() => fs.existsSync(paths.lockfilePath));
+    // This client checks every 25 milliseconds, so it has seen the reservation.
+    await delayAsync(60);
+    const releasedAt: number = releaseStartup();
+    const client: DaemonClient = await connecting;
+    await client.closeAsync();
+    const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt);
+    expect(afterRelease).toHaveLength(1);
+    expect(afterRelease[0] - releasedAt).toBeLessThan(100);
+  });
+
+  it('waits whole backoff steps after the startup reservation is released without a ready daemon', async () => {
+    reserveStartup();
+    const pending: Promise<unknown> = connectOrStartDaemonAsync(options).then(
+      () => new Error('Expected startup to be aborted.'),
+      (rejection: unknown) => rejection
+    );
+    await waitIntoLongStepAsync();
+    const releasedAt: number = releaseStartup();
+    await delayAsync(1000);
+    abort.abort();
+    expect(await pending).toMatchObject({ name: 'AbortError' });
+    const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt);
+    // One attempt at once, which nothing answers, and then one for each step of 500 milliseconds.
+    expect(afterRelease.length).toBeGreaterThanOrEqual(1);
+    expect(afterRelease[0] - releasedAt).toBeLessThan(100);
+    expect(afterRelease.length).toBeLessThanOrEqual(3);
+  });
+
+  it('stops at once when aborted while the startup reservation remains', async () => {
+    reserveStartup();
+    const reason: Error = new Error('cancelled while another client starts the daemon');
+    const pending: Promise<unknown> = connectOrStartDaemonAsync(options).then(
+      () => new Error('Expected startup to be aborted.'),
+      (rejection: unknown) => rejection
+    );
+    await waitIntoLongStepAsync();
+    abort.abort(reason);
+    const abortedAt: number = performance.now();
+    expect(await pending).toMatchObject({ name: 'AbortError', cause: reason });
+    expect(performance.now() - abortedAt).toBeLessThan(100);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
new file mode 100644
index 00000000000..eebdc4849d5
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
@@ -0,0 +1,137 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  readDaemonLockfile,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient } from '../DaemonClient';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import {
+  describeGroupLeftRunning,
+  isRunning,
+  readClientLogTexts,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe('detached daemon startup after a daemon whose PID a later process has', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-reused-owner-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-reused-owner-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  async function leaveStaleSocketAsync(): Promise<void> {
+    // A listener killed without cleanup leaves a bound-nowhere socket file behind.
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [
+        '-e',
+        `require('net').createServer().listen(${JSON.stringify(paths.socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+      ],
+      { stdio: 'ignore' }
+    );
+    await once(child, 'close');
+  }
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations of a record whose live PID a later process has, but never that process, before a start',
+    async () => {
+      const operationPids: number[] = [];
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      try {
+        // Each leads a process group and session of its own, as an operation does.
+        const unrelated: number = await startDetachedOperationAsync(operationPids);
+        const recorded: number = await startDetachedOperationAsync(operationPids);
+        await leaveStaleSocketAsync();
+        recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+        recordOperationGroup(paths.lockfilePath, unrelated, unrelated, readProcessStartTime(unrelated));
+        recordOperationGroup(paths.lockfilePath, unrelated, recorded, readProcessStartTime(recorded));
+        const reaps: IDaemonOrphanReap[] = [];
+        const client: DaemonClient = await connectOrStartDaemonAsync({
+          ...options,
+          onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+        });
+        await client.closeAsync();
+        expect(isRunning(recorded)).toBe(false);
+        expect(isRunning(unrelated)).toBe(true);
+        expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+        expect(readClientLogTexts(paths)).toEqual([
+          describeGroupLeftRunning(unrelated, unrelated, 'daemonPidInUse')
+        ]);
+        expect(warning).not.toHaveBeenCalled();
+        expect(readDaemonLockfile(paths.lockfilePath)?.pid).not.toBe(unrelated);
+        expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
+      } finally {
+        warning.mockRestore();
+        operationPids.forEach(stopOperationIfRunning);
+      }
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts b/libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts
new file mode 100644
index 00000000000..10dad54b939
--- /dev/null
+++ b/libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DaemonClientError } from '../../DaemonClientError';
+import type { IConnectOrStartDaemonOptions } from '../../connectOrStartDaemon';
+import {
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync
+} from '../../connectOrAwaitDaemonStartup';
+
+/**
+ * Prints one JSON line: whether the client connected, may run Rush in-process, or must fail, and every
+ * onAwaitStartup call. Given a folder as the second argument, it first appends its PID to "clients" there and
+ * waits for a "go" file, and it appends its PID to "notices" there on each onAwaitStartup call.
+ */
+async function mainAsync(): Promise<void> {
+  const options: IConnectOrStartDaemonOptions = JSON.parse(process.argv[2]);
+  const signalFolder: string | undefined = process.argv[3];
+  if (signalFolder) {
+    fs.appendFileSync(path.join(signalFolder, 'clients'), `${process.pid}\n`);
+    while (!fs.existsSync(path.join(signalFolder, 'go'))) await delayAsync(10);
+  }
+  const startedAt: number = Date.now();
+  const notices: { owner: string; waitMs: number }[] = [];
+  try {
+    const client = await connectOrAwaitDaemonStartupAsync({
+      ...options,
+      onAwaitStartup: (owner: string, waitMs: number) => {
+        notices.push({ owner, waitMs });
+        if (signalFolder) fs.appendFileSync(path.join(signalFolder, 'notices'), `${process.pid}\n`);
+      }
+    });
+    const elapsedMs: number = Date.now() - startedAt;
+    const { pid } = await client.status;
+    await client.closeAsync();
+    process.stdout.write(`${JSON.stringify({ kind: 'connected', pid, elapsedMs, notices })}\n`);
+  } catch (error) {
+    const kind: string =
+      error instanceof DaemonStartupPendingError
+        ? 'pending'
+        : error instanceof DaemonClientError
+          ? 'fallback'
+          : 'error';
+    const elapsedMs: number = Date.now() - startedAt;
+    process.stdout.write(
+      `${JSON.stringify({ kind, message: (error as Error).message, elapsedMs, notices })}\n`
+    );
+  }
+}
+
+mainAsync().catch((error: Error) => {
+  process.stderr.write(`${error.stack}\n`);
+  process.exitCode = 1;
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index e03e1cc12eb..c99b5ab9e44 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
@@ -8,7 +9,8 @@ import {
   DAEMON_PROTOCOL_VERSION,
   DaemonFrameType,
   decodeDaemonControlMessage,
-  encodeDaemonControlMessage
+  encodeDaemonControlMessage,
+  type DaemonControlMessage
 } from '@rushstack/rush-daemon-protocol';
 import {
   DaemonFrameListener,
@@ -16,22 +18,36 @@ import {
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import { connectOrStartDaemonAsync } from '../../connectOrStartDaemon';
+import { getDaemonStartupFilePath, reserveDaemonStartup } from '../../DaemonStartup';
+import { OPERATION_SCRIPT } from '../OrphanedOperation';
+
 async function mainAsync(): Promise<void> {
   const paths: IDaemonPaths = JSON.parse(process.argv[2]);
   const folder: string = path.dirname(paths.lockfilePath);
   const daemonVersion: string = process.argv[3] ?? 'fixture';
-  const restartMode: string | undefined = process.argv[4];
+  const mode: string | undefined = process.argv[4];
+  const restartMode: string | undefined = mode?.startsWith('restart-') ? mode : undefined;
+  // While this file exists, the daemon waits before it listens. It writes its PID to the file named without "hold-".
+  const holdPrebindName: string = process.env.FIXTURE_HOLD_PREBIND ?? 'hold-prebind';
   const connections: Set<DaemonFrameConnection> = new Set();
   let closing: Promise<void> | undefined;
+  let heldRequest: { connection: DaemonFrameConnection; requestId: string } | undefined;
+  let plannedRestartAnswers: number = 0;
   fs.appendFileSync(path.join(folder, 'starts'), `${process.pid}\n`);
+  fs.appendFileSync(
+    path.join(folder, 'identities'),
+    `${process.pid} ${process.env.FIXTURE_IDENTITY ?? 'client'}\n`
+  );
   fs.appendFileSync(path.join(folder, 'parents'), `${process.ppid}\n`);
+  fs.writeFileSync(path.join(folder, 'runtime-base'), process.env.RUSHD_RUNTIME_DIR ?? '(unset)');
   process.stdout.write('launcher stdout\n');
   process.stderr.write('launcher stderr\n');
-  if (fs.existsSync(path.join(folder, 'hold-prebind'))) {
+  if (fs.existsSync(path.join(folder, holdPrebindName))) {
     const marker: string = path.join(folder, `prebind-${process.pid}.tmp`);
     fs.writeFileSync(marker, String(process.pid));
-    fs.renameSync(marker, path.join(folder, 'prebind'));
-    while (fs.existsSync(path.join(folder, 'hold-prebind'))) {
+    fs.renameSync(marker, path.join(folder, holdPrebindName.replace(/^hold-/, '')));
+    while (fs.existsSync(path.join(folder, holdPrebindName))) {
       if (fs.existsSync(path.join(folder, 'stop'))) {
         fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
         return;
@@ -39,7 +55,7 @@ async function mainAsync(): Promise<void> {
       await new Promise((resolve) => setTimeout(resolve, 20));
     }
   }
-  await new Promise((resolve) => setTimeout(resolve, 250));
+  await new Promise((resolve) => setTimeout(resolve, readStartupDelayMs(folder)));
   const listener = await DaemonFrameListener.listenAsync(paths, {
     protocolVersion: DAEMON_PROTOCOL_VERSION,
     onConnection: (connection) => {
@@ -65,16 +81,72 @@ async function mainAsync(): Promise<void> {
           });
         } else if (message.kind === 'requestStart') {
           fs.appendFileSync(path.join(folder, 'requests'), `${daemonVersion}\n`);
+          if (mode === 'orphan-and-kill-on-request') startOperation();
+          if (
+            mode === 'crash-on-request' ||
+            mode === 'kill-on-request' ||
+            mode === 'orphan-and-kill-on-request'
+          ) {
+            exitAbruptly();
+            return;
+          }
+          if (mode === 'close-on-request') {
+            await connection.closeAsync();
+            return;
+          }
+          if (mode === 'hold-until-shutdown' || mode === 'crash-on-cancel') {
+            heldRequest = { connection, requestId: message.payload.requestId };
+            return;
+          }
           if (message.payload.admission?.waitTimeoutMs !== undefined) {
             fs.appendFileSync(path.join(folder, 'waits'), `${message.payload.admission.waitTimeoutMs}\n`);
           }
+          if (message.payload.admission?.waitTimeoutIsDefault) {
+            fs.appendFileSync(
+              path.join(folder, 'default-waits'),
+              `${message.payload.admission.waitTimeoutMs}\n`
+            );
+          }
+          // Like a daemon that exits, or closes the connection, while the request waits in its queue. The "-once"
+          // mode does so only in the first daemon; "crash-after-start-notice" first says that the request started.
+          const queuedCrashesPath: string = path.join(folder, 'queued-crashes');
+          if (
+            mode === 'crash-while-queued' ||
+            (mode === 'crash-while-queued-once' && !fs.existsSync(queuedCrashesPath)) ||
+            mode === 'crash-after-start-notice' ||
+            mode === 'close-while-queued'
+          ) {
+            const { requestId } = message.payload;
+            // Like rushd with requestStarted, wait until each frame is written before exiting. On Windows, a pipe
+            // finishes a write only on a later turn of the event loop, and Node.js holds the frames written meanwhile.
+            await sendControlWrittenAsync(connection, {
+              kind: 'queuePosition',
+              payload: { position: 1, requestId }
+            });
+            if (mode === 'crash-after-start-notice') {
+              await sendControlWrittenAsync(connection, { kind: 'requestStarted', payload: { requestId } });
+            }
+            if (mode === 'close-while-queued') {
+              await connection.closeAsync();
+              return;
+            }
+            fs.appendFileSync(queuedCrashesPath, 'c');
+            exitAbruptly();
+            return;
+          }
           const restartCount: number = fs.existsSync(path.join(folder, 'restarted'))
             ? fs.readFileSync(path.join(folder, 'restarted'), 'utf8').length
             : 0;
           const restart: boolean =
             restartMode !== undefined &&
-            (restartMode !== 'restart-once' || restartCount < 1) &&
+            ((restartMode !== 'restart-once' && restartMode !== 'restart-installation') ||
+              restartCount < 1) &&
             (restartMode !== 'restart-twice' || restartCount < 2);
+          const drainMsPath: string = path.join(folder, 'drain-ms');
+          if (restart && fs.existsSync(drainMsPath)) {
+            // Like a daemon that restarts only after the requests it serves finish.
+            await new Promise((resolve) => setTimeout(resolve, Number(fs.readFileSync(drainMsPath, 'utf8'))));
+          }
           await connection.sendFrameAsync({
             kind: DaemonFrameType.controlJson,
             payload: encodeDaemonControlMessage({
@@ -84,15 +156,49 @@ async function mainAsync(): Promise<void> {
                 exitCode: restart ? 1 : 0,
                 outcome: restart ? 'failure' : 'success',
                 aborted: false,
-                ...(restart ? { retryAfterRestart: true as const } : {})
+                ...(restart ? { retryAfterRestart: true as const } : {}),
+                ...(restart && restartMode?.startsWith('restart-installation')
+                  ? {
+                      restartReason: {
+                        kind: 'installationChanged' as const,
+                        change: 'removed' as const,
+                        folder: path.join(folder, 'gone')
+                      }
+                    }
+                  : {})
               }
             })
           });
-          if (restart && restartMode !== 'restart-held') {
+          if (restart && restartMode === 'restart-planned') {
+            // Like RushDaemonHost: answer every request, then release ownership and launch the successor itself.
+            if (++plannedRestartAnswers === readNumber(folder, 'planned-requests', 1)) {
+              void launchPlannedSuccessorAsync().catch((error: Error) => {
+                process.stderr.write(`${error.stack}\n`);
+                process.exitCode = 1;
+              });
+            }
+          } else if (restart && !restartMode?.endsWith('-held')) {
             fs.appendFileSync(path.join(folder, 'restarted'), 'r');
             await stopAsync();
           }
+        } else if (message.kind === 'requestCancel' && mode === 'crash-on-cancel') {
+          exitAbruptly();
         } else if (message.kind === 'shutdown') {
+          if (heldRequest) {
+            // Like rushd, an orderly shutdown ends a running request with an aborted result first.
+            await heldRequest.connection.sendFrameAsync({
+              kind: DaemonFrameType.controlJson,
+              payload: encodeDaemonControlMessage({
+                kind: 'requestResult',
+                payload: {
+                  requestId: heldRequest.requestId,
+                  exitCode: 130,
+                  outcome: 'aborted',
+                  aborted: true
+                }
+              })
+            });
+          }
           await connection.sendFrameAsync({
             kind: DaemonFrameType.controlJson,
             payload: encodeDaemonControlMessage({ kind: 'shutdownAck', payload: {} })
@@ -104,7 +210,20 @@ async function mainAsync(): Promise<void> {
   });
   const expiry: number = Date.now() + 10000;
   const timer = setInterval(() => {
-    if (!fs.existsSync(path.join(folder, 'stop')) && Date.now() < expiry) return;
+    // The startup helper releases its reservation once it has seen this daemon ready.
+    const readySeen: boolean =
+      (mode === 'stop-when-ready' || mode === 'reserve-and-stop-when-ready') &&
+      !fs.existsSync(getDaemonStartupFilePath(paths));
+    if (readySeen && mode === 'reserve-and-stop-when-ready') {
+      // Like a daemon that exits while another startup is reserved, for example its successor's.
+      reserveDaemonStartup(paths, { pid: process.pid, startedAt: new Date().toISOString() });
+    }
+    const stopRequested: boolean =
+      fs.existsSync(path.join(folder, 'stop')) ||
+      Date.now() >= expiry ||
+      // Like a "daemon stop" that arrives as soon as the startup helper has seen this daemon ready.
+      readySeen;
+    if (!stopRequested) return;
     void stopAsync().catch((error: Error) => {
       process.stderr.write(`${error.stack}\n`);
       process.exitCode = 1;
@@ -116,6 +235,52 @@ async function mainAsync(): Promise<void> {
     return closing;
   }
 
+  /**
+   * Like a phased operation, which is spawned without `detached`, starts an operation process in this daemon's
+   * process group, and records its PID in the "operations" file.
+   */
+  function startOperation(): void {
+    const operation = spawn(process.execPath, ['-e', OPERATION_SCRIPT], { stdio: 'ignore' });
+    fs.writeFileSync(path.join(folder, 'operations'), String(operation.pid));
+  }
+
+  /** Exits like a crashed daemon, without cleanup. The test expects this exit, so it also counts as stopped. */
+  function exitAbruptly(): void {
+    fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
+    if (mode === 'kill-on-request' || mode === 'orphan-and-kill-on-request') {
+      process.kill(process.pid, 'SIGKILL');
+    }
+    setImmediate(() => {
+      throw new Error('fixture daemon crash\nwhile running the request');
+    });
+  }
+
+  async function launchPlannedSuccessorAsync(): Promise<void> {
+    await stopAsync();
+    // The "planned-launch-delay-ms" file models a launch that begins well after ownership is released.
+    await new Promise((resolve) => setTimeout(resolve, readNumber(folder, 'planned-launch-delay-ms', 0)));
+    const environment: Record<string, string> = {};
+    for (const [name, value] of Object.entries(process.env)) {
+      if (value !== undefined) environment[name] = value;
+    }
+    const successor = await connectOrStartDaemonAsync({
+      paths,
+      expectedDaemonVersion: daemonVersion,
+      startCommand: {
+        command: process.execPath,
+        args: [__filename, JSON.stringify(paths), daemonVersion],
+        cwd: folder,
+        environment: { ...environment, FIXTURE_IDENTITY: 'planned' }
+      }
+    });
+    try {
+      const { pid } = await successor.status;
+      fs.writeFileSync(path.join(folder, 'planned-successor'), String(pid));
+    } finally {
+      await successor.closeAsync();
+    }
+  }
+
   async function closeOnceAsync(): Promise<void> {
     clearInterval(timer);
     const stopped: Promise<void> = listener.stopAcceptingAsync();
@@ -127,7 +292,31 @@ async function mainAsync(): Promise<void> {
   }
 }
 
+function sendControlWrittenAsync(
+  connection: DaemonFrameConnection,
+  message: DaemonControlMessage
+): Promise<void> {
+  return connection.sendFrameWrittenAsync({
+    kind: DaemonFrameType.controlJson,
+    payload: encodeDaemonControlMessage(message)
+  });
+}
+
+/** How long the daemon waits before it listens: 250 milliseconds, or the number in the "startup-delay-ms" file. */
+function readStartupDelayMs(folder: string): number {
+  return readNumber(folder, 'startup-delay-ms', 250);
+}
+
+function readNumber(folder: string, name: string, defaultValue: number): number {
+  const filePath: string = path.join(folder, name);
+  return fs.existsSync(filePath) ? Number(fs.readFileSync(filePath, 'utf8')) : defaultValue;
+}
+
 mainAsync().catch((error: Error) => {
+  // For example, the daemon found another one at the endpoint. The test expects this exit, so it counts as stopped.
+  const folder: string = path.dirname((JSON.parse(process.argv[2]) as IDaemonPaths).lockfilePath);
+  fs.appendFileSync(path.join(folder, 'failures'), `${process.pid} ${error.message}\n`);
+  fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
   process.stderr.write(`${error.stack}\n`);
   process.exitCode = 1;
 });
diff --git a/libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts b/libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts
new file mode 100644
index 00000000000..e4e234a38cc
--- /dev/null
+++ b/libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts
@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { closeInheritedFileDescriptors } from '../../InheritedFileDescriptors';
+
+// Node opens it close-on-exec, like every descriptor that it opens itself.
+const ownFd: number = fs.openSync(process.argv[2], 'w');
+
+process.once('message', () => {
+  const closed: number[] | undefined = closeInheritedFileDescriptors();
+  fs.writeSync(ownFd, 'still open');
+  process.send!({ closed });
+  // The test inspects this process before it lets it exit.
+  process.once('message', () => {
+    fs.closeSync(ownFd);
+    process.disconnect();
+  });
+});
+process.send!({ ownFd });
diff --git a/libraries/rush-client-core/src/test/fixtures/startLockHolder.ts b/libraries/rush-client-core/src/test/fixtures/startLockHolder.ts
new file mode 100644
index 00000000000..08d5140af7c
--- /dev/null
+++ b/libraries/rush-client-core/src/test/fixtures/startLockHolder.ts
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../../StartupLock';
+
+/** Holds the start mutex, like a client that has not reserved startup yet, until a "release-lock" file exists. */
+async function mainAsync(): Promise<void> {
+  const paths: IDaemonPaths = JSON.parse(process.argv[2]);
+  const folder: string = path.dirname(paths.lockfilePath);
+  const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+  if (!lock) throw new Error('The start mutex is already held.');
+  fs.writeFileSync(path.join(folder, 'lock-held'), String(process.pid));
+  const expiry: number = Date.now() + 30000;
+  while (!fs.existsSync(path.join(folder, 'release-lock')) && Date.now() < expiry) {
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  await lock.releaseAsync();
+}
+
+mainAsync().catch((error: Error) => {
+  process.stderr.write(`${error.stack}\n`);
+  process.exitCode = 1;
+});
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index f88dbe96366..7545a064928 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -25,7 +25,26 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
 - **Interactive request contracts** — request-tagged stdin frames preserve arbitrary bytes, while
   acknowledged raw-mode controls and typed terminal-policy results remain scoped to one request.
 - **Request admission contracts** — resolved no-wait and bounded-timeout options, typed admission
-  failure codes, and capability-gated one-based queue-position control messages.
+  failure codes, and capability-gated one-based queue-position control messages. A queue position
+  may carry the `restartReason` for which the daemon restarts once the requests that the position
+  counts finish, with `scriptCount`, how many of those requests run a rushx script, and
+  `restartsForAnotherRequest`, set when the restart is another request's: for a rushx script that
+  waits for another request's restart, and for a request queued behind another request that waits
+  for the rushx scripts to exit before the daemon restarts.
+  A `scriptCount` without a `restartReason` says that the request waits for that many running
+  rushx scripts to exit before it runs, because it restarts the daemon once it ends (a native
+  `install` or `update`). A request queued behind it is told `nativeMutation` instead, which names
+  that command in `commandName`.
+  `workspaceInputsChanged` names the installation files or the files of Rush and its plugins that
+  changed since the daemon started, or the Rush version that the request selects. Older daemons
+  omit these fields, and clients ignore reason kinds they do not know. A queue position may instead
+  carry `nativeLockHolder` (`IDaemonNativeLockHolder`) while the request waits for a Rush process
+  that the daemon does not run to release the repository's lock: that process's `pid` and
+  `command`, such as `rush install`, as far as the daemon can tell. Its `position` is then 1.
+  A queue position may also carry `continuingOperations` (`IDaemonContinuingOperations`) while the
+  request waits only for operations that earlier requests left running after their result, such as
+  the independent operations of a failed build that returned early: how many of them still wait or
+  run (`count`), and the names of the first few (`names`). Older clients ignore it.
 - **Request lifecycle contracts** — a validated presentation-free command envelope, cancellation,
   typed routing rejection/fallback, and one authoritative terminal result control. Command parsing
   and Rush action construction remain outside the protocol.
@@ -56,13 +75,35 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   with cancellation, admission errors or operation results. Clients may retry once
   after attested predecessor ownership release, never on transport loss or an error
   string. The ordinary mutation result has no retry flag and drains before restart.
+  A retry result may say why in `restartReason`: `installationChanged` names the folder that
+  was removed or replaced, and `environmentChanged` names the environment variables that
+  differ from the daemon's, never their values. Each control, format, line separator or
+  paragraph separator character of a name, such as a newline, ESC, U+2028 or a bidirectional
+  override, and each backslash, is sent as a `\xHH` or `\u{H…}` escape, so that a client prints
+  the names on one line. Clients ignore kinds they do not know.
 - **Read-only workspace status** - optional `pong.payload.workspace` reports the provider generation,
   installed session token, graph existence and real warm accounting. An absent token means no session is
   installed; an absent `warmSet` means no controller is attached, not zero memory. Warm status includes
   effective configuration, maintenance state/failure, retained/protected/watched projects, measured RSS,
   unmeasured runners, pressure and cleanup diagnostics. Child RSS is a last-completion sample, not a
   process-tree ceiling. Nested records and numeric fields are validated. Older pong shapes remain valid;
-  this additive field does not change the 0.9 request, generation-fencing or retry contracts.
+  this additive field does not change the 0.9 request, generation-fencing or retry contracts. While the
+  daemon runs only operations that earlier requests left running after their result, the status also
+  carries them as `continuingOperations`, in the same shape as a queue position's.
+- **Keepalive (0.13)** - a client may `ping` while its request runs, to learn whether the daemon still
+  responds, and gets a `pong` as before. A daemon that is closing the session ignores a `ping` rather than
+  answering it with a protocol `error`, which could reach the client ahead of the request's typed result.
+  Clients must negotiate `DAEMON_KEEPALIVE_PROTOCOL_MINOR` before they ping during a request.
+- **Request started (0.14)** - a client that negotiated `DAEMON_REQUEST_STARTED_PROTOCOL_MINOR` may subscribe
+  with `supportsRequestStarted: true`. The daemon then sends it `requestStarted` once per request, when the
+  request has left every queue and before anything from it is applied, so the notice precedes the request's
+  output, events and terminal control. A daemon that exits after a `queuePosition` but before `requestStarted`
+  has not run the request, unless it exited abruptly just as a build joined an executing iteration, which starts
+  the build's work before the notice is written. A daemon answers a `requestStarted` that a client sends with a
+  protocol `error`.
+- **Usage** - a failure result for a command line that native Rush rejects as invalid may carry the command's
+  `usage`, which native Rush prints to stdout before the error. Older daemons omit it and older clients ignore
+  it, so this additive field needs no minor.
 
 Part of the Rush 6 / rushd re-architecture:
 [microsoft/rushstack#5894](https://github.com/microsoft/rushstack/issues/5894).
diff --git a/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts b/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
new file mode 100644
index 00000000000..90ad9c92f5a
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { isDaemonControlRecord } from './ControlRecord';
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const EMPTY_STRING_LENGTH: number = 0;
+const FIRST_OPERATION_COUNT: number = 1;
+
+/**
+ * Whether `value` is an `IDaemonContinuingOperations`: a positive count, at most that many nonempty names, and a
+ * `stopping` that is a boolean if set.
+ * @internal
+ */
+export function isDaemonContinuingOperations(value: unknown): boolean {
+  return isDaemonControlRecord(value) && !Array.isArray(value) && hasContinuingOperationsFields(value);
+}
+
+/** Validates a queue position's optional `continuingOperations`. @internal */
+export function validateQueuedContinuingOperations(value: unknown): void {
+  if (value !== undefined && !isDaemonContinuingOperations(value)) {
+    throw new DaemonProtocolError(
+      'malformedControlMessage',
+      'Queue position payload.continuingOperations must have a positive count, at most that many nonempty ' +
+        'names, and a boolean stopping if set.'
+    );
+  }
+}
+
+function hasContinuingOperationsFields(value: Record<string, unknown>): boolean {
+  return (
+    isOperationCount(value.count) &&
+    isNameList(value.names, value.count as number) &&
+    isOptionalBoolean(value.stopping)
+  );
+}
+
+function isOperationCount(value: unknown): boolean {
+  return Number.isSafeInteger(value) && (value as number) >= FIRST_OPERATION_COUNT;
+}
+
+function isNameList(value: unknown, count: number): boolean {
+  return Array.isArray(value) && value.length <= count && value.every(isNonEmptyString);
+}
+
+function isNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_STRING_LENGTH;
+}
+
+function isOptionalBoolean(value: unknown): boolean {
+  return value === undefined || typeof value === 'boolean';
+}
diff --git a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
index 2be3cf95f9d..30c52fc49ed 100644
--- a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
+++ b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
@@ -48,6 +48,11 @@ function validateError(payload: Record<string, unknown>): void {
   requireStringField(payload, 'code');
   requireStringField(payload, 'message');
 }
+function validatePing(payload: Record<string, unknown>): void {
+  if (payload.omitWarmSet !== undefined && typeof payload.omitWarmSet !== 'boolean') {
+    fail('Control message field "omitWarmSet" must be a boolean.');
+  }
+}
 type ControlValidator = (payload: Record<string, unknown>) => void;
 const noopValidator: ControlValidator = () => undefined;
 
@@ -56,7 +61,7 @@ const VALIDATORS_BY_KIND: Record<string, ControlValidator> = {
   helloAck: validateHelloAck,
   subscribe: validateSubscribeControl,
   unsubscribe: noopValidator,
-  ping: noopValidator,
+  ping: validatePing,
   pong: validateDaemonPong,
   error: validateError,
   setRawMode: validateRawModeControl,
@@ -64,6 +69,7 @@ const VALIDATORS_BY_KIND: Record<string, ControlValidator> = {
   terminalPolicy: validateTerminalPolicyControl,
   queuePosition: validateRequestQueuePositionControl,
   requestStart: validateRequestStartControl,
+  requestStarted: validateRequestCancelControl,
   requestCancel: validateRequestCancelControl,
   requestRejected: validateRequestRejectedControl,
   requestResult: validateRequestResultControl,
diff --git a/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts b/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts
index 77237f3304b..82d6f7b0abc 100644
--- a/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts
@@ -24,6 +24,11 @@ export interface IDaemonClientCaps {
   readonly supportsRequestAdmission?: boolean;
   /** Whether the client supports the request start, cancellation, and terminal outcome controls. */
   readonly supportsRequestLifecycle?: boolean;
+  /**
+   * Whether the client accepts `requestStarted`, which says when the daemon starts to execute the request. Only
+   * negotiated from `DAEMON_REQUEST_STARTED_PROTOCOL_MINOR` on.
+   */
+  readonly supportsRequestStarted?: boolean;
   /** The verbosity subset this client receives. Defaults to `normal`. */
   readonly verbosity?: DaemonVerbosity;
   /** The client's terminal width in columns, when known. */
diff --git a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
index 293776da321..14ef4089e88 100644
--- a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { DaemonRestartReason } from './DaemonInstallationChange';
 import type { DaemonRequestAdmissionErrorCode } from './DaemonRequestAdmission';
 
 /**
@@ -17,11 +18,16 @@ export type DaemonCommandOutcome = 'success' | 'success-with-warning' | 'failure
  */
 export interface IDaemonCommandResult {
   /**
-   * Protocol 0.10: no execution or request IO occurred, and a successor has been selected.
+   * Protocol 0.10: no execution or request IO occurred, and a successor has been selected. With a
+   * `restartReason` of `installationChanged`, the daemon exits without one instead, and the client starts it.
    * Retry only after attested predecessor ownership release, within the request's admission deadline and a
    * small client-defined retry bound; then fall back instead of retrying. Never infer this from an error.
+   * The predecessor launches the selected successor itself after that release, and its process exits once the
+   * launch settles: until then, a retrying client connects to the successor but must not start a daemon.
    */
   readonly retryAfterRestart?: true;
+  /** Why the daemon restarts, when it says; only together with `retryAfterRestart`. Older daemons omit it. */
+  readonly restartReason?: DaemonRestartReason;
   /** Whether cancellation or disconnect was observed, even if a cleanup failure determines the outcome. */
   readonly aborted: boolean;
   /** The typed admission failure, when execution never started. */
@@ -30,6 +36,11 @@ export interface IDaemonCommandResult {
   readonly exitCode: number;
   /** A failure description for execution or cleanup failures that were not already operation-scoped. */
   readonly errorMessage?: string;
+  /**
+   * The usage of the command, for a command line that native Rush rejects as invalid. Native Rush prints it to
+   * stdout before `errorMessage`. Older daemons omit it.
+   */
+  readonly usage?: string;
   /** The semantic command outcome. */
   readonly outcome: DaemonCommandOutcome;
   /** The identifier copied from the request. */
diff --git a/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts b/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts
index 7836f1561a4..e2f373850a8 100644
--- a/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts
@@ -15,6 +15,7 @@ export const DAEMON_CONTROL_MESSAGE_KINDS: readonly [
   'terminalPolicy',
   'queuePosition',
   'requestStart',
+  'requestStarted',
   'requestCancel',
   'requestRejected',
   'requestResult',
@@ -35,6 +36,7 @@ export const DAEMON_CONTROL_MESSAGE_KINDS: readonly [
   'terminalPolicy',
   'queuePosition',
   'requestStart',
+  'requestStarted',
   'requestCancel',
   'requestRejected',
   'requestResult',
diff --git a/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts b/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
index a21e8d422a8..4514e2b60a7 100644
--- a/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
@@ -10,7 +10,7 @@ import type {
   IDaemonTerminalPolicyMessage
 } from './DaemonInteractiveControl';
 import type { IDaemonShutdownAckMessage, IDaemonShutdownMessage } from './DaemonLifecycleControl';
-import type { IDaemonPongMessage } from './DaemonPongMessage';
+import type { IDaemonPingPayload, IDaemonPongMessage } from './DaemonPongMessage';
 import type { DaemonProtocolErrorCode } from './DaemonProtocolError';
 import type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
 import type { IDaemonRequestQueuePositionMessage } from './DaemonRequestAdmission';
@@ -18,7 +18,8 @@ import type {
   IDaemonRequestCancelMessage,
   IDaemonRequestRejectedMessage,
   IDaemonRequestResultMessage,
-  IDaemonRequestStartMessage
+  IDaemonRequestStartMessage,
+  IDaemonRequestStartedMessage
 } from './DaemonRequestControl';
 
 /** The empty payload of control messages that carry no data. @beta */
@@ -54,7 +55,7 @@ export interface IDaemonUnsubscribeMessage {
 /** A liveness probe. @beta */
 export interface IDaemonPingMessage {
   readonly kind: 'ping';
-  readonly payload: DaemonEmptyPayload;
+  readonly payload: IDaemonPingPayload;
 }
 
 /** A protocol error sent on the wire. @beta */
@@ -91,6 +92,7 @@ export type DaemonControlMessage =
   | IDaemonTerminalPolicyMessage
   | IDaemonRequestQueuePositionMessage
   | IDaemonRequestStartMessage
+  | IDaemonRequestStartedMessage
   | IDaemonRequestCancelMessage
   | IDaemonRequestRejectedMessage
   | IDaemonRequestResultMessage;
diff --git a/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
new file mode 100644
index 00000000000..5f629a838e5
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The request's environment differs from the one that the daemon started with, in variables that the daemon cannot
+ * take from each request. The daemon restarts with the request's environment.
+ *
+ * @beta
+ */
+export interface IDaemonEnvironmentChangedRestartReason {
+  /** Identifies this reason. */
+  readonly kind: 'environmentChanged';
+  /**
+   * The sorted names of the variables that differ: those that only one of the two environments sets, and those that
+   * they set to different values. Values are never sent, because a variable such as `NODE_OPTIONS` can carry a
+   * secret. Each control, format, line separator or paragraph separator character of a name, such as a newline, ESC,
+   * U+2028 or a bidirectional override, and each backslash, is sent as an escape: `\xHH` below U+0100 and `\u{H…}`
+   * from there on. So a client can print the names on one line. A daemon may send an empty list.
+   */
+  readonly variableNames: readonly string[];
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
new file mode 100644
index 00000000000..34fc110f8b2
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
+import type { IDaemonWorkspaceInputsChangedRestartReason } from './DaemonWorkspaceInputsChange';
+
+/**
+ * How a folder of a running daemon's installation changed after the daemon started.
+ *
+ * @beta
+ */
+export type DaemonInstallationChangeKind = 'removed' | 'replaced';
+
+/**
+ * A folder of the daemon's own installation, or of the Rush engine that it loaded, that was removed or replaced
+ * after the daemon started. Such a daemon cannot load the rest of its code, so it restarts instead of serving.
+ *
+ * @beta
+ */
+export interface IDaemonInstallationChange {
+  /** `removed` when the folder no longer exists; `replaced` when a different folder now has its path. */
+  readonly change: DaemonInstallationChangeKind;
+  /** The absolute path of the outermost folder that was removed or replaced. */
+  readonly folder: string;
+}
+
+/**
+ * The daemon's installation was removed or replaced. The daemon exits without selecting a successor, and the
+ * client starts one with its own current launcher.
+ *
+ * @beta
+ */
+export interface IDaemonInstallationChangedRestartReason extends IDaemonInstallationChange {
+  /** Identifies this reason. */
+  readonly kind: 'installationChanged';
+}
+
+/**
+ * Another request runs a native Rush command that changes the workspace's installation, such as `install` or
+ * `update`, and the daemon restarts once it has run. A queued request that waits behind that request is told this
+ * reason, with `restartsForAnotherRequest`.
+ *
+ * @beta
+ */
+export interface IDaemonNativeMutationRestartReason {
+  /** Identifies this reason. */
+  readonly kind: 'nativeMutation';
+  /** The name of the Rush command that the other request runs, such as `install`. */
+  readonly commandName: string;
+}
+
+/**
+ * Why a daemon asked the client to retry after a restart, or why a queued request waits for a restart. Clients ignore
+ * kinds that they do not know.
+ *
+ * @beta
+ */
+export type DaemonRestartReason =
+  | IDaemonInstallationChangedRestartReason
+  | IDaemonEnvironmentChangedRestartReason
+  | IDaemonWorkspaceInputsChangedRestartReason
+  | IDaemonNativeMutationRestartReason;
diff --git a/libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts b/libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts
new file mode 100644
index 00000000000..a32cd92bb20
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts
@@ -0,0 +1,14 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * A Rush process that the daemon does not run, such as `rush install`, which holds the repository's lock, as far as
+ * the daemon can tell.
+ * @beta
+ */
+export interface IDaemonNativeLockHolder {
+  /** The process ID of the holder. Omitted when the lock does not name it, as on Windows. */
+  readonly pid?: number;
+  /** The holder's command, shortened to the program and its action, such as `rush install`. Omitted when unknown. */
+  readonly command?: string;
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
index 926e20e4494..d5bbb148372 100644
--- a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
@@ -32,6 +32,18 @@ export interface IDaemonOperationStatusChangedPayload {
   readonly status: string;
   /** The previous raw engine status string, when known. */
   readonly previousStatus?: string;
+  /**
+   * The absolute path of the operation's full text log, when the operation failed or succeeded with
+   * warnings and wrote a log. Clients that summarize output print it so the full output can be read later.
+   */
+  readonly logFilePath?: string;
+  /**
+   * Which of the operation's commands produced the status, when the operation failed or succeeded with
+   * warnings and has an incremental command (a `<phase>:incremental` script) besides its initial command.
+   * An incremental command can fail where the initial command would not, so clients that summarize output
+   * say when it ran.
+   */
+  readonly commandKind?: 'initial' | 'incremental';
 }
 
 /**
@@ -44,4 +56,10 @@ export interface IDaemonActivityPayload {
   readonly text: string;
   /** The stream the line was written to. Defaults to `stdout`. */
   readonly stream?: 'stdout' | 'stderr';
+  /**
+   * Set when Rush or a Rush plugin wrote the text as a warning or an error while the engine loaded or ran,
+   * which native Rush prints in yellow or red. Absent on other activity, including the end-of-run summary.
+   * Clients that print only a summary can still show these lines.
+   */
+  readonly severity?: 'warning' | 'error';
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts b/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts
index 7dbc06d8cea..55b8eaed4c9 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts
@@ -63,6 +63,8 @@ export interface IDaemonPhasedRequest {
   readonly operationSelection: ReadonlyArray<IDaemonPhasedOperationSelection>;
   /** A client-generated identifier unique within the connection. */
   readonly requestId: string;
+  /** Copied from {@link IDaemonRequestEnvelope.returnEarlyOnFailure}; only shared builds honor it. */
+  readonly returnEarlyOnFailure?: boolean;
   /** Terminal capability needed by the resolved command. */
   readonly terminalRequirement?: DaemonTerminalRequirement;
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts b/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
index e964c89de57..fdd09c7c76b 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
@@ -1,9 +1,20 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IDaemonInstallationChange } from './DaemonInstallationChange';
 import type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
 import type { IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
 
+/** What a ping asks the daemon to leave out of its pong. Older daemons ignore it and leave nothing out. @beta */
+export interface IDaemonPingPayload {
+  /**
+   * Leave `workspace.warmSet` out of the pong. It names every retained, protected and watched project, which in a
+   * large repo makes the pong hundreds of kilobytes. A client that pings only to learn that the daemon is ready sets
+   * this.
+   */
+  readonly omitWarmSet?: boolean;
+}
+
 /** The liveness reply. @beta */
 export interface IDaemonPongMessage {
   readonly kind: 'pong';
@@ -18,6 +29,11 @@ export interface IDaemonPongMessage {
     readonly residentMemoryBytes?: number;
     /** Optional generation and warm accounting; older peers may omit this snapshot. */
     readonly workspace?: IDaemonWorkspaceStatus;
+    /**
+     * Present when the daemon found its own installation removed or replaced after it started. Its next request
+     * restarts it. Older daemons omit it.
+     */
+    readonly installationChange?: IDaemonInstallationChange;
     readonly uptimeMs: number;
   };
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts b/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts
index 54fc61970e2..7862c87c804 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts
@@ -3,6 +3,7 @@
 
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateInstallationChange } from './InstallationChangeValidation';
 import { validateWorkspaceStatus } from './WorkspaceStatusValidation';
 
 const ZERO: number = 0;
@@ -18,6 +19,7 @@ export function validateDaemonPong(payload: Record<string, unknown>): void {
   validatePid(payload.pid);
   validateResidentMemory(payload.residentMemoryBytes);
   validateWorkspaceStatus(payload.workspace);
+  validateInstallationChange(payload.installationChange, 'pong field "installationChange"');
 }
 
 function validateDaemonVersion(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
index b35d1d68838..eaf357a7f2f 100644
--- a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
@@ -28,6 +28,27 @@ export const DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR: number = 10;
 /** The first additive protocol minor whose shutdown acknowledgement reports the active request count. @beta */
 export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number = 11;
 
+/**
+ * The first protocol minor whose clients and daemons meet in `/tmp/rushd-<uid>` (or in the folder that
+ * `RUSHD_RUNTIME_DIR` names) rather than in one chosen by `XDG_RUNTIME_DIR` or `TMPDIR`, and whose workspace
+ * identity ignores temporary and runtime folder variables. @beta
+ */
+export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number = 12;
+
+/**
+ * The first protocol minor whose daemons ignore a `ping` that arrives while the connection closes, rather than
+ * failing the connection with a protocol error that could reach the client before the request's result. From this
+ * minor on, a client may ping the daemon at any time while a request runs, to learn whether it still responds. @beta
+ */
+export const DAEMON_KEEPALIVE_PROTOCOL_MINOR: number = 13;
+
+/**
+ * The first protocol minor whose daemons send `requestStarted` when they start to execute a request, to a client
+ * that subscribes with `supportsRequestStarted`. Until then the request has not run, so a client whose daemon exits
+ * first may send it to another daemon. @beta
+ */
+export const DAEMON_REQUEST_STARTED_PROTOCOL_MINOR: number = 14;
+
 /**
  * A rushd wire protocol version.
  *
@@ -61,7 +82,7 @@ export interface IDaemonProtocolVersion {
  */
 export const DAEMON_PROTOCOL_VERSION: IDaemonProtocolVersion = {
   major: 0,
-  minor: DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR
+  minor: DAEMON_REQUEST_STARTED_PROTOCOL_MINOR
 };
 
 /**
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 6be5d0c3808..016f63d6cdd 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -1,9 +1,11 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { DaemonRestartReason } from './DaemonInstallationChange';
+import type { IDaemonNativeLockHolder } from './DaemonNativeLockHolder';
+
 /** The largest wait timeout accepted by Node.js timers. @beta */
 export const MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS: number = 0x7fffffff;
-const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
 
 /** A typed reason why a daemon request was not admitted. @beta */
 export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-timeout';
@@ -13,67 +15,71 @@ export interface IDaemonRequestAdmissionOptions {
   /** Fail immediately when the request cannot be admitted. */
   readonly noWait?: boolean;
   /**
-   * True when `waitTimeoutMs` is a client default rather than an explicit user choice. A default timeout bounds
-   * workspace admission only, not waiting behind running compatible shared builds.
+   * True when `waitTimeoutMs` is a client default rather than an explicit user choice. A default timeout applies
+   * to each daemon's workspace admission only: not to waiting behind running compatible shared builds, nor, when
+   * the daemon restarts for the request's environment or because its installation changed, to waiting for the
+   * requests that it was already serving while it serves no rushx script.
    */
   readonly waitTimeoutIsDefault?: boolean;
   /** Maximum queue wait in milliseconds. Omission means no timeout. */
   readonly waitTimeoutMs?: number;
 }
 
+/**
+ * Operations that the daemon still runs for requests that already have their result: those that a failed build's
+ * early result did not block (see {@link IDaemonRequestEnvelope.returnEarlyOnFailure}). @beta
+ */
+export interface IDaemonContinuingOperations {
+  /** How many of them are still waiting or running. */
+  readonly count: number;
+  /** The names of the first few of them, in name order. */
+  readonly names: ReadonlyArray<string>;
+  /**
+   * Set in a queue position while the daemon stops these operations for the request, instead of letting it wait for
+   * them to end. Older daemons omit it; older clients ignore it, and say that the request waits for them.
+   */
+  readonly stopping?: boolean;
+}
+
 /** Reports a request's current one-based scheduler queue position. @beta */
 export interface IDaemonRequestQueuePositionMessage {
   readonly kind: 'queuePosition';
   readonly payload: {
     readonly position: number;
     readonly requestId: string;
+    /**
+     * Set while the request waits for the requests that `position` counts to finish, since the daemon then
+     * restarts for this reason, and the request runs after the restart. With `restartsForAnotherRequest`, another
+     * request needs the restart, and a `nativeMutation` reason says that it runs a native `install` or `update`,
+     * after which the daemon restarts. Older daemons omit it; clients ignore unknown kinds.
+     */
+    readonly restartReason?: DaemonRestartReason;
+    /**
+     * Set with `restartReason` if any of the requests that `position` counts run a rushx script: how many. Set
+     * without it while the request waits for that many running rushx scripts to exit before it runs, because it
+     * restarts the daemon once it ends (a native `install` or `update`), which would end them; `position` then
+     * counts the same scripts. Older daemons send a plain position instead.
+     */
+    readonly scriptCount?: number;
+    /**
+     * Set with `restartReason` when another request needs the restart, not this one: for a rushx script that waits
+     * for that request's restart, so that the restart does not wait for the script, and for a request that is
+     * queued behind a request that holds exclusive workspace admission while it waits for running rushx scripts to
+     * exit before it restarts the daemon. The latter's `position` counts those scripts, that request and the
+     * requests queued ahead of it.
+     */
+    readonly restartsForAnotherRequest?: boolean;
+    /**
+     * Set while the request waits for a Rush process that the daemon does not run to release the repository's
+     * lock. `position` is then 1 if the request waits for that process itself, rather than for other requests,
+     * or the request's own position if it waits behind another request's load or reload of the workspace graph
+     * that waits for that process. Older daemons omit it; older clients ignore it.
+     */
+    readonly nativeLockHolder?: IDaemonNativeLockHolder;
+    /**
+     * Set while the request waits only for operations that earlier requests left running after their result, with
+     * `stopping` while the daemon stops them for the request. Older daemons omit it; older clients ignore it.
+     */
+    readonly continuingOperations?: IDaemonContinuingOperations;
   };
 }
-
-/** Validates resolved admission values at a daemon request boundary. @beta */
-export function validateDaemonRequestAdmissionOptions(
-  options: IDaemonRequestAdmissionOptions | undefined
-): void {
-  if (options === undefined) {
-    return;
-  }
-  validateAdmissionRecord(options);
-  validateBoolean(options.noWait, 'noWait');
-  validateBoolean(options.waitTimeoutIsDefault, 'waitTimeoutIsDefault');
-  validateWaitTimeout(options.waitTimeoutMs);
-}
-
-function validateAdmissionRecord(options: IDaemonRequestAdmissionOptions): void {
-  if (typeof options !== 'object' || options === null) {
-    throw new TypeError('Daemon request admission options must be an object.');
-  }
-}
-
-function validateBoolean(value: unknown, name: string): void {
-  if (value !== undefined && typeof value !== 'boolean') {
-    throw new TypeError(`Daemon request admission ${name} must be a boolean.`);
-  }
-}
-
-function validateWaitTimeout(value: unknown): void {
-  if (value === undefined) {
-    return;
-  }
-  if (!isBoundedInteger(value)) {
-    throw new RangeError(
-      `Daemon request admission waitTimeoutMs must be an integer between 0 and ${MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS}.`
-    );
-  }
-}
-
-function isBoundedInteger(value: unknown): value is number {
-  return isInteger(value) && isWithinWaitTimeoutRange(value);
-}
-
-function isInteger(value: unknown): value is number {
-  return typeof value === 'number' && Number.isInteger(value);
-}
-
-function isWithinWaitTimeoutRange(value: number): boolean {
-  return value >= MINIMUM_WAIT_TIMEOUT_MS && value <= MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS;
-}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts
new file mode 100644
index 00000000000..d94754259f2
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
+import { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
+
+const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
+
+/** Validates resolved admission values at a daemon request boundary. @beta */
+export function validateDaemonRequestAdmissionOptions(
+  options: IDaemonRequestAdmissionOptions | undefined
+): void {
+  if (options === undefined) {
+    return;
+  }
+  validateAdmissionRecord(options);
+  validateBoolean(options.noWait, 'noWait');
+  validateBoolean(options.waitTimeoutIsDefault, 'waitTimeoutIsDefault');
+  validateWaitTimeout(options.waitTimeoutMs);
+}
+
+function validateAdmissionRecord(options: IDaemonRequestAdmissionOptions): void {
+  if (typeof options !== 'object' || options === null) {
+    throw new TypeError('Daemon request admission options must be an object.');
+  }
+}
+
+function validateBoolean(value: unknown, name: string): void {
+  if (value !== undefined && typeof value !== 'boolean') {
+    throw new TypeError(`Daemon request admission ${name} must be a boolean.`);
+  }
+}
+
+function validateWaitTimeout(value: unknown): void {
+  if (value === undefined) {
+    return;
+  }
+  if (!isValidWaitTimeout(value)) {
+    throw new RangeError(
+      `Daemon request admission waitTimeoutMs must be an integer between 0 and ${MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS}.`
+    );
+  }
+}
+
+function isValidWaitTimeout(value: unknown): value is number {
+  return isInteger(value) && isWithinWaitTimeoutRange(value);
+}
+
+function isInteger(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value);
+}
+
+function isWithinWaitTimeoutRange(value: number): boolean {
+  return value >= MINIMUM_WAIT_TIMEOUT_MS && value <= MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS;
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts b/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts
index c27e37ac34d..ea7540596a6 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts
@@ -24,6 +24,16 @@ export interface IDaemonRequestCancelMessage {
   readonly payload: { readonly requestId: string };
 }
 
+/**
+ * Says that the daemon starts to execute one request: before this, the request has only waited or been prepared, and
+ * has not run. Sent at most once per request, and only to a client that subscribed with `supportsRequestStarted`.
+ * @beta
+ */
+export interface IDaemonRequestStartedMessage {
+  readonly kind: 'requestStarted';
+  readonly payload: { readonly requestId: string };
+}
+
 /** Terminates a request that could not be routed or started. @beta */
 export interface IDaemonRequestRejectedMessage {
   readonly kind: 'requestRejected';
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts b/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts
index 9db2a247070..5c74f3bb39c 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts
@@ -52,6 +52,14 @@ export interface IDaemonRequestEnvelope {
   readonly invocationKind?: DaemonInvocationKind;
   /** A client-generated identifier unique within this connection. */
   readonly requestId: string;
+  /**
+   * Whether a shared build may report its failure before the rest of its work ends. Once an operation failed and
+   * no operation of the selected projects that no other selected project consumes is unfinished, the daemon
+   * writes the result, in which unfinished operations report their current status. Those keep running in the
+   * daemon, and the request stays active until they end, unless a request that cannot run alongside them, or a
+   * restart, stops them first. Older daemons ignore this field.
+   */
+  readonly returnEarlyOnFailure?: boolean;
   /** Request-local terminal capabilities. */
   readonly terminal: IDaemonRequestTerminal;
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts b/libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts
new file mode 100644
index 00000000000..201f08f3d47
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts
@@ -0,0 +1,27 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Workspace inputs that bind a daemon process differ from the ones that it started with, so the daemon restarts to
+ * serve a request that needs them. Each field is set only when that kind of input differs, and a list is empty when
+ * the daemon could not tell which files changed. A request whose environment differs is described by
+ * `environmentChanged` instead, whatever else differs.
+ *
+ * @beta
+ */
+export interface IDaemonWorkspaceInputsChangedRestartReason {
+  /** Identifies this reason. */
+  readonly kind: 'workspaceInputsChanged';
+  /**
+   * The installation files that changed since the daemon started, such as the lockfile, relative to the workspace
+   * root when they are inside it.
+   */
+  readonly installationFiles?: ReadonlyArray<string>;
+  /**
+   * Some of the files of Rush or of a Rush plugin whose code changed since the daemon started, relative to the
+   * workspace root when they are inside it.
+   */
+  readonly implementationFiles?: ReadonlyArray<string>;
+  /** The Rush version that the request selects, which the daemon does not run. */
+  readonly selectedRushVersion?: string;
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts b/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
index d32675bd984..0361ce79a6e 100644
--- a/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IDaemonContinuingOperations } from './DaemonRequestAdmission';
+
 /** Effective runtime policy, not a hard process/tree RSS limit. @beta */
 export interface IDaemonWarmSetConfiguration {
   /** Persistent host project observation; omitted by older peers. Never schedules builds. */
@@ -55,6 +57,14 @@ export interface IDaemonWorkspaceStatus {
   readonly generationToken?: string;
   /** Graph existence, not a claim of successful execution or resident children. */
   readonly graphInitialized: boolean;
-  /** Absent when no warm controller is attached; absence never means measured zero memory. */
+  /**
+   * Absent when no warm controller is attached, or when the ping asked to leave it out
+   * (`IDaemonPingPayload.omitWarmSet`). Absence never means measured zero memory.
+   */
   readonly warmSet?: IDaemonWarmSetStatus;
+  /**
+   * Set while the daemon runs only operations that earlier requests left running after their result, such as the
+   * independent operations of a failed build that returned early. Older peers omit it.
+   */
+  readonly continuingOperations?: IDaemonContinuingOperations;
 }
diff --git a/libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts b/libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts
new file mode 100644
index 00000000000..246445b086b
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts
@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const EMPTY_LENGTH: number = 0;
+
+/** Validates the variable names of an `environmentChanged` restart reason. @internal */
+export function validateEnvironmentChange(reason: Record<string, unknown>): void {
+  const { variableNames } = reason;
+  if (!Array.isArray(variableNames) || !variableNames.every(isVariableName)) {
+    throw new DaemonProtocolError('malformedControlMessage', 'Invalid restartReason.variableNames.');
+  }
+}
+
+function isVariableName(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_LENGTH;
+}
diff --git a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
new file mode 100644
index 00000000000..3d3caaeb84f
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { isDaemonControlRecord } from './ControlRecord';
+import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateEnvironmentChange } from './EnvironmentChangeValidation';
+import { validateWorkspaceInputsChange } from './WorkspaceInputsChangeValidation';
+
+const INSTALLATION_CHANGE_KINDS: ReadonlySet<unknown> = new Set(['removed', 'replaced']);
+const INSTALLATION_CHANGED: string = 'installationChanged';
+const ENVIRONMENT_CHANGED: string = 'environmentChanged';
+const WORKSPACE_INPUTS_CHANGED: string = 'workspaceInputsChanged';
+const NATIVE_MUTATION: string = 'nativeMutation';
+const EMPTY_LENGTH: number = 0;
+/** Validates the fields of each known restart reason kind; unknown kinds are accepted. */
+const REASON_VALIDATORS: ReadonlyMap<unknown, (reason: Record<string, unknown>) => void> = new Map([
+  [
+    INSTALLATION_CHANGED,
+    (reason: Record<string, unknown>) => validateInstallationChange(reason, 'restartReason')
+  ],
+  [ENVIRONMENT_CHANGED, validateEnvironmentChange],
+  [WORKSPACE_INPUTS_CHANGED, validateWorkspaceInputsChange],
+  [NATIVE_MUTATION, validateNativeMutation]
+]);
+
+/** Validates an optional installation change, as reported by pong or by a restart reason. @internal */
+export function validateInstallationChange(value: unknown, field: string): void {
+  if (value === undefined) return;
+  requireRecord(value, field);
+  if (!INSTALLATION_CHANGE_KINDS.has(value.change)) fail(`${field}.change`);
+  requireFolder(value.folder, `${field}.folder`);
+}
+
+/** Validates an optional restart reason. Unknown kinds from newer daemons are accepted and ignored. @internal */
+export function validateRestartReason(payload: Record<string, unknown>): void {
+  if (payload.restartReason === undefined) return;
+  if (payload.retryAfterRestart !== true) fail('restartReason without retryAfterRestart');
+  validateReason(payload.restartReason);
+}
+
+/** Validates the optional restart reason of a queue position, which needs no retry flag. @internal */
+export function validateQueuedRestartReason(payload: Record<string, unknown>): void {
+  if (payload.restartReason !== undefined) validateReason(payload.restartReason);
+}
+
+function validateReason(reason: unknown): void {
+  requireRecord(reason, 'restartReason');
+  requireKind(reason.kind);
+  REASON_VALIDATORS.get(reason.kind)?.(reason);
+}
+
+function validateNativeMutation(reason: Record<string, unknown>): void {
+  const { commandName } = reason;
+  if (typeof commandName !== 'string' || commandName.length === EMPTY_LENGTH)
+    fail('restartReason.commandName');
+}
+
+function requireRecord(value: unknown, field: string): asserts value is Record<string, unknown> {
+  if (!isDaemonControlRecord(value) || Array.isArray(value)) fail(field);
+}
+
+function requireKind(value: unknown): void {
+  if (typeof value !== 'string' || value.length === EMPTY_LENGTH) fail('restartReason.kind');
+}
+
+function requireFolder(value: unknown, field: string): void {
+  if (typeof value !== 'string' || value.length === EMPTY_LENGTH) fail(field);
+}
+
+function fail(field: string): never {
+  throw new DaemonProtocolError('malformedControlMessage', `Invalid ${field}.`);
+}
diff --git a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
index 6b0419bc075..baae340a0b1 100644
--- a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
@@ -1,10 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { validateQueuedContinuingOperations } from './ContinuingOperationsValidation';
+import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateQueuedRestartReason } from './InstallationChangeValidation';
 
 const EMPTY_STRING_LENGTH: number = 0;
+const FIRST_PROCESS_ID: number = 1;
 const FIRST_QUEUE_POSITION: number = 1;
+const NO_SCRIPTS: number = 0;
 
 /** Validates optional request-admission capability negotiation. @internal */
 export function validateRequestAdmissionCapability(payload: Record<string, unknown>): void {
@@ -20,6 +25,59 @@ export function validateRequestAdmissionCapability(payload: Record<string, unkno
 export function validateRequestQueuePositionControl(payload: Record<string, unknown>): void {
   validateRequestId(payload.requestId);
   validateQueuePosition(payload.position);
+  validateQueuedRestartReason(payload);
+  validateScriptCount(payload.scriptCount);
+  validateRestartsForAnotherRequest(payload.restartsForAnotherRequest);
+  validateNativeLockHolder(payload.nativeLockHolder);
+  validateQueuedContinuingOperations(payload.continuingOperations);
+}
+
+function validateNativeLockHolder(value: unknown): void {
+  if (value !== undefined) {
+    validateNativeLockHolderFields(requireNativeLockHolderRecord(value));
+  }
+}
+
+function requireNativeLockHolderRecord(value: unknown): Record<string, unknown> {
+  if (!isDaemonControlRecord(value) || Array.isArray(value)) {
+    fail('Queue position payload.nativeLockHolder must be an object.');
+  }
+  return value;
+}
+
+function validateNativeLockHolderFields(holder: Record<string, unknown>): void {
+  validateOptional(holder.pid, isProcessId, 'nativeLockHolder.pid must be a positive safe integer');
+  validateOptional(holder.command, isNonEmptyString, 'nativeLockHolder.command must be a nonempty string');
+}
+
+function validateOptional(value: unknown, isValid: (value: unknown) => boolean, requirement: string): void {
+  if (value !== undefined && !isValid(value)) {
+    fail(`Queue position payload.${requirement}.`);
+  }
+}
+
+function isProcessId(value: unknown): boolean {
+  return Number.isSafeInteger(value) && (value as number) >= FIRST_PROCESS_ID;
+}
+
+function isNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_STRING_LENGTH;
+}
+
+function validateRestartsForAnotherRequest(value: unknown): void {
+  if (value !== undefined && typeof value !== 'boolean') {
+    fail('Queue position payload.restartsForAnotherRequest must be a boolean.');
+  }
+}
+
+function validateScriptCount(value: unknown): void {
+  if (value !== undefined && !isScriptCount(value)) {
+    fail('Queue position payload.scriptCount must be a nonnegative safe integer.');
+  }
+}
+
+function isScriptCount(value: unknown): boolean {
+  return Number.isSafeInteger(value) && (value as number) >= NO_SCRIPTS;
 }
 
 function validateRequestId(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/RequestControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestControlValidation.ts
index 5f628a2cdab..5686cac2948 100644
--- a/libraries/rush-daemon-protocol/src/RequestControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestControlValidation.ts
@@ -4,7 +4,7 @@
 import { isDaemonControlRecord } from './ControlRecord';
 import { validateDaemonInvocationKind, validateExpectedWorkspaceGeneration } from './DaemonInvocationKind';
 import { DaemonProtocolError } from './DaemonProtocolError';
-import { validateRequestAdmission, validateRequestTerminal } from './RequestEnvelopeValidation';
+import { validateRequestHandling } from './RequestEnvelopeValidation';
 import { validateRequestId } from './RequestIdentifierValidation';
 import { validateRequestResultFields } from './RequestResultValidation';
 
@@ -33,8 +33,7 @@ export function validateRequestStartControl(payload: Record<string, unknown>): v
   requireString(payload.cwd, 'requestStart payload.cwd');
   requireStringArray(payload.argv, 'requestStart payload.argv');
   requireStringRecord(payload.environment, 'requestStart payload.environment');
-  validateRequestTerminal(payload.terminal);
-  validateRequestAdmission(payload.admission);
+  validateRequestHandling(payload);
 }
 
 /** Validates a request-cancel payload. @internal */
diff --git a/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts b/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts
index 1bf3a7f6be8..0a60e016341 100644
--- a/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts
@@ -8,8 +8,14 @@ import { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
 const FIRST_TERMINAL_COLUMN: number = 1;
 const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
 
-/** Validates request terminal fields. @internal */
-export function validateRequestTerminal(value: unknown): void {
+/** Validates the request's terminal, its admission and whether it may return early on failure. @internal */
+export function validateRequestHandling(payload: Record<string, unknown>): void {
+  validateRequestTerminal(payload.terminal);
+  validateRequestAdmission(payload.admission);
+  validateOptionalBoolean(payload.returnEarlyOnFailure, 'requestStart payload.returnEarlyOnFailure');
+}
+
+function validateRequestTerminal(value: unknown): void {
   const terminal: Record<string, unknown> = requireRecord(value, 'requestStart payload.terminal');
   requireBoolean(terminal.isTTY, 'Request terminal isTTY');
   requireBoolean(terminal.supportsColor, 'Request terminal supportsColor');
@@ -18,8 +24,7 @@ export function validateRequestTerminal(value: unknown): void {
   validateTerminalRequirement(terminal.terminalRequirement);
 }
 
-/** Validates request admission fields. @internal */
-export function validateRequestAdmission(value: unknown): void {
+function validateRequestAdmission(value: unknown): void {
   if (value === undefined) return;
   const admission: Record<string, unknown> = requireRecord(value, 'requestStart payload.admission');
   validateOptionalBoolean(admission.noWait, 'Request admission noWait');
diff --git a/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts b/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts
index 8f915ed159b..f5cd05acd5f 100644
--- a/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts
@@ -25,3 +25,13 @@ export function validateRequestLifecycleCapability(payload: Record<string, unkno
     );
   }
 }
+
+/** Validates optional negotiation of the `requestStarted` notice. @internal */
+export function validateRequestStartedCapability(payload: Record<string, unknown>): void {
+  if (payload.supportsRequestStarted !== undefined && typeof payload.supportsRequestStarted !== 'boolean') {
+    throw new DaemonProtocolError(
+      'malformedControlMessage',
+      'Subscribe message payload.supportsRequestStarted must be a boolean.'
+    );
+  }
+}
diff --git a/libraries/rush-daemon-protocol/src/RequestResultValidation.ts b/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
index ff6c8e6fb7c..69082193866 100644
--- a/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
@@ -3,6 +3,7 @@
 
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateRestartReason } from './InstallationChangeValidation';
 import { validateRestartResult } from './RestartResultValidation';
 
 const ADMISSION_ERROR_CODES: ReadonlySet<unknown> = new Set(['aborted', 'no-wait', 'wait-timeout']);
@@ -11,9 +12,11 @@ const EMPTY_STRING_LENGTH: number = 0;
 /** Validates optional global and phased result fields. @internal */
 export function validateRequestResultFields(payload: Record<string, unknown>): void {
   validateOptionalString(payload.errorMessage, 'errorMessage');
+  validateOptionalString(payload.usage, 'usage');
   validateAdmissionErrorCode(payload.admissionErrorCode);
   validatePhasedResultShape(payload);
   validateRestartResult(payload);
+  validateRestartReason(payload);
 }
 
 function validateAdmissionErrorCode(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts b/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts
index 493108f7299..826c9f9f385 100644
--- a/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts
@@ -7,7 +7,8 @@ import { validateInteractiveCapability } from './InteractiveControlValidation';
 import { validateRequestAdmissionCapability } from './RequestAdmissionControlValidation';
 import {
   validateInputLifecycleCapability,
-  validateRequestLifecycleCapability
+  validateRequestLifecycleCapability,
+  validateRequestStartedCapability
 } from './RequestLifecycleCapabilityValidation';
 
 export function validateSubscribeControl(payload: Record<string, unknown>): void {
@@ -21,6 +22,7 @@ export function validateSubscribeControl(payload: Record<string, unknown>): void
   validateInputLifecycleCapability(payload);
   validateRequestAdmissionCapability(payload);
   validateRequestLifecycleCapability(payload);
+  validateRequestStartedCapability(payload);
   requireSubscribeVerbosity(payload);
 }
 
diff --git a/libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts b/libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts
new file mode 100644
index 00000000000..a8b2dcbc46b
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts
@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const FILE_LIST_FIELDS: ReadonlyArray<string> = ['installationFiles', 'implementationFiles'];
+const EMPTY_LENGTH: number = 0;
+
+/** Validates the optional fields of a `workspaceInputsChanged` restart reason. @internal */
+export function validateWorkspaceInputsChange(reason: Record<string, unknown>): void {
+  for (const field of FILE_LIST_FIELDS) validateOptionalNames(reason[field], field);
+  validateOptionalVersion(reason.selectedRushVersion);
+}
+
+function validateOptionalVersion(value: unknown): void {
+  if (value !== undefined && !isNonEmptyString(value)) fail('selectedRushVersion');
+}
+
+function validateOptionalNames(value: unknown, field: string): void {
+  if (value !== undefined && !isNameList(value)) fail(field);
+}
+
+function isNameList(value: unknown): boolean {
+  return Array.isArray(value) && value.every(isNonEmptyString);
+}
+
+function isNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_LENGTH;
+}
+
+function fail(field: string): never {
+  throw new DaemonProtocolError('malformedControlMessage', `Invalid restartReason.${field}.`);
+}
diff --git a/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts b/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts
index c64e6155738..77988d5d097 100644
--- a/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts
+++ b/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { isDaemonContinuingOperations } from './ContinuingOperationsValidation';
 import { validateRequestId } from './RequestIdentifierValidation';
 import {
   failStatus,
@@ -23,6 +24,7 @@ export function validateWorkspaceStatus(value: unknown): void {
   validateGenerationToken(status);
   validateWarmGraph(status);
   validateWarmSetStatus(status.warmSet);
+  validateContinuingOperations(status.continuingOperations);
 }
 
 function validateReloadTier(value: unknown): void {
@@ -40,3 +42,7 @@ function validateGenerationToken(status: Record<string, unknown>): void {
 function validateWarmGraph(status: Record<string, unknown>): void {
   if (status.warmSet !== undefined && status.graphInitialized !== true) failStatus('warmSet');
 }
+
+function validateContinuingOperations(value: unknown): void {
+  if (value !== undefined && !isDaemonContinuingOperations(value)) failStatus('continuingOperations');
+}
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 15371633771..3b214b946a4 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -26,31 +26,27 @@ export { DAEMON_GRAPH_GENERATION_PROTOCOL_MINOR } from './DaemonProtocolVersion'
 export { DAEMON_INPUT_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_INTERACTIVE_IO_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_INVOCATION_KIND_PROTOCOL_MINOR } from './DaemonProtocolVersion';
-export { DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
+export { DAEMON_KEEPALIVE_PROTOCOL_MINOR, DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR, DAEMON_PROTOCOL_VERSION } from './DaemonProtocolVersion';
+export { DAEMON_REQUEST_STARTED_PROTOCOL_MINOR } from './DaemonProtocolVersion';
+export { DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from './DaemonProtocolVersion';
-export { isDaemonProtocolCompatible } from './DaemonProtocolVersion';
-export type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
+export { isDaemonProtocolCompatible, type IDaemonProtocolVersion } from './DaemonProtocolVersion';
 export type { IDaemonClientCaps } from './DaemonClientCaps';
 export { DAEMON_CONTROL_MESSAGE_KINDS, isDaemonControlMessageKind } from './DaemonControlKinds';
 export type { DaemonControlMessageKind } from './DaemonControlKinds';
 export type { DaemonControlMessage, DaemonEmptyPayload } from './DaemonControlMessage';
 export type { IDaemonErrorMessage, IDaemonHelloAckMessage } from './DaemonControlMessage';
-export type { IDaemonHelloMessage } from './DaemonControlMessage';
+export type { IDaemonHelloMessage, IDaemonUnsubscribeMessage } from './DaemonControlMessage';
 export type { IDaemonPingMessage, IDaemonSubscribeMessage } from './DaemonControlMessage';
-export type { IDaemonUnsubscribeMessage } from './DaemonControlMessage';
 export type { IDaemonRawModeChangedMessage, IDaemonSetRawModeMessage } from './DaemonInteractiveControl';
 export type { IDaemonStdinEndMessage, IDaemonStdinReadyMessage } from './DaemonInteractiveControl';
 export type { IDaemonTerminalPolicyMessage } from './DaemonInteractiveControl';
-export type { IDaemonPongMessage } from './DaemonPongMessage';
-export type {
-  IDaemonWarmProjectRank,
-  IDaemonWarmSetConfiguration,
-  IDaemonWarmSetStatus
-} from './DaemonWorkspaceStatus';
-export type { IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
+export type { IDaemonPingPayload, IDaemonPongMessage } from './DaemonPongMessage';
+export type { IDaemonWarmProjectRank, IDaemonWarmSetConfiguration } from './DaemonWorkspaceStatus';
+export type { IDaemonWarmSetStatus, IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
 export type { IDaemonShutdownAckMessage, IDaemonShutdownMessage } from './DaemonLifecycleControl';
 export { isDaemonControlRecord } from './ControlRecord';
 export { validateDaemonControlMessage } from './ControlMessageValidation';
@@ -60,21 +56,26 @@ export { createDaemonHello, createDaemonHelloAck, negotiateDaemonHello } from '.
 export type { DaemonHandshakeOutcome } from './DaemonHandshake';
 export type { DaemonJsonNull, DaemonJsonValue } from './DaemonJsonValue';
 export type { DaemonCommandOutcome, IDaemonCommandResult } from './DaemonCommandResult';
+export type { DaemonInstallationChangeKind, IDaemonInstallationChange } from './DaemonInstallationChange';
+export type { DaemonRestartReason, IDaemonNativeMutationRestartReason } from './DaemonInstallationChange';
+export type { IDaemonInstallationChangedRestartReason } from './DaemonInstallationChange';
+export type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
+export type { IDaemonWorkspaceInputsChangedRestartReason } from './DaemonWorkspaceInputsChange';
 export { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
-export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
+export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmissionValidation';
 export type { DaemonRequestRejectionCode, IDaemonRequestCancelMessage } from './DaemonRequestControl';
 export type { IDaemonRequestRejectedMessage, IDaemonRequestResultMessage } from './DaemonRequestControl';
-export type { IDaemonRequestStartMessage } from './DaemonRequestControl';
+export type { IDaemonRequestStartedMessage, IDaemonRequestStartMessage } from './DaemonRequestControl';
 export type { IDaemonRequestEnvelope, IDaemonRequestTerminal } from './DaemonRequestEnvelope';
 export type { DaemonInvocationKind } from './DaemonInvocationKind';
 export type { DaemonRequestAdmissionErrorCode } from './DaemonRequestAdmission';
-export type { IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
+export type { IDaemonContinuingOperations, IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { IDaemonRequestQueuePositionMessage } from './DaemonRequestAdmission';
+export type { IDaemonNativeLockHolder } from './DaemonNativeLockHolder';
 export type { DaemonRushCommandOrigin } from './DaemonRushCommand';
-export { RUSHD_GRAPH_SNAPSHOT } from './DaemonGraphSnapshot';
+export { RUSHD_GRAPH_SNAPSHOT, type IDaemonUninitializedGraphSnapshot } from './DaemonGraphSnapshot';
 export type { IDaemonGraphInvalidations, IDaemonGraphOperation } from './DaemonGraphSnapshot';
 export type { IDaemonGraphSnapshotPayload, IDaemonInitializedGraphSnapshot } from './DaemonGraphSnapshot';
-export type { IDaemonUninitializedGraphSnapshot } from './DaemonGraphSnapshot';
 export type { DaemonTerminalPolicyDecision, DaemonTerminalPolicyReason } from './DaemonTerminalPolicy';
 export type { DaemonTerminalRequirement, IDaemonTerminalPolicyResult } from './DaemonTerminalPolicy';
 export { decodeDaemonStdinChunk, encodeDaemonStdinChunk, type IDaemonStdinChunk } from './StdinFrameCodec';
@@ -83,8 +84,7 @@ export type { DaemonEventPrivacy, IDaemonEventEnvelope, IDaemonEventScope } from
 export type { IDaemonEventSource } from './DaemonEventEnvelope';
 export { isDaemonEventEnvelope, validateDaemonEventEnvelope } from './DaemonEventValidation';
 export { isDaemonExtensionEventName, isRushdExtensionEventName } from './DaemonExtensionEventName';
-export { RUSHD_EXTENSION_NAMESPACE } from './DaemonExtensionEventName';
-export type { DaemonExtensionEventName } from './DaemonExtensionEventName';
+export { RUSHD_EXTENSION_NAMESPACE, type DaemonExtensionEventName } from './DaemonExtensionEventName';
 export { compareDaemonVerbosity, isDaemonVerbosity, type DaemonVerbosity } from './DaemonVerbosity';
 export { shouldSerializeDaemonEvent } from './DaemonVerbosityFilter';
 export type { DaemonDiagnosticSeverity, IDaemonDiagnosticPayload } from './DaemonVerbosityFilter';
diff --git a/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts b/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
new file mode 100644
index 00000000000..d86d65f3baa
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+import { statusFrame, workspaceStatus } from './WorkspaceStatusTestData';
+
+const FIRST_POSITION: number = 1;
+const REQUEST_ID: string = 'waits-for-continuing-work';
+
+const WELL_FORMED: ReadonlyArray<unknown> = [
+  { count: 1, names: ['a (build)'] },
+  { count: 5, names: ['a (build)', 'b (build)', 'c (build)'] },
+  { count: 2, names: [] },
+  { count: 1, names: ['a (build)'], stopping: true },
+  { count: 1, names: ['a (build)'], stopping: false }
+];
+
+const MALFORMED: ReadonlyArray<unknown> = [
+  null,
+  [],
+  'a (build)',
+  { names: [] },
+  { count: 0, names: [] },
+  { count: 1.5, names: [] },
+  { count: '2', names: [] },
+  { count: 1 },
+  { count: 1, names: 'a (build)' },
+  { count: 1, names: ['a (build)', 'b (build)'] },
+  { count: 1, names: [''] },
+  { count: 1, names: [{ name: 'a (build)' }] },
+  { count: 1, names: [], stopping: 'yes' },
+  { count: 1, names: [], stopping: null }
+];
+
+function queuePositionFrame(continuingOperations: unknown): Uint8Array {
+  const payload: object = { position: FIRST_POSITION, requestId: REQUEST_ID, continuingOperations };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+function continuingStatusFrame(continuingOperations: unknown): Uint8Array {
+  return statusFrame({ ...workspaceStatus(), continuingOperations });
+}
+
+it.each(WELL_FORMED)('round-trips a queue position behind continuing operations %j', (value: unknown) => {
+  const frame: Uint8Array = queuePositionFrame(value);
+  expect(encodeDaemonControlMessage(decodeDaemonControlMessage(frame))).toEqual(frame);
+});
+
+it.each(WELL_FORMED)('round-trips a workspace status with continuing operations %j', (value: unknown) => {
+  const frame: Uint8Array = continuingStatusFrame(value);
+  expect(encodeDaemonControlMessage(decodeDaemonControlMessage(frame))).toEqual(frame);
+});
+
+it.each(MALFORMED)('rejects a queue position with malformed continuing operations %j', (value: unknown) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame(value))).toThrow(/continuingOperations/);
+});
+
+it.each(MALFORMED)('rejects a workspace status with malformed continuing operations %j', (value: unknown) => {
+  expect(() => decodeDaemonControlMessage(continuingStatusFrame(value))).toThrow(/continuingOperations/);
+});
diff --git a/libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts b/libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts
new file mode 100644
index 00000000000..775d5945091
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { IDaemonCommandResult } from '../DaemonCommandResult';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonEnvironmentChangedRestartReason } from '../DaemonEnvironmentChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FAILURE_EXIT_CODE: number = 1;
+const FIRST_POSITION: number = 1;
+const NOT_A_NAME: number = 7;
+const QUEUED_REQUEST_ID: string = 'queued-before-restart';
+const REASON: IDaemonEnvironmentChangedRestartReason = {
+  kind: 'environmentChanged',
+  variableNames: ['FOO', 'NODE_OPTIONS']
+};
+const RESULT: IDaemonCommandResult = {
+  aborted: false,
+  exitCode: FAILURE_EXIT_CODE,
+  outcome: 'failure',
+  requestId: 'environment',
+  retryAfterRestart: true,
+  restartReason: REASON
+};
+
+function resultFrame(restartReason: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({ kind: 'requestResult', payload: { ...RESULT, restartReason } })
+  );
+}
+
+function queuePositionFrame(restartReason: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({
+      kind: 'queuePosition',
+      payload: { position: FIRST_POSITION, requestId: QUEUED_REQUEST_ID, restartReason }
+    })
+  );
+}
+
+it('round-trips a restart result that names the variables that differ', () => {
+  const message: DaemonControlMessage = { kind: 'requestResult', payload: RESULT };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('round-trips a queue position whose restart is for an environment', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: { position: FIRST_POSITION, requestId: QUEUED_REQUEST_ID, restartReason: REASON }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('accepts an environment reason that names no variables', () => {
+  const restartReason: object = { kind: 'environmentChanged', variableNames: [] };
+  expect(decodeDaemonControlMessage(resultFrame(restartReason))).toMatchObject({
+    payload: { restartReason }
+  });
+});
+
+const MALFORMED_REASONS: object[] = [
+  { kind: 'environmentChanged' },
+  { kind: 'environmentChanged', variableNames: null },
+  { kind: 'environmentChanged', variableNames: 'NODE_OPTIONS' },
+  { kind: 'environmentChanged', variableNames: [''] },
+  { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS', NOT_A_NAME] }
+];
+
+it.each(MALFORMED_REASONS)('rejects a restart result whose environment reason is %j', (reason: object) => {
+  expect(() => decodeDaemonControlMessage(resultFrame(reason))).toThrow(/restartReason\.variableNames/);
+});
+
+it.each(MALFORMED_REASONS)('rejects a queue position whose environment reason is %j', (reason: object) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame(reason))).toThrow(
+    /restartReason\.variableNames/
+  );
+});
diff --git a/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts b/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
new file mode 100644
index 00000000000..380b8d09f74
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { IDaemonCommandResult } from '../DaemonCommandResult';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonInstallationChange } from '../DaemonInstallationChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FAILURE_EXIT_CODE: number = 1;
+const ZERO: number = 0;
+const CHANGE: IDaemonInstallationChange = { change: 'removed', folder: '/snapshots/s9' };
+const RESULT: IDaemonCommandResult = {
+  aborted: false,
+  exitCode: FAILURE_EXIT_CODE,
+  outcome: 'failure',
+  requestId: 'installation',
+  retryAfterRestart: true,
+  restartReason: { kind: 'installationChanged', ...CHANGE }
+};
+
+function resultFrame(payload: object): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'requestResult', payload }));
+}
+
+function pongFrame(installationChange: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({ kind: 'pong', payload: { uptimeMs: ZERO, installationChange } })
+  );
+}
+
+it('round-trips a restart result that names the changed installation', () => {
+  const message: DaemonControlMessage = { kind: 'requestResult', payload: RESULT };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('accepts a restart reason kind from a newer daemon', () => {
+  const payload: object = {
+    ...RESULT,
+    restartReason: { kind: 'newerReason', detail: ['NODE_OPTIONS'] }
+  };
+  expect(decodeDaemonControlMessage(resultFrame(payload))).toMatchObject({ payload });
+});
+
+it.each([
+  { restartReason: null },
+  { restartReason: 'installationChanged' },
+  { restartReason: [] },
+  { restartReason: { kind: '' } },
+  { restartReason: { ...CHANGE } },
+  { restartReason: { kind: 'installationChanged', change: 'moved', folder: CHANGE.folder } },
+  { restartReason: { kind: 'installationChanged', change: 'removed', folder: '' } },
+  { restartReason: { kind: 'installationChanged', change: 'removed' } },
+  { retryAfterRestart: undefined, exitCode: ZERO, outcome: 'success' }
+])('rejects a malformed restart reason %j', (override: object) => {
+  expect(() => decodeDaemonControlMessage(resultFrame({ ...RESULT, ...override }))).toThrow();
+});
+
+it.each([undefined, CHANGE, { change: 'replaced', folder: '/snapshots/s9/libraries' }])(
+  'round-trips an optional pong installation change %j',
+  (installationChange: unknown) => {
+    const frame: Uint8Array = pongFrame(installationChange);
+    expect(encodeDaemonControlMessage(decodeDaemonControlMessage(frame))).toEqual(frame);
+  }
+);
+
+it.each([null, [], {}, { change: 'moved', folder: '/x' }, { change: 'removed', folder: ZERO }])(
+  'rejects a malformed pong installation change %j',
+  (installationChange: unknown) => {
+    expect(() => decodeDaemonControlMessage(pongFrame(installationChange))).toThrow(/installationChange/);
+  }
+);
diff --git a/libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts b/libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts
new file mode 100644
index 00000000000..e8b9b205b8b
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FIRST_POSITION: number = 1;
+const HOLDER_PID: number = 4242;
+const REQUEST_ID: string = 'waits-for-native-rush';
+
+function queuePositionFrame(fields: object): Uint8Array {
+  const payload: object = { position: FIRST_POSITION, requestId: REQUEST_ID, ...fields };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+it('round-trips a queue position that waits for a native Rush process to release the repository lock', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: {
+      position: FIRST_POSITION,
+      requestId: REQUEST_ID,
+      nativeLockHolder: { pid: HOLDER_PID, command: 'rush install' }
+    }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it.each([{}, { pid: HOLDER_PID }, { command: 'rush build' }])(
+  'accepts a native lock holder whose pid or command is unknown %j',
+  (nativeLockHolder: object) => {
+    expect(decodeDaemonControlMessage(queuePositionFrame({ nativeLockHolder }))).toMatchObject({
+      payload: { nativeLockHolder }
+    });
+  }
+);
+
+it.each([
+  null,
+  'rush install',
+  [HOLDER_PID],
+  { pid: 0 },
+  { pid: -1 },
+  { pid: 1.5 },
+  { pid: '4242' },
+  { command: HOLDER_PID },
+  { command: '' }
+])('rejects a malformed native lock holder %j', (nativeLockHolder: unknown) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ nativeLockHolder }))).toThrow(
+    /nativeLockHolder/
+  );
+});
diff --git a/libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts
new file mode 100644
index 00000000000..95ed38eeaff
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts
@@ -0,0 +1,45 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonNativeMutationRestartReason } from '../DaemonInstallationChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const POSITION: number = 2;
+const SCRIPT_COUNT: number = 1;
+const NOT_A_NAME: number = 1;
+const REQUEST_ID: string = 'waits-behind-install';
+const REASON: IDaemonNativeMutationRestartReason = { kind: 'nativeMutation', commandName: 'install' };
+
+function queuePositionFrame(fields: object): Uint8Array {
+  const payload: object = { position: POSITION, requestId: REQUEST_ID, ...fields };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+it('round-trips a request that waits behind a native install while the install waits for rushx scripts', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: {
+      position: POSITION,
+      requestId: REQUEST_ID,
+      restartReason: REASON,
+      scriptCount: SCRIPT_COUNT,
+      restartsForAnotherRequest: true
+    }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it.each([
+  {},
+  { commandName: '' },
+  { commandName: NOT_A_NAME },
+  { commandName: null },
+  { commandName: ['install'] }
+])('rejects a native mutation reason without a command name: %j', (fields: object) => {
+  const restartReason: object = { kind: 'nativeMutation', ...fields };
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ restartReason }))).toThrow(
+    'Invalid restartReason.commandName.'
+  );
+});
diff --git a/libraries/rush-daemon-protocol/src/test/PingPayload.test.ts b/libraries/rush-daemon-protocol/src/test/PingPayload.test.ts
new file mode 100644
index 00000000000..9798923b64b
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/PingPayload.test.ts
@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonPingPayload } from '../DaemonPongMessage';
+
+import { captureProtocolError } from './TestVectors';
+
+it.each<IDaemonPingPayload>([{}, { omitWarmSet: true }, { omitWarmSet: false }])(
+  'round-trips a ping whose payload is %j',
+  (payload: IDaemonPingPayload) => {
+    const message: DaemonControlMessage = { kind: 'ping', payload };
+    expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+  }
+);
+
+it('rejects a ping whose omitWarmSet is not a boolean', () => {
+  const error: ReturnType<typeof captureProtocolError> = captureProtocolError(() =>
+    decodeDaemonControlMessage(Buffer.from('{"kind":"ping","payload":{"omitWarmSet":"yes"}}'))
+  );
+  expect(error.code).toBe('malformedControlMessage');
+});
diff --git a/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
new file mode 100644
index 00000000000..b694c303a5b
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { DaemonRestartReason } from '../DaemonInstallationChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FIRST_POSITION: number = 1;
+const REQUEST_ID: string = 'queued-before-restart';
+const REASON: DaemonRestartReason = {
+  kind: 'installationChanged',
+  change: 'removed',
+  folder: '/snapshots/s9'
+};
+
+function queuePositionFrame(restartReason: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({
+      kind: 'queuePosition',
+      payload: { position: FIRST_POSITION, requestId: REQUEST_ID, restartReason }
+    })
+  );
+}
+
+it('round-trips a queue position that says the daemon restarts once the requests ahead finish', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: { position: FIRST_POSITION, requestId: REQUEST_ID, restartReason: REASON }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('accepts a queued restart reason kind from a newer daemon', () => {
+  const restartReason: object = { kind: 'newerReason', detail: ['NODE_OPTIONS'] };
+  expect(decodeDaemonControlMessage(queuePositionFrame(restartReason))).toMatchObject({
+    payload: { restartReason }
+  });
+});
+
+it.each([
+  null,
+  'installationChanged',
+  [],
+  { kind: '' },
+  { change: 'removed', folder: '/x' },
+  { kind: 'installationChanged', change: 'moved', folder: '/x' },
+  { kind: 'installationChanged', change: 'removed', folder: '' }
+])('rejects a malformed queued restart reason %j', (restartReason: unknown) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame(restartReason))).toThrow(/restartReason/);
+});
diff --git a/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts b/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts
index c36e1857af2..53c1e7df8ba 100644
--- a/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts
@@ -1,10 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import {
-  MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS,
-  validateDaemonRequestAdmissionOptions
-} from '../DaemonRequestAdmission';
+import { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from '../DaemonRequestAdmission';
+import { validateDaemonRequestAdmissionOptions } from '../DaemonRequestAdmissionValidation';
 
 const OUT_OF_RANGE_INCREMENT: number = 1;
 
diff --git a/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts b/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts
index aa0f162d678..9ebfaee8b75 100644
--- a/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts
@@ -11,11 +11,13 @@ const BASE_RESULT: IDaemonCommandResult = {
   outcome: 'success',
   requestId: 'request'
 };
+const NATIVE_USAGE_EXIT_CODE: number = 2;
 
 it.each([
   ['negative exit code', { ...BASE_RESULT, exitCode: -1 }],
   ['unknown admission error', { ...BASE_RESULT, admissionErrorCode: 'later' }],
   ['non-string error', { ...BASE_RESULT, errorMessage: false }],
+  ['non-string usage', { ...BASE_RESULT, usage: false }],
   ['partial phased result', { ...BASE_RESULT, scheduled: true }],
   [
     'malformed operation result',
@@ -38,3 +40,17 @@ it('accepts a complete phased request result', () => {
   };
   expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
 });
+
+it('accepts a failed request result with the usage of its command', () => {
+  const message: DaemonControlMessage = {
+    kind: 'requestResult',
+    payload: {
+      ...BASE_RESULT,
+      exitCode: NATIVE_USAGE_EXIT_CODE,
+      outcome: 'failure',
+      errorMessage: 'rush build: error: Unrecognized arguments: --nope.',
+      usage: 'usage: rush build [-h] [-t PROJECT]\n'
+    }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
diff --git a/libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts b/libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts
new file mode 100644
index 00000000000..449ece70f27
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { IDaemonRequestStartMessage } from '../DaemonRequestControl';
+
+const NUMBER_FLAG: number = 1;
+
+function createRequestStart(returnEarlyOnFailure: unknown): IDaemonRequestStartMessage {
+  return {
+    kind: 'requestStart',
+    payload: {
+      argv: ['build', '--to', 'project-a'],
+      commandName: 'build',
+      commandOrigin: 'built-in',
+      cwd: '/repo',
+      environment: {},
+      requestId: 'early-failure-request',
+      returnEarlyOnFailure: returnEarlyOnFailure as boolean | undefined,
+      terminal: { isTTY: false, supportsColor: false }
+    }
+  };
+}
+
+function roundTrip(message: IDaemonRequestStartMessage): unknown {
+  return decodeDaemonControlMessage(encodeDaemonControlMessage(message));
+}
+
+it.each([true, false, undefined])('round-trips returnEarlyOnFailure %p', (value: boolean | undefined) => {
+  expect(roundTrip(createRequestStart(value))).toEqual(createRequestStart(value));
+});
+
+it.each(['true', NUMBER_FLAG, null])('rejects a non-boolean returnEarlyOnFailure %p', (value: unknown) => {
+  expect(() => roundTrip(createRequestStart(value))).toThrow(
+    'requestStart payload.returnEarlyOnFailure must be a boolean.'
+  );
+});
diff --git a/libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts b/libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts
new file mode 100644
index 00000000000..a96d5c193df
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts
@@ -0,0 +1,48 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import { validateDaemonControlMessage } from '../ControlMessageValidation';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import {
+  DAEMON_KEEPALIVE_PROTOCOL_MINOR,
+  DAEMON_PROTOCOL_VERSION,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR
+} from '../DaemonProtocolVersion';
+
+const REQUEST_ID: string = 'started-request';
+
+it('is a minor after keepalive, and the one this package implements', () => {
+  expect(DAEMON_REQUEST_STARTED_PROTOCOL_MINOR).toBeGreaterThan(DAEMON_KEEPALIVE_PROTOCOL_MINOR);
+  expect(DAEMON_PROTOCOL_VERSION.minor).toBe(DAEMON_REQUEST_STARTED_PROTOCOL_MINOR);
+});
+
+it('round-trips requestStarted', () => {
+  const message: DaemonControlMessage = { kind: 'requestStarted', payload: { requestId: REQUEST_ID } };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('requires a valid request identifier for requestStarted', () => {
+  const kind: string = 'requestStarted';
+  expect(() => validateDaemonControlMessage({ kind, payload: {} })).toThrow();
+  expect(() => validateDaemonControlMessage({ kind, payload: { requestId: '' } })).toThrow();
+  expect(() => validateDaemonControlMessage({ kind, payload: { requestId: ' invalid ' } })).toThrow();
+});
+
+it.each([true, false, undefined])('accepts the requestStarted capability %s', (supportsRequestStarted) => {
+  expect(() =>
+    validateDaemonControlMessage({
+      kind: 'subscribe',
+      payload: { isTTY: false, supportsRequestStarted }
+    })
+  ).not.toThrow();
+});
+
+it('rejects an invalid requestStarted capability', () => {
+  expect(() =>
+    validateDaemonControlMessage({
+      kind: 'subscribe',
+      payload: { isTTY: false, supportsRequestStarted: 'yes' }
+    })
+  ).toThrow('supportsRequestStarted');
+});
diff --git a/libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts
new file mode 100644
index 00000000000..d74fc3d8cdc
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts
@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+import type { IDaemonWorkspaceInputsChangedRestartReason } from '../DaemonWorkspaceInputsChange';
+
+const FAILURE_EXIT_CODE: number = 1;
+const POSITION: number = 2;
+const SCRIPT_COUNT: number = 1;
+const NO_SCRIPTS: number = 0;
+const FRACTIONAL_COUNT: number = 1.5;
+const NEGATIVE_COUNT: number = -1;
+const REQUEST_ID: string = 'waits-for-inputs';
+const REASON: IDaemonWorkspaceInputsChangedRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml'],
+  implementationFiles: ['common/autoinstallers/plugins/node_modules/p/lib/index.js'],
+  selectedRushVersion: '5.180.0'
+};
+
+function roundTrip(message: DaemonControlMessage): unknown {
+  return decodeDaemonControlMessage(encodeDaemonControlMessage(message));
+}
+
+function queuePositionFrame(fields: object): Uint8Array {
+  const payload: object = { position: POSITION, requestId: REQUEST_ID, ...fields };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+it('round-trips a queue position that waits for a restart for changed workspace inputs', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: { position: POSITION, requestId: REQUEST_ID, restartReason: REASON, scriptCount: SCRIPT_COUNT }
+  };
+  expect(roundTrip(message)).toEqual(message);
+});
+
+it('round-trips a rushx script that waits for another request restart', () => {
+  const restartReason: IDaemonWorkspaceInputsChangedRestartReason = { kind: 'workspaceInputsChanged' };
+  const payload: object = { restartReason, restartsForAnotherRequest: true, scriptCount: NO_SCRIPTS };
+  expect(decodeDaemonControlMessage(queuePositionFrame(payload))).toMatchObject({ payload });
+});
+
+it('round-trips a restart result for changed workspace inputs', () => {
+  const message: DaemonControlMessage = {
+    kind: 'requestResult',
+    payload: {
+      aborted: false,
+      exitCode: FAILURE_EXIT_CODE,
+      outcome: 'failure',
+      requestId: REQUEST_ID,
+      restartReason: REASON,
+      retryAfterRestart: true
+    }
+  };
+  expect(roundTrip(message)).toEqual(message);
+});
+
+it.each([
+  { installationFiles: 'common/config/rush/pnpm-lock.yaml' },
+  { implementationFiles: [''] },
+  { installationFiles: [FAILURE_EXIT_CODE] },
+  { implementationFiles: null },
+  { selectedRushVersion: '' },
+  { selectedRushVersion: [] }
+])('rejects a malformed workspace inputs reason %j', (fields: object) => {
+  const restartReason: object = { kind: 'workspaceInputsChanged', ...fields };
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ restartReason }))).toThrow(/restartReason/);
+});
+
+it.each([
+  { scriptCount: NEGATIVE_COUNT },
+  { scriptCount: FRACTIONAL_COUNT },
+  { scriptCount: '1' },
+  { restartsForAnotherRequest: 'yes' }
+])('rejects a malformed restart wait %j', (fields: object) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ restartReason: REASON, ...fields }))).toThrow(
+    /scriptCount|restartsForAnotherRequest/
+  );
+});
diff --git a/libraries/rush-daemon-transport/README.md b/libraries/rush-daemon-transport/README.md
index 4abb9d30ef7..cce199505cd 100644
--- a/libraries/rush-daemon-transport/README.md
+++ b/libraries/rush-daemon-transport/README.md
@@ -7,17 +7,39 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
 - **Workspace keys** — `sha256(canonicalRepoRoot + rushVersion + startupOptions)`, so distinct
   workspaces, Rush versions, or startup options resolve to distinct daemon endpoints while the
   same workspace stays stable across runs.
-- **Per-user path derivation** — `$XDG_RUNTIME_DIR`-aware Unix domain sockets on POSIX and
-  `\\.\pipe\rushd-<key>` named pipes on Windows.
+- **Per-user path derivation** — Unix domain sockets in `/tmp/rushd-<uid>/` on POSIX, or in
+  `$RUSHD_RUNTIME_DIR/rushd-<uid>/` when that variable is an absolute path, and
+  `\\.\pipe\rushd-<key>` named pipes on Windows. `TMPDIR` and `XDG_RUNTIME_DIR` are not
+  consulted, because they differ between the shells, jobs and services of one user. A daemon
+  resolves its paths with the same rule, and a client that starts one passes the folder it
+  chose as `RUSHD_RUNTIME_DIR`. The folder must be a directory (not a symbolic link) that the
+  user owns; one that others can open is made owner-only (`0700`). The socket path must fit in
+  a socket address, at most 108 bytes on Linux and 104 on other POSIX platforms, because Node.js
+  silently truncates a longer one; a longer path is refused with `socketPathTooLong` before the
+  folder is checked or created.
 - **`net` listener and connector** — framed with
   [`@rushstack/rush-daemon-protocol`](https://www.npmjs.com/package/@rushstack/rush-daemon-protocol),
   with backpressure-aware writes and serialized async frame handlers for inbound flow control.
+  `sendFrameWrittenAsync` resolves only once the operating system holds the frame, so the peer
+  can read it even if this process exits next. The socket is paused while a handler runs, and a
+  failed write or a reset from the peer discards the bytes that wait in its buffer;
+  `closedAfterReadingAll` says whether a closed connection read every byte that the peer sent.
 - **PID/lockfile handling** — stale sockets and dead PIDs are detected (two-factor: PID liveness
-  plus a connect probe) and reclaimed without manual cleanup.
+  plus a connect probe) and reclaimed without manual cleanup. On Linux, a reclaim first stops the
+  operations that the dead daemon left running. Both `reclaimStaleDaemonAsync` and
+  `DaemonFrameListener.listenAsync` report each set of stopped process groups to `onOrphansReaped`,
+  or, without it, as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. A recorded operation group
+  that the reclaim cannot prove is still the dead daemon's gets no signal. When such a group still
+  has a live process, it is passed to `onOperationGroupLeftRunning`, if given, with the first check
+  it failed; `formatOperationGroupLeftRunning` describes it in one line.
 - **Two-phase shutdown** — `stopAcceptingAsync()` stops admission and waits for connections while
   retaining ownership. Hosts release the endpoint with `closeAsync()` after their resources have
   finished disposing. A live owner prevents rebinding even when its socket has already closed;
   repeated closes cannot remove a successor's endpoint.
+- **Owner-safe publication** — a listener binds a private name and hard-links it to the socket
+  path, so it never replaces a live peer's socket; the runtime folder's file system must support
+  hard links. On close it removes the socket and ownership record only while they are still the
+  files it created, so a predecessor that shuts down late never removes a successor's endpoint.
 
 Part of the Rush 6 / rushd re-architecture:
 [microsoft/rushstack#5894](https://github.com/microsoft/rushstack/issues/5894).
diff --git a/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
new file mode 100644
index 00000000000..2435ddd1bf5
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as net from 'node:net';
+
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+/**
+ * Waits until a socket whose `write()` returned `false` has written what it buffered.
+ * @remarks
+ * `'drain'` alone can wait forever. A socket that is ending, as the daemon's side is once its peer
+ * half-closes, finishes writing without a `'drain'`, and a socket destroyed without an error emits no
+ * `'error'`. So `'finish'` resolves too, `'error'` rejects with its error, and a `'close'` that comes
+ * first rejects with `transportClosed`.
+ *
+ * The socket must not have closed before the write. A write to a closed socket returns `false` and
+ * emits nothing more, so this would wait for a `'close'` that has already happened.
+ * `DaemonFrameConnection` checks `socket.closed` before it writes.
+ * @internal
+ */
+export function waitForBufferedWriteAsync(socket: net.Socket): Promise<void> {
+  return new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+    function settle(error: Error | undefined): void {
+      socket.off('drain', onWritten).off('finish', onWritten).off('close', onClosed).off('error', settle);
+      if (error === undefined) {
+        resolve();
+      } else {
+        reject(error);
+      }
+    }
+    function onWritten(): void {
+      settle(undefined);
+    }
+    function onClosed(): void {
+      settle(
+        new DaemonTransportError(
+          DaemonTransportErrorCode.transportClosed,
+          'The connection closed before it wrote a frame.'
+        )
+      );
+    }
+    socket.on('drain', onWritten).on('finish', onWritten).on('close', onClosed).on('error', settle);
+  });
+}
+
+/**
+ * Writes bytes and waits for the socket's write callback, which runs once the operating system holds all of
+ * them, after every earlier write.
+ * @remarks
+ * Rejects with the socket's error when the write fails, as it does on a socket that has already closed.
+ * @internal
+ */
+export function writeUntilWrittenAsync(socket: net.Socket, bytes: Uint8Array): Promise<void> {
+  return new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+    socket.write(bytes, (error: Error | null | undefined) => (error ? reject(error) : resolve()));
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonExitRelease.ts b/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
new file mode 100644
index 00000000000..5ae80b40fb9
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsFolder, readOperationGroupRecords } from './DaemonOperationGroups';
+import type { IDaemonPaths } from './DaemonPaths';
+import { listLiveGroupMembers } from './DaemonProcessList';
+import type { IProcessStat } from './DaemonProcessStat';
+
+const NO_RECORDS: number = 0;
+
+function isOtherProcess(stat: IProcessStat): boolean {
+  return stat.pid !== process.pid;
+}
+
+/**
+ * Whether this daemon process has children that a successor must reap if it exits without joining them: a
+ * recorded operation group that still runs, or another live member of the daemon's own process group.
+ *
+ * @remarks
+ * Linux only, like the records it reads. Elsewhere it finds none.
+ */
+export function hasProcessesToReap(paths: IDaemonPaths): boolean {
+  const folder: string = getOperationGroupsFolder(paths.lockfilePath, process.pid);
+  return (
+    readOperationGroupRecords(folder).length > NO_RECORDS ||
+    listLiveGroupMembers(process.pid).some(isOtherProcess)
+  );
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFileChange.ts b/libraries/rush-daemon-transport/src/DaemonFileChange.ts
new file mode 100644
index 00000000000..6dbaab78cf3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonFileChange.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { readFileIdentity } from './DaemonFileIdentity';
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
+
+/**
+ * How the file at a path differs from the file that this process created there: `removed` when nothing has
+ * the name any more, `replaced` when another file has it.
+ *
+ * @beta
+ */
+export type DaemonFileChange = 'removed' | 'replaced';
+
+const REMOVED: DaemonFileChange = 'removed';
+const REPLACED: DaemonFileChange = 'replaced';
+
+interface IFileIdentityRead {
+  /** False when the path could not be read for a reason that says nothing about the file. */
+  readonly known: boolean;
+  readonly identity?: IDaemonFileIdentity;
+}
+
+function readIdentity(filePath: string): IFileIdentityRead {
+  try {
+    return { known: true, identity: readFileIdentity(filePath) };
+  } catch {
+    return { known: false };
+  }
+}
+
+function isSameFile(current: IDaemonFileIdentity, expected: IDaemonFileIdentity): boolean {
+  return current.dev === expected.dev && current.ino === expected.ino;
+}
+
+function compareIdentity(
+  current: IDaemonFileIdentity | undefined,
+  expected: IDaemonFileIdentity
+): DaemonFileChange | undefined {
+  if (!current) return REMOVED;
+  return isSameFile(current, expected) ? undefined : REPLACED;
+}
+
+/**
+ * Compares the file at `filePath` with `expected`, the identity of the file this process created there.
+ * @returns `undefined` while it is the same file, and also when the path cannot be read for another reason
+ * (for example permissions), since that is no evidence that the file changed.
+ */
+export function compareFileIdentity(
+  filePath: string,
+  expected: IDaemonFileIdentity
+): DaemonFileChange | undefined {
+  const read: IFileIdentityRead = readIdentity(filePath);
+  return read.known ? compareIdentity(read.identity, expected) : undefined;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
new file mode 100644
index 00000000000..c6db7f83cce
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
@@ -0,0 +1,91 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { unlinkIfPresent } from './DaemonUnlink';
+
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+const READ_ONLY: string = 'r';
+const NOT_A_DIRECTORY: string = 'ENOTDIR';
+
+/** The device and inode of a file that this process created. */
+export interface IDaemonFileIdentity {
+  readonly dev: number;
+  readonly ino: number;
+  /** An open descriptor that keeps the inode in use, so no later file can get its number (POSIX only). */
+  readonly fd?: number;
+}
+
+/**
+ * Every stat here uses `{ bigint: true }`, which fills a stat array of its own. A plain stat of a socket leaves
+ * the socket's type in the array that Node 22's cached `fs.realpathSync` reads (nodejs/node#65113), and the next
+ * `require()` in the process could then load a package through its symbolic link. Pinned and read identities
+ * are converted the same way, so they compare equal.
+ */
+function toIdentity(stats: fs.BigIntStats): IDaemonFileIdentity {
+  return { dev: Number(stats.dev), ino: Number(stats.ino) };
+}
+
+function lstatIfPresent(filePath: string): fs.BigIntStats | undefined {
+  try {
+    return fs.lstatSync(filePath, { bigint: true, throwIfNoEntry: false });
+  } catch (error) {
+    // A folder on the path that became a file leaves nothing at the path, as a deletion does.
+    if ((error as NodeJS.ErrnoException).code !== NOT_A_DIRECTORY) throw error;
+    return undefined;
+  }
+}
+
+/** The identity of the file (not a link target) at `filePath`, or `undefined` when nothing is there. */
+export function readFileIdentity(filePath: string): IDaemonFileIdentity | undefined {
+  const stats: fs.BigIntStats | undefined = lstatIfPresent(filePath);
+  return stats && toIdentity(stats);
+}
+
+/** The identity of the file (not a link target) at `filePath`. Throws when nothing is there. */
+export function getFileIdentity(filePath: string): IDaemonFileIdentity {
+  return toIdentity(fs.lstatSync(filePath, { bigint: true }));
+}
+
+/**
+ * Returns the identity of the file that this process just wrote at `filePath`, and holds it open on POSIX.
+ *
+ * @remarks
+ * XFS and ext4 give a deleted file's inode number to the next file created, which could then pass for this one
+ * in {@link removeOwnFile}. The open descriptor keeps the inode in use until {@link removeOwnFile} releases it.
+ * An NTFS file id includes a sequence number that changes on reuse, so Windows needs no descriptor.
+ */
+export function pinFileIdentity(filePath: string): IDaemonFileIdentity {
+  const fd: number = fs.openSync(filePath, READ_ONLY);
+  const identity: IDaemonFileIdentity = toIdentity(fs.fstatSync(fd, { bigint: true }));
+  if (process.platform !== WINDOWS_PLATFORM) return { ...identity, fd };
+  fs.closeSync(fd);
+  return identity;
+}
+
+function isSameFile(current: IDaemonFileIdentity | undefined, expected: IDaemonFileIdentity): boolean {
+  if (!current) return false;
+  return current.dev === expected.dev && current.ino === expected.ino;
+}
+
+function release(identity: IDaemonFileIdentity): void {
+  if (identity.fd !== undefined) fs.closeSync(identity.fd);
+}
+
+/**
+ * Deletes `filePath` only while it is still the file this process created, then releases `identity`, even
+ * when the deletion fails. Call it once for each identity.
+ *
+ * @remarks
+ * Once a daemon's socket or lockfile has been replaced, for example after someone deleted it and a successor
+ * started, the name belongs to the successor, which must stay reachable when this daemon exits.
+ */
+export function removeOwnFile(filePath: string, identity: IDaemonFileIdentity | undefined): void {
+  if (!identity) return;
+  try {
+    if (isSameFile(readFileIdentity(filePath), identity)) unlinkIfPresent(filePath);
+  } finally {
+    release(identity);
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts b/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
index 019dbdd96d4..ee07cb535f5 100644
--- a/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
+++ b/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
@@ -1,12 +1,13 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { once } from 'node:events';
 import type * as net from 'node:net';
 
-import { DaemonFrameDecoder, encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
+import { encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
+import { waitForBufferedWriteAsync, writeUntilWrittenAsync } from './DaemonBufferedWrite';
+import { DaemonFrameReceiver } from './DaemonFrameReceiver';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 
 /** One end of a framed rushd connection over a `net` socket (Unix socket or named pipe).
@@ -17,32 +18,50 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * @beta */
 export class DaemonFrameConnection {
   readonly #socket: net.Socket;
-  readonly #decoder: DaemonFrameDecoder = new DaemonFrameDecoder();
-  #frameHandler: ((frame: IDaemonFrame) => void | Promise<void>) | undefined;
+  readonly #receiver: DaemonFrameReceiver;
   #closedHandler: ((error: Error | undefined) => void) | undefined;
   #closedError: Error | undefined;
-  #receiveQueue: Promise<void> = Promise.resolve();
   public constructor(socket: net.Socket) {
     this.#socket = socket;
-    socket.on('data', (chunk: Buffer) => this.#onData(chunk));
+    this.#receiver = new DaemonFrameReceiver(socket, (error: unknown) => this.#fail(error));
     socket.on('error', (error: Error) => this.#onError(error));
     socket.on('close', () => this.#onClose());
   }
   /** Registers the serialized, backpressured handler invoked for each decoded frame. */
   public onFrame(handler: (frame: IDaemonFrame) => void | Promise<void>): void {
-    this.#frameHandler = handler;
+    this.#receiver.frameHandler = handler;
   }
   /** Registers the close handler, invoked at most once with the cause. */
   public onClosed(handler: (error: Error | undefined) => void): void {
     this.#closedHandler = handler;
   }
-  /** Encodes and writes a frame, resolving when the socket has drained it. @throws {@link DaemonTransportError} when closed. */
+  /**
+   * Whether the connection has closed after it read every byte that the peer sent, so that the close discarded
+   * no frame: it read the peer's end, or a reset that came once nothing was left to read. Each of those frames
+   * goes to the frame handler in order, though some may not be handled yet.
+   * @remarks False while the connection is open, and after `abort()`, a malformed frame, a throwing handler or
+   * any other close, such as a failed write, or a reset while bytes waited in the socket's buffer, which is
+   * paused while a handler runs. The operating system reports a reset only after the bytes that came before it.
+   */
+  public get closedAfterReadingAll(): boolean {
+    return this.#receiver.closedAfterReadingAll;
+  }
+  /** Encodes and writes a frame, resolving once the socket has written it. @throws {@link DaemonTransportError} when closed, or when it closes first. */
   public async sendFrameAsync(frame: IDaemonFrame): Promise<void> {
     this.#assertOpen();
     if (!this.#socket.write(encodeDaemonFrame(frame))) {
-      await once(this.#socket, 'drain');
+      await waitForBufferedWriteAsync(this.#socket);
     }
   }
+  /**
+   * Encodes and writes a frame, resolving only once the operating system holds all of it, after every earlier
+   * frame, so that the peer can read it even if this process exits next. `sendFrameAsync` can resolve sooner.
+   * @throws {@link DaemonTransportError} when closed, or the socket's error when the write fails.
+   */
+  public async sendFrameWrittenAsync(frame: IDaemonFrame): Promise<void> {
+    this.#assertOpen();
+    await writeUntilWrittenAsync(this.#socket, encodeDaemonFrame(frame));
+  }
   /** Half-closes the writable side and releases the socket. */
   public async closeAsync(): Promise<void> {
     this.#socket.end();
@@ -51,6 +70,7 @@ export class DaemonFrameConnection {
   /** Immediately closes a connection whose graceful drain cannot make progress. @internal */
   public abort(error: Error): void {
     this.#closedError = this.#closedError ?? error;
+    this.#receiver.discard();
     this.#socket.destroy(error);
   }
   /** The wrapped socket, for the internal raw-write test hook. @internal */
@@ -65,30 +85,10 @@ export class DaemonFrameConnection {
       );
     }
   }
-  #onData(chunk: Buffer): void {
-    let frames: IDaemonFrame[];
-    try {
-      frames = this.#decoder.push(chunk);
-    } catch (error) {
-      this.#fail(error);
-      return;
-    }
-    this.#socket.pause();
-    this.#receiveQueue = this.#receiveQueue
-      .then(() => this.#dispatchFramesAsync(frames))
-      .then(() => {
-        this.#socket.resume();
-      })
-      .catch((error: unknown) => this.#fail(error));
-  }
-  async #dispatchFramesAsync(frames: ReadonlyArray<IDaemonFrame>): Promise<void> {
-    for (const frame of frames) {
-      await this.#frameHandler?.(frame);
-    }
-  }
   #fail(error: unknown): void {
     const cause: Error = error instanceof Error ? error : new Error(String(error));
     this.#closedError = this.#closedError ?? cause;
+    this.#receiver.discard();
     this.#socket.destroy(cause);
   }
   #onError(error: Error): void {
diff --git a/libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts b/libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts
new file mode 100644
index 00000000000..0d4cb869bff
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts
@@ -0,0 +1,74 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as net from 'node:net';
+
+import { DaemonFrameDecoder } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+/**
+ * The receiving side of a `DaemonFrameConnection`. It decodes the socket's bytes to frames in wire order and
+ * hands them to the frame handler one at a time, and it tracks whether the socket closed after it read every
+ * byte that the peer sent.
+ * @remarks
+ * The socket is paused while the handler runs, so bytes that arrive meanwhile wait in its buffer, and a close
+ * that comes first discards them: a failed write, or a reset from the peer. The operating system reports a
+ * reset only after the bytes that arrived before it, so a reset with nothing buffered lost nothing. A named
+ * pipe ends rather than resets.
+ * @internal
+ */
+export class DaemonFrameReceiver {
+  public frameHandler: ((frame: IDaemonFrame) => void | Promise<void>) | undefined;
+  readonly #socket: net.Socket;
+  readonly #fail: (error: unknown) => void;
+  readonly #decoder: DaemonFrameDecoder = new DaemonFrameDecoder();
+  #receiveQueue: Promise<void> = Promise.resolve();
+  #readAll: boolean = false;
+  #discarded: boolean = false;
+  public constructor(socket: net.Socket, fail: (error: unknown) => void) {
+    this.#socket = socket;
+    this.#fail = fail;
+    socket.on('data', (chunk: Buffer) => this.#onData(chunk));
+    socket.on('end', () => {
+      this.#readAll = true;
+    });
+    socket.on('error', (error: Error) => {
+      this.#readAll ||= isResetWithNothingUnread(error, socket);
+    });
+  }
+  /** Whether the socket has closed after it read every byte that the peer sent, and this side did not discard. */
+  public get closedAfterReadingAll(): boolean {
+    return this.#socket.closed && this.#readAll && !this.#discarded;
+  }
+  /** Records that this side is closing the connection, which may discard bytes that arrived but were not read. */
+  public discard(): void {
+    this.#discarded = true;
+  }
+  #onData(chunk: Buffer): void {
+    let frames: IDaemonFrame[];
+    try {
+      frames = this.#decoder.push(chunk);
+    } catch (error) {
+      this.#fail(error);
+      return;
+    }
+    this.#socket.pause();
+    this.#receiveQueue = this.#receiveQueue
+      .then(() => this.#dispatchFramesAsync(frames))
+      .then(() => {
+        this.#socket.resume();
+      })
+      .catch((error: unknown) => this.#fail(error));
+  }
+  async #dispatchFramesAsync(frames: ReadonlyArray<IDaemonFrame>): Promise<void> {
+    for (const frame of frames) {
+      await this.frameHandler?.(frame);
+    }
+  }
+}
+
+/** A reset that a read reported while the socket's buffer held nothing that the peer sent. */
+function isResetWithNothingUnread(error: Error, socket: net.Socket): boolean {
+  const { code, syscall } = error as NodeJS.ErrnoException;
+  return code === 'ECONNRESET' && syscall === 'read' && !socket.readableLength;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts b/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
new file mode 100644
index 00000000000..e096a263e8e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
@@ -0,0 +1,43 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { readProcessIds } from './DaemonProcessList';
+import { isLiveMemberOf, readStatRecord } from './DaemonProcessStat';
+
+const NO_SIGNAL: number = 0;
+const NO_SUCH_PROCESS: string = 'ESRCH';
+// Reading a listed process's record fails with these codes once the process is gone.
+const GONE_ERROR_CODES: ReadonlySet<string | undefined> = new Set(['ENOENT', NO_SUCH_PROCESS]);
+
+// A listed process whose record cannot be read for another reason (another user's process under the
+// `hidepid` mount option, for example) might be a live member, so it counts as one.
+function isLiveOrUnreadableMemberOf(groupId: number, pid: number): boolean {
+  try {
+    return isLiveMemberOf(groupId, readStatRecord(pid));
+  } catch (error) {
+    return !GONE_ERROR_CODES.has((error as NodeJS.ErrnoException).code);
+  }
+}
+
+/**
+ * `true` while some process of group `groupId` has not exited, as `/proc` shows it. A zombie, which has
+ * exited but which its parent has not reaped, does not count. Throws when `/proc` cannot be listed.
+ */
+export function hasLiveGroupMember(groupId: number): boolean {
+  const isMember = (pid: number): boolean => isLiveOrUnreadableMemberOf(groupId, pid);
+  // A group's id is its leader's pid, so a live leader answers without reading every process's record.
+  return isMember(groupId) || readProcessIds().some(isMember);
+}
+
+/**
+ * `false` only when `kill` proves that group `groupId` has no process at all, not even a zombie (ESRCH), which
+ * spares a scan of every process's record. A group that this user may not signal counts as having members.
+ */
+export function mayHaveGroupMembers(groupId: number): boolean {
+  try {
+    process.kill(-groupId, NO_SIGNAL);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException | undefined)?.code !== NO_SUCH_PROCESS;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts b/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
new file mode 100644
index 00000000000..6f7b216798c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
+
+const POLL_INTERVAL_MS: number = 20;
+
+/** Outcome of reaping a dead daemon's orphaned process groups. */
+export type DaemonOrphanReapOutcome = 'none' | IDaemonOrphanReap['outcome'];
+
+function listExistingGroups(context: IReapContext, groupIds: readonly number[]): number[] {
+  return groupIds.filter((groupId: number) => context.ops.groupExists(groupId));
+}
+
+function haveAllExited(context: IReapContext, groupIds: readonly number[]): boolean {
+  return !groupIds.some((groupId: number) => context.ops.groupExists(groupId));
+}
+
+async function waitForGroupsExitAsync(context: IReapContext, groupIds: readonly number[]): Promise<boolean> {
+  const deadline: number = context.ops.now() + context.graceMs;
+  while (context.ops.now() < deadline) {
+    if (haveAllExited(context, groupIds)) return true;
+    await context.ops.delayAsync(POLL_INTERVAL_MS);
+  }
+  return haveAllExited(context, groupIds);
+}
+
+function signalExistingGroups(
+  context: IReapContext,
+  groupIds: readonly number[],
+  signal: NodeJS.Signals
+): void {
+  for (const groupId of listExistingGroups(context, groupIds)) {
+    context.ops.signalGroup(groupId, signal);
+  }
+}
+
+/**
+ * Sends SIGTERM to every group, then SIGKILL to those still present after `graceMs`, and throws if any is
+ * still present after a further `graceMs`. The groups share each grace period. Call only for groups proven
+ * to belong to the dead daemon, under the reclaim mutex.
+ */
+export async function terminateProcessGroupsAsync(
+  context: IReapContext,
+  groupIds: readonly number[]
+): Promise<IDaemonOrphanReap['outcome']> {
+  signalExistingGroups(context, groupIds, 'SIGTERM');
+  if (await waitForGroupsExitAsync(context, groupIds)) return 'terminated';
+  signalExistingGroups(context, groupIds, 'SIGKILL');
+  if (await waitForGroupsExitAsync(context, groupIds)) return 'killed';
+  throw new Error(`Processes of dead daemon ${context.deadPid} survived SIGKILL; not reclaiming its socket.`);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonListener.ts b/libraries/rush-daemon-transport/src/DaemonListener.ts
index df37a5749bb..ba6b598e74a 100644
--- a/libraries/rush-daemon-transport/src/DaemonListener.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListener.ts
@@ -5,15 +5,23 @@ import * as net from 'node:net';
 
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 
+import type { DaemonFileChange } from './DaemonFileChange';
+import { pinFileIdentity } from './DaemonFileIdentity';
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import { DaemonFrameConnection } from './DaemonFrameConnection';
 import { listenWithReclaimAsync } from './DaemonListenerBinding';
 import { DaemonListenerLifetime } from './DaemonListenerLifetime';
-import { ensureDaemonRuntimeDir, writeDaemonLockfile } from './DaemonLockfile';
+import type { IDaemonListenerFiles } from './DaemonListenerLifetime';
+import { writeDaemonLockfile } from './DaemonLockfile';
+import { startOperationGroupRecording } from './DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder } from './DaemonOperationGroups';
 import { assertDaemonOwnershipAvailable } from './DaemonOwnership';
 import type { IDaemonPaths } from './DaemonPaths';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
+import { ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 
 /** Options for {@link DaemonFrameListener.listenAsync}. @beta */
-export interface IDaemonListenerOptions {
+export interface IDaemonListenerOptions extends IDaemonReclaimOptions {
   /** The wire protocol version this daemon speaks (recorded in the lockfile). */
   readonly protocolVersion: IDaemonProtocolVersion;
   /** The ISO 8601 start time recorded in the lockfile. Defaults to now. */
@@ -30,8 +38,11 @@ export interface IDaemonListenerOptions {
  * @beta */
 export class DaemonFrameListener {
   readonly #lifetime: DaemonListenerLifetime;
-  private constructor(server: net.Server, paths: IDaemonPaths) {
-    this.#lifetime = new DaemonListenerLifetime(server, paths);
+  private constructor(server: net.Server, paths: IDaemonPaths, files: IDaemonListenerFiles) {
+    // Record detached operation groups for as long as this process owns the lockfile, so a successor can
+    // reap them if this daemon dies uncleanly.
+    const folder: string = getOperationGroupsFolder(paths.lockfilePath, process.pid);
+    this.#lifetime = new DaemonListenerLifetime(server, paths, files, startOperationGroupRecording(folder));
   }
   /** Binds the socket/pipe path and writes the PID lockfile. */
   public static async listenAsync(
@@ -43,19 +54,20 @@ export class DaemonFrameListener {
       options.onConnection(new DaemonFrameConnection(socket));
     });
     ensureDaemonRuntimeDir(paths);
-    await listenWithReclaimAsync(server, paths);
+    const socket: IDaemonFileIdentity | undefined = await listenWithReclaimAsync(server, paths, options);
     // Lockfile after bind: a pre-existing stale record must read as dead, not
     // as a live owner that would make reclaim refuse.
+    let lockfile: IDaemonFileIdentity | undefined;
     try {
-      writeListenerLockfile(paths, options);
+      lockfile = writeListenerLockfile(paths, options);
     } catch (error) {
-      await new DaemonListenerLifetime(server, paths).stopAcceptingAsync();
+      await new DaemonListenerLifetime(server, paths, { socket }).stopAcceptingAsync();
       throw error;
     }
-    return new DaemonFrameListener(server, paths);
+    return new DaemonFrameListener(server, paths, { socket, lockfile });
   }
 
-  /** Stops accepting connections and releases the socket/pipe and lockfile. */
+  /** Stops accepting connections and releases the socket/pipe and lockfile, unless a successor replaced them. */
   public closeAsync(): Promise<void> {
     return this.#lifetime.closeAsync();
   }
@@ -63,13 +75,25 @@ export class DaemonFrameListener {
   public stopAcceptingAsync(): Promise<void> {
     return this.#lifetime.stopAcceptingAsync();
   }
+  /** For a daemon process that exits before its shutdown finished: releases the socket/pipe and lockfile,
+   * unless the daemon still has children that a successor must reap. Then both stay, as after a crash.
+   * @returns Whether they were released. */
+  public releaseForExit(): boolean {
+    return this.#lifetime.releaseForExit();
+  }
+  /** Reports a POSIX socket that was deleted, or whose name another file took: no client can connect then.
+   * @returns `undefined` while the socket is intact, on Windows, and after the listener released it. */
+  public checkSocket(): DaemonFileChange | undefined {
+    return this.#lifetime.checkSocket();
+  }
 }
 
-function writeListenerLockfile(paths: IDaemonPaths, options: IDaemonListenerOptions): void {
+function writeListenerLockfile(paths: IDaemonPaths, options: IDaemonListenerOptions): IDaemonFileIdentity {
   writeDaemonLockfile(paths.lockfilePath, {
     pid: process.pid,
     protocolVersion: options.protocolVersion,
     startedAt: options.startedAt ?? new Date().toISOString(),
     socketPath: paths.socketPath
   });
+  return pinFileIdentity(paths.lockfilePath);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
index 77885fa9354..d8d8cd1380a 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
@@ -3,17 +3,45 @@
 
 import type * as net from 'node:net';
 
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import { ADDRESS_IN_USE, listenOrErrorAsync, toListenTransportError } from './DaemonListenerNet';
 import type { INetError } from './DaemonListenerNet';
 import type { IDaemonPaths } from './DaemonPaths';
 import { reclaimStaleDaemonAsync } from './DaemonReclaim';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
+import { listenPublishedAsync } from './DaemonSocketPublication';
 
 const FIRST_ATTEMPT: number = 0;
 const RECLAIM_ATTEMPT: number = 1;
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 
-export async function listenWithReclaimAsync(server: net.Server, paths: IDaemonPaths): Promise<void> {
+/**
+ * Binds the listener, reclaiming its path once from a dead daemon. Returns the identity of a POSIX socket; a
+ * Windows named pipe has no file and disappears with its server. Of the listener's options, only
+ * `onOrphansReaped` and `onOperationGroupLeftRunning` go on to the reclaim, because the reaper also reads
+ * fields for tests from that object.
+ */
+export async function listenWithReclaimAsync(
+  server: net.Server,
+  paths: IDaemonPaths,
+  listenerOptions: IDaemonReclaimOptions
+): Promise<IDaemonFileIdentity | undefined> {
+  const options: IDaemonReclaimOptions = {
+    onOrphansReaped: listenerOptions.onOrphansReaped,
+    onOperationGroupLeftRunning: listenerOptions.onOperationGroupLeftRunning
+  };
+  if (process.platform !== WINDOWS_PLATFORM) return listenPublishedAsync(server, paths, options);
+  await listenPipeWithReclaimAsync(server, paths, options);
+  return undefined;
+}
+
+async function listenPipeWithReclaimAsync(
+  server: net.Server,
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions
+): Promise<void> {
   for (let attempt: number = FIRST_ATTEMPT; attempt <= RECLAIM_ATTEMPT; attempt++) {
-    const bound: boolean = await tryListenOnceAsync(server, paths, attempt);
+    const bound: boolean = await tryListenOnceAsync(server, paths, attempt, options);
     if (bound) {
       return;
     }
@@ -23,21 +51,23 @@ export async function listenWithReclaimAsync(server: net.Server, paths: IDaemonP
 async function tryListenOnceAsync(
   server: net.Server,
   paths: IDaemonPaths,
-  attempt: number
+  attempt: number,
+  options: IDaemonReclaimOptions
 ): Promise<boolean> {
   const error: INetError | undefined = await listenOrErrorAsync(server, paths.socketPath);
-  return error ? recoverFromListenErrorAsync(error, paths, attempt) : true;
+  return error ? recoverFromListenErrorAsync(error, paths, attempt, options) : true;
 }
 
 async function recoverFromListenErrorAsync(
   error: INetError,
   paths: IDaemonPaths,
-  attempt: number
+  attempt: number,
+  options: IDaemonReclaimOptions
 ): Promise<boolean> {
   const canReclaim: boolean = error.code === ADDRESS_IN_USE && attempt === FIRST_ATTEMPT;
   if (!canReclaim) {
     throw toListenTransportError(error, paths.socketPath);
   }
-  await reclaimStaleDaemonAsync(paths);
+  await reclaimStaleDaemonAsync(paths, options);
   return false;
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
index ee6f22141ba..a13c7297016 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
@@ -3,32 +3,95 @@
 
 import type * as net from 'node:net';
 
-import { removeDaemonArtifacts } from './DaemonLockfile';
+import { hasProcessesToReap } from './DaemonExitRelease';
+import { compareFileIdentity } from './DaemonFileChange';
+import type { DaemonFileChange } from './DaemonFileChange';
+import { removeOwnFile } from './DaemonFileIdentity';
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
+import type { StopOperationGroupRecording } from './DaemonOperationGroupRecorder';
 import type { IDaemonPaths } from './DaemonPaths';
+import { releaseAfterAsync } from './DaemonReleaseAfter';
+
+/** The files a listener created: its published POSIX socket and its lockfile. */
+export interface IDaemonListenerFiles {
+  readonly socket?: IDaemonFileIdentity;
+  readonly lockfile?: IDaemonFileIdentity;
+}
+
+function keepNoRecords(): void {
+  // Nothing was recorded before the lockfile was written.
+}
 
 export class DaemonListenerLifetime {
+  readonly #files: IDaemonListenerFiles;
   readonly #paths: IDaemonPaths;
   readonly #server: net.Server;
+  readonly #stopRecording: StopOperationGroupRecording;
   #closePromise: Promise<void> | undefined;
   #stopPromise: Promise<void> | undefined;
+  // `removeOwnFile` releases the pinned identity, so each file is released once.
+  #socketReleased: boolean = false;
+  #lockfileReleased: boolean = false;
 
-  public constructor(server: net.Server, paths: IDaemonPaths) {
+  public constructor(
+    server: net.Server,
+    paths: IDaemonPaths,
+    files: IDaemonListenerFiles,
+    stopRecording: StopOperationGroupRecording = keepNoRecords
+  ) {
     this.#server = server;
     this.#paths = paths;
+    this.#files = files;
+    this.#stopRecording = stopRecording;
   }
 
   public stopAcceptingAsync(): Promise<void> {
-    this.#stopPromise ??= new Promise<void>((resolve) => this.#server.close(() => resolve()));
+    this.#stopPromise ??= this.#stopOnceAsync();
     return this.#stopPromise;
   }
 
   public closeAsync(): Promise<void> {
-    this.#closePromise ??= this.#closeOnceAsync();
+    this.#closePromise ??= releaseAfterAsync(this.stopAcceptingAsync(), () => this.#releaseLockfile());
     return this.#closePromise;
   }
 
-  async #closeOnceAsync(): Promise<void> {
-    await this.stopAcceptingAsync();
-    removeDaemonArtifacts(this.#paths.lockfilePath, this.#paths.socketPath);
+  /**
+   * Releases the socket and the lockfile for a process that exits without closing the listener, unless it has
+   * children that a successor must reap first. Then both stay, as after a crash. Returns whether it released them.
+   */
+  public releaseForExit(): boolean {
+    if (hasProcessesToReap(this.#paths)) return false;
+    this.#releaseSocket();
+    this.#releaseLockfile();
+    return true;
+  }
+
+  /** Reports a published socket that no longer has its name, until this listener releases the socket. */
+  public checkSocket(): DaemonFileChange | undefined {
+    if (!this.#files.socket || this.#socketReleased) return undefined;
+    return compareFileIdentity(this.#paths.socketPath, this.#files.socket);
+  }
+
+  async #stopOnceAsync(): Promise<void> {
+    // Unlink first, as libuv does for the path it bound, but only this listener's own socket: the name may
+    // belong to a successor by now. Close even when that fails, or the open server keeps the process up.
+    try {
+      this.#releaseSocket();
+    } finally {
+      await new Promise<void>((resolve: () => void) => this.#server.close(() => resolve()));
+    }
+  }
+
+  #releaseSocket(): void {
+    if (this.#socketReleased) return;
+    this.#socketReleased = true;
+    removeOwnFile(this.#paths.socketPath, this.#files.socket);
+  }
+
+  #releaseLockfile(): void {
+    if (this.#lockfileReleased) return;
+    this.#lockfileReleased = true;
+    this.#stopRecording();
+    removeOwnFile(this.#paths.lockfilePath, this.#files.lockfile);
   }
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonLockfile.ts b/libraries/rush-daemon-transport/src/DaemonLockfile.ts
index f81fbd1ef76..a8db247a39a 100644
--- a/libraries/rush-daemon-transport/src/DaemonLockfile.ts
+++ b/libraries/rush-daemon-transport/src/DaemonLockfile.ts
@@ -6,8 +6,6 @@ import * as path from 'node:path';
 
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 
-import type { IDaemonPaths } from './DaemonPaths';
-
 const UTF8: BufferEncoding = 'utf8';
 const NO_SIGNAL: number = 0;
 const DIR_MODE: number = 0o700;
@@ -25,14 +23,6 @@ export interface IDaemonLockfile {
   readonly socketPath: string;
 }
 
-/** Creates the per-user runtime directory (mode `0700`) when the platform has one.
- * Must be called before binding a POSIX socket inside it. @beta */
-export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void {
-  if (paths.runtimeDir !== undefined) {
-    fs.mkdirSync(paths.runtimeDir, { recursive: true, mode: DIR_MODE });
-  }
-}
-
 /** Returns `true` when a process with `pid` exists and is signalable. @beta */
 export function isDaemonProcessAlive(pid: number): boolean {
   try {
@@ -68,7 +58,9 @@ export function writeDaemonLockfile(lockfilePath: string, lockfile: IDaemonLockf
   fs.writeFileSync(lockfilePath, JSON.stringify(lockfile), { encoding: UTF8, mode: FILE_MODE });
 }
 
-/** Removes the daemon lockfile and (on POSIX) the stale socket file; idempotent. @beta */
+/** Removes the daemon lockfile and (on POSIX) the stale socket file; idempotent.
+ * Only for a dead owner's files: a daemon removes its own with an identity check, since a successor may
+ * already have replaced them. @beta */
 export function removeDaemonArtifacts(lockfilePath: string, socketPath: string): void {
   for (const filePath of [lockfilePath, socketPath]) {
     try {
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts
new file mode 100644
index 00000000000..1cfd096fc71
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { readSpawnMarks } from './DaemonOperationGroupSpawnMark';
+import { isGroupAndSessionLeader } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+import type { IReapContext } from './DaemonReapOptions';
+
+// A child's start time is set when it is forked, inside the spawn that its mark brackets. 1 s is over 13 times
+// the longest spawn measured from a daemon-sized process.
+const SPAWN_WINDOW_TICKS: number = 100;
+const NO_MARKS: number = 0;
+
+/** The dead daemon's record folder, what it recorded there, and its marker. */
+export interface IOperationGroupAdoptionScope {
+  readonly folder: string;
+  readonly records: readonly IOperationGroupRecord[];
+  readonly marker: string;
+}
+
+interface IAdoption {
+  readonly context: IReapContext;
+  readonly marker: string;
+  readonly recorded: ReadonlySet<number>;
+  readonly marks: readonly number[];
+}
+
+type AdoptionCheck = (stat: IProcessStat, adoption: IAdoption) => boolean;
+
+function startedInSpawn(stat: IProcessStat, marks: readonly number[]): boolean {
+  const start: number = Number(stat.startTime);
+  return marks.some((mark: number) => start >= mark && start - mark <= SPAWN_WINDOW_TICKS);
+}
+
+// A live daemon still owns the processes it starts, and its mark may be of a spawn that is running now.
+function isDaemonGone({ ops, deadPid, deadPidReused }: IReapContext): boolean {
+  return deadPidReused || !ops.isProcessAlive(deadPid);
+}
+
+// The cheap checks come first; the last reads the process's environment.
+const ADOPTION_CHECKS: readonly AdoptionCheck[] = [
+  (stat: IProcessStat) => isGroupAndSessionLeader(stat) && !stat.exited,
+  (stat: IProcessStat, { recorded }: IAdoption) => !recorded.has(stat.pid),
+  (stat: IProcessStat, { marks }: IAdoption) => startedInSpawn(stat, marks),
+  (stat: IProcessStat, { context, marker }: IAdoption) => context.ops.hasEnvironmentEntry(stat.pid, marker)
+];
+
+/**
+ * The live processes that the dead daemon may have started without recording them, because it died during the
+ * spawn, as records to reap: each leads its own process group and session, no record names its group, it
+ * started within 1 s after one of the spawn marks left in the folder, and it carries the daemon's marker.
+ * Without a spawn mark, which is every case but a death during a spawn, no process is read; nor while the
+ * daemon's pid is alive and not reused.
+ */
+export function adoptUnrecordedOperationGroups(
+  context: IReapContext,
+  { folder, records, marker }: IOperationGroupAdoptionScope
+): IOperationGroupRecord[] {
+  const marks: number[] = readSpawnMarks(folder);
+  if (marks.length === NO_MARKS || !isDaemonGone(context)) return [];
+  const recorded: Set<number> = new Set(records.map((record: IOperationGroupRecord) => record.groupId));
+  const adoption: IAdoption = { context, marker, recorded, marks };
+  return context.ops
+    .listProcesses()
+    .filter((stat: IProcessStat) => ADOPTION_CHECKS.every((check: AdoptionCheck) => check(stat, adoption)))
+    .map((stat: IProcessStat) => ({ groupId: stat.pid, startTime: stat.startTime }));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts
new file mode 100644
index 00000000000..01edb6e738c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts
@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { findOperationGroupLeftRunningReason, readOperationGroupState } from './DaemonOperationGroupState';
+import type { IOperationGroupState } from './DaemonOperationGroupState';
+import type { IReapContext } from './DaemonReapOptions';
+import type {
+  DaemonOperationGroupLeftRunningReason,
+  IDaemonOperationGroupLeftRunning
+} from './DaemonReclaimOptions';
+
+const NO_MEMBERS: number = 0;
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+// 0 and 1 are never operation groups, and kill(-0)/kill(-1) would probe our own group or every process.
+const FIRST_USER_PID: number = 2;
+
+type GroupCheck = (groupId: number, context: IReapContext) => boolean;
+
+// The proof rejects the first two before it reads anything. kill() finds no process of a stale group, which
+// spares a scan of every process's record, or of a group whose processes have all been reaped since the proof.
+const WORTH_READING_CHECKS: readonly GroupCheck[] = [
+  (groupId: number, context: IReapContext) => context.platform !== WINDOWS_PLATFORM,
+  (groupId: number) => Number.isSafeInteger(groupId) && groupId >= FIRST_USER_PID,
+  (groupId: number, context: IReapContext) => context.ops.mayHaveMembers(groupId)
+];
+
+/** The records that a reap removed without a signal, and the marker of the daemon that wrote them. */
+export interface IUnprovenOperationGroups {
+  readonly records: readonly IOperationGroupRecord[];
+  readonly marker: string;
+}
+
+function isGroupWorthReading(groupId: number, context: IReapContext): boolean {
+  return WORTH_READING_CHECKS.every((check: GroupCheck) => check(groupId, context));
+}
+
+function explainLeftRunning(
+  record: IOperationGroupRecord,
+  context: IReapContext,
+  marker: string
+): DaemonOperationGroupLeftRunningReason | undefined {
+  if (!isGroupWorthReading(record.groupId, context)) return undefined;
+  const state: IOperationGroupState = readOperationGroupState({ record, context, marker });
+  return state.members.length > NO_MEMBERS ? findOperationGroupLeftRunningReason(state) : undefined;
+}
+
+// A probe that fails proves nothing about the group, and only its report is lost.
+function tryExplainLeftRunning(
+  record: IOperationGroupRecord,
+  context: IReapContext,
+  marker: string
+): DaemonOperationGroupLeftRunningReason | undefined {
+  try {
+    return explainLeftRunning(record, context, marker);
+  } catch {
+    return undefined;
+  }
+}
+
+function listGroupsLeftRunning(
+  context: IReapContext,
+  { records, marker }: IUnprovenOperationGroups
+): IDaemonOperationGroupLeftRunning[] {
+  return records.flatMap((record: IOperationGroupRecord) => {
+    const reason: DaemonOperationGroupLeftRunningReason | undefined = tryExplainLeftRunning(
+      record,
+      context,
+      marker
+    );
+    return reason ? [{ daemonPid: context.deadPid, processGroupId: record.groupId, reason }] : [];
+  });
+}
+
+/**
+ * Reports each of the records that a reap removed without a signal to `onOperationGroupLeftRunning`, with the
+ * first condition of the proof that its group fails now, when the group still has a live process.
+ *
+ * @remarks
+ * The reap passes the context that its proof read through (see `withProcessReadsOnce`), so a group is judged
+ * on what the proof read of it, and is read here only when the proof did not read it. A group of which kill()
+ * finds no process now is not reported, and neither is one with no live member, one that passes every
+ * condition, or one whose read fails. Without the callback, nothing is read.
+ */
+export function reportOperationGroupsLeftRunning(
+  context: IReapContext,
+  unproven: IUnprovenOperationGroups
+): void {
+  const report: IReapContext['onOperationGroupLeftRunning'] = context.onOperationGroupLeftRunning;
+  if (!report) return;
+  for (const group of listGroupsLeftRunning(context, unproven)) report(group);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts
new file mode 100644
index 00000000000..5950a7da0df
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from './DaemonOperationGroupMarker';
+import type {
+  DaemonOperationGroupLeftRunningReason,
+  IDaemonOperationGroupLeftRunning
+} from './DaemonReclaimOptions';
+
+type DescribeReason = (group: IDaemonOperationGroupLeftRunning) => string;
+
+const REASON_DESCRIPTIONS: Readonly<Record<DaemonOperationGroupLeftRunningReason, DescribeReason>> = {
+  callerGroup: () =>
+    'its ID is the PID or the process group ID of this process, or this process cannot read its own group',
+  daemonPidInUse: () => "another process has that daemon's PID now",
+  leaderChanged: ({ processGroupId }: IDaemonOperationGroupLeftRunning) =>
+    `the process with PID ${processGroupId} now is not the leader that the daemon recorded`,
+  otherSession: () => 'its leader has exited, and a process of the group is in another session',
+  noMarker: () =>
+    `its leader has exited, and no process of the group has that daemon's ${DAEMON_OPERATION_GROUPS_ENV_VAR} ` +
+    'value, which a daemon from a release before that variable does not set'
+};
+
+/**
+ * Describes, in one line without a final period, a process group that a reclaim left running (see
+ * `IDaemonReclaimOptions.onOperationGroupLeftRunning`): which group, which exited daemon recorded it, and why
+ * the reclaim left it running. "This process" in it is the process that reclaimed.
+ *
+ * @remarks
+ * For example: "left process group 5001 running, which the exited daemon (PID 4242) recorded for an
+ * operation: its leader has exited, and a process of the group is in another session".
+ *
+ * @beta
+ */
+export function formatOperationGroupLeftRunning(group: IDaemonOperationGroupLeftRunning): string {
+  return (
+    `left process group ${group.processGroupId} running, which the exited daemon (PID ${group.daemonPid}) ` +
+    `recorded for an operation: ${REASON_DESCRIPTIONS[group.reason](group)}`
+  );
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts
new file mode 100644
index 00000000000..ade5417e319
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+const ENTRY_SEPARATOR: string = '=';
+
+/**
+ * The environment variable that marks every process a daemon starts while it records operation process groups.
+ *
+ * @remarks
+ * On Linux, a daemon sets it in its own `process.env` to the folder in which it records its operations' process
+ * groups, so every process that it starts, and every descendant that keeps its environment, carries it. After
+ * the daemon dies, a recorded group whose leader has exited is signaled only if one of its live members still
+ * carries the marker of that folder: without it, a later process that got the recorded pid and called `setsid()`
+ * would pass for the operation. A host that builds a child's environment from a request instead of from its own
+ * `process.env` passes on its own value, never the request's. The variable is not part of a daemon's identity.
+ *
+ * @beta
+ */
+export const DAEMON_OPERATION_GROUPS_ENV_VAR: 'RUSHD_OPERATION_GROUPS' = 'RUSHD_OPERATION_GROUPS';
+
+/** Removes the marker that {@link markOperationGroups} set, unless something else has replaced it. */
+export type UnmarkOperationGroups = () => void;
+
+/** The environment entry (`NAME=value`) that marks the operations whose groups are recorded in `folder`. */
+export function getOperationGroupsMarker(folder: string): string {
+  return `${DAEMON_OPERATION_GROUPS_ENV_VAR}${ENTRY_SEPARATOR}${folder}`;
+}
+
+/** Marks the processes that this process starts from now on as operations recorded in `folder`. */
+export function markOperationGroups(folder: string): UnmarkOperationGroups {
+  process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = folder;
+  return () => {
+    if (process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] === folder) {
+      delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+    }
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts
new file mode 100644
index 00000000000..3f9918536e0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts
@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import type { IProcessStat } from './DaemonProcessStat';
+import { isSignalableGroup } from './DaemonReapOptions';
+import type { IReapContext } from './DaemonReapOptions';
+
+function isSameLeader(leader: IProcessStat, record: IOperationGroupRecord): boolean {
+  const { groupId } = record;
+  return leader.startTime === record.startTime && leader.groupId === groupId && leader.sessionId === groupId;
+}
+
+// Every group lives inside one session. A group whose session is its own id was created by setsid() of
+// the recorded leader, or of a reused pid that also called setsid(), which needs the pid space to wrap.
+// So one live member must also carry the marker that the daemon gives every process it starts: a reused
+// pid's session has no reason to. A shell job's group lives in its shell's session and is rejected. A stale
+// record's group usually has no process at all, which kill() proves without reading every process's record.
+function isLeaderlessOperationGroup(groupId: number, context: IReapContext, marker: string): boolean {
+  if (!context.ops.mayHaveMembers(groupId)) return false;
+  const members: IProcessStat[] = context.ops.listLiveGroupMembers(groupId);
+  return (
+    members.every((member: IProcessStat) => member.sessionId === groupId) &&
+    members.some((member: IProcessStat) => context.ops.hasEnvironmentEntry(member.pid, marker))
+  );
+}
+
+// A zombie leader has exited, and only its parent can remove it, so it proves nothing about its group.
+function readLiveLeader(groupId: number, context: IReapContext): IProcessStat | undefined {
+  const leader: IProcessStat | undefined = context.ops.readProcessStat(groupId);
+  return leader?.exited ? undefined : leader;
+}
+
+/**
+ * `true` when `record` provably still names an operation of the dead daemon whose records carry `marker`
+ * (see `getOperationGroupsMarker`), so that its group may be signaled.
+ */
+export function isProvenOperationGroup(
+  record: IOperationGroupRecord,
+  context: IReapContext,
+  marker: string
+): boolean {
+  if (!isSignalableGroup(record.groupId, context)) return false;
+  const leader: IProcessStat | undefined = readLiveLeader(record.groupId, context);
+  return leader ? isSameLeader(leader, record) : isLeaderlessOperationGroup(record.groupId, context, marker);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
new file mode 100644
index 00000000000..691967f89dd
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -0,0 +1,95 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
+import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
+import { adoptUnrecordedOperationGroups } from './DaemonOperationGroupAdoption';
+import { reportOperationGroupsLeftRunning } from './DaemonOperationGroupLeftRunning';
+import { getOperationGroupsMarker } from './DaemonOperationGroupMarker';
+import { isProvenOperationGroup } from './DaemonOperationGroupProof';
+import {
+  getOperationGroupsFolder,
+  readOperationGroupRecords,
+  removeOperationGroupRecords
+} from './DaemonOperationGroups';
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { isOwnedEntry } from './DaemonOwnedEntry';
+import { withProcessReadsOnce } from './DaemonProcessReadsOnce';
+import { createReapContext, reportOrphansReaped } from './DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
+
+const NO_MEMBERS: number = 0;
+const LIST_SEPARATOR: string = ', ';
+const NOTHING_REAPED: DaemonOrphanReapOutcome = 'none';
+
+async function terminateAndLogAsync(
+  context: IReapContext,
+  groupIds: number[]
+): Promise<DaemonOrphanReapOutcome> {
+  const outcome: IDaemonOrphanReap['outcome'] = await terminateProcessGroupsAsync(context, groupIds);
+  reportOrphansReaped(
+    context,
+    { daemonPid: context.deadPid, processGroupIds: groupIds, outcome },
+    `Reclaimed dead daemon ${context.deadPid}: its orphaned operation process groups ` +
+      `${groupIds.join(LIST_SEPARATOR)} were ${outcome}.`
+  );
+  return outcome;
+}
+
+async function reapRecordedGroupsAsync(
+  folder: string,
+  context: IReapContext
+): Promise<DaemonOrphanReapOutcome> {
+  const marker: string = getOperationGroupsMarker(folder);
+  const records: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  // The termination polls the groups itself, and never through these reads.
+  const probe: IReapContext = withProcessReadsOnce(context);
+  const adopted: IOperationGroupRecord[] = adoptUnrecordedOperationGroups(probe, { folder, records, marker });
+  const proven: IOperationGroupRecord[] = [...records, ...adopted].filter((record: IOperationGroupRecord) =>
+    isProvenOperationGroup(record, probe, marker)
+  );
+  const groupIds: number[] = proven.map((record: IOperationGroupRecord) => record.groupId);
+  const outcome: DaemonOrphanReapOutcome =
+    groupIds.length > NO_MEMBERS ? await terminateAndLogAsync(context, groupIds) : NOTHING_REAPED;
+  removeOperationGroupRecords(folder);
+  const unproven: IOperationGroupRecord[] = records.filter(
+    (record: IOperationGroupRecord) => !proven.includes(record)
+  );
+  reportOperationGroupsLeftRunning(probe, { records: unproven, marker });
+  return outcome;
+}
+
+/**
+ * Terminates the detached operation process groups that dead daemon `deadPid` recorded while it ran
+ * (see `startOperationGroupRecording`), then deletes the records.
+ *
+ * @remarks
+ * A record is signaled only when it provably still names the daemon's operation: its leader is alive with
+ * the recorded start time and still leads group and session `groupId` (a reused pid has another start
+ * time), or its leader has exited (a zombie leader has too), every live member of the group is in
+ * session `groupId`, and at least one of them carries the daemon's marker (`RUSHD_OPERATION_GROUPS` set to
+ * the record folder; see `startOperationGroupRecording`). Unproven records are dropped without a signal, and
+ * each whose group still has a live process goes to `options.onOperationGroupLeftRunning` with the first
+ * condition that the group fails, judged on what the proof read of it. A daemon from a release before that
+ * marker sets none, so the first reclaim after an upgrade drops its recorded groups whose leader has exited
+ * and leaves them running.
+ * A daemon that died while starting a `detached` child left a spawn mark in the folder. Then a live process with
+ * no record is proven and signaled as if recorded when it leads its own group and session, started within 1 s
+ * after the mark, and carries the marker. Without a spawn mark, no other process is read.
+ * Records survive a failed reap, so the next reclaim retries.
+ * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
+ * Call only under the reclaim mutex, after the daemon has been proven dead, or its pid proven reused
+ * (`deadPidReused`).
+ */
+export async function reapDeadDaemonOperationGroupsAsync(
+  lockfilePath: string,
+  deadPid: number,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<DaemonOrphanReapOutcome> {
+  const context: IReapContext = createReapContext(deadPid, options);
+  const folder: string = getOperationGroupsFolder(lockfilePath, deadPid);
+  return isOwnedEntry(folder, 'directory', context.uid)
+    ? reapRecordedGroupsAsync(folder, context)
+    : NOTHING_REAPED;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
new file mode 100644
index 00000000000..7798e6c0650
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+import * as diagnosticsChannel from 'node:diagnostics_channel';
+
+import { markOperationGroups } from './DaemonOperationGroupMarker';
+import type { UnmarkOperationGroups } from './DaemonOperationGroupMarker';
+import {
+  removeOperationGroupRecord,
+  removeOperationGroupRecords,
+  writeOperationGroupRecord
+} from './DaemonOperationGroups';
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { recordOnSpawn } from './DaemonOperationGroupSpawnHook';
+import { isGroupAndSessionLeader, readProcessStat } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+
+// Node publishes every new ChildProcess on this built-in channel (since v16.18; built-in channels are
+// experimental). If it ever stops publishing, nothing is recorded and reclaim falls back to the daemon group.
+const CHILD_PROCESS_CHANNEL: string = 'child_process';
+const CLOSE_EVENT: string = 'close';
+
+interface IChildProcessMessage {
+  readonly process: ChildProcess;
+}
+
+/** Stops recording and deletes the records; call it when the daemon releases its lockfile. */
+export type StopOperationGroupRecording = () => void;
+
+function bestEffort(action: () => void): void {
+  try {
+    action();
+  } catch {
+    // A lost record only means this group is not reaped if the daemon later dies uncleanly.
+  }
+}
+
+function recordWhileRunning(child: ChildProcess, folder: string): void {
+  // Right after the spawn, or on 'spawn' one tick later: either way before the child can be reaped, so its pid is
+  // still its own. A `detached` child (SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX) leads its own group
+  // and session, so it is outside the daemon's process group and needs a record of its own.
+  const stat: IProcessStat | undefined = child.pid === undefined ? undefined : readProcessStat(child.pid);
+  if (!isGroupAndSessionLeader(stat)) return;
+  const record: IOperationGroupRecord = { groupId: stat.pid, startTime: stat.startTime };
+  bestEffort(() => writeOperationGroupRecord(folder, record));
+  child.once(CLOSE_EVENT, () => bestEffort(() => removeOperationGroupRecord(folder, record)));
+}
+
+/**
+ * Records every child this process spawns into its own process group and session, until that child exits,
+ * so that a successor can reap them if this daemon dies without killing them (SIGKILL, OOM).
+ *
+ * @remarks
+ * Linux only: records need `/proc` start times to rule out pid reuse. Elsewhere this records nothing.
+ * A child is recorded as soon as Node's spawn has started it, before any other code runs. While a `detached`
+ * child is being started, `folder` also holds a spawn mark, so a successor can stop a child that this daemon
+ * died while starting, before its record was written (see `reapDeadDaemonOperationGroupsAsync`).
+ * While it records, `process.env` carries `RUSHD_OPERATION_GROUPS` set to `folder`, which every process
+ * started from then on inherits unless it is given an environment without it; a successor signals a recorded
+ * group whose leader has exited only when one of its live members carries it.
+ */
+export function startOperationGroupRecording(folder: string): StopOperationGroupRecording {
+  if (readProcessStat(process.pid) === undefined) return () => undefined;
+  const unmark: UnmarkOperationGroups = markOperationGroups(folder);
+  const onChildProcess = (message: unknown): void => {
+    const child: ChildProcess = (message as IChildProcessMessage).process;
+    recordOnSpawn(child, { folder, record: () => recordWhileRunning(child, folder) });
+  };
+  diagnosticsChannel.subscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
+  return () => {
+    diagnosticsChannel.unsubscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
+    unmark();
+    bestEffort(() => removeOperationGroupRecords(folder));
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts
new file mode 100644
index 00000000000..fe0cd6fdaa1
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+
+import { withSpawnMark } from './DaemonOperationGroupSpawnMark';
+
+const SPAWN_METHOD: string = 'spawn';
+const SPAWN_EVENT: string = 'spawn';
+
+/** The record folder in which a spawn in flight is marked, and how to record the child once it has a pid. */
+export interface ISpawnRecording {
+  readonly folder: string;
+  readonly record: () => void;
+}
+
+interface ISpawnOptions {
+  readonly detached?: unknown;
+}
+
+// Node's spawn functions construct the ChildProcess, which publishes it, and then call `child.spawn(options)`,
+// which starts the process and sets `child.pid`. An own property of the instance runs instead of the prototype's
+// method, once: it removes itself first.
+function hookSpawnMethod(child: ChildProcess, { folder, record }: ISpawnRecording): void {
+  const spawnMethod: unknown = Reflect.get(child, SPAWN_METHOD);
+  if (typeof spawnMethod !== 'function') return;
+  const spawnAndRecord = (options: ISpawnOptions | undefined): unknown => {
+    Reflect.deleteProperty(child, SPAWN_METHOD);
+    return withSpawnMark(folder, options?.detached === true, () => {
+      const result: unknown = Reflect.apply(spawnMethod, child, [options]);
+      record();
+      return result;
+    });
+  };
+  Reflect.defineProperty(child, SPAWN_METHOD, { configurable: true, writable: true, value: spawnAndRecord });
+}
+
+// A lost record only means that the child is not reaped if this process dies uncleanly. A throw would instead
+// reach whoever called Node's spawn function, after the child had started, or leave the 'spawn' listener.
+function tryRecord(recording: Pick<ISpawnRecording, 'record'>): void {
+  try {
+    recording.record();
+  } catch {
+    // See above.
+  }
+}
+
+/**
+ * Calls `record` once for `child`, which was just published on the `child_process` channel: right after Node
+ * has started it, before any other code can run, or else on its `'spawn'` event, one tick later. A throw from
+ * `record` is dropped.
+ */
+export function recordOnSpawn(child: ChildProcess, recording: ISpawnRecording): void {
+  let recorded: boolean = false;
+  const recordOnce = (): void => {
+    if (recorded) return;
+    recorded = true;
+    tryRecord(recording);
+  };
+  hookSpawnMethod(child, { folder: recording.folder, record: recordOnce });
+  child.once(SPAWN_EVENT, recordOnce);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts
new file mode 100644
index 00000000000..8038533fc70
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { readFolderNames, writeOperationGroupsEntry } from './DaemonOperationGroups';
+
+const PROC_UPTIME: string = '/proc/uptime';
+const UTF8: BufferEncoding = 'utf8';
+// "<seconds>.<hundredths> <idle seconds>": the kernel always prints two digits after the point.
+const UPTIME_PATTERN: RegExp = /^(\d+)\.(\d\d) /;
+const SECONDS_MATCH: number = 1;
+const HUNDREDTHS_MATCH: number = 2;
+// USER_HZ, the unit of a `/proc` stat start time, is 100 on every Linux architecture that Node runs on.
+const TICKS_PER_SECOND: number = 100;
+const MARK_PREFIX: string = 'spawn-';
+const MARK_NAME_PATTERN: RegExp = /^spawn-(\d+)$/;
+const TICKS_MATCH: number = 1;
+
+/**
+ * The clock ticks since boot, from `/proc/uptime`. Both it and a `/proc` stat start time count the boot-time
+ * clock and truncate, so a process forked after this read has a start time at least this value. Throws when
+ * `/proc/uptime` cannot be read.
+ */
+export function readUptimeTicks(): number {
+  const match: RegExpExecArray | null = UPTIME_PATTERN.exec(fs.readFileSync(PROC_UPTIME, UTF8));
+  if (!match) throw new Error(`${PROC_UPTIME} has an unexpected format`);
+  return Number(match[SECONDS_MATCH]) * TICKS_PER_SECOND + Number(match[HUNDREDTHS_MATCH]);
+}
+
+// Without a mark, only a child that this daemon dies while starting goes without a reap.
+function tryWriteSpawnMark(folder: string): string | undefined {
+  try {
+    const markPath: string = path.join(folder, `${MARK_PREFIX}${readUptimeTicks()}`);
+    writeOperationGroupsEntry(markPath);
+    return markPath;
+  } catch {
+    return undefined;
+  }
+}
+
+// A mark left behind only lets a later reap also consider the children that started just after it.
+function tryRemoveSpawnMark(markPath: string): void {
+  try {
+    fs.rmSync(markPath, { force: true });
+  } catch {
+    // See above.
+  }
+}
+
+/**
+ * Runs `spawn`, which starts a child and records it; when `detached`, between writing a spawn mark in `folder`
+ * and removing it. So if this process dies while it starts a child that leads its own process group, before the
+ * child is recorded, the mark is left (see {@link readSpawnMarks}).
+ */
+export function withSpawnMark<T>(folder: string, detached: boolean, spawn: () => T): T {
+  const markPath: string | undefined = detached ? tryWriteSpawnMark(folder) : undefined;
+  try {
+    return spawn();
+  } finally {
+    if (markPath !== undefined) tryRemoveSpawnMark(markPath);
+  }
+}
+
+/** The clock ticks since boot (see {@link readUptimeTicks}) at which the spawns marked in `folder` began. */
+export function readSpawnMarks(folder: string): number[] {
+  return readFolderNames(folder).flatMap((name: string) => {
+    const match: RegExpExecArray | null = MARK_NAME_PATTERN.exec(name);
+    return match ? [Number(match[TICKS_MATCH])] : [];
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts
new file mode 100644
index 00000000000..2a2ff4d6f3b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts
@@ -0,0 +1,81 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import type { IProcessStat } from './DaemonProcessStat';
+import type { IReapContext } from './DaemonReapOptions';
+import type { DaemonOperationGroupLeftRunningReason } from './DaemonReclaimOptions';
+
+/** A record whose group is read, with the context of its reap and the marker of the daemon that wrote it. */
+export interface IOperationGroupProbe {
+  readonly record: IOperationGroupRecord;
+  readonly context: IReapContext;
+  readonly marker: string;
+}
+
+/** How a recorded operation process group looks now. */
+export interface IOperationGroupState extends IOperationGroupProbe {
+  /** The process whose PID is the group's ID, unless it has exited. */
+  readonly leader: IProcessStat | undefined;
+  /** The processes of the group that have not exited. */
+  readonly members: readonly IProcessStat[];
+}
+
+interface IReasonCheck {
+  readonly reason: DaemonOperationGroupLeftRunningReason;
+  readonly applies: (state: IOperationGroupState) => boolean;
+}
+
+function isCallerGroup({ record, context }: IOperationGroupState): boolean {
+  const ownGroupId: number | undefined = context.ops.ownGroupId();
+  return record.groupId === context.selfPid || ownGroupId === undefined || ownGroupId === record.groupId;
+}
+
+function isDaemonPidInUse({ record, context }: IOperationGroupState): boolean {
+  const { deadPid } = context;
+  return context.deadPidReused ? record.groupId === deadPid : context.ops.isProcessAlive(deadPid);
+}
+
+function isRecordedLeader(leader: IProcessStat, { groupId, startTime }: IOperationGroupRecord): boolean {
+  return leader.startTime === startTime && leader.groupId === groupId && leader.sessionId === groupId;
+}
+
+function hasOtherLeader({ record, leader }: IOperationGroupState): boolean {
+  return leader !== undefined && !isRecordedLeader(leader, record);
+}
+
+function hasMemberInOtherSession({ record, leader, members }: IOperationGroupState): boolean {
+  return leader === undefined && members.some((member: IProcessStat) => member.sessionId !== record.groupId);
+}
+
+function lacksMarker({ context, marker, leader, members }: IOperationGroupState): boolean {
+  const isMarked = (member: IProcessStat): boolean => context.ops.hasEnvironmentEntry(member.pid, marker);
+  return leader === undefined && !members.some(isMarked);
+}
+
+// The conditions of `isProvenOperationGroup`, in its order, each as the reason why a group fails it.
+const REASON_CHECKS: readonly IReasonCheck[] = [
+  { reason: 'callerGroup', applies: isCallerGroup },
+  { reason: 'daemonPidInUse', applies: isDaemonPidInUse },
+  { reason: 'leaderChanged', applies: hasOtherLeader },
+  { reason: 'otherSession', applies: hasMemberInOtherSession },
+  { reason: 'noMarker', applies: lacksMarker }
+];
+
+/** Reads the leader and the live members of the probed record's group. */
+export function readOperationGroupState(probe: IOperationGroupProbe): IOperationGroupState {
+  const { ops } = probe.context;
+  const stat: IProcessStat | undefined = ops.readProcessStat(probe.record.groupId);
+  const leader: IProcessStat | undefined = stat?.exited ? undefined : stat;
+  return { ...probe, leader, members: ops.listLiveGroupMembers(probe.record.groupId) };
+}
+
+/**
+ * The first condition that the group fails, in the order in which `isProvenOperationGroup` checks them, or
+ * `undefined` when it passes every one.
+ */
+export function findOperationGroupLeftRunningReason(
+  state: IOperationGroupState
+): DaemonOperationGroupLeftRunningReason | undefined {
+  return REASON_CHECKS.find((check: IReasonCheck) => check.applies(state))?.reason;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts
new file mode 100644
index 00000000000..161d0f2367f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import { listOperationGroupsDaemonPids } from './DaemonOperationGroups';
+import { createReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+
+// Only a folder's pid is known, not its daemon's start time, so a live process with that pid may be the
+// daemon or may reuse its pid. The daemon ran as this user, so only a pid that has no process this user may
+// signal proves that it is gone.
+function isStranded(context: IReapContext): boolean {
+  return context.deadPid !== context.selfPid && !context.ops.isProcessAlive(context.deadPid);
+}
+
+/**
+ * Reaps the record folders beside `lockfilePath` that belong to daemons which are gone but which no lockfile
+ * names any more, for example because an older `rush-client daemon stop --force` removed the lockfile,
+ * without a reclaim, while their operations still ran.
+ *
+ * @remarks
+ * The folders of the caller and of `ownerPid`, the daemon that the lockfile names, are skipped; the reclaim
+ * reaps the owner's folder by itself. A folder whose pid has a live process stays for a later reclaim. Each
+ * other folder goes through {@link reapDeadDaemonOperationGroupsAsync}: a record is signaled only with the
+ * proof that it requires, unproven records are dropped without a signal, and a folder that is a symbolic link
+ * or that another user owns is left alone. Call only under the reclaim mutex.
+ */
+export async function sweepStrandedOperationGroupsAsync(
+  lockfilePath: string,
+  ownerPid: number | undefined,
+  options: IDaemonOrphanReaperOptions
+): Promise<void> {
+  const stranded: IReapContext[] = listOperationGroupsDaemonPids(lockfilePath)
+    .filter((pid: number) => pid !== ownerPid)
+    .map((pid: number) => createReapContext(pid, options))
+    .filter(isStranded);
+  for (const { deadPid } of stranded) {
+    await reapDeadDaemonOperationGroupsAsync(lockfilePath, deadPid, options);
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
new file mode 100644
index 00000000000..803b3ccae85
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
@@ -0,0 +1,88 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+const FOLDER_INFIX: string = '.groups-';
+const NAME_SEPARATOR: string = '-';
+const RECORD_NAME_PATTERN: RegExp = /^(\d+)-(\d+)$/;
+// A pid as getOperationGroupsFolder() writes it: no sign, no leading zero, and never 0.
+const DAEMON_PID_PATTERN: RegExp = /^[1-9]\d*$/;
+const GROUP_ID_MATCH: number = 1;
+const START_TIME_MATCH: number = 2;
+const DIR_MODE: number = 0o700;
+const FILE_MODE: number = 0o600;
+const EMPTY_FILE: string = '';
+
+/** A running operation process group: its leader's pid (which is the group id) and start time. */
+export interface IOperationGroupRecord {
+  readonly groupId: number;
+  readonly startTime: string;
+}
+
+/** The sidecar folder in which daemon `daemonPid` records the process groups of its running operations. */
+export function getOperationGroupsFolder(lockfilePath: string, daemonPid: number): string {
+  return `${lockfilePath}${FOLDER_INFIX}${daemonPid}`;
+}
+
+function getRecordPath(folder: string, record: IOperationGroupRecord): string {
+  return path.join(folder, `${record.groupId}${NAME_SEPARATOR}${record.startTime}`);
+}
+
+/** Writes the empty file `entryPath`, creating its sidecar folder first; for records and spawn marks. */
+export function writeOperationGroupsEntry(entryPath: string): void {
+  fs.mkdirSync(path.dirname(entryPath), { recursive: true, mode: DIR_MODE });
+  fs.writeFileSync(entryPath, EMPTY_FILE, { mode: FILE_MODE });
+}
+
+/** Records a running group as an empty file whose name is the record, so no record is ever half-written. */
+export function writeOperationGroupRecord(folder: string, record: IOperationGroupRecord): void {
+  writeOperationGroupsEntry(getRecordPath(folder, record));
+}
+
+/** Forgets a group whose leader has exited. */
+export function removeOperationGroupRecord(folder: string, record: IOperationGroupRecord): void {
+  fs.rmSync(getRecordPath(folder, record), { force: true });
+}
+
+function parseRecordName(name: string): IOperationGroupRecord | undefined {
+  const match: RegExpExecArray | null = RECORD_NAME_PATTERN.exec(name);
+  return match ? { groupId: Number(match[GROUP_ID_MATCH]), startTime: match[START_TIME_MATCH] } : undefined;
+}
+
+function isRecord(record: IOperationGroupRecord | undefined): record is IOperationGroupRecord {
+  return record !== undefined;
+}
+
+/** The names of the entries in `folder`; none when it is missing or unreadable. */
+export function readFolderNames(folder: string): string[] {
+  try {
+    return fs.readdirSync(folder);
+  } catch {
+    return [];
+  }
+}
+
+/** Reads the recorded groups; a missing or unreadable folder holds none. */
+export function readOperationGroupRecords(folder: string): IOperationGroupRecord[] {
+  return readFolderNames(folder).map(parseRecordName).filter(isRecord);
+}
+
+/**
+ * The pids of the daemons, running or not, whose record folders are beside `lockfilePath`. A name that
+ * isn't a pid as {@link getOperationGroupsFolder} writes it, or whose number is too large to be exact, is
+ * skipped.
+ */
+export function listOperationGroupsDaemonPids(lockfilePath: string): number[] {
+  const prefix: string = `${path.basename(lockfilePath)}${FOLDER_INFIX}`;
+  return readFolderNames(path.dirname(lockfilePath))
+    .filter((name: string) => name.startsWith(prefix) && DAEMON_PID_PATTERN.test(name.slice(prefix.length)))
+    .map((name: string) => Number(name.slice(prefix.length)))
+    .filter(Number.isSafeInteger);
+}
+
+/** Deletes the sidecar folder and every record in it; idempotent. */
+export function removeOperationGroupRecords(folder: string): void {
+  fs.rmSync(folder, { recursive: true, force: true });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
index bd4c61534b3..5ee589a3a1e 100644
--- a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
@@ -1,75 +1,33 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
+import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
 import type { IDaemonLockfile } from './DaemonLockfile';
-import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
-import { POSIX_PROCESS_GROUP_OPS } from './DaemonProcessGroup';
+import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import { sweepStrandedOperationGroupsAsync } from './DaemonOperationGroupSweep';
+import { isOwnedEntry } from './DaemonOwnedEntry';
+import {
+  createReapContext,
+  isSignalableGroup,
+  reportOrphansReaped,
+  resolveCallerUid
+} from './DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
 
-const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
-// 0 and 1 are never daemons, and kill(-0)/kill(-1) would signal our own group or every process.
-const FIRST_USER_PID: number = 2;
-const POLL_INTERVAL_MS: number = 20;
-const DEFAULT_GRACE_MS: number = 2000;
-
-/** Outcome of reaping a dead daemon's process group. */
-export type DaemonOrphanReapOutcome = 'none' | 'terminated' | 'killed';
-
-/** Options for {@link reapDeadDaemonProcessGroupAsync}; every field defaults to the real process. */
-export interface IDaemonOrphanReaperOptions {
-  readonly ops?: IDaemonProcessGroupOps;
-  readonly platform?: NodeJS.Platform;
-  readonly selfPid?: number;
-  /** How long SIGTERM'd (and then SIGKILL'd) processes get to exit. */
-  readonly graceMs?: number;
-}
-
-interface IReapContext {
-  readonly ops: IDaemonProcessGroupOps;
-  readonly deadPid: number;
-  readonly graceMs: number;
-}
-type OrphanCheck = (pid: number) => boolean;
-
-function isNeitherSelfNorOwnGroup(pid: number, selfPid: number, ops: IDaemonProcessGroupOps): boolean {
-  // Fail closed: an unknown own group might be `pid` (e.g. rush-client run by an operation).
-  const ownGroupId: number | undefined = ops.ownGroupId();
-  return pid !== selfPid && ownGroupId !== undefined && pid !== ownGroupId;
-}
-
-function orphanChecks(options: IDaemonOrphanReaperOptions, ops: IDaemonProcessGroupOps): OrphanCheck[] {
-  return [
-    () => (options.platform ?? process.platform) !== WINDOWS_PLATFORM,
-    (pid: number) => Number.isSafeInteger(pid) && pid >= FIRST_USER_PID,
-    (pid: number) => isNeitherSelfNorOwnGroup(pid, options.selfPid ?? process.pid, ops),
-    (pid: number) => !ops.isProcessAlive(pid),
-    (pid: number) => ops.groupExists(pid)
-  ];
-}
-
-async function waitForGroupExitAsync(context: IReapContext): Promise<boolean> {
-  const deadline: number = context.ops.now() + context.graceMs;
-  while (context.ops.now() < deadline) {
-    if (!context.ops.groupExists(context.deadPid)) return true;
-    await context.ops.delayAsync(POLL_INTERVAL_MS);
-  }
-  return !context.ops.groupExists(context.deadPid);
-}
-
-async function terminateGroupAsync(context: IReapContext): Promise<DaemonOrphanReapOutcome> {
-  context.ops.signalGroup(context.deadPid, 'SIGTERM');
-  if (await waitForGroupExitAsync(context)) return 'terminated';
-  context.ops.signalGroup(context.deadPid, 'SIGKILL');
-  if (await waitForGroupExitAsync(context)) return 'killed';
-  throw new Error(`Processes of dead daemon ${context.deadPid} survived SIGKILL; not reclaiming its socket.`);
+function isOrphanedDaemonGroup(context: IReapContext): boolean {
+  return isSignalableGroup(context.deadPid, context) && context.ops.groupExists(context.deadPid);
 }
 
 /**
- * Terminates operation processes left behind by a daemon that died without joining them (SIGKILL, OOM).
+ * Terminates processes left behind in a dead daemon's own process group (SIGKILL, OOM).
  *
  * @remarks
- * The daemon is spawned detached, so its pid is its process group id, and phased operation children inherit
- * that group (children spawned with their own detached group are out of scope). Sends SIGTERM, then SIGKILL
- * after `graceMs`, and throws if the group still has not exited after a further `graceMs`.
+ * The daemon is spawned detached, so its pid is its process group id, and children it spawns without
+ * `detached` inherit that group. Detached operation children lead groups of their own; see
+ * {@link reapDeadDaemonOperationGroupsAsync}. Sends SIGTERM, then SIGKILL after `graceMs`, and throws if the
+ * group still has not exited after a further `graceMs`.
  * PID-reuse guard: only group `deadPid` is signaled, and only once `deadPid` is proven dead while the group
  * still exists; POSIX never reuses a pid still in use as a process group id, so every remaining member
  * belongs to the dead daemon. Never signals the caller's pid or group, and does nothing when the caller's
@@ -80,21 +38,46 @@ export async function reapDeadDaemonProcessGroupAsync(
   options: IDaemonOrphanReaperOptions = {}
 ): Promise<DaemonOrphanReapOutcome> {
   const context: IReapContext = createReapContext(deadPid, options);
-  if (!orphanChecks(options, context.ops).every((check: OrphanCheck) => check(deadPid))) return 'none';
-  const outcome: DaemonOrphanReapOutcome = await terminateGroupAsync(context);
-  context.ops.log(`Reclaimed dead daemon ${deadPid}: its orphaned operation process group was ${outcome}.`);
+  if (!isOrphanedDaemonGroup(context)) return 'none';
+  const outcome: IDaemonOrphanReap['outcome'] = await terminateProcessGroupsAsync(context, [deadPid]);
+  reportOrphansReaped(
+    context,
+    { daemonPid: deadPid, processGroupIds: [deadPid], outcome },
+    `Reclaimed dead daemon ${deadPid}: its orphaned operation process group was ${outcome}.`
+  );
   return outcome;
 }
 
-function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
-  return {
-    ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
-    deadPid,
-    graceMs: options.graceMs ?? DEFAULT_GRACE_MS
-  };
+function isOwnRecord(
+  lockfilePath: string,
+  owner: IDaemonLockfile | undefined,
+  options: IDaemonOrphanReaperOptions
+): owner is IDaemonLockfile {
+  return owner !== undefined && isOwnedEntry(lockfilePath, 'file', resolveCallerUid(options));
+}
+
+async function reapRecordedOwnerAsync(
+  lockfilePath: string,
+  owner: IDaemonLockfile | undefined,
+  options: IDaemonOrphanReaperOptions
+): Promise<void> {
+  if (!isOwnRecord(lockfilePath, owner, options)) return;
+  await reapDeadDaemonProcessGroupAsync(owner.pid, options);
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, owner.pid, options);
 }
 
-/** Reaps the orphaned operations of a reclaimed daemon's recorded owner, if there is one. */
-export async function reapOrphansOfDeadOwnerAsync(owner: IDaemonLockfile | undefined): Promise<void> {
-  if (owner) await reapDeadDaemonProcessGroupAsync(owner.pid);
+/**
+ * Reaps the orphaned processes of a reclaimed daemon's recorded owner, if there is one, and then the
+ * recorded operation groups of other dead daemons that no lockfile names
+ * (see {@link sweepStrandedOperationGroupsAsync}). A lockfile that is a symbolic link, or that another user
+ * owns, names no daemon of this user, so its owner is not signaled, and the sweep skips the owner's folder
+ * too.
+ */
+export async function reapOrphansOfDeadOwnerAsync(
+  lockfilePath: string,
+  owner: IDaemonLockfile | undefined,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<void> {
+  await reapRecordedOwnerAsync(lockfilePath, owner, options);
+  await sweepStrandedOperationGroupsAsync(lockfilePath, owner?.pid, options);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonOwnGroup.ts b/libraries/rush-daemon-transport/src/DaemonOwnGroup.ts
new file mode 100644
index 00000000000..3c727f5a0ea
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOwnGroup.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const PROC_SELF_STAT: string = '/proc/self/stat';
+const UTF8: BufferEncoding = 'utf8';
+const COMM_END: string = ')';
+const FIELD_SEPARATOR: string = ' ';
+// After the ")" that ends the command name come: " <state> <ppid> <pgrp> ...".
+const PGRP_FIELD_INDEX: number = 3;
+
+/** This Linux process's own process group id, or `undefined` when the platform cannot report it. */
+export function ownGroupId(): number | undefined {
+  try {
+    const stat: string = fs.readFileSync(PROC_SELF_STAT, UTF8);
+    const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
+    return Number(fields[PGRP_FIELD_INDEX]);
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts b/libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts
new file mode 100644
index 00000000000..a7d82d88018
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+/** What a record must be: a regular file or a directory, never a symbolic link. */
+export type DaemonOwnedEntryKind = 'file' | 'directory';
+
+const DIRECTORY: DaemonOwnedEntryKind = 'directory';
+
+function isKind(stats: fs.Stats, kind: DaemonOwnedEntryKind): boolean {
+  return kind === DIRECTORY ? stats.isDirectory() : stats.isFile();
+}
+
+function isOwner(stats: fs.Stats, uid: number | undefined): boolean {
+  // Windows has no user ids to compare.
+  return uid === undefined || stats.uid === uid;
+}
+
+/** `true` when `entryPath` itself (not a link target) is a `kind` that user `uid` owns. */
+export function isOwnedEntry(
+  entryPath: string,
+  kind: DaemonOwnedEntryKind,
+  uid: number | undefined
+): boolean {
+  const stats: fs.Stats | undefined = fs.lstatSync(entryPath, { throwIfNoEntry: false });
+  return stats !== undefined && isOwner(stats, uid) && isKind(stats, kind);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonPaths.ts b/libraries/rush-daemon-transport/src/DaemonPaths.ts
index fb1f4e558ac..6e3b78134d2 100644
--- a/libraries/rush-daemon-transport/src/DaemonPaths.ts
+++ b/libraries/rush-daemon-transport/src/DaemonPaths.ts
@@ -8,7 +8,16 @@ const PIPE_PREFIX: string = '\\\\.\\pipe\\';
 const SOCKET_SUFFIX: string = '.sock';
 const LOCKFILE_SUFFIX: string = '.pid.json';
 const RUNTIME_DIR_NAME: string = 'rushd';
-const XDG_RUNTIME_DIR_ENV: string = 'XDG_RUNTIME_DIR';
+// Unlike TMPDIR or XDG_RUNTIME_DIR, /tmp is the same folder for every process of a user, whatever its
+// environment (sudo, cron, env -i, ssh without PAM, a service unit), so all of them meet at one daemon.
+const SHARED_POSIX_TEMP_DIR: string = '/tmp';
+
+/**
+ * The environment variable that moves the per-user runtime directory on POSIX. Only an absolute path is used.
+ *
+ * @beta
+ */
+export const DAEMON_RUNTIME_DIR_ENV_VAR: 'RUSHD_RUNTIME_DIR' = 'RUSHD_RUNTIME_DIR';
 
 /**
  * The platform facts {@link resolveDaemonPaths} needs, injectable for tests.
@@ -40,18 +49,18 @@ export interface IDaemonPaths {
   readonly lockfilePath: string;
 }
 
-/**
- * Resolves the per-user socket/pipe and lockfile paths for a workspace key.
- *
- * @remarks
- * POSIX: `$XDG_RUNTIME_DIR/rushd-<uid>/` (falling back to `<os.tmpdir()>/rushd-<uid>/`),
- * with the socket at `rushd-<key>.sock` inside it. Windows: the named pipe
- * `\\.\pipe\rushd-<key>`; the lockfile lives in `<os.tmpdir()>/rushd/` (the
- * temporary directory is already per-user on Windows).
- *
- * @beta
- */
-export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspaceKey: string): IDaemonPaths {
+/** The base folder that `RUSHD_RUNTIME_DIR` names, when it is an absolute path. */
+function getConfiguredRuntimeBase(environment: IDaemonPathEnvironment): string | undefined {
+  const value: string | undefined = environment.env[DAEMON_RUNTIME_DIR_ENV_VAR];
+  return value !== undefined && path.posix.isAbsolute(value) ? value : undefined;
+}
+
+/** Resolves the paths of `workspaceKey` in the runtime directory `<base>/rushd-<uid>` (POSIX). */
+function resolveDaemonPathsInBase(
+  environment: IDaemonPathEnvironment,
+  workspaceKey: string,
+  base: string
+): IDaemonPaths {
   if (environment.platform === WINDOWS_PLATFORM) {
     return {
       runtimeDir: undefined,
@@ -59,7 +68,6 @@ export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspac
       lockfilePath: path.win32.join(environment.tmpdir, RUNTIME_DIR_NAME, `${workspaceKey}${LOCKFILE_SUFFIX}`)
     };
   }
-  const base: string = environment.env[XDG_RUNTIME_DIR_ENV] ?? environment.tmpdir;
   const runtimeDir: string = path.posix.join(base, `${RUNTIME_DIR_NAME}-${environment.uid}`);
   return {
     runtimeDir,
@@ -67,3 +75,23 @@ export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspac
     lockfilePath: path.posix.join(runtimeDir, `${workspaceKey}${LOCKFILE_SUFFIX}`)
   };
 }
+
+/**
+ * Resolves the per-user socket/pipe and lockfile paths at which a client finds the daemon of a workspace key.
+ *
+ * @remarks
+ * POSIX: `/tmp/rushd-<uid>/`, or `$RUSHD_RUNTIME_DIR/rushd-<uid>/` when that variable is an absolute path,
+ * with the socket at `rushd-<key>.sock` inside it. `TMPDIR` and `XDG_RUNTIME_DIR` are deliberately not
+ * consulted: they differ between the shells, services and tools of one user, which would give one checkout
+ * one daemon per environment. Windows: the named pipe `\\.\pipe\rushd-<key>`; the lockfile lives in
+ * `<os.tmpdir()>/rushd/` (the temporary directory is already per-user on Windows).
+ * A daemon resolves the paths it listens at with this same rule, and a client that starts one passes the
+ * base it chose as `RUSHD_RUNTIME_DIR`, so a daemon, its successor and every client of a checkout meet at
+ * one endpoint.
+ *
+ * @beta
+ */
+export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspaceKey: string): IDaemonPaths {
+  const base: string = getConfiguredRuntimeBase(environment) ?? SHARED_POSIX_TEMP_DIR;
+  return resolveDaemonPathsInBase(environment, workspaceKey, base);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
index a8eb871383d..48173b8d7a4 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
@@ -4,24 +4,34 @@
 import * as fs from 'node:fs';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
+import { hasLiveGroupMember, mayHaveGroupMembers } from './DaemonGroupMemberScan';
 import { isDaemonProcessAlive } from './DaemonLockfile';
+import { ownGroupId } from './DaemonOwnGroup';
+import { listLiveGroupMembers, listProcesses } from './DaemonProcessList';
+import { hasEnvironmentEntry, readProcessStat } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
 
 const NO_SIGNAL: number = 0;
 const NO_SUCH_PROCESS: string = 'ESRCH';
 const PROC_SELF_STAT: string = '/proc/self/stat';
-const UTF8: BufferEncoding = 'utf8';
-const COMM_END: string = ')';
-const FIELD_SEPARATOR: string = ' ';
-// After the ")" that ends the command name come: " <state> <ppid> <pgrp> ...".
-const PGRP_FIELD_INDEX: number = 3;
 
-/** Process probing/signaling used to reap a dead daemon's process group; injectable for tests. */
+/** Process probing/signaling used to reap a dead daemon's orphaned process groups; injectable for tests. */
 export interface IDaemonProcessGroupOps {
   readonly isProcessAlive: (pid: number) => boolean;
+  /** `true` while a member of the group has not exited; where `/proc` exists, a group of zombies is gone. */
   readonly groupExists: (groupId: number) => boolean;
+  /** `false` only when the group has no process at all, not even a zombie; `true` when that is unknown. */
+  readonly mayHaveMembers: (groupId: number) => boolean;
   readonly signalGroup: (groupId: number, signal: NodeJS.Signals) => void;
   /** The caller's own process group id, or `undefined` when the platform cannot report it. */
   readonly ownGroupId: () => number | undefined;
+  /** Reads a process's `/proc` identity, or `undefined` when it is gone (or there is no `/proc`). */
+  readonly readProcessStat: (pid: number) => IProcessStat | undefined;
+  /** The processes in a group that have not exited. */
+  readonly listLiveGroupMembers: (groupId: number) => IProcessStat[];
+  /** Every process's `/proc` identity, zombies included; none where there is no `/proc`. */
+  readonly listProcesses: () => IProcessStat[];
+  readonly hasEnvironmentEntry: (pid: number, entry: string) => boolean;
   readonly delayAsync: (ms: number) => Promise<void>;
   readonly now: () => number;
   readonly log: (message: string) => void;
@@ -32,7 +42,7 @@ function rethrowUnlessNoSuchProcess(error: unknown): void {
   if ((error as NodeJS.ErrnoException | undefined)?.code !== NO_SUCH_PROCESS) throw error;
 }
 
-function groupExists(groupId: number): boolean {
+function hasAnyMember(groupId: number): boolean {
   try {
     process.kill(-groupId, NO_SIGNAL);
     return true;
@@ -42,6 +52,13 @@ function groupExists(groupId: number): boolean {
   }
 }
 
+// kill() also finds a group whose members have all exited but are not reaped (zombies). No signal ends
+// them, and a parent that never reaps, such as a container's init, keeps them, so where `/proc` can tell,
+// they don't count. Without `/proc`, any member counts.
+function groupExists(groupId: number): boolean {
+  return hasAnyMember(groupId) && (!fs.existsSync(PROC_SELF_STAT) || hasLiveGroupMember(groupId));
+}
+
 function signalGroup(groupId: number, signal: NodeJS.Signals): void {
   try {
     process.kill(-groupId, signal);
@@ -50,16 +67,6 @@ function signalGroup(groupId: number, signal: NodeJS.Signals): void {
   }
 }
 
-function ownGroupId(): number | undefined {
-  try {
-    const stat: string = fs.readFileSync(PROC_SELF_STAT, UTF8);
-    const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
-    return Number(fields[PGRP_FIELD_INDEX]);
-  } catch {
-    return undefined;
-  }
-}
-
 function log(message: string): void {
   process.emitWarning(message, { code: 'RUSH_DAEMON_ORPHANS_REAPED' });
 }
@@ -68,8 +75,13 @@ function log(message: string): void {
 export const POSIX_PROCESS_GROUP_OPS: IDaemonProcessGroupOps = {
   isProcessAlive: isDaemonProcessAlive,
   groupExists,
+  mayHaveMembers: mayHaveGroupMembers,
   signalGroup,
   ownGroupId,
+  readProcessStat,
+  listLiveGroupMembers,
+  listProcesses,
+  hasEnvironmentEntry,
   delayAsync: async (ms: number) => {
     await delayAsync(ms);
   },
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessList.ts b/libraries/rush-daemon-transport/src/DaemonProcessList.ts
new file mode 100644
index 00000000000..9ab0ac769fc
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessList.ts
@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { isLiveMemberOf, readProcessStat } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+
+const PROC_ROOT: string = '/proc';
+const PID_PATTERN: RegExp = /^\d+$/;
+
+/** Lists the pids in `/proc`; throws when `/proc` cannot be listed. */
+export function readProcessIds(): number[] {
+  return fs
+    .readdirSync(PROC_ROOT)
+    .filter((name: string) => PID_PATTERN.test(name))
+    .map(Number);
+}
+
+function listProcessIds(): number[] {
+  try {
+    return readProcessIds();
+  } catch {
+    return [];
+  }
+}
+
+function isReadable(stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined;
+}
+
+/** Reads the `/proc` record of every process, zombies included; none when `/proc` cannot be listed. */
+export function listProcesses(): IProcessStat[] {
+  return listProcessIds().map(readProcessStat).filter(isReadable);
+}
+
+/** Lists the processes of group `groupId` that have not exited, by scanning `/proc`. */
+export function listLiveGroupMembers(groupId: number): IProcessStat[] {
+  return listProcessIds()
+    .map(readProcessStat)
+    .filter((stat: IProcessStat | undefined): stat is IProcessStat => isLiveMemberOf(groupId, stat));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts b/libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts
new file mode 100644
index 00000000000..1cfba3ec005
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
+import type { IReapContext } from './DaemonReapOptions';
+
+interface IKeptRead<T> {
+  readonly value: T;
+}
+
+// A read that throws is not kept, so the next caller reads again and gets its own error.
+function readOnce<T>(read: (id: number) => T): (id: number) => T {
+  const kept: Map<number, IKeptRead<T>> = new Map();
+  return (id: number): T => {
+    const result: IKeptRead<T> = kept.get(id) ?? { value: read(id) };
+    kept.set(id, result);
+    return result.value;
+  };
+}
+
+/**
+ * `context`, with each process's `/proc` record and each group's list of live members read at most once.
+ *
+ * @remarks
+ * The proof and the report of one reap share it: the report judges a group on what the proof read of it, and
+ * scans every process's record only for a group that the proof did not read. Whether a group has any process
+ * at all (`mayHaveMembers`) is still asked each time.
+ */
+export function withProcessReadsOnce(context: IReapContext): IReapContext {
+  const { ops } = context;
+  const readsOnce: IDaemonProcessGroupOps = {
+    ...ops,
+    readProcessStat: readOnce(ops.readProcessStat),
+    listLiveGroupMembers: readOnce(ops.listLiveGroupMembers)
+  };
+  return { ...context, ops: readsOnce };
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
new file mode 100644
index 00000000000..e7b4e09d0bb
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const PROC_ROOT: string = '/proc';
+const STAT_FILE_NAME: string = 'stat';
+const ENVIRON_FILE_NAME: string = 'environ';
+const ENTRY_TERMINATOR: string = '\0';
+const UTF8: BufferEncoding = 'utf8';
+const COMM_END: string = ')';
+const FIELD_SEPARATOR: string = ' ';
+// Indices into the fields after the ")" that ends the command name (proc_pid_stat(5)):
+// ") <state> <ppid> <pgrp> <session> ...", where starttime is field 22 of the whole record.
+const STATE_INDEX: number = 1;
+const GROUP_INDEX: number = 3;
+const SESSION_INDEX: number = 4;
+const START_TIME_INDEX: number = 20;
+const EXITED_STATES: ReadonlySet<string> = new Set(['Z', 'X']);
+
+/** The identity fields of one Linux `/proc/<pid>/stat` record. */
+export interface IProcessStat {
+  readonly pid: number;
+  readonly groupId: number;
+  readonly sessionId: number;
+  /** Clock ticks after boot when the process started; a reused pid gets a different value. */
+  readonly startTime: string;
+  /** `true` for a zombie: it has exited but its parent has not reaped it yet. */
+  readonly exited: boolean;
+}
+
+function parseProcessStat(pid: number, stat: string): IProcessStat {
+  // The command name may contain spaces and ")", so parse after its last ")".
+  const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
+  return {
+    pid,
+    groupId: Number(fields[GROUP_INDEX]),
+    sessionId: Number(fields[SESSION_INDEX]),
+    startTime: fields[START_TIME_INDEX],
+    exited: EXITED_STATES.has(fields[STATE_INDEX])
+  };
+}
+
+/** Reads `/proc/<pid>/stat`; throws when the record cannot be read. */
+export function readStatRecord(pid: number): IProcessStat {
+  return parseProcessStat(pid, fs.readFileSync(`${PROC_ROOT}/${pid}/${STAT_FILE_NAME}`, UTF8));
+}
+
+/** Reads `/proc/<pid>/stat`; `undefined` when the process is gone or the platform has no `/proc`. */
+export function readProcessStat(pid: number): IProcessStat | undefined {
+  try {
+    return readStatRecord(pid);
+  } catch {
+    return undefined;
+  }
+}
+
+/** `true` when `stat` is the record of a process in group `groupId` that has not exited. */
+export function isLiveMemberOf(groupId: number, stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined && stat.groupId === groupId && !stat.exited;
+}
+
+/**
+ * `true` when `stat` is the record of a process that leads its own process group and session, as a `detached`
+ * child does (`SubprocessTerminator.RECOMMENDED_OPTIONS` on POSIX).
+ */
+export function isGroupAndSessionLeader(stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined && stat.groupId === stat.pid && stat.sessionId === stat.pid;
+}
+
+/**
+ * `true` when the environment that process `pid` started with holds exactly `entry` (`NAME=value`); `false`
+ * when it does not, or when it cannot be read: the process is gone or another user's, or there is no `/proc`.
+ */
+export function hasEnvironmentEntry(pid: number, entry: string): boolean {
+  try {
+    const environ: string = fs.readFileSync(`${PROC_ROOT}/${pid}/${ENVIRON_FILE_NAME}`, UTF8);
+    return environ.split(ENTRY_TERMINATOR).includes(entry);
+  } catch {
+    return false;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
new file mode 100644
index 00000000000..1fd3f7d2dfd
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
+import { POSIX_PROCESS_GROUP_OPS } from './DaemonProcessGroup';
+import type { IDaemonOrphanReap, IDaemonReclaimOptions } from './DaemonReclaimOptions';
+
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+// 0 and 1 are never daemons, and kill(-0)/kill(-1) would signal our own group or every process.
+const FIRST_USER_PID: number = 2;
+const DEFAULT_GRACE_MS: number = 2000;
+
+/** Options for reaping a dead daemon's orphans; every field defaults to the real process. */
+export interface IDaemonOrphanReaperOptions extends IDaemonReclaimOptions {
+  readonly ops?: IDaemonProcessGroupOps;
+  readonly platform?: NodeJS.Platform;
+  readonly selfPid?: number;
+  /** How long SIGTERM'd (and then SIGKILL'd) processes get to exit. */
+  readonly graceMs?: number;
+  /** The caller's user id (`process.getuid()`); only records that this user owns are acted on. */
+  readonly uid?: number;
+  /**
+   * `true` when a process that started after the dead daemon's lockfile was written now has the daemon's pid:
+   * the daemon is gone although its pid is alive, and that process may lead group `deadPid`.
+   */
+  readonly deadPidReused?: boolean;
+}
+
+/** {@link IDaemonOrphanReaperOptions} with every default applied, for the dead daemon `deadPid`. */
+export interface IReapContext extends IDaemonReclaimOptions {
+  readonly ops: IDaemonProcessGroupOps;
+  readonly platform: NodeJS.Platform;
+  readonly selfPid: number;
+  readonly deadPid: number;
+  readonly graceMs: number;
+  readonly uid: number | undefined;
+  readonly deadPidReused: boolean;
+}
+
+function resolveCaller(options: IDaemonOrphanReaperOptions): Pick<IReapContext, 'platform' | 'selfPid'> {
+  return { platform: options.platform ?? process.platform, selfPid: options.selfPid ?? process.pid };
+}
+
+function resolveReapPolicy(
+  options: IDaemonOrphanReaperOptions
+): Pick<IReapContext, 'graceMs' | 'deadPidReused'> {
+  return { graceMs: options.graceMs ?? DEFAULT_GRACE_MS, deadPidReused: options.deadPidReused ?? false };
+}
+
+/** The user whose records may be acted on. */
+export function resolveCallerUid(options: IDaemonOrphanReaperOptions): number | undefined {
+  return options.uid ?? process.getuid?.();
+}
+
+/** Applies the defaults of {@link IDaemonOrphanReaperOptions}. */
+export function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
+  return {
+    ...resolveCaller(options),
+    ...resolveReapPolicy(options),
+    ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
+    deadPid,
+    uid: resolveCallerUid(options),
+    onOrphansReaped: options.onOrphansReaped,
+    onOperationGroupLeftRunning: options.onOperationGroupLeftRunning
+  };
+}
+
+/** Reports the process groups that a reap stopped to `onOrphansReaped`, or else logs `message`. */
+export function reportOrphansReaped(context: IReapContext, reap: IDaemonOrphanReap, message: string): void {
+  if (context.onOrphansReaped) context.onOrphansReaped(reap);
+  else context.ops.log(message);
+}
+
+function isNeitherSelfNorOwnGroup(groupId: number, context: IReapContext): boolean {
+  // Fail closed: an unknown own group might be `groupId` (e.g. rush-client run by an operation).
+  const ownGroupId: number | undefined = context.ops.ownGroupId();
+  return groupId !== context.selfPid && ownGroupId !== undefined && groupId !== ownGroupId;
+}
+
+type GroupCheck = (groupId: number, context: IReapContext) => boolean;
+
+const SIGNALABLE_GROUP_CHECKS: readonly GroupCheck[] = [
+  (groupId: number, context: IReapContext) => context.platform !== WINDOWS_PLATFORM,
+  (groupId: number) => Number.isSafeInteger(groupId) && groupId >= FIRST_USER_PID,
+  isNeitherSelfNorOwnGroup,
+  // A live daemon still owns its operations. The later process that has a gone daemon's pid may lead group
+  // `deadPid`, which is then never signaled.
+  (groupId: number, context: IReapContext) =>
+    context.deadPidReused ? groupId !== context.deadPid : !context.ops.isProcessAlive(context.deadPid)
+];
+
+/**
+ * `true` when group `groupId` may be signaled at all: Linux, a user pid, not ours, and its daemon is dead (or
+ * its pid was reused, and the group is not the one of that pid).
+ */
+export function isSignalableGroup(groupId: number, context: IReapContext): boolean {
+  return SIGNALABLE_GROUP_CHECKS.every((check: GroupCheck) => check(groupId, context));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index 92f0ed93231..06bdd1a7266 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -1,64 +1,43 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import * as fs from 'node:fs';
-
 import { connectDaemonAsync } from './DaemonConnector';
 import type { DaemonFrameConnection } from './DaemonFrameConnection';
-import {
-  isDaemonProcessAlive,
-  readDaemonLockfile,
-  removeDaemonArtifacts
-} from './DaemonLockfile';
+import { isDaemonProcessAlive, readDaemonLockfile, removeDaemonArtifacts } from './DaemonLockfile';
 import { reapOrphansOfDeadOwnerAsync } from './DaemonOrphanReaper';
 import type { IDaemonPaths } from './DaemonPaths';
-import { tryAcquireReclaimLock } from './DaemonReclaimLock';
-import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
-import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+import { runUnderReclaimMutexAsync, throwAlreadyRunning } from './DaemonReclaimMutex';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
 
 /**
  * Reclaims the socket/pipe path when it is held by a dead daemon.
  *
  * @remarks
- * Two-factor stale detection — the lockfile PID must be dead *and* a connect
- * probe must fail — so a daemon that is alive but momentarily unresponsive is
- * never reclaimed underneath itself. Reclaims are serialized through the
- * lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may
- * unlink the socket path, so a concurrent starter cannot delete a socket that
- * another process just bound. Operation processes still running in the dead
- * daemon's process group are terminated first (see `DaemonOrphanReaper`).
+ * Two-factor stale detection — the lockfile PID must be dead *and* a connect probe must fail — so a daemon
+ * that is alive but momentarily unresponsive is never reclaimed underneath itself. Reclaims are serialized
+ * through the lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may unlink the socket
+ * path, so a concurrent starter cannot delete a socket that another process just bound. Operation processes
+ * still running in the dead daemon's process group, or in the operation process groups that it recorded, are
+ * terminated first on Linux, and so are the operation process groups recorded by other daemons that are gone
+ * and that no lockfile names (see `DaemonOrphanReaper`). They are reported to `options.onOrphansReaped`. Nothing is
+ * read, reaped or removed unless the runtime directory is a private directory of this user.
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
- * the reclaim lock.
+ * the reclaim lock, with code `unsafeRuntimeDirectory` for an unsafe
+ * runtime directory, and with code `socketPathTooLong` for a socket path that
+ * no client could connect to.
  *
  * @beta
  */
-export async function reclaimStaleDaemonAsync(paths: IDaemonPaths): Promise<void> {
-  // The mutex lives beside the lockfile (never the same file): the lockfile
-  // records the *running* daemon's live PID, while the mutex only ever records
-  // a reclaimer's pid. So a live daemon is "locked" (its PID alive), while a
-  // dead daemon's stale record is safe to steal.
-  const lock: DaemonReclaimLockOutcome = tryAcquireReclaimLock(reclaimLockPath(paths));
-  if (!lock.acquired) {
-    throwAlreadyRunning(paths, 'another starter holds the reclaim lock');
-  }
-  try {
-    await reclaimUnderLockAsync(paths);
-  } finally {
-    try {
-      fs.unlinkSync(reclaimLockPath(paths));
-    } catch {
-      // Another starter may have already cleared it; release is best-effort.
-    }
-  }
+export async function reclaimStaleDaemonAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
+  await runUnderReclaimMutexAsync(paths, () => reclaimUnderLockAsync(paths, options));
 }
 
-function reclaimLockPath(paths: IDaemonPaths): string {
-  return `${paths.lockfilePath}.reclaim`;
-}
-
-async function reclaimUnderLockAsync(paths: IDaemonPaths): Promise<void> {
+async function reclaimUnderLockAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void> {
   const owner: ReturnType<typeof readDaemonLockfile> = readDaemonLockfile(paths.lockfilePath);
   if (isLockfilePidAlive(owner)) {
     throwAlreadyRunning(paths, 'its lockfile PID is alive');
@@ -68,7 +47,7 @@ async function reclaimUnderLockAsync(paths: IDaemonPaths): Promise<void> {
     throwAlreadyRunning(paths, 'it answers a connect probe');
   }
   // A daemon that died uncleanly leaves its operations running; stop them before a successor re-runs them.
-  await reapOrphansOfDeadOwnerAsync(owner);
+  await reapOrphansOfDeadOwnerAsync(paths.lockfilePath, owner, options);
   removeDaemonArtifacts(paths.lockfilePath, paths.socketPath);
 }
 
@@ -76,13 +55,6 @@ function isLockfilePidAlive(lockfile: ReturnType<typeof readDaemonLockfile>): bo
   return lockfile !== undefined && isDaemonProcessAlive(lockfile.pid);
 }
 
-function throwAlreadyRunning(paths: IDaemonPaths, reason: string): never {
-  throw new DaemonTransportError(
-    DaemonTransportErrorCode.daemonAlreadyRunning,
-    `A live daemon already listens at ${paths.socketPath} (${reason}).`
-  );
-}
-
 async function probeConnectionFailsAsync(socketPath: string): Promise<boolean> {
   try {
     const probe: DaemonFrameConnection = await connectDaemonAsync(socketPath);
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts b/libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts
new file mode 100644
index 00000000000..e1ffd9bbf2e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from './DaemonPaths';
+import { tryAcquireReclaimLock } from './DaemonReclaimLock';
+import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
+import { assertDaemonRuntimeDirIsPrivate } from './DaemonRuntimeDir';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+function reclaimLockPath(paths: IDaemonPaths): string {
+  return `${paths.lockfilePath}.reclaim`;
+}
+
+/** Throws {@link DaemonTransportErrorCode.daemonAlreadyRunning} for the endpoint of `paths`. */
+export function throwAlreadyRunning(paths: IDaemonPaths, reason: string): never {
+  throw new DaemonTransportError(
+    DaemonTransportErrorCode.daemonAlreadyRunning,
+    `A live daemon already listens at ${paths.socketPath} (${reason}).`
+  );
+}
+
+/**
+ * Runs `action` while holding the reclaim mutex of `paths`, in a runtime directory that is private to this
+ * user. Throws `daemonAlreadyRunning` when another starter holds the mutex, and `unsafeRuntimeDirectory` for an
+ * unsafe runtime directory.
+ */
+export async function runUnderReclaimMutexAsync(
+  paths: IDaemonPaths,
+  action: () => Promise<void>
+): Promise<void> {
+  assertDaemonRuntimeDirIsPrivate(paths);
+  // The mutex lives beside the lockfile (never the same file): the lockfile
+  // records the *running* daemon's live PID, while the mutex only ever records
+  // a reclaimer's pid. So a live daemon is "locked" (its PID alive), while a
+  // dead daemon's stale record is safe to steal.
+  const lock: DaemonReclaimLockOutcome = tryAcquireReclaimLock(reclaimLockPath(paths));
+  if (!lock.acquired) {
+    throwAlreadyRunning(paths, 'another starter holds the reclaim lock');
+  }
+  try {
+    await action();
+  } finally {
+    try {
+      fs.unlinkSync(reclaimLockPath(paths));
+    } catch {
+      // Another starter may have already cleared it; release is best-effort.
+    }
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts b/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
new file mode 100644
index 00000000000..3de280fd1fe
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Process groups that a reclaim stopped, because the daemon that left them running had exited.
+ *
+ * @beta
+ */
+export interface IDaemonOrphanReap {
+  /** The PID of the daemon that exited. */
+  readonly daemonPid: number;
+  /** The process groups that were stopped: the daemon's own group, or the operation groups it recorded. */
+  readonly processGroupIds: readonly number[];
+  /** `terminated` when every group exited after SIGTERM, and `killed` when some needed SIGKILL. */
+  readonly outcome: 'terminated' | 'killed';
+}
+
+/**
+ * The first condition that a recorded operation process group failed, so that a reclaim left it running.
+ *
+ * @remarks
+ * - `callerGroup`: the group's ID is the PID or the process group ID of the process that reclaims (a
+ *   `rush-client` that the operation ran, for example), or that process cannot read its own process group.
+ *
+ * - `daemonPidInUse`: another process has the exited daemon's PID now. When the reclaim was told so
+ *   (`deadPidReused`), only the group whose ID is that PID is left running for this reason.
+ *
+ * - `leaderChanged`: the process whose PID is the group's ID is not the leader that the daemon recorded: it
+ *   started at another time, or it has left the group or the group's session.
+ *
+ * - `otherSession`: the group's leader has exited, and a live process of the group is in another session.
+ *
+ * - `noMarker`: the group's leader has exited, and no live process of the group has the exited daemon's
+ *   `RUSHD_OPERATION_GROUPS` value, which a daemon from a release before that variable does not set.
+ *
+ * @beta
+ */
+export type DaemonOperationGroupLeftRunningReason =
+  | 'callerGroup'
+  | 'daemonPidInUse'
+  | 'leaderChanged'
+  | 'otherSession'
+  | 'noMarker';
+
+/**
+ * A process group that an exited daemon recorded for an operation, and whose record a reclaim removed without
+ * a signal, because it could not prove that the group still runs that operation.
+ *
+ * @beta
+ */
+export interface IDaemonOperationGroupLeftRunning {
+  /** The PID of the daemon that recorded the group and exited. */
+  readonly daemonPid: number;
+  /** The process group, which still had a live process when the reclaim left it. */
+  readonly processGroupId: number;
+  /** The first condition that the group failed. */
+  readonly reason: DaemonOperationGroupLeftRunningReason;
+}
+
+/**
+ * Options for {@link reclaimStaleDaemonAsync}.
+ *
+ * @beta
+ */
+export interface IDaemonReclaimOptions {
+  /**
+   * Called once for each set of process groups that the reclaim stopped, so that the caller can say so in
+   * its own words. When it is omitted, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+   */
+  readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
+  /**
+   * Called once for each recorded operation process group that the reclaim left running when it removed the
+   * group's record, because it could not prove that the group still runs an operation of the exited daemon.
+   * A group without a live process is not reported. When it is omitted, nothing is reported.
+   */
+  readonly onOperationGroupLeftRunning?: (group: IDaemonOperationGroupLeftRunning) => void;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts b/libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts
new file mode 100644
index 00000000000..27e978e3e67
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts
@@ -0,0 +1,32 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+const THEN: string = '. Then: ';
+
+function describeError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function releaseAfterFailure(stepError: unknown, release: () => void): unknown {
+  try {
+    release();
+  } catch (releaseError) {
+    const message: string = `${describeError(stepError)}${THEN}${describeError(releaseError)}`;
+    return new AggregateError([stepError, releaseError], message);
+  }
+  return stepError;
+}
+
+/**
+ * Runs `release` once `step` settles, even when `step` fails. When only `step` fails, rejects with its error. When
+ * `release` fails too, rejects with an AggregateError of both errors, in that order, whose message names both: a
+ * daemon reports only the stack of the error that stops it.
+ */
+export async function releaseAfterAsync(step: Promise<void>, release: () => void): Promise<void> {
+  try {
+    await step;
+  } catch (stepError) {
+    throw releaseAfterFailure(stepError, release);
+  }
+  release();
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts b/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
new file mode 100644
index 00000000000..eea4a4ccd2b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
@@ -0,0 +1,43 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import type { IDaemonPaths } from './DaemonPaths';
+import type { IDaemonOrphanReaperOptions } from './DaemonReapOptions';
+import { runUnderReclaimMutexAsync } from './DaemonReclaimMutex';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
+
+/**
+ * Stops the operation process groups that the daemon which wrote the lockfile recorded, when a process that
+ * started after the lockfile was written now has that daemon's PID, `ownerPid`, and deletes the records.
+ *
+ * @remarks
+ * The caller proves the reuse, for example from `/proc` and the lockfile's `startedAt`. The daemon is then gone,
+ * and the process that has its PID now is not a daemon that lost its lockfile either, because such a daemon
+ * would have written a later one. Once the lockfile is removed, no reclaim finds these records, since a live
+ * PID's record folder is left alone, so call this before removing it.
+ * A record is signaled only with the proof that a dead daemon's records require: its leader is alive with the
+ * recorded start time and leads its own group and session, or its leader has exited, every live member of
+ * the group is in the group's own session, and one of them carries the daemon's `RUSHD_OPERATION_GROUPS`
+ * marker (see `DAEMON_OPERATION_GROUPS_ENV_VAR`). Group `ownerPid`, which the later process may lead, is never
+ * signaled. Unproven records are dropped without a signal, and records survive a failed reap. Each set of
+ * stopped groups is reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process
+ * warning. Nothing is read, reaped or removed unless the runtime directory is a private directory of this
+ * user, and a record folder that is a symbolic link, or that another user owns, is left alone.
+ *
+ * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when another process holds the
+ * reclaim lock, and with code `unsafeRuntimeDirectory` for an unsafe runtime directory; and an `Error` when a
+ * group survives SIGKILL.
+ *
+ * @beta
+ */
+export async function reapReusedOwnerOperationGroupsAsync(
+  paths: IDaemonPaths,
+  ownerPid: number,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
+  const reaperOptions: IDaemonOrphanReaperOptions = { ...options, deadPidReused: true };
+  await runUnderReclaimMutexAsync(paths, async () => {
+    await reapDeadDaemonOperationGroupsAsync(paths.lockfilePath, ownerPid, reaperOptions);
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts b/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
new file mode 100644
index 00000000000..700fbd8d6c7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from './DaemonPaths';
+import { verifyRuntimeFolder } from './DaemonRuntimeFolderCheck';
+import { assertDaemonSocketPathFits } from './DaemonSocketPathLength';
+
+const DIR_MODE: number = 0o700;
+
+function getCurrentUid(): number | undefined {
+  return process.getuid?.();
+}
+
+function tryCreateFolder(folder: string): unknown {
+  try {
+    fs.mkdirSync(folder, { recursive: true, mode: DIR_MODE });
+    return undefined;
+  } catch (error) {
+    return error;
+  }
+}
+
+/**
+ * Checks the per-user runtime directory, when it exists, before a client trusts the socket inside it.
+ *
+ * @remarks
+ * The folder must be a real directory (not a symbolic link) that the current user owns; one that is also
+ * open to others is changed to mode `0700`. Otherwise another user could have created it first, for example
+ * in `/tmp`, and could listen at the socket path or plant the records that reclaim acts on.
+ *
+ * The socket path must also fit in a socket address (108 bytes on Linux, 104 on macOS), which only a long
+ * `RUSHD_RUNTIME_DIR` exceeds. Node would cut a longer path short, so no client could reach the daemon.
+ *
+ * @throws {@link DaemonTransportError} with code `socketPathTooLong` or `unsafeRuntimeDirectory`.
+ *
+ * @beta
+ */
+export function assertDaemonRuntimeDirIsPrivate(paths: IDaemonPaths): void {
+  assertDaemonSocketPathFits(paths, process.platform);
+  if (paths.runtimeDir !== undefined) verifyRuntimeFolder(paths.runtimeDir, getCurrentUid());
+}
+
+/**
+ * Creates the per-user runtime directory (mode `0700`) when the platform has one, and checks it as
+ * {@link assertDaemonRuntimeDirIsPrivate} does. Must be called before binding a POSIX socket inside it.
+ * A socket path that is too long is refused before anything is created.
+ *
+ * @beta
+ */
+export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void {
+  if (paths.runtimeDir === undefined) return;
+  assertDaemonSocketPathFits(paths, process.platform);
+  const failure: unknown = tryCreateFolder(paths.runtimeDir);
+  // An entry in the way (such as a file or a dangling link) is explained by the check, not by mkdir.
+  verifyRuntimeFolder(paths.runtimeDir, getCurrentUid());
+  if (failure !== undefined) throw failure;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts b/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
new file mode 100644
index 00000000000..6d782b4f174
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from './DaemonPaths';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+const DIR_MODE: number = 0o700;
+// The remainder by 0o100 is the group and other permission bits; by 0o10000, all permission bits.
+const GROUP_AND_OTHER_MODE_MODULUS: number = 0o100;
+const PERMISSION_MODE_MODULUS: number = 0o10000;
+const NO_MODE_BITS: number = 0;
+const OCTAL_RADIX: number = 8;
+
+interface IUnsafeFolderCheck {
+  readonly isUnsafe: (stats: fs.BigIntStats, uid: number | undefined) => boolean;
+  readonly reason: string;
+}
+
+const UNSAFE_FOLDER_CHECKS: readonly IUnsafeFolderCheck[] = [
+  { isUnsafe: (stats: fs.BigIntStats) => stats.isSymbolicLink(), reason: 'it is a symbolic link' },
+  { isUnsafe: (stats: fs.BigIntStats) => !stats.isDirectory(), reason: 'it is not a directory' },
+  {
+    // Windows has no uid to compare.
+    isUnsafe: (stats: fs.BigIntStats, uid: number | undefined) => uid !== undefined && Number(stats.uid) !== uid,
+    reason: 'another user owns it'
+  }
+];
+
+function createUnsafeFolderError(folder: string, stats: fs.BigIntStats, reason: string): DaemonTransportError {
+  const mode: string = (Number(stats.mode) % PERMISSION_MODE_MODULUS).toString(OCTAL_RADIX);
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.unsafeRuntimeDirectory,
+    `The daemon runtime folder ${folder} is unsafe: ${reason} (owner uid ${stats.uid}, mode ${mode}). ` +
+      `Remove it, or set ${DAEMON_RUNTIME_DIR_ENV_VAR} to an absolute path of a folder that only you can write.`
+  );
+}
+
+function restrictToOwner(folder: string, stats: fs.BigIntStats, uid: number | undefined): void {
+  // Windows has no POSIX permission bits to tighten.
+  if (uid !== undefined && Number(stats.mode) % GROUP_AND_OTHER_MODE_MODULUS !== NO_MODE_BITS) {
+    fs.chmodSync(folder, DIR_MODE);
+  }
+}
+
+function assertSafeFolder(folder: string, stats: fs.BigIntStats, uid: number | undefined): void {
+  const unsafe: IUnsafeFolderCheck | undefined = UNSAFE_FOLDER_CHECKS.find((check: IUnsafeFolderCheck) =>
+    check.isUnsafe(stats, uid)
+  );
+  if (unsafe) throw createUnsafeFolderError(folder, stats, unsafe.reason);
+  restrictToOwner(folder, stats, uid);
+}
+
+/**
+ * When `folder` exists, throws unless it is a directory (not a symbolic link) that user `uid` owns, and makes
+ * it owner-only (mode `0700`) when others have any access. Without a `uid` (Windows), only the kind is checked.
+ *
+ * @throws {@link DaemonTransportError} with code `unsafeRuntimeDirectory`.
+ */
+export function verifyRuntimeFolder(folder: string, uid: number | undefined): void {
+  // Another user can put a socket or FIFO at this name in /tmp. A plain stat of one would leave its type in the
+  // stat array that Node 22's cached realpath reads (nodejs/node#65113), and in-process Rush, which a client
+  // falls back to for an unsafe folder, could then fail to find its modules.
+  const stats: fs.BigIntStats | undefined = fs.lstatSync(folder, { bigint: true, throwIfNoEntry: false });
+  if (stats) assertSafeFolder(folder, stats, uid);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts b/libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts
new file mode 100644
index 00000000000..29cf3f1998a
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from './DaemonPaths';
+import type { IDaemonPaths } from './DaemonPaths';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+// The size of sockaddr_un.sun_path. Node truncates a longer path to this many bytes when it binds or connects,
+// but a daemon publishes its socket with link(2), which does not, so clients would look for a name nobody bound.
+const LINUX_MAX_SOCKET_PATH_BYTES: number = 108;
+// macOS and the BSDs.
+const OTHER_MAX_SOCKET_PATH_BYTES: number = 104;
+const LINUX_PLATFORM: NodeJS.Platform = 'linux';
+// The shortest absolute base, `/`.
+const MIN_BASE_BYTES: number = 1;
+
+interface ISocketPathLength {
+  readonly socketPath: string;
+  readonly runtimeDir: string;
+  readonly bytes: number;
+  readonly limit: number;
+}
+
+/** The longest socket path, in bytes, that a POSIX `platform` binds and connects to without truncating it. */
+export function getMaxDaemonSocketPathBytes(platform: NodeJS.Platform): number {
+  return platform === LINUX_PLATFORM ? LINUX_MAX_SOCKET_PATH_BYTES : OTHER_MAX_SOCKET_PATH_BYTES;
+}
+
+// Paths from resolveDaemonPaths always leave room for a base; other layouts may not.
+function describeRemedy(maxBaseBytes: number): string {
+  return maxBaseBytes < MIN_BASE_BYTES
+    ? `Use a shorter runtime folder, or unset ${DAEMON_RUNTIME_DIR_ENV_VAR}.`
+    : `Set ${DAEMON_RUNTIME_DIR_ENV_VAR} to an absolute path of at most ${maxBaseBytes} bytes, or unset it.`;
+}
+
+function createTooLongError(length: ISocketPathLength): DaemonTransportError {
+  const { socketPath, runtimeDir, bytes, limit } = length;
+  // The runtime folder is `<base>/rushd-<uid>`, so everything after its parent is fixed.
+  const suffixBytes: number = bytes - Buffer.byteLength(path.posix.dirname(runtimeDir));
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.socketPathTooLong,
+    `The daemon socket path ${socketPath} is ${bytes} bytes long, but this platform allows at most ${limit}. ` +
+      describeRemedy(limit - suffixBytes)
+  );
+}
+
+/**
+ * Throws unless the POSIX socket path of `paths` fits in a socket address on `platform`. Windows named pipes
+ * (no runtime directory) are not checked.
+ *
+ * @throws {@link DaemonTransportError} with code `socketPathTooLong`.
+ */
+export function assertDaemonSocketPathFits(paths: IDaemonPaths, platform: NodeJS.Platform): void {
+  const { runtimeDir, socketPath } = paths;
+  if (runtimeDir === undefined) return;
+  const bytes: number = Buffer.byteLength(socketPath);
+  const limit: number = getMaxDaemonSocketPathBytes(platform);
+  if (bytes > limit) throw createTooLongError({ socketPath, runtimeDir, bytes, limit });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
new file mode 100644
index 00000000000..b3567126614
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import type * as net from 'node:net';
+import * as path from 'node:path';
+
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
+import { getFileIdentity } from './DaemonFileIdentity';
+import { listenOrErrorAsync, toListenTransportError } from './DaemonListenerNet';
+import type { INetError } from './DaemonListenerNet';
+import type { IDaemonPaths } from './DaemonPaths';
+import { reclaimStaleDaemonAsync } from './DaemonReclaim';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+import { unlinkIfPresent } from './DaemonUnlink';
+
+const PRIVATE_NAME_PREFIX: string = '.bind-';
+const PRIVATE_NAME_SEPARATOR: string = '-';
+const PRIVATE_NAME_RANDOM_BYTES: number = 4;
+const HEX: BufferEncoding = 'hex';
+const SOCKET_MODE: number = 0o600;
+const ALREADY_EXISTS: string = 'EEXIST';
+
+function getPrivateSocketPath(socketPath: string): string {
+  const suffix: string = crypto.randomBytes(PRIVATE_NAME_RANDOM_BYTES).toString(HEX);
+  const name: string = `${PRIVATE_NAME_PREFIX}${process.pid}${PRIVATE_NAME_SEPARATOR}${suffix}`;
+  return path.join(path.dirname(socketPath), name);
+}
+
+function closeServerAsync(server: net.Server): Promise<void> {
+  return new Promise<void>((resolve: () => void) => server.close(() => resolve()));
+}
+
+/** Gives the private socket the name `socketPath`; `false` when that name exists (link(2) never replaces). */
+function tryLink(privatePath: string, socketPath: string): boolean {
+  try {
+    fs.linkSync(privatePath, socketPath);
+    return true;
+  } catch (error) {
+    if ((error as INetError).code !== ALREADY_EXISTS) throw error;
+    return false;
+  }
+}
+
+function stillInUse(socketPath: string): DaemonTransportError {
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.daemonAlreadyRunning,
+    `The daemon path ${socketPath} is still in use after reclaim.`
+  );
+}
+
+async function publishAsync(
+  privatePath: string,
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions
+): Promise<IDaemonFileIdentity> {
+  fs.chmodSync(privatePath, SOCKET_MODE);
+  const identity: IDaemonFileIdentity = getFileIdentity(privatePath);
+  if (!tryLink(privatePath, paths.socketPath)) {
+    // Reclaim a dead daemon's leftovers once (this throws while their owner lives), then try again.
+    await reclaimStaleDaemonAsync(paths, options);
+    if (!tryLink(privatePath, paths.socketPath)) throw stillInUse(paths.socketPath);
+  }
+  return identity;
+}
+
+/**
+ * Binds a POSIX socket under a private name and then publishes it at `paths.socketPath`.
+ *
+ * @remarks
+ * When a server closes, libuv unlinks the path it bound, whichever file has that name by then. The published
+ * name may by then belong to a successor (after someone deleted this daemon's socket and another daemon
+ * started), so only the private name is ever bound, and it is deleted as soon as the socket is published.
+ * Publishing uses link(2), which, unlike bind or rename, never replaces an existing name. The socket is made
+ * owner-only before it is published. A dead daemon's leftovers at that name are reclaimed once, with `options`.
+ * Returns the identity of the published socket; the listening socket keeps its inode in use, so the identity
+ * needs no open descriptor.
+ */
+export async function listenPublishedAsync(
+  server: net.Server,
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions
+): Promise<IDaemonFileIdentity> {
+  const privatePath: string = getPrivateSocketPath(paths.socketPath);
+  const error: INetError | undefined = await listenOrErrorAsync(server, privatePath);
+  if (error) throw toListenTransportError(error, privatePath);
+  try {
+    return await publishAsync(privatePath, paths, options);
+  } catch (publishError) {
+    await closeServerAsync(server);
+    throw publishError;
+  } finally {
+    unlinkIfPresent(privatePath);
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonTransportError.ts b/libraries/rush-daemon-transport/src/DaemonTransportError.ts
index 7a7efb9310d..4257851d559 100644
--- a/libraries/rush-daemon-transport/src/DaemonTransportError.ts
+++ b/libraries/rush-daemon-transport/src/DaemonTransportError.ts
@@ -14,7 +14,11 @@ export enum DaemonTransportErrorCode {
   /** The connection attempt exceeded the configured timeout. */
   connectionTimeout = 'connectionTimeout',
   /** The transport was closed while an operation was in flight. */
-  transportClosed = 'transportClosed'
+  transportClosed = 'transportClosed',
+  /** The per-user runtime directory is a symbolic link, is not a directory, or another user owns it. */
+  unsafeRuntimeDirectory = 'unsafeRuntimeDirectory',
+  /** The POSIX socket path is longer than a socket address allows, so no client could connect to it. */
+  socketPathTooLong = 'socketPathTooLong'
 }
 
 /**
diff --git a/libraries/rush-daemon-transport/src/DaemonUnlink.ts b/libraries/rush-daemon-transport/src/DaemonUnlink.ts
new file mode 100644
index 00000000000..d2016272f18
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonUnlink.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const NO_ENTRY: string = 'ENOENT';
+
+/**
+ * Deletes the file (never a folder) at `filePath`, if there is one.
+ *
+ * @remarks
+ * Unlike `fs.rmSync`, it does not stat the file first. A plain stat of a socket leaves the socket's type in the
+ * stat array that Node 22's cached `fs.realpathSync` reads (nodejs/node#65113), and the next `require()` in the
+ * process could then load a package through its symbolic link, where the package's dependencies are not found.
+ */
+export function unlinkIfPresent(filePath: string): void {
+  try {
+    fs.unlinkSync(filePath);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== NO_ENTRY) throw error;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index 4674d34b024..b41f04b56c9 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -15,20 +15,35 @@
  */
 
 export { connectDaemonAsync, type IDaemonConnectorOptions } from './DaemonConnector';
+export type { DaemonFileChange } from './DaemonFileChange';
 export { DaemonFrameConnection } from './DaemonFrameConnection';
 export { DaemonFrameListener, type IDaemonListenerOptions } from './DaemonListener';
 export {
-  ensureDaemonRuntimeDir,
   isDaemonProcessAlive,
   readDaemonLockfile,
   removeDaemonArtifacts,
   writeDaemonLockfile,
   type IDaemonLockfile
 } from './DaemonLockfile';
+export { formatOperationGroupLeftRunning } from './DaemonOperationGroupLeftRunningMessage';
+export { DAEMON_OPERATION_GROUPS_ENV_VAR } from './DaemonOperationGroupMarker';
 export { tryAcquireReclaimLock, type DaemonReclaimLockOutcome } from './DaemonReclaimLock';
-export { resolveDaemonPaths, type IDaemonPathEnvironment, type IDaemonPaths } from './DaemonPaths';
+export {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  resolveDaemonPaths,
+  type IDaemonPathEnvironment,
+  type IDaemonPaths
+} from './DaemonPaths';
 export { resolveDaemonPathsFromProcess } from './DaemonPathsFromProcess';
 export { reclaimStaleDaemonAsync } from './DaemonReclaim';
+export type {
+  DaemonOperationGroupLeftRunningReason,
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonReclaimOptions
+} from './DaemonReclaimOptions';
+export { reapReusedOwnerOperationGroupsAsync } from './DaemonReusedOwnerReap';
+export { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 export { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 export {
   computeDaemonWorkspaceKey,
diff --git a/libraries/rush-daemon-transport/src/test/BackpressureFixture.ts b/libraries/rush-daemon-transport/src/test/BackpressureFixture.ts
new file mode 100644
index 00000000000..e4f5a9af8b8
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/BackpressureFixture.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonFrameType } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import type { DaemonFrameConnection } from '../DaemonFrameConnection';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createDeferred, createTestDaemonPaths, startTestDaemonPair } from './TestDaemonFixture';
+import type { IDeferred, ITestDaemonPair } from './TestDaemonFixture';
+
+const FILL_BYTE: number = 0x61;
+
+/** A send so far: still pending, resolved, or the error it rejected with. */
+export type SendState = 'pending' | 'resolved' | Error;
+
+/** A test pair whose server side has accepted, and the error its server side closed with. */
+export interface IBackpressurePair extends ITestDaemonPair {
+  readonly server: DaemonFrameConnection;
+  readonly serverClosed: Promise<Error | undefined>;
+}
+
+/** A log frame with a payload of the given size. */
+export function createFrame(byteCount: number): IDaemonFrame {
+  return { kind: DaemonFrameType.logStdout, payload: Buffer.alloc(byteCount, FILL_BYTE) };
+}
+
+/** Records how a send settles, without leaving its rejection unhandled. */
+export function trackSend(send: Promise<void>): () => SendState {
+  let state: SendState = 'pending';
+  send.then(
+    () => {
+      state = 'resolved';
+    },
+    (error: Error) => {
+      state = error;
+    }
+  );
+  return () => state;
+}
+
+/** Lets every callback that the current event queued run first. */
+export async function nextMacrotaskAsync(): Promise<void> {
+  await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+}
+
+/** Runs a test on a new pair whose client doesn't read until the test resumes it, then closes the pair. */
+export async function withPausedPairAsync(test: (pair: IBackpressurePair) => Promise<void>): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const pair: ITestDaemonPair = await startTestDaemonPair(paths);
+  try {
+    const server: DaemonFrameConnection = await pair.serverSide;
+    const serverClosed: IDeferred<Error | undefined> = createDeferred<Error | undefined>();
+    server.onClosed((error: Error | undefined) => serverClosed.resolve(error));
+    pair.client.socket.pause();
+    await test({ ...pair, server, serverClosed: serverClosed.promise });
+  } finally {
+    await pair.client.closeAsync();
+    await pair.listener.closeAsync();
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts b/libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts
new file mode 100644
index 00000000000..257260c2765
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts
@@ -0,0 +1,95 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonTransportError, DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createFrame, nextMacrotaskAsync, trackSend, withPausedPairAsync } from './BackpressureFixture';
+import type { IBackpressurePair, SendState } from './BackpressureFixture';
+import { createDeferred } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+
+// A peer can half-close a Unix socket, but not a Windows named pipe.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const LARGE_FRAME_BYTES: number = 4194304;
+const SMALL_FRAME_BYTES: number = 1;
+const MEBIBYTE: number = 1048576;
+const FRAME_COUNT: number = 16;
+const NONE: number = 0;
+const SOCKET_EVENTS: ReadonlyArray<string> = ['drain', 'finish', 'close', 'error'];
+const TRANSPORT_CLOSED: Partial<DaemonTransportError> = { code: DaemonTransportErrorCode.transportClosed };
+
+function countListeners(pair: IBackpressurePair): number[] {
+  return SOCKET_EVENTS.map((eventName: string) => pair.server.socket.listenerCount(eventName));
+}
+
+posixIt('settles a backpressured send when the peer half-closes, then reads the frame', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const received: IDeferred<number> = createDeferred<number>();
+    pair.client.onFrame((frame: IDaemonFrame) => received.resolve(frame.payload.length));
+    const send: Promise<void> = pair.server.sendFrameAsync(createFrame(LARGE_FRAME_BYTES));
+    const sendState: () => SendState = trackSend(send);
+    // The next frame in line, started as a session's send queue starts it.
+    const nextState: () => SendState = trackSend(
+      send.then(() => pair.server.sendFrameAsync(createFrame(SMALL_FRAME_BYTES)))
+    );
+    expect(pair.server.socket.writableNeedDrain).toBe(true);
+    // The daemon's side doesn't allow a half-open connection, so the peer's FIN ends it, and the
+    // buffered frame then finishes writing without a 'drain'.
+    pair.client.socket.end();
+    pair.client.socket.resume();
+    expect(await received.promise).toBe(LARGE_FRAME_BYTES);
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    expect(sendState()).toBe('resolved');
+    expect(nextState()).toBeInstanceOf(DaemonTransportError);
+    expect(nextState()).toMatchObject(TRANSPORT_CLOSED);
+  });
+});
+
+it('rejects a backpressured send when its connection closes without an error first', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const sendState: () => SendState = trackSend(pair.server.sendFrameAsync(createFrame(LARGE_FRAME_BYTES)));
+    expect(pair.server.socket.writableNeedDrain).toBe(true);
+    pair.server.socket.destroy();
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    expect(sendState()).toBeInstanceOf(DaemonTransportError);
+    expect(sendState()).toMatchObject(TRANSPORT_CLOSED);
+  });
+});
+
+it('rejects a backpressured send with the error that aborted its connection', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const abortError: Error = new Error('The drain deadline passed.');
+    const sendState: () => SendState = trackSend(pair.server.sendFrameAsync(createFrame(LARGE_FRAME_BYTES)));
+    expect(pair.server.socket.writableNeedDrain).toBe(true);
+    pair.server.abort(abortError);
+    expect(await pair.serverClosed).toBe(abortError);
+    await nextMacrotaskAsync();
+    expect(sendState()).toBe(abortError);
+  });
+});
+
+it('leaves no socket listeners behind once backpressured sends drain', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const allReceived: IDeferred<void> = createDeferred<void>();
+    const listenersBefore: number[] = countListeners(pair);
+    let received: number = NONE;
+    let backpressured: number = NONE;
+    pair.client.onFrame(() => {
+      received++;
+      if (received === FRAME_COUNT) allReceived.resolve();
+    });
+    pair.client.socket.resume();
+    for (let index: number = NONE; index < FRAME_COUNT; index++) {
+      const send: Promise<void> = pair.server.sendFrameAsync(createFrame(MEBIBYTE));
+      if (pair.server.socket.writableNeedDrain) backpressured++;
+      await send;
+    }
+    await allReceived.promise;
+    expect(backpressured).toBeGreaterThan(NONE);
+    expect(countListeners(pair)).toEqual(listenersBefore);
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts
new file mode 100644
index 00000000000..aa8ea54a1ae
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { createFrame, nextMacrotaskAsync, trackSend } from './BackpressureFixture';
+import type { SendState } from './BackpressureFixture';
+import { createDeferred } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+import {
+  FIRST_BYTES,
+  SECOND_BYTES,
+  holdFirstFrame,
+  sendWhileHeldAsync,
+  withUnreadingPeerAsync,
+  writeFramesAsync
+} from './UnreadingPeerFixture';
+import type { IHeldHandler, IUnreadingPeerPair } from './UnreadingPeerFixture';
+
+// These tests use Unix sockets, where a write to a socket whose peer has closed fails with EPIPE.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+// On Linux, a Unix socket that closes with bytes it never read resets its peer's connection.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+posixIt(
+  'closedAfterReadingAll is true when the peer ends while a handler runs, once every frame is read',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      const handler: IHeldHandler = holdFirstFrame(pair.reader);
+      await sendWhileHeldAsync(pair, handler);
+      // The peer has nothing of the reader's unread, so this ends the connection rather than resetting it.
+      pair.peer.destroy();
+      await nextMacrotaskAsync();
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+      handler.release();
+      expect(await pair.closed).toBeUndefined();
+      await nextMacrotaskAsync();
+      expect(handler.received).toEqual([FIRST_BYTES, SECOND_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(true);
+    });
+  }
+);
+
+posixIt(
+  'closedAfterReadingAll is false when a write fails after the peer closed, while a frame waits',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      const handler: IHeldHandler = holdFirstFrame(pair.reader);
+      await sendWhileHeldAsync(pair, handler);
+      pair.peer.destroy();
+      const sendState: () => SendState = trackSend(pair.reader.sendFrameAsync(createFrame(FIRST_BYTES)));
+      expect(await pair.closed).toMatchObject({ code: 'EPIPE', syscall: 'write' });
+      handler.release();
+      await nextMacrotaskAsync();
+      expect(sendState()).toMatchObject({ code: 'EPIPE' });
+      expect(handler.received).toEqual([FIRST_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
+
+linuxIt(
+  'closedAfterReadingAll is false when the peer resets the connection while a frame waits',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      // The peer never reads this, so its close resets the connection.
+      await pair.reader.sendFrameAsync(createFrame(FIRST_BYTES));
+      const handler: IHeldHandler = holdFirstFrame(pair.reader);
+      await sendWhileHeldAsync(pair, handler);
+      pair.peer.destroy();
+      expect(await pair.closed).toMatchObject({ code: 'ECONNRESET', syscall: 'read' });
+      handler.release();
+      await nextMacrotaskAsync();
+      expect(handler.received).toEqual([FIRST_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
+
+linuxIt(
+  'closedAfterReadingAll is true when the peer resets the connection once every frame is read',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      await pair.reader.sendFrameAsync(createFrame(FIRST_BYTES));
+      const received: number[] = [];
+      const lastReceived: IDeferred<void> = createDeferred<void>();
+      pair.reader.onFrame((frame: IDaemonFrame) => {
+        received.push(frame.payload.length);
+        if (frame.payload.length === SECOND_BYTES) lastReceived.resolve();
+      });
+      await writeFramesAsync(pair.peer, FIRST_BYTES);
+      await writeFramesAsync(pair.peer, SECOND_BYTES);
+      await lastReceived.promise;
+      pair.peer.destroy();
+      expect(await pair.closed).toMatchObject({ code: 'ECONNRESET', syscall: 'read' });
+      expect(received).toEqual([FIRST_BYTES, SECOND_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(true);
+    });
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
new file mode 100644
index 00000000000..e8caf89024b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
@@ -0,0 +1,74 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { createFrame, nextMacrotaskAsync } from './BackpressureFixture';
+import { createDeferred } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+import { FIRST_BYTES, SECOND_BYTES, withUnreadingPeerAsync, writeFramesAsync } from './UnreadingPeerFixture';
+import type { IUnreadingPeerPair } from './UnreadingPeerFixture';
+
+// These tests use Unix sockets.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+// On Linux, a Unix socket that closes with bytes it never read resets its peer's connection.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+posixIt('closedAfterReadingAll is false while the connection is open, and after abort()', async () => {
+  await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+    expect(pair.reader.closedAfterReadingAll).toBe(false);
+    const abortError: Error = new Error('The test aborted the connection.');
+    pair.reader.abort(abortError);
+    expect(await pair.closed).toBe(abortError);
+    expect(pair.reader.closedAfterReadingAll).toBe(false);
+  });
+});
+
+posixIt(
+  "closedAfterReadingAll is false after abort(), even once the connection has read the peer's end",
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      const abortError: Error = new Error('The test aborted the connection.');
+      let whileOpen: boolean | undefined;
+      // This runs after the connection's own 'end' listener, so it has read everything but not closed.
+      pair.reader.socket.once('end', () => {
+        whileOpen = pair.reader.closedAfterReadingAll;
+        pair.reader.abort(abortError);
+      });
+      pair.peer.end();
+      expect(await pair.closed).toBe(abortError);
+      expect(whileOpen).toBe(false);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
+
+linuxIt(
+  'closedAfterReadingAll is false once a handler throws, even after a reset once every byte was read',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      // The peer never reads this, so its close resets the connection.
+      await pair.reader.sendFrameAsync(createFrame(FIRST_BYTES));
+      const received: number[] = [];
+      const holding: IDeferred<void> = createDeferred<void>();
+      const failure: IDeferred<void> = createDeferred<void>();
+      pair.reader.onFrame(async (frame: IDaemonFrame) => {
+        received.push(frame.payload.length);
+        holding.resolve();
+        await failure.promise;
+        throw new Error('The handler failed.');
+      });
+      // Both frames arrive in one read, so the second waits for the handler rather than in the socket's buffer.
+      await writeFramesAsync(pair.peer, FIRST_BYTES, SECOND_BYTES);
+      await holding.promise;
+      pair.peer.destroy();
+      expect(await pair.closed).toMatchObject({ code: 'ECONNRESET', syscall: 'read' });
+      expect(pair.reader.closedAfterReadingAll).toBe(true);
+      failure.resolve();
+      await nextMacrotaskAsync();
+      // The frame after the one whose handler threw never reaches the handler.
+      expect(received).toEqual([FIRST_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
new file mode 100644
index 00000000000..404064dd9e3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import {
+  OPERATION_CHILD,
+  OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const REUSED_START: string = '999';
+const SHELL_SESSION: number = 3000;
+
+async function reapAsync(processes: readonly IProcessStat[]): Promise<IFakeGroup & { outcome: string }> {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', processes });
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+  return { ...fake, outcome };
+}
+
+it('signals a recorded group whose leader is alive with the recorded start time', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync(operationTree(OPERATION_GROUP));
+  expect(result.outcome).toBe('terminated');
+  expect(result.targets).toEqual([OPERATION_GROUP]);
+  expect(result.logs).toEqual([expect.stringContaining(`groups ${OPERATION_GROUP} were terminated`)]);
+});
+
+it('reports a group that needed SIGKILL to onOrphansReaped as killed instead of logging it', async () => {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGKILL', processes: operationTree(OPERATION_GROUP) });
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('killed');
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [OPERATION_GROUP], outcome: 'killed' }]);
+  expect(fake.logs).toEqual([]);
+});
+
+it('signals a group whose leader has exited when every live member is in its session', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync(operationTree(OPERATION_GROUP, false));
+  expect(result.outcome).toBe('terminated');
+  expect(result.targets).toEqual([OPERATION_GROUP]);
+});
+
+it('signals a group whose leader is a zombie when every live member is in its session', async () => {
+  const zombieLeader: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), exited: true };
+  const processes: IProcessStat[] = [zombieLeader, ...operationTree(OPERATION_GROUP, false)];
+  const result: IFakeGroup & { outcome: string } = await reapAsync(processes);
+  expect(result.outcome).toBe('terminated');
+  expect(result.targets).toEqual([OPERATION_GROUP]);
+});
+
+it('never signals a reused pid: the leader has another start time', async () => {
+  const reused: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), startTime: REUSED_START };
+  const result: IFakeGroup & { outcome: string } = await reapAsync([reused]);
+  expect(result.outcome).toBe('none');
+  expect(result.signals).toEqual([]);
+});
+
+it('never signals a leader that no longer leads its own session', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync([
+    stat(OPERATION_GROUP, OPERATION_GROUP, SHELL_SESSION)
+  ]);
+  expect(result.signals).toEqual([]);
+});
+
+it('never signals a leaderless group of another session, such as a shell job with a reused pid', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync([
+    stat(OPERATION_CHILD, OPERATION_GROUP, SHELL_SESSION)
+  ]);
+  expect(result.signals).toEqual([]);
+});
+
+it('never signals a group whose only members have exited', async () => {
+  const zombie: IProcessStat = { ...stat(OPERATION_CHILD, OPERATION_GROUP), exited: true };
+  const result: IFakeGroup & { outcome: string } = await reapAsync([zombie]);
+  expect(result.outcome).toBe('none');
+  expect(result.signals).toEqual([]);
+});
+
+it('does nothing when the dead daemon recorded no groups', async () => {
+  const fake: IFakeGroup = createFakeGroup({ processes: operationTree(OPERATION_GROUP) });
+  const lockfilePath: string = recordGroups([]);
+  await expect(
+    reapDeadDaemonOperationGroupsAsync(`${lockfilePath}.missing`, DEAD_PID, fake.options)
+  ).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts
new file mode 100644
index 00000000000..2f0373e1b99
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts
@@ -0,0 +1,91 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import type { StopOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const HOLD_STDIO_ARGS: string[] = [
+  '-e',
+  `
+    const { spawn } = require('node:child_process');
+    const child = spawn(process.execPath, ${JSON.stringify(SLEEP_ARGS)}, {
+      stdio: ['ignore', 'inherit', 'inherit']
+    });
+    console.log(child.pid);
+    process.exit(0);
+  `
+];
+// SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX.
+const DETACHED: SpawnOptions = { detached: true, stdio: 'ignore' };
+const ATTACHED: SpawnOptions = { stdio: 'ignore' };
+const DETACHED_WITH_PIPES: SpawnOptions = { detached: true, stdio: ['ignore', 'pipe', 'pipe'] };
+const NO_RECORDS: number = 0;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function spawnAsync(options: SpawnOptions): Promise<ChildProcess> {
+  const child: ChildProcess = spawn(process.execPath, SLEEP_ARGS, options);
+  await once(child, 'spawn');
+  started = [...started, ...identifyStarted([Number(child.pid)])];
+  return child;
+}
+
+function recordOf(child: ChildProcess): IOperationGroupRecord {
+  const pid: number = Number(child.pid);
+  return { groupId: pid, startTime: String(readProcessStat(pid)?.startTime) };
+}
+
+linuxIt('records a detached child while it runs, and no child that shares the daemon group', async () => {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  const detached: ChildProcess = await spawnAsync(DETACHED);
+  await spawnAsync(ATTACHED);
+  expect(readOperationGroupRecords(folder)).toEqual([recordOf(detached)]);
+  detached.kill('SIGKILL');
+  expect(await waitUntilAsync(() => readOperationGroupRecords(folder).length === NO_RECORDS)).toBe(true);
+  stop();
+  expect(fs.existsSync(folder)).toBe(false);
+});
+
+linuxIt('keeps a detached child record until inherited streams close', async () => {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  const child: ChildProcess = spawn(process.execPath, HOLD_STDIO_ARGS, DETACHED_WITH_PIPES);
+  await once(child, 'spawn');
+  const record: IOperationGroupRecord = recordOf(child);
+  const [output]: [Buffer] = (await once(child.stdout!, 'data')) as [Buffer];
+  await once(child, 'exit');
+  const descendantPid: number = Number(output.toString().trim());
+  started = [...started, ...identifyStarted([Number(child.pid), descendantPid])];
+
+  expect(readOperationGroupRecords(folder)).toEqual([record]);
+  process.kill(descendantPid, 'SIGKILL');
+  await once(child, 'close');
+  expect(await waitUntilAsync(() => readOperationGroupRecords(folder).length === NO_RECORDS)).toBe(true);
+  stop();
+});
+
+linuxIt('records nothing after it stops', async () => {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  startOperationGroupRecording(folder)();
+  await spawnAsync(DETACHED);
+  expect(readOperationGroupRecords(folder)).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
index a775495413b..dae3dc3b87a 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
@@ -2,7 +2,8 @@
 // See LICENSE in the project root for license information.
 
 import { reapDeadDaemonProcessGroupAsync } from '../DaemonOrphanReaper';
-import type { IDaemonOrphanReaperOptions } from '../DaemonOrphanReaper';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import { DEAD_PID, SELF_PID, createFakeGroup } from './OrphanReaperFixture';
 import type { IFakeGroup } from './OrphanReaperFixture';
@@ -23,6 +24,18 @@ it('escalates to SIGKILL when the group outlives the grace period', async () =>
   expect(fake.logs).toEqual([expect.stringContaining('killed')]);
 });
 
+it('reports the stopped group to onOrphansReaped instead of logging it', async () => {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGKILL' });
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, options)).resolves.toBe('killed');
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [DEAD_PID], outcome: 'killed' }]);
+  expect(fake.logs).toEqual([]);
+});
+
 it('fails the reclaim when the group is still present after SIGKILL', async () => {
   const fake: IFakeGroup = createFakeGroup({});
   await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, fake.options)).rejects.toThrow(/survived SIGKILL/);
diff --git a/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts b/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts
index aee4c54bce7..ffe6bfdbd6d 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts
@@ -1,32 +1,38 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonPathEnvironment } from '../DaemonPaths';
+import type { IDaemonPathEnvironment, IDaemonPaths } from '../DaemonPaths';
 import { resolveDaemonPaths } from '../DaemonPaths';
 
 const TEST_UID: number = 1000;
 const KEY: string = 'rushd-deadbeef';
+const IGNORED_VALUES: readonly string[] = ['', 'relative/folder'];
 
 function posixEnv(env: Readonly<Record<string, string>>): IDaemonPathEnvironment {
-  return { platform: 'linux', env, tmpdir: '/tmp', uid: TEST_UID };
+  return { platform: 'linux', env, tmpdir: '/var/tmp/per-session', uid: TEST_UID };
 }
 
-it('uses XDG_RUNTIME_DIR on POSIX when set', () => {
-  const paths: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(
-    posixEnv({ XDG_RUNTIME_DIR: '/run/user/1000' }),
-    KEY
-  );
-  expect(paths.socketPath).toBe('/run/user/1000/rushd-1000/rushd-deadbeef.sock');
-  expect(paths.lockfilePath).toBe('/run/user/1000/rushd-1000/rushd-deadbeef.pid.json');
+it('meets in /tmp on POSIX, whatever TMPDIR and XDG_RUNTIME_DIR say', () => {
+  const plain: IDaemonPaths = resolveDaemonPaths(posixEnv({}), KEY);
+  expect(plain.socketPath).toBe('/tmp/rushd-1000/rushd-deadbeef.sock');
+  expect(plain.lockfilePath).toBe('/tmp/rushd-1000/rushd-deadbeef.pid.json');
+  const session: IDaemonPathEnvironment = posixEnv({ XDG_RUNTIME_DIR: '/run/user/1000', TMPDIR: '/scratch' });
+  expect(resolveDaemonPaths(session, KEY)).toEqual(plain);
+});
+
+it('moves the runtime directory to an absolute RUSHD_RUNTIME_DIR', () => {
+  const paths: IDaemonPaths = resolveDaemonPaths(posixEnv({ RUSHD_RUNTIME_DIR: '/run/rush' }), KEY);
+  expect(paths.runtimeDir).toBe('/run/rush/rushd-1000');
+  expect(paths.socketPath).toBe('/run/rush/rushd-1000/rushd-deadbeef.sock');
 });
 
-it('falls back to the temp dir on POSIX without XDG_RUNTIME_DIR', () => {
-  const paths: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(posixEnv({}), KEY);
-  expect(paths.socketPath).toBe('/tmp/rushd-1000/rushd-deadbeef.sock');
+it.each(IGNORED_VALUES)('ignores RUSHD_RUNTIME_DIR=%j, which is not an absolute path', (value: string) => {
+  const paths: IDaemonPaths = resolveDaemonPaths(posixEnv({ RUSHD_RUNTIME_DIR: value }), KEY);
+  expect(paths.runtimeDir).toBe('/tmp/rushd-1000');
 });
 
 it('uses a named pipe on Windows', () => {
-  const paths: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(
+  const paths: IDaemonPaths = resolveDaemonPaths(
     { platform: 'win32', env: {}, tmpdir: 'C:\\Users\\u\\AppData\\Local\\Temp', uid: undefined },
     KEY
   );
@@ -36,7 +42,7 @@ it('uses a named pipe on Windows', () => {
 });
 
 it('derives distinct paths for distinct keys', () => {
-  const first: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(posixEnv({}), KEY);
-  const second: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(posixEnv({}), 'rushd-00000000');
+  const first: IDaemonPaths = resolveDaemonPaths(posixEnv({}), KEY);
+  const second: IDaemonPaths = resolveDaemonPaths(posixEnv({}), 'rushd-00000000');
   expect(first.socketPath).not.toBe(second.socketPath);
 });
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
index 8ab89515a3c..e2c107e60b9 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
@@ -4,6 +4,7 @@
 import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
 
 const GROUP_ID: number = 4242;
+const NO_SIGNAL: number = 0;
 
 function throwErrno(code: string): never {
   throw Object.assign(new Error(code), { code });
@@ -13,6 +14,16 @@ afterEach(() => {
   jest.restoreAllMocks();
 });
 
+it('treats only ESRCH as proof that a process group has no process at all', () => {
+  const kill: jest.SpyInstance = jest.spyOn(process, 'kill').mockImplementation(() => throwErrno('ESRCH'));
+  expect(POSIX_PROCESS_GROUP_OPS.mayHaveMembers(GROUP_ID)).toBe(false);
+  expect(kill).toHaveBeenCalledWith(-GROUP_ID, NO_SIGNAL);
+  kill.mockImplementation(() => throwErrno('EPERM'));
+  expect(POSIX_PROCESS_GROUP_OPS.mayHaveMembers(GROUP_ID)).toBe(true);
+  kill.mockImplementation(() => true);
+  expect(POSIX_PROCESS_GROUP_OPS.mayHaveMembers(GROUP_ID)).toBe(true);
+});
+
 it('treats only ESRCH as proof that a process group is gone', () => {
   jest.spyOn(process, 'kill').mockImplementation(() => throwErrno('ESRCH'));
   expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(false);
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts
new file mode 100644
index 00000000000..04ae6870dfa
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '../DaemonOperationGroupMarker';
+import { listProcesses } from '../DaemonProcessList';
+import { hasEnvironmentEntry } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Another user's process: its environment can't be read (EACCES), unless the tests run as root.
+const INIT_PID: number = 1;
+// Linux caps pid_max at 2^22, so this pid never exists (ENOENT).
+const IMPOSSIBLE_PID: number = 4194305;
+const ENTRY: string = `${DAEMON_OPERATION_GROUPS_ENV_VAR}=/nonexistent/rushd-read-errors`;
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+// Fails every read of `/proc/<pid>/stat` as a process that exits during a scan, or is hidden, would.
+function failStatReadsOf(pid: number): void {
+  const statPath: string = `/proc/${pid}/stat`;
+  const { readFileSync } = fs;
+  jest.spyOn(fs, 'readFileSync').mockImplementation(((
+    ...args: Parameters<typeof readFileSync>
+  ): string | Buffer => {
+    const [file] = args;
+    if (file === statPath) throw Object.assign(new Error(`ENOENT: ${statPath}`), { code: 'ENOENT' });
+    return readFileSync(...args);
+  }) as typeof readFileSync);
+}
+
+linuxIt('lists every process but one whose /proc record cannot be read, without throwing', () => {
+  failStatReadsOf(process.ppid);
+  const pids: number[] = listProcesses().map((stat: IProcessStat) => stat.pid);
+  expect({ self: pids.includes(process.pid), parent: pids.includes(process.ppid) }).toEqual({
+    self: true,
+    parent: false
+  });
+});
+
+linuxIt('reads an environment that cannot be read as not holding the entry, without throwing', () => {
+  expect([hasEnvironmentEntry(INIT_PID, ENTRY), hasEnvironmentEntry(IMPOSSIBLE_PID, ENTRY)]).toEqual([
+    false,
+    false
+  ]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
new file mode 100644
index 00000000000..dc83d26de8e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, ChildProcessByStdio } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import { listLiveGroupMembers, listProcesses } from '../DaemonProcessList';
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { waitUntilAsync } from './ProcessWaitFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Linux caps pid_max at 2^22, so this pid never exists.
+const IMPOSSIBLE_PID: number = 4194305;
+const SLEEP_SECONDS: string = '30';
+const DIGITS: RegExp = /^\d+$/;
+// The shell starts a 1 s sleep and then becomes a 30 s sleep, which never reaps it, so the first stays a zombie.
+const ZOMBIE_PARENT_SCRIPT: string = 'sleep 1 & echo $!; exec sleep 30';
+
+linuxIt('reads the group, session and start time of a live process', () => {
+  const self: IProcessStat | undefined = readProcessStat(process.pid);
+  expect(self).toMatchObject({
+    pid: process.pid,
+    groupId: POSIX_PROCESS_GROUP_OPS.ownGroupId(),
+    exited: false
+  });
+  expect(self?.startTime).toMatch(DIGITS);
+  expect(readProcessStat(IMPOSSIBLE_PID)).toBeUndefined();
+});
+
+linuxIt('lists the live members of a process group', () => {
+  const members: IProcessStat[] = listLiveGroupMembers(Number(POSIX_PROCESS_GROUP_OPS.ownGroupId()));
+  expect(members.map((member: IProcessStat) => member.pid)).toContain(process.pid);
+});
+
+linuxIt('lists every process that has a /proc record, zombies included', async () => {
+  const parent: ChildProcessByStdio<null, Readable, null> = spawn('/bin/sh', ['-c', ZOMBIE_PARENT_SCRIPT], {
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const zombiePid: number = Number(String(await once(parent.stdout, 'data')).trim());
+  const becameZombie: boolean = await waitUntilAsync(() => readProcessStat(zombiePid)?.exited === true);
+  const listed: IProcessStat[] = listProcesses().filter((stat: IProcessStat) =>
+    [process.pid, process.ppid, zombiePid].includes(stat.pid)
+  );
+  parent.kill('SIGKILL');
+  await once(parent, 'exit');
+  expect({ becameZombie, listed: listed.map(({ pid, exited }: IProcessStat) => ({ pid, exited })) }).toEqual({
+    becameZombie: true,
+    listed: expect.arrayContaining([
+      { pid: process.ppid, exited: false },
+      { pid: process.pid, exited: false },
+      { pid: zombiePid, exited: true }
+    ])
+  });
+});
+
+linuxIt('parses a command name that contains spaces and parentheses', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-stat-'));
+  const executable: string = path.join(folder, 'a) b (c');
+  fs.symlinkSync('/bin/sleep', executable);
+  const child: ChildProcess = spawn(executable, [SLEEP_SECONDS], { detached: true, stdio: 'ignore' });
+  await once(child, 'spawn');
+  const pid: number = Number(child.pid);
+  const stat: IProcessStat | undefined = readProcessStat(pid);
+  child.kill('SIGKILL');
+  await once(child, 'exit');
+  fs.rmSync(folder, { recursive: true, force: true });
+  expect(stat).toMatchObject({ pid, groupId: pid, sessionId: pid, exited: false });
+  expect(stat?.startTime).toMatch(DIGITS);
+});
diff --git a/libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts b/libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts
new file mode 100644
index 00000000000..a7061d1861f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts
@@ -0,0 +1,43 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A detached process leads its own group, as a daemon that rush-client started does. It checks for children to
+// reap before, while and after a child that it spawned into its own group runs.
+const GROUP_LEADER_OPTIONS: SpawnOptions = { detached: true, stdio: ['ignore', 'pipe', 'ignore'] };
+const GROUP_LEADER_SCRIPT: string = `
+const { hasProcessesToReap } = require(process.argv[1]);
+const paths = { lockfilePath: process.argv[2] };
+const before = hasProcessesToReap(paths);
+const child = require('node:child_process').spawn('sleep', ['30'], { stdio: 'ignore' });
+child.once('spawn', () => {
+  const during = hasProcessesToReap(paths);
+  child.once('exit', () => process.stdout.write(JSON.stringify([before, during, hasProcessesToReap(paths)])));
+  child.kill('SIGKILL');
+});`;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+linuxIt('finds a child that runs in the daemon process group', async () => {
+  const modulePath: string = path.join(__dirname, '..', 'DaemonExitRelease.js');
+  const args: string[] = ['-e', GROUP_LEADER_SCRIPT, modulePath, createTestDaemonPaths().lockfilePath];
+  const leader: ChildProcess = spawn(process.execPath, args, GROUP_LEADER_OPTIONS);
+  await once(leader, 'spawn');
+  started = identifyStarted([Number(leader.pid)]);
+  const [chunk] = (await once(leader.stdout as Readable, 'data')) as [Buffer];
+  expect(JSON.parse(chunk.toString())).toEqual([false, true, false]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts b/libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts
new file mode 100644
index 00000000000..c545fb3a849
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { writeDaemonLockfile } from '../DaemonLockfile';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+const FAKE_DAEMON_OPTIONS: SpawnOptions = { detached: true, stdio: ['ignore', 'pipe', 'ignore'] };
+const SPACE: string = ' ';
+// The fake daemon runs the real recorder, then spawns two operations the way Rush does
+// (`detached: true` = SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX), each with a grandchild. The
+// first operation's shell waits for its grandchild; the second exits when the daemon's stdin pipe closes,
+// which leaves a leaderless group behind.
+const FAKE_DAEMON_SCRIPT: string = `
+const [recorder, groups, lockfile] = process.argv.slice(1);
+require(recorder).startOperationGroupRecording(require(groups).getOperationGroupsFolder(lockfile, process.pid));
+const spawnOperation = (tail) => require('node:child_process').spawn('/bin/sh',
+  ['-c', 'sleep 30 </dev/null >/dev/null 2>&1 & echo $!; ' + tail], { detached: true, stdio: ['pipe', 'pipe', 'ignore'] });
+const pidsOf = (op) => new Promise((resolve) => op.stdout.once('data', (d) => resolve(op.pid + ' ' + String(d).trim())));
+Promise.all([spawnOperation('wait'), spawnOperation('read line')].map(pidsOf))
+  .then((pids) => process.stdout.write(pids.join(' ') + '\\n'));
+setInterval(() => {}, 1000);`;
+
+/** A fake daemon that recorded two detached operations, each with a grandchild. */
+export interface IFakeDaemon {
+  readonly daemon: ChildProcess;
+  /** Leader and grandchild of the waiting operation, then of the exiting one. */
+  readonly pids: number[];
+}
+
+/** Starts the fake daemon and waits until both operations and their grandchildren run. */
+export async function startFakeDaemonAsync(paths: IDaemonPaths): Promise<IFakeDaemon> {
+  const modules: string[] = ['DaemonOperationGroupRecorder', 'DaemonOperationGroups'].map((name: string) =>
+    path.join(__dirname, '..', `${name}.js`)
+  );
+  const args: string[] = ['-e', FAKE_DAEMON_SCRIPT, ...modules, paths.lockfilePath];
+  const daemon: ChildProcess = spawn(process.execPath, args, FAKE_DAEMON_OPTIONS);
+  const [chunk] = (await once(daemon.stdout as Readable, 'data')) as [Buffer];
+  return { daemon, pids: chunk.toString().trim().split(SPACE).map(Number) };
+}
+
+/** SIGKILLs the fake daemon, as the OOM killer would, leaving its operations behind. */
+export async function killFakeDaemonAsync(fake: IFakeDaemon): Promise<void> {
+  fake.daemon.kill('SIGKILL');
+  await once(fake.daemon, 'exit');
+  (fake.daemon.stdout as Readable).destroy();
+}
+
+/** Writes the lockfile the dead fake daemon would have left. */
+export function writeDeadOwnerLockfile(paths: IDaemonPaths, fake: IFakeDaemon): void {
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: Number(fake.daemon.pid),
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts b/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
new file mode 100644
index 00000000000..aa0566d0731
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
@@ -0,0 +1,71 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const ANY_LOCKFILE: string = '';
+
+/** Describes the processes of a fake process table. */
+export interface IFakeProcessSpec {
+  /** The signal after which every group is gone; omitted means they never exit. */
+  readonly exitsOn?: NodeJS.Signals;
+  /** Processes outside the dead daemon's own group, such as detached operation trees. */
+  readonly processes?: readonly IProcessStat[];
+  /**
+   * The only environment entry that each listed pid carries, or `undefined` for none. Every other process carries
+   * the marker of the dead daemon's record folder, as the processes that the daemon started do.
+   */
+  readonly markers?: ReadonlyMap<number, string | undefined>;
+}
+
+/** The state of a fake process table that decides which of its processes are alive. */
+export interface IFakeProcessTable {
+  readonly spec: IFakeProcessSpec;
+  readonly signals: readonly NodeJS.Signals[];
+}
+
+/** `true` once the table's processes have received the signal after which they are gone. */
+export function hasExited(table: IFakeProcessTable): boolean {
+  return table.signals.some((signal: NodeJS.Signals) => signal === table.spec.exitsOn);
+}
+
+/** The table's processes, or none once they are gone. */
+export function liveProcesses(table: IFakeProcessTable): readonly IProcessStat[] {
+  return hasExited(table) ? [] : (table.spec.processes ?? []);
+}
+
+// Every record folder of daemon `daemonPid` is `<lockfile path>.groups-<daemonPid>`.
+function isMarkerOf(daemonPid: number, entry: string): boolean {
+  const folderSuffix: string = getOperationGroupsFolder(ANY_LOCKFILE, daemonPid);
+  return entry.startsWith(getOperationGroupsMarker(ANY_LOCKFILE)) && entry.endsWith(folderSuffix);
+}
+
+function hasEnvironmentEntry(
+  table: IFakeProcessTable,
+  daemonPid: number,
+  pid: number,
+  entry: string
+): boolean {
+  const { markers } = table.spec;
+  return markers?.has(pid) === true ? markers.get(pid) === entry : isMarkerOf(daemonPid, entry);
+}
+
+/** The process-reading ops of a fake table in which `daemonPid` is the dead daemon. */
+export function createProcessOps(
+  table: IFakeProcessTable,
+  daemonPid: number
+): Pick<
+  IDaemonProcessGroupOps,
+  'readProcessStat' | 'listLiveGroupMembers' | 'listProcesses' | 'hasEnvironmentEntry'
+> {
+  return {
+    readProcessStat: (pid: number) => liveProcesses(table).find((stat: IProcessStat) => stat.pid === pid),
+    listLiveGroupMembers: (groupId: number) =>
+      liveProcesses(table).filter((stat: IProcessStat) => stat.groupId === groupId && !stat.exited),
+    listProcesses: () => [...liveProcesses(table)],
+    hasEnvironmentEntry: (pid: number, entry: string) => hasEnvironmentEntry(table, daemonPid, pid, entry)
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/test/FileChange.test.ts b/libraries/rush-daemon-transport/src/test/FileChange.test.ts
new file mode 100644
index 00000000000..5febc724174
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FileChange.test.ts
@@ -0,0 +1,65 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { compareFileIdentity } from '../DaemonFileChange';
+import type { IDaemonFileIdentity } from '../DaemonFileIdentity';
+
+const CONTENT: string = 'content';
+const MOVED_SUFFIX: string = '.moved';
+const OTHER_DEVICE_OFFSET: number = 1;
+
+let folder: string;
+let filePath: string;
+let created: IDaemonFileIdentity;
+
+beforeEach(() => {
+  folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-file-change-'));
+  filePath = path.join(folder, 'file');
+  fs.writeFileSync(filePath, CONTENT);
+  const { dev, ino } = fs.lstatSync(filePath);
+  created = { dev, ino };
+});
+
+afterEach(() => fs.rmSync(folder, { recursive: true, force: true }));
+
+// The moved file keeps its inode in use, so a new file at the name cannot get the same number.
+function moveAway(): void {
+  fs.renameSync(filePath, `${filePath}${MOVED_SUFFIX}`);
+}
+
+it('reports no change while the name has the file that was created there', () => {
+  expect(compareFileIdentity(filePath, created)).toBeUndefined();
+});
+
+it('reports a name that no file has any more as removed', () => {
+  moveAway();
+  expect(compareFileIdentity(filePath, created)).toBe('removed');
+});
+
+it('reports a name that another file took as replaced', () => {
+  moveAway();
+  fs.writeFileSync(filePath, CONTENT);
+  expect(compareFileIdentity(filePath, created)).toBe('replaced');
+});
+
+it('tells files apart by device as well as by inode', () => {
+  const otherDevice: IDaemonFileIdentity = { dev: created.dev + OTHER_DEVICE_OFFSET, ino: created.ino };
+  expect(compareFileIdentity(filePath, otherDevice)).toBe('replaced');
+});
+
+it('reports a name whose folder became a file as removed', () => {
+  fs.rmSync(folder, { recursive: true });
+  fs.writeFileSync(folder, CONTENT);
+  expect(compareFileIdentity(filePath, created)).toBe('removed');
+});
+
+it('reports no change when the name cannot be read for another reason', () => {
+  // Node.js rejects a path that contains a NUL character on every platform, before it looks for the file.
+  const invalid: string = path.join(folder, 'invalid\0name');
+  expect(() => fs.lstatSync(invalid)).toThrow();
+  expect(compareFileIdentity(invalid, created)).toBeUndefined();
+});
diff --git a/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts b/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
new file mode 100644
index 00000000000..22d4a280753
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
@@ -0,0 +1,94 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import type { IDaemonFileIdentity } from '../DaemonFileIdentity';
+import { pinFileIdentity, readFileIdentity, removeOwnFile } from '../DaemonFileIdentity';
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const UTF8: BufferEncoding = 'utf8';
+const SOCKET_MODE: number = 0o600;
+const PERMISSION_MODULUS: number = 0o1000;
+const PRIVATE_NAME_PREFIX: string = '.bind-';
+const REPLACEMENT: string = 'another file';
+const MOVED_SUFFIX: string = '.moved';
+
+function createFile(paths: IDaemonPaths, content: string): string {
+  const filePath: string = path.join(paths.runtimeDir ?? '', 'file');
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content);
+  return filePath;
+}
+
+posixIt('keeps a pinned inode in use, so a replacement never passes for the file it replaced', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'first');
+  const pinned: IDaemonFileIdentity = pinFileIdentity(filePath);
+  fs.rmSync(filePath);
+  fs.writeFileSync(filePath, 'second');
+  expect(readFileIdentity(filePath)?.ino).not.toBe(pinned.ino);
+  removeOwnFile(filePath, pinned);
+  expect(fs.readFileSync(filePath, UTF8)).toBe('second');
+  expect(() => fs.fstatSync(pinned.fd ?? Number.NaN)).toThrow();
+  removeIsolatedBase(paths);
+});
+
+posixIt('removes a file that is still the pinned one', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'only');
+  removeOwnFile(filePath, pinFileIdentity(filePath));
+  expect(fs.existsSync(filePath)).toBe(false);
+  removeIsolatedBase(paths);
+});
+
+posixIt('reads nothing at a path whose folder became a file, and still releases the pinned inode', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'only');
+  const pinned: IDaemonFileIdentity = pinFileIdentity(filePath);
+  fs.rmSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(path.dirname(filePath), REPLACEMENT);
+  expect(readFileIdentity(filePath)).toBeUndefined();
+  removeOwnFile(filePath, pinned);
+  expect(fs.readFileSync(path.dirname(filePath), UTF8)).toBe(REPLACEMENT);
+  expect(() => fs.fstatSync(pinned.fd ?? Number.NaN)).toThrow();
+  removeIsolatedBase(paths);
+});
+
+posixIt('releases the pinned inode when it cannot read the path, and throws why', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'only');
+  const pinned: IDaemonFileIdentity = pinFileIdentity(filePath);
+  const folder: string = path.dirname(filePath);
+  // A folder that became a link to itself: every path through it fails with ELOOP.
+  fs.renameSync(folder, `${folder}${MOVED_SUFFIX}`);
+  fs.symlinkSync(folder, folder);
+  expect(() => removeOwnFile(filePath, pinned)).toThrow('ELOOP');
+  expect(() => fs.fstatSync(pinned.fd ?? Number.NaN)).toThrow();
+  expect(fs.readFileSync(path.join(`${folder}${MOVED_SUFFIX}`, 'file'), UTF8)).toBe('only');
+  removeIsolatedBase(paths);
+});
+
+posixIt('publishes an owner-only socket and deletes the private name it bound', async () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  try {
+    expect(fs.lstatSync(paths.socketPath).isSocket()).toBe(true);
+    expect(fs.lstatSync(paths.socketPath).mode % PERMISSION_MODULUS).toBe(SOCKET_MODE);
+    const names: string[] = fs.readdirSync(paths.runtimeDir ?? '');
+    expect(names.filter((name: string) => name.startsWith(PRIVATE_NAME_PREFIX))).toEqual([]);
+  } finally {
+    await listener.closeAsync();
+    removeIsolatedBase(paths);
+  }
+});
diff --git a/libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts b/libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts
new file mode 100644
index 00000000000..c5bb5f52531
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { hasLiveGroupMember } from '../DaemonGroupMemberScan';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+
+const GROUP_ID: number = 4242;
+const OTHER_GROUP_ID: number = 4243;
+const MEMBER_PID: number = 101;
+const LEADER_STAT_PATH: string = `/proc/${GROUP_ID}/stat`;
+// A `/proc` listing of the group's leader and one other member; `self` is no pid.
+const PROC_LISTING: string[] = [String(GROUP_ID), String(MEMBER_PID), 'self'];
+// proc_pid_stat(5): "pid (comm) state ppid pgrp session", then 15 fields up to starttime.
+const FIELDS_BEFORE_START_TIME: number = 15;
+const LIVE: string = 'S';
+const ZOMBIE: string = 'Z';
+
+type ReadRecord = () => string;
+
+function inGroup(state: string): ReadRecord {
+  return () => `0 (sleep) ${state} 1 ${GROUP_ID} ${GROUP_ID}${' 0'.repeat(FIELDS_BEFORE_START_TIME)} 777`;
+}
+
+function failing(code: string): ReadRecord {
+  return () => {
+    throw Object.assign(new Error(code), { code });
+  };
+}
+
+const GONE: ReadRecord = failing('ENOENT');
+
+// `readLeader` and `readMember` give the stat records of the group's leader and of its other member.
+function mockProc(readLeader: ReadRecord, readMember: ReadRecord): jest.SpyInstance {
+  jest
+    .spyOn(fs, 'readFileSync')
+    .mockImplementation((path: fs.PathOrFileDescriptor) =>
+      path === LEADER_STAT_PATH ? readLeader() : readMember()
+    );
+  return (jest.spyOn(fs, 'readdirSync') as jest.SpyInstance).mockReturnValue(PROC_LISTING);
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+it('answers from a live leader without listing /proc', () => {
+  const listing: jest.SpyInstance = mockProc(inGroup(LIVE), inGroup(ZOMBIE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+  expect(listing).not.toHaveBeenCalled();
+});
+
+it('counts a live member when the leader is gone or a zombie, and no zombie or other group', () => {
+  mockProc(GONE, inGroup(LIVE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+  expect(hasLiveGroupMember(OTHER_GROUP_ID)).toBe(false);
+  mockProc(inGroup(ZOMBIE), inGroup(LIVE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+  mockProc(inGroup(ZOMBIE), inGroup(ZOMBIE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(false);
+});
+
+it.each(['ENOENT', 'ESRCH'])('does not count a listed process that is gone (%s)', (code: string) => {
+  mockProc(failing(code), failing(code));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(false);
+});
+
+it('counts a listed process whose record it cannot read, as under hidepid, as a live member', () => {
+  mockProc(GONE, failing('EACCES'));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+});
+
+it('throws when it cannot list /proc', () => {
+  mockProc(GONE, GONE).mockImplementation(failing('EMFILE'));
+  expect(() => hasLiveGroupMember(GROUP_ID)).toThrow('EMFILE');
+});
+
+describe('a group that kill() still finds', () => {
+  beforeEach(() => {
+    jest.spyOn(process, 'kill').mockImplementation(() => true);
+  });
+
+  it('is gone once every member that /proc lists has exited', () => {
+    jest.spyOn(fs, 'existsSync').mockReturnValue(true);
+    mockProc(inGroup(ZOMBIE), inGroup(ZOMBIE));
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(false);
+    mockProc(GONE, inGroup(LIVE));
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(true);
+  });
+
+  it('exists where there is no /proc to tell', () => {
+    jest.spyOn(fs, 'existsSync').mockReturnValue(false);
+    mockProc(GONE, GONE).mockImplementation(failing('ENOENT'));
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(true);
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts b/libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts
new file mode 100644
index 00000000000..5fbf9f9f5b7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts
@@ -0,0 +1,87 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import type { SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { unlinkIfPresent } from '../DaemonUnlink';
+
+const PACKAGE_NAME: string = 'linked-package';
+const DEPENDENCY_NAME: string = 'linked-dependency';
+const INDEX_NAME: string = 'index.js';
+const MAIN_NAME: string = 'main.js';
+const NODE_MODULES: string = 'node_modules';
+const SOCKET_NAME: string = 's.sock';
+const PUBLISHED_NAME: string = 'p.sock';
+const FOLDER_PREFIX: string = 'rushd-linked-';
+// Short, as a socket path must be (104 bytes on macOS).
+const POSIX_TEMP_FOLDER: string = '/tmp';
+const CHILD_TIMEOUT_MS: number = 10000;
+const UTF8: BufferEncoding = 'utf8';
+
+/** How a Node process of its own exited, and what it printed. */
+export interface IChildOutcome {
+  readonly status: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * Creates a folder in which `node_modules/linked-package` is a symbolic link into a store, as pnpm installs
+ * packages. The package finds its dependency only from its real path.
+ */
+export function createLinkedPackageFolder(): string {
+  const folder: string = fs.mkdtempSync(path.join(POSIX_TEMP_FOLDER, FOLDER_PREFIX));
+  const store: string = path.join(folder, 'store', NODE_MODULES);
+  fs.mkdirSync(path.join(store, DEPENDENCY_NAME), { recursive: true });
+  fs.writeFileSync(path.join(store, DEPENDENCY_NAME, INDEX_NAME), "module.exports = 'found';");
+  fs.mkdirSync(path.join(store, PACKAGE_NAME));
+  fs.writeFileSync(path.join(store, PACKAGE_NAME, INDEX_NAME), `module.exports = require('${DEPENDENCY_NAME}');`);
+  fs.mkdirSync(path.join(folder, NODE_MODULES));
+  fs.symlinkSync(path.join(store, PACKAGE_NAME), path.join(folder, NODE_MODULES, PACKAGE_NAME));
+  return folder;
+}
+
+function createMain(call: string): string {
+  return [
+    "const fs = require('node:fs');",
+    "const net = require('node:net');",
+    'const [modulePath, socketPath, publishedPath] = process.argv.slice(2);',
+    'const target = require(modulePath);',
+    "const out = (value) => process.stdout.write(String(value) + ' ');",
+    'const server = net.createServer().listen(socketPath, async () => {',
+    `  ${call}`,
+    `  try { process.stdout.write(require('${PACKAGE_NAME}')); } catch (error) { process.stdout.write(error.code); }`,
+    '  server.close();',
+    '});'
+  ].join('\n');
+}
+
+/**
+ * Runs `call` in a Node process of its own while a socket listens at `socketPath`, then requires the linked
+ * package and prints what it exports, or the error's code. `call` is JavaScript that can use `target` (the module
+ * at `modulePath`), `socketPath`, `publishedPath` (a free name), `fs`, `net` and `out` (which prints a value). The
+ * main module is in `folder`, so the loader has already cached that path as one without links.
+ */
+export function runThenRequireLinkedPackage(folder: string, modulePath: string, call: string): IChildOutcome {
+  fs.writeFileSync(path.join(folder, MAIN_NAME), createMain(call));
+  const socketPaths: string[] = [SOCKET_NAME, PUBLISHED_NAME].map((name: string) => path.join(folder, name));
+  const child: SpawnSyncReturns<string> = spawnSync(process.execPath, [MAIN_NAME, modulePath, ...socketPaths], {
+    cwd: folder,
+    encoding: UTF8,
+    env: { ...process.env, NODE_OPTIONS: undefined, NODE_PRESERVE_SYMLINKS: undefined },
+    timeout: CHILD_TIMEOUT_MS
+  });
+  return { status: child.status, stdout: child.stdout, stderr: child.stderr };
+}
+
+/**
+ * Deletes a folder from {@link createLinkedPackageFolder}. Its sockets are unlinked first: `fs.rmSync` would stat
+ * them, and this process's own later `require()` calls could then fail as the child's would.
+ */
+export function removeLinkedPackageFolder(folder: string): void {
+  for (const name of [SOCKET_NAME, PUBLISHED_NAME]) unlinkIfPresent(path.join(folder, name));
+  fs.rmSync(folder, { recursive: true, force: true });
+}
diff --git a/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts b/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
new file mode 100644
index 00000000000..aee4ee36f8b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+
+import type { IDaemonFileIdentity } from '../DaemonFileIdentity';
+import { pinFileIdentity } from '../DaemonFileIdentity';
+import { DaemonListenerLifetime } from '../DaemonListenerLifetime';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { listenPublishedAsync } from '../DaemonSocketPublication';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// A named pipe has no runtime folder that could be replaced.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const REPLACEMENT: string = 'another file';
+const LOCKFILE_CONTENT: string = '{}';
+const MOVED_SUFFIX: string = '.moved';
+const UTF8: BufferEncoding = 'utf8';
+const ONCE: number = 1;
+const ELOOP: string = 'ELOOP';
+
+let paths: IDaemonPaths;
+let server: net.Server;
+let lockfile: IDaemonFileIdentity;
+let stopRecording: jest.Mock;
+let lifetime: DaemonListenerLifetime;
+
+beforeEach(async () => {
+  paths = createIsolatedTestDaemonPaths();
+  ensureDaemonRuntimeDir(paths);
+  server = net.createServer();
+  const socket: IDaemonFileIdentity = await listenPublishedAsync(server, paths, {});
+  fs.writeFileSync(paths.lockfilePath, LOCKFILE_CONTENT);
+  lockfile = pinFileIdentity(paths.lockfilePath);
+  stopRecording = jest.fn();
+  lifetime = new DaemonListenerLifetime(server, paths, { socket, lockfile }, stopRecording);
+});
+
+afterEach(() => {
+  // Only after a failed test: the listener closes its server itself.
+  if (server.listening) server.close();
+  removeIsolatedBase(paths);
+});
+
+/**
+ * Deletes the socket with no stat of it (`fs.rmSync` would stat it first). After a sync stat of a socket, Node 22's
+ * `fs.realpathSync` can return a path with a link unresolved (it checks a stale stat), and jest then fails to load
+ * its own modules.
+ */
+function unlinkSocket(): void {
+  fs.unlinkSync(paths.socketPath);
+}
+
+function expectClosedAndReleased(): void {
+  expect(server.listening).toBe(false);
+  expect(stopRecording).toHaveBeenCalledTimes(ONCE);
+  expect(() => fs.fstatSync(lockfile.fd ?? Number.NaN)).toThrow();
+}
+
+posixIt(
+  'closes and releases everything, without an error, after a file took its runtime folder',
+  async () => {
+    const folder: string = paths.runtimeDir ?? '';
+    unlinkSocket();
+    fs.rmSync(folder, { recursive: true });
+    fs.writeFileSync(folder, REPLACEMENT);
+    await lifetime.closeAsync();
+    expectClosedAndReleased();
+    expect(fs.readFileSync(folder, UTF8)).toBe(REPLACEMENT);
+  }
+);
+
+posixIt('closes and releases everything when it cannot delete its files, and rejects with why', async () => {
+  const folder: string = paths.runtimeDir ?? '';
+  unlinkSocket();
+  // A runtime folder that became a link to itself: every path through it fails with ELOOP.
+  fs.renameSync(folder, `${folder}${MOVED_SUFFIX}`);
+  fs.symlinkSync(folder, folder);
+  const closing: Promise<void> = lifetime.closeAsync();
+  // Both errors, the socket's first: the lockfile's does not replace it.
+  await expect(closing).rejects.toMatchObject({
+    errors: [expect.objectContaining({ code: ELOOP }), expect.objectContaining({ code: ELOOP })]
+  });
+  await expect(closing).rejects.toThrow(`'${paths.socketPath}'. Then: `);
+  await expect(closing).rejects.toThrow(`'${paths.lockfilePath}'`);
+  expectClosedAndReleased();
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts b/libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts
new file mode 100644
index 00000000000..7a2a5f3f7cd
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import { readDaemonLockfile } from '../DaemonLockfile';
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { identifyStarted, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+// SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX, which gives the operation a group of its own.
+const DETACHED: SpawnOptions = { detached: true, stdio: 'ignore' };
+const NO_RECORDS: number = 0;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+function listenAsync(paths: IDaemonPaths): Promise<DaemonFrameListener> {
+  return DaemonFrameListener.listenAsync(paths, {
+    onConnection: () => undefined,
+    protocolVersion: DAEMON_PROTOCOL_VERSION
+  });
+}
+
+function countRecords(paths: IDaemonPaths): number {
+  return readOperationGroupRecords(getOperationGroupsFolder(paths.lockfilePath, process.pid)).length;
+}
+
+it('releases the lockfile for exit when the daemon has no children', async () => {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const listener: DaemonFrameListener = await listenAsync(paths);
+  try {
+    expect(listener.releaseForExit()).toBe(true);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  } finally {
+    await listener.closeAsync();
+  }
+});
+
+posixIt('releases the socket for exit, and a later close leaves a successor alone', async () => {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const released: DaemonFrameListener = await listenAsync(paths);
+  expect(released.releaseForExit()).toBe(true);
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+  const successor: DaemonFrameListener = await listenAsync(paths);
+  try {
+    await released.closeAsync();
+    expect(readDaemonLockfile(paths.lockfilePath)?.pid).toBe(process.pid);
+    expect(fs.existsSync(paths.socketPath)).toBe(true);
+  } finally {
+    await successor.closeAsync();
+  }
+  expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+});
+
+linuxIt('keeps the socket and the lockfile for a successor while a recorded operation runs', async () => {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const listener: DaemonFrameListener = await listenAsync(paths);
+  try {
+    const operation: ChildProcess = spawn(process.execPath, SLEEP_ARGS, DETACHED);
+    await once(operation, 'spawn');
+    started = identifyStarted([Number(operation.pid)]);
+    expect(await waitUntilAsync(() => countRecords(paths) > NO_RECORDS)).toBe(true);
+    expect(listener.releaseForExit()).toBe(false);
+    expect(readDaemonLockfile(paths.lockfilePath)?.pid).toBe(process.pid);
+    expect(fs.existsSync(paths.socketPath)).toBe(true);
+    operation.kill('SIGKILL');
+    expect(await waitUntilAsync(() => countRecords(paths) === NO_RECORDS)).toBe(true);
+    expect(listener.releaseForExit()).toBe(true);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  } finally {
+    await listener.closeAsync();
+  }
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts b/libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts
new file mode 100644
index 00000000000..2f26e288ca5
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import type { IDaemonOrphanReap, IDaemonReclaimOptions } from '../DaemonReclaimOptions';
+
+import {
+  killFakeDaemonAsync,
+  startFakeDaemonAsync,
+  writeDeadOwnerLockfile
+} from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Above the worst case of a 5 s poll plus the reaper's SIGTERM and SIGKILL grace periods, so that a
+// regression fails an assertion instead of timing out.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+const STALE_SOCKET: string = 'stale';
+const WARNING_CODE: { code: string } = { code: 'RUSH_DAEMON_ORPHANS_REAPED' };
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  // A failed assertion must not leave this test's processes running.
+  killStillRunning(started);
+  started = [];
+  jest.restoreAllMocks();
+});
+
+/** Leaves what a SIGKILLed daemon leaves behind: its operations, its lockfile and its socket. */
+async function crashFakeDaemonAsync(paths: IDaemonPaths): Promise<IFakeDaemon> {
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  await killFakeDaemonAsync(fake);
+  writeDeadOwnerLockfile(paths, fake);
+  fs.writeFileSync(paths.socketPath, STALE_SOCKET);
+  return fake;
+}
+
+/** Binds a listener at the crashed daemon's socket path, which reclaims it, and closes the listener again. */
+async function listenOverCrashAsync(
+  paths: IDaemonPaths,
+  fake: IFakeDaemon,
+  options: IDaemonReclaimOptions
+): Promise<void> {
+  const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
+    ...options,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  await listener.closeAsync();
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+}
+
+async function reportsReapsToListenerOptionAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await crashFakeDaemonAsync(paths);
+  const reaps: IDaemonOrphanReap[] = [];
+  await listenOverCrashAsync(paths, fake, { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) });
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  expect(reaps).toEqual([
+    { daemonPid: Number(fake.daemon.pid), processGroupIds: expect.any(Array), outcome: 'terminated' }
+  ]);
+  const [{ processGroupIds }] = reaps;
+  expect(new Set(processGroupIds)).toEqual(new Set([waitingLeader, exitingLeader]));
+  expect(warning).not.toHaveBeenCalled();
+}
+
+linuxIt(
+  "reports the operations it stops while reclaiming a dead daemon's socket to onOrphansReaped",
+  reportsReapsToListenerOptionAsync,
+  REAP_TEST_TIMEOUT_MS
+);
+
+async function warnsWithoutListenerOptionAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await crashFakeDaemonAsync(paths);
+  await listenOverCrashAsync(paths, fake, {});
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${waitingLeader}`), WARNING_CODE);
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${exitingLeader}`), WARNING_CODE);
+}
+
+linuxIt(
+  'reports them as a process warning without onOrphansReaped',
+  warnsWithoutListenerOptionAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts b/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
new file mode 100644
index 00000000000..4a433389aff
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import * as daemonReclaim from '../DaemonReclaim';
+import type { IDaemonOperationGroupLeftRunning, IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const DIR_MODE: number = 0o700;
+const STALE_SOCKET: string = 'stale';
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+/** Leaves a file at the socket path, which makes binding reclaim the path. */
+function plantStaleSocket(paths: IDaemonPaths): void {
+  fs.mkdirSync(path.dirname(paths.socketPath), { recursive: true, mode: DIR_MODE });
+  fs.writeFileSync(paths.socketPath, STALE_SOCKET);
+}
+
+async function passesOnlyTheReclaimCallbacksAsync(): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  plantStaleSocket(paths);
+  // The reclaim is stubbed: it only removes the stale socket, so that the second attempt to publish succeeds.
+  const reclaim: jest.SpyInstance = jest
+    .spyOn(daemonReclaim, 'reclaimStaleDaemonAsync')
+    .mockImplementation(async (stalePaths: IDaemonPaths) => fs.unlinkSync(stalePaths.socketPath));
+  const onOrphansReaped: (reap: IDaemonOrphanReap) => void = () => undefined;
+  const onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => void = () => undefined;
+  const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined,
+    onOrphansReaped,
+    onOperationGroupLeftRunning
+  });
+  await listener.closeAsync();
+  // The reaper behind the reclaim also reads fields for tests from its options: nothing else may reach it.
+  expect(reclaim.mock.calls).toEqual([[paths, { onOrphansReaped, onOperationGroupLeftRunning }]]);
+}
+
+posixIt(
+  "passes only the reclaim's callbacks from its options on to the reclaim of a stale socket",
+  passesOnlyTheReclaimCallbacksAsync
+);
diff --git a/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts b/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
new file mode 100644
index 00000000000..11fa8eb994d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
@@ -0,0 +1,87 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import { DaemonListenerLifetime } from '../DaemonListenerLifetime';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// A named pipe has no file identity, and it can't be deleted while its server runs.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const REPLACEMENT: string = 'another file';
+const UTF8: BufferEncoding = 'utf8';
+
+let paths: IDaemonPaths;
+let listener: DaemonFrameListener;
+
+beforeEach(async () => {
+  paths = createIsolatedTestDaemonPaths();
+  listener = await DaemonFrameListener.listenAsync(paths, {
+    onConnection: () => undefined,
+    protocolVersion: DAEMON_PROTOCOL_VERSION
+  });
+});
+
+afterEach(async () => {
+  await listener.closeAsync();
+  removeIsolatedBase(paths);
+});
+
+it('reports no change while the socket has its name', () => {
+  expect(listener.checkSocket()).toBeUndefined();
+});
+
+it('reports no change for a listener that published no socket, as on Windows', () => {
+  expect(new DaemonListenerLifetime(net.createServer(), paths, {}).checkSocket()).toBeUndefined();
+});
+
+posixIt('reports a deleted socket as removed', () => {
+  fs.rmSync(paths.socketPath);
+  expect(listener.checkSocket()).toBe('removed');
+});
+
+posixIt('reports a socket whose runtime folder was deleted as removed', () => {
+  fs.rmSync(paths.runtimeDir ?? paths.socketPath, { recursive: true });
+  expect(listener.checkSocket()).toBe('removed');
+});
+
+posixIt(
+  'closes without an error after a file took the name of its runtime folder, and leaves it',
+  async () => {
+    const folder: string = paths.runtimeDir ?? paths.socketPath;
+    fs.rmSync(folder, { recursive: true });
+    fs.writeFileSync(folder, REPLACEMENT);
+    expect(listener.checkSocket()).toBe('removed');
+    await listener.closeAsync();
+    expect(fs.readFileSync(folder, UTF8)).toBe(REPLACEMENT);
+  }
+);
+
+posixIt(
+  'reports a socket name that another file took as replaced, and closes without deleting it',
+  async () => {
+    fs.rmSync(paths.socketPath);
+    fs.writeFileSync(paths.socketPath, REPLACEMENT);
+    expect(listener.checkSocket()).toBe('replaced');
+    await listener.closeAsync();
+    expect(fs.readFileSync(paths.socketPath, UTF8)).toBe(REPLACEMENT);
+  }
+);
+
+posixIt('reports no change once the listener stopped accepting and deleted its socket', async () => {
+  await listener.stopAcceptingAsync();
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+  expect(listener.checkSocket()).toBeUndefined();
+});
+
+posixIt('reports no change once the listener released its socket for exit', () => {
+  expect(listener.releaseForExit()).toBe(true);
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+  expect(listener.checkSocket()).toBeUndefined();
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts b/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
new file mode 100644
index 00000000000..02908797029
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
@@ -0,0 +1,94 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { connectDaemonAsync } from '../DaemonConnector';
+import type { DaemonFrameConnection } from '../DaemonFrameConnection';
+import { DaemonFrameListener } from '../DaemonListener';
+import { readDaemonLockfile } from '../DaemonLockfile';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createDeferred, createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+
+// A named pipe can't be deleted while its server runs, so only POSIX has a successor in this sense.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const SUCCESSOR: string = 'successor';
+// The name that a listener binds before it publishes its socket.
+const PRIVATE_NAME_PREFIX: string = '.bind-';
+
+function listenAsync(paths: IDaemonPaths, reached?: IDeferred<string>): Promise<DaemonFrameListener> {
+  return DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => reached?.resolve(SUCCESSOR)
+  });
+}
+
+async function expectSuccessorReachableAsync(paths: IDaemonPaths, reached: IDeferred<string>): Promise<void> {
+  expect(readDaemonLockfile(paths.lockfilePath)?.socketPath).toBe(paths.socketPath);
+  const client: DaemonFrameConnection = await connectDaemonAsync(paths.socketPath);
+  await expect(reached.promise).resolves.toBe(SUCCESSOR);
+  await client.closeAsync();
+}
+
+async function expectPredecessorCloseSparesSuccessorAsync(
+  deleteFiles: (paths: IDaemonPaths) => void
+): Promise<void> {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const predecessor: DaemonFrameListener = await listenAsync(paths);
+  deleteFiles(paths);
+  const reached: IDeferred<string> = createDeferred<string>();
+  const successor: DaemonFrameListener = await listenAsync(paths, reached);
+  try {
+    await predecessor.closeAsync();
+    await expectSuccessorReachableAsync(paths, reached);
+  } finally {
+    await successor.closeAsync();
+    removeIsolatedBase(paths);
+  }
+}
+
+posixIt('keeps a successor reachable after a predecessor whose socket and lockfile were deleted closes', () =>
+  expectPredecessorCloseSparesSuccessorAsync((paths: IDaemonPaths) => {
+    fs.rmSync(paths.socketPath);
+    fs.rmSync(paths.lockfilePath);
+  })
+);
+
+posixIt('keeps a successor reachable after a predecessor whose runtime folder was deleted closes', () =>
+  expectPredecessorCloseSparesSuccessorAsync((paths: IDaemonPaths) => {
+    fs.rmSync(paths.runtimeDir ?? paths.socketPath, { recursive: true });
+  })
+);
+
+posixIt('does not replace the socket of a live listener whose lockfile was deleted', async () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const reached: IDeferred<string> = createDeferred<string>();
+  const live: DaemonFrameListener = await listenAsync(paths, reached);
+  fs.rmSync(paths.lockfilePath);
+  try {
+    const refused: DaemonTransportErrorCode = DaemonTransportErrorCode.daemonAlreadyRunning;
+    await expect(listenAsync(paths)).rejects.toMatchObject({ code: refused });
+    const names: string[] = fs.readdirSync(paths.runtimeDir ?? paths.socketPath);
+    expect(names.filter((name: string) => name.startsWith(PRIVATE_NAME_PREFIX))).toEqual([]);
+    // The refused listener must not have replaced the name, so the connection reaches the live one.
+    const client: DaemonFrameConnection = await connectDaemonAsync(paths.socketPath);
+    await expect(reached.promise).resolves.toBe(SUCCESSOR);
+    await client.closeAsync();
+  } finally {
+    await live.closeAsync();
+    removeIsolatedBase(paths);
+  }
+});
+
+posixIt('removes its own socket and lockfile when it closes', async () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const listener: DaemonFrameListener = await listenAsync(paths);
+  await listener.closeAsync();
+  expect(fs.readdirSync(paths.runtimeDir ?? paths.socketPath)).toEqual([]);
+  removeIsolatedBase(paths);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts
new file mode 100644
index 00000000000..fec58e1b07d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts
@@ -0,0 +1,50 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { adoptUnrecordedOperationGroups } from '../DaemonOperationGroupAdoption';
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import { createReapContext } from '../DaemonReapOptions';
+
+import {
+  AT_MARK,
+  AT_WINDOW_END,
+  MARK,
+  RECORD,
+  RECORDED,
+  WINDOW_END,
+  createMarkedFolder
+} from './OperationGroupAdoptionFixture';
+import type { IMarkedFolder } from './OperationGroupAdoptionFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+
+it('adopts only unrecorded group and session leaders with the marker, started within 1 s after a mark', () => {
+  const { folder, fake }: IMarkedFolder = createMarkedFolder(MARK);
+  const adopted: IOperationGroupRecord[] = adoptUnrecordedOperationGroups(
+    createReapContext(DEAD_PID, fake.options),
+    { folder, records: [RECORD], marker: getOperationGroupsMarker(folder) }
+  );
+  expect(adopted).toEqual([
+    { groupId: AT_MARK, startTime: String(MARK) },
+    { groupId: AT_WINDOW_END, startTime: String(WINDOW_END) }
+  ]);
+});
+
+it('signals each recorded or adopted group once', async () => {
+  const { lockfilePath, fake }: IMarkedFolder = createMarkedFolder(MARK);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'terminated'
+  );
+  expect(fake.targets).toEqual([RECORDED, AT_MARK, AT_WINDOW_END]);
+});
+
+it('reads no process list without a spawn mark', async () => {
+  const { lockfilePath, fake }: IMarkedFolder = createMarkedFolder(undefined);
+  const listProcesses: jest.Mock = jest.fn(() => []);
+  const ops: IDaemonProcessGroupOps = { ...(fake.options.ops as IDaemonProcessGroupOps), listProcesses };
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, { ...fake.options, ops });
+  expect(listProcesses).not.toHaveBeenCalled();
+  expect(fake.targets).toEqual([RECORDED]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts
new file mode 100644
index 00000000000..6281949e918
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { AT_MARK, MARK, leader, markName } from './OperationGroupAdoptionFixture';
+import type { IAdoptionScene } from './OperationGroupAdoptionFixture';
+import { adoptAndReapAsync } from './OperationGroupAdoptionRun';
+import type { IAdoptionRun } from './OperationGroupAdoptionRun';
+import { SELF_PID } from './OrphanReaperFixture';
+
+const OWN_GROUP: number = 1500;
+const LATER_MARK: number = 7000;
+const LATER_IN_WINDOW: number = 7100;
+const BETWEEN_MARKS: number = 6000;
+const EARLY_START: number = 50;
+const AT_LATER_MARK: number = 8001;
+const IN_LATER_WINDOW: number = 8002;
+const BETWEEN: number = 8003;
+const EARLY: number = 8004;
+// Names that are not a spawn mark's; a pattern without its end anchor, or with no digit, would read 0 or 12.
+const BAD_MARK_NAMES: string[] = ['spawn-', 'spawn-abc', 'spawn-12x'];
+
+it("never signals the reaper's own process or its own group, which it would otherwise adopt", async () => {
+  const run: IAdoptionRun = await adoptAndReapAsync({
+    markNames: [markName(MARK)],
+    processes: [leader(SELF_PID, MARK), leader(OWN_GROUP, MARK), leader(AT_MARK, MARK)],
+    ownGroupId: OWN_GROUP
+  });
+  expect(run).toEqual({ adopted: [SELF_PID, OWN_GROUP, AT_MARK], scanned: true, signaled: [AT_MARK] });
+});
+
+it('reads no process for a spawn mark whose name is not a clock tick, and throws nothing', async () => {
+  const run: IAdoptionRun = await adoptAndReapAsync({
+    markNames: BAD_MARK_NAMES,
+    processes: [leader(EARLY, EARLY_START)]
+  });
+  expect(run).toEqual({ adopted: [], scanned: false, signaled: [] });
+});
+
+it('adopts the processes started within 1 s after any of the spawn marks', async () => {
+  const run: IAdoptionRun = await adoptAndReapAsync({
+    markNames: [markName(MARK), markName(LATER_MARK)],
+    processes: [
+      leader(AT_LATER_MARK, LATER_MARK),
+      leader(IN_LATER_WINDOW, LATER_IN_WINDOW),
+      leader(BETWEEN, BETWEEN_MARKS)
+    ]
+  });
+  const adopted: number[] = [AT_LATER_MARK, IN_LATER_WINDOW];
+  expect(run).toEqual({ adopted, scanned: true, signaled: adopted });
+});
+
+it("reads no process while the dead daemon's pid is alive, unless another process has reused it", async () => {
+  const scene: IAdoptionScene = {
+    markNames: [markName(MARK)],
+    processes: [leader(AT_MARK, MARK)],
+    daemonAlive: true
+  };
+  const alive: IAdoptionRun = await adoptAndReapAsync(scene);
+  const reused: IAdoptionRun = await adoptAndReapAsync(scene, true);
+  expect({ alive, reused }).toEqual({
+    alive: { adopted: [], scanned: false, signaled: [] },
+    reused: { adopted: [AT_MARK], scanned: true, signaled: [AT_MARK] }
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts
new file mode 100644
index 00000000000..65b6348617a
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts
@@ -0,0 +1,99 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+/** The clock tick of the spawn mark that {@link createMarkedFolder} writes. */
+export const MARK: number = 5000;
+const IN_WINDOW: number = 5050;
+/** The last tick of the 1 s after {@link MARK}. */
+export const WINDOW_END: number = 5100;
+const ONE_TICK: number = 1;
+/** A marker-carrying leader started at the mark. */
+export const AT_MARK: number = 7001;
+/** A marker-carrying leader started at the end of the window. */
+export const AT_WINDOW_END: number = 7002;
+const BEFORE_MARK: number = 7003;
+const AFTER_WINDOW: number = 7004;
+const NO_MARKER: number = 7005;
+const OTHER_MARKER: number = 7006;
+const NOT_GROUP_LEADER: number = 7007;
+const NOT_SESSION_LEADER: number = 7008;
+const ZOMBIE: number = 7009;
+/** A marker-carrying leader started in the window, which the dead daemon recorded. */
+export const RECORDED: number = 7010;
+const OTHER_GROUP: number = 7070;
+const OTHER_SESSION: number = 7080;
+const OTHER_FOLDER: string = `/nonexistent/other.pid.json.groups-${DEAD_PID}`;
+const EMPTY_FILE: string = '';
+
+/** A process that leads its own group and session, started at clock tick `start`. */
+export function leader(pid: number, start: number, exited: boolean = false): IProcessStat {
+  return { pid, groupId: pid, sessionId: pid, startTime: String(start), exited };
+}
+
+/** The name of a spawn mark at clock tick `tick`. */
+export function markName(tick: number): string {
+  return `spawn-${tick}`;
+}
+
+// One process per condition of an adoption; only AT_MARK and AT_WINDOW_END meet them all.
+const TABLE: readonly IProcessStat[] = [
+  leader(AT_MARK, MARK),
+  leader(AT_WINDOW_END, WINDOW_END),
+  leader(BEFORE_MARK, MARK - ONE_TICK),
+  leader(AFTER_WINDOW, WINDOW_END + ONE_TICK),
+  leader(NO_MARKER, IN_WINDOW),
+  leader(OTHER_MARKER, IN_WINDOW),
+  { ...leader(NOT_GROUP_LEADER, IN_WINDOW), groupId: OTHER_GROUP, sessionId: OTHER_GROUP },
+  { ...leader(NOT_SESSION_LEADER, IN_WINDOW), sessionId: OTHER_SESSION },
+  leader(ZOMBIE, IN_WINDOW, true),
+  leader(RECORDED, IN_WINDOW)
+];
+// NO_MARKER's environment has no marker, or can't be read; OTHER_MARKER carries another daemon folder's marker.
+const TABLE_MARKERS: ReadonlyMap<number, string | undefined> = new Map([
+  [NO_MARKER, undefined],
+  [OTHER_MARKER, getOperationGroupsMarker(OTHER_FOLDER)]
+]);
+
+/** The dead daemon's record of {@link RECORDED}. */
+export const RECORD: IOperationGroupRecord = { groupId: RECORDED, startTime: String(IN_WINDOW) };
+
+/** A dead daemon's record folder, and the fake process table of its processes. */
+export interface IMarkedFolder {
+  readonly lockfilePath: string;
+  readonly folder: string;
+  readonly fake: IFakeGroup;
+}
+
+/** The entries of a dead daemon's record folder, and its fake process table, in which SIGTERM ends every group. */
+export interface IAdoptionScene extends Omit<IFakeGroupSpec, 'exitsOn'> {
+  readonly markNames: readonly string[];
+  readonly records?: readonly IOperationGroupRecord[];
+}
+
+/** Creates the dead daemon's folder beside a new lockfile, with the scene's records and spawn marks. */
+export function createAdoptionFolder({ markNames, records, ...spec }: IAdoptionScene): IMarkedFolder {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  fs.mkdirSync(folder, { recursive: true });
+  records?.forEach((record: IOperationGroupRecord) => writeOperationGroupRecord(folder, record));
+  markNames.forEach((name: string) => fs.writeFileSync(path.join(folder, name), EMPTY_FILE));
+  return { lockfilePath, folder, fake: createFakeGroup({ ...spec, exitsOn: 'SIGTERM' }) };
+}
+
+/** The folder with {@link RECORD} and, unless `mark` is undefined, a spawn mark, and the table of every case. */
+export function createMarkedFolder(mark: number | undefined): IMarkedFolder {
+  const markNames: string[] = mark === undefined ? [] : [markName(mark)];
+  return createAdoptionFolder({ markNames, records: [RECORD], processes: TABLE, markers: TABLE_MARKERS });
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts
new file mode 100644
index 00000000000..8f004b9a23b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts
@@ -0,0 +1,48 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { adoptUnrecordedOperationGroups } from '../DaemonOperationGroupAdoption';
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import { createReapContext } from '../DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { createAdoptionFolder } from './OperationGroupAdoptionFixture';
+import type { IAdoptionScene, IMarkedFolder } from './OperationGroupAdoptionFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+
+const NO_CALLS: number = 0;
+
+/** The groups adopted in a scene, whether the whole process table was read, and the groups its reap signaled. */
+export interface IAdoptionRun {
+  readonly adopted: number[];
+  readonly scanned: boolean;
+  readonly signaled: number[];
+}
+
+/** Adopts in the scene, and then reaps it; `deadPidReused` as the reclaim passes it. */
+export async function adoptAndReapAsync(
+  scene: IAdoptionScene,
+  deadPidReused: boolean = false
+): Promise<IAdoptionRun> {
+  const { lockfilePath, folder, fake }: IMarkedFolder = createAdoptionFolder(scene);
+  const ops: IDaemonProcessGroupOps = fake.options.ops as IDaemonProcessGroupOps;
+  const listProcesses: jest.Mock = jest.fn(ops.listProcesses);
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    ops: { ...ops, listProcesses },
+    deadPidReused
+  };
+  const adopted: IOperationGroupRecord[] = adoptUnrecordedOperationGroups(
+    createReapContext(DEAD_PID, options),
+    { folder, records: scene.records ?? [], marker: getOperationGroupsMarker(folder) }
+  );
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options);
+  return {
+    adopted: adopted.map((record: IOperationGroupRecord) => record.groupId),
+    scanned: listProcesses.mock.calls.length > NO_CALLS,
+    signaled: [...fake.targets]
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts
new file mode 100644
index 00000000000..6b045d7e935
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { DEAD_PID } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+/** The leader pid (and group and session id) of the first fake detached operation. */
+export const OPERATION_GROUP: number = 5000;
+/** A second fake detached operation. */
+export const OTHER_OPERATION_GROUP: number = 6000;
+/** The start time recorded for every fake operation leader. */
+export const RECORDED_START: string = '777';
+const CHILD_OFFSET: number = 1;
+/** The pid of the child in {@link OPERATION_GROUP}'s tree. */
+export const OPERATION_CHILD: number = OPERATION_GROUP + CHILD_OFFSET;
+
+/** A fake `/proc` stat record for a live process. */
+export function stat(pid: number, groupId: number, sessionId: number = groupId): IProcessStat {
+  return { pid, groupId, sessionId, startTime: RECORDED_START, exited: false };
+}
+
+/** A fake operation tree: the leader (unless it exited) and one child, both in group and session `groupId`. */
+export function operationTree(groupId: number, leaderAlive: boolean = true): IProcessStat[] {
+  const child: IProcessStat = stat(groupId + CHILD_OFFSET, groupId);
+  return leaderAlive ? [stat(groupId, groupId), child] : [child];
+}
+
+/** A lockfile path whose dead daemon ({@link DEAD_PID}) recorded `groupIds`. */
+export function recordGroups(groupIds: readonly number[]): string {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  fs.mkdirSync(folder, { recursive: true });
+  for (const groupId of groupIds) {
+    const record: IOperationGroupRecord = { groupId, startTime: RECORDED_START };
+    writeOperationGroupRecord(folder, record);
+  }
+  return lockfilePath;
+}
+
+/** `true` when the dead daemon's records for `lockfilePath` still exist. */
+export function recordsRemain(lockfilePath: string): boolean {
+  return fs.existsSync(getOperationGroupsFolder(lockfilePath, DEAD_PID));
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts
new file mode 100644
index 00000000000..f64010d1ffe
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOperationGroupLeftRunning } from '../DaemonReclaimOptions';
+
+import { OPERATION_GROUP, recordGroups, stat } from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+
+/** A live process with the PID {@link OPERATION_GROUP} that started later than the recorded leader. */
+export const REUSED_LEADER: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), startTime: '999' };
+
+/** What a reap of one recorded group returned, signaled and reported as left running. */
+export interface ILeftRunningReap {
+  readonly fake: IFakeGroup;
+  readonly outcome: string;
+  readonly groups: readonly IDaemonOperationGroupLeftRunning[];
+}
+
+/**
+ * Reaps the dead daemon's record of {@link OPERATION_GROUP}, or with `deadPidReused` its record of the group
+ * whose ID is its own PID, in a fake process table whose groups exit on SIGTERM. `options` override the
+ * table's, and the reap's `onOperationGroupLeftRunning` collects its reports.
+ */
+export async function reapLeftRunningAsync(
+  spec: IFakeGroupSpec,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<ILeftRunningReap> {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', ...spec });
+  const groups: IDaemonOperationGroupLeftRunning[] = [];
+  const onOperationGroupLeftRunning = (group: IDaemonOperationGroupLeftRunning): number => groups.push(group);
+  const lockfilePath: string = recordGroups([options.deadPidReused ? DEAD_PID : OPERATION_GROUP]);
+  const reapOptions: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOperationGroupLeftRunning,
+    ...options
+  };
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, reapOptions);
+  return { fake, outcome, groups };
+}
+
+/** The options of `fake`, with its `listLiveGroupMembers` replaced. */
+export function withGroupMembers(
+  fake: IFakeGroup,
+  listLiveGroupMembers: IDaemonProcessGroupOps['listLiveGroupMembers']
+): IDaemonOrphanReaperOptions {
+  return { ...fake.options, ops: { ...(fake.options.ops as IDaemonProcessGroupOps), listLiveGroupMembers } };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts
new file mode 100644
index 00000000000..d4b3aa82534
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts
@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatOperationGroupLeftRunning } from '../DaemonOperationGroupLeftRunningMessage';
+import type { DaemonOperationGroupLeftRunningReason } from '../DaemonReclaimOptions';
+
+const DAEMON_PID: number = 4242;
+const GROUP_ID: number = 5001;
+const PREFIX: string =
+  `left process group ${GROUP_ID} running, which the exited daemon (PID ${DAEMON_PID}) recorded for an ` +
+  'operation: ';
+// The lines that clients search the launcher log for (see rush-client-core's ReclaimedDaemonLog).
+const SEARCHED_LINE: RegExp = /rushd \(PID|rushd ready at|reset the daemon's files|left running/;
+
+const DESCRIPTIONS: [DaemonOperationGroupLeftRunningReason, string][] = [
+  [
+    'callerGroup',
+    'its ID is the PID or the process group ID of this process, or this process cannot read its own group'
+  ],
+  ['daemonPidInUse', "another process has that daemon's PID now"],
+  ['leaderChanged', `the process with PID ${GROUP_ID} now is not the leader that the daemon recorded`],
+  ['otherSession', 'its leader has exited, and a process of the group is in another session'],
+  [
+    'noMarker',
+    "its leader has exited, and no process of the group has that daemon's RUSHD_OPERATION_GROUPS value, " +
+      'which a daemon from a release before that variable does not set'
+  ]
+];
+
+it.each(DESCRIPTIONS)('describes %s in one line that no client searches for', (reason, description) => {
+  const line: string = formatOperationGroupLeftRunning({
+    daemonPid: DAEMON_PID,
+    processGroupId: GROUP_ID,
+    reason
+  });
+  expect(line).toBe(`${PREFIX}${description}`);
+  expect(line).not.toMatch(SEARCHED_LINE);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts
new file mode 100644
index 00000000000..dc24ae00959
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOperationGroupLeftRunning } from '../DaemonReclaimOptions';
+
+import {
+  OPERATION_GROUP,
+  OTHER_OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { reapLeftRunningAsync, withGroupMembers } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+// A later process that has the PID of the recorded leader of OTHER_OPERATION_GROUP.
+const OTHER_LEADER: IProcessStat = {
+  ...stat(OTHER_OPERATION_GROUP, OTHER_OPERATION_GROUP),
+  startTime: '999'
+};
+
+it('reads no group again that has no process', async () => {
+  const listLiveGroupMembers: jest.Mock = jest.fn(() => []);
+  const fake: IFakeGroup = createFakeGroup({ processes: [] });
+  const { groups } = await reapLeftRunningAsync(
+    { processes: [] },
+    withGroupMembers(fake, listLiveGroupMembers)
+  );
+  expect(groups).toEqual([]);
+  expect(listLiveGroupMembers).not.toHaveBeenCalled();
+});
+
+it('reports nothing, and keeps the records, when a group that it proved survives SIGKILL', async () => {
+  // Without `exitsOn`, no process of the table ever exits.
+  const fake: IFakeGroup = createFakeGroup({ processes: [...operationTree(OPERATION_GROUP), OTHER_LEADER] });
+  const groups: IDaemonOperationGroupLeftRunning[] = [];
+  const onOperationGroupLeftRunning = (group: IDaemonOperationGroupLeftRunning): number => groups.push(group);
+  const lockfilePath: string = recordGroups([OPERATION_GROUP, OTHER_OPERATION_GROUP]);
+  const reap: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, {
+    ...fake.options,
+    onOperationGroupLeftRunning
+  });
+  await expect(reap).rejects.toThrow(/survived SIGKILL/);
+  expect(fake.targets.every((groupId: number) => groupId === OPERATION_GROUP)).toBe(true);
+  expect(groups).toEqual([]);
+  expect(recordsRemain(lockfilePath)).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts
new file mode 100644
index 00000000000..9802e2c0d32
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts
@@ -0,0 +1,71 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Readable } from 'node:stream';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOperationGroupLeftRunning } from '../DaemonReclaimOptions';
+
+import { RECORDED_START } from './OperationGroupFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A detached shell leads a new session and group, starts a member in them, prints its pid and exits, which
+// leaves the group without its leader. Nothing in the group has RUSHD_OPERATION_GROUPS, as in an operation of
+// a daemon from a release before that variable.
+const LEADERLESS_SCRIPT: string = 'sleep 600 </dev/null >/dev/null 2>&1 & echo $!';
+const GRACE_MS: number = 500;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function startUnmarkedLeaderlessGroupAsync(): Promise<number> {
+  const shell: ChildProcess = spawn('/bin/sh', ['-c', LEADERLESS_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore'],
+    env: { PATH: process.env.PATH }
+  });
+  const exited: Promise<unknown[]> = once(shell, 'exit');
+  const [chunk] = (await once(shell.stdout as Readable, 'data')) as [Buffer];
+  started = identifyStarted([Number(chunk.toString().trim())]);
+  await exited;
+  const groupId: number = Number(shell.pid);
+  expect(await waitUntilAsync(() => isGone(groupId))).toBe(true);
+  return groupId;
+}
+
+linuxIt(
+  'reports a real leaderless group without the marker once, as noMarker, and signals nothing',
+  async () => {
+    const { lockfilePath } = createTestDaemonPaths();
+    const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+    const groupId: number = await startUnmarkedLeaderlessGroupAsync();
+    fs.mkdirSync(folder, { recursive: true });
+    writeOperationGroupRecord(folder, { groupId, startTime: RECORDED_START });
+    const groups: IDaemonOperationGroupLeftRunning[] = [];
+    const signalGroup: jest.Mock = jest.fn();
+    const options: IDaemonOrphanReaperOptions = {
+      ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, signalGroup, log: () => undefined },
+      graceMs: GRACE_MS,
+      onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => groups.push(group)
+    };
+    await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+    expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: groupId, reason: 'noMarker' }]);
+    expect(signalGroup).not.toHaveBeenCalled();
+    expect(fs.existsSync(folder)).toBe(false);
+    expect(started.map(({ pid }) => isAlive(pid))).toEqual([true]);
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts
new file mode 100644
index 00000000000..69db10bdcce
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts
@@ -0,0 +1,56 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_CHILD, OPERATION_GROUP, operationTree } from './OperationGroupFixture';
+import { reapLeftRunningAsync } from './OperationGroupLeftRunningFixture';
+import type { ILeftRunningReap } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+
+const ONCE: number = 1;
+const TWICE: number = 2;
+// A group whose leader has exited, and whose only member lacks the dead daemon's marker.
+const UNMARKED_LEADERLESS: IFakeGroupSpec = {
+  processes: operationTree(OPERATION_GROUP, false),
+  markers: new Map([[OPERATION_CHILD, undefined]])
+};
+
+interface ICountedReads {
+  readonly options: IDaemonOrphanReaperOptions;
+  readonly readProcessStat: jest.Mock;
+  readonly listLiveGroupMembers: jest.Mock;
+}
+
+// A fake table of UNMARKED_LEADERLESS whose reads are counted, with mayHaveMembers replaced.
+function countReads(mayHaveMembers: IDaemonProcessGroupOps['mayHaveMembers']): ICountedReads {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', ...UNMARKED_LEADERLESS });
+  const ops: IDaemonProcessGroupOps = fake.options.ops as IDaemonProcessGroupOps;
+  const readProcessStat: jest.Mock = jest.fn(ops.readProcessStat);
+  const listLiveGroupMembers: jest.Mock = jest.fn(ops.listLiveGroupMembers);
+  const counted: IDaemonProcessGroupOps = { ...ops, readProcessStat, listLiveGroupMembers, mayHaveMembers };
+  return { options: { ...fake.options, ops: counted }, readProcessStat, listLiveGroupMembers };
+}
+
+it('judges a leaderless group on what the proof read, and reads it only once', async () => {
+  const counted: ICountedReads = countReads(() => true);
+  const { outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    UNMARKED_LEADERLESS,
+    counted.options
+  );
+  expect(outcome).toBe('none');
+  expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: OPERATION_GROUP, reason: 'noMarker' }]);
+  expect(counted.readProcessStat).toHaveBeenCalledTimes(ONCE);
+  expect(counted.listLiveGroupMembers).toHaveBeenCalledTimes(ONCE);
+});
+
+it('reports no group whose processes have all been reaped since the proof read it', async () => {
+  const mayHaveMembers: jest.Mock = jest.fn().mockReturnValueOnce(true).mockReturnValue(false);
+  const counted: ICountedReads = countReads(mayHaveMembers);
+  const { groups }: ILeftRunningReap = await reapLeftRunningAsync(UNMARKED_LEADERLESS, counted.options);
+  expect(groups).toEqual([]);
+  expect(mayHaveMembers).toHaveBeenCalledTimes(TWICE);
+  expect(counted.listLiveGroupMembers).toHaveBeenCalledTimes(ONCE);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts
new file mode 100644
index 00000000000..be7ee83542f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts
@@ -0,0 +1,74 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonOperationGroupLeftRunningReason } from '../DaemonReclaimOptions';
+
+import { OPERATION_CHILD, OPERATION_GROUP, operationTree, stat } from './OperationGroupFixture';
+import { REUSED_LEADER, reapLeftRunningAsync } from './OperationGroupLeftRunningFixture';
+import type { ILeftRunningReap } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import type { IFakeGroupSpec } from './OrphanReaperFixture';
+
+const SHELL_SESSION: number = 3000;
+const UNMARKED: ReadonlyMap<number, string | undefined> = new Map([[OPERATION_CHILD, undefined]]);
+const OPERATION: IFakeGroupSpec = { processes: operationTree(OPERATION_GROUP) };
+
+it.each<[string, IFakeGroupSpec, DaemonOperationGroupLeftRunningReason]>([
+  ['a leader with another start time', { processes: [REUSED_LEADER] }, 'leaderChanged'],
+  [
+    'a leader in another session',
+    { processes: [stat(OPERATION_GROUP, OPERATION_GROUP, SHELL_SESSION)] },
+    'leaderChanged'
+  ],
+  [
+    'a leaderless group with a member in another session',
+    { processes: [stat(OPERATION_CHILD, OPERATION_GROUP, SHELL_SESSION)] },
+    'otherSession'
+  ],
+  [
+    "a leaderless group without the daemon's marker",
+    { processes: operationTree(OPERATION_GROUP, false), markers: UNMARKED },
+    'noMarker'
+  ],
+  ["the caller's own group", { ...OPERATION, ownGroupId: OPERATION_GROUP }, 'callerGroup'],
+  ['a caller that cannot read its own group', { ...OPERATION, unknownOwnGroup: true }, 'callerGroup'],
+  ["a live process with the daemon's PID", { ...OPERATION, daemonAlive: true }, 'daemonPidInUse']
+])('reports %s as left running, and signals nothing', async (title, spec, reason) => {
+  const { fake, outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(spec);
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: OPERATION_GROUP, reason }]);
+});
+
+it.each<[string, IFakeGroupSpec, DaemonOperationGroupLeftRunningReason]>([
+  [
+    "the caller's own group, while a live process has the daemon's PID",
+    { ...OPERATION, ownGroupId: OPERATION_GROUP, daemonAlive: true },
+    'callerGroup'
+  ],
+  [
+    "a leader with another start time, while a live process has the daemon's PID",
+    { processes: [REUSED_LEADER], daemonAlive: true },
+    'daemonPidInUse'
+  ],
+  [
+    "a leaderless group with a member in another session and without the daemon's marker",
+    { processes: [stat(OPERATION_CHILD, OPERATION_GROUP, SHELL_SESSION)], markers: UNMARKED },
+    'otherSession'
+  ]
+])(
+  'reports %s by the first condition that it fails, in the order of the proof',
+  async (title, spec, reason) => {
+    const { groups }: ILeftRunningReap = await reapLeftRunningAsync(spec);
+    expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: OPERATION_GROUP, reason }]);
+  }
+);
+
+it("reports the group of the daemon's reused PID, which that PID's new process may lead", async () => {
+  const { fake, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    { processes: operationTree(DEAD_PID) },
+    { deadPidReused: true }
+  );
+  expect(fake.signals).toEqual([]);
+  expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: DEAD_PID, reason: 'daemonPidInUse' }]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts
new file mode 100644
index 00000000000..fd460e472d7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_CHILD, OPERATION_GROUP, operationTree, recordGroups, stat } from './OperationGroupFixture';
+import { REUSED_LEADER, reapLeftRunningAsync, withGroupMembers } from './OperationGroupLeftRunningFixture';
+import type { ILeftRunningReap } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const ONCE: number = 1;
+
+it.each<[string, readonly IProcessStat[]]>([
+  ['whose only members have exited', [{ ...stat(OPERATION_CHILD, OPERATION_GROUP), exited: true }]],
+  ['that has no process at all', []]
+])('reports no group %s', async (title, processes) => {
+  const { fake, outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync({ processes });
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(groups).toEqual([]);
+});
+
+it('reports a group that it stopped only to onOrphansReaped', async () => {
+  const onOrphansReaped: jest.Mock = jest.fn();
+  const { outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    { processes: operationTree(OPERATION_GROUP) },
+    { onOrphansReaped }
+  );
+  expect(outcome).toBe('terminated');
+  expect(onOrphansReaped).toHaveBeenCalledTimes(ONCE);
+  expect(groups).toEqual([]);
+});
+
+it('reads no group again without onOperationGroupLeftRunning', async () => {
+  const fake: IFakeGroup = createFakeGroup({ processes: [REUSED_LEADER] });
+  const listLiveGroupMembers: jest.Mock = jest.fn(() => []);
+  const options: IDaemonOrphanReaperOptions = withGroupMembers(fake, listLiveGroupMembers);
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(listLiveGroupMembers).not.toHaveBeenCalled();
+});
+
+it('loses only the report of a group that it cannot read again', async () => {
+  const fake: IFakeGroup = createFakeGroup({ processes: [REUSED_LEADER] });
+  const failingRead: jest.Mock = jest.fn(() => {
+    throw new Error('EACCES');
+  });
+  const { outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    { processes: [REUSED_LEADER] },
+    withGroupMembers(fake, failingRead)
+  );
+  expect(outcome).toBe('none');
+  expect(failingRead).toHaveBeenCalledTimes(ONCE);
+  expect(groups).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts
new file mode 100644
index 00000000000..98e11d53c7d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR, getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import type { StopOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { hasEnvironmentEntry } from '../DaemonProcessStat';
+
+import { identifyStarted, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const NAME: string = 'RUSHD_TEST_ENVIRONMENT_ENTRY';
+const VALUE: string = '/tmp/rushd-1000/key.pid.json.groups-4242';
+const FOREIGN_FOLDER: string = '/elsewhere.groups-4242';
+const ENTRY: string = `${NAME}=${VALUE}`;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+  delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+});
+
+function recordingFolder(): string {
+  return getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+}
+
+linuxIt('marks the processes started while it records, and removes only its own marker', () => {
+  const folder: string = recordingFolder();
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  expect(process.env[DAEMON_OPERATION_GROUPS_ENV_VAR]).toBe(folder);
+  expect(getOperationGroupsMarker(folder)).toBe(`${DAEMON_OPERATION_GROUPS_ENV_VAR}=${folder}`);
+  stop();
+  expect(process.env[DAEMON_OPERATION_GROUPS_ENV_VAR]).toBeUndefined();
+  const stopAgain: StopOperationGroupRecording = startOperationGroupRecording(recordingFolder());
+  process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = FOREIGN_FOLDER;
+  stopAgain();
+  expect(process.env[DAEMON_OPERATION_GROUPS_ENV_VAR]).toBe(FOREIGN_FOLDER);
+});
+
+linuxIt('finds only an exact entry of the environment that a process started with', async () => {
+  const child: ChildProcess = spawn(process.execPath, SLEEP_ARGS, {
+    env: { [NAME]: VALUE },
+    stdio: 'ignore'
+  });
+  await once(child, 'spawn');
+  const pid: number = Number(child.pid);
+  started = identifyStarted([pid]);
+  expect(hasEnvironmentEntry(pid, ENTRY)).toBe(true);
+  for (const entry of [`${NAME}=${FOREIGN_FOLDER}`, `${NAME}=`, NAME, `${ENTRY}/`, VALUE]) {
+    expect(hasEnvironmentEntry(pid, entry)).toBe(false);
+  }
+  child.kill('SIGKILL');
+  expect(await waitUntilAsync(() => isGone(pid))).toBe(true);
+  expect(hasEnvironmentEntry(pid, ENTRY)).toBe(false);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts
new file mode 100644
index 00000000000..435c2eb7c9c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import {
+  OPERATION_CHILD,
+  OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+type Markers = ReadonlyMap<number, string | undefined>;
+type MarkersOf = (lockfilePath: string) => Markers;
+
+interface IReap {
+  readonly outcome: string;
+  readonly fake: IFakeGroup;
+}
+
+const NEXT_PID: number = 1;
+const OTHER_DAEMON_PID: number = DEAD_PID + NEXT_PID;
+const OTHER_WORKSPACE_SUFFIX: string = '.other';
+const NO_FOLDER: string = '';
+// A group whose leader has exited, with two live members in its session.
+const LEADERLESS: readonly IProcessStat[] = [
+  ...operationTree(OPERATION_GROUP, false),
+  stat(OPERATION_CHILD + NEXT_PID, OPERATION_GROUP)
+];
+
+function unmarked(processes: readonly IProcessStat[]): Map<number, string | undefined> {
+  return new Map(processes.map((member: IProcessStat) => [member.pid, undefined]));
+}
+
+function deadDaemonMarker(lockfilePath: string): string {
+  return getOperationGroupsMarker(getOperationGroupsFolder(lockfilePath, DEAD_PID));
+}
+
+async function reapAsync(processes: readonly IProcessStat[], markersOf: MarkersOf): Promise<IReap> {
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  const fake: IFakeGroup = createFakeGroup({
+    exitsOn: 'SIGTERM',
+    processes,
+    markers: markersOf(lockfilePath)
+  });
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+  return { outcome, fake };
+}
+
+it("never signals a leaderless group none of whose members carries the dead daemon's marker", async () => {
+  const { outcome, fake } = await reapAsync(LEADERLESS, () => unmarked(LEADERLESS));
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+it.each<[string, (lockfilePath: string) => string]>([
+  [
+    'another daemon beside the same lockfile',
+    (lockfilePath: string) =>
+      getOperationGroupsMarker(getOperationGroupsFolder(lockfilePath, OTHER_DAEMON_PID))
+  ],
+  [
+    'the same daemon pid in another workspace',
+    (lockfilePath: string) => deadDaemonMarker(`${lockfilePath}${OTHER_WORKSPACE_SUFFIX}`)
+  ],
+  ['no folder at all', () => getOperationGroupsMarker(NO_FOLDER)]
+])('never signals a leaderless group whose member carries the marker of %s', async (name, markerOf) => {
+  const markersOf: MarkersOf = (lockfilePath: string) =>
+    new Map([...unmarked(LEADERLESS), [OPERATION_CHILD, markerOf(lockfilePath)]]);
+  const { outcome, fake } = await reapAsync(LEADERLESS, markersOf);
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+it("signals a leaderless group when one of its members carries the dead daemon's marker", async () => {
+  const markersOf: MarkersOf = (lockfilePath: string) =>
+    new Map([...unmarked(LEADERLESS), [OPERATION_CHILD, deadDaemonMarker(lockfilePath)]]);
+  const { outcome, fake } = await reapAsync(LEADERLESS, markersOf);
+  expect(outcome).toBe('terminated');
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+});
+
+it('still signals a group whose leader is alive with the recorded start time without any marker', async () => {
+  const tree: readonly IProcessStat[] = operationTree(OPERATION_GROUP);
+  const { outcome, fake } = await reapAsync(tree, () => unmarked(tree));
+  expect(outcome).toBe('terminated');
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts
new file mode 100644
index 00000000000..fcc4d429d46
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Readable } from 'node:stream';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { RECORDED_START } from './OperationGroupFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A detached shell leads a new session and group, starts a member in them, prints its pid and exits, which
+// leaves the group without its leader, as an operation whose shell has exited does.
+const LEADERLESS_SCRIPT: string = 'sleep 600 </dev/null >/dev/null 2>&1 & echo $!';
+const SHELL_OPTIONS: { detached: true; stdio: ['ignore', 'pipe', 'ignore'] } = {
+  detached: true,
+  stdio: ['ignore', 'pipe', 'ignore']
+};
+const GRACE_MS: number = 500;
+const OTHER_WORKSPACE_SUFFIX: string = '.other';
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface ILeaderlessGroup {
+  readonly groupId: number;
+  readonly member: number;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function startLeaderlessGroupAsync(marker: string | undefined): Promise<ILeaderlessGroup> {
+  const env: NodeJS.ProcessEnv = { PATH: process.env.PATH, [DAEMON_OPERATION_GROUPS_ENV_VAR]: marker };
+  const shell: ChildProcess = spawn('/bin/sh', ['-c', LEADERLESS_SCRIPT], { ...SHELL_OPTIONS, env });
+  const exited: Promise<unknown[]> = once(shell, 'exit');
+  const [chunk] = (await once(shell.stdout as Readable, 'data')) as [Buffer];
+  const member: number = Number(chunk.toString().trim());
+  started = identifyStarted([member]);
+  await exited;
+  const groupId: number = Number(shell.pid);
+  expect(await waitUntilAsync(() => isGone(groupId))).toBe(true);
+  return { groupId, member };
+}
+
+function deadDaemonFolder(lockfilePath: string): string {
+  return getOperationGroupsFolder(lockfilePath, DEAD_PID);
+}
+
+// Records a real leaderless group for the dead daemon, whose member has the marker `markerOf(lockfilePath)`.
+async function reapWithMarkerAsync(markerOf: (lockfilePath: string) => string | undefined): Promise<string> {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = deadDaemonFolder(lockfilePath);
+  const { groupId, member } = await startLeaderlessGroupAsync(markerOf(lockfilePath));
+  expect(isAlive(member)).toBe(true);
+  fs.mkdirSync(folder, { recursive: true });
+  writeOperationGroupRecord(folder, { groupId, startTime: RECORDED_START });
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, OPTIONS);
+  expect(fs.existsSync(folder)).toBe(false);
+  return outcome;
+}
+
+linuxIt('never signals a real leaderless group whose live member has no marker', async () => {
+  await expect(reapWithMarkerAsync(() => undefined)).resolves.toBe('none');
+  expect(started.map(({ pid }) => isAlive(pid))).toEqual([true]);
+});
+
+linuxIt(
+  'never signals a real leaderless group whose live member has the marker of another workspace',
+  async () => {
+    const otherWorkspaceFolder = (lockfilePath: string): string =>
+      deadDaemonFolder(`${lockfilePath}${OTHER_WORKSPACE_SUFFIX}`);
+    await expect(reapWithMarkerAsync(otherWorkspaceFolder)).resolves.toBe('none');
+    expect(started.map(({ pid }) => isAlive(pid))).toEqual([true]);
+  }
+);
+
+linuxIt("signals a real leaderless group whose live member has the dead daemon's marker", async () => {
+  await expect(reapWithMarkerAsync(deadDaemonFolder)).resolves.toBe('terminated');
+  expect(await waitUntilAsync(() => !started.some(({ pid }) => isAlive(pid)))).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
new file mode 100644
index 00000000000..dfc7c840d16
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
@@ -0,0 +1,89 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import {
+  killFakeDaemonAsync,
+  startFakeDaemonAsync,
+  writeDeadOwnerLockfile
+} from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Above the worst case of two 5 s polls plus the reaper's SIGTERM and SIGKILL grace periods, so that a
+// regression fails an assertion instead of timing out.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+
+function recordedGroupIds(folder: string): Set<number> {
+  return new Set(readOperationGroupRecords(folder).map((record: IOperationGroupRecord) => record.groupId));
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  // A failed assertion must not leave this test's processes running.
+  killStillRunning(started);
+  started = [];
+  jest.restoreAllMocks();
+});
+
+async function reapsOrphanedOperationGroupsAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  const folder: string = getOperationGroupsFolder(paths.lockfilePath, Number(fake.daemon.pid));
+  expect(recordedGroupIds(folder)).toEqual(new Set([waitingLeader, exitingLeader]));
+  await killFakeDaemonAsync(fake);
+  // Reaped, not merely a zombie, so reclaim finds a group without its leader.
+  expect(await waitUntilAsync(() => isGone(exitingLeader))).toBe(true);
+  writeDeadOwnerLockfile(paths, fake);
+  await reclaimStaleDaemonAsync(paths);
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+  expect(readOperationGroupRecords(folder)).toEqual([]);
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${waitingLeader}`), expect.anything());
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${exitingLeader}`), expect.anything());
+}
+
+posixIt(
+  'reaps detached operation groups orphaned by a SIGKILLed daemon, with or without their leader',
+  reapsOrphanedOperationGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
+
+async function reportsReapedOperationGroupsAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  await killFakeDaemonAsync(fake);
+  expect(await waitUntilAsync(() => isGone(exitingLeader))).toBe(true);
+  writeDeadOwnerLockfile(paths, fake);
+  const reaps: IDaemonOrphanReap[] = [];
+  await reclaimStaleDaemonAsync(paths, { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) });
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+  const operations: IDaemonOrphanReap[] = reaps.filter((reap: IDaemonOrphanReap) =>
+    reap.processGroupIds.includes(waitingLeader)
+  );
+  expect(operations).toEqual([
+    { daemonPid: Number(fake.daemon.pid), processGroupIds: expect.any(Array), outcome: 'terminated' }
+  ]);
+  const [{ processGroupIds }] = operations;
+  expect(new Set(processGroupIds)).toEqual(new Set([waitingLeader, exitingLeader]));
+  expect(warning).not.toHaveBeenCalled();
+}
+
+posixIt(
+  'reports the reaped operation groups to onOrphansReaped instead of logging them',
+  reportsReapedOperationGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts
new file mode 100644
index 00000000000..c95576977d9
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts
@@ -0,0 +1,94 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// The fake daemon records with the real recorder, except that writing a record writes the child's pid to a file
+// and SIGKILLs the daemon instead. So it dies after Node has started its detached operation, before the operation
+// has a record: whatever the recorder leaves in its folder then is all that a successor finds.
+const DYING_DAEMON_SCRIPT: string = `
+const [recorder, groups, lockfile, pidFile] = process.argv.slice(1);
+const groupsModule = require(groups);
+groupsModule.writeOperationGroupRecord = (folder, record) => {
+  require('node:fs').writeFileSync(pidFile, String(record.groupId));
+  process.kill(process.pid, 'SIGKILL');
+};
+require(recorder).startOperationGroupRecording(groupsModule.getOperationGroupsFolder(lockfile, process.pid));
+require('node:child_process').spawn('sleep', ['30'], { detached: true, stdio: 'ignore' });`;
+const PID_FILE_SUFFIX: string = '.sleeper';
+const UTF8: BufferEncoding = 'utf8';
+const GRACE_MS: number = 500;
+// Enough for the 5 s wait for the sleeper to be gone, so a failure shows what the reap did.
+const TEST_TIMEOUT_MS: number = 15000;
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface IDeadDaemon {
+  readonly daemonPid: number;
+  readonly signal: NodeJS.Signals | null;
+  readonly sleeper: number;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function runDyingDaemonAsync(lockfilePath: string): Promise<IDeadDaemon> {
+  const pidFile: string = `${lockfilePath}${PID_FILE_SUFFIX}`;
+  const modules: string[] = ['DaemonOperationGroupRecorder', 'DaemonOperationGroups'].map((name: string) =>
+    path.join(__dirname, '..', `${name}.js`)
+  );
+  const args: string[] = ['-e', DYING_DAEMON_SCRIPT, ...modules, lockfilePath, pidFile];
+  const daemon: ChildProcess = spawn(process.execPath, args, { stdio: 'ignore' });
+  const [, signal] = (await once(daemon, 'exit')) as [number | null, NodeJS.Signals | null];
+  const sleeper: number = Number(fs.readFileSync(pidFile, UTF8));
+  fs.rmSync(pidFile);
+  started = identifyStarted([sleeper]);
+  return { daemonPid: Number(daemon.pid), signal, sleeper };
+}
+
+linuxIt(
+  'reaps a detached operation whose daemon died after starting it, before recording it',
+  async () => {
+    const { lockfilePath } = createTestDaemonPaths();
+    const { daemonPid, signal, sleeper } = await runDyingDaemonAsync(lockfilePath);
+    const folder: string = getOperationGroupsFolder(lockfilePath, daemonPid);
+    const entries: string[] = fs.existsSync(folder) ? fs.readdirSync(folder) : [];
+    const reaped: (readonly number[])[] = [];
+    const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+      reaped.push(reap.processGroupIds);
+    };
+    const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, daemonPid, {
+      ...OPTIONS,
+      onOrphansReaped
+    });
+    const gone: boolean = await waitUntilAsync(() => !isAlive(sleeper));
+    expect({ signal, entries, outcome, reaped, gone }).toEqual({
+      signal: 'SIGKILL',
+      entries: [expect.stringMatching(/^spawn-\d+$/)],
+      outcome: 'terminated',
+      reaped: [[sleeper]],
+      gone: true
+    });
+  },
+  TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts
new file mode 100644
index 00000000000..cb93a459c64
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts
@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import * as diagnosticsChannel from 'node:diagnostics_channel';
+import { EventEmitter, once } from 'node:events';
+
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import type { StopOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import {
+  getOperationGroupsFolder,
+  readFolderNames,
+  readOperationGroupRecords
+} from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const CHILD_PROCESS_CHANNEL: string = 'child_process';
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const MISSING_COMMAND: string = '/nonexistent/rushd-spawn-test';
+const ERROR_FIELDS: string[] = ['message', 'code', 'errno', 'syscall', 'path', 'spawnargs'];
+
+interface IFailedSpawn {
+  readonly entries: string[];
+  readonly pid: number | undefined;
+  readonly error: Record<string, unknown>;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+function createFolder(): string {
+  return getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+}
+
+linuxIt("records a published child without a spawn method on its 'spawn' event", async () => {
+  // Started before the recording, so only the published stand-in below can record it.
+  const sleeper: ChildProcess = spawn(process.execPath, SLEEP_ARGS, { detached: true, stdio: 'ignore' });
+  await once(sleeper, 'spawn');
+  const pid: number = Number(sleeper.pid);
+  started = identifyStarted([pid]);
+  const folder: string = createFolder();
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  const standIn: EventEmitter & { pid: number } = Object.assign(new EventEmitter(), { pid });
+  diagnosticsChannel.channel(CHILD_PROCESS_CHANNEL).publish({ process: standIn });
+  const beforeSpawnEvent: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  standIn.emit('spawn');
+  const afterSpawnEvent: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  stop();
+  const record: IOperationGroupRecord = { groupId: pid, startTime: String(readProcessStat(pid)?.startTime) };
+  expect({ beforeSpawnEvent, afterSpawnEvent }).toEqual({ beforeSpawnEvent: [], afterSpawnEvent: [record] });
+});
+
+// A detached spawn of a missing command: the entries in `folder` right after it, and its 'error' event.
+async function spawnMissingAsync(folder: string): Promise<IFailedSpawn> {
+  const child: ChildProcess = spawn(MISSING_COMMAND, [], { detached: true, stdio: 'ignore' });
+  const entries: string[] = readFolderNames(folder);
+  const [error] = (await once(child, 'error')) as [NodeJS.ErrnoException & Record<string, unknown>];
+  const reported: Record<string, unknown> = Object.fromEntries(
+    ERROR_FIELDS.map((field: string) => [field, error[field]])
+  );
+  return { entries, pid: child.pid, error: reported };
+}
+
+linuxIt(
+  "emits the same 'error' as without recording when a detached spawn fails, with no mark or record",
+  async () => {
+    const unrecorded: IFailedSpawn = await spawnMissingAsync(createFolder());
+    const folder: string = createFolder();
+    const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+    const recorded: IFailedSpawn = await spawnMissingAsync(folder);
+    const entriesAfterError: string[] = readFolderNames(folder);
+    stop();
+    expect(unrecorded.error.code).toBe('ENOENT');
+    expect({ recorded, entriesAfterError }).toEqual({ recorded: unrecorded, entriesAfterError: [] });
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts
new file mode 100644
index 00000000000..1e9a03a7a58
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts
@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { once } from 'node:events';
+import type { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+
+import { SPAWNED, spawnStandIn } from './SpawnStandInFixture';
+import type { IStandInRun } from './SpawnStandInFixture';
+import { createRecordFolder, expectedSteps, stepsOf } from './SpawnStandInSteps';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// What Node's ChildProcess spawn method returns for a command that isn't found, which it reports on 'error'.
+const UV_ENOENT: number = -2;
+const PROC_UPTIME: string = '/proc/uptime';
+const EMPTY_FILE: string = '';
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+function failUptimeReads(): void {
+  const { readFileSync } = fs;
+  jest.spyOn(fs, 'readFileSync').mockImplementation(((...args: Parameters<typeof readFileSync>) => {
+    const [file] = args;
+    if (file === PROC_UPTIME) throw Object.assign(new Error(`EACCES: ${PROC_UPTIME}`), { code: 'EACCES' });
+    return readFileSync(...args);
+  }) as typeof readFileSync);
+}
+
+linuxIt(
+  'returns what the real spawn returns, and runs it once, between writing a mark and removing it',
+  () => {
+    const run: IStandInRun = spawnStandIn({ folder: createRecordFolder() });
+    expect(run.returned).toBe(SPAWNED);
+    expect(stepsOf(run)).toEqual(expectedSteps());
+  }
+);
+
+linuxIt('runs the real spawn once, and records the child, when no spawn mark can be written', () => {
+  // A file where the record folder belongs, so the mark's folder can't be created.
+  const folder: string = createRecordFolder();
+  fs.writeFileSync(folder, EMPTY_FILE);
+  expect(stepsOf(spawnStandIn({ folder }))).toEqual(expectedSteps({ marksInSpawn: [] }));
+});
+
+linuxIt(
+  'runs the real spawn once, and records the child without a mark, when /proc/uptime cannot be read',
+  () => {
+    failUptimeReads();
+    const run: IStandInRun = spawnStandIn({ folder: createRecordFolder() });
+    expect(stepsOf(run)).toEqual(expectedSteps({ marksInSpawn: [] }));
+  }
+);
+
+linuxIt('returns the child and removes the spawn mark when recording the child throws', () => {
+  const record = (): void => {
+    throw new Error('The record could not be written');
+  };
+  expect(stepsOf(spawnStandIn({ folder: createRecordFolder(), record }))).toEqual(expectedSteps());
+});
+
+linuxIt(
+  "returns a spawn's ENOENT as the real spawn does, which reports it on 'error', and leaves no mark",
+  async () => {
+    const error: Error = Object.assign(new Error('spawn /nonexistent/command ENOENT'), { code: 'ENOENT' });
+    const spawn = (child: EventEmitter): unknown => {
+      process.nextTick(() => child.emit('error', error));
+      return UV_ENOENT;
+    };
+    const run: IStandInRun = spawnStandIn({ folder: createRecordFolder(), spawn });
+    const [emitted] = (await once(run.child, 'error')) as [unknown];
+    expect(emitted).toBe(error);
+    expect(stepsOf(run)).toEqual(expectedSteps({ returned: UV_ENOENT }));
+  }
+);
+
+linuxIt('throws what the real spawn throws, without recording the child, and leaves no mark', () => {
+  const error: Error = new Error('spawn EINVAL');
+  const spawn = (): unknown => {
+    throw error;
+  };
+  const run: IStandInRun = spawnStandIn({ folder: createRecordFolder(), spawn });
+  expect(run.thrown).toBe(error);
+  expect(stepsOf(run)).toEqual(expectedSteps({ returned: undefined, thrown: error, recordCalls: 0 }));
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts
new file mode 100644
index 00000000000..6ab13024386
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { DEAD_PID } from './OrphanReaperFixture';
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const PROC_UPTIME: string = '/proc/uptime';
+const UTF8: BufferEncoding = 'utf8';
+const DECIMAL_POINT: string = '.';
+const FRACTION_START: number = 0;
+const HUNDREDTHS_DIGITS: number = 2;
+const TICKS_PER_SECOND: number = 100;
+// Twice the 1 s after a mark in which a reap considers a process as started by the marked spawn.
+const LONG_BEFORE_TICKS: number = 200;
+const NO_TICKS: number = 0;
+const GRACE_MS: number = 500;
+// Enough for the 5 s wait for the sleeper to be gone, so a failure shows what the reap did.
+const TEST_TIMEOUT_MS: number = 15000;
+const SLEEP_SECONDS: string = '30';
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface IMarkedReap {
+  readonly sleeper: number;
+  readonly outcome: string;
+  readonly reaped: (readonly number[])[];
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+// The clock ticks since boot, read with this test's own parser.
+function readTicks(): number {
+  const [seconds, fraction] = fs.readFileSync(PROC_UPTIME, UTF8).split(DECIMAL_POINT);
+  return Number(seconds) * TICKS_PER_SECOND + Number(fraction.slice(FRACTION_START, HUNDREDTHS_DIGITS));
+}
+
+async function spawnMarkedSleeperAsync(folder: string): Promise<number> {
+  const env: NodeJS.ProcessEnv = { PATH: process.env.PATH, [DAEMON_OPERATION_GROUPS_ENV_VAR]: folder };
+  const sleeper: ChildProcess = spawn('sleep', [SLEEP_SECONDS], { detached: true, stdio: 'ignore', env });
+  await once(sleeper, 'spawn');
+  started = identifyStarted([Number(sleeper.pid)]);
+  return Number(sleeper.pid);
+}
+
+// Marks a spawn `ticksBefore` ticks ago in the dead daemon's folder, starts a detached sleeper with the daemon's
+// marker and no record, and reaps.
+async function reapAfterMarkAsync(ticksBefore: number): Promise<IMarkedReap> {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(path.join(folder, `spawn-${readTicks() - ticksBefore}`), '');
+  const sleeper: number = await spawnMarkedSleeperAsync(folder);
+  const reaped: (readonly number[])[] = [];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+    reaped.push(reap.processGroupIds);
+  };
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, {
+    ...OPTIONS,
+    onOrphansReaped
+  });
+  expect(fs.existsSync(folder)).toBe(false);
+  return { sleeper, outcome, reaped };
+}
+
+linuxIt('reaps an unrecorded detached process with the marker that started just after a spawn mark', async () => {
+  const { sleeper, outcome, reaped } = await reapAfterMarkAsync(NO_TICKS);
+  const gone: boolean = await waitUntilAsync(() => !isAlive(sleeper));
+  expect({ outcome, reaped, gone }).toEqual({ outcome: 'terminated', reaped: [[sleeper]], gone: true });
+}, TEST_TIMEOUT_MS);
+
+linuxIt('never signals a process with the marker that started over 1 s after the spawn mark', async () => {
+  const { sleeper, outcome, reaped } = await reapAfterMarkAsync(LONG_BEFORE_TICKS);
+  expect({ outcome, reaped, alive: isAlive(sleeper) }).toEqual({ outcome: 'none', reaped: [], alive: true });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts
new file mode 100644
index 00000000000..421471b5dda
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { readSpawnMarks, readUptimeTicks, withSpawnMark } from '../DaemonOperationGroupSpawnMark';
+
+// These tests start no process. A callback stands in for the spawn, and it only reads or changes the folder.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const DETACHED: boolean = true;
+const NOT_DETACHED: boolean = false;
+const FIRST_INDEX: number = 0;
+const TEMP_PREFIX: string = 'rushd-spawn-mark-';
+const MARK_FOLDER: string = 'groups';
+const MARK_PREFIX: string = 'spawn-';
+const EMPTY_FILE: string = '';
+const RETURNED: string = 'returned';
+
+const createdFolders: string[] = [];
+
+afterEach(() => {
+  for (const folder of createdFolders.splice(FIRST_INDEX)) {
+    fs.rmSync(folder, { recursive: true, force: true });
+  }
+});
+
+// A new mark folder, which doesn't exist yet: the mark's writer creates it, as it does a daemon's record folder.
+function createMarkFolder(): string {
+  const temp: string = fs.mkdtempSync(path.join(os.tmpdir(), TEMP_PREFIX));
+  createdFolders.push(temp);
+  return path.join(temp, MARK_FOLDER);
+}
+
+linuxIt('marks a detached spawn with the clock tick it began at, and only while it runs', () => {
+  const folder: string = createMarkFolder();
+  const before: number = readUptimeTicks();
+  const marks: number[] = withSpawnMark(folder, DETACHED, () => readSpawnMarks(folder));
+  const after: number = readUptimeTicks();
+  expect(marks).toEqual([expect.any(Number)]);
+  const [mark] = marks;
+  expect({ notBefore: mark >= before, notAfter: mark <= after }).toEqual({ notBefore: true, notAfter: true });
+  expect(readSpawnMarks(folder)).toEqual([]);
+});
+
+linuxIt('marks nothing for a spawn that is not detached', () => {
+  const folder: string = createMarkFolder();
+  expect(withSpawnMark(folder, NOT_DETACHED, () => readSpawnMarks(folder))).toEqual([]);
+});
+
+linuxIt('removes the mark when the spawn throws, and throws what it threw', () => {
+  const folder: string = createMarkFolder();
+  const error: Error = new Error('spawn EINVAL');
+  const marksInSpawn: number[][] = [];
+  const throwing = (): never => {
+    marksInSpawn.push(readSpawnMarks(folder));
+    throw error;
+  };
+  expect(() => withSpawnMark(folder, DETACHED, throwing)).toThrow(error);
+  expect({ marksInSpawn, marksAfter: readSpawnMarks(folder) }).toEqual({
+    marksInSpawn: [[expect.any(Number)]],
+    marksAfter: []
+  });
+});
+
+linuxIt('runs the spawn and returns what it returns when no mark can be written', () => {
+  // A file where the mark folder belongs, so the folder can't be created.
+  const folder: string = createMarkFolder();
+  fs.writeFileSync(folder, EMPTY_FILE);
+  expect(withSpawnMark(folder, DETACHED, () => RETURNED)).toBe(RETURNED);
+});
+
+linuxIt('returns what the spawn returns when its mark cannot be removed', () => {
+  const folder: string = createMarkFolder();
+  // Puts a folder where the mark file was, so removing the mark fails.
+  const replaceMark = (): string => {
+    const [mark] = readSpawnMarks(folder);
+    const markPath: string = path.join(folder, `${MARK_PREFIX}${mark}`);
+    fs.rmSync(markPath);
+    fs.mkdirSync(markPath);
+    return RETURNED;
+  };
+  expect(withSpawnMark(folder, DETACHED, replaceMark)).toBe(RETURNED);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts
new file mode 100644
index 00000000000..9cb21476aac
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { ChildProcess, spawn } from 'node:child_process';
+import type { SpawnOptions } from 'node:child_process';
+import fs from 'node:fs';
+import * as path from 'node:path';
+
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder, readFolderNames } from '../DaemonOperationGroups';
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const MARK_PREFIX: string = 'spawn-';
+const MARK_PATTERN: RegExp = /^write spawn-(\d+)$/;
+const TICKS_MATCH: number = 1;
+const SPAWN_WINDOW_TICKS: number = 100;
+
+type SpawnMethod = (this: ChildProcess, options: unknown) => unknown;
+
+interface ISpawnTrace {
+  readonly child: ChildProcess;
+  /** The steps traced until `spawn()` returned. */
+  readonly steps: string[];
+  /** The spawn marks in the record folder when `spawn()` returned. */
+  readonly marksLeft: string[];
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+  jest.restoreAllMocks();
+});
+
+// Traces the writes and removals of entries in `folder`, and every call of the ChildProcess spawn method.
+function traceSpawnSteps(folder: string): string[] {
+  const steps: string[] = [];
+  const trace = (verb: string, file: unknown): void => {
+    if (String(file).startsWith(folder)) steps.push(`${verb} ${path.basename(String(file))}`);
+  };
+  const { writeFileSync, rmSync } = fs;
+  jest.spyOn(fs, 'writeFileSync').mockImplementation((...args: Parameters<typeof writeFileSync>) => {
+    const [file] = args;
+    trace('write', file);
+    writeFileSync(...args);
+  });
+  jest.spyOn(fs, 'rmSync').mockImplementation((...args: Parameters<typeof rmSync>) => {
+    const [file] = args;
+    trace('remove', file);
+    rmSync(...args);
+  });
+  const prototype: { spawn: SpawnMethod } = ChildProcess.prototype as unknown as { spawn: SpawnMethod };
+  const spawnMethod: SpawnMethod = prototype.spawn;
+  jest.spyOn(prototype, 'spawn').mockImplementation(function (this: ChildProcess, options: unknown) {
+    steps.push('spawn');
+    return spawnMethod.call(this, options);
+  });
+  return steps;
+}
+
+// Spawns a sleeper while recording in a new folder.
+function spawnTraced(options: SpawnOptions): ISpawnTrace {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  const stop: () => void = startOperationGroupRecording(folder);
+  const steps: string[] = traceSpawnSteps(folder);
+  const child: ChildProcess = spawn(process.execPath, SLEEP_ARGS, options);
+  const traced: string[] = [...steps];
+  started = identifyStarted([Number(child.pid)]);
+  const marksLeft: string[] = readFolderNames(folder).filter((name: string) => name.startsWith(MARK_PREFIX));
+  stop();
+  return { child, steps: traced, marksLeft };
+}
+
+linuxIt('marks a detached spawn before it starts, and unmarks it only after the child is recorded', () => {
+  const { child, steps, marksLeft }: ISpawnTrace = spawnTraced({ detached: true, stdio: 'ignore' });
+  const start: number = Number(readProcessStat(Number(child.pid))?.startTime);
+  const [firstStep] = steps;
+  const mark: number = Number(MARK_PATTERN.exec(firstStep)?.[TICKS_MATCH]);
+  const window: boolean[] = [mark <= start, start - mark <= SPAWN_WINDOW_TICKS];
+  expect({ steps, marksLeft, window }).toEqual({
+    steps: [`write ${MARK_PREFIX}${mark}`, 'spawn', `write ${child.pid}-${start}`, `remove ${MARK_PREFIX}${mark}`],
+    marksLeft: [],
+    window: [true, true]
+  });
+});
+
+linuxIt('writes no spawn mark for a child that stays in the daemon group', () => {
+  const { steps, marksLeft }: ISpawnTrace = spawnTraced({ stdio: 'ignore' });
+  expect({ steps, marksLeft }).toEqual({ steps: ['spawn'], marksLeft: [] });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts
new file mode 100644
index 00000000000..f491902af8e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// The fake daemon records, starts an operation the way Rush does (`detached: true`), writes its pid, and
+// SIGKILLs itself in the same synchronous block, before Node can emit the child's 'spawn' event.
+const DYING_DAEMON_SCRIPT: string = `
+const [recorder, groups, lockfile, pidFile] = process.argv.slice(1);
+require(recorder).startOperationGroupRecording(require(groups).getOperationGroupsFolder(lockfile, process.pid));
+const child = require('node:child_process').spawn('sleep', ['30'], { detached: true, stdio: 'ignore' });
+require('node:fs').writeFileSync(pidFile, String(child.pid));
+process.kill(process.pid, 'SIGKILL');`;
+const PID_FILE_SUFFIX: string = '.sleeper';
+const UTF8: BufferEncoding = 'utf8';
+const GRACE_MS: number = 500;
+// Enough for the 5 s wait for the sleeper to be gone, so a failure shows what the reap did.
+const TEST_TIMEOUT_MS: number = 15000;
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface IDeadDaemon {
+  readonly daemonPid: number;
+  readonly sleeper: number;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function runDyingDaemonAsync(lockfilePath: string): Promise<IDeadDaemon> {
+  const pidFile: string = `${lockfilePath}${PID_FILE_SUFFIX}`;
+  const modules: string[] = ['DaemonOperationGroupRecorder', 'DaemonOperationGroups'].map((name: string) =>
+    path.join(__dirname, '..', `${name}.js`)
+  );
+  const args: string[] = ['-e', DYING_DAEMON_SCRIPT, ...modules, lockfilePath, pidFile];
+  const daemon: ChildProcess = spawn(process.execPath, args, { stdio: 'ignore' });
+  await once(daemon, 'exit');
+  const sleeper: number = Number(fs.readFileSync(pidFile, UTF8));
+  fs.rmSync(pidFile);
+  started = identifyStarted([sleeper]);
+  return { daemonPid: Number(daemon.pid), sleeper };
+}
+
+function recordOf(pid: number): IOperationGroupRecord {
+  return { groupId: pid, startTime: String(readProcessStat(pid)?.startTime) };
+}
+
+linuxIt('reaps a detached operation that its daemon started in the same tick as its SIGKILL', async () => {
+  const { lockfilePath } = createTestDaemonPaths();
+  const { daemonPid, sleeper } = await runDyingDaemonAsync(lockfilePath);
+  const expected: IOperationGroupRecord = recordOf(sleeper);
+  const folder: string = getOperationGroupsFolder(lockfilePath, daemonPid);
+  const records: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, daemonPid, OPTIONS);
+  const gone: boolean = await waitUntilAsync(() => !isAlive(sleeper));
+  expect({ records, outcome, gone }).toEqual({ records: [expected], outcome: 'terminated', gone: true });
+}, TEST_TIMEOUT_MS);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts
new file mode 100644
index 00000000000..99a5e0a498b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { sweepStrandedOperationGroupsAsync } from '../DaemonOperationGroupSweep';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { OPERATION_GROUP, OTHER_OPERATION_GROUP, operationTree, stat } from './OperationGroupFixture';
+import {
+  OTHER_STRANDED_PID,
+  STRANDED_PID,
+  recordDaemonFolder,
+  recordFolder,
+  removeCreatedEntries,
+  withLivePids
+} from './OperationGroupSweepFixture';
+import { SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const LIVE_PID: number = 4303;
+const OWNER_PID: number = 4304;
+const REUSED_START: string = '999';
+const NO_OWNER: undefined = undefined;
+// Number() rounds this name to 1e20, whose folder name it is again, but no process can have that pid.
+const UNSAFE_PID_NAME: string = '100000000000000000000';
+
+afterEach(removeCreatedEntries);
+
+// OPERATION_GROUP is the operation its record names; OTHER_OPERATION_GROUP's leader is another process.
+function createFake(): IFakeGroup {
+  const reused: IProcessStat = {
+    ...stat(OTHER_OPERATION_GROUP, OTHER_OPERATION_GROUP),
+    startTime: REUSED_START
+  };
+  return createFakeGroup({ exitsOn: 'SIGTERM', processes: [...operationTree(OPERATION_GROUP), reused] });
+}
+
+function existing(folders: readonly string[]): string[] {
+  return folders.filter((folder: string) => fs.existsSync(folder));
+}
+
+it('sweeps the folders of dead daemons that no lockfile names, and signals only proven groups', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folders: string[] = [
+    recordDaemonFolder(lockfilePath, STRANDED_PID, [OPERATION_GROUP]),
+    recordDaemonFolder(lockfilePath, OTHER_STRANDED_PID, [OTHER_OPERATION_GROUP])
+  ];
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, withLivePids(fake, [SELF_PID]));
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+  expect(fake.logs).toEqual([
+    `Reclaimed dead daemon ${STRANDED_PID}: its orphaned operation process groups ` +
+      `${OPERATION_GROUP} were terminated.`
+  ]);
+  expect(existing(folders)).toEqual([]);
+});
+
+it('leaves the folders of a live pid (maybe reused), of the lockfile owner and of the caller', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folders: string[] = [LIVE_PID, OWNER_PID, SELF_PID].map((pid: number) =>
+    recordDaemonFolder(lockfilePath, pid, [OPERATION_GROUP])
+  );
+  await sweepStrandedOperationGroupsAsync(lockfilePath, OWNER_PID, withLivePids(fake, [LIVE_PID]));
+  expect(fake.signals).toEqual([]);
+  expect(existing(folders)).toEqual(folders);
+});
+
+it('leaves folders that only look like a record folder of the lockfile, or name no real pid', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folders: string[] = [
+    `${lockfilePath}.groups-0${STRANDED_PID}`,
+    `${lockfilePath}.groups-0`,
+    `${lockfilePath}.groups--${STRANDED_PID}`,
+    `${lockfilePath}.groups-${UNSAFE_PID_NAME}`,
+    `${lockfilePath}.groups-${STRANDED_PID}.old`,
+    `${lockfilePath}.old.groups-${STRANDED_PID}`
+  ].map((folder: string) => recordFolder(folder, [OPERATION_GROUP]));
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, withLivePids(fake, [SELF_PID]));
+  expect(fake.signals).toEqual([]);
+  expect(existing(folders)).toEqual(folders);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts
new file mode 100644
index 00000000000..2718780c5bb
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { RECORDED_START } from './OperationGroupFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+/** A daemon that is gone and whose record folder no lockfile names. */
+export const STRANDED_PID: number = 4301;
+/** A second such daemon. */
+export const OTHER_STRANDED_PID: number = 4302;
+const FIRST_INDEX: number = 0;
+const LINK_TARGET_SUFFIX: string = '.target';
+
+const createdEntries: string[] = [];
+
+/** Records `groupIds` in `folder`; {@link removeCreatedEntries} deletes what a test leaves. */
+export function recordFolder(folder: string, groupIds: readonly number[]): string {
+  fs.mkdirSync(folder, { recursive: true });
+  for (const groupId of groupIds) writeOperationGroupRecord(folder, { groupId, startTime: RECORDED_START });
+  createdEntries.push(folder);
+  return folder;
+}
+
+/** Records `groupIds` in the record folder of daemon `daemonPid` beside `lockfilePath`. */
+export function recordDaemonFolder(
+  lockfilePath: string,
+  daemonPid: number,
+  groupIds: readonly number[]
+): string {
+  return recordFolder(getOperationGroupsFolder(lockfilePath, daemonPid), groupIds);
+}
+
+/** Moves `entryPath` aside and puts a symbolic link to it in its place. */
+export function moveBehindLink(entryPath: string): void {
+  const target: string = `${entryPath}${LINK_TARGET_SUFFIX}`;
+  fs.renameSync(entryPath, target);
+  fs.symlinkSync(target, entryPath);
+  createdEntries.push(target);
+}
+
+/** Deletes the folders, links and link targets that the helpers above created. */
+export function removeCreatedEntries(): void {
+  for (const entry of createdEntries.splice(FIRST_INDEX)) fs.rmSync(entry, { recursive: true, force: true });
+}
+
+/** The options of `fake`, in whose process table exactly `livePids` are alive. */
+export function withLivePids(fake: IFakeGroup, livePids: readonly number[]): IDaemonOrphanReaperOptions {
+  const ops: IDaemonProcessGroupOps = {
+    ...(fake.options.ops as IDaemonProcessGroupOps),
+    isProcessAlive: (pid: number) => livePids.includes(pid)
+  };
+  return { ...fake.options, ops };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
new file mode 100644
index 00000000000..572fc7db8f3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
@@ -0,0 +1,99 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import {
+  OPERATION_GROUP,
+  OTHER_OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { DEAD_PID, SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+
+const BOTH_GROUPS: readonly number[] = [OPERATION_GROUP, OTHER_OPERATION_GROUP];
+const SWAPPER_PID: number = 0;
+const INIT_PID: number = 1;
+const UNSAFE_GROUPS: readonly number[] = [SWAPPER_PID, INIT_PID, SELF_PID];
+
+function createOperations(spec: IFakeGroupSpec): IFakeGroup {
+  return createFakeGroup({
+    ...spec,
+    processes: [...operationTree(OPERATION_GROUP), ...operationTree(OTHER_OPERATION_GROUP)]
+  });
+}
+
+it('signals every proven group together and escalates the survivors to SIGKILL', async () => {
+  const fake: IFakeGroup = createOperations({ exitsOn: 'SIGKILL' });
+  const lockfilePath: string = recordGroups(BOTH_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'killed'
+  );
+  expect(fake.signals).toEqual(['SIGTERM', 'SIGTERM', 'SIGKILL', 'SIGKILL']);
+  expect(fake.targets).toEqual([...BOTH_GROUPS, ...BOTH_GROUPS]);
+  expect(fake.logs).toEqual([
+    expect.stringContaining(`${OPERATION_GROUP}, ${OTHER_OPERATION_GROUP} were killed`)
+  ]);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+});
+
+it('reports every group it stopped to onOrphansReaped instead of logging them', async () => {
+  const fake: IFakeGroup = createOperations({ exitsOn: 'SIGTERM' });
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  const lockfilePath: string = recordGroups(BOTH_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe(
+    'terminated'
+  );
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: BOTH_GROUPS, outcome: 'terminated' }]);
+  expect(fake.logs).toEqual([]);
+});
+
+it('fails the reclaim and keeps the records when a group survives SIGKILL', async () => {
+  const fake: IFakeGroup = createOperations({});
+  const lockfilePath: string = recordGroups(BOTH_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).rejects.toThrow(
+    /survived SIGKILL/
+  );
+  expect(recordsRemain(lockfilePath)).toBe(true);
+});
+
+it.each<[string, IFakeGroupSpec, IDaemonOrphanReaperOptions]>([
+  ['the daemon is alive', { daemonAlive: true }, {}],
+  ['the caller leads the group', { ownGroupId: OPERATION_GROUP }, {}],
+  ['the caller group is unknown', { unknownOwnGroup: true }, {}],
+  ['the caller is the leader', {}, { selfPid: OPERATION_GROUP }],
+  ['on Windows', {}, { platform: 'win32' }]
+])(
+  'never signals a recorded group when %s',
+  async (name: string, spec: IFakeGroupSpec, overrides: IDaemonOrphanReaperOptions) => {
+    const fake: IFakeGroup = createOperations({ ...spec, exitsOn: 'SIGTERM' });
+    const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+    const options: IDaemonOrphanReaperOptions = { ...fake.options, ...overrides };
+    await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+    expect(fake.signals).toEqual([]);
+  }
+);
+
+it('never signals the kernel, init or the caller, even as proven leaders', async () => {
+  const leaders: IProcessStat[] = UNSAFE_GROUPS.map((groupId: number) => stat(groupId, groupId));
+  const fake: IFakeGroup = createFakeGroup({
+    ownGroupId: OPERATION_GROUP,
+    exitsOn: 'SIGTERM',
+    processes: leaders
+  });
+  const lockfilePath: string = recordGroups(UNSAFE_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'none'
+  );
+  expect(fake.signals).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts b/libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts
new file mode 100644
index 00000000000..caf5a5d3e09
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts
@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { hasEnvironmentEntry } from '../DaemonProcessStat';
+
+import { killFakeDaemonAsync, startFakeDaemonAsync } from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  // The fake daemon's operations outlive it.
+  killStillRunning(started);
+  started = [];
+});
+
+linuxIt(
+  'gives the operations of a recording daemon, and their children, the marker of its records',
+  async () => {
+    const paths: IDaemonPaths = createTestDaemonPaths();
+    const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+    const daemonPid: number = Number(fake.daemon.pid);
+    started = identifyStarted([daemonPid, ...fake.pids]);
+    const marker: string = getOperationGroupsMarker(getOperationGroupsFolder(paths.lockfilePath, daemonPid));
+    const otherMarker: string = getOperationGroupsMarker(
+      getOperationGroupsFolder(paths.lockfilePath, process.pid)
+    );
+    expect(fake.pids.map((pid: number) => hasEnvironmentEntry(pid, marker))).toEqual(
+      fake.pids.map(() => true)
+    );
+    expect(fake.pids.some((pid: number) => hasEnvironmentEntry(pid, otherMarker))).toBe(false);
+    await killFakeDaemonAsync(fake);
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
index 2e4a96a4cfc..c8c9d922ec8 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
@@ -12,6 +12,7 @@ import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import { isDaemonProcessAlive, writeDaemonLockfile } from '../DaemonLockfile';
 import type { IDaemonPaths } from '../DaemonPaths';
 import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import { createTestDaemonPaths } from './TestDaemonFixture';
 
@@ -19,10 +20,14 @@ const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
 const FIRST_ATTEMPT: number = 0;
 const POLL_ATTEMPTS: number = 100;
 const POLL_INTERVAL_MS: number = 20;
+// The operation child exits by itself after a minute, so a run where the reap fails doesn't leave it running.
+// The test waits only 2 s for the reap, so the child's own exit can't make the test pass.
+const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
 // A stand-in daemon: spawns one operation child and prints the child pid. Like a phased operation (spawned
 // without `detached`), the child inherits the daemon's process group.
 const FAKE_DAEMON_SCRIPT: string =
-  "const c=require('node:child_process').spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'});" +
+  "const c=require('node:child_process')" +
+  `.spawn(process.execPath,['-e','${OPERATION_SCRIPT}'],{stdio:'ignore'});` +
   "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
 
 interface IOrphanedGroup {
@@ -52,10 +57,8 @@ async function waitUntilDeadAsync(pid: number): Promise<boolean> {
   return false;
 }
 
-posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaiming', async () => {
-  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
-  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
-  expect(isDaemonProcessAlive(orphanPid)).toBe(true);
+/** Records `daemonPid` as the owner of new test paths. */
+function recordDeadOwner(daemonPid: number): IDaemonPaths {
   const paths: IDaemonPaths = createTestDaemonPaths();
   writeDaemonLockfile(paths.lockfilePath, {
     pid: daemonPid,
@@ -63,8 +66,27 @@ posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaim
     startedAt: new Date().toISOString(),
     socketPath: paths.socketPath
   });
-  await reclaimStaleDaemonAsync(paths);
+  return paths;
+}
+
+posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaiming', async () => {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
+  expect(isDaemonProcessAlive(orphanPid)).toBe(true);
+  await reclaimStaleDaemonAsync(recordDeadOwner(daemonPid));
   expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
   expect(warning).toHaveBeenCalledWith(expect.stringContaining(`dead daemon ${daemonPid}`), expect.anything());
   warning.mockRestore();
 });
+
+posixIt('reports what it stopped to onOrphansReaped instead of a process warning', async () => {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
+  const reaps: IDaemonOrphanReap[] = [];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): number => reaps.push(reap);
+  await reclaimStaleDaemonAsync(recordDeadOwner(daemonPid), { onOrphansReaped });
+  expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
+  expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+  expect(warning).not.toHaveBeenCalled();
+  warning.mockRestore();
+});
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
index c0e1f8bede7..8ef4a42fb66 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
@@ -1,8 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonOrphanReaperOptions } from '../DaemonOrphanReaper';
 import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { createProcessOps, hasExited, liveProcesses } from './FakeProcessTable';
+import type { IFakeProcessSpec } from './FakeProcessTable';
 
 /** The pid of the fake dead daemon, which is also its process group id. */
 export const DEAD_PID: number = 4242;
@@ -14,37 +18,62 @@ const CLOCK_START: number = 0;
 /** A fake process table recording every signal sent and every message logged. */
 export interface IFakeGroup {
   readonly signals: NodeJS.Signals[];
+  /** The group id of every signal in {@link IFakeGroup.signals}, in the same order. */
+  readonly targets: number[];
   readonly logs: string[];
   readonly options: IDaemonOrphanReaperOptions;
 }
 
 /** Describes the fake process table. */
-export interface IFakeGroupSpec {
+export interface IFakeGroupSpec extends IFakeProcessSpec {
   readonly daemonAlive?: boolean;
-  /** The signal after which the group is gone; omitted means it never exits. */
-  readonly exitsOn?: NodeJS.Signals;
   readonly ownGroupId?: number;
   readonly unknownOwnGroup?: boolean;
   readonly anyGroupExists?: boolean;
 }
 
-/** Creates a fake process table with a virtual clock. */
-export function createFakeGroup(spec: IFakeGroupSpec): IFakeGroup {
-  const signals: NodeJS.Signals[] = [];
-  const logs: string[] = [];
+interface IFakeTable extends Omit<IFakeGroup, 'options'> {
+  readonly spec: IFakeGroupSpec;
+}
+
+function isKnownGroup(table: IFakeTable, groupId: number): boolean {
+  return table.spec.anyGroupExists === true || groupId === DEAD_PID;
+}
+
+function groupExists(table: IFakeTable, groupId: number): boolean {
+  const inTable: boolean = liveProcesses(table).some((stat: IProcessStat) => stat.groupId === groupId);
+  return !hasExited(table) && (isKnownGroup(table, groupId) || inTable);
+}
+
+function createGroupOps(table: IFakeTable): IDaemonProcessGroupOps {
+  const { spec } = table;
   let clock: number = CLOCK_START;
-  const ops: IDaemonProcessGroupOps = {
+  return {
     isProcessAlive: () => spec.daemonAlive === true,
-    groupExists: (groupId: number) =>
-      (spec.anyGroupExists === true || groupId === DEAD_PID) &&
-      !signals.some((signal: NodeJS.Signals) => signal === spec.exitsOn),
-    signalGroup: (groupId: number, signal: NodeJS.Signals) => signals.push(signal),
+    groupExists: (groupId: number) => groupExists(table, groupId),
+    mayHaveMembers: (groupId: number) => groupExists(table, groupId),
+    signalGroup: (groupId: number, signal: NodeJS.Signals) => {
+      table.targets.push(groupId);
+      table.signals.push(signal);
+    },
     ownGroupId: () => (spec.unknownOwnGroup === true ? undefined : (spec.ownGroupId ?? SELF_PID)),
+    ...createProcessOps(table, DEAD_PID),
     delayAsync: async (ms: number) => {
       clock += ms;
     },
     now: () => clock,
-    log: (message: string) => logs.push(message)
+    log: (message: string) => table.logs.push(message)
+  };
+}
+
+/** Creates a fake process table with a virtual clock. */
+export function createFakeGroup(spec: IFakeGroupSpec): IFakeGroup {
+  const table: IFakeTable = { spec, signals: [], targets: [], logs: [] };
+  const options: IDaemonOrphanReaperOptions = {
+    ops: createGroupOps(table),
+    platform: 'linux',
+    selfPid: SELF_PID,
+    graceMs: GRACE_MS
   };
-  return { signals, logs, options: { ops, platform: 'linux', selfPid: SELF_PID, graceMs: GRACE_MS } };
+  return { signals: table.signals, targets: table.targets, logs: table.logs, options };
 }
diff --git a/libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts b/libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts
new file mode 100644
index 00000000000..3554a7c34f1
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { readUptimeTicks } from '../DaemonOperationGroupSpawnMark';
+import { ownGroupId } from '../DaemonOwnGroup';
+
+// The clock and own-group reads against fixed /proc text, so no test here depends on the host or its processes.
+const PROC_UPTIME: string = '/proc/uptime';
+const UPTIME: string = '12345.67 98765.43\n';
+const UPTIME_TICKS: number = 1234567;
+const PROC_SELF_STAT: string = '/proc/self/stat';
+// "<pid> (<name>) <state> <ppid> <pgrp> <session> ...", where the name may hold any text, ") " included.
+const SELF_STAT: string = '4242 (a) b (c) S 101 202 303 0 -1 4194304\n';
+const OWN_GROUP: number = 202;
+const NO_STAT: Error = Object.assign(new Error(`ENOENT: ${PROC_SELF_STAT}`), { code: 'ENOENT' });
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+// Answers reads of `file` with `content`, or throws it when it is an error, and passes every other read through.
+function fakeRead(file: string, content: string | Error): void {
+  const { readFileSync } = fs;
+  jest.spyOn(fs, 'readFileSync').mockImplementation(((
+    ...args: Parameters<typeof readFileSync>
+  ): string | Buffer => {
+    const [readPath] = args;
+    if (readPath !== file) return readFileSync(...args);
+    if (content instanceof Error) throw content;
+    return content;
+  }) as typeof readFileSync);
+}
+
+it('counts the clock in hundredths of a second', () => {
+  fakeRead(PROC_UPTIME, UPTIME);
+  expect(readUptimeTicks()).toBe(UPTIME_TICKS);
+});
+
+it('reads its own process group, not its parent, from after the last ")" of its name', () => {
+  fakeRead(PROC_SELF_STAT, SELF_STAT);
+  expect(ownGroupId()).toBe(OWN_GROUP);
+});
+
+it('reports no own process group when /proc/self/stat cannot be read', () => {
+  fakeRead(PROC_SELF_STAT, NO_STAT);
+  expect(ownGroupId()).toBeUndefined();
+});
diff --git a/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts b/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
new file mode 100644
index 00000000000..0e592e2d522
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
@@ -0,0 +1,63 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const NO_SUCH_PROCESS: string = 'ESRCH';
+const FIRST_ATTEMPT: number = 0;
+const POLL_ATTEMPTS: number = 250;
+const POLL_INTERVAL_MS: number = 20;
+
+/** `true` while `pid` runs; a zombie that has exited does not count. */
+export function isAlive(pid: number): boolean {
+  const stat: IProcessStat | undefined = readProcessStat(pid);
+  return stat !== undefined && !stat.exited;
+}
+
+/** `true` once `pid` has exited and been reaped, so `/proc` has no record of it. */
+export function isGone(pid: number): boolean {
+  return readProcessStat(pid) === undefined;
+}
+
+/** Polls `condition` for up to 5 s. */
+export async function waitUntilAsync(condition: () => boolean): Promise<boolean> {
+  for (let attempt: number = FIRST_ATTEMPT; attempt < POLL_ATTEMPTS; attempt++) {
+    if (condition()) return true;
+    await delayAsync(POLL_INTERVAL_MS);
+  }
+  return condition();
+}
+
+/** A process a test started, identified by pid and start time so that a reused pid is never signaled. */
+export interface IStartedProcess {
+  readonly pid: number;
+  readonly startTime: string | undefined;
+}
+
+/** Identifies processes a test has just started. */
+export function identifyStarted(pids: readonly number[]): IStartedProcess[] {
+  return pids.map((pid: number) => ({ pid, startTime: readProcessStat(pid)?.startTime }));
+}
+
+function isStillRunning({ pid, startTime }: IStartedProcess): boolean {
+  return startTime !== undefined && readProcessStat(pid)?.startTime === startTime;
+}
+
+function killIfPresent(pid: number): void {
+  try {
+    process.kill(pid, 'SIGKILL');
+  } catch (error) {
+    // Killing one process can end another first: an operation that reads the fake daemon's pipe exits with it.
+    if ((error as NodeJS.ErrnoException).code !== NO_SUCH_PROCESS) throw error;
+  }
+}
+
+/** SIGKILLs the started processes that are still the same processes; for test cleanup only. */
+export function killStillRunning(started: readonly IStartedProcess[]): void {
+  for (const { pid } of started.filter(isStillRunning)) {
+    killIfPresent(pid);
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts b/libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts
new file mode 100644
index 00000000000..9cc68e6d566
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import type { IDaemonLockfile } from '../DaemonLockfile';
+import { writeDaemonLockfile } from '../DaemonLockfile';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { reapOrphansOfDeadOwnerAsync } from '../DaemonOrphanReaper';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_GROUP, operationTree, recordGroups, recordsRemain } from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const NO_UID: number = 0;
+const FIRST_INDEX: number = 0;
+const EPOCH_MS: number = 0;
+const OTHER_USER_OFFSET: number = 1;
+const LINK_TARGET_SUFFIX: string = '.target';
+const OWNER: IDaemonLockfile = {
+  pid: DEAD_PID,
+  protocolVersion: DAEMON_PROTOCOL_VERSION,
+  startedAt: new Date(EPOCH_MS).toISOString(),
+  socketPath: 'unused'
+};
+
+const createdEntries: string[] = [];
+
+afterEach(() => {
+  for (const entry of createdEntries.splice(FIRST_INDEX)) fs.rmSync(entry, { recursive: true, force: true });
+});
+
+function recordOwnGroups(): string {
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  for (const entry of [lockfilePath, getOperationGroupsFolder(lockfilePath, DEAD_PID)]) {
+    createdEntries.push(entry, `${entry}${LINK_TARGET_SUFFIX}`);
+  }
+  return lockfilePath;
+}
+
+function createFake(): IFakeGroup {
+  return createFakeGroup({ exitsOn: 'SIGTERM', processes: operationTree(OPERATION_GROUP) });
+}
+
+function asAnotherUser(options: IDaemonOrphanReaperOptions): IDaemonOrphanReaperOptions {
+  return { ...options, uid: (process.getuid?.() ?? NO_UID) + OTHER_USER_OFFSET };
+}
+
+function moveBehindLink(entryPath: string): void {
+  fs.renameSync(entryPath, `${entryPath}${LINK_TARGET_SUFFIX}`);
+  fs.symlinkSync(`${entryPath}${LINK_TARGET_SUFFIX}`, entryPath);
+}
+
+function recordDeadOwner(): string {
+  const lockfilePath: string = recordOwnGroups();
+  writeDaemonLockfile(lockfilePath, OWNER);
+  return lockfilePath;
+}
+
+posixIt('never signals the groups in a record folder that is a symbolic link', async () => {
+  const fake: IFakeGroup = createFake();
+  const lockfilePath: string = recordOwnGroups();
+  moveBehindLink(getOperationGroupsFolder(lockfilePath, DEAD_PID));
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'none'
+  );
+  expect(fake.signals).toEqual([]);
+  expect(recordsRemain(lockfilePath)).toBe(true);
+});
+
+posixIt('never signals the groups in a record folder of another user', async () => {
+  const fake: IFakeGroup = createFake();
+  const lockfilePath: string = recordOwnGroups();
+  const options: IDaemonOrphanReaperOptions = asAnotherUser(fake.options);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+posixIt('never signals the owner named by a lockfile of another user, or behind a link', async () => {
+  const fake: IFakeGroup = createFake();
+  const lockfilePath: string = recordDeadOwner();
+  await reapOrphansOfDeadOwnerAsync(lockfilePath, OWNER, asAnotherUser(fake.options));
+  moveBehindLink(lockfilePath);
+  await reapOrphansOfDeadOwnerAsync(lockfilePath, OWNER, fake.options);
+  expect(fake.signals).toEqual([]);
+});
+
+it('signals the group of the owner named by a lockfile of this user', async () => {
+  const fake: IFakeGroup = createFake();
+  await reapOrphansOfDeadOwnerAsync(recordDeadOwner(), OWNER, fake.options);
+  expect(fake.targets).toEqual([DEAD_PID]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts b/libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts
new file mode 100644
index 00000000000..4226d9efe3d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts
@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { releaseAfterAsync } from '../DaemonReleaseAfter';
+
+const ONCE: number = 1;
+const STEP_ERROR: Error = new Error('the step failed');
+const RELEASE_ERROR: Error = new Error('the release failed');
+const STEP_TEXT: string = 'a step that rejects with text';
+
+function throwReleaseError(): void {
+  throw RELEASE_ERROR;
+}
+
+it('releases after a step that works', async () => {
+  const release: jest.Mock = jest.fn();
+  await releaseAfterAsync(Promise.resolve(), release);
+  expect(release).toHaveBeenCalledTimes(ONCE);
+});
+
+it('rejects with the error of the release when only the release fails', async () => {
+  await expect(releaseAfterAsync(Promise.resolve(), throwReleaseError)).rejects.toBe(RELEASE_ERROR);
+});
+
+it('releases after a step that fails, and rejects with the error of the step', async () => {
+  const release: jest.Mock = jest.fn();
+  await expect(releaseAfterAsync(Promise.reject(STEP_ERROR), release)).rejects.toBe(STEP_ERROR);
+  expect(release).toHaveBeenCalledTimes(ONCE);
+});
+
+it('rejects with both errors, in order, when the step and the release fail', async () => {
+  const releasing: Promise<void> = releaseAfterAsync(Promise.reject(STEP_ERROR), throwReleaseError);
+  await expect(releasing).rejects.toBeInstanceOf(AggregateError);
+  await expect(releasing).rejects.toMatchObject({ errors: [STEP_ERROR, RELEASE_ERROR] });
+  await expect(releasing).rejects.toThrow(`${STEP_ERROR.message}. Then: ${RELEASE_ERROR.message}`);
+});
+
+it('names a failure that is not an Error by its text', async () => {
+  const releasing: Promise<void> = releaseAfterAsync(Promise.reject(STEP_TEXT), throwReleaseError);
+  await expect(releasing).rejects.toThrow(`${STEP_TEXT}. Then: ${RELEASE_ERROR.message}`);
+});
diff --git a/libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts b/libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts
new file mode 100644
index 00000000000..2a2376fae3f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts
@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IChildOutcome } from './LinkedPackageFixture';
+import {
+  createLinkedPackageFolder,
+  removeLinkedPackageFolder,
+  runThenRequireLinkedPackage
+} from './LinkedPackageFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+
+/** What meets the socket, its module, JavaScript that calls it (see the fixture), and what the child prints. */
+type SocketCase = readonly [string, string, string, string];
+
+const SOCKET_CASES: readonly SocketCase[] = [
+  ['readFileIdentity', 'DaemonFileIdentity', 'out(typeof target.readFileIdentity(socketPath).ino);', 'number found'],
+  [
+    'removeOwnFile',
+    'DaemonFileIdentity',
+    'target.removeOwnFile(socketPath, target.readFileIdentity(socketPath)); out(fs.existsSync(socketPath));',
+    'false found'
+  ],
+  [
+    'listenPublishedAsync',
+    'DaemonSocketPublication',
+    'const published = net.createServer();' +
+      ' out(typeof (await target.listenPublishedAsync(published, { socketPath: publishedPath })).ino);' +
+      ' published.close();',
+    'number found'
+  ],
+  [
+    'verifyRuntimeFolder',
+    'DaemonRuntimeFolderCheck',
+    'try { target.verifyRuntimeFolder(socketPath, process.getuid()); } catch (error) { out(error.code); }',
+    'unsafeRuntimeDirectory found'
+  ]
+];
+
+// A plain stat of a socket leaves its type in the stat array that Node 22's cached realpath reads
+// (nodejs/node#65113). Jest resolves modules itself, so a Node process of its own makes each call and then requires
+// a package through a symbolic link, as pnpm installs them.
+posixIt.each(SOCKET_CASES)(
+  'leaves require() resolving symbolic links after %s meets a socket',
+  (name: string, moduleName: string, call: string, expected: string) => {
+    const folder: string = createLinkedPackageFolder();
+    try {
+      const outcome: IChildOutcome = runThenRequireLinkedPackage(folder, require.resolve(`../${moduleName}`), call);
+      expect(outcome).toEqual({ status: 0, stdout: expected, stderr: '' });
+    } finally {
+      removeLinkedPackageFolder(folder);
+    }
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts b/libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts
new file mode 100644
index 00000000000..bc23b4833bd
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts
@@ -0,0 +1,75 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from '../DaemonPaths';
+import type { IProcessStat } from '../DaemonProcessStat';
+import { tryAcquireReclaimLock } from '../DaemonReclaimLock';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+import { reapReusedOwnerOperationGroupsAsync } from '../DaemonReusedOwnerReap';
+import { ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { OPERATION_GROUP, OTHER_OPERATION_GROUP, operationTree, stat } from './OperationGroupFixture';
+import { recordDaemonFolder, removeCreatedEntries } from './OperationGroupSweepFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const REUSED_START: string = '999';
+const RECORDED_GROUPS: readonly number[] = [OPERATION_GROUP, OTHER_OPERATION_GROUP, DEAD_PID];
+
+afterEach(removeCreatedEntries);
+
+interface IReusedOwner {
+  readonly paths: IDaemonPaths;
+  readonly fake: IFakeGroup;
+  /** The record folder of the owner. */
+  readonly folder: string;
+}
+
+// A process that started after the daemon's lockfile was written has the daemon's pid, so the fake reports
+// every pid alive. It leads group DEAD_PID with the start time recorded for that group, so only the rule for
+// the owner's own group keeps it from being signaled. OTHER_OPERATION_GROUP's leader has another start time.
+function recordReusedOwner(): IReusedOwner {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  ensureDaemonRuntimeDir(paths);
+  const otherLeader: IProcessStat = {
+    ...stat(OTHER_OPERATION_GROUP, OTHER_OPERATION_GROUP),
+    startTime: REUSED_START
+  };
+  const fake: IFakeGroup = createFakeGroup({
+    daemonAlive: true,
+    exitsOn: 'SIGTERM',
+    processes: [...operationTree(OPERATION_GROUP), otherLeader, stat(DEAD_PID, DEAD_PID)]
+  });
+  return { paths, fake, folder: recordDaemonFolder(paths.lockfilePath, DEAD_PID, RECORDED_GROUPS) };
+}
+
+it('stops only the proven groups of an owner whose pid a later process has, never that process', async () => {
+  const { paths, fake, folder } = recordReusedOwner();
+  const reaps: IDaemonOrphanReap[] = [];
+  await reapReusedOwnerOperationGroupsAsync(paths, DEAD_PID, {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  });
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [OPERATION_GROUP], outcome: 'terminated' }]);
+  expect(fs.existsSync(folder)).toBe(false);
+});
+
+it('signals nothing and keeps the records while another process holds the reclaim lock', async () => {
+  const { paths, fake, folder } = recordReusedOwner();
+  const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+  expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+  try {
+    await expect(reapReusedOwnerOperationGroupsAsync(paths, DEAD_PID, fake.options)).rejects.toMatchObject({
+      code: DaemonTransportErrorCode.daemonAlreadyRunning
+    });
+  } finally {
+    fs.unlinkSync(reclaimLockPath);
+  }
+  expect(fake.signals).toEqual([]);
+  expect(fs.existsSync(folder)).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts b/libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts
new file mode 100644
index 00000000000..a0f65eb3493
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { verifyRuntimeFolder } from '../DaemonRuntimeFolderCheck';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// Windows has no runtime folder: its named pipes live in the kernel's pipe namespace.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const PRIVATE_MODE: number = 0o700;
+const OPEN_MODE: number = 0o755;
+const PERMISSION_MODULUS: number = 0o1000;
+const NO_UID: number = 0;
+const OTHER_USER_OFFSET: number = 1;
+const LINK_TARGET_SUFFIX: string = '.target';
+
+type Planter = (folder: string) => void;
+
+const PLANTERS: readonly [string, Planter][] = [
+  [
+    'it is a symbolic link',
+    (folder: string) => {
+      fs.mkdirSync(`${folder}${LINK_TARGET_SUFFIX}`, { mode: PRIVATE_MODE });
+      fs.symlinkSync(`${folder}${LINK_TARGET_SUFFIX}`, folder);
+    }
+  ],
+  ['it is not a directory', (folder: string) => fs.writeFileSync(folder, '')]
+];
+
+function getMode(folder: string): number {
+  return fs.statSync(folder).mode % PERMISSION_MODULUS;
+}
+
+function getOtherUid(): number {
+  return (process.getuid?.() ?? NO_UID) + OTHER_USER_OFFSET;
+}
+
+function captureError(action: () => void): unknown {
+  try {
+    action();
+  } catch (error) {
+    return error;
+  }
+}
+
+posixIt('creates the runtime folder owner-only, and tightens one that others can enter', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const folder: string = paths.runtimeDir ?? '';
+  ensureDaemonRuntimeDir(paths);
+  expect(getMode(folder)).toBe(PRIVATE_MODE);
+  fs.chmodSync(folder, OPEN_MODE);
+  assertDaemonRuntimeDirIsPrivate(paths);
+  expect(getMode(folder)).toBe(PRIVATE_MODE);
+  removeIsolatedBase(paths);
+});
+
+posixIt.each(PLANTERS)('refuses a runtime folder when %s', async (reason: string, plant: Planter) => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  plant(paths.runtimeDir ?? '');
+  const expected: object = {
+    code: DaemonTransportErrorCode.unsafeRuntimeDirectory,
+    message: expect.stringContaining(reason)
+  };
+  const error: unknown = captureError(() => assertDaemonRuntimeDirIsPrivate(paths));
+  expect(error).toMatchObject(expected);
+  expect((error as Error).message).toContain(DAEMON_RUNTIME_DIR_ENV_VAR);
+  expect(captureError(() => ensureDaemonRuntimeDir(paths))).toMatchObject(expected);
+  await expect(reclaimStaleDaemonAsync(paths)).rejects.toMatchObject(expected);
+  const listening: Promise<DaemonFrameListener> = DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  await expect(listening).rejects.toMatchObject(expected);
+  removeIsolatedBase(paths);
+});
+
+posixIt('refuses a runtime folder of another user without changing it', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const folder: string = paths.runtimeDir ?? '';
+  fs.mkdirSync(folder, { mode: OPEN_MODE });
+  fs.chmodSync(folder, OPEN_MODE);
+  expect(captureError(() => verifyRuntimeFolder(folder, getOtherUid()))).toMatchObject({
+    code: DaemonTransportErrorCode.unsafeRuntimeDirectory,
+    message: expect.stringContaining('another user owns it')
+  });
+  expect(getMode(folder)).toBe(OPEN_MODE);
+  removeIsolatedBase(paths);
+});
diff --git a/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts b/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
new file mode 100644
index 00000000000..0b7e0488841
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonTransportError, DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createFrame, nextMacrotaskAsync, trackSend, withPausedPairAsync } from './BackpressureFixture';
+import type { IBackpressurePair, SendState } from './BackpressureFixture';
+
+const SMALL_FRAME_BYTES: number = 1;
+
+it('rejects a send on a connection that already closed without an error', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    pair.server.socket.destroy();
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    // A write to a closed socket emits nothing more, so only the open check can settle this send.
+    const sendState: () => SendState = trackSend(pair.server.sendFrameAsync(createFrame(SMALL_FRAME_BYTES)));
+    await nextMacrotaskAsync();
+    expect(sendState()).toBeInstanceOf(DaemonTransportError);
+    expect(sendState()).toMatchObject({ code: DaemonTransportErrorCode.transportClosed });
+  });
+});
+
+it('rejects sendFrameWrittenAsync on a connection that already closed without an error', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    pair.server.socket.destroy();
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    // Without the open check, the write would reject with the socket's own error instead.
+    const writtenState: () => SendState = trackSend(
+      pair.server.sendFrameWrittenAsync(createFrame(SMALL_FRAME_BYTES))
+    );
+    await nextMacrotaskAsync();
+    expect(writtenState()).toBeInstanceOf(DaemonTransportError);
+    expect(writtenState()).toMatchObject({ code: DaemonTransportErrorCode.transportClosed });
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts b/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
new file mode 100644
index 00000000000..619bed306a3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as net from 'node:net';
+import { Duplex } from 'node:stream';
+
+import { DaemonFrameConnection } from '../DaemonFrameConnection';
+
+import { createFrame, nextMacrotaskAsync, trackSend } from './BackpressureFixture';
+import type { SendState } from './BackpressureFixture';
+
+const FIRST_BYTES: number = 1;
+const SECOND_BYTES: number = 2;
+
+/** A connection over a socket that finishes each write only when the test calls that write's callback. */
+interface IHeldWriteConnection {
+  readonly connection: DaemonFrameConnection;
+  readonly writeCallbacks: Array<(error?: Error | null) => void>;
+}
+
+function createHeldWriteConnection(): IHeldWriteConnection {
+  const writeCallbacks: Array<(error?: Error | null) => void> = [];
+  const socket: Duplex = new Duplex({
+    read(): void {
+      // Nothing arrives.
+    },
+    write(chunk: Buffer, encoding: BufferEncoding, callback: (error?: Error | null) => void): void {
+      writeCallbacks.push(callback);
+    }
+  });
+  return { connection: new DaemonFrameConnection(socket as net.Socket), writeCallbacks };
+}
+
+function finishNextWrite(writeCallbacks: Array<(error?: Error | null) => void>, error?: Error): void {
+  const callback: ((error?: Error | null) => void) | undefined = writeCallbacks.shift();
+  if (!callback) {
+    throw new Error('No write is waiting.');
+  }
+  callback(error);
+}
+
+it('sendFrameWrittenAsync resolves only once the socket has written the frame and the frames before it', async () => {
+  const { connection, writeCallbacks } = createHeldWriteConnection();
+  const acceptedState: () => SendState = trackSend(connection.sendFrameAsync(createFrame(FIRST_BYTES)));
+  const writtenState: () => SendState = trackSend(
+    connection.sendFrameWrittenAsync(createFrame(SECOND_BYTES))
+  );
+  await nextMacrotaskAsync();
+  // The socket accepted both frames, but has written neither.
+  expect(acceptedState()).toBe('resolved');
+  expect(writtenState()).toBe('pending');
+  finishNextWrite(writeCallbacks);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe('pending');
+  finishNextWrite(writeCallbacks);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe('resolved');
+});
+
+it("sendFrameWrittenAsync rejects with the socket's error when the write fails", async () => {
+  const { connection, writeCallbacks } = createHeldWriteConnection();
+  const writtenState: () => SendState = trackSend(connection.sendFrameWrittenAsync(createFrame(FIRST_BYTES)));
+  const writeError: Error = new Error('The write failed.');
+  await nextMacrotaskAsync();
+  finishNextWrite(writeCallbacks, writeError);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe(writeError);
+});
+
+it('sendFrameWrittenAsync rejects when the connection aborts before the socket writes the frame', async () => {
+  const { connection, writeCallbacks } = createHeldWriteConnection();
+  await connection.sendFrameAsync(createFrame(FIRST_BYTES));
+  // The socket holds the first frame's write, so this frame waits behind it.
+  const writtenState: () => SendState = trackSend(
+    connection.sendFrameWrittenAsync(createFrame(SECOND_BYTES))
+  );
+  const abortError: Error = new Error('The test aborted the connection.');
+  connection.abort(abortError);
+  finishNextWrite(writeCallbacks);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe(abortError);
+});
diff --git a/libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts b/libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts
new file mode 100644
index 00000000000..bdbc1612ce3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts
@@ -0,0 +1,80 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR, resolveDaemonPaths } from '../DaemonPaths';
+import { assertDaemonSocketPathFits, getMaxDaemonSocketPathBytes } from '../DaemonSocketPathLength';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+import { WORKSPACE_KEY_LENGTH } from '../WorkspaceKey';
+
+const UID: number = 9127721;
+const KEY: string = `rushd-${'0'.repeat(WORKSPACE_KEY_LENGTH)}`;
+// What a base gains on its way to the socket path: `/rushd-<uid>/rushd-<key>.sock`.
+const SUFFIX_BYTES: number = Buffer.byteLength(`/rushd-${UID}/${KEY}.sock`);
+const ONE: number = 1;
+// Longer than the limit of every platform.
+const LONG_NAME_BYTES: number = 160;
+// 25 two-byte characters make a 51-byte base of only 26 characters, too long for Linux by one byte.
+const TWO_BYTE_CHARACTER_COUNT: number = 25;
+const TOO_LONG: object = { code: DaemonTransportErrorCode.socketPathTooLong };
+const LINUX_LIMIT: number = 108;
+const BSD_LIMIT: number = 104;
+const LIMITS: readonly [NodeJS.Platform, number][] = [
+  ['linux', LINUX_LIMIT],
+  ['darwin', BSD_LIMIT],
+  ['freebsd', BSD_LIMIT]
+];
+
+function resolvePaths(platform: NodeJS.Platform, base: string): IDaemonPaths {
+  const env: Record<string, string> = { [DAEMON_RUNTIME_DIR_ENV_VAR]: base };
+  return resolveDaemonPaths({ platform, env, tmpdir: '/tmp', uid: UID }, KEY);
+}
+
+function createBase(bytes: number): string {
+  return `/${'a'.repeat(bytes - ONE)}`;
+}
+
+function captureMessage(paths: IDaemonPaths, platform: NodeJS.Platform): string {
+  try {
+    assertDaemonSocketPathFits(paths, platform);
+  } catch (error) {
+    expect(error).toMatchObject(TOO_LONG);
+    return (error as Error).message;
+  }
+  return '';
+}
+
+it.each(LIMITS)(
+  'allows a socket path of at most sun_path bytes on %s',
+  (platform: NodeJS.Platform, limit: number) => {
+    const maxBaseBytes: number = limit - SUFFIX_BYTES;
+    const fits: IDaemonPaths = resolvePaths(platform, createBase(maxBaseBytes));
+    expect(getMaxDaemonSocketPathBytes(platform)).toBe(limit);
+    expect(Buffer.byteLength(fits.socketPath)).toBe(limit);
+    expect(captureMessage(fits, platform)).toBe('');
+    const tooLong: IDaemonPaths = resolvePaths(platform, createBase(maxBaseBytes + ONE));
+    expect(captureMessage(tooLong, platform)).toBe(
+      `The daemon socket path ${tooLong.socketPath} is ${limit + ONE} bytes long, but this platform allows at ` +
+        `most ${limit}. Set ${DAEMON_RUNTIME_DIR_ENV_VAR} to an absolute path of at most ${maxBaseBytes} ` +
+        'bytes, or unset it.'
+    );
+  }
+);
+
+it('counts bytes, not characters', () => {
+  const paths: IDaemonPaths = resolvePaths('linux', `/${'é'.repeat(TWO_BYTE_CHARACTER_COUNT)}`);
+  expect(captureMessage(paths, 'linux')).toContain('is 109 bytes long');
+});
+
+it('names no length to aim for when a runtime folder of another layout leaves no room', () => {
+  const runtimeDir: string = createBase(LONG_NAME_BYTES);
+  const paths: IDaemonPaths = { runtimeDir, socketPath: `${runtimeDir}/d.sock`, lockfilePath: '' };
+  expect(captureMessage(paths, 'linux')).toMatch(
+    /at most 108\. Use a shorter runtime folder, or unset RUSHD_/
+  );
+});
+
+it('does not check a Windows named pipe', () => {
+  const socketPath: string = `\\\\.\\pipe\\${'p'.repeat(LONG_NAME_BYTES)}`;
+  expect(captureMessage({ runtimeDir: undefined, socketPath, lockfilePath: '' }, 'win32')).toBe('');
+});
diff --git a/libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts b/libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts
new file mode 100644
index 00000000000..c2ca10a40f0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts
@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR, resolveDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// Windows has no runtime folder: its named pipes live in the kernel's pipe namespace.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+// Longer than the limit of every platform, before the runtime folder and socket name are added.
+const LONG_NAME_BYTES: number = 110;
+const TOO_LONG: object = {
+  code: DaemonTransportErrorCode.socketPathTooLong,
+  message: expect.stringContaining(DAEMON_RUNTIME_DIR_ENV_VAR)
+};
+
+function captureError(action: () => void): unknown {
+  try {
+    action();
+  } catch (error) {
+    return error;
+  }
+}
+
+posixIt('refuses a long socket path before it creates, checks, reclaims or binds anything', async () => {
+  const isolated: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const base: string = path.join(path.dirname(isolated.runtimeDir ?? ''), 'b'.repeat(LONG_NAME_BYTES));
+  const env: Record<string, string> = { [DAEMON_RUNTIME_DIR_ENV_VAR]: base };
+  const paths: IDaemonPaths = resolveDaemonPaths(
+    { platform: process.platform, env, tmpdir: os.tmpdir(), uid: process.getuid?.() },
+    'rushd-long'
+  );
+  expect(captureError(() => assertDaemonRuntimeDirIsPrivate(paths))).toMatchObject(TOO_LONG);
+  expect(captureError(() => ensureDaemonRuntimeDir(paths))).toMatchObject(TOO_LONG);
+  await expect(reclaimStaleDaemonAsync(paths)).rejects.toMatchObject(TOO_LONG);
+  const listening: Promise<DaemonFrameListener> = DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  await expect(listening).rejects.toMatchObject(TOO_LONG);
+  expect(fs.existsSync(base)).toBe(false);
+  removeIsolatedBase(isolated);
+});
diff --git a/libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts b/libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts
new file mode 100644
index 00000000000..6301ec2bea1
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts
@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+
+import { readFolderNames } from '../DaemonOperationGroups';
+import { recordOnSpawn } from '../DaemonOperationGroupSpawnHook';
+
+const MARK_PREFIX: string = 'spawn-';
+const SPAWN_METHOD: string = 'spawn';
+const DETACHED: Readonly<Record<string, boolean>> = { detached: true };
+
+/** What the stand-in's own `spawn` returns, unless a test says otherwise. */
+export const SPAWNED: Readonly<Record<string, boolean>> = { spawned: true };
+
+/** What the stand-in's own `spawn` does, called on the stand-in `child`. */
+export type StandInSpawn = (child: EventEmitter) => unknown;
+
+/** What a detached spawn of a stand-in child through the recorder's hook did. */
+export interface IStandInRun {
+  readonly child: EventEmitter;
+  /** What the hooked `spawn` returned to its caller, as Node's spawn functions would get it. */
+  readonly returned?: unknown;
+  /** What the hooked `spawn` threw. */
+  readonly thrown?: unknown;
+  /** The calls of the stand-in's own `spawn`. */
+  readonly spawnCalls: number;
+  readonly recordCalls: number;
+  /** The spawn marks in the folder while the stand-in's own `spawn` ran. */
+  readonly marksInSpawn: string[];
+  /** The spawn marks in the folder after the hooked `spawn` returned or threw. */
+  readonly marksAfter: string[];
+}
+
+/** The record folder, what the stand-in's own `spawn` does, and what recording the child does. */
+export interface IStandInOptions {
+  readonly folder: string;
+  readonly spawn?: StandInSpawn;
+  readonly record?: () => void;
+}
+
+function readMarks(folder: string): string[] {
+  return readFolderNames(folder).filter((name: string) => name.startsWith(MARK_PREFIX));
+}
+
+// An instance of a new class whose prototype's `spawn` is `spawn`, as ChildProcess's prototype has Node's.
+function createStandIn(spawn: jest.Mock): EventEmitter {
+  class StandInChild extends EventEmitter {}
+  Reflect.defineProperty(StandInChild.prototype, SPAWN_METHOD, {
+    configurable: true,
+    writable: true,
+    value: spawn
+  });
+  return new StandInChild();
+}
+
+function callSpawn(child: EventEmitter): Pick<IStandInRun, 'returned' | 'thrown'> {
+  try {
+    return { returned: Reflect.apply(Reflect.get(child, SPAWN_METHOD), child, [DETACHED]) };
+  } catch (error) {
+    return { thrown: error };
+  }
+}
+
+/**
+ * Hooks a stand-in child the way the recorder hooks each published ChildProcess, and then calls its `spawn` for a
+ * detached child, the way Node's spawn functions do. No process is started.
+ */
+export function spawnStandIn({
+  folder,
+  spawn = () => SPAWNED,
+  record = () => undefined
+}: IStandInOptions): IStandInRun {
+  const marksInSpawn: string[] = [];
+  const ownSpawn: jest.Mock = jest.fn(function (this: EventEmitter): unknown {
+    marksInSpawn.push(...readMarks(folder));
+    return spawn(this);
+  });
+  const recordMock: jest.Mock = jest.fn(record);
+  const child: EventEmitter = createStandIn(ownSpawn);
+  recordOnSpawn(child as unknown as ChildProcess, { folder, record: recordMock });
+  const result: Pick<IStandInRun, 'returned' | 'thrown'> = callSpawn(child);
+  return {
+    child,
+    ...result,
+    spawnCalls: ownSpawn.mock.calls.length,
+    recordCalls: recordMock.mock.calls.length,
+    marksInSpawn,
+    marksAfter: readMarks(folder)
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts b/libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts
new file mode 100644
index 00000000000..35273f1d5d0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts
@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+
+import { SPAWNED } from './SpawnStandInFixture';
+import type { IStandInRun } from './SpawnStandInFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+/** What {@link IStandInRun} records of a spawn: everything but the stand-in child. */
+export type StandInSteps = Omit<IStandInRun, 'child'>;
+
+/** A new record folder of this process, which does not exist yet. */
+export function createRecordFolder(): string {
+  return getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+}
+
+/**
+ * What a detached spawn that works does: the real spawn runs once, between writing one spawn mark and removing it,
+ * the child is recorded once, and the hooked `spawn` returns {@link SPAWNED}; with `changes` applied.
+ */
+export function expectedSteps(changes: Partial<StandInSteps> = {}): StandInSteps {
+  const marksInSpawn: string[] = [expect.stringMatching(/^spawn-\d+$/)];
+  return { returned: SPAWNED, spawnCalls: 1, recordCalls: 1, marksInSpawn, marksAfter: [], ...changes };
+}
+
+/** The steps of `run`, without its child. */
+export function stepsOf(run: IStandInRun): StandInSteps {
+  const { returned, thrown, spawnCalls, recordCalls, marksInSpawn, marksAfter } = run;
+  return { returned, thrown, spawnCalls, recordCalls, marksInSpawn, marksAfter };
+}
diff --git a/libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts b/libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts
new file mode 100644
index 00000000000..37894d7fc74
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import {
+  OPERATION_GROUP,
+  OTHER_OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain
+} from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+interface IScanCount {
+  /** The group of each scan of the process table for a group's members, in order. */
+  readonly scannedGroups: number[];
+  readonly options: IDaemonOrphanReaperOptions;
+}
+
+// The options of `fake`, which also count each scan of its process table for a group's members.
+function countScans(fake: IFakeGroup): IScanCount {
+  const ops: IDaemonProcessGroupOps = fake.options.ops as IDaemonProcessGroupOps;
+  const scannedGroups: number[] = [];
+  const listLiveGroupMembers = (groupId: number): IProcessStat[] => {
+    scannedGroups.push(groupId);
+    return ops.listLiveGroupMembers(groupId);
+  };
+  return { scannedGroups, options: { ...fake.options, ops: { ...ops, listLiveGroupMembers } } };
+}
+
+it('drops a record whose group has no process without a scan of every process', async () => {
+  const fake: IFakeGroup = createFakeGroup({
+    exitsOn: 'SIGTERM',
+    processes: operationTree(OPERATION_GROUP, false)
+  });
+  const { scannedGroups, options } = countScans(fake);
+  const lockfilePath: string = recordGroups([OTHER_OPERATION_GROUP, OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe(
+    'terminated'
+  );
+  expect(scannedGroups).toEqual([OPERATION_GROUP]);
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+});
+
+it('still decides by the proof when a group that kill() finds has no live member', async () => {
+  const fake: IFakeGroup = createFakeGroup({ anyGroupExists: true, processes: [] });
+  const { scannedGroups, options } = countScans(fake);
+  const lockfilePath: string = recordGroups([OTHER_OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+  expect(scannedGroups).toEqual([OTHER_OPERATION_GROUP]);
+  expect(fake.signals).toEqual([]);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+});
diff --git a/libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts
new file mode 100644
index 00000000000..47298d21920
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { killFakeDaemonAsync, startFakeDaemonAsync } from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Above the worst case of the reaper's SIGTERM and SIGKILL grace periods plus the polls below.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+const RECORDED_OPERATIONS: number = 2;
+
+let started: IStartedProcess[] = [];
+let folders: string[] = [];
+afterEach(() => {
+  // A failed assertion must not leave this test's processes or record folders behind.
+  killStillRunning(started);
+  for (const folder of folders) fs.rmSync(folder, { recursive: true, force: true });
+  started = [];
+  folders = [];
+});
+
+// A fake daemon records its operations, but no lockfile names it, as after an older `daemon stop --force`
+// that removed the lockfile, without a reclaim, while the daemon's operations still ran.
+async function startUnnamedDaemonAsync(paths: IDaemonPaths): Promise<[IFakeDaemon, string]> {
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  const folder: string = getOperationGroupsFolder(paths.lockfilePath, Number(fake.daemon.pid));
+  folders.push(folder);
+  return [fake, folder];
+}
+
+async function reapsStrandedGroupsAsync(): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const [fake, folder] = await startUnnamedDaemonAsync(paths);
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  await killFakeDaemonAsync(fake);
+  expect(await waitUntilAsync(() => isGone(exitingLeader))).toBe(true);
+  const reaps: IDaemonOrphanReap[] = [];
+  await reclaimStaleDaemonAsync(paths, { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) });
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+  expect(fs.existsSync(folder)).toBe(false);
+  expect(reaps).toEqual([
+    { daemonPid: Number(fake.daemon.pid), processGroupIds: expect.any(Array), outcome: 'terminated' }
+  ]);
+  const [{ processGroupIds }] = reaps;
+  expect(new Set(processGroupIds)).toEqual(new Set([waitingLeader, exitingLeader]));
+}
+
+posixIt(
+  'reaps the operation groups of a dead daemon that no lockfile names',
+  reapsStrandedGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
+
+async function leavesLiveDaemonGroupsAsync(): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const [fake, folder] = await startUnnamedDaemonAsync(paths);
+  await reclaimStaleDaemonAsync(paths);
+  expect(fake.pids.every(isAlive)).toBe(true);
+  expect(readOperationGroupRecords(folder)).toHaveLength(RECORDED_OPERATIONS);
+}
+
+posixIt(
+  'leaves the operation groups of a live daemon that no lockfile names',
+  leavesLiveDaemonGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts b/libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts
new file mode 100644
index 00000000000..68a3f479309
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { sweepStrandedOperationGroupsAsync } from '../DaemonOperationGroupSweep';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_GROUP, operationTree } from './OperationGroupFixture';
+import {
+  STRANDED_PID,
+  moveBehindLink,
+  recordDaemonFolder,
+  removeCreatedEntries,
+  withLivePids
+} from './OperationGroupSweepFixture';
+import { SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const NO_UID: number = 0;
+const OTHER_USER_OFFSET: number = 1;
+const NO_OWNER: undefined = undefined;
+
+afterEach(removeCreatedEntries);
+
+function createFake(): IFakeGroup {
+  return createFakeGroup({ exitsOn: 'SIGTERM', processes: operationTree(OPERATION_GROUP) });
+}
+
+posixIt('never signals the groups in a stranded record folder that is a symbolic link', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = recordDaemonFolder(lockfilePath, STRANDED_PID, [OPERATION_GROUP]);
+  moveBehindLink(folder);
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, withLivePids(fake, [SELF_PID]));
+  expect(fake.signals).toEqual([]);
+  expect(fs.lstatSync(folder).isSymbolicLink()).toBe(true);
+});
+
+posixIt('never signals the groups in a stranded record folder of another user', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = recordDaemonFolder(lockfilePath, STRANDED_PID, [OPERATION_GROUP]);
+  const options: IDaemonOrphanReaperOptions = {
+    ...withLivePids(fake, [SELF_PID]),
+    uid: (process.getuid?.() ?? NO_UID) + OTHER_USER_OFFSET
+  };
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, options);
+  expect(fake.signals).toEqual([]);
+  expect(fs.existsSync(folder)).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts b/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
index b04a4f0f859..d4e00c9b2d7 100644
--- a/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import * as os from 'node:os';
+import * as path from 'node:path';
 
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 
@@ -9,19 +11,36 @@ import { connectDaemonAsync } from '../DaemonConnector';
 import type { DaemonFrameConnection } from '../DaemonFrameConnection';
 import { DaemonFrameListener } from '../DaemonListener';
 import type { IDaemonPaths } from '../DaemonPaths';
-import { resolveDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from '../DaemonPaths';
 
-let testKeyCounter: number = 0;
-const COUNTER_START: number = 1;
+import { resolveTestKeyPaths } from './TestDaemonKeys';
 
-/** Creates unique daemon paths for the current platform in the temp dir. */
+const ISOLATED_BASE_PREFIX: string = 'rushd-test-base-';
+// Short, as a socket path must be (104 bytes on macOS); the daemon's own default base is /tmp too.
+const POSIX_TEMP_FOLDER: string = '/tmp';
+
+/**
+ * Creates unique daemon paths for the current platform in the user's shared runtime directory. Whatever a test
+ * leaves there under them is deleted after the test file's last test (see `removeTestKeyEntries`).
+ */
 export function createTestDaemonPaths(): IDaemonPaths {
-  testKeyCounter += COUNTER_START;
-  const workspaceKey: string = `rushd-test-${process.pid}-${testKeyCounter}`;
-  return resolveDaemonPaths(
-    { platform: process.platform, env: {}, tmpdir: os.tmpdir(), uid: process.getuid?.() },
-    workspaceKey
-  );
+  return resolveTestKeyPaths({});
+}
+
+/**
+ * Creates unique daemon paths in a new runtime base of their own (see {@link removeIsolatedBase}), for tests
+ * that delete or replace the runtime directory. Real daemons use the shared one.
+ */
+export function createIsolatedTestDaemonPaths(): IDaemonPaths {
+  const parent: string = process.platform === 'win32' ? os.tmpdir() : POSIX_TEMP_FOLDER;
+  const base: string = fs.mkdtempSync(path.join(parent, ISOLATED_BASE_PREFIX));
+  return resolveTestKeyPaths({ [DAEMON_RUNTIME_DIR_ENV_VAR]: base });
+}
+
+/** Deletes the runtime base of paths from {@link createIsolatedTestDaemonPaths}. */
+export function removeIsolatedBase(paths: IDaemonPaths): void {
+  if (paths.runtimeDir !== undefined)
+    fs.rmSync(path.dirname(paths.runtimeDir), { recursive: true, force: true });
 }
 
 /** A minimal deferred promise for crossing the callback/async boundary. */
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts
new file mode 100644
index 00000000000..6de082aa8c8
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+
+import { OPERATION_GROUP, recordGroups } from './OperationGroupFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+import { removeTestKeyEntries } from './TestDaemonKeys';
+
+it("removes what this file's keys left in the shared runtime directory, and no other file's entries", () => {
+  const recorded: string = recordGroups([OPERATION_GROUP]);
+  const { lockfilePath } = createTestDaemonPaths();
+  const entries: string[] = [lockfilePath, `${lockfilePath}.log`];
+  for (const entry of entries) fs.writeFileSync(entry, '{}');
+  // The same pid as this file's keys, as another test file in this worker would have.
+  const foreign: string = path.join(path.dirname(lockfilePath), `rushd-test-${process.pid}-other.pid.json`);
+  fs.writeFileSync(foreign, '{}');
+  try {
+    removeTestKeyEntries();
+    expect(fs.existsSync(getOperationGroupsFolder(recorded, DEAD_PID))).toBe(false);
+    expect(entries.filter((entry: string) => fs.existsSync(entry))).toEqual([]);
+    expect(fs.existsSync(foreign)).toBe(true);
+  } finally {
+    fs.rmSync(foreign, { force: true });
+  }
+});
+
+interface IModuleCopy {
+  firstKey: string;
+  removeEntries: () => void;
+}
+
+async function loadCopyAsync(): Promise<IModuleCopy> {
+  const { resolveTestKeyPaths, removeTestKeyEntries: removeEntries } = await import('./TestDaemonKeys');
+  return { firstKey: path.basename(resolveTestKeyPaths({}).lockfilePath), removeEntries };
+}
+
+it('gives each test file keys of its own, and has it remove their entries after its last test', async () => {
+  const hooks: jest.ProvidesHookCallback[] = [];
+  const spy: jest.SpyInstance = jest
+    .spyOn(global, 'afterAll')
+    .mockImplementation((hook: jest.ProvidesHookCallback) => hooks.push(hook));
+  const copies: IModuleCopy[] = [];
+  try {
+    // Fresh copies of the module, as two test files in one Jest worker get.
+    await jest.isolateModulesAsync(async () => {
+      copies.push(await loadCopyAsync());
+    });
+    await jest.isolateModulesAsync(async () => {
+      copies.push(await loadCopyAsync());
+    });
+    const [firstFileKey, secondFileKey] = copies.map((copy: IModuleCopy) => copy.firstKey);
+    expect(secondFileKey).not.toBe(firstFileKey);
+    expect(hooks).toEqual(copies.map((copy: IModuleCopy) => copy.removeEntries));
+  } finally {
+    spy.mockRestore();
+  }
+});
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts
new file mode 100644
index 00000000000..8b0f107476a
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts
@@ -0,0 +1,56 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '../DaemonPaths';
+import { resolveDaemonPaths } from '../DaemonPaths';
+
+const NONCE_BYTES: number = 3;
+const COUNTER_STEP: number = 1;
+const NO_OVERRIDES: Readonly<Record<string, string>> = {};
+
+// Jest runs several test files in one worker and loads this module afresh for each of them, so a key made of the
+// pid and a counter alone would repeat in the next file, and in a later worker that reuses the pid.
+const TEST_KEY_PREFIX: string = `rushd-test-${process.pid}-${crypto.randomBytes(NONCE_BYTES).toString('hex')}-`;
+let testKeyCounter: number = 0;
+
+function resolveKeyPaths(env: Readonly<Record<string, string>>, workspaceKey: string): IDaemonPaths {
+  return resolveDaemonPaths(
+    { platform: process.platform, env, tmpdir: os.tmpdir(), uid: process.getuid?.() },
+    workspaceKey
+  );
+}
+
+/** Resolves the paths of a new workspace key of this test file, in the runtime base that `env` selects. */
+export function resolveTestKeyPaths(env: Readonly<Record<string, string>>): IDaemonPaths {
+  testKeyCounter += COUNTER_STEP;
+  return resolveKeyPaths(env, `${TEST_KEY_PREFIX}${testKeyCounter}`);
+}
+
+function readFolderIfPresent(folder: string): string[] {
+  try {
+    return fs.readdirSync(folder);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Deletes every entry that this test file's keys left in the user's shared runtime directory: records, sockets,
+ * operation group records, logs and locks. Other files' and real daemons' entries are left alone.
+ */
+export function removeTestKeyEntries(): void {
+  const folder: string = path.dirname(resolveKeyPaths(NO_OVERRIDES, TEST_KEY_PREFIX).lockfilePath);
+  const names: string[] = readFolderIfPresent(folder).filter((name: string) =>
+    name.startsWith(TEST_KEY_PREFIX)
+  );
+  for (const name of names) fs.rmSync(path.join(folder, name), { recursive: true, force: true });
+}
+
+// Each test file that makes keys loads this module, so each one cleans up after its last test, including records
+// that a test keeps on purpose and those of a test that failed before its own cleanup.
+afterAll(removeTestKeyEntries);
diff --git a/libraries/rush-daemon-transport/src/test/Unlink.test.ts b/libraries/rush-daemon-transport/src/test/Unlink.test.ts
new file mode 100644
index 00000000000..bc8844666e0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/Unlink.test.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { unlinkIfPresent } from '../DaemonUnlink';
+
+const FOLDER_PREFIX: string = 'rushd-unlink-';
+
+describe(unlinkIfPresent.name, () => {
+  let folder: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), FOLDER_PREFIX));
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('deletes a file', () => {
+    const filePath: string = path.join(folder, 'file');
+    fs.writeFileSync(filePath, 'content');
+    unlinkIfPresent(filePath);
+    expect(fs.existsSync(filePath)).toBe(false);
+  });
+
+  it('does nothing when nothing is at the path', () => {
+    expect(() => unlinkIfPresent(path.join(folder, 'missing'))).not.toThrow();
+  });
+
+  it('throws for a folder, and leaves it', () => {
+    const child: string = path.join(folder, 'child');
+    fs.mkdirSync(child);
+    expect(() => unlinkIfPresent(child)).toThrow();
+    expect(fs.statSync(child).isDirectory()).toBe(true);
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts b/libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts
new file mode 100644
index 00000000000..198a17ce016
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as net from 'node:net';
+
+import { encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { connectDaemonAsync } from '../DaemonConnector';
+import type { DaemonFrameConnection } from '../DaemonFrameConnection';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+
+import { createFrame, nextMacrotaskAsync } from './BackpressureFixture';
+import { createDeferred, createTestDaemonPaths } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+
+/** The payload sizes of the two frames that the peer sends, which tell them apart. */
+export const FIRST_BYTES: number = 1;
+export const SECOND_BYTES: number = 2;
+
+/** A connection under test, and a peer that never reads what the connection sends. */
+export interface IUnreadingPeerPair {
+  readonly reader: DaemonFrameConnection;
+  readonly peer: net.Socket;
+  /** The error that the reader closed with. */
+  readonly closed: Promise<Error | undefined>;
+}
+
+/** A frame handler that records the payload sizes it gets, and holds the first frame until `release`. */
+export interface IHeldHandler {
+  readonly received: number[];
+  /** Resolves once the handler holds the first frame, when the connection has paused its socket. */
+  readonly holding: Promise<void>;
+  readonly release: () => void;
+}
+
+async function listenAsync(paths: IDaemonPaths, accepted: IDeferred<net.Socket>): Promise<net.Server> {
+  ensureDaemonRuntimeDir(paths);
+  const server: net.Server = net.createServer({ pauseOnConnect: true }, (socket: net.Socket) => {
+    socket.on('error', () => undefined);
+    accepted.resolve(socket);
+  });
+  await new Promise<void>((resolve: () => void) => server.listen(paths.socketPath, resolve));
+  return server;
+}
+
+/**
+ * Runs a test on a connection whose peer never reads, as a daemon whose event loop is stuck doesn't, so that the
+ * peer's close resets the connection once the connection has sent it anything.
+ */
+export async function withUnreadingPeerAsync(fn: (pair: IUnreadingPeerPair) => Promise<void>): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const accepted: IDeferred<net.Socket> = createDeferred<net.Socket>();
+  const server: net.Server = await listenAsync(paths, accepted);
+  try {
+    const reader: DaemonFrameConnection = await connectDaemonAsync(paths.socketPath);
+    const closed: IDeferred<Error | undefined> = createDeferred<Error | undefined>();
+    reader.onClosed((error: Error | undefined) => closed.resolve(error));
+    const peer: net.Socket = await accepted.promise;
+    try {
+      await fn({ reader, peer, closed: closed.promise });
+    } finally {
+      reader.abort(new Error('The test ended.'));
+      peer.destroy();
+    }
+  } finally {
+    await new Promise<void>((resolve: () => void) => server.close(() => resolve()));
+  }
+}
+
+export function holdFirstFrame(reader: DaemonFrameConnection): IHeldHandler {
+  const received: number[] = [];
+  const holding: IDeferred<void> = createDeferred<void>();
+  const release: IDeferred<void> = createDeferred<void>();
+  reader.onFrame(async (frame: IDaemonFrame) => {
+    received.push(frame.payload.length);
+    if (frame.payload.length === FIRST_BYTES) {
+      holding.resolve();
+      await release.promise;
+    }
+  });
+  return { received, holding: holding.promise, release: () => release.resolve() };
+}
+
+/** The peer writes frames of these payload sizes in one write; resolves once the reader's side holds them. */
+export async function writeFramesAsync(peer: net.Socket, ...byteCounts: number[]): Promise<void> {
+  const bytes: Buffer = Buffer.concat(byteCounts.map((n: number) => encodeDaemonFrame(createFrame(n))));
+  await new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+    peer.write(bytes, (error: Error | null | undefined) => (error ? reject(error) : resolve()));
+  });
+}
+
+/** Sends the first frame, and the second one once the reader holds the first, so the second waits unread. */
+export async function sendWhileHeldAsync(pair: IUnreadingPeerPair, handler: IHeldHandler): Promise<void> {
+  await writeFramesAsync(pair.peer, FIRST_BYTES);
+  await handler.holding;
+  await writeFramesAsync(pair.peer, SECOND_BYTES);
+  while (!pair.reader.socket.readableLength) await nextMacrotaskAsync();
+}
diff --git a/libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts b/libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts
new file mode 100644
index 00000000000..c2a3af7c117
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts
@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import type { Readable } from 'node:stream';
+
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+
+// sh without job control keeps a background job in the shell's process group, so the job leads no group
+// and setsid(1) calls setsid() itself instead of forking. The shell then becomes a sleep, which never reaps
+// the job.
+const UNREAPED_LEADER_SCRIPT: string =
+  'setsid sleep 600 </dev/null >/dev/null 2>&1 & echo $!; exec sleep 600';
+const FIRST_INDEX: number = 0;
+
+const started: IStartedProcess[] = [];
+
+/**
+ * Starts a process that leads its own session and process group, like a detached operation, and whose parent
+ * never reaps it: once it exits, it stays a zombie. Returns its pid.
+ */
+export async function startUnreapedLeaderAsync(): Promise<number> {
+  const parent: ChildProcess = spawn('/bin/sh', ['-c', UNREAPED_LEADER_SCRIPT], {
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const [chunk] = (await once(parent.stdout as Readable, 'data')) as [Buffer];
+  (parent.stdout as Readable).destroy();
+  const pid: number = Number(chunk.toString().trim());
+  started.push(...identifyStarted([Number(parent.pid), pid]));
+  await waitUntilAsync(() => readProcessStat(pid)?.sessionId === pid);
+  return pid;
+}
+
+/** `true` once `pid` has exited but is not reaped. */
+export function isZombie(pid: number): boolean {
+  return readProcessStat(pid)?.exited === true;
+}
+
+/** Kills the parents and leaders that are still the processes started; a parent's exit lets its zombie go. */
+export function killUnreapedLeaders(): void {
+  killStillRunning(started.splice(FIRST_INDEX));
+}
diff --git a/libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts b/libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts
new file mode 100644
index 00000000000..265c4dbe9b7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { OPERATION_GROUP, recordGroups, stat } from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { waitUntilAsync } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+import { isZombie, killUnreapedLeaders, startUnreapedLeaderAsync } from './UnreapedLeaderFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Short, so that a group that never counts as gone fails its test within about a second.
+const GRACE_MS: number = 500;
+const TEST_TIMEOUT_MS: number = 30000;
+// The real process table, in which daemon DEAD_PID is dead whatever this host runs under that pid.
+const REAL_OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false },
+  graceMs: GRACE_MS
+};
+
+let folders: string[] = [];
+afterEach(() => {
+  killUnreapedLeaders();
+  for (const folder of folders) fs.rmSync(folder, { recursive: true, force: true });
+  folders = [];
+});
+
+/** Records `leader` with its real start time for dead daemon DEAD_PID; returns the lockfile path. */
+function recordLeader(leader: number): string {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  folders.push(folder);
+  fs.mkdirSync(folder, { recursive: true });
+  const { startTime } = readProcessStat(leader) as IProcessStat;
+  writeOperationGroupRecord(folder, { groupId: leader, startTime });
+  return lockfilePath;
+}
+
+linuxIt(
+  'counts a group whose only member is a zombie as gone',
+  async () => {
+    const leader: number = await startUnreapedLeaderAsync();
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(leader)).toBe(true);
+    process.kill(leader, 'SIGKILL');
+    expect(await waitUntilAsync(() => isZombie(leader))).toBe(true);
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(leader)).toBe(false);
+  },
+  TEST_TIMEOUT_MS
+);
+
+async function stopsGroupLeftAsZombieAsync(): Promise<void> {
+  const leader: number = await startUnreapedLeaderAsync();
+  const lockfilePath: string = recordLeader(leader);
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...REAL_OPTIONS,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  const outcome: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options);
+  await expect(outcome).resolves.toBe('terminated');
+  expect(isZombie(leader)).toBe(true);
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [leader], outcome: 'terminated' }]);
+  expect(fs.existsSync(getOperationGroupsFolder(lockfilePath, DEAD_PID))).toBe(false);
+}
+
+linuxIt('stops a group whose parent never reaps it', stopsGroupLeftAsZombieAsync, TEST_TIMEOUT_MS);
+
+async function dropsZombieLeaderAsync(): Promise<void> {
+  const leader: number = await startUnreapedLeaderAsync();
+  const lockfilePath: string = recordLeader(leader);
+  process.kill(leader, 'SIGKILL');
+  expect(await waitUntilAsync(() => isZombie(leader))).toBe(true);
+  const outcome: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, REAL_OPTIONS);
+  await expect(outcome).resolves.toBe('none');
+  expect(fs.existsSync(getOperationGroupsFolder(lockfilePath, DEAD_PID))).toBe(false);
+}
+
+linuxIt('drops the record of a leader that is already a zombie', dropsZombieLeaderAsync, TEST_TIMEOUT_MS);
+
+it('never signals a recorded group whose leader is a zombie and that has no live member', async () => {
+  const zombieLeader: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), exited: true };
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', processes: [zombieLeader] });
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  const outcome: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options);
+  await expect(outcome).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 8f745e29930..a522671db53 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -25,6 +25,35 @@ the existing unlimited lifetime; invalid, nonpositive, or overflowing timeouts a
 The host's `closed` promise signals completion of shutdown, including idle shutdown, and `closeAsync()`
 reports cleanup failures. `serveRushDaemonAsync()` returns after either idle shutdown or its shutdown signal.
 
+Hosts can also set `idleGarbageCollectionDelayMs`, which `serveRushDaemonAsync()` defaults to 10 seconds for a
+daemon that owns its process. After a request, once no request has been pending for that long and the operation
+graph has no iteration scheduled or running, the host runs one full garbage collection that returns the freed heap
+pages to the operating system (on Node.js 20, a regular full collection, which keeps them pooled). It logs the
+resident memory and heap before and after, and how long the collection paused the daemon. It runs again only after
+another request. Collections during a request free the heap but keep its pages pooled for reuse. V8 returns them
+by itself only when its memory reducer, which checks every 8 seconds, finds the process idle, and after some
+requests it never does.
+
+A daemon that exits without releasing its endpoint, for example after SIGKILL, can leave operations running.
+On Linux, a host that reclaims such an endpoint at startup first stops them, so that they cannot overwrite the
+outputs of its own requests. The daemon log (`onLog`) gets one line for each set of process groups that it
+stopped; without `onLog`, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. A process
+group that the exited daemon recorded for an operation, but that the host cannot prove still runs that
+operation, gets no signal; while it has a live process, the daemon log gets a line that names it and says which
+check it failed, for example `rushd: left process group 4242 running, which the exited daemon (PID 4000)
+recorded for an operation: the process with PID 4242 now is not the leader that the daemon recorded`.
+
+Whatever starts a shutdown (a signal, a management client, the idle timeout, a lost socket, a restart or
+`closeAsync()`), the host writes one line to `onLog` when it begins, with its process ID and the reason, for example
+`rushd (PID 2750564) shutting down: received SIGTERM`; later close calls write nothing. The standalone daemon
+starts each log line with the time, and its `rushd ready at` line also has the time and the process ID, so that
+each start can be matched with its end. If whatever reads the output of `rushd` goes away first, as with
+`rushd 2>&1 | tee rushd.log` when Ctrl+C stops `tee` as well, `rushd` goes on without its output: it still stops
+cleanly and removes its socket and lockfile. A client that goes away before it gets a reply (its connection fails
+with `EPIPE` or `ECONNRESET`) is not a daemon failure: the host writes one line to `onLog` for each reply that it
+could not send, for example `rushd: a client went away before its reply; dropped the pong (write EPIPE)`, and
+nothing to `onError`.
+
 Protocol 0.6 management clients can stop the host through the workspace transport rather than signaling a PID
 read from disk. The host requires a lifecycle-capable hello, drains `shutdownAck` before beginning shutdown,
 then cancels outstanding requests and disposes the resolver, workspace, and endpoint through its normal close
@@ -68,7 +97,8 @@ a workspace graph. Embedded hosts can install the composite explicitly; omitting
 
 ### Bounded native engine integration
 
-`PhasedCommandEngine` in `rush-lib` parses native `build` and `rebuild` commands without invoking CLI execution,
+`PhasedCommandEngine` in `rush-lib` parses native `build` and `rebuild` commands, and the phased commands of
+command-line.json, without invoking CLI execution,
 initializing `.env`, changing the process working directory, or mutating `process.env`. Graph preparation reuses
 `PhasedScriptAction`'s standard operation, sharding, shell-runner, validation, cache/legacy-skip, and situational
 plugin pipeline. It does not launch a Rush CLI subprocess. The graph includes every project, and native
@@ -86,20 +116,36 @@ The host uses stable fingerprints to classify native requests:
 Configuration fingerprints use contents rather than timestamps. Runtime content hashes are cached only behind
 file identity/size/mtime/ctime checks; touching unchanged content does not itself change a fingerprint.
 Native dispatch first copies the envelope and normalizes only engine-owned `_RUSH_LIB_PATH` to this daemon's
-real engine, preventing false restarts or wrong SDK selection from a foreign client path. Environment
+own engine, preventing false restarts or wrong SDK selection from a foreign client path. The daemon keeps the
+spelling that its engine chose when it loaded: a source-built rush-lib, such as one in a `rush deploy` output,
+is spelled through the daemon's own `node_modules/@microsoft/rush-lib` link so plugins can resolve it by name. Environment
 comparisons (the tier-2 fingerprint and the production resolver's startup-environment check) both use rush-lib's
 `getWorkspaceFingerprintEnvironmentEntries()`, which omits `workspaceFingerprintIgnoredEnvironmentVariables`:
 volatile per-shell, terminal, session and client-routing variables such as `PWD`, `OLDPWD`, `SHLVL`, `_`,
 `TERM`, `COLUMNS`, `WSL_INTEROP`, `SSH_*`, `INIT_CWD`, `RUSH_DAEMON`, `RUSH_DAEMON_AUTO_START` and
-`RUSH_DAEMON_EXPERIMENTAL`. Rush does not read these to configure the engine, build the graph or hash operations,
+`RUSH_DAEMON_EXPERIMENTAL`. Rush does not read these to configure the engine or build the graph,
 so running a command from a project subfolder or another shell reuses the warm workspace. All other environment
 inputs, including every other `RUSH_*` variable, `NODE_*`, npm/pnpm configuration, `PATH` and `HOME`, remain
-unchanged and are checked normally. Phased operation processes inherit the daemon's own environment, so they
-see the daemon's startup values for the ignored variables rather than the submitting shell's values.
-Compatible selections reuse the same graph and records. An unchanged successful build schedules no work; rebuild
-still invalidates the graph on each request. Every execution refreshes operation inputs under its native lease.
-
-A generation lease spans resolution through final output. Reload also takes exclusive workspace admission and
+unchanged and are checked normally. Each phased operation process takes the ignored variables from the request
+that selected it (`getWorkspaceRequestOperationEnvironment()`) and hashes its `dependsOnEnvVars` from that
+environment, so it sees the submitting shell's values, as a native command would. The exception is
+`RUSHD_OPERATION_GROUPS`: on Linux the daemon sets it in its own `process.env` to mark the processes that it
+starts (`DAEMON_OPERATION_GROUPS_ENV_VAR` of rush-daemon-transport), so operations and the child processes of
+global commands get the daemon's value, or none, never the request's. The rest of that environment is
+the daemon's `process.env` when the operation starts, so it includes variables that a plugin sets in the same
+iteration's `beforeExecuteIterationAsync`; state hashes use the values from when the iteration was scheduled, before
+those hooks run, as native Rush does.
+Compatible selections reuse the same graph and records. An unchanged successful build schedules no work. A
+`rebuild`, or another command with `"incremental": false`, runs every operation that it selects again, without
+earlier results, build cache restores or the legacy skip check, and the graph keeps the new results for later
+requests. Every execution refreshes operation inputs under its native lease.
+With the build cache enabled, a cacheable operation whose tracked input files change while the inputs snapshot is
+taken or while it executes is not kept as up to date, whether or not cache writes are allowed: the next request runs
+it and its consumers again, even if the files were changed back in between. Operations whose build cache is
+disabled, and workspaces without a build cache, don't get this check.
+
+A generation lease spans resolution through final output; a Rushx script releases it when the script starts (see
+below). Reload also takes exclusive workspace admission and
 the native preparation lock, discards paused prepared work, and awaits old runner/plugin/watcher cleanup before
 publishing the replacement. The initiating request atomically downgrades its admission so another reload cannot
 dispose the newly selected graph before it runs. Watch requests are cancelled and drained before their generation
@@ -116,9 +162,14 @@ the graph/cache settings with the construction snapshot. Changed inherited or ri
 generation reload before execution, even outside watcher roots or in ignored `node_modules` files.
 The retained graph and its cache policy are never patched in place.
 
-External Rush plugins, `.env` initialization, watch/install/variant
+External Rush plugins that Rush would initialize for the requested command (plugins without `associatedCommands`,
+or associated with that command) or whose cached command-line.json defines that command, one of its phases, or a
+parameter associated with either are rejected, as are `.env` initialization, watch/install/variant
 and diagnostic-directory options, build event-hook scripts (unless explicitly ignored), and arbitrary global
-commands are rejected by the phased path, not silently bypassed. Native Rushx is handled separately below.
+commands; they are rejected by the phased path, not silently bypassed. Configured plugins that are scoped only to
+other commands are inert for the build and are permitted; their autoinstaller `package.json` and cached manifest and
+command-line files are workspace definitions, so changing them reloads the generation. An unreadable manifest or
+command-line file is rejected. Native Rushx is handled separately below.
 For phased commands, a changed request environment requires a new process, including Rush/cache
 policy variables (the volatile variables listed above excepted). These restrictions remain until the corresponding initialization,
 environment, and resource-lifetime contracts are request-scoped.
@@ -132,9 +183,40 @@ whose own operations all completed earlier may receive its result while the iter
 below); it must not assume the lock is already released. Thus ordinary native actions and permanent `--no-daemon`
 fallback can run immediately after a completed single-client warm request without stopping the daemon.
 
-A real native command holding the lock causes preparation or execution to be refused; there is no lock bypass or
-automatic retry. A later explicit request can retry after contention ends, including contention during the first
-engine initialization. A dirty native lock left by another command invalidates retained successes so the native
+When a Rush process that the daemon does not run, such as `rush install` or a `--no-daemon` build, holds the lock,
+preparation and execution wait for it within the request's wait timeout, including during the first engine
+initialization; there is no lock bypass. The daemon tries the lock every 250 ms, since native Rush does not say when
+it releases it. Coalesced requests wait together, and each one stops waiting when its own timeout ends. Each waiting
+client gets a queue position with `nativeLockHolder`, the process as far as the daemon can tell (see
+`findNativeLockHolder` in `@rushstack/rush-client-core`; on Linux, its PID and command, such as `rush install`), and
+another whenever that process changes. `--no-wait` and a zero timeout fail at once, naming the process. The built-in
+default timeout also limits this wait, because the other process can run for any length of time; a request that
+waits longer fails with an admission failure that names the process and suggests `--wait-timeout`. A cancelled
+request stops waiting and never runs. When the daemon itself holds the lock for another request, the request still
+fails at once, and the experimental graph request's lease does not wait. A served Rushx script does not wait for a
+reload that waits for such a process, since the script does not need the reload: it resolves and starts on the
+current generation at once, as it would have before the reload began, and the reload waits for it only until it
+has started. After an edit to `rush.json` or `common/config/rush/experiments.json`, the client runs it in-process
+at once instead, as it would if no reload were running. Other requests that wait behind such a reload, such as
+builds, wait for that process too, and spend their wait timeouts meanwhile; their queue positions carry the same
+`nativeLockHolder`, with their own position, and a request whose timeout ends names the process in its failure.
+
+A client that subscribes with `supportsRequestStarted` (protocol 0.14) gets `requestStarted` once its request has left
+every queue, before anything from the request is applied. A phased batch sends it to each participant after the native
+lock, the wait for connecting clients and input reconciliation, and before it applies the requests' settings and
+selections, closes runners for a rebuild or schedules the iteration; a global command, Rushx script or graph request
+gets it just before it runs. The daemon goes on only once the operating system holds the notice, not just once the
+socket accepts it, so the client can read it even if the daemon exits as soon as the request starts, and a client whose
+daemon exited before the notice knows that its request did not run. A request that joins an executing iteration gets the
+notice only once the iteration takes its work, so a request that cannot join is not told that it started while it waits
+for a later batch. The iteration dispatches that work as it takes it, before the notice is written: a daemon that closes
+still sends the notice, but one that exits abruptly just then can leave its client to take the build for one that did
+not run. A notice that cannot be written does not fail the request.
+A shutdown uses the same point for every client, whether or not it subscribed: the error of a request that had not
+reached it says that the daemon was shut down while the request was queued and that it did not start, and the error
+of a request past it says that the request was running.
+
+A dirty native lock left by another command invalidates retained successes so the native
 incremental/cache pipeline can reconcile possibly changed ignored outputs. Declared `outputFolderNames` are also
 fingerprinted (one `stat` per folder: existence, identity and modification time) when an operation succeeds or is
 restored from cache; a request whose reconciliation finds a missing or changed output folder (for example after
@@ -151,6 +233,11 @@ an installation using native Rush package-install APIs; the host does not instal
 packages during restart. Selection probes foreign runtimes in isolation, and launch
 rechecks the actual engine version and protocol before binding. An unavailable or
 incompatible installation is never impersonated by the bundled engine.
+
+On Windows the standalone launcher starts the daemon detached, without a console. Before serving, the launched
+daemon therefore makes `windowsHide: true` the default for every `node:child_process` call that does not choose a
+value, so Git, tar, operation shells and plugin tools do not each open a visible console window. Their descendants
+inherit the resulting windowless console. Embedded hosts, which own their process, are not changed.
 Embedded `RushDaemonHost` users can provide `getSuccessorLaunchAsync`, returning the existing core
 `IDaemonStartCommand` plus the expected daemon implementation version. Selection is validated before shutdown;
 an unavailable selected Rush version fails explicitly and is never run by the current engine under a false version.
@@ -158,7 +245,50 @@ The default entrypoint supports the `rush.json` version, not a separate preview-
 
 Successor startup reuses `connectOrStartDaemonAsync`: acknowledged old ownership must be released after all old
 resources finish, startup is serialized with ordinary clients, and hello/ping readiness attests a different PID.
-`restartCompleted` reports completion or failure.
+`restartCompleted` reports completion or failure. Clients that retry a `retryAfterRestart: true` result do not start a
+daemon while this process lives, so the successor is the one it selected; only a client that did not follow the
+restart can still take the startup mutex first.
+
+A request whose environment needs another process does not restart the daemon while it serves other requests. It
+first waits for the requests that this process is serving to finish (the restart drain), and its queue position is the
+number of those requests. The queue positions also say why the daemon restarts (`restartReason`): `environmentChanged`
+names the variables that differ (see below), and `workspaceInputsChanged` names the installation files and the files
+of Rush or its plugins that changed since the daemon started, as the latest capture found them, or the Rush version
+that the request selects. They say how many of those requests run a rushx script (`scriptCount`), and the drain's
+admission errors name the same reason. Like the graph-execution gate, waiting for the requests that were already being served when
+the drain began is progress rather than contention: while one of them is still being served and no rushx script is, a
+client-default `waitTimeoutMs` (`waitTimeoutIsDefault`) does not limit the drain and is not spent, and the client
+sends the request to the successor with its default again. The default still limits the drain while a rushx script is
+served, since a script may not exit until it is stopped, and while it waits for requests that arrived during the
+drain, which could otherwise keep it waiting for as long as they keep arriving. An explicit `noWait` or
+`waitTimeoutMs` limits the whole drain, and only its remaining time carries over to the successor. When a drain times
+out, its message names the time that did not count.
+
+The change that needs a restart may be reverted during the drain, while requests that do not need one keep the drain
+from finishing for as long as they keep arriving. A request that waits for the drain therefore captures its inputs
+again every second, and once they no longer need a restart it stops waiting and is admitted as if it had just
+arrived, on this process. The requests that wait share these captures: a request reuses the latest one until it is a
+second old, so the drain costs one capture a second however many requests wait, and each request still sees a revert
+within about two seconds. A request that needs a restart only for its environment does not capture again, since its
+environment cannot change.
+
+A restart is pending from when a request begins its restart drain until the request has planned the restart, has found
+that it no longer needs it, or has failed or been cancelled. A rushx script that arrives while a restart is pending
+does not start, since the restart would then wait for it to exit: the script waits for the pending restart instead,
+and the drain does not count it. If the restart was planned, the script's result carries `retryAfterRestart: true` so
+that the client runs it on the successor; otherwise it runs on this process. Its queue position is the number of
+requests that are served or waiting to restart, with the reason of the first request that waits to restart and
+`restartsForAnotherRequest: true`, and its wait timeout applies as it does to the drain, relative to the
+requests that were served when the script began to wait.
+
+The `retryAfterRestart: true` result of the request that restarts the daemon for its environment carries
+`restartReason: { kind: 'environmentChanged', variableNames }`: the sorted names of the variables that are set in only
+one of the two environments, or set to different values, compared as the fingerprint's `environmentHash` compares them
+(without the variables that it ignores, and with repeated `PATH` entries removed). Values are never sent, since a
+variable such as `NODE_OPTIONS` can hold a secret. Each control character of a name, such as a newline or ESC, is sent
+as a `\xHH` escape, so that the client's line and the daemon log's line each stay one line. Each request that is
+answered while that restart is pending gets the same reason, because the successor starts with the restarting
+request's environment, not its own. The daemon log (`onLog`) names the request and the variables.
 
 Protocol 0.10 (`DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR`) provides bounded, typed retry authorization.
 Only a pre-execution command result may carry `retryAfterRestart: true`. During a planned restart, accepted
@@ -168,6 +298,30 @@ then retries an eligible request **at most once**. Command input/output or cance
 even with the typed flag. Error text, a changed PID, or connection loss never authorizes replay.
 Ordinary shutdown and disconnect retain cancellation semantics.
 
+A daemon also restarts when its own installation changes. `serveRushDaemonAsync` records the identity (device,
+inode and birth time) of the folder it loaded the daemon from, of the Rush engine folder, and of their parents.
+Before each request it checks them. When one was removed, or another folder now has its path (a deleted snapshot,
+or a reinstalled `~/.rush` release), the daemon cannot load the rest of its code, so from then on it admits no
+more requests, and `pong` reports `installationChange`. Requests that it had already admitted finish. Each new or
+queued request, and each request that fails before it begins while the installation is changed (for example on a
+module that the daemon can no longer load), waits for them in the restart drain (see above), with queue positions
+that carry the `restartReason`. It then gets the typed `retryAfterRestart: true` result with
+`restartReason: { kind: 'installationChanged', change, folder }` instead of an early answer, so that its client
+does not wait for the old daemon to exit while a long build still runs. The drain's timeout rules are the same as
+for an environment: a client-default `waitTimeoutMs` does not limit waiting for the requests that were already
+being served when the wait began, as long as no rushx script is being served, and a timeout names the changed
+folder. A request that times out there, or that sets `noWait`, gets its admission error code and requests no
+restart. The first request that gets the result makes the daemon exit without selecting a successor, and each
+client starts one with its own launcher. A build or graph control request that waits to restart the daemon for its
+inputs checks the installation again once those waits end, just before it would select a successor, so a change
+during them gets the same result. So does a native `install` or `update` once its waits end, just before its worker
+starts. When the installation changes after that, while the worker runs or the successor is selected, the daemon
+exits after the mutation without selecting a successor, the mutation's output says so, and each request that is
+answered from then on gets the typed result. Embedded hosts opt in with `checkInstallation`
+(`captureDaemonInstallation`).
+The daemon log (`onLog`) gets one line for the change and one for each rejected request, with its code, its
+message and, for an unexpected `routingFailed`, the stack.
+
 Positively identified built-in `install` and `update` requests execute in `NativeMutationWorker`, a single-shot
 native Rush parser process owned by `GlobalCommandExecutionContext`. This is not the phased warm engine.
 Native arguments, policies, hooks, stdin/EOF, output and numeric exit status are preserved. Even a failed mutation
@@ -175,9 +329,21 @@ may have changed files: its exact result is drained before old generation cleanu
 Post-mutation state selects the successor. If the result cannot be drained or the selected version cannot be
 launched, the host stops without silently starting an incorrect successor. A mutation that started is never
 replayed, even after failure; an unstarted request can retry only through the typed pre-execution contract above.
-An ordinary nonzero mutation result still permits restart once its resources have joined. A failed worker
-join is different: its failure result drains, but the sticky workspace ownership barrier forbids both the
-host's successor and a competing client's auto-start, even after the result connection closes.
+A mutation that exits nonzero before it changed the installation keeps the daemon instead, for example one that
+fails on the Rush lock, on `common/scripts` or on its arguments. It keeps it only if every subspace's
+`last-install.flag` existed when the worker started and has the same file identity (device, inode, size and times)
+when it ends, since Rush deletes that flag before it changes the subspace and a reinstall writes the same content
+again; if the hotlink state records no link, since Rush unlinks those packages before it deletes the flag; if a
+fresh input capture, which compares the installation files as a build does, would not restart the daemon; and if the
+daemon's own installation did not change. It decides only once the worker's processes have joined, and it checks the
+flags, the hotlink state and its own installation again then, since a process that the worker started can still
+change them after the worker exits; a mutation whose worker could not be joined never keeps the daemon. The kept
+daemon selects no successor, even when the result could not be drained, and logs `rushd: "rush install" failed (exit
+code 1) before it changed the installation, so this daemon keeps running and reloads the workspace for the next
+request`. The mutation quiesced the warm set, so the next request that needs the graph reloads it, as after a reload
+that found the Rush lock busy. Any other nonzero mutation result still permits restart once its resources have
+joined. A failed worker join is different: its failure result drains, but the sticky workspace ownership barrier
+forbids both the host's successor and a competing client's auto-start, even after the result connection closes.
 
 The opt-in CLI forwards positively identified built-in `install` and `update` only to peers supporting protocol
 0.10. Other administrative commands remain native; Rushx script names are not reinterpreted as Rush built-ins.
@@ -196,15 +362,41 @@ this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
 ```
 
 The helper returns `undefined` for a delegate without lifecycle support. Explicit `invocationKind: "rushx"`
-requests retain a generation lease but go directly to the composite resolver, without native build/mutation/graph
-interception or phased environment matching. They use exclusive global admission. The host disposes each old
+requests go directly to the composite resolver, without native build/mutation/graph interception, phased
+environment matching, or workspace admission. A script uses its generation only to resolve, so it holds its
+generation lease only until it starts: a reload that another request needs never waits for a long-running script
+such as a dev server. A restart, a native `install` or `update`, and lifecycle disposal would end a running script,
+so they still wait for every running script to exit, and a planned restart counts a script as running work until it
+exits. While a request waits for them, its queue position is the number of scripts that still run, which is also its
+`scriptCount`, with the `restartReason` of a restart, or without one for a native `install` or `update`, which runs
+before its restart. A request that waits behind it meanwhile learns what it waits for: its queue position also counts
+those scripts and that request, and carries their `scriptCount`, `restartsForAnotherRequest: true` and the
+`restartReason` of the restart, or for a native `install` or `update` a `nativeMutation` reason that names the
+command. Its wait-timeout error names the same wait.
+A script that arrives while a restart is pending waits for the restart instead of starting.
+The host disposes each old
 resolver before replacing its session, and disposes the current resolver at shutdown; the composite must forward
 its normal disposer to its owned delegates.
 
 **Client integration boundary:** the resolver requires `commandOrigin: "built-in"` for native
-`build`/`rebuild`. The standalone client identifies these workspace commands while leaving
-`rushx build` and other script invocations custom. The resolver also validates the native parsed
-action; identical script names alone never authorize a workspace build.
+`build`/`rebuild` and `commandOrigin: "custom"` for the phased commands of command-line.json. The
+standalone client identifies these workspace commands while leaving `rushx build` and other script
+invocations custom. The resolver also validates the native parsed action; identical script names alone
+never authorize a workspace build. Commands share one graph where they can
+(`PhasedCommandEngine.getEngineSharingBlocker`). The graph of an incremental command serves another phased
+command if it has every operation of the phases that the request selects, both commands give the same arguments
+to the phases that the request can run, the same plugins are associated with both commands, and no plugin taps
+`runAnyPhasedCommand` or the `runPhasedCommand` hook of either command. So a `test` graph serves `build` and
+`rebuild`, and a `build` graph serves `rebuild`. The graph of a non-incremental command serves only that
+command. With `daemon.usePersistentIpcRunners`, no other graph serves a non-incremental command such as
+`rebuild` either, because persistent IPC runners serve only incremental commands. Any other built-in request
+reloads the graph. Any other custom request reloads it only if the new
+graph could serve the current graph's command, so that two commands never replace each other's graph on every
+request; otherwise, for example `retest` after `build`, it is rejected as unsupported and the client runs it
+in-process. Each request keeps its own admission class: an incremental custom command shares build admission
+like `build`; one with `"incremental": false` is exclusive and reruns its selection like `rebuild`. A global
+command, or a built-in command that is not phased, is rejected as unsupported before any workspace input is read,
+so the client runs it in-process.
 
 ### Explicit persistent Node operations
 
@@ -233,9 +425,11 @@ including on Windows. Descriptor args and non-ignored native custom parameter to
 quotes, spaces and shell metacharacters are not parsed or expanded. Native cwd, environment, IPC stdio and
 process ownership are preserved. No shell string is rewritten to obtain a launcher.
 
-Only unsharded incremental daemon builds use this path. Rebuild, ordinary/native fallback, empty/missing
-canonical scripts, and preassigned runners (including shard/collator and architectural NoOp nodes) retain their
-native behavior. Existing watch-only `:ipc` declarations and the graph's `isWatch` setting are unchanged.
+Only unsharded graphs of incremental commands use this path. A graph created by `rebuild`, ordinary/native
+fallback, empty/missing canonical scripts, and preassigned runners (including shard/collator and architectural
+NoOp nodes) retain their native behavior. A `rebuild` that the graph of an incremental command serves first closes
+the runners of the operations that it selects, so each one starts cold, as in a native `rush rebuild` process.
+Existing watch-only `:ipc` declarations and the graph's `isWatch` setting are unchanged.
 The existing `--no-ipc` is honored when the native command registers it. IPC runners remain **non-cacheable**,
 as in native watch mode; this is an explicit execution/cache-policy choice. Their hash still uses the native
 canonical command and non-ignored custom parameters, not an invented command identity.
@@ -303,9 +497,9 @@ preserves its records and diagnostics without failing an otherwise successful bu
 | Policy | Runtime behavior |
 | --- | --- |
 | `watch` | Retains host observation of requested warm projects between requests when true. False (the default) keeps root/config guards only. Never schedules builds. |
-| `warmIdleTimeoutSeconds` | Expires unused project runners, watchers and retained results after requests finish. Unchanged requests refresh recency too. |
+| `warmIdleTimeoutSeconds` | Expires unused project runners and watchers, together with those projects' retained results, after requests finish. Unchanged requests refresh recency too. Projects whose only retained state is operation results from resource-free (shell/null) runners do not expire: those results are revalidated on every request and stay until the generation ends, so an agent that returns after a long pause still gets no-op skips. |
 | `warmSetMaxProjects` | Limits the projects that hold warm **resources** (an active runner such as a persistent IPC child, or a `watch: true` file watcher). The lowest-ranked holders are released (runners closed, watchers removed, records deleted); executing/prepared and explicitly protected work is exempt. Projects whose only retained state is operation results from resource-free (shell/null) runners neither count toward nor are evicted for this limit, so no-op re-requests of large workspaces stay skipped. |
-| `warmMemoryBudgetMB` | Attempts idle eviction under sampled daemon-plus-measured-child RSS pressure. The comparison uses the **whole daemon process RSS** (graph, Node heap and retained records, typically 130-190 MiB) plus measured child RSS, so a budget below the daemon's baseline evicts every idle project on each pass and disables warm skipping. Never treats cache files as memory or claims a hard RSS ceiling. |
+| `warmMemoryBudgetMB` | Attempts idle eviction of resource-holding projects under sampled daemon-plus-measured-child RSS pressure. The comparison uses the **whole daemon process RSS** (graph, Node heap and retained records, typically 130-190 MiB for a small workspace and more for a large one) plus measured child RSS, so a budget below the daemon's baseline releases every idle runner and watcher on each pass. Retained results of resource-free projects are not evicted for the budget, so warm skipping keeps working, and the pressure warning is reported once per distinct state. Never treats cache files as memory or claims a hard RSS ceiling. |
 | `autoWarmByTelemetry` | Promotes already-requested high-value work instead of pure LRU. Never schedules or executes speculative scripts. |
 
 One deterministic best-first comparator is shared by retention and reverse-order eviction. With complete
@@ -374,6 +568,7 @@ the tier is not a command-success or successor-readiness signal. Older peers may
 | `generation`, `generationToken` | Provider generation counter and current installed session identity; neither implies a graph or successful build. |
 | `lastReloadTier` | Lifecycle-owned tier: `0` initial/reuse, `1` successful reload, `2` requested restart. |
 | `graphInitialized` | Whether that session has a materialized operation graph. |
+| `continuingOperations` | Present only while the running iteration runs just the operations that requests which already have their failed result left running (see below): how many are unfinished, and the first three of their names in name order. |
 | `warmSet` | Absent when no controller is attached, not a claim of zero memory. |
 | `warmSet.configuration` | The effective `watch` flag and four warm-resource knobs; older peers may omit `watch`. |
 | `maintenanceState`, `maintenanceFailure` | Running, quiescing, stopped, or failed maintenance; stopping maintenance alone does not free graph/watcher resources. |
@@ -447,28 +642,105 @@ the router validates both, reconciles retained invalidations, applies the select
 and runs at most one scheduled iteration. A workspace-wide `RequestScheduler` admits phased and global routes using
 the static built-in command policy (`SHARED-BUILD`, `SHARED-READ`, or `EXCLUSIVE`); custom-origin commands and unknown
 built-in names fail closed to `EXCLUSIVE`, including plugin replacements of built-in names. Queued clients receive
-ordered, one-based position controls and can request fail-fast or bounded waiting. One progress channel covers both
-workspace admission and the temporary phased graph-execution gate. An explicit `noWait` or `waitTimeoutMs` is one
-absolute deadline for both waits. When the client marks `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), the
-deadline bounds workspace admission only: a `SHARED-BUILD` request that arrives after the current batch has closed waits
-on the graph-execution gate without a deadline, because it is queued only behind running compatible shared builds, and
-then runs in the next batch. Cancellation, disconnect, or queue-output failure removes queued work before it can execute.
+ordered, one-based position controls and can request fail-fast or time-limited waiting. One progress channel covers
+both workspace admission and the temporary phased graph-execution gate. `noWait` fails at once wherever the request
+would wait. A finite `waitTimeoutMs` is a budget that only contention spends, whether it is the client's default or an
+explicit value. A request queued behind another request that holds exclusive workspace admission to load or reload
+the graph does not spend its budget during that load, so every build that arrives while the first build after startup
+loads the graph is admitted when the load finishes. That wait is limited separately, to 10 times `waitTimeoutMs`, so
+a load that never finishes does not hold the requests behind it indefinitely. The budget does run while that other
+request still waits for exclusive admission, so requests behind a reload that cannot start, for example behind a long
+build, still time out. The request's own work does not spend the budget either, before or after admission: capturing
+its inputs, loading or reloading the graph, routing and execution. Routing boundaries
+such as the graph-execution gate apply the remaining budget they receive, and a request that re-enters workspace
+admission to reload the graph after its inputs changed starts again from the budget it had when it was admitted; time
+it spent at those boundaries is not charged again. A timeout message at any boundary names the timeout that the
+client asked for rather than the remaining budget, and says how long the request waited behind another request's
+graph load without spending it. The default and an explicit value differ only at the
+graph-execution gate and at a restart drain (see "Process restart and isolated install/update"). When the client marks
+`waitTimeoutMs` as its default (`waitTimeoutIsDefault`), a `SHARED-BUILD` request that arrives after the current batch
+has closed waits at the graph-execution gate without a deadline, because it is queued only behind running compatible
+shared builds, and then runs in the next batch. An explicit value still limits that wait.
+Cancellation, disconnect, or queue-output failure removes queued work before it can execute.
 A requesting client receives only its enabled dependency closure's WS1 raw chunks and structured events through
 backpressured, ordered callbacks, followed exactly once by a typed final command result after all preceding output
 drains. The result translates only that client's operation subset to Rush's success, warning, failure, or abort exit
 semantics. Warning-only builds honor the operation's configured `allowWarningsInSuccessfulBuild` state plus the
 request's immutable `RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD` environment override without mutating `process.env`.
 Compatible phased `SHARED-BUILD` requests admitted before the next graph iteration starts are coalesced at a
-deterministic event-loop-turn boundary. The router reconciles retained invalidations once, unions the clients' enabled
-dependency closures, and schedules one iteration. Shared operations execute once, while each client subscribes only
-to its own closure and derives its final result only from that subset. A client does not wait for the other clients'
+deterministic event-loop-turn boundary. Requests are compatible when they have the same request settings and the same
+value of every environment variable that an operation of the graph lists in `dependsOnEnvVars` (an unset variable and
+an empty one hash alike, so they count as the same value), because
+a shared operation runs once, in the environment of the first request that selected it. Iteration hooks get the
+same attribution: `getOperationRequestId` returns the `requestId` of the request whose environment
+`getOperationEnvironment` returns for an operation. The router reconciles
+retained invalidations once, unions the clients' enabled dependency closures, and schedules one iteration. Shared
+operations execute once, while each client subscribes only to its own closure and derives its final result only from
+that subset. A client does not wait for the other clients'
 larger selections: once every operation of its own closure that the iteration scheduled has completed and its output
 has drained, its result is published while the iteration, graph lease, and native execution lease continue for the
 remaining clients. The last client that still needs the iteration receives its result after iteration end and lease
 release, as for a single client. An early result is not published when any of the client's operations was aborted;
 iteration-wide failures that occur after an early result are reported only to the remaining clients. Requests
 admitted after scheduling starts form a later batch. Cancelling or disconnecting one client removes its subscription without aborting work needed by other
-clients; the graph iteration is aborted only after every client in that batch has stopped needing it.
+clients. From then on, operations that only departed clients needed and that have not been handed to an execution slot
+finish as skipped without running, like operations that no client selected. The graph iteration is aborted once every
+client in that batch has stopped needing it, or once every operation that a remaining client needs has finished while
+work that only departed clients needed is still running. In the latter case the running operations are terminated, so
+neither the remaining client's result nor later requests wait for work that nobody needs.
+
+With the experimental `daemon.joinRunningBatch` setting (`RUSH_DAEMON_JOIN_RUNNING_BATCH=1` in the daemon's
+environment), a request admitted after scheduling starts can instead join the executing iteration, if it has the
+batch's request settings and no other request waits for the graph. Such a batch's iteration holds the operations that
+no participant needs, instead of skipping them, until its other operations complete. A request that arrives before the
+iteration dispatches operations, for example while the batch reconciles its inputs, first waits for it to start, as it
+would wait for the running build otherwise: an explicit wait timeout limits that wait and counts it, and a request
+with `noWait` does not wait and does not join. When a request joins, the router
+reads its inputs again, and the graph adds its operations to the executing iteration (`tryExtendCurrentIteration`),
+so that operations that both requests need run once. The request then takes part in the batch like any other
+participant, but does not receive output that operations wrote before it joined. If the graph can't take the
+request's work, for example because an operation that the request needs started before its inputs changed, nothing
+changes and the request runs in a later batch as if it had not tried to join. The daemon writes one line per attempt
+to its stderr:
+`Request <id> joined the executing iteration after <n> ms.` or `Request <id> did not join the executing iteration
+after <n> ms: <reason>`.
+
+A `SHARED-BUILD` request that sets `returnEarlyOnFailure` (agent output does) gets its failed result as soon as nothing
+unfinished can change it. Its operations that the failure did not block keep running until the iteration ends, so that
+later requests find them done, and the request keeps its admission until then. While the iteration runs only such
+operations, each request that waits for the graph gets a queue position with `continuingOperations`: how many of them
+are unfinished, and the first three of their names in name order. It gets another position each time that number
+gets smaller, so it never names an operation that has ended. The workspace status reports the same field meanwhile.
+Neither field is present while any request still waits for the iteration's result. Before the daemon rejects a
+request as unsupported, so that its client runs the command in-process, it stops such operations and waits until they
+have stopped, unless the command is a Rushx script or a built-in command that only reads the workspace, such as
+`list`. If it stopped all of them while the client still waited, the second line of the rejection names them, for
+example `rushd stopped 2 operations left running by an earlier failed command (a (build), b (build)), so that this
+command can run in-process.` The client prints that line under its fallback line.
+
+With the experimental `daemon.backgroundPrepare` setting (`RUSH_DAEMON_BACKGROUND_PREPARE=1` in the daemon's
+environment), an idle daemon reloads the generation before the next request needs it. The daemon keeps the command
+line (name, origin, argv and working directory) of the last phased command that it served, but not the client's
+environment or terminal: a preparation uses the daemon's own environment. Each change that the workspace watcher
+reports starts a 2-second quiet period. After it, the daemon captures the workspace inputs and classifies them as that
+command's next request would, from the fingerprint alone. If that request would reload (tier 1), the daemon takes
+native Rush's lock without waiting, then quiesces the warm set, loads the new session and creates the engine for that
+command line, as a request's reload does, but runs no operation and keeps no result. It writes
+`rushd: prepared "rush <argv>" in the background (background-prepare-<n>) in <n> ms` to its log. A request with the
+same command line, working directory and environment, as far as the fingerprint reads it, waits for the preparation as
+behind any reload, with its wait budget paused, and then starts on the new generation (tier 0). Any other request,
+including a Rushx script or a graph request, stops the preparation at its next step (a step that has started runs to
+its end) and then runs as before; once the preparation has quiesced the warm set, that request or the next one
+reloads. After a preparation stops, or when the inputs change while it loads, the daemon checks again once it is idle
+and a quiet period has passed. A preparation starts only while no request, Rushx script, reload or restart is active
+or waits, and not while another Rush process holds the lock: the daemon then checks again after 2 seconds, and after
+twice as long each time, up to 60 seconds. It never restarts the daemon (tier 2, for example after a lockfile
+changes), and it does not act on a change that the watcher cannot attribute to a path, on an unhealthy watcher, or on
+inputs that the watcher does not observe, such as the files of projects that it doesn't watch or inherited rig
+settings; the next request still detects all of these. After a preparation fails for another reason, for example
+because the new configuration requires `--no-daemon`, nothing is prepared until the daemon serves a phased command
+again. While a preparation runs, native Rush commands find the lock taken, as they do during any reload, and a
+`--no-wait` request fails at once.
 
 The typed phased router remains separate from native initialization. `ProductionDaemonRequestResolver` supplies
 validated exact selections from `PhasedCommandEngine`; other integrations retain the existing dependency-closure
diff --git a/libraries/rush-daemon/config/jest.config.json b/libraries/rush-daemon/config/jest.config.json
index d1749681d90..97e21dc59e0 100644
--- a/libraries/rush-daemon/config/jest.config.json
+++ b/libraries/rush-daemon/config/jest.config.json
@@ -1,3 +1,6 @@
 {
-  "extends": "local-node-rig/profiles/default/config/jest.config.json"
+  "extends": "local-node-rig/profiles/default/config/jest.config.json",
+
+  // Delete the environment variables that can hold a secret before each test file loads
+  "setupFiles": ["../lib-commonjs/test/RemoveSecretEnvironmentVariables.js"]
 }
diff --git a/libraries/rush-daemon/package.json b/libraries/rush-daemon/package.json
index 0ed99a23dfa..751e9107d10 100644
--- a/libraries/rush-daemon/package.json
+++ b/libraries/rush-daemon/package.json
@@ -56,6 +56,9 @@
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",
+    "@rushstack/rush-amazon-s3-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-azure-storage-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-http-build-cache-plugin": "workspace:*",
     "eslint": "~9.37.0",
     "local-node-rig": "workspace:*"
   },
diff --git a/libraries/rush-daemon/src/BackgroundPreparationScheduler.ts b/libraries/rush-daemon/src/BackgroundPreparationScheduler.ts
new file mode 100644
index 00000000000..5f82127efa0
--- /dev/null
+++ b/libraries/rush-daemon/src/BackgroundPreparationScheduler.ts
@@ -0,0 +1,227 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getWorkspaceFingerprintEnvironmentEntries } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import type { IWorkspaceSession } from './WorkspaceSession';
+
+/** A background preparation is due once the watched workspace inputs have not changed for this long. */
+export const BACKGROUND_PREPARE_QUIET_MS: number = 2000;
+/**
+ * While another Rush process holds the repository's lock, a background preparation is due again after this long, and
+ * then after twice as long each time, up to `BACKGROUND_PREPARE_MAX_RETRY_MS`.
+ */
+const BACKGROUND_PREPARE_FIRST_RETRY_MS: number = 2000;
+const BACKGROUND_PREPARE_MAX_RETRY_MS: number = 60_000;
+
+/** The command line that a background preparation binds, and the session that served it. */
+export interface IPreparationHint {
+  readonly session: IWorkspaceSession;
+  readonly envelope: IDaemonRequestEnvelope;
+}
+
+/** A state of the workspace and its generation, in which a background preparation found nothing to do. */
+export interface IPreparationCheck {
+  readonly session: IWorkspaceSession;
+  /** The invalidation sequence of `session`. */
+  readonly sequence: number;
+  readonly boundSession: IWorkspaceSession | undefined;
+  readonly forceReload: boolean;
+}
+
+export interface IBackgroundPreparationSchedulerOptions {
+  /** The environment of every background preparation. */
+  readonly environment: Readonly<Record<string, string>>;
+  /** Checks whether to start a background preparation now. */
+  readonly checkAsync: () => Promise<void>;
+  readonly onLog?: (message: string) => void;
+}
+
+export class BackgroundPreparationBusyError extends Error {
+  public constructor() {
+    super("Another Rush process holds this repository's lock.");
+  }
+}
+
+/**
+ * Keeps the command line of the last phased command that a daemon served, if its workspace turns
+ * `daemon.backgroundPrepare` on, and calls `checkAsync` when a background preparation may be due: once the watched
+ * workspace inputs have been quiet for `BACKGROUND_PREPARE_QUIET_MS`, once the daemon is idle again after it was busy
+ * when a check was due, and again later while another Rush process holds the repository's lock.
+ */
+export class BackgroundPreparationScheduler {
+  readonly #environment: Readonly<Record<string, string>>;
+  readonly #checkAsync: () => Promise<void>;
+  readonly #onLog: ((message: string) => void) | undefined;
+  #hint: IPreparationHint | undefined;
+  #unsubscribe: (() => void) | undefined;
+  #timer: NodeJS.Timeout | undefined;
+  /** Set when a check was due while the daemon was busy; it is due again once the daemon is idle. */
+  #deferred: boolean = false;
+  #checked: IPreparationCheck | undefined;
+  /** The last wait before a check that is due for a busy lock, or 0 after any other outcome. */
+  #retryMs: number = 0;
+  #closed: boolean = false;
+
+  public constructor(options: IBackgroundPreparationSchedulerOptions) {
+    this.#environment = options.environment;
+    this.#checkAsync = options.checkAsync;
+    this.#onLog = options.onLog;
+  }
+
+  public get hint(): IPreparationHint | undefined {
+    return this.#hint;
+  }
+
+  /**
+   * Keeps the command line of a phased command that was served on `session`, if the workspace turns
+   * `daemon.backgroundPrepare` on, and otherwise forgets any. A preparation runs with the daemon's own environment and
+   * no terminal, so nothing else of the client's request is kept. For a new session, `capturedSequence` is its
+   * invalidation sequence when its inputs were last captured: a change that the watcher reported after that, before
+   * this call, is due for a check too.
+   */
+  public remember(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    capturedSequence?: number
+  ): void {
+    if (this.#closed || !session.rushConfiguration.daemon.backgroundPrepare) {
+      this.forget();
+      return;
+    }
+    const isNewSession: boolean = this.#hint?.session !== session;
+    if (isNewSession) {
+      this.#unsubscribe?.();
+      this.#unsubscribe = session.invalidations.subscribe(() => this.#arm(BACKGROUND_PREPARE_QUIET_MS));
+      this.#checked = undefined;
+    }
+    const { argv, commandName, commandOrigin, cwd, invocationKind } = envelope;
+    this.#hint = {
+      session,
+      envelope: {
+        requestId: '',
+        argv: [...argv],
+        commandName,
+        commandOrigin,
+        cwd,
+        ...(invocationKind !== undefined && { invocationKind }),
+        environment: this.#environment,
+        terminal: { isTTY: false, supportsColor: false }
+      }
+    };
+    if (
+      isNewSession &&
+      capturedSequence !== undefined &&
+      session.invalidations.getSnapshot().sequence > capturedSequence
+    ) {
+      this.#arm(BACKGROUND_PREPARE_QUIET_MS);
+    }
+  }
+
+  /** Until a phased command is served again, nothing is prepared in the background. */
+  public forget(): void {
+    this.#unsubscribe?.();
+    this.#unsubscribe = undefined;
+    this.#hint = undefined;
+    this.#checked = undefined;
+    this.#deferred = false;
+    this.#retryMs = 0;
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+  }
+
+  public close(): void {
+    this.#closed = true;
+    this.forget();
+  }
+
+  /** Whether `check` is the state in which a check last found nothing to do. */
+  public isChecked(check: IPreparationCheck): boolean {
+    const checked: IPreparationCheck | undefined = this.#checked;
+    return (
+      checked !== undefined &&
+      checked.session === check.session &&
+      checked.sequence === check.sequence &&
+      checked.boundSession === check.boundSession &&
+      checked.forceReload === check.forceReload
+    );
+  }
+
+  /** Records that nothing is to be done in the state `check`, until the workspace or its generation changes. */
+  public markChecked(check: IPreparationCheck): void {
+    this.#checked = check;
+    this.#retryMs = 0;
+  }
+
+  /** Ends a wait for another Rush process. */
+  public markPrepared(): void {
+    this.#retryMs = 0;
+  }
+
+  /** Checks again once the daemon is idle; see `resume`. */
+  public defer(): void {
+    this.#deferred = true;
+  }
+
+  /** Arms a check that was due while the daemon was busy, if the daemon is idle now. */
+  public resume(isIdle: boolean): void {
+    if (!this.#deferred || !isIdle) return;
+    this.#deferred = false;
+    this.#arm(BACKGROUND_PREPARE_QUIET_MS);
+  }
+
+  /** Checks again later while another Rush process holds the repository's lock, waiting twice as long each time. */
+  public retry(): void {
+    if (this.#retryMs === 0) {
+      this.#onLog?.(
+        "rushd: another Rush process holds this repository's lock; the daemon prepares in the background " +
+          'once that process releases it'
+      );
+    }
+    this.#retryMs =
+      this.#retryMs === 0
+        ? BACKGROUND_PREPARE_FIRST_RETRY_MS
+        : Math.min(this.#retryMs * 2, BACKGROUND_PREPARE_MAX_RETRY_MS);
+    this.#arm(this.#retryMs);
+  }
+
+  #arm(delayMs: number): void {
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+    if (this.#closed || !this.#hint) return;
+    this.#timer = setTimeout(() => {
+      this.#timer = undefined;
+      void this.#checkAsync().catch((error: unknown) => {
+        this.#onLog?.(
+          `rushd: could not check whether to prepare in the background: ${getErrorMessage(error)}`
+        );
+      });
+    }, delayMs);
+    this.#timer.unref();
+  }
+}
+
+/** Whether two requests have the same command line and working directory. */
+export function isSameCommandLine(envelope: IDaemonRequestEnvelope, other: IDaemonRequestEnvelope): boolean {
+  return (
+    envelope.commandName === other.commandName &&
+    envelope.commandOrigin === other.commandOrigin &&
+    envelope.invocationKind === other.invocationKind &&
+    envelope.cwd === other.cwd &&
+    envelope.argv.length === other.argv.length &&
+    envelope.argv.every((arg: string, index: number) => arg === other.argv[index])
+  );
+}
+
+/** The parts of an environment that a workspace input capture reads, normalized as every fingerprint comparison is. */
+export function getCaptureEnvironmentKey(environment: Readonly<Record<string, string | undefined>>): string {
+  return JSON.stringify([
+    environment.RUSH_PREVIEW_VERSION ?? null,
+    getWorkspaceFingerprintEnvironmentEntries(environment)
+  ]);
+}
+
+export function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/libraries/rush-daemon/src/ConnectingClientTracker.ts b/libraries/rush-daemon/src/ConnectingClientTracker.ts
new file mode 100644
index 00000000000..fac35422ac8
--- /dev/null
+++ b/libraries/rush-daemon/src/ConnectingClientTracker.ts
@@ -0,0 +1,124 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/** One connection that the daemon accepted, until it sends its first request or starts closing. */
+export interface IConnectingClient {
+  /** Records that the daemon read a frame from the connection or finished writing one to it. */
+  touch(): void;
+  /** Stops tracking the connection, because it sent its first request or is closing. */
+  settle(): void;
+}
+
+/** Options for {@link ConnectingClientTracker}. */
+export interface IConnectingClientTrackerOptions {
+  /** How long after its latest activity a connection still counts as connecting. */
+  readonly idleLimitMs?: number;
+  /** The longest that one call to {@link ConnectingClientTracker.waitAsync} waits. */
+  readonly waitLimitMs?: number;
+}
+
+// A client sends its next handshake frame as soon as it reads the daemon's reply, so a connection that neither sent
+// a frame nor got one for this long is not about to send a request.
+const DEFAULT_IDLE_LIMIT_MS: number = 100;
+// What a batch of shared builds may spend waiting before its reconcile, so that a stalled client costs little.
+const DEFAULT_WAIT_LIMIT_MS: number = 100;
+
+/**
+ * Tracks the connections that the daemon accepted and that have not sent a request yet, so that a batch of shared
+ * builds can wait for their requests before its input reconcile starts.
+ *
+ * @remarks
+ * A client exchanges hello, subscribe and ping with the daemon before it sends its request. Each exchange waits
+ * while the daemon is busy, for example preparing another request, so a client that connected before a batch
+ * closed can send its request after the batch's reconcile started. That request cannot join the batch; it waits for
+ * the batch to finish, then reconciles again. Waiting for such clients first lets their requests join the batch.
+ */
+export class ConnectingClientTracker {
+  readonly #idleLimitMs: number;
+  readonly #waitLimitMs: number;
+  readonly #lastActivityTimeMs: Map<IConnectingClient, number> = new Map();
+  readonly #waiters: Set<() => void> = new Set();
+
+  public constructor(options: IConnectingClientTrackerOptions = {}) {
+    this.#idleLimitMs = options.idleLimitMs ?? DEFAULT_IDLE_LIMIT_MS;
+    this.#waitLimitMs = options.waitLimitMs ?? DEFAULT_WAIT_LIMIT_MS;
+  }
+
+  /** Starts tracking a connection that the daemon has just accepted. */
+  public add(): IConnectingClient {
+    const client: IConnectingClient = {
+      touch: () => {
+        if (this.#lastActivityTimeMs.has(client)) {
+          this.#lastActivityTimeMs.set(client, performance.now());
+        }
+      },
+      settle: () => {
+        if (this.#lastActivityTimeMs.delete(client)) {
+          for (const wake of Array.from(this.#waiters)) wake();
+        }
+      }
+    };
+    this.#lastActivityTimeMs.set(client, performance.now());
+    return client;
+  }
+
+  /**
+   * Resolves once no tracked connection had activity within the idle limit, or once the wait limit has passed.
+   *
+   * @remarks
+   * It first lets the event loop poll for I/O, which accepts the connections that wait in the listening socket's
+   * backlog, so that they are tracked too. Before it decides that a connection is idle, it lets the event loop poll
+   * again, so that frames that arrived while the daemon was busy are read first, and replies that waited for the
+   * event loop finish writing first.
+   */
+  public async waitAsync(): Promise<void> {
+    await waitForPollAsync();
+    const deadlineMs: number = performance.now() + this.#waitLimitMs;
+    for (;;) {
+      const nowMs: number = performance.now();
+      const idleTimeMs: number | undefined = this.#getIdleTimeMs();
+      if (idleTimeMs === undefined || idleTimeMs <= nowMs || deadlineMs <= nowMs) {
+        return;
+      }
+      await this.#waitForSettleAsync(Math.min(idleTimeMs, deadlineMs) - nowMs);
+      if (this.#lastActivityTimeMs.size > 0) {
+        await waitForPollAsync();
+      }
+    }
+  }
+
+  /** When the tracked connection with the latest frame becomes idle, or undefined if none is tracked. */
+  #getIdleTimeMs(): number | undefined {
+    let latestMs: number | undefined;
+    for (const timeMs of this.#lastActivityTimeMs.values()) {
+      if (latestMs === undefined || timeMs > latestMs) {
+        latestMs = timeMs;
+      }
+    }
+    return latestMs === undefined ? undefined : latestMs + this.#idleLimitMs;
+  }
+
+  /** Resolves when a tracked connection settles or after `timeoutMs`, whichever comes first. */
+  async #waitForSettleAsync(timeoutMs: number): Promise<void> {
+    let wake: () => void = () => undefined;
+    const woken: Promise<void> = new Promise<void>((resolve) => {
+      wake = resolve;
+    });
+    this.#waiters.add(wake);
+    const timeout: ReturnType<typeof setTimeout> = setTimeout(wake, timeoutMs);
+    try {
+      await woken;
+    } finally {
+      clearTimeout(timeout);
+      this.#waiters.delete(wake);
+    }
+  }
+}
+
+/** Resolves after the event loop has polled for I/O at least once since the call. */
+async function waitForPollAsync(): Promise<void> {
+  // Called while the event loop handles I/O, the first immediate runs before the loop polls again, so the poll that
+  // it follows can have started before the call. The second immediate follows a poll that started after it.
+  await new Promise<void>((resolve) => setImmediate(resolve));
+  await new Promise<void>((resolve) => setImmediate(resolve));
+}
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 51f9bff38ad..f3f542203f0 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -10,6 +10,7 @@ import {
   DAEMON_PROTOCOL_VERSION,
   DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR,
   DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR,
   DaemonFrameType,
   DaemonProtocolError,
   decodeDaemonControlMessage,
@@ -21,18 +22,24 @@ import type {
   DaemonRequestRejectionCode,
   IDaemonErrorMessage,
   IDaemonFrame,
+  IDaemonInstallationChange,
   IDaemonPongMessage,
   IDaemonRequestEnvelope,
   IDaemonWorkspaceStatus
 } from '@rushstack/rush-daemon-protocol';
+import { DaemonTransportError, DaemonTransportErrorCode } from '@rushstack/rush-daemon-transport';
 import type { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
+import { createGlobalCommandResult } from './CommandResultPolicy';
+import type { ConnectingClientTracker, IConnectingClient } from './ConnectingClientTracker';
 import { DaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
 import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
+import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import type { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
-import type { DaemonShutdownError } from './DaemonShutdownError';
+import { readResidentMemoryBytes } from './DaemonResidentMemory';
+import { DaemonShutdownError, getRequestShutdownReason } from './DaemonShutdownError';
 import { DaemonWireRequestClient } from './DaemonWireRequestClient';
 import {
   InteractiveInputRoutingError,
@@ -52,13 +59,26 @@ export interface IDaemonControlSessionOptions {
   readonly onShutdownRequested: () => void;
   /** Counts requests running on every connection, reported in the shutdown acknowledgement. */
   readonly getActiveRequestCount?: () => number;
-  readonly getWorkspaceStatus?: () => IDaemonWorkspaceStatus;
+  /** Reads the status that `pong` reports, without the warm set when the ping asked to leave it out. */
+  readonly getWorkspaceStatus?: (omitWarmSet: boolean) => IDaemonWorkspaceStatus;
+  /** Reports a removed or replaced installation in `pong`. */
+  readonly checkInstallation?: () => IDaemonInstallationChange | undefined;
+  /**
+   * Receives a message for the daemon log for each rejected request, and for each reply that could not reach a
+   * client because the client went away.
+   */
+  readonly onLog?: (message: string) => void;
+  /** Tracks this connection until it sends its first request or starts closing. */
+  readonly connectingClients?: ConnectingClientTracker;
 }
 
 interface IRequestState {
   readonly abortController: AbortController;
   readonly client: DaemonWireRequestClient;
   completion: Promise<void>;
+  /** The quoted command line, for reports about requests that did not finish. */
+  readonly description: string;
+  readonly startedAtMs: number;
 }
 
 interface IClassifiedRejection {
@@ -67,6 +87,11 @@ interface IClassifiedRejection {
 }
 
 const CLOSE_DRAIN_TIMEOUT_MS: number = 5000;
+// How long the typed results for requests that did not stop get to reach their clients before the connection is
+// aborted.
+const SHUTDOWN_RESULT_SEND_TIMEOUT_MS: number = 1000;
+const MAX_REQUEST_DESCRIPTION_LENGTH: number = 100;
+const MS_PER_SECOND: number = 1000;
 
 export class DaemonControlSession {
   readonly #connection: DaemonFrameConnection;
@@ -76,6 +101,8 @@ export class DaemonControlSession {
   readonly #completedRequestIds: Set<string> = new Set();
   readonly #closedPromise: Promise<void>;
   readonly #resolveClosed: () => void;
+  readonly #connectingClient: IConnectingClient | undefined;
+  #clientGone: boolean = false;
   #closePromise: Promise<void> | undefined;
   #connectionClosed: boolean = false;
   #handshakeComplete: boolean = false;
@@ -86,6 +113,7 @@ export class DaemonControlSession {
   #peerSupportsDaemonLifecycle: boolean = false;
   #peerSupportsRequestAdmission: boolean = false;
   #peerSupportsRequestLifecycle: boolean = false;
+  #peerSupportsRequestStarted: boolean = false;
   #sendQueue: Promise<void> = Promise.resolve();
   #sessionId: string | undefined;
   #subscribed: boolean = false;
@@ -93,6 +121,7 @@ export class DaemonControlSession {
   public constructor(connection: DaemonFrameConnection, options: IDaemonControlSessionOptions) {
     this.#connection = connection;
     this.#options = options;
+    this.#connectingClient = options.connectingClients?.add();
     const closed: ReturnType<typeof createDeferred> = createDeferred();
     this.#closedPromise = closed.promise;
     this.#resolveClosed = closed.resolve;
@@ -107,6 +136,13 @@ export class DaemonControlSession {
   }
 
   public closeAsync(drainRequests: boolean = false, reason?: DaemonShutdownError): Promise<void> {
+    // Unlike a disconnect, closing the session also stops the work that a request still runs after it sent its
+    // result (a failed build that returned early). No client waits for a restart result from such a request.
+    for (const state of this.#requestById.values()) {
+      if (state.client.terminalOutcomeSent) {
+        state.abortController.abort(reason ?? new Error('The daemon control session is closing.'));
+      }
+    }
     this.#closePromise ??= this.#closeOnceAsync(drainRequests, reason);
     return this.#closePromise;
   }
@@ -115,7 +151,17 @@ export class DaemonControlSession {
     return this.#requestById.size;
   }
 
+  /** Describes each request that has not finished, such as `"build -t a" (running for 12.3 s)`. */
+  public describeActiveRequests(): string[] {
+    const nowMs: number = Date.now();
+    return Array.from(this.#requestById.values(), (state: IRequestState) => {
+      const runningSeconds: string = ((nowMs - state.startedAtMs) / MS_PER_SECOND).toFixed(1);
+      return `${state.description} (running for ${runningSeconds} s)`;
+    });
+  }
+
   async #handleFrameSafelyAsync(frame: IDaemonFrame): Promise<void> {
+    this.#connectingClient?.touch();
     try {
       await this.#onFrameAsync(frame);
     } catch (error) {
@@ -125,6 +171,9 @@ export class DaemonControlSession {
 
   async #onFrameAsync(frame: IDaemonFrame): Promise<void> {
     if (this.#isClosing) {
+      // A client may ping at any time while its request runs. The request's own result, or the closed connection,
+      // answers it; an error sent now could reach the client before that result.
+      if (isPingFrame(frame)) return;
       throw new DaemonProtocolError('malformedControlMessage', 'The daemon session is closing.');
     }
     if (frame.kind === DaemonFrameType.stdin) {
@@ -166,7 +215,7 @@ export class DaemonControlSession {
         this.#handleSubscribe(message.payload);
         return;
       case 'ping':
-        this.#send(this.#createPong());
+        this.#send(this.#createPong(message.payload.omitWarmSet === true));
         return;
       case 'shutdown':
         await this.#shutdownHostAsync();
@@ -217,6 +266,7 @@ export class DaemonControlSession {
     this.#peerSupportsDaemonLifecycle = peerMinor >= DAEMON_LIFECYCLE_PROTOCOL_MINOR;
     this.#peerSupportsRequestAdmission = peerMinor >= DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR;
     this.#peerSupportsRequestLifecycle = peerMinor >= DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR;
+    this.#peerSupportsRequestStarted = peerMinor >= DAEMON_REQUEST_STARTED_PROTOCOL_MINOR;
     this.#send(outcome.ack);
   }
 
@@ -232,6 +282,8 @@ export class DaemonControlSession {
       this.#peerSupportsRequestAdmission && payload.supportsRequestAdmission === true;
     this.#peerSupportsRequestLifecycle =
       this.#peerSupportsRequestLifecycle && payload.supportsRequestLifecycle === true;
+    this.#peerSupportsRequestStarted =
+      this.#peerSupportsRequestStarted && payload.supportsRequestStarted === true;
     this.#peerSupportsInputLifecycle =
       this.#peerSupportsInputLifecycle && payload.supportsInputLifecycle === true;
     this.#interactiveConnection.setEnabled(
@@ -255,10 +307,16 @@ export class DaemonControlSession {
       payload: activeRequests === undefined ? {} : { activeRequests }
     });
     this.#options.onShutdownRequested();
-    await ackPromise;
+    try {
+      await ackPromise;
+    } catch (error) {
+      if (!this.#isClientGone(error)) throw error;
+      await this.#handleSendFailureAsync(error, 'the shutdownAck');
+    }
   }
 
   #startRequest(envelope: IDaemonRequestEnvelope): void {
+    const receivedTimeMs: number = performance.now();
     this.#assertRequestLifecycleReady();
     const requestId: string = envelope.requestId;
     if (this.#requestById.has(requestId) || this.#completedRequestIds.has(requestId)) {
@@ -294,17 +352,28 @@ export class DaemonControlSession {
       requestId
     });
     const sessionId: string = this.#sessionId!;
+    const connectingClients: ConnectingClientTracker | undefined = this.#options.connectingClients;
     const client: DaemonWireRequestClient = new DaemonWireRequestClient({
       abortSignal: abortController.signal,
       getNextEventSequence: () => this.#getNextEventSequence(),
       interactiveSession,
+      receivedTimeMs,
       requestId,
       sendControlAsync: (message: DaemonControlMessage) => this.#enqueueControlAsync(message),
+      sendControlWrittenAsync: (message: DaemonControlMessage) => this.#enqueueControlWrittenAsync(message),
       sendFrameAsync: (frame: IDaemonFrame) => this.#enqueueFrameAsync(frame),
       sessionId,
-      supportsRequestAdmission: this.#peerSupportsRequestAdmission
+      supportsRequestAdmission: this.#peerSupportsRequestAdmission,
+      supportsRequestStarted: this.#peerSupportsRequestStarted,
+      waitForConnectingClientsAsync: connectingClients && (() => connectingClients.waitAsync())
     });
-    const state: IRequestState = { abortController, client, completion: Promise.resolve() };
+    const state: IRequestState = {
+      abortController,
+      client,
+      completion: Promise.resolve(),
+      description: describeRequest(envelope),
+      startedAtMs: Date.now()
+    };
     this.#requestById.set(requestId, state);
     const releaseActivity: (() => void) | undefined = this.#options.onRequestStarted?.();
     state.completion = Promise.resolve()
@@ -313,7 +382,11 @@ export class DaemonControlSession {
         this.#completeRequest(requestId, state);
         releaseActivity?.();
       });
-    void state.completion.catch((error: unknown) => this.#handleSendFailureAsync(error));
+    void state.completion.catch((error: unknown) =>
+      this.#handleSendFailureAsync(error, `the result of ${state.description}`)
+    );
+    // The request has its receipt time, so a batch that waits for this connection can now close.
+    this.#connectingClient?.settle();
   }
 
   #getNextEventSequence(): number {
@@ -353,7 +426,26 @@ export class DaemonControlSession {
       dispatchError = combineErrors(dispatchError, cleanupError);
     }
     if (dispatchError !== undefined && !state.client.terminalOutcomeSent && !this.#connectionClosed) {
+      if (dispatchError instanceof DaemonRequestUsageError) {
+        // Native Rush reports an invalid command line and exits, so the client must not run it in-process.
+        const { exitCode, message, usage } = dispatchError;
+        await state.client.writeResultAsync({
+          requestId: envelope.requestId,
+          exitCode,
+          outcome: 'failure',
+          aborted: state.abortController.signal.aborted,
+          errorMessage: message,
+          ...(usage === undefined ? {} : { usage })
+        });
+        return;
+      }
       const rejection: IClassifiedRejection = classifyRejection(dispatchError);
+      // The client prints only the message; keep the rest where `rush-client daemon logs` finds it.
+      this.#options.onLog?.(
+        `rushd: rejected request ${envelope.requestId} (${rejection.code}): ${
+          rejection.code === 'routingFailed' ? describeError(dispatchError) : rejection.message
+        }`
+      );
       await state.client.writeRejectionAsync(rejection.code, rejection.message);
     }
   }
@@ -382,15 +474,16 @@ export class DaemonControlSession {
     }
   }
 
-  #createPong(): IDaemonPongMessage {
+  #createPong(omitWarmSet: boolean): IDaemonPongMessage {
     return {
       kind: 'pong',
       payload: {
         daemonVersion: this.#options.daemonVersion,
         protocolVersion: DAEMON_PROTOCOL_VERSION,
         pid: process.pid,
-        residentMemoryBytes: process.memoryUsage().rss,
-        workspace: this.#options.getWorkspaceStatus?.(),
+        residentMemoryBytes: readResidentMemoryBytes(),
+        workspace: this.#options.getWorkspaceStatus?.(omitWarmSet),
+        installationChange: this.#options.checkInstallation?.(),
         uptimeMs: Date.now() - this.#options.startedAtMs
       }
     };
@@ -398,7 +491,7 @@ export class DaemonControlSession {
 
   #send(message: DaemonControlMessage, closeAfterSend: boolean = false): void {
     void this.#enqueueControlAsync(message, closeAfterSend).catch((error: unknown) =>
-      this.#handleSendFailureAsync(error)
+      this.#handleSendFailureAsync(error, `the ${message.kind}`)
     );
   }
 
@@ -409,10 +502,31 @@ export class DaemonControlSession {
     );
   }
 
-  #enqueueFrameAsync(frame: IDaemonFrame, closeAfterSend: boolean = false): Promise<void> {
+  /** Like `#enqueueControlAsync`, but resolves only once the operating system holds the whole frame. */
+  #enqueueControlWrittenAsync(message: DaemonControlMessage): Promise<void> {
+    return this.#enqueueFrameAsync(
+      { kind: DaemonFrameType.controlJson, payload: encodeDaemonControlMessage(message) },
+      false,
+      true
+    );
+  }
+
+  #enqueueFrameAsync(
+    frame: IDaemonFrame,
+    closeAfterSend: boolean = false,
+    written: boolean = false
+  ): Promise<void> {
     const sendPromise: Promise<void> = this.#sendQueue
-      .then(() => this.#connection.sendFrameAsync(frame))
-      .then(() => (closeAfterSend ? this.#connection.closeAsync() : undefined));
+      .then(() =>
+        written ? this.#connection.sendFrameWrittenAsync(frame) : this.#connection.sendFrameAsync(frame)
+      )
+      .then(() => {
+        // Before its request, a client waits for each reply. A large reply (the pong carries the warm set status)
+        // finishes writing only when the event loop runs, so a busy daemon can write it long after the client's
+        // last frame. Its client must not count as idle before it could read the reply.
+        this.#connectingClient?.touch();
+        return closeAfterSend ? this.#connection.closeAsync() : undefined;
+      });
     this.#sendQueue = sendPromise.catch(() => undefined);
     return sendPromise;
   }
@@ -436,24 +550,54 @@ export class DaemonControlSession {
     await this.#closeWithReasonAsync(error);
   }
 
-  async #handleSendFailureAsync(error: unknown): Promise<void> {
+  /** Reports a failed send and closes the session. `reply` names what was lost, such as `the pong`. */
+  async #handleSendFailureAsync(error: unknown, reply: string): Promise<void> {
     const normalizedError: Error = normalizeError(error);
-    this.#options.onError(normalizedError);
+    if (this.#isClientGone(error)) {
+      // Not a daemon failure, so one line instead of a stack.
+      this.#options.onLog?.(
+        `rushd: a client went away before its reply; dropped ${reply} (${(error as Error).message})`
+      );
+    } else {
+      this.#options.onError(normalizedError);
+    }
     await this.#closeWithReasonAsync(normalizedError);
   }
 
+  /**
+   * Whether an error only means that the client went away: its connection failed with EPIPE or ECONNRESET, or had
+   * already failed so before this send found it closed. A call that sees EPIPE or ECONNRESET remembers it for
+   * those later sends. Pass the error as thrown: normalizing can wrap an error from another realm, such as a
+   * socket error under Jest, and drop its code.
+   */
+  #isClientGone(error: unknown): boolean {
+    if (isClientGoneError(error)) {
+      this.#clientGone = true;
+      return true;
+    }
+    return (
+      this.#clientGone &&
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.transportClosed
+    );
+  }
+
   #closeWithReasonAsync(reason: Error): Promise<void> {
     this.#markClosing(reason);
     this.#closePromise ??= this.#closeOnceAsync();
     return this.#closePromise;
   }
 
-  #markClosing(reason: Error): void {
+  #markClosing(reason: Error, keepFinishedRequests: boolean = false): void {
     if (this.#isClosing) return;
     this.#isClosing = true;
+    this.#connectingClient?.settle();
     this.#interactiveConnection.close(reason);
     for (const state of this.#requestById.values()) {
-      state.abortController.abort(reason);
+      if (!keepFinishedRequests || !state.client.terminalOutcomeSent) {
+        // A shutdown tells a request that has not started that it was queued.
+        state.abortController.abort(getRequestShutdownReason(reason, state.client.requestStarted));
+      }
     }
   }
 
@@ -470,7 +614,7 @@ export class DaemonControlSession {
           CLOSE_DRAIN_TIMEOUT_MS
         ))
       ) {
-        this.#connection.abort(closeReason);
+        await this.#abortConnectionAsync(closeReason);
       }
       await pending;
     }
@@ -480,24 +624,55 @@ export class DaemonControlSession {
       this.#sendQueue
     ]).then(() => undefined);
     if (!(await settlesWithinAsync(drainPromise, CLOSE_DRAIN_TIMEOUT_MS))) {
-      this.#connection.abort(closeReason);
+      await this.#abortConnectionAsync(closeReason);
     }
     await drainPromise;
     if (!this.#connectionClosed) await this.#connection.closeAsync();
     await this.#closedPromise;
   }
 
+  /**
+   * Aborts a connection whose requests did not finish in time. When the daemon is shutting down, each request that
+   * has no terminal outcome yet first gets a typed result that carries the shutdown's reason, so that its client
+   * reports that instead of a lost connection. The request's own late result is then refused.
+   */
+  async #abortConnectionAsync(reason: Error): Promise<void> {
+    if (reason instanceof DaemonShutdownError && !this.#connectionClosed) {
+      const writes: Promise<void>[] = [];
+      for (const [requestId, state] of this.#requestById) {
+        if (!state.client.terminalOutcomeSent) {
+          writes.push(
+            writeShutdownResultAsync(
+              requestId,
+              state,
+              getRequestShutdownReason(reason, state.client.requestStarted)
+            )
+          );
+        }
+      }
+      await settlesWithinAsync(
+        Promise.allSettled(writes).then(() => undefined),
+        SHUTDOWN_RESULT_SEND_TIMEOUT_MS
+      );
+    }
+    this.#connection.abort(reason);
+  }
+
   async #handleConnectionClosedAsync(error: Error | undefined): Promise<void> {
     if (this.#connectionClosed) return;
     this.#connectionClosed = true;
-    this.#markClosing(error ?? new Error('The daemon client connection closed.'));
+    // A client that went away is not a daemon failure. Each reply that it missed is logged when its send fails.
+    const closeError: Error | undefined = error && this.#isClientGone(error) ? undefined : error;
+    // A client that disconnects after its result does not stop the work that its request still runs.
+    this.#markClosing(error ?? new Error('The daemon client connection closed.'), true);
     const settlements: PromiseSettledResult<void>[] = await Promise.allSettled(
       Array.from(this.#requestById.values(), (state: IRequestState) => state.completion)
     );
     const cleanupErrors: Error[] = settlements
       .filter((result): result is PromiseRejectedResult => result.status === 'rejected')
+      .filter((result: PromiseRejectedResult) => !this.#isClientGone(result.reason))
       .map((result: PromiseRejectedResult) => normalizeError(result.reason));
-    const finalError: Error | undefined = combineCloseErrors(error, cleanupErrors);
+    const finalError: Error | undefined = combineCloseErrors(closeError, cleanupErrors);
     if (cleanupErrors.length > 0) this.#options.onError(finalError!);
     this.#options.onClosed(this, finalError);
     this.#resolveClosed();
@@ -512,6 +687,34 @@ function createDeferred(): { promise: Promise<void>; resolve: () => void } {
   return { promise, resolve: resolvePromise };
 }
 
+function describeRequest(envelope: IDaemonRequestEnvelope): string {
+  const command: string = envelope.argv.length > 0 ? envelope.argv.join(' ') : envelope.commandName;
+  return command.length > MAX_REQUEST_DESCRIPTION_LENGTH
+    ? `"${command.slice(0, MAX_REQUEST_DESCRIPTION_LENGTH - 1)}…"`
+    : `"${command}"`;
+}
+
+function isPingFrame(frame: IDaemonFrame): boolean {
+  return (
+    frame.kind === DaemonFrameType.controlJson && decodeDaemonControlMessage(frame.payload).kind === 'ping'
+  );
+}
+
+function writeShutdownResultAsync(
+  requestId: string,
+  state: IRequestState,
+  reason: DaemonShutdownError
+): Promise<void> {
+  try {
+    // The result that a router writes for a request that the shutdown aborted.
+    return state.client.writeResultAsync(
+      createGlobalCommandResult({ aborted: true, error: reason, exitCode: undefined, requestId })
+    );
+  } catch (error) {
+    return Promise.reject(error);
+  }
+}
+
 function normalizeProtocolError(error: unknown): DaemonProtocolError {
   if (error instanceof DaemonProtocolError) return error;
   return new DaemonProtocolError('malformedControlMessage', normalizeError(error).message, {
@@ -523,6 +726,12 @@ function normalizeError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error));
 }
 
+/** Whether a connection error means that the client has closed its end, so that nothing more can reach it. */
+function isClientGoneError(error: unknown): boolean {
+  const code: unknown = (error as NodeJS.ErrnoException | undefined)?.code;
+  return code === 'EPIPE' || code === 'ECONNRESET';
+}
+
 function combineErrors(primary: unknown, cleanup: unknown): unknown {
   if (primary === undefined) return cleanup;
   return new AggregateError([primary, cleanup], 'The request failed and could not clean up.');
@@ -538,6 +747,11 @@ function classifyRejection(error: unknown): IClassifiedRejection {
   return { code: 'routingFailed', message: normalizeError(error).message };
 }
 
+function describeError(error: unknown): string {
+  const normalized: Error = normalizeError(error);
+  return normalized.stack ?? normalized.message;
+}
+
 function combineCloseErrors(
   error: Error | undefined,
   cleanupErrors: ReadonlyArray<Error>
diff --git a/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts b/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
new file mode 100644
index 00000000000..d8d9fc420dd
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
@@ -0,0 +1,120 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { readResidentMemoryBytes } from './DaemonResidentMemory';
+
+const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
+
+/** What one idle garbage collection returned, and how long it paused the daemon. */
+export interface IDaemonIdleGarbageCollection {
+  readonly durationMs: number;
+  readonly heapUsedBytesBefore: number;
+  readonly heapUsedBytesAfter: number;
+  readonly residentBytesBefore: number;
+  readonly residentBytesAfter: number;
+}
+
+export interface IDaemonIdleGarbageCollectorOptions {
+  /** How long no request may be pending, and no engine work running, before the collection starts. */
+  readonly delayMs: number;
+  /** Runs one full garbage collection that returns the freed heap pages to the operating system. */
+  readonly collect: () => void;
+  /** Whether engine work that no request waits for, such as an iteration that its clients left, is running. */
+  readonly isEngineBusy: () => boolean;
+  readonly onCollected: (collection: IDaemonIdleGarbageCollection) => void;
+  /**
+   * Receives the error from a collection that failed, or whose memory use could not be read. The collector then
+   * stops.
+   */
+  readonly onError: (error: Error) => void;
+}
+
+/**
+ * Runs one memory-reducing garbage collection after each request, once the daemon has been idle for a while.
+ *
+ * @remarks
+ * Full collections during a request free the heap but keep its pages pooled, so the daemon keeps the resident memory
+ * of its busiest recent request. V8's memory reducer returns the pages only when one of its checks, 8 seconds apart,
+ * finds the mutator idle, and after some requests none does. This collector runs one collection once no request has
+ * been pending for the delay and the engine is idle. It never starts one while a request is pending, and it does
+ * not start another until a request settles again.
+ */
+export class DaemonIdleGarbageCollector implements Disposable {
+  readonly #options: IDaemonIdleGarbageCollectorOptions;
+  #activeRequests: number = 0;
+  #settledSinceCollection: boolean = false;
+  #stopped: boolean = false;
+  #timer: NodeJS.Timeout | undefined;
+
+  public constructor(options: IDaemonIdleGarbageCollectorOptions) {
+    const { delayMs } = options;
+    if (!Number.isFinite(delayMs) || delayMs <= 0 || delayMs > MAX_TIMER_DELAY_MS) {
+      throw new RangeError(
+        `The idle garbage collection delay must be greater than zero and at most ${MAX_TIMER_DELAY_MS} ms.`
+      );
+    }
+    this.#options = options;
+  }
+
+  /** Counts a request as pending until the returned function is called. */
+  public acquire(): () => void {
+    this.#activeRequests++;
+    this.#clearTimer();
+    let released: boolean = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.#activeRequests--;
+      this.#settledSinceCollection = true;
+      this.#schedule();
+    };
+  }
+
+  public [Symbol.dispose](): void {
+    this.#stopped = true;
+    this.#clearTimer();
+  }
+
+  #schedule(): void {
+    this.#clearTimer();
+    if (this.#stopped || this.#activeRequests !== 0 || !this.#settledSinceCollection) return;
+    this.#timer = setTimeout(() => this.#collectWhenIdle(), this.#options.delayMs);
+    this.#timer.unref();
+  }
+
+  #clearTimer(): void {
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+  }
+
+  #collectWhenIdle(): void {
+    this.#timer = undefined;
+    if (this.#options.isEngineBusy()) {
+      // The engine is still running work that no request waits for; wait a whole delay again.
+      this.#schedule();
+      return;
+    }
+    this.#settledSinceCollection = false;
+    let collection: IDaemonIdleGarbageCollection;
+    try {
+      collection = measureCollection(this.#options.collect);
+    } catch (error) {
+      this.#stopped = true;
+      this.#options.onError(error as Error);
+      return;
+    }
+    this.#options.onCollected(collection);
+  }
+}
+
+function measureCollection(collect: () => void): IDaemonIdleGarbageCollection {
+  // Reading the memory use can fail too, for example when the process has no file descriptor left.
+  const heapUsedBytesBefore: number = process.memoryUsage().heapUsed;
+  const residentBytesBefore: number = readResidentMemoryBytes();
+  const startTime: number = performance.now();
+  collect();
+  const durationMs: number = performance.now() - startTime;
+  const heapUsedBytesAfter: number = process.memoryUsage().heapUsed;
+  const residentBytesAfter: number = readResidentMemoryBytes();
+  return { durationMs, heapUsedBytesBefore, heapUsedBytesAfter, residentBytesBefore, residentBytesAfter };
+}
diff --git a/libraries/rush-daemon/src/DaemonIdleTimer.ts b/libraries/rush-daemon/src/DaemonIdleTimer.ts
index f64d4400b8a..91176d92eec 100644
--- a/libraries/rush-daemon/src/DaemonIdleTimer.ts
+++ b/libraries/rush-daemon/src/DaemonIdleTimer.ts
@@ -8,6 +8,7 @@ const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
 export class DaemonIdleTimer implements Disposable {
   readonly #delayMs: number | undefined;
   #activeRequests: number = 0;
+  #expired: boolean = false;
   #onIdle: (() => void) | undefined;
   #timer: NodeJS.Timeout | undefined;
 
@@ -43,6 +44,15 @@ export class DaemonIdleTimer implements Disposable {
     };
   }
 
+  /**
+   * From now on, calls `onIdle` as soon as no request is active, instead of after the idle timeout, and also when no
+   * idle timeout was configured.
+   */
+  public expire(): void {
+    this.#expired = true;
+    this.#schedule();
+  }
+
   public [Symbol.dispose](): void {
     this.#onIdle = undefined;
     clearTimeout(this.#timer);
@@ -50,8 +60,9 @@ export class DaemonIdleTimer implements Disposable {
 
   #schedule(): void {
     clearTimeout(this.#timer);
-    if (this.#activeRequests !== 0 || !this.#onIdle || this.#delayMs === undefined) return;
-    this.#timer = setTimeout(this.#onIdle, this.#delayMs);
+    const delayMs: number | undefined = this.#expired ? 0 : this.#delayMs;
+    if (this.#activeRequests !== 0 || !this.#onIdle || delayMs === undefined) return;
+    this.#timer = setTimeout(this.#onIdle, delayMs);
     this.#timer.unref();
   }
 }
diff --git a/libraries/rush-daemon/src/DaemonInstallationMonitor.ts b/libraries/rush-daemon/src/DaemonInstallationMonitor.ts
new file mode 100644
index 00000000000..d30f98af13e
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonInstallationMonitor.ts
@@ -0,0 +1,102 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type {
+  DaemonInstallationChangeKind,
+  IDaemonInstallationChange
+} from '@rushstack/rush-daemon-protocol';
+
+/**
+ * Reports a folder of the running daemon's installation that was removed or replaced after startup, or
+ * `undefined` while the installation is intact.
+ *
+ * @beta
+ */
+export type CheckDaemonInstallation = () => IDaemonInstallationChange | undefined;
+
+interface IFolderIdentity {
+  readonly folder: string;
+  readonly dev: bigint;
+  readonly ino: bigint;
+  /** Zero where the file system does not record it; it tells a recreated folder that reused an inode. */
+  readonly birthtimeNs: bigint;
+}
+
+/**
+ * Remembers which folder each path and each of its ancestors named at startup.
+ *
+ * @remarks
+ * A check stats only the given folders. A folder keeps its identity while files inside it change, so only a
+ * removed, renamed or recreated folder is reported: the outermost ancestor that no longer exists, or that is now
+ * a different folder. Errors other than a missing path are ignored rather than reported, because restarting a
+ * daemon whose code is still in place would only lose its warm state.
+ *
+ * @beta
+ */
+export function captureDaemonInstallation(folders: ReadonlyArray<string>): CheckDaemonInstallation {
+  const chains: IFolderIdentity[][] = [];
+  for (const folder of folders) {
+    const chain: IFolderIdentity[] | undefined = captureChain(path.resolve(folder));
+    if (chain) chains.push(chain);
+  }
+  return () => {
+    for (const chain of chains) {
+      if (compareIdentity(chain[chain.length - 1]) === undefined) continue;
+      for (const identity of chain) {
+        const change: DaemonInstallationChangeKind | undefined = compareIdentity(identity);
+        if (change) return { change, folder: identity.folder };
+      }
+    }
+    return undefined;
+  };
+}
+
+/** The folders this process loaded its code from: its own package's output and the Rush engine. */
+export function getDaemonInstallationFolders(): string[] {
+  return [__dirname, path.dirname(require.resolve('@microsoft/rush-lib'))];
+}
+
+function captureChain(folder: string): IFolderIdentity[] | undefined {
+  const ancestors: string[] = [];
+  for (let current: string = folder; ; current = path.dirname(current)) {
+    ancestors.unshift(current);
+    if (path.dirname(current) === current) break;
+  }
+  const chain: IFolderIdentity[] = [];
+  for (const ancestor of ancestors) {
+    const stats: fs.BigIntStats | undefined = tryStat(ancestor);
+    if (stats)
+      chain.push({ folder: ancestor, dev: stats.dev, ino: stats.ino, birthtimeNs: stats.birthtimeNs });
+  }
+  return chain[chain.length - 1]?.folder === folder ? chain : undefined;
+}
+
+function compareIdentity(identity: IFolderIdentity): DaemonInstallationChangeKind | undefined {
+  let stats: fs.BigIntStats | undefined;
+  try {
+    stats = fs.statSync(identity.folder, { bigint: true });
+  } catch (error) {
+    return isMissing(error) ? 'removed' : undefined;
+  }
+  return stats.dev === identity.dev &&
+    stats.ino === identity.ino &&
+    stats.birthtimeNs === identity.birthtimeNs
+    ? undefined
+    : 'replaced';
+}
+
+function tryStat(folder: string): fs.BigIntStats | undefined {
+  try {
+    return fs.statSync(folder, { bigint: true });
+  } catch {
+    return undefined;
+  }
+}
+
+function isMissing(error: unknown): boolean {
+  const code: unknown = (error as NodeJS.ErrnoException | undefined)?.code;
+  return code === 'ENOENT' || code === 'ENOTDIR';
+}
diff --git a/libraries/rush-daemon/src/DaemonOrphanReapLog.ts b/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
new file mode 100644
index 00000000000..703df6e936f
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatOperationGroupLeftRunning } from '@rushstack/rush-daemon-transport';
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
+
+/** Lists process groups as `process group A` or `process groups A, B and C`; the log names every group. */
+function formatProcessGroups(groupIds: readonly number[]): string {
+  const items: string[] = groupIds.map(String);
+  const last: string | undefined = items.pop();
+  return items.length === 0 ? `process group ${last}` : `process groups ${items.join(', ')} and ${last}`;
+}
+
+/**
+ * Returns the daemon log line for the operations that an exited daemon left running and that this daemon
+ * stopped when it reclaimed the workspace's endpoint, so that they cannot overwrite the outputs of its requests.
+ */
+export function formatOrphanReapLogLine(reap: IDaemonOrphanReap): string {
+  const operations: string =
+    `the operations that the exited daemon (PID ${reap.daemonPid}) left running ` +
+    `(${formatProcessGroups(reap.processGroupIds)})`;
+  return reap.outcome === 'killed'
+    ? `rushd: killed ${operations}; they did not exit after SIGTERM`
+    : `rushd: stopped ${operations}`;
+}
+
+/**
+ * Returns the daemon log line for a process group that an exited daemon recorded for an operation, and that
+ * this daemon left running when it reclaimed the workspace's endpoint, because it could not prove that the
+ * group still ran that operation. Whoever later finds the group's processes can find out why here.
+ */
+export function formatOperationGroupLeftRunningLogLine(group: IDaemonOperationGroupLeftRunning): string {
+  return `rushd: ${formatOperationGroupLeftRunning(group)}`;
+}
+
+/**
+ * Returns the reclaim options that write each set of stopped process groups to `onLog` as
+ * {@link formatOrphanReapLogLine}'s line, and each recorded operation group that the reclaim left running as
+ * {@link formatOperationGroupLeftRunningLogLine}'s. Without `onLog`, the transport reports each set of
+ * stopped groups as a `RUSH_DAEMON_ORPHANS_REAPED` process warning, and no group that it left running.
+ */
+export function getOrphanReapLogOptions(
+  onLog: ((message: string) => void) | undefined
+): IDaemonReclaimOptions {
+  if (!onLog) return {};
+  return {
+    onOrphansReaped: (reap: IDaemonOrphanReap) => onLog(formatOrphanReapLogLine(reap)),
+    onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) =>
+      onLog(formatOperationGroupLeftRunningLogLine(group))
+  };
+}
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index d984b44f91a..ab23a7562a2 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineRequestSettings, WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 import type {
   IDaemonCommandResult,
   IDaemonEventEnvelope,
@@ -18,11 +18,15 @@ import type { IResolvedGlobalCommandRequest } from './GlobalCommandRequest';
 import type { IInteractiveRequestSession } from './InteractiveRequestInputRouter';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { PhasedRequestRouter } from './PhasedRequestRouter';
+import { writeRequestStartedAsync } from './RequestStartedNotice';
 import type { IGlobalCommandRequestClient } from './GlobalCommandRequestClient';
+import type { IPhasedRequestTelemetrySink } from './PhasedRequestTelemetry';
 import type { IWorkspaceSession } from './WorkspaceSession';
+import type { RequestExclusivityClass } from './RequestScheduler';
 import { DaemonGraphRequestRouter } from './DaemonGraphRequestRouter';
 import { getDaemonGraphObserver } from './DaemonGraphObserver';
 import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { classifyRushCommand } from './RushCommandRequestPolicy';
 
 /** A request resolved by the integration that owns Rush command parsing. @beta */
 export type ResolvedDaemonRequest = IResolvedDaemonPhasedRequest | IResolvedDaemonGlobalRequest;
@@ -35,6 +39,13 @@ export interface IResolvedDaemonPhasedRequest {
   readonly exactSelection?: boolean;
   /** Verbosity and parallelism for this request; applied to the shared graph before its iteration. */
   readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+  /**
+   * Workspace admission class of the parsed command. Defaults to the built-in command classification, which
+   * makes every command that is not built in `EXCLUSIVE`.
+   */
+  readonly exclusivityClass?: RequestExclusivityClass;
+  /** Receives the request's telemetry report once it has taken part in a graph iteration or no-op check. */
+  readonly telemetry?: IPhasedRequestTelemetrySink;
 }
 
 /** A resolver outcome that uses the existing isolated global executor contract. @beta */
@@ -43,11 +54,28 @@ export interface IResolvedDaemonGlobalRequest {
   readonly kind: 'global';
 }
 
+/** How the host lifecycle admitted one request, for request-scoped telemetry. @beta */
+export interface IDaemonRequestLifecycleInfo {
+  /** The `performance.now()` timestamp at which the lifecycle received the request. */
+  readonly receivedTimeMs: number;
+  /** The `performance.now()` timestamp at which the lifecycle had prepared the request's workspace generation. */
+  readonly preparedTimeMs: number;
+  /** How the lifecycle reconciled the workspace inputs for this request. */
+  readonly reloadTier: WorkspaceInputChangeTier;
+}
+
 /** Context supplied to an integration-owned request resolver. @beta */
 export interface IResolveDaemonRequestOptions {
   /** Aborts when the request is cancelled, disconnected, or the host shuts down. */
   readonly abortSignal: AbortSignal;
+  /**
+   * Stops the creation of an engine that this call binds, between its preparation steps. Only a workspace lifecycle
+   * that prepares the next engine while no request waits for it sets this; a request's own binding runs to its end.
+   */
+  readonly engineCreationSignal?: AbortSignal;
   readonly envelope: IDaemonRequestEnvelope;
+  /** Present when a host lifecycle admitted the request. */
+  readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
   readonly workspaceSession: IWorkspaceSession;
 }
 
@@ -72,16 +100,42 @@ export class DaemonRequestDispatchError extends Error {
   }
 }
 
+/**
+ * A phased command request whose environment differs from the daemon's startup environment. A host lifecycle
+ * restarts the daemon from that environment, as it does for build. Without one, the client runs the command
+ * in-process.
+ */
+export class DaemonRequestEnvironmentError extends DaemonRequestDispatchError {
+  public constructor() {
+    super(
+      'unsupported',
+      'The request environment differs from the daemon startup environment. Restart the daemon from this ' +
+        'environment or use --no-daemon.'
+    );
+    this.name = 'DaemonRequestEnvironmentError';
+  }
+}
+
 /** Wire destination consumed by the shared request dispatcher. @beta */
 export interface IDaemonRequestDispatchClient {
   readonly abortSignal: AbortSignal;
   readonly interactiveSession: IInteractiveRequestSession;
+  /**
+   * The `performance.now()` timestamp at which the transport read the request. A host lifecycle reports it as the
+   * request's {@link IDaemonRequestLifecycleInfo.receivedTimeMs}. When it is omitted, the request counts as received
+   * when its dispatch starts.
+   */
+  readonly receivedTimeMs?: number;
   readonly sessionId: string;
   readonly supportsRequestAdmission: boolean;
   getNextEventSequence(): number;
+  /** {@inheritDoc IPhasedRequestClient.waitForConnectingClientsAsync} */
+  waitForConnectingClientsAsync?(): Promise<void>;
   writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
   writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
   writeQueuePositionAsync(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+  /** {@inheritDoc IPhasedRequestClient.writeRequestStartedAsync} */
+  writeRequestStartedAsync?(): Promise<void>;
   writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void>;
   writeTerminalChunkAsync(stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
   writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
@@ -94,6 +148,11 @@ export interface IDispatchWorkspaceRequestOptions {
   readonly workspaceSession: IWorkspaceSession;
   readonly resolver: IDaemonRequestResolver | undefined;
   readonly onExecutionStarting?: () => void;
+  /**
+   * Present when a host lifecycle admitted the request. Its `receivedTimeMs` also decides whether a phased request
+   * can join a batch whose input reconcile has started; see {@link PhasedRequestRouter.executeAsync}.
+   */
+  readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
 }
 
 /** Executes an already admitted workspace generation without resolving against another session. @beta */
@@ -101,6 +160,10 @@ export type DispatchWorkspaceRequestAsync = (
   options: IDispatchWorkspaceRequestOptions
 ) => Promise<IDaemonCommandResult | undefined>;
 
+interface IRequestExclusivityClassListener {
+  readonly onRequestExclusivityClass?: (exclusivityClass: RequestExclusivityClass) => void;
+}
+
 /** Host-owned lifecycle admission surrounding existing command routers. @beta */
 export interface IDaemonRequestLifecycle extends AsyncDisposable {
   dispatchAsync(
@@ -158,14 +221,15 @@ export class DaemonRequestDispatcher implements AsyncDisposable {
 async function dispatchWorkspaceRequestAsync(
   options: IDispatchWorkspaceRequestOptions
 ): Promise<IDaemonCommandResult | undefined> {
-  const { envelope, client, workspaceSession, resolver, onExecutionStarting } = options;
+  const { envelope, client, workspaceSession, resolver, lifecycleInfo } = options;
+  // Runs just before the request can have an effect. The client knows that the request may have run before it does.
+  const startExecutionAsync = async (): Promise<void> => {
+    options.onExecutionStarting?.();
+    await writeRequestStartedAsync(client);
+  };
   workspaceSession.assertActive?.();
-  if (
-    !isRushxInvocation(envelope) &&
-    envelope.commandOrigin === 'built-in' &&
-    (envelope.commandName === 'daemon' || (envelope.argv[0] === 'daemon' && envelope.argv[1] === 'graph'))
-  ) {
-    onExecutionStarting?.();
+  if (isDaemonGraphCommand(envelope)) {
+    await startExecutionAsync();
     await new DaemonGraphRequestRouter(workspaceSession).executeAsync(envelope, client);
     return undefined;
   }
@@ -178,6 +242,7 @@ async function dispatchWorkspaceRequestAsync(
   const resolved: ResolvedDaemonRequest = await resolver.resolveRequestAsync({
     abortSignal: client.abortSignal,
     envelope,
+    lifecycleInfo,
     workspaceSession
   });
   workspaceSession.assertActive?.();
@@ -186,12 +251,19 @@ async function dispatchWorkspaceRequestAsync(
   }
   if (resolved.kind === 'phased') {
     validateResolvedPhasedRequest(envelope, resolved.request);
+    const exclusivityClass: RequestExclusivityClass =
+      resolved.exclusivityClass ??
+      classifyRushCommand({ commandName: envelope.commandName, commandOrigin: envelope.commandOrigin });
+    (client as IRequestExclusivityClassListener).onRequestExclusivityClass?.(exclusivityClass);
     return await new PhasedRequestRouter(workspaceSession).executeAsync(
       resolved.request,
       createPhasedClient(client),
       resolved.exactSelection,
-      onExecutionStarting,
-      resolved.requestSettings
+      options.onExecutionStarting,
+      resolved.requestSettings,
+      resolved.telemetry,
+      lifecycleInfo?.receivedTimeMs ?? client.receivedTimeMs,
+      exclusivityClass
     );
   }
   const globalRouter: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(workspaceSession);
@@ -212,13 +284,22 @@ async function dispatchWorkspaceRequestAsync(
     request,
     async (context) => {
       workspaceSession.assertActive?.();
-      onExecutionStarting?.();
+      await startExecutionAsync();
       return await resolved.executor(context);
     },
     createGlobalClient(client)
   );
 }
 
+/** Whether the dispatcher answers the request with the daemon's graph router instead of the resolver. */
+export function isDaemonGraphCommand(envelope: IDaemonRequestEnvelope): boolean {
+  return (
+    !isRushxInvocation(envelope) &&
+    envelope.commandOrigin === 'built-in' &&
+    (envelope.commandName === 'daemon' || (envelope.argv[0] === 'daemon' && envelope.argv[1] === 'graph'))
+  );
+}
+
 function validateResolvedPhasedRequest(
   envelope: IDaemonRequestEnvelope,
   request: IDaemonPhasedRequest
diff --git a/libraries/rush-daemon/src/DaemonRequestTelemetry.ts b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
new file mode 100644
index 00000000000..3fcad135f41
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
@@ -0,0 +1,225 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { PerformanceEntry } from 'node:perf_hooks';
+
+import { PackageJsonLookup } from '@rushstack/node-core-library';
+import type {
+  IPhasedCommandEngineLogTelemetryOptions,
+  ITelemetryData,
+  PhasedCommandEngine
+} from '@microsoft/rush-lib';
+
+import type { IDaemonRequestLifecycleInfo } from './DaemonRequestDispatcher';
+import type {
+  IPhasedRequestTelemetryMeasure,
+  IPhasedRequestTelemetryReport,
+  IPhasedRequestTelemetrySink
+} from './PhasedRequestTelemetry';
+import { getWorkspaceGenerationToken } from './WorkspaceGeneration';
+import type { IWorkspaceSession } from './WorkspaceSession';
+
+const DAEMON_PACKAGE_VERSION: string = PackageJsonLookup.loadOwnPackageJson(__dirname).version;
+const MILLISECONDS_PER_SECOND: number = 1000;
+const GENERATION_TOKEN_PREFIX_LENGTH: number = 8;
+const NATIVE_ITERATION_MEASURE_PREFIX: string = 'rush:executionManager:';
+const DAEMON_MEASURE_PREFIX: string = 'rush:daemon:';
+const RUSH_MEASURE_PREFIX: string = 'rush:';
+
+/**
+ * Request environment variables that attribute an entry to its caller. They are read from the request, never from
+ * the daemon's own environment. Each is in `workspaceFingerprintIgnoredEnvironmentVariables` and
+ * `workspaceRequestScopedEnvironmentVariables`, so a request that sets, changes or unsets one keeps the warm
+ * daemon, and the daemon's own `process.env` never has them. Native Rush rejects unknown `RUSH_` variables, so the
+ * Rush-owned tag variable uses the `RUSHD_` prefix.
+ */
+const ATTRIBUTION_VARIABLES: Readonly<Record<string, string>> = {
+  agentSessionId: 'COPILOT_AGENT_SESSION_ID',
+  telemetryTag: 'RUSHD_TELEMETRY_TAG'
+};
+
+/** When the warm engine was created, as `performance.now()` values. */
+export interface IDaemonEngineCreationTiming {
+  readonly startTimeMs: number;
+  readonly endTimeMs: number;
+}
+
+/** What the production resolver knows about one resolved request. */
+export interface IDaemonRequestTelemetryContext {
+  /** The request's own parsed command. */
+  readonly command: Pick<PhasedCommandEngine, 'createTelemetryData'>;
+  readonly logTelemetry: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
+  readonly workspaceSession: IWorkspaceSession;
+  readonly lifecycleInfo: IDaemonRequestLifecycleInfo | undefined;
+  readonly resolveStartTimeMs: number;
+  readonly resolveEndTimeMs: number;
+  /** Set only for the request whose handling created the warm engine. */
+  readonly engineCreation: IDaemonEngineCreationTiming | undefined;
+  /** Returns the 1-based position of the entry among those the warm engine logged. */
+  readonly getRequestIndex: () => number;
+}
+
+/**
+ * Creates the sink that logs one native telemetry entry for a request served by the warm engine.
+ */
+export function createDaemonRequestTelemetrySink(
+  context: IDaemonRequestTelemetryContext
+): IPhasedRequestTelemetrySink {
+  return {
+    logRequest: (report: IPhasedRequestTelemetryReport) => {
+      try {
+        context.logTelemetry(createDaemonRequestTelemetryData(context, report), {
+          servedByIteration: report.scheduled
+        });
+      } catch (error) {
+        process.stderr.write(
+          `Unable to log telemetry for request ${report.request.requestId}: ${(error as Error).message}\n`
+        );
+      }
+    }
+  };
+}
+
+/**
+ * Builds the native telemetry entry for one request.
+ *
+ * @remarks
+ * Times are relative to the moment the daemon received the request, as a native command's are relative to its
+ * process start. `durationInSeconds` has the native meaning: it starts when the graph iteration was scheduled, or,
+ * for a request that needed no iteration, when its batch began handling it. `bootDurationSeconds` and
+ * `totalDurationSeconds` also start at the daemon's receipt of the request, so they exclude the client's own
+ * startup and connection time.
+ */
+export function createDaemonRequestTelemetryData(
+  context: IDaemonRequestTelemetryContext,
+  report: IPhasedRequestTelemetryReport
+): ITelemetryData {
+  const timeOriginMs: number = context.lifecycleInfo?.receivedTimeMs ?? context.resolveStartTimeMs;
+  const durationStartTimeMs: number = report.iterationStartTimeMs ?? report.executionStartTimeMs;
+  return context.command.createTelemetryData({
+    records: report.records,
+    succeeded: report.result.exitCode === 0,
+    durationInSeconds: toSeconds(report.resultTimeMs - durationStartTimeMs),
+    timeOriginMs,
+    extraData: {
+      ...getDaemonExtraData(context, report),
+      durationBasis: report.iterationStartTimeMs === undefined ? 'batch' : 'iteration',
+      bootDurationSeconds: toSeconds(durationStartTimeMs - timeOriginMs),
+      totalDurationSeconds: toSeconds(report.resultTimeMs - timeOriginMs),
+      ...getRequestAttribution(report.request.environment)
+    },
+    performanceEntries: [
+      ...getLifecycleEntries(context),
+      ...report.measures.map(createMeasureEntry),
+      ...getNativeEntries(context, report, durationStartTimeMs)
+    ]
+  });
+}
+
+function getDaemonExtraData(
+  context: IDaemonRequestTelemetryContext,
+  report: IPhasedRequestTelemetryReport
+): Record<string, string | number | boolean> {
+  const { lifecycleInfo, workspaceSession } = context;
+  const queueWait: IPhasedRequestTelemetryMeasure | undefined = report.measures.find(
+    (measure: IPhasedRequestTelemetryMeasure) => measure.name === `${DAEMON_MEASURE_PREFIX}queueWait`
+  );
+  const generation: number | undefined = workspaceSession.metadata.generation;
+  return {
+    daemon: true,
+    daemonVersion: DAEMON_PACKAGE_VERSION,
+    daemonPid: process.pid,
+    requestId: report.request.requestId,
+    ...(generation === undefined ? {} : { generation }),
+    generationToken: getWorkspaceGenerationToken(workspaceSession).slice(0, GENERATION_TOKEN_PREFIX_LENGTH),
+    ...(lifecycleInfo === undefined ? {} : { reloadTier: lifecycleInfo.reloadTier }),
+    requestIndex: context.getRequestIndex(),
+    batchSize: report.batchSize,
+    queueWaitSeconds: queueWait ? toSeconds(queueWait.endTimeMs - queueWait.startTimeMs) : 0,
+    graphWasInitialized: context.engineCreation === undefined,
+    persistentIpcRunners: workspaceSession.rushConfiguration.daemon.usePersistentIpcRunners,
+    scheduled: report.scheduled,
+    earlyResult: report.earlyResult,
+    ...(report.joinedIteration ? { joinedIteration: true } : {}),
+    countRetained: report.countRetained,
+    exitCode: report.result.exitCode,
+    outcome: report.result.outcome
+  };
+}
+
+function getRequestAttribution(
+  environment: Readonly<Record<string, string>>
+): Record<string, string | number | boolean> {
+  const attribution: Record<string, string> = {};
+  for (const [field, variable] of Object.entries(ATTRIBUTION_VARIABLES)) {
+    const value: string | undefined = environment[variable];
+    if (value) attribution[field] = value;
+  }
+  return attribution;
+}
+
+function getLifecycleEntries(context: IDaemonRequestTelemetryContext): PerformanceEntry[] {
+  const { engineCreation, lifecycleInfo } = context;
+  const measures: IPhasedRequestTelemetryMeasure[] = [];
+  if (lifecycleInfo) {
+    measures.push({
+      name: `${DAEMON_MEASURE_PREFIX}prepareWorkspace`,
+      startTimeMs: lifecycleInfo.receivedTimeMs,
+      endTimeMs: lifecycleInfo.preparedTimeMs
+    });
+  }
+  if (engineCreation) {
+    measures.push({ name: `${DAEMON_MEASURE_PREFIX}createEngine`, ...engineCreation });
+  }
+  measures.push({
+    name: `${DAEMON_MEASURE_PREFIX}resolve`,
+    startTimeMs: context.resolveStartTimeMs,
+    endTimeMs: context.resolveEndTimeMs
+  });
+  return measures.map(createMeasureEntry);
+}
+
+/**
+ * The native measures recorded while serving this request: engine creation for the request that created the
+ * engine, and the graph iteration's own measures under their native names. One daemon serves one workspace and
+ * runs one iteration at a time, so the time windows attribute the measures to this request.
+ */
+function getNativeEntries(
+  context: IDaemonRequestTelemetryContext,
+  report: IPhasedRequestTelemetryReport,
+  durationStartTimeMs: number
+): PerformanceEntry[] {
+  const { engineCreation } = context;
+  return performance.getEntriesByType('measure').filter((entry: PerformanceEntry) => {
+    const endTime: number = entry.startTime + entry.duration;
+    if (entry.name.startsWith(DAEMON_MEASURE_PREFIX)) {
+      return false;
+    }
+    if (entry.name.startsWith(NATIVE_ITERATION_MEASURE_PREFIX)) {
+      return report.scheduled && entry.startTime >= durationStartTimeMs && endTime <= report.resultTimeMs;
+    }
+    return (
+      engineCreation !== undefined &&
+      entry.name.startsWith(RUSH_MEASURE_PREFIX) &&
+      entry.startTime >= engineCreation.startTimeMs &&
+      endTime <= engineCreation.endTimeMs
+    );
+  });
+}
+
+function createMeasureEntry(measure: IPhasedRequestTelemetryMeasure): PerformanceEntry {
+  const { name, startTimeMs: startTime } = measure;
+  const duration: number = measure.endTimeMs - startTime;
+  return {
+    name,
+    entryType: 'measure',
+    startTime,
+    duration,
+    detail: undefined,
+    toJSON: () => ({ name, entryType: 'measure', startTime, duration })
+  };
+}
+
+function toSeconds(milliseconds: number): number {
+  return milliseconds / MILLISECONDS_PER_SECOND;
+}
diff --git a/libraries/rush-daemon/src/DaemonRequestUsageError.ts b/libraries/rush-daemon/src/DaemonRequestUsageError.ts
new file mode 100644
index 00000000000..febfaadaae0
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonRequestUsageError.ts
@@ -0,0 +1,26 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/** Options for {@link DaemonRequestUsageError}. */
+export interface IDaemonRequestUsageErrorOptions extends ErrorOptions {
+  /** The usage of the command, which native Rush prints to stdout before the message. */
+  readonly usage?: string;
+}
+
+/**
+ * A command line that native Rush rejects as invalid. The request fails with native Rush's exit code, and the
+ * client does not run the command in-process, which would only report the same error again.
+ */
+export class DaemonRequestUsageError extends Error {
+  /** The exit code of native Rush for this command line. */
+  public readonly exitCode: number;
+  /** The usage of the command, if it is known. */
+  public readonly usage: string | undefined;
+
+  public constructor(message: string, exitCode: number, options?: IDaemonRequestUsageErrorOptions) {
+    super(message, options);
+    this.name = 'DaemonRequestUsageError';
+    this.exitCode = exitCode;
+    this.usage = options?.usage;
+  }
+}
diff --git a/libraries/rush-daemon/src/DaemonResidentMemory.ts b/libraries/rush-daemon/src/DaemonResidentMemory.ts
new file mode 100644
index 00000000000..4bc6280e852
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonResidentMemory.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const PROC_SELF_STATUS: string = '/proc/self/status';
+// For example "VmRSS:\t  123456 kB"; the kernel always gives this line in kibibytes.
+const VM_RSS_LINE_PATTERN: RegExp = /^VmRSS:\s*(\d+) kB$/m;
+const BYTES_PER_KIB: number = 1024;
+
+function tryReadStatusResidentBytes(): number | undefined {
+  let status: string;
+  try {
+    status = fs.readFileSync(PROC_SELF_STATUS, 'utf8');
+  } catch {
+    return undefined;
+  }
+  const match: RegExpExecArray | null = VM_RSS_LINE_PATTERN.exec(status);
+  return match ? Number(match[1]) * BYTES_PER_KIB : undefined;
+}
+
+/**
+ * The resident memory of this process, in bytes.
+ *
+ * @remarks
+ * On Linux this is `VmRSS` from `/proc/self/status`. `process.memoryUsage().rss` reads the `rss` field of
+ * `/proc/self/stat` instead, which the kernel takes from counters that it keeps per CPU and adds up only
+ * approximately, so on a host with many CPUs it can be tens of megabytes off. Recent kernels add up `VmRSS`
+ * exactly. Elsewhere, or when `/proc/self/status` cannot be read or has no `VmRSS` line, this is
+ * `process.memoryUsage.rss()`, and it throws when that does.
+ */
+export function readResidentMemoryBytes(): number {
+  const statusBytes: number | undefined =
+    process.platform === 'linux' ? tryReadStatusResidentBytes() : undefined;
+  return statusBytes ?? process.memoryUsage.rss();
+}
diff --git a/libraries/rush-daemon/src/DaemonShutdownDeadline.ts b/libraries/rush-daemon/src/DaemonShutdownDeadline.ts
new file mode 100644
index 00000000000..ad36f71690e
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownDeadline.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonShutdownDeadlineError, type DaemonShutdownStage } from './DaemonShutdownDeadlineError';
+
+/** Where a shutdown is when it is cut short. */
+export interface IDaemonShutdownProgress {
+  readonly stage: DaemonShutdownStage;
+  readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
+/** Options for {@link DaemonShutdownDeadline}. */
+export interface IDaemonShutdownDeadlineOptions {
+  /** How long a shutdown may take. Without it, only {@link DaemonShutdownDeadline.expire} cuts one short. */
+  readonly timeoutMs: number | undefined;
+  readonly getProgress: () => IDaemonShutdownProgress;
+  /** Reports a failure of cleanup that finished after the shutdown was cut short. */
+  readonly onLateFailure: (error: Error) => void;
+}
+
+/**
+ * Races a shutdown's cleanup against its deadline, so that an await that ignores cancellation cannot keep the
+ * daemon from exiting.
+ */
+export class DaemonShutdownDeadline {
+  readonly #options: IDaemonShutdownDeadlineOptions;
+  #forcedBy: string | undefined;
+  #cutShort: ((forcedBy: string | undefined) => void) | undefined;
+
+  public constructor(options: IDaemonShutdownDeadlineOptions) {
+    this.#options = options;
+  }
+
+  /**
+   * Settles as the cleanup does, unless the deadline passes or {@link DaemonShutdownDeadline.expire} is called
+   * first. Then it rejects with {@link DaemonShutdownDeadlineError}, and the cleanup goes on in the background.
+   */
+  public async raceAsync(cleanup: Promise<void>): Promise<void> {
+    const startedAtMs: number = Date.now();
+    let timer: NodeJS.Timeout | undefined;
+    const cutShort: Promise<void> = new Promise<void>((resolve, reject) => {
+      this.#cutShort = (forcedBy: string | undefined) =>
+        reject(
+          new DaemonShutdownDeadlineError({
+            ...this.#options.getProgress(),
+            elapsedMs: Date.now() - startedAtMs,
+            forcedBy
+          })
+        );
+    });
+    if (this.#forcedBy !== undefined) {
+      this.#cutShort?.(this.#forcedBy);
+    } else if (this.#options.timeoutMs !== undefined) {
+      timer = setTimeout(() => this.#cutShort?.(undefined), this.#options.timeoutMs);
+    }
+    try {
+      await Promise.race([cleanup, cutShort]);
+    } catch (error) {
+      if (error instanceof DaemonShutdownDeadlineError) {
+        cleanup.catch((lateError: unknown) =>
+          this.#options.onLateFailure(lateError instanceof Error ? lateError : new Error(String(lateError)))
+        );
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      this.#cutShort = undefined;
+    }
+  }
+
+  /** Cuts the running shutdown short now. A shutdown that has not started yet is cut short when it starts. */
+  public expire(forcedBy: string): void {
+    this.#forcedBy ??= forcedBy;
+    this.#cutShort?.(forcedBy);
+  }
+}
diff --git a/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts b/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
new file mode 100644
index 00000000000..c97ee215e90
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
@@ -0,0 +1,93 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The step of a daemon shutdown that was still running when it was cut short.
+ *
+ * @beta
+ */
+export type DaemonShutdownStage =
+  | 'requests'
+  | 'workspaceMaintenance'
+  | 'requestDispatcher'
+  | 'workspaceSession'
+  | 'cacheWrites'
+  | 'listener';
+
+/**
+ * Options for {@link DaemonShutdownDeadlineError}.
+ *
+ * @beta
+ */
+export interface IDaemonShutdownDeadlineErrorOptions {
+  /** How long the shutdown had been running. */
+  readonly elapsedMs: number;
+  /** What cut the shutdown short before its deadline, such as "a second SIGTERM". Omitted when the deadline did. */
+  readonly forcedBy?: string;
+  /** The step that was still running. */
+  readonly stage: DaemonShutdownStage;
+  /** A description of each request that had not finished. */
+  readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
+/**
+ * Reports a daemon shutdown that was cut short, by its deadline or by a second signal, before its cleanup
+ * finished. The cleanup may still be running.
+ *
+ * @remarks
+ * A daemon process that gets it releases what it safely can and exits, instead of waiting forever for an await
+ * that ignores cancellation, such as a lock that another process holds.
+ *
+ * @beta
+ */
+export class DaemonShutdownDeadlineError extends Error {
+  /** How long the shutdown had been running when it was cut short. */
+  public readonly elapsedMs: number;
+  /** What cut the shutdown short before its deadline, such as "a second SIGTERM". Undefined when the deadline did. */
+  public readonly forcedBy: string | undefined;
+  /** The step that was still running. */
+  public readonly stage: DaemonShutdownStage;
+  /** A description of each request that had not finished, such as `"build -t a" (running for 12.3 s)`. */
+  public readonly unfinishedRequests: ReadonlyArray<string>;
+
+  public constructor(options: IDaemonShutdownDeadlineErrorOptions) {
+    super(formatMessage(options));
+    this.name = 'DaemonShutdownDeadlineError';
+    this.elapsedMs = options.elapsedMs;
+    this.forcedBy = options.forcedBy;
+    this.stage = options.stage;
+    this.unfinishedRequests = options.unfinishedRequests;
+  }
+}
+
+const MS_PER_SECOND: number = 1000;
+
+function formatMessage(options: IDaemonShutdownDeadlineErrorOptions): string {
+  const elapsed: string = `${(options.elapsedMs / MS_PER_SECOND).toFixed(1)} s`;
+  const ending: string =
+    options.forcedBy === undefined
+      ? `did not finish within ${elapsed}`
+      : `was cut short by ${options.forcedBy} after ${elapsed}`;
+  const requests: string =
+    options.unfinishedRequests.length > 0
+      ? ` Unfinished requests: ${options.unfinishedRequests.join('; ')}.`
+      : '';
+  return `The Rush daemon's shutdown ${ending}, while ${describeStage(options.stage)}.${requests}`;
+}
+
+function describeStage(stage: DaemonShutdownStage): string {
+  switch (stage) {
+    case 'requests':
+      return 'waiting for requests to finish';
+    case 'workspaceMaintenance':
+      return 'stopping workspace maintenance';
+    case 'requestDispatcher':
+      return 'disposing the request dispatcher';
+    case 'workspaceSession':
+      return 'disposing the workspace session';
+    case 'cacheWrites':
+      return 'stopping the build cache writes';
+    case 'listener':
+      return 'closing the listener';
+  }
+}
diff --git a/libraries/rush-daemon/src/DaemonShutdownError.ts b/libraries/rush-daemon/src/DaemonShutdownError.ts
index f50a30252f8..3b424782628 100644
--- a/libraries/rush-daemon/src/DaemonShutdownError.ts
+++ b/libraries/rush-daemon/src/DaemonShutdownError.ts
@@ -6,7 +6,13 @@
  *
  * @beta
  */
-export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
+export type DaemonShutdownInitiator =
+  | 'controlClient'
+  | 'signal'
+  | 'idleTimeout'
+  | 'restart'
+  | 'host'
+  | 'socketLost';
 
 /**
  * Options for {@link DaemonShutdownError}.
@@ -17,10 +23,15 @@ export interface IDaemonShutdownErrorOptions {
   readonly initiator: DaemonShutdownInitiator;
   /** The process signal name, when the initiator is `signal`. */
   readonly signal?: string;
+  /**
+   * Whether the request had left every queue and started, as the `requestStarted` message tells a client. When it is
+   * `false`, the message says that the request was queued and did not start. Defaults to `true`.
+   */
+  readonly requestStarted?: boolean;
 }
 
 /**
- * The typed reason used to abort requests that were still running when the daemon shut down.
+ * The typed reason used to abort requests that were still running or queued when the daemon shut down.
  *
  * @remarks
  * Its message is delivered to the affected clients as the request's error message.
@@ -30,15 +41,21 @@ export interface IDaemonShutdownErrorOptions {
 export class DaemonShutdownError extends Error {
   public readonly initiator: DaemonShutdownInitiator;
   public readonly signal: string | undefined;
+  /** Whether the request had started; see {@link IDaemonShutdownErrorOptions.requestStarted}. */
+  public readonly requestStarted: boolean;
 
   public constructor(options: IDaemonShutdownErrorOptions) {
+    const requestStarted: boolean = options.requestStarted ?? true;
     super(
-      `The Rush daemon was shut down (${describeInitiator(options)}) while this request was running; ` +
-        're-run the command.'
+      `The Rush daemon was shut down (${describeInitiator(options)}) ` +
+        (requestStarted
+          ? 'while this request was running; re-run the command.'
+          : 'while this request was queued; it did not start. Re-run the command.')
     );
     this.name = 'DaemonShutdownError';
     this.initiator = options.initiator;
     this.signal = options.signal;
+    this.requestStarted = requestStarted;
   }
 }
 
@@ -54,9 +71,24 @@ function describeInitiator(options: IDaemonShutdownErrorOptions): string {
       return 'the daemon restarted to apply workspace changes';
     case 'host':
       return 'the daemon host was closed';
+    case 'socketLost':
+      return 'its socket file was deleted or replaced, so no new client could connect to it';
   }
 }
 
+/**
+ * Returns the reason to give one request when its connection closes for `reason`: a shutdown reason for a request
+ * that has not started says that it was queued. Any other reason is returned unchanged.
+ */
+export function getRequestShutdownReason<TReason extends Error>(
+  reason: TReason,
+  requestStarted: boolean
+): TReason | DaemonShutdownError {
+  return reason instanceof DaemonShutdownError && reason.requestStarted && !requestStarted
+    ? new DaemonShutdownError({ initiator: reason.initiator, signal: reason.signal, requestStarted: false })
+    : reason;
+}
+
 /** Returns the shutdown reason if the signal was aborted because the daemon shut down. */
 export function getDaemonShutdownReason(signal: AbortSignal): DaemonShutdownError | undefined {
   return signal.aborted && signal.reason instanceof DaemonShutdownError ? signal.reason : undefined;
diff --git a/libraries/rush-daemon/src/DaemonShutdownSignals.ts b/libraries/rush-daemon/src/DaemonShutdownSignals.ts
new file mode 100644
index 00000000000..e26b6bad2f9
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownSignals.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonShutdownError } from './DaemonShutdownError';
+
+/** The part of `process` that {@link listenForShutdownSignals} uses. */
+export interface IShutdownSignalEmitter {
+  on(event: NodeJS.Signals, listener: (signal: NodeJS.Signals) => void): unknown;
+  off(event: NodeJS.Signals, listener: (signal: NodeJS.Signals) => void): unknown;
+}
+
+/** Options for {@link listenForShutdownSignals}. */
+export interface IShutdownSignalsOptions {
+  readonly emitter: IShutdownSignalEmitter;
+  /** Called for each termination signal after the first one, such as a second Ctrl+C. */
+  readonly onForce: (signal: NodeJS.Signals) => void;
+  readonly getNowMs?: () => number;
+}
+
+/** The shutdown signal of a daemon that owns its process. */
+export interface IShutdownSignals {
+  /** Aborted by the first SIGINT or SIGTERM, with a {@link DaemonShutdownError}. */
+  readonly signal: AbortSignal;
+  readonly dispose: () => void;
+}
+
+const SHUTDOWN_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM'];
+// SubprocessTerminator's listener kills the tracked child processes, removes itself and sends the first signal to
+// this process again, which arrives within a moment. That copy does not ask to force the shutdown.
+const RELAY_WINDOW_MS: number = 1000;
+
+/**
+ * Listens for SIGINT and SIGTERM until disposed. The first one requests a clean shutdown. Each later one calls
+ * `onForce`, so that the daemon can exit even when its shutdown does not finish, except for one copy of the first
+ * signal that arrives within a second, which SubprocessTerminator sends.
+ */
+export function listenForShutdownSignals(options: IShutdownSignalsOptions): IShutdownSignals {
+  const { emitter, onForce, getNowMs = Date.now } = options;
+  const controller: AbortController = new AbortController();
+  let relay: { readonly signal: NodeJS.Signals; readonly deadlineMs: number } | undefined;
+  const onSignal: (signal: NodeJS.Signals) => void = (signal: NodeJS.Signals) => {
+    if (!controller.signal.aborted) {
+      relay = { signal, deadlineMs: getNowMs() + RELAY_WINDOW_MS };
+      controller.abort(new DaemonShutdownError({ initiator: 'signal', signal }));
+      return;
+    }
+    const isRelay: boolean = relay?.signal === signal && getNowMs() <= relay.deadlineMs;
+    relay = undefined;
+    if (!isRelay) onForce(signal);
+  };
+  for (const name of SHUTDOWN_SIGNALS) emitter.on(name, onSignal);
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      for (const name of SHUTDOWN_SIGNALS) emitter.off(name, onSignal);
+    }
+  };
+}
diff --git a/libraries/rush-daemon/src/DaemonSocketWatch.ts b/libraries/rush-daemon/src/DaemonSocketWatch.ts
new file mode 100644
index 00000000000..c18d83d68ed
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonSocketWatch.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonFileChange } from '@rushstack/rush-daemon-transport';
+
+/** How often a daemon checks that its socket still has its published name. */
+export const DAEMON_SOCKET_CHECK_INTERVAL_MS: number = 5000;
+
+/**
+ * Checks at an interval that the daemon's socket still has its published name, and reports the first change.
+ *
+ * @remarks
+ * The timer does not keep the process running. The watch stops once it reported a change, or when disposed.
+ */
+export class DaemonSocketWatch implements Disposable {
+  #timer: NodeJS.Timeout | undefined;
+
+  public constructor(
+    checkSocket: () => DaemonFileChange | undefined,
+    onChanged: (change: DaemonFileChange) => void,
+    intervalMs: number = DAEMON_SOCKET_CHECK_INTERVAL_MS
+  ) {
+    this.#timer = setInterval(() => {
+      const change: DaemonFileChange | undefined = checkSocket();
+      if (!change) return;
+      this[Symbol.dispose]();
+      onChanged(change);
+    }, intervalMs);
+    this.#timer.unref();
+  }
+
+  public [Symbol.dispose](): void {
+    clearInterval(this.#timer);
+    this.#timer = undefined;
+  }
+}
diff --git a/libraries/rush-daemon/src/DaemonWireRequestClient.ts b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
index f2fb40af531..fb55c5cda0b 100644
--- a/libraries/rush-daemon/src/DaemonWireRequestClient.ts
+++ b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
@@ -24,11 +24,19 @@ export interface IDaemonWireRequestClientOptions {
   readonly abortSignal: AbortSignal;
   readonly getNextEventSequence: () => number;
   readonly interactiveSession: IInteractiveRequestSession;
+  /** The `performance.now()` timestamp at which the control session read the request. */
+  readonly receivedTimeMs: number;
   readonly requestId: string;
   readonly sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
+  /** Like `sendControlAsync`, but resolves only once the operating system holds the whole frame. */
+  readonly sendControlWrittenAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
   readonly sessionId: string;
   readonly supportsRequestAdmission: boolean;
+  /** Whether the client accepts `requestStarted`; see {@link DaemonWireRequestClient.writeRequestStartedAsync}. */
+  readonly supportsRequestStarted?: boolean;
+  /** Waits for the daemon's other connections that have not sent a request yet. Resolves at once if omitted. */
+  readonly waitForConnectingClientsAsync?: () => Promise<void>;
 }
 
 /** Ordered wire destination for one request owned by a control session. @internal */
@@ -36,11 +44,17 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
   readonly #getNextEventSequence: () => number;
   readonly #requestId: string;
   readonly #sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
+  readonly #sendControlWrittenAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly #sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
+  readonly #supportsRequestStarted: boolean;
+  readonly #waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
+  #startedSent: boolean = false;
+  #requestStarted: boolean = false;
   #terminalOutcomeSent: boolean = false;
 
   public readonly abortSignal: AbortSignal;
   public readonly interactiveSession: IInteractiveRequestSession;
+  public readonly receivedTimeMs: number;
   public readonly sessionId: string;
   public readonly supportsRequestAdmission: boolean;
 
@@ -48,21 +62,34 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     this.abortSignal = options.abortSignal;
     this.#getNextEventSequence = options.getNextEventSequence;
     this.interactiveSession = options.interactiveSession;
+    this.receivedTimeMs = options.receivedTimeMs;
     this.#requestId = options.requestId;
     this.#sendControlAsync = options.sendControlAsync;
+    this.#sendControlWrittenAsync = options.sendControlWrittenAsync;
     this.#sendFrameAsync = options.sendFrameAsync;
     this.sessionId = options.sessionId;
     this.supportsRequestAdmission = options.supportsRequestAdmission;
+    this.#supportsRequestStarted = options.supportsRequestStarted === true;
+    this.#waitForConnectingClientsAsync = options.waitForConnectingClientsAsync;
   }
 
   public getNextEventSequence(): number {
     return this.#getNextEventSequence();
   }
 
+  public async waitForConnectingClientsAsync(): Promise<void> {
+    await this.#waitForConnectingClientsAsync?.();
+  }
+
   public get terminalOutcomeSent(): boolean {
     return this.#terminalOutcomeSent;
   }
 
+  /** Whether the request has left every queue, whether or not its client subscribed to `requestStarted`. */
+  public get requestStarted(): boolean {
+    return this.#requestStarted;
+  }
+
   public writeEventAsync(event: IDaemonEventEnvelope): Promise<void> {
     return this.#sendFrameAsync({
       kind: DaemonFrameType.event,
@@ -86,9 +113,21 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     return this.#sendControlAsync(message);
   }
 
-  public writeResultAsync(
-    result: IDaemonCommandResult | IDaemonPhasedRequestResult
-  ): Promise<void> {
+  /**
+   * Tells a client that subscribed with `supportsRequestStarted` that the request left every queue, once. Frames
+   * are sent in order, so this precedes the request's output. For every client, it records that the request started,
+   * so that a shutdown tells a request that never started that it was queued.
+   * It resolves only once the operating system holds the notice, so that the client can read it even if the daemon
+   * exits as soon as the request starts.
+   */
+  public writeRequestStartedAsync(): Promise<void> {
+    this.#requestStarted = true;
+    if (!this.#supportsRequestStarted || this.#startedSent) return Promise.resolve();
+    this.#startedSent = true;
+    return this.#sendControlWrittenAsync({ kind: 'requestStarted', payload: { requestId: this.#requestId } });
+  }
+
+  public writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void> {
     this.#claimTerminalOutcome();
     return this.#sendControlAsync({ kind: 'requestResult', payload: result });
   }
@@ -98,10 +137,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     return this.#sendControlAsync({ kind: 'terminalPolicy', payload: result });
   }
 
-  public writeRejectionAsync(
-    code: DaemonRequestRejectionCode,
-    message: string
-  ): Promise<void> {
+  public writeRejectionAsync(code: DaemonRequestRejectionCode, message: string): Promise<void> {
     this.#claimTerminalOutcome();
     return this.#sendControlAsync({
       kind: 'requestRejected',
@@ -109,11 +145,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     });
   }
 
-  #writeLogAsync(
-    operationId: string,
-    stream: 'stdout' | 'stderr',
-    chunk: Uint8Array
-  ): Promise<void> {
+  #writeLogAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void> {
     return this.#sendFrameAsync({
       kind: stream === 'stdout' ? DaemonFrameType.logStdout : DaemonFrameType.logStderr,
       payload: encodeDaemonLogChunk({ chunk, operationId })
diff --git a/libraries/rush-daemon/src/EngineActivityOptions.ts b/libraries/rush-daemon/src/EngineActivityOptions.ts
new file mode 100644
index 00000000000..bd878251258
--- /dev/null
+++ b/libraries/rush-daemon/src/EngineActivityOptions.ts
@@ -0,0 +1,32 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { _IOperationActivityOptions } from '@microsoft/rush-lib';
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+/**
+ * Activity options for text that Rush or a Rush plugin wrote through a daemon engine's terminal. The graph's event
+ * sink (PhasedRequestEventMultiplexer) passes the options object unchanged to each request's event sink.
+ */
+export interface IEngineActivityOptions extends _IOperationActivityOptions {
+  /**
+   * Set when the text is a warning or an error. Request event sinks copy it into the activity payload, so
+   * clients that print only a summary can still show these lines.
+   */
+  readonly severity?: 'warning' | 'error';
+}
+
+const WARNING_ACTIVITY: IEngineActivityOptions = { stderr: true, severity: 'warning' };
+const ERROR_ACTIVITY: IEngineActivityOptions = { stderr: true, severity: 'error' };
+const OUTPUT_ACTIVITY: IEngineActivityOptions = { stderr: false };
+
+export function getEngineActivityOptions(severity: TerminalProviderSeverity): IEngineActivityOptions {
+  switch (severity) {
+    case TerminalProviderSeverity.warning:
+      return WARNING_ACTIVITY;
+    case TerminalProviderSeverity.error:
+      return ERROR_ACTIVITY;
+    default:
+      return OUTPUT_ACTIVITY;
+  }
+}
diff --git a/libraries/rush-daemon/src/EngineTerminalProvider.ts b/libraries/rush-daemon/src/EngineTerminalProvider.ts
index 88345d03723..8b42edaf82a 100644
--- a/libraries/rush-daemon/src/EngineTerminalProvider.ts
+++ b/libraries/rush-daemon/src/EngineTerminalProvider.ts
@@ -2,8 +2,10 @@
 // See LICENSE in the project root for license information.
 
 import type { IOperationGraph, _IOperationGraphEventSink } from '@microsoft/rush-lib';
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
 
+import { getEngineActivityOptions } from './EngineActivityOptions';
 import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
 
 export class EngineTerminalProvider implements ITerminalProvider {
@@ -21,13 +23,32 @@ export class EngineTerminalProvider implements ITerminalProvider {
 
   /**
    * Drains buffered diagnostics into the failure description, so that they belong to the failing request
-   * and are never replayed into a later request.
+   * and are never replayed into a later request. Like the request output, the description omits verbose and
+   * debug messages unless the graph runs in debug mode: loading a large workspace writes thousands of them.
+   *
+   * The error comes first, because clients give the first line as the reason for the failure. The other
+   * diagnostics follow in the order they were written: a warning written while parsing the command line, such
+   * as one about the compatible plugin list, is not the reason for an error that selecting operations throws.
    */
   public describeError(error: unknown): string {
-    return [
-      ...this.#messages.splice(0).map(({ text }) => text),
-      error instanceof Error ? error.message : String(error)
-    ].join('\n');
+    const lines: string[] = [];
+    let firstErrorLineIndex: number = -1;
+    for (const { text, severity } of this.#messages.splice(0)) {
+      const line: string = text.replace(/\r?\n$/, '');
+      if (this.#isHidden(severity) || !line.trim()) continue;
+      if (firstErrorLineIndex < 0 && severity === TerminalProviderSeverity.error) {
+        firstErrorLineIndex = lines.length;
+      }
+      lines.push(line);
+    }
+    // An AlreadyReportedError only says "An error occurred."; the error lines written before it are the report.
+    const reason: string =
+      firstErrorLineIndex >= 0 && error instanceof Error && error instanceof AlreadyReportedError
+        ? lines.splice(firstErrorLineIndex, 1)[0]
+        : error instanceof Error
+          ? error.message
+          : String(error);
+    return [reason, ...lines].join('\n');
   }
 
   public get hasBufferedMessages(): boolean {
@@ -88,15 +109,17 @@ export class EngineTerminalProvider implements ITerminalProvider {
     );
   }
 
-  #emit(text: string, severity: TerminalProviderSeverity): void {
-    if (
+  #isHidden(severity: TerminalProviderSeverity): boolean {
+    return (
       !this.#graph?.debugMode &&
       (severity === TerminalProviderSeverity.verbose || severity === TerminalProviderSeverity.debug)
-    ) {
+    );
+  }
+
+  #emit(text: string, severity: TerminalProviderSeverity): void {
+    if (this.#isHidden(severity)) {
       return;
     }
-    this.#graph?.eventSink?.onActivity?.(text, {
-      stderr: severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning
-    });
+    this.#graph?.eventSink?.onActivity?.(text, getEngineActivityOptions(severity));
   }
 }
diff --git a/libraries/rush-daemon/src/EnvironmentRestartReason.ts b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
new file mode 100644
index 00000000000..a70282dfc16
--- /dev/null
+++ b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getWorkspaceFingerprintEnvironmentEntries } from '@microsoft/rush-lib';
+import type { IDaemonEnvironmentChangedRestartReason } from '@rushstack/rush-daemon-protocol';
+
+/**
+ * The variables of an environment that a daemon's identity includes, by name, with the values that the workspace
+ * input fingerprint hashes: without the variables that it ignores, and with repeated `PATH` entries removed.
+ */
+export type EnvironmentIdentityEntries = ReadonlyMap<string, string>;
+
+/**
+ * A character that would split, restyle or reorder a line that prints the name: a control character, such as a
+ * newline or ESC, a line or paragraph separator, or a format character, such as a bidirectional override. A
+ * backslash is escaped too, so that each escape in a printed name stands for one character of the name.
+ */
+const ESCAPED_CHARACTER: RegExp = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\\]/gu;
+
+/** Returns the variables of `environment` that a daemon's identity includes. */
+export function getEnvironmentIdentityEntries(
+  environment: Readonly<Record<string, string | undefined>>
+): EnvironmentIdentityEntries {
+  return new Map(getWorkspaceFingerprintEnvironmentEntries(environment));
+}
+
+/**
+ * Says why a daemon that started with `startupEntries` restarts for a request with `environment`: the sorted names
+ * of the variables that are set in only one of them or set to different values, never the values. Each control,
+ * format, line separator or paragraph separator character of a name, and each backslash, is written as an escape:
+ * `\xHH` below U+0100 and `\u{H…}` from there on. So the client and the daemon log print the names on one line, and
+ * a name that contains ESC prints differently from one that contains the text `\x1b`. Returns `undefined` when the
+ * environments do not differ, which is when their fingerprint `environmentHash` is the same.
+ */
+export function getEnvironmentRestartReason(
+  startupEntries: EnvironmentIdentityEntries,
+  environment: Readonly<Record<string, string | undefined>>
+): IDaemonEnvironmentChangedRestartReason | undefined {
+  const requestEntries: EnvironmentIdentityEntries = getEnvironmentIdentityEntries(environment);
+  const variableNames: Set<string> = new Set();
+  for (const [name, value] of startupEntries) {
+    if (requestEntries.get(name) !== value) variableNames.add(name);
+  }
+  for (const name of requestEntries.keys()) {
+    if (!startupEntries.has(name)) variableNames.add(name);
+  }
+  if (variableNames.size === 0) return undefined;
+  return { kind: 'environmentChanged', variableNames: Array.from(variableNames, escapeVariableName).sort() };
+}
+
+function escapeVariableName(name: string): string {
+  return name.replace(ESCAPED_CHARACTER, (character: string) => {
+    // The `u` flag matches a character above U+FFFF as one character, so this is its whole code point.
+    const codePoint: number = character.codePointAt(0)!;
+    const hex: string = codePoint.toString(16);
+    return codePoint < 0x100 ? `\\x${hex.padStart(2, '0')}` : `\\u{${hex}}`;
+  });
+}
diff --git a/libraries/rush-daemon/src/FreshCaptureCoalescer.ts b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
new file mode 100644
index 00000000000..efef5bfdad2
--- /dev/null
+++ b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
@@ -0,0 +1,113 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+interface ICapture<TValue> {
+  readonly startTimeMs: number;
+  readonly running: Promise<TValue>;
+  next: Promise<TValue> | undefined;
+}
+
+interface ISucceededCapture<TValue> {
+  readonly startTimeMs: number;
+  readonly result: Promise<TValue>;
+}
+
+/**
+ * Options for {@link FreshCaptureCoalescer}.
+ */
+export interface IFreshCaptureCoalescerOptions {
+  /**
+   * Returns the current time on the clock that callers use for `notBeforeMs`. Defaults to `performance.now()`.
+   */
+  readonly now?: () => number;
+}
+
+function ignore(): void {}
+
+/**
+ * Shares workspace input captures between concurrent requests, without ever giving a caller a capture that
+ * began before the caller asked for one, or before the time that the caller passes as `notBeforeMs`.
+ *
+ * @remarks
+ * A capture reads the workspace while it runs, so a capture that is already running can miss a change made just
+ * before a later caller arrived. A caller that finds a capture running therefore waits for the next capture,
+ * which starts when the running one settles and is shared by every caller that arrived in the meantime.
+ * Concurrent callers cost at most two captures instead of one each, and every caller receives a result that is
+ * at least as fresh as a capture it started itself.
+ *
+ * A caller that knows an earlier time after which every change it depends on was made, such as the time at which
+ * the daemon received its request, can pass that time as `notBeforeMs`. It then shares a running capture that
+ * started at or after that time instead of waiting for the next one. It also receives the latest capture that
+ * succeeded, if that capture started at or after that time: a capture can finish before such a caller asks for
+ * it, for example when it awaits no I/O and so holds the event loop until it returns. The coalescer retains that
+ * one result for each scope and key until a capture that started later succeeds. A caller that does not pass
+ * `notBeforeMs` never receives a capture that has settled.
+ *
+ * Callers that pass the same scope and key must request the same capture.
+ */
+export class FreshCaptureCoalescer<TScope extends object, TValue> {
+  readonly #captures: WeakMap<TScope, Map<string, ICapture<TValue>>> = new WeakMap();
+  readonly #succeeded: WeakMap<TScope, Map<string, ISucceededCapture<TValue>>> = new WeakMap();
+  readonly #now: () => number;
+
+  public constructor(options: IFreshCaptureCoalescerOptions = {}) {
+    this.#now = options.now ?? (() => performance.now());
+  }
+
+  /**
+   * Returns a capture that started after this call, or at or after `notBeforeMs` if it is specified.
+   *
+   * @param scope - Captures are shared only within a scope.
+   * @param key - Identifies the capture within the scope.
+   * @param captureAsync - Starts a capture when the caller cannot share one.
+   * @param notBeforeMs - A time on this coalescer's clock. A running capture, or the latest capture that succeeded,
+   * is shared with the caller if it started at or after this time. If it is not specified, the caller shares only a
+   * capture that starts after this call.
+   */
+  public captureAsync(
+    scope: TScope,
+    key: string,
+    captureAsync: () => Promise<TValue>,
+    notBeforeMs?: number
+  ): Promise<TValue> {
+    if (notBeforeMs !== undefined) {
+      const succeeded: ISucceededCapture<TValue> | undefined = this.#succeeded.get(scope)?.get(key);
+      if (succeeded && succeeded.startTimeMs >= notBeforeMs) return succeeded.result;
+    }
+    const capture: ICapture<TValue> | undefined = this.#captures.get(scope)?.get(key);
+    if (!capture) return this.#start(scope, key, captureAsync);
+    if (notBeforeMs !== undefined && capture.startTimeMs >= notBeforeMs) return capture.running;
+    capture.next ??= capture.running.then(ignore, ignore).then(() => this.#start(scope, key, captureAsync));
+    return capture.next;
+  }
+
+  #start(scope: TScope, key: string, captureAsync: () => Promise<TValue>): Promise<TValue> {
+    let captures: Map<string, ICapture<TValue>> | undefined = this.#captures.get(scope);
+    if (!captures) {
+      captures = new Map();
+      this.#captures.set(scope, captures);
+    }
+    const startTimeMs: number = this.#now();
+    const running: Promise<TValue> = new Promise<TValue>((resolve) => resolve(captureAsync()));
+    const capture: ICapture<TValue> = { startTimeMs, running, next: undefined };
+    captures.set(key, capture);
+    const forget: () => void = () => {
+      if (captures.get(key) === capture) captures.delete(key);
+    };
+    const retain: () => void = () => {
+      let succeeded: Map<string, ISucceededCapture<TValue>> | undefined = this.#succeeded.get(scope);
+      if (!succeeded) {
+        succeeded = new Map();
+        this.#succeeded.set(scope, succeeded);
+      }
+      // Captures of one key can overlap, so one that started earlier can succeed later.
+      const latest: ISucceededCapture<TValue> | undefined = succeeded.get(key);
+      if (!latest || latest.startTimeMs <= startTimeMs) succeeded.set(key, { startTimeMs, result: running });
+    };
+    running.then(() => {
+      retain();
+      forget();
+    }, forget);
+    return running;
+  }
+}
diff --git a/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts b/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
index c2cffbb35ab..fe3ac552b69 100644
--- a/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
+++ b/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
@@ -10,6 +10,7 @@ import { Terminal, TerminalProviderSeverity } from '@rushstack/terminal';
 import type { ITerminal, ITerminalProvider } from '@rushstack/terminal';
 
 import {
+  applyDaemonOperationGroupsMarker,
   createGlobalCommandEnvironment,
   resolveGlobalCommandEnvironment,
   resolveGlobalCommandWorkingDirectory,
@@ -41,7 +42,10 @@ const CHILD_OUTPUT_DRAIN_IDLE_TIMEOUT_MS: number = 250;
 export interface IGlobalCommandSpawnOptions {
   /** An absolute directory, physically confined to the workspace. Explicit Windows path spelling is preserved. */
   readonly cwd?: string;
-  /** A complete child environment; cannot be combined with environmentOverlay. */
+  /**
+   * A complete child environment; cannot be combined with environmentOverlay. Either way, the child gets the daemon's
+   * own `RUSHD_OPERATION_GROUPS`, or none, instead of the request's.
+   */
   readonly environment?: Readonly<NodeJS.ProcessEnv>;
   readonly environmentOverlay?: Readonly<NodeJS.ProcessEnv>;
   readonly forwardInput?: boolean;
@@ -262,10 +266,11 @@ export class GlobalCommandExecutionContext implements IGlobalCommandExecutionCon
     const child: childProcess.ChildProcessWithoutNullStreams = childProcess.spawn(command, [...args], {
       cwd: process.platform === 'win32' ? (options.cwd ?? canonicalCwd) : canonicalCwd,
       detached: SubprocessTerminator.RECOMMENDED_OPTIONS.detached,
-      env:
+      env: applyDaemonOperationGroupsMarker(
         options.environment === undefined
           ? createGlobalCommandEnvironment(this.environment, options.environmentOverlay)
-          : resolveGlobalCommandEnvironment(options.environment),
+          : resolveGlobalCommandEnvironment(options.environment)
+      ),
       shell: options.shell,
       stdio: 'pipe',
       windowsHide: options.windowsHide
diff --git a/libraries/rush-daemon/src/GlobalCommandRequest.ts b/libraries/rush-daemon/src/GlobalCommandRequest.ts
index 0b41a05f27e..0d7a148378f 100644
--- a/libraries/rush-daemon/src/GlobalCommandRequest.ts
+++ b/libraries/rush-daemon/src/GlobalCommandRequest.ts
@@ -12,7 +12,9 @@ import type {
   DaemonTerminalRequirement,
   IDaemonRequestAdmissionOptions
 } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transport';
 
+import { freezeDaemonRequestAdmissionOptions } from './WorkspaceRequestAdmission';
 import type { IWorkspaceSession } from './WorkspaceSession';
 
 /**
@@ -100,7 +102,7 @@ export function resolveGlobalCommandRequest(
   validateDaemonRequestAdmissionOptions(options.admission);
   const cwd: string = resolveGlobalCommandWorkingDirectory(options.cwd, workspaceSession);
   const request: IResolvedGlobalCommandRequest = Object.freeze({
-    admission: options.admission ? Object.freeze({ ...options.admission }) : undefined,
+    admission: options.admission ? freezeDaemonRequestAdmissionOptions(options.admission) : undefined,
     commandName: options.commandName,
     commandOrigin: options.commandOrigin,
     cwd,
@@ -130,6 +132,23 @@ export function resolveGlobalCommandEnvironment(environment: Readonly<NodeJS.Pro
   return createEnvironmentMap(environment).toObject();
 }
 
+/**
+ * Returns a copy of a child environment built from a request, with the daemon's own marker of the processes that it
+ * starts (`RUSHD_OPERATION_GROUPS`), or without one when the daemon has none, whatever the request's value is.
+ */
+export function applyDaemonOperationGroupsMarker(
+  environment: Readonly<NodeJS.ProcessEnv>
+): NodeJS.ProcessEnv {
+  const environmentMap: EnvironmentMap = new EnvironmentMap(environment);
+  const marker: string | undefined = process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+  if (marker === undefined) {
+    environmentMap.unset(DAEMON_OPERATION_GROUPS_ENV_VAR);
+  } else {
+    environmentMap.set(DAEMON_OPERATION_GROUPS_ENV_VAR, marker);
+  }
+  return environmentMap.toObject();
+}
+
 function validateCommandOrigin(value: DaemonRushCommandOrigin): void {
   if (value !== 'built-in' && value !== 'custom') {
     throw new Error('Global command origin is not recognized.');
diff --git a/libraries/rush-daemon/src/NativeMutationInstallationState.ts b/libraries/rush-daemon/src/NativeMutationInstallationState.ts
new file mode 100644
index 00000000000..ee48341a066
--- /dev/null
+++ b/libraries/rush-daemon/src/NativeMutationInstallationState.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { BigIntStats } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
+import * as path from 'node:path';
+
+import { RushConstants, type RushConfiguration } from '@microsoft/rush-lib';
+import { FileSystem } from '@rushstack/node-core-library';
+
+/**
+ * What the files that show whether a native `install` or `update` changed the installation contained at one time.
+ */
+export interface INativeMutationInstallationState {
+  /** The identity of each subspace's `last-install.flag`, by path, or `undefined` for a flag that doesn't exist. */
+  readonly flags: ReadonlyMap<string, string | undefined>;
+  /** Whether the hotlink state records a link. A state that can't be parsed counts as one. */
+  readonly hasHotlinks: boolean;
+}
+
+/**
+ * Reads the files. Returns `undefined`, which never counts as unchanged, if one exists but can't be read.
+ */
+export async function captureNativeMutationInstallationStateAsync(
+  rushConfiguration: RushConfiguration
+): Promise<INativeMutationInstallationState | undefined> {
+  try {
+    // The same flags as the installation files of the workspace input fingerprint.
+    const flagPaths: string[] = rushConfiguration.subspaces.map((subspace) =>
+      path.join(subspace.getSubspaceTempFolderPath(), 'last-install.flag')
+    );
+    const identities: (string | undefined)[] = await Promise.all(flagPaths.map(getFileIdentityAsync));
+    return {
+      flags: new Map(flagPaths.map((flagPath: string, index: number) => [flagPath, identities[index]])),
+      hasHotlinks: await hasHotlinksAsync(
+        path.join(rushConfiguration.commonTempFolder, RushConstants.rushHotlinkStateFilename)
+      )
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Whether a native `install` or `update` that ran between the two captures left the installation as it was.
+ *
+ * @remarks
+ * Rush deletes a subspace's `last-install.flag` before it changes that subspace's `node_modules`, and writes it
+ * again once the subspace is installed, before the `afterInstall` hooks run. The flag doesn't record when it was
+ * written, so a reinstall can write the same content again. Each flag is therefore compared by its file identity
+ * (device, inode, size and times), not by its content, and a flag that was missing beforehand proves nothing. Rush
+ * also deletes the virtual store folders of hotlinked packages before it deletes the flag, and it rewrites the hotlink
+ * state only after them, so a workspace with a hotlink never counts as unchanged.
+ */
+export function isInstallationUnchangedByMutation(
+  before: INativeMutationInstallationState,
+  after: INativeMutationInstallationState
+): boolean {
+  if (before.hasHotlinks || after.hasHotlinks || before.flags.size !== after.flags.size) return false;
+  for (const [flagPath, identity] of before.flags) {
+    if (identity === undefined || after.flags.get(flagPath) !== identity) return false;
+  }
+  return true;
+}
+
+async function getFileIdentityAsync(filePath: string): Promise<string | undefined> {
+  let stats: BigIntStats;
+  try {
+    stats = await stat(filePath, { bigint: true });
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) return undefined;
+    throw error;
+  }
+  return [stats.dev, stats.ino, stats.size, stats.mtimeNs, stats.ctimeNs, stats.birthtimeNs].join(':');
+}
+
+async function hasHotlinksAsync(statePath: string): Promise<boolean> {
+  let text: string;
+  try {
+    text = await readFile(statePath, 'utf8');
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) return false;
+    throw error;
+  }
+  let state: { fileVersion?: unknown; linksBySubspace?: unknown } | undefined;
+  try {
+    state = JSON.parse(text);
+  } catch {
+    return true;
+  }
+  const links: unknown = state?.linksBySubspace;
+  // Rush reads file version 0 only.
+  if (state?.fileVersion !== 0 || typeof links !== 'object' || links === null) return true;
+  return Object.values(links).some(
+    (subspaceLinks: unknown) => !Array.isArray(subspaceLinks) || subspaceLinks.length > 0
+  );
+}
diff --git a/libraries/rush-daemon/src/NativeMutationRequest.ts b/libraries/rush-daemon/src/NativeMutationRequest.ts
index d22c58e74c1..25310a30ff7 100644
--- a/libraries/rush-daemon/src/NativeMutationRequest.ts
+++ b/libraries/rush-daemon/src/NativeMutationRequest.ts
@@ -13,7 +13,7 @@ import type { GlobalCommandExecutor } from './GlobalCommandRequestRouter';
 export function createNativeMutationResolver(
   envelope: IDaemonRequestEnvelope,
   rushVersion: string,
-  onCompletedAsync: (context: IGlobalCommandExecutionContext) => Promise<void>
+  onCompletedAsync: (context: IGlobalCommandExecutionContext, exitCode: number) => Promise<void>
 ): IDaemonRequestResolver {
   if (
     envelope.commandOrigin !== 'built-in' ||
@@ -38,7 +38,7 @@ export function createNativeMutationResolver(
         else resolve(code);
       });
     });
-    await onCompletedAsync(context);
+    await onCompletedAsync(context, exitCode);
     return { exitCode };
   };
   return {
diff --git a/libraries/rush-daemon/src/NativeRepositoryLock.ts b/libraries/rush-daemon/src/NativeRepositoryLock.ts
new file mode 100644
index 00000000000..dbd68713d32
--- /dev/null
+++ b/libraries/rush-daemon/src/NativeRepositoryLock.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { PhasedCommandEngineBusyError } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+
+/** The resource name of native Rush's repository lock, in the common temp folder. */
+const NATIVE_LOCK_RESOURCE_NAME: string = 'rush';
+
+/**
+ * Whether this process holds native Rush's repository lock in `lockFolder`, after it failed to take the lock.
+ *
+ * @remarks
+ * A process that fails to take the lock deletes its own lock file again, so only the process that holds the lock
+ * still has one. On Windows, the lock file does not name its process, so this is never known there.
+ */
+export function isNativeLockHeldByThisProcess(lockFolder: string): boolean {
+  return (
+    process.platform !== 'win32' &&
+    fs.existsSync(LockFile.getLockFilePath(lockFolder, NATIVE_LOCK_RESOURCE_NAME))
+  );
+}
+
+/**
+ * Takes native Rush's repository lock in `lockFolder`, or returns undefined while another process holds it.
+ * If this process holds it already, for another request, waiting for it would not end, so this fails at once, as a
+ * native Rush command does.
+ */
+export function tryAcquireNativeLock(lockFolder: string): LockFile | undefined {
+  const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, NATIVE_LOCK_RESOURCE_NAME);
+  if (!lock && isNativeLockHeldByThisProcess(lockFolder)) {
+    throw new PhasedCommandEngineBusyError();
+  }
+  return lock;
+}
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
index 75367181132..c6c43bac466 100644
--- a/libraries/rush-daemon/src/OperationOutputFingerprints.ts
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -6,42 +6,175 @@ import * as path from 'node:path';
 
 import {
   OperationStatus,
+  type IConfigurableOperation,
+  type IInputsSnapshot,
   type IOperationExecutionResult,
   type IOperationGraph,
+  type IOperationGraphIterationOptions,
   type Operation
 } from '@microsoft/rush-lib';
 
+import type { IOutputFolderDigest, IOutputFolderSet } from './OutputFolderDigest';
+import {
+  getSharedOutputFolderDigester,
+  type IBackgroundOutputFolderDigests,
+  type OutputFolderDigester
+} from './OutputFolderDigestPool';
+
 const PLUGIN_NAME: 'DaemonOperationOutputFingerprints' = 'DaemonOperationOutputFingerprints';
 
 /**
- * Retained results that allow the warm graph to skip an operation. Other statuses always re-run.
+ * Runs after Rush's incremental decision, which taps `configureIteration` at the default stage.
+ */
+const CONFIGURE_ITERATION_STAGE: number = 100;
+
+/**
+ * Runs after Rush's own `afterExecuteOperationAsync` taps, which use stages up to 1, so that the outputs are recorded
+ * with the final status of the result.
+ */
+const RECORD_OPERATION_STAGE: number = 100;
+
+/**
+ * Retained results that allow the warm graph to skip an operation. Other statuses always re-run. The graph only
+ * retains a `Skipped` result for an operation that it selected, when a plugin (e.g. change detection) found its
+ * outputs up to date.
  */
 const TRACKED_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Success,
-  OperationStatus.FromCache
+  OperationStatus.FromCache,
+  OperationStatus.Skipped
 ]);
 
 interface IOutputFingerprint {
   readonly record: IOperationExecutionResult;
   readonly fingerprint: string;
+  /** Undefined if the outputs could not be read when recorded; that never matches. */
+  readonly contentFingerprint: string | undefined;
+  /** The number of entries below the output folders when recorded. */
+  readonly entryCount: number;
+}
+
+interface IContentWalk {
+  readonly operation: Operation;
+  readonly folderSet: IOutputFolderSet;
+  /** The expected size of the walk, so that the largest walks start first. */
+  readonly entryCount: number;
+}
+
+interface ISkipCheck extends IContentWalk {
+  readonly state: IConfigurableOperation;
+  readonly contentFingerprint: string;
+}
+
+interface IRecordWalk extends IContentWalk {
+  readonly record: IOperationExecutionResult;
+  readonly fingerprint: string;
+}
+
+/** Output folders that the digester's worker threads walk while the inputs are reconciled. */
+interface IEarlyWalk {
+  readonly digests: IBackgroundOutputFolderDigests;
+  readonly folderSets: ReadonlyArray<IOutputFolderSet>;
+  /** The index of each walked operation's folder set. */
+  readonly indexByOperation: ReadonlyMap<Operation, number>;
+  /** The inputs snapshot of the reconciliation that started the walk, once that reconciliation succeeded. */
+  inputsSnapshot: IInputsSnapshot | undefined;
+}
+
+/** The output folders that a plan of the executing iteration for another request's work walked. */
+interface IExtensionWalks {
+  /** The options of the plan, which `extendIteration` receives again if the graph accepts it. */
+  readonly context: IOperationGraphIterationOptions;
+  readonly operations: ReadonlyArray<Operation>;
 }
 
 /**
- * Detects retained successful operations whose declared output folders were changed outside the daemon.
+ * Detects retained successful or up-to-date operations whose declared output folders were changed outside
+ * the daemon.
  *
  * @remarks
  * Build outputs are normally git-ignored, so they do not contribute to any operation state hash. Without
- * this check, deleting an output folder (`rm -rf lib`, `git clean -xdf`, `heft clean`) leaves a warm graph
- * that reports the operation as up to date. The fingerprint is deliberately cheap: one `stat` per declared
- * output folder, capturing existence, identity and modification time. This detects deletion, recreation,
- * and adding, removing or renaming direct children; it does not detect in-place edits of nested files.
+ * this check, a warm graph reports an operation as up to date after its outputs were deleted (`rm -rf lib`,
+ * `git clean -xdf`, `heft clean`) or edited, and a consumer that runs on top of edited outputs stores them
+ * in its own build cache entry. There are two checks:
+ *
+ * - On every reconciliation, one `stat` per declared output folder of every retained operation, capturing
+ *   existence, identity and modification time. This detects deleting or recreating a folder, and adding,
+ *   removing or renaming its direct children, unless that happens in the same tick of the file system's clock
+ *   as the folder's last change (up to 16 ms on Windows).
+ *
+ * - When an iteration is configured, a walk of the declared output folders of each selected operation that
+ *   Rush would otherwise skip. It compares the relative path of every nested entry and the size,
+ *   modification time and identity of every entry that is not a folder. This also detects in-place edits
+ *   and nested additions, deletions and renames. Its cost grows with the output files of the request's
+ *   selection, not with the whole warm graph. Once a walk takes long enough to matter, walks are spread
+ *   over a pool of worker threads (see {@link OutputFolderDigester}), and the pool walks the folders that
+ *   the last iteration walked while the inputs are reconciled (see `walkWhileReconcilingAsync`).
+ *
+ * Both record the outputs of a result when Rush reports it, before any consumer of the operation starts, so that
+ * a change that is made while the rest of the iteration runs is found by the next request.
  */
 export class OperationOutputFingerprints {
+  readonly #digester: OutputFolderDigester;
   readonly #fingerprints: Map<Operation, IOutputFingerprint> = new Map();
   readonly #graph: IOperationGraph;
+  /** The operations whose output folders the last iteration walked. The next one probably walks them again. */
+  #lastWalkedOperations: Set<Operation> = new Set();
+  /** The walks of a plan of the executing iteration for another request's work, until the graph accepts it. */
+  #extensionWalks: IExtensionWalks | undefined;
+  #earlyWalk: IEarlyWalk | undefined;
+  /** The walks of results that this iteration recorded when Rush reported them, one folder set at a time. */
+  #recordedWalkCount: number = 0;
+  #recordedWalkMs: number = 0;
 
-  public constructor(graph: IOperationGraph) {
+  public constructor(
+    graph: IOperationGraph,
+    digester: OutputFolderDigester = getSharedOutputFolderDigester()
+  ) {
+    this.#digester = digester;
     this.#graph = graph;
+    graph.hooks.configureIteration.tap(
+      { name: PLUGIN_NAME, stage: CONFIGURE_ITERATION_STAGE },
+      (
+        currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
+        lastResults: ReadonlyMap<Operation, IOperationExecutionResult>,
+        context: IOperationGraphIterationOptions
+      ) => {
+        const { startedOperations } = context;
+        if (startedOperations) {
+          // The graph can still refuse this plan of the executing iteration for another request's work. The early
+          // walk belongs to the reconciliation that starts the next iteration.
+          this.#extensionWalks = {
+            context,
+            operations: this.#enableOperationsWithChangedContents(currentStates, undefined, startedOperations)
+          };
+        } else {
+          this.#extensionWalks = undefined;
+          this.#lastWalkedOperations = new Set(
+            this.#enableOperationsWithChangedContents(currentStates, this.#takeEarlyWalk(context), undefined)
+          );
+        }
+      }
+    );
+    graph.hooks.extendIteration.tap(
+      PLUGIN_NAME,
+      (
+        records: ReadonlyMap<Operation, IOperationExecutionResult>,
+        context: IOperationGraphIterationOptions
+      ) => {
+        const walks: IExtensionWalks | undefined = this.#extensionWalks;
+        this.#extensionWalks = undefined;
+        if (walks?.context === context) {
+          for (const operation of walks.operations) {
+            this.#lastWalkedOperations.add(operation);
+          }
+        }
+      }
+    );
+    graph.hooks.afterExecuteOperationAsync.tap(
+      { name: PLUGIN_NAME, stage: RECORD_OPERATION_STAGE },
+      (record: IOperationExecutionResult) => this.#recordOperation(record)
+    );
     graph.hooks.afterExecuteIterationAsync.tap(
       PLUGIN_NAME,
       (status: OperationStatus, records: ReadonlyMap<Operation, IOperationExecutionResult>) => {
@@ -49,10 +182,47 @@ export class OperationOutputFingerprints {
         return status;
       }
     );
+    graph.abortController.signal.addEventListener('abort', () => this.#takeEarlyWalk()?.digests.cancel(), {
+      once: true
+    });
+  }
+
+  /**
+   * Runs a reconciliation of the inputs while the digester's worker threads walk the output folders that the
+   * last iteration walked, so that the next iteration's content check can use those digests instead of walking.
+   *
+   * @remarks
+   * Only an iteration that uses the inputs snapshot of this reconciliation uses the digests. Every request
+   * that such an iteration serves was received before the reconciliation started, so the walks see each change
+   * that was made before one of those requests was sent, as the inputs snapshot does. A later change can be
+   * missed, as it can by the inputs snapshot, and the next request finds it: an operation keeps its recorded
+   * fingerprint until it produces a new result. No operation writes its outputs during the walks, because the
+   * daemon reconciles only while no iteration runs, including work that continues after an early result.
+   */
+  public async walkWhileReconcilingAsync<TResult extends { readonly inputsSnapshot: IInputsSnapshot }>(
+    reconcileAsync: () => Promise<TResult>
+  ): Promise<TResult> {
+    this.#takeEarlyWalk()?.digests.cancel();
+    const earlyWalk: IEarlyWalk | undefined = this.#graph.abortController.signal.aborted
+      ? undefined
+      : this.#startEarlyWalk();
+    this.#earlyWalk = earlyWalk;
+    try {
+      const result: TResult = await reconcileAsync();
+      if (earlyWalk) {
+        earlyWalk.inputsSnapshot = result.inputsSnapshot;
+      }
+      return result;
+    } catch (error) {
+      if (earlyWalk && this.#earlyWalk === earlyWalk) {
+        this.#takeEarlyWalk()?.digests.cancel();
+      }
+      throw error;
+    }
   }
 
   /**
-   * Returns retained successful operations whose output folders no longer match the recorded fingerprint.
+   * Returns retained operations whose output folders no longer match the recorded fingerprint.
    *
    * @remarks
    * Fingerprints of changed operations are forgotten only after all cleanup succeeded, so a failed
@@ -76,19 +246,204 @@ export class OperationOutputFingerprints {
     return changed;
   }
 
+  /**
+   * Returns the retained operations whose output folders no longer match the recorded fingerprint, as
+   * {@link OperationOutputFingerprints.getOperationsWithChangedOutputs} does, for adding another request's work
+   * to the executing iteration with the given records.
+   *
+   * @remarks
+   * Every fingerprint is kept, so that the next reconciliation checks the outputs again if the caller does not
+   * invalidate the returned operations. An operation that the iteration dispatched may be writing its outputs,
+   * and one that it runs produces new outputs anyway, so neither is checked.
+   */
+  public peekOperationsWithChangedOutputs(
+    iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>
+  ): Operation[] {
+    const changed: Operation[] = [];
+    for (const [operation, { record, fingerprint }] of this.#fingerprints) {
+      const iterationRecord: IOperationExecutionResult | undefined = iterationRecords.get(operation);
+      if (
+        (!iterationRecord || (!iterationRecord.enabled && isUndispatched(iterationRecord))) &&
+        this.#isRetained(operation, record) &&
+        getOutputFingerprint(operation) !== fingerprint
+      ) {
+        // Once invalidated, the operation must run instead of skipping because its input state is unchanged
+        forgetLegacySkipState(operation);
+        changed.push(operation);
+      }
+    }
+    return changed;
+  }
+
+  /**
+   * Enables each selected operation that Rush would skip if any entry below its output folders changed, and returns
+   * the operations whose output folders it walked.
+   *
+   * @remarks
+   * The recorded fingerprint is kept until the operation produces a new retained result, so an iteration
+   * that ends before the operation runs leaves the check in place for the next request. When the executing
+   * iteration is planned again for another request's work, the operations that it already dispatched are not
+   * checked: they are no longer affected by the plan. If the graph refuses that plan, an operation that the plan
+   * enabled has already lost its legacy skip state. That can only make the operation run instead of skipping, and
+   * unless its outputs are restored, the next plan finds the same change.
+   */
+  #enableOperationsWithChangedContents(
+    currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
+    earlyWalk: IEarlyWalk | undefined,
+    startedOperations: ReadonlySet<Operation> | undefined
+  ): Operation[] {
+    const checks: ISkipCheck[] = [];
+    for (const [operation, state] of currentStates) {
+      if (state.enabled || !operation.enabled || startedOperations?.has(operation)) {
+        continue;
+      }
+      const entry: IOutputFingerprint | undefined = this.#fingerprints.get(operation);
+      if (!entry || !this.#isRetained(operation, entry.record)) {
+        continue;
+      }
+      const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+      const { contentFingerprint, entryCount } = entry;
+      if (!folderSet || contentFingerprint === undefined) {
+        enableOperation(operation, state);
+      } else {
+        checks.push({ operation, folderSet, entryCount, state, contentFingerprint });
+      }
+    }
+    const walkedOperations: Operation[] = checks.map(({ operation }: ISkipCheck) => operation);
+    const digests: IOutputFolderDigest[] = this.#digestLargestFirst(checks, earlyWalk);
+    checks.forEach(({ operation, state, contentFingerprint }: ISkipCheck, index: number) => {
+      if (digests[index].digest !== contentFingerprint) {
+        enableOperation(operation, state);
+      }
+    });
+    return walkedOperations;
+  }
+
+  /**
+   * Records the stat fingerprint and the content digest of the outputs of a result that the graph will retain, and
+   * that allows it to skip the operation later. Rush reports a result before any consumer of the operation starts,
+   * so the outputs are recorded as the operation left them.
+   */
+  #recordOperation(record: IOperationExecutionResult): void {
+    const { operation, status } = record;
+    // The graph retains a skipped result only for an operation that it selected.
+    if (!TRACKED_STATUSES.has(status) || (status === OperationStatus.Skipped && !record.enabled)) {
+      return;
+    }
+    const fingerprint: string | undefined = getOutputFingerprint(operation);
+    const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+    if (fingerprint === undefined || folderSet === undefined) {
+      this.#fingerprints.delete(operation);
+      return;
+    }
+    const startTimeMs: number = performance.now();
+    const [{ digest: contentFingerprint, entryCount }] = this.#digester.digest([folderSet]);
+    this.#recordedWalkMs += performance.now() - startTimeMs;
+    this.#recordedWalkCount++;
+    this.#fingerprints.set(operation, { record, fingerprint, contentFingerprint, entryCount });
+    this.#lastWalkedOperations.add(operation);
+  }
+
+  /**
+   * Records the outputs of each retained result that was not recorded when Rush reported it, and lets the digester
+   * start its pool if this iteration's walks took long enough together.
+   */
   #recordIteration(records: ReadonlyMap<Operation, IOperationExecutionResult>): void {
+    const walks: IRecordWalk[] = [];
     for (const [operation, record] of records) {
       // Only records produced by this iteration become the retained result; disabled operations keep
       // their earlier record and fingerprint.
-      if (this.#isRetained(operation, record)) {
+      if (this.#isRetained(operation, record) && this.#fingerprints.get(operation)?.record !== record) {
         const fingerprint: string | undefined = getOutputFingerprint(operation);
-        if (fingerprint === undefined) {
+        const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+        if (fingerprint === undefined || folderSet === undefined) {
           this.#fingerprints.delete(operation);
         } else {
-          this.#fingerprints.set(operation, { record, fingerprint });
+          const entryCount: number = this.#fingerprints.get(operation)?.entryCount ?? 0;
+          walks.push({ operation, folderSet, entryCount, record, fingerprint });
         }
       }
     }
+    const digests: IOutputFolderDigest[] = this.#digestLargestFirst(walks);
+    walks.forEach(({ operation, record, fingerprint }: IRecordWalk, index: number) => {
+      const { digest: contentFingerprint, entryCount } = digests[index];
+      this.#fingerprints.set(operation, { record, fingerprint, contentFingerprint, entryCount });
+      this.#lastWalkedOperations.add(operation);
+    });
+    this.#digester.recordCallingThreadDigests(this.#recordedWalkCount, this.#recordedWalkMs);
+    this.#recordedWalkCount = 0;
+    this.#recordedWalkMs = 0;
+  }
+
+  /**
+   * Starts walking the output folders that the last iteration walked, if their operations still have a
+   * retained result to check.
+   */
+  #startEarlyWalk(): IEarlyWalk | undefined {
+    const walks: IContentWalk[] = [];
+    for (const operation of this.#lastWalkedOperations) {
+      const entry: IOutputFingerprint | undefined = this.#fingerprints.get(operation);
+      const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+      if (entry?.contentFingerprint !== undefined && folderSet && this.#isRetained(operation, entry.record)) {
+        walks.push({ operation, folderSet, entryCount: entry.entryCount });
+      }
+    }
+    sortLargestFirst(walks);
+    const folderSets: IOutputFolderSet[] = walks.map(({ folderSet }: IContentWalk) => folderSet);
+    const digests: IBackgroundOutputFolderDigests | undefined =
+      walks.length > 0 ? this.#digester.start(folderSets) : undefined;
+    return (
+      digests && {
+        digests,
+        folderSets,
+        indexByOperation: new Map(
+          walks.map(({ operation }: IContentWalk, index: number) => [operation, index])
+        ),
+        inputsSnapshot: undefined
+      }
+    );
+  }
+
+  /**
+   * Returns the pending early walk, and forgets it. With a context, returns it only if that iteration uses the
+   * inputs snapshot of the reconciliation that started the walk, and cancels it otherwise.
+   */
+  #takeEarlyWalk(context?: IOperationGraphIterationOptions): IEarlyWalk | undefined {
+    const earlyWalk: IEarlyWalk | undefined = this.#earlyWalk;
+    this.#earlyWalk = undefined;
+    if (
+      !earlyWalk ||
+      !context ||
+      (earlyWalk.inputsSnapshot !== undefined && earlyWalk.inputsSnapshot === context.inputsSnapshot)
+    ) {
+      return earlyWalk;
+    }
+    earlyWalk.digests.cancel();
+    return undefined;
+  }
+
+  /**
+   * Sorts the walks by their expected size, largest first, and returns their digests in that order. Uses the
+   * digests of an early walk of the same folder sets where there are any, and walks the others now.
+   */
+  #digestLargestFirst(walks: IContentWalk[], earlyWalk?: IEarlyWalk): IOutputFolderDigest[] {
+    sortLargestFirst(walks);
+    const digests: (IOutputFolderDigest | undefined)[] = earlyWalk ? takeEarlyDigests(walks, earlyWalk) : [];
+    const missingIndexes: number[] = [];
+    for (let index: number = 0; index < walks.length; index++) {
+      if (!digests[index]) {
+        missingIndexes.push(index);
+      }
+    }
+    if (missingIndexes.length > 0) {
+      const missingDigests: IOutputFolderDigest[] = this.#digester.digest(
+        missingIndexes.map((index: number) => walks[index].folderSet)
+      );
+      missingIndexes.forEach((walkIndex: number, index: number) => {
+        digests[walkIndex] = missingDigests[index];
+      });
+    }
+    return digests as IOutputFolderDigest[];
   }
 
   #isRetained(operation: Operation, record: IOperationExecutionResult): boolean {
@@ -96,6 +451,15 @@ export class OperationOutputFingerprints {
   }
 }
 
+function isUndispatched(record: IOperationExecutionResult): boolean {
+  return record.status === OperationStatus.Waiting || record.status === OperationStatus.Ready;
+}
+
+function enableOperation(operation: Operation, state: IConfigurableOperation): void {
+  forgetLegacySkipState(operation);
+  state.enabled = true;
+}
+
 /**
  * Without a build cache, Rush's legacy skip detection reports an operation as skipped when its recorded
  * input state is unchanged, even though its outputs are gone. Remove that record (as the legacy skip logic
@@ -126,3 +490,44 @@ function getOutputFingerprint(operation: Operation): string | undefined {
     })
     .join('|');
 }
+
+/**
+ * Returns the digest that the early walk computed for each walk's folder set, where it computed one, and
+ * stops the early walk.
+ */
+function takeEarlyDigests(
+  walks: ReadonlyArray<IContentWalk>,
+  { digests, folderSets, indexByOperation }: IEarlyWalk
+): (IOutputFolderDigest | undefined)[] {
+  const earlyIndexes: (number | undefined)[] = walks.map(({ operation, folderSet }: IContentWalk) => {
+    const index: number | undefined = indexByOperation.get(operation);
+    return index !== undefined && isSameFolderSet(folderSets[index], folderSet) ? index : undefined;
+  });
+  if (earlyIndexes.every((index: number | undefined) => index === undefined)) {
+    digests.cancel();
+    return [];
+  }
+  const earlyDigests: ReadonlyArray<IOutputFolderDigest | undefined> = digests.finish();
+  return earlyIndexes.map((index: number | undefined) =>
+    index === undefined ? undefined : earlyDigests[index]
+  );
+}
+
+function sortLargestFirst(walks: IContentWalk[]): void {
+  walks.sort((left: IContentWalk, right: IContentWalk) => right.entryCount - left.entryCount);
+}
+
+function isSameFolderSet(left: IOutputFolderSet, right: IOutputFolderSet): boolean {
+  return (
+    left.projectFolder === right.projectFolder &&
+    left.folderNames.length === right.folderNames.length &&
+    left.folderNames.every((folderName: string, index: number) => folderName === right.folderNames[index])
+  );
+}
+
+function getOutputFolderSet(operation: Operation): IOutputFolderSet | undefined {
+  const folderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+  return folderNames?.length
+    ? { projectFolder: operation.associatedProject.projectFolder, folderNames: [...folderNames] }
+    : undefined;
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigest.ts b/libraries/rush-daemon/src/OutputFolderDigest.ts
new file mode 100644
index 00000000000..77e1f536025
--- /dev/null
+++ b/libraries/rush-daemon/src/OutputFolderDigest.ts
@@ -0,0 +1,80 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, type Hash } from 'node:crypto';
+import type * as fs from 'node:fs';
+
+import {
+  walkOperationOutputFolders,
+  type IOperationOutputFolderWalkEntry
+} from '@microsoft/rush-lib/lib/logic/operations/OperationOutputManifest';
+
+/** The declared output folders of one operation. */
+export interface IOutputFolderSet {
+  /** The absolute path of the project folder that the folder names are relative to. */
+  readonly projectFolder: string;
+  readonly folderNames: ReadonlyArray<string>;
+}
+
+/** The content digest of one {@link IOutputFolderSet}. */
+export interface IOutputFolderDigest {
+  /**
+   * Undefined if the folders could not be read (for example, because an entry was deleted during the walk).
+   * An undefined digest never matches.
+   */
+  readonly digest: string | undefined;
+  /** The number of entries that were read, which callers use to start the largest walks first. */
+  readonly entryCount: number;
+}
+
+interface IWalkState {
+  readonly hash: Hash;
+  entryCount: number;
+}
+
+/**
+ * Digests every entry below the given output folders: the sorted relative path of each nested entry, and the
+ * size, modification time and identity of each entry that is not a folder.
+ *
+ * @remarks
+ * Folder modification times are left out, because the sorted listing already captures added and removed
+ * entries. Symbolic links are recorded, not followed.
+ */
+export function digestOutputFolders({ projectFolder, folderNames }: IOutputFolderSet): IOutputFolderDigest {
+  const state: IWalkState = { hash: createHash('sha1'), entryCount: 0 };
+  try {
+    walkOperationOutputFolders(projectFolder, folderNames, (entry: IOperationOutputFolderWalkEntry): void => {
+      if (!entry.isOutputFolder) {
+        state.entryCount++;
+      }
+      switch (entry.kind) {
+        case 'missing': {
+          state.hash.update(`${entry.relativePath}\0missing\n`);
+          break;
+        }
+        case 'folder': {
+          const identity: string = entry.isOutputFolder ? `\0${entry.stats!.ino}` : '';
+          state.hash.update(`${entry.relativePath}\0folder${identity}\n`);
+          break;
+        }
+        case 'replaced': {
+          state.hash.update(`${entry.relativePath}\0replaced\n`);
+          break;
+        }
+        case 'file': {
+          state.hash.update(`${entry.relativePath}\0${describeEntry(entry.stats)}\n`);
+          break;
+        }
+      }
+    });
+  } catch {
+    return { digest: undefined, entryCount: state.entryCount };
+  }
+  return { digest: state.hash.digest('hex'), entryCount: state.entryCount };
+}
+
+function describeEntry(stats: fs.Stats | undefined): string {
+  return stats
+    ? `${stats.isSymbolicLink() ? 'link' : 'file'}\0${stats.size}\0${stats.mtimeMs}\0${stats.ino}`
+    : 'deleted';
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigestPool.ts b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
new file mode 100644
index 00000000000..fa041fdda70
--- /dev/null
+++ b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
@@ -0,0 +1,476 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { MessageChannel, receiveMessageOnPort, Worker, type MessagePort } from 'node:worker_threads';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from './OutputFolderDigest';
+
+/** Slot of a job's shared state that holds the index of the next folder set to claim. */
+const NEXT_INDEX_SLOT: number = 0;
+/** Slot of a job's shared state that counts the folder sets whose digest was published. */
+const COMPLETED_COUNT_SLOT: number = 1;
+const JOB_STATE_SLOT_COUNT: number = 2;
+
+/** How often a waiting caller checks whether the workers still make progress. */
+const WAIT_SLICE_MS: number = 1000;
+/**
+ * Every thread publishes a digest every few milliseconds, so this long without any progress means a worker
+ * died after claiming a folder set. Stopping the pool then only costs speed.
+ */
+const DEFAULT_STALL_TIMEOUT_MS: number = 10000;
+/**
+ * The workers stop after this long without a new job, so that an idle daemon does not keep their memory: about 11 MB
+ * per worker once it starts, and more after repeated walks. Requests a few seconds apart keep the same workers. The
+ * first job after an idle period starts new ones, and the calling thread walks while they start.
+ */
+const DEFAULT_IDLE_TIMEOUT_MS: number = 30000;
+
+/**
+ * Digests of several folder sets on the calling thread that take longer than this together start a pool for later
+ * digests.
+ */
+const POOL_START_THRESHOLD_MS: number = 50;
+const MAX_POOL_THREAD_COUNT: number = 7;
+/**
+ * A walk allocates only short-lived objects. With the default young generation, each worker's heap keeps
+ * growing over repeated digests (by about 150 MB per worker at repo scale), while this size keeps the same
+ * speed.
+ */
+export const WORKER_MAX_YOUNG_GENERATION_SIZE_MB: number = 4;
+
+interface IOutputFolderDigestJob {
+  readonly jobId: number;
+  readonly folderSets: ReadonlyArray<IOutputFolderSet>;
+  readonly state: Int32Array;
+}
+
+/** `[jobId, index, digest]` */
+type OutputFolderDigestResult = readonly [number, number, IOutputFolderDigest];
+
+/** A job whose digests are still wanted. */
+interface IPendingJob {
+  readonly results: (IOutputFolderDigest | undefined)[];
+  readonly state: Int32Array;
+  readonly folderSetCount: number;
+}
+
+/**
+ * Folder sets that the workers of an {@link OutputFolderDigestPool} digest while the calling thread does other
+ * work. Call `finish` or `cancel` once.
+ */
+export interface IBackgroundOutputFolderDigests {
+  /**
+   * Stops the workers from claiming more folder sets, waits for the ones they claimed, and returns their digests,
+   * indexed like the folder sets. A folder set that no worker claimed has no digest.
+   */
+  finish(): ReadonlyArray<IOutputFolderDigest | undefined>;
+  /** Stops the workers from claiming more folder sets, and drops the digests. */
+  cancel(): void;
+}
+
+/** The `workerData` of a pool worker. */
+export interface IOutputFolderDigestWorkerData {
+  readonly resultPort: MessagePort;
+}
+
+/** Options for {@link OutputFolderDigestPool}. */
+export interface IOutputFolderDigestPoolOptions {
+  readonly threadCount: number;
+  /** Defaults to the compiled `OutputFolderDigestWorker.js` next to this module. */
+  readonly workerScriptPath?: string;
+  /**
+   * How long a caller waits for claimed folder sets without progress before it digests them itself and
+   * stops the pool. Defaults to 10 seconds.
+   */
+  readonly stallTimeoutMs?: number;
+  /**
+   * How long the workers stay after the last job was posted, before they stop to free their memory. They stay
+   * longer while a job whose digests are still wanted has folder sets left to digest. The next job starts new
+   * workers. Defaults to 30 seconds.
+   */
+  readonly idleTimeoutMs?: number;
+  /** Whether the calling thread claims folder sets too, rather than only waiting. Defaults to `true`. */
+  readonly claimOnCallingThread?: boolean;
+}
+
+/** Options for {@link OutputFolderDigester}. */
+export interface IOutputFolderDigesterOptions {
+  /** Defaults to one less than the available parallelism, at most 7. Zero never starts a pool. */
+  readonly threadCount?: number;
+  /**
+   * Digests of several folder sets on the calling thread that take longer than this together start the pool (see
+   * `recordCallingThreadDigests`). Defaults to 50 ms.
+   */
+  readonly poolStartThresholdMs?: number;
+  /** How long the pool's workers stay without a new job; see {@link IOutputFolderDigestPoolOptions.idleTimeoutMs}. */
+  readonly idleTimeoutMs?: number;
+}
+
+interface IPoolThread {
+  readonly worker: Worker;
+  readonly resultPort: MessagePort;
+}
+
+/** Serves the jobs of an {@link OutputFolderDigestPool}; runs in each pool worker. */
+export function serveOutputFolderDigestJobs(jobPort: MessagePort, resultPort: MessagePort): void {
+  jobPort.on('message', ({ jobId, folderSets, state }: IOutputFolderDigestJob) => {
+    claimAndDigest(folderSets, state, (index: number, digest: IOutputFolderDigest) => {
+      const result: OutputFolderDigestResult = [jobId, index, digest];
+      resultPort.postMessage(result);
+    });
+  });
+}
+
+/**
+ * Digests output folder sets on the calling thread and a set of worker threads together.
+ *
+ * @remarks
+ * `digest` is synchronous, so it can run inside the synchronous `configureIteration` hook. The calling thread
+ * claims folder sets the same way the workers do, then blocks in `Atomics.wait` until the folder sets that
+ * workers claimed are published, and reads them with `receiveMessageOnPort`. A walk is dominated by `readdir`
+ * and `lstat` system calls, so it shortens roughly in proportion to the number of threads. If the workers
+ * never start or stop making progress, the calling thread digests what is left, so the results always equal
+ * {@link digestOutputFolders}.
+ *
+ * `start` gives folder sets to the workers only, so that the calling thread can do other work while they are
+ * walked, and collects the digests that are ready when it needs them.
+ *
+ * The workers stop once no job was posted for the idle timeout and every job whose digests are still wanted was
+ * digested, so that an idle process does not keep their memory. The next job starts new ones.
+ */
+export class OutputFolderDigestPool {
+  readonly #threads: IPoolThread[] = [];
+  readonly #threadCount: number;
+  readonly #workerScriptPath: string;
+  readonly #stallTimeoutMs: number;
+  readonly #idleTimeoutMs: number;
+  readonly #claimOnCallingThread: boolean;
+  /** Each job whose digests are still wanted, by job ID. */
+  readonly #pendingJobsById: Map<number, IPendingJob> = new Map();
+  #nextJobId: number = 0;
+  #stalled: boolean = false;
+  #idleTimer: NodeJS.Timeout | undefined;
+
+  public constructor({
+    threadCount,
+    workerScriptPath = path.join(__dirname, 'OutputFolderDigestWorker.js'),
+    stallTimeoutMs = DEFAULT_STALL_TIMEOUT_MS,
+    idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS,
+    claimOnCallingThread = true
+  }: IOutputFolderDigestPoolOptions) {
+    this.#threadCount = threadCount;
+    this.#workerScriptPath = workerScriptPath;
+    this.#stallTimeoutMs = stallTimeoutMs;
+    this.#idleTimeoutMs = idleTimeoutMs;
+    this.#claimOnCallingThread = claimOnCallingThread;
+    try {
+      this.#startThreads();
+    } catch (error) {
+      this.dispose();
+      throw error;
+    }
+    this.#scheduleIdleStop();
+  }
+
+  /**
+   * Whether the pool no longer uses its workers, because they stopped making progress or the pool was
+   * disposed. The calling thread then digests everything.
+   */
+  public get stalled(): boolean {
+    return this.#stalled;
+  }
+
+  /** Returns the digest of each folder set, in order. */
+  public digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+    const results: (IOutputFolderDigest | undefined)[] = new Array(folderSets.length);
+    const state: Int32Array = createJobState();
+    const parallel: boolean = !this.#stalled && (folderSets.length > 1 || !this.#claimOnCallingThread);
+    const jobId: number | undefined = parallel ? this.#postJob(folderSets, state, results) : undefined;
+    if (this.#claimOnCallingThread || !parallel) {
+      claimAndDigest(folderSets, state, (index: number, digest: IOutputFolderDigest) => {
+        results[index] = digest;
+      });
+    }
+    if (jobId !== undefined) {
+      this.#waitForClaimedFolderSets(state, folderSets.length);
+      this.#receiveResults();
+      this.#pendingJobsById.delete(jobId);
+    }
+    if (this.#stalled) {
+      this.dispose();
+    }
+    return folderSets.map(
+      (folderSet: IOutputFolderSet, index: number) => results[index] ?? digestOutputFolders(folderSet)
+    );
+  }
+
+  /**
+   * Starts digesting the folder sets on the workers only, so that the calling thread can do other work meanwhile.
+   * Each digest equals that of {@link digestOutputFolders} at the time its walk ran.
+   */
+  public start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests {
+    const results: (IOutputFolderDigest | undefined)[] = new Array(folderSets.length);
+    const state: Int32Array = createJobState();
+    const jobId: number | undefined =
+      this.#stalled || folderSets.length === 0 ? undefined : this.#postJob(folderSets, state, results);
+    if (jobId === undefined) {
+      return { finish: () => results, cancel: () => undefined };
+    }
+    let settled: boolean = false;
+    /** Returns the number of folder sets that workers claimed. */
+    const stopClaims = (): number => {
+      settled = true;
+      return Math.min(Atomics.exchange(state, NEXT_INDEX_SLOT, folderSets.length), folderSets.length);
+    };
+    return {
+      finish: (): ReadonlyArray<IOutputFolderDigest | undefined> => {
+        if (!settled) {
+          const claimedCount: number = stopClaims();
+          if (!this.#stalled) {
+            this.#waitForClaimedFolderSets(state, claimedCount);
+            this.#receiveResults();
+          }
+          this.#pendingJobsById.delete(jobId);
+          if (this.#stalled) {
+            this.dispose();
+          }
+        }
+        return results;
+      },
+      cancel: (): void => {
+        if (!settled) {
+          stopClaims();
+          this.#pendingJobsById.delete(jobId);
+        }
+      }
+    };
+  }
+
+  /** Stops the workers. Later digests run on the calling thread. */
+  public dispose(): void {
+    this.#stalled = true;
+    clearTimeout(this.#idleTimer);
+    this.#idleTimer = undefined;
+    this.#stopThreads();
+  }
+
+  #startThreads(): void {
+    for (let threadIndex: number = 0; threadIndex < this.#threadCount; threadIndex++) {
+      const { port1, port2 } = new MessageChannel();
+      const workerData: IOutputFolderDigestWorkerData = { resultPort: port2 };
+      const worker: Worker = new Worker(this.#workerScriptPath, {
+        workerData,
+        transferList: [port2],
+        resourceLimits: { maxYoungGenerationSizeMb: WORKER_MAX_YOUNG_GENERATION_SIZE_MB }
+      });
+      // Workers never keep the daemon alive. A worker that fails leaves its claims to the caller.
+      worker.unref();
+      worker.on('error', () => undefined);
+      this.#threads.push({ worker, resultPort: port1 });
+    }
+  }
+
+  #stopThreads(): void {
+    for (const { worker, resultPort } of this.#threads.splice(0)) {
+      resultPort.close();
+      void worker.terminate();
+    }
+  }
+
+  /**
+   * Posts a job to every worker, after starting new workers if the idle ones stopped. Returns undefined if they
+   * could not start; the pool is then stalled, and the calling thread digests everything.
+   */
+  #postJob(
+    folderSets: ReadonlyArray<IOutputFolderSet>,
+    state: Int32Array,
+    results: (IOutputFolderDigest | undefined)[]
+  ): number | undefined {
+    if (this.#threads.length === 0) {
+      try {
+        this.#startThreads();
+      } catch {
+        this.dispose();
+        return undefined;
+      }
+    }
+    const jobId: number = ++this.#nextJobId;
+    this.#pendingJobsById.set(jobId, { results, state, folderSetCount: folderSets.length });
+    const job: IOutputFolderDigestJob = { jobId, folderSets, state };
+    for (const { worker } of this.#threads) {
+      worker.postMessage(job);
+    }
+    this.#scheduleIdleStop();
+    return jobId;
+  }
+
+  #scheduleIdleStop(): void {
+    clearTimeout(this.#idleTimer);
+    this.#idleTimer = setTimeout(() => this.#stopIdleThreads(), this.#idleTimeoutMs);
+    // The timer never keeps the daemon alive either.
+    this.#idleTimer.unref();
+  }
+
+  /**
+   * Stops the workers unless a job whose digests are still wanted has folder sets whose digests they have yet to
+   * publish, and keeps the digests that they published. Checks again after another idle timeout otherwise.
+   */
+  #stopIdleThreads(): void {
+    this.#idleTimer = undefined;
+    for (const { state, folderSetCount } of this.#pendingJobsById.values()) {
+      if (Atomics.load(state, COMPLETED_COUNT_SLOT) < folderSetCount) {
+        this.#scheduleIdleStop();
+        return;
+      }
+    }
+    this.#receiveResults();
+    this.#stopThreads();
+  }
+
+  #waitForClaimedFolderSets(state: Int32Array, count: number): void {
+    let completed: number = Atomics.load(state, COMPLETED_COUNT_SLOT);
+    let progressTimeMs: number = performance.now();
+    while (completed < count) {
+      Atomics.wait(state, COMPLETED_COUNT_SLOT, completed, Math.min(WAIT_SLICE_MS, this.#stallTimeoutMs));
+      const current: number = Atomics.load(state, COMPLETED_COUNT_SLOT);
+      if (current !== completed) {
+        completed = current;
+        progressTimeMs = performance.now();
+      } else if (performance.now() - progressTimeMs >= this.#stallTimeoutMs) {
+        this.#stalled = true;
+        return;
+      }
+    }
+  }
+
+  /**
+   * Reads every published result, and keeps those of jobs whose digests are still wanted. Results of a job that
+   * finished, was cancelled or stalled are dropped.
+   */
+  #receiveResults(): void {
+    for (const { resultPort } of this.#threads) {
+      for (
+        let received: { message: unknown } | undefined = receiveMessageOnPort(resultPort);
+        received !== undefined;
+        received = receiveMessageOnPort(resultPort)
+      ) {
+        const [jobId, index, digest] = received.message as OutputFolderDigestResult;
+        const job: IPendingJob | undefined = this.#pendingJobsById.get(jobId);
+        if (job) {
+          job.results[index] = digest;
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Digests output folder sets on the calling thread until digests of several folder sets take longer than a threshold,
+ * and through an {@link OutputFolderDigestPool} after that, so a workspace with small outputs never starts threads.
+ */
+export class OutputFolderDigester {
+  readonly #poolStartThresholdMs: number;
+  readonly #idleTimeoutMs: number | undefined;
+  #threadCount: number;
+  #pool: OutputFolderDigestPool | undefined;
+
+  public constructor({
+    threadCount = getDefaultThreadCount(),
+    poolStartThresholdMs = POOL_START_THRESHOLD_MS,
+    idleTimeoutMs
+  }: IOutputFolderDigesterOptions = {}) {
+    this.#threadCount = threadCount;
+    this.#poolStartThresholdMs = poolStartThresholdMs;
+    this.#idleTimeoutMs = idleTimeoutMs;
+  }
+
+  /** Whether later digests use worker threads. */
+  public get isParallel(): boolean {
+    return this.#pool !== undefined && !this.#pool.stalled;
+  }
+
+  /** Returns the digest of each folder set, in order. */
+  public digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+    if (this.#pool && !this.#pool.stalled) {
+      return this.#pool.digest(folderSets);
+    }
+    const startTimeMs: number = performance.now();
+    const digests: IOutputFolderDigest[] = folderSets.map((folderSet: IOutputFolderSet) =>
+      digestOutputFolders(folderSet)
+    );
+    this.recordCallingThreadDigests(folderSets.length, performance.now() - startTimeMs);
+    return digests;
+  }
+
+  /**
+   * Starts the pool for later digests if digests of several folder sets on the calling thread took longer than the
+   * threshold together, including a caller's digests of one folder set at a time.
+   */
+  public recordCallingThreadDigests(folderSetCount: number, durationMs: number): void {
+    if (
+      !this.#pool &&
+      this.#threadCount > 0 &&
+      folderSetCount > 1 &&
+      durationMs > this.#poolStartThresholdMs
+    ) {
+      try {
+        this.#pool = new OutputFolderDigestPool({
+          threadCount: this.#threadCount,
+          idleTimeoutMs: this.#idleTimeoutMs
+        });
+      } catch {
+        this.#threadCount = 0;
+      }
+    }
+  }
+
+  /**
+   * Starts digesting the folder sets on the pool's workers, so that the calling thread can do other work meanwhile.
+   * Returns undefined if no pool is running; see {@link OutputFolderDigestPool.start}.
+   */
+  public start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests | undefined {
+    return this.#pool && !this.#pool.stalled ? this.#pool.start(folderSets) : undefined;
+  }
+
+  /** Stops the pool, if one was started. Later digests run on the calling thread. */
+  public dispose(): void {
+    this.#threadCount = 0;
+    this.#pool?.dispose();
+  }
+}
+
+let sharedDigester: OutputFolderDigester | undefined;
+
+/** The process-wide digester, so that every warm graph of the daemon shares one pool. */
+export function getSharedOutputFolderDigester(): OutputFolderDigester {
+  sharedDigester ??= new OutputFolderDigester();
+  return sharedDigester;
+}
+
+/** Claims folder sets one at a time until none are left, and publishes each digest before counting it. */
+function claimAndDigest(
+  folderSets: ReadonlyArray<IOutputFolderSet>,
+  state: Int32Array,
+  publish: (index: number, digest: IOutputFolderDigest) => void
+): void {
+  for (
+    let index: number = Atomics.add(state, NEXT_INDEX_SLOT, 1);
+    index < folderSets.length;
+    index = Atomics.add(state, NEXT_INDEX_SLOT, 1)
+  ) {
+    publish(index, digestOutputFolders(folderSets[index]));
+    Atomics.add(state, COMPLETED_COUNT_SLOT, 1);
+    Atomics.notify(state, COMPLETED_COUNT_SLOT);
+  }
+}
+
+function getDefaultThreadCount(): number {
+  const parallelism: number = os.availableParallelism?.() ?? os.cpus().length;
+  return Math.max(0, Math.min(MAX_POOL_THREAD_COUNT, parallelism - 1));
+}
+
+function createJobState(): Int32Array {
+  return new Int32Array(new SharedArrayBuffer(JOB_STATE_SLOT_COUNT * Int32Array.BYTES_PER_ELEMENT));
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigestWorker.ts b/libraries/rush-daemon/src/OutputFolderDigestWorker.ts
new file mode 100644
index 00000000000..a2abd576c2a
--- /dev/null
+++ b/libraries/rush-daemon/src/OutputFolderDigestWorker.ts
@@ -0,0 +1,11 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { parentPort, workerData } from 'node:worker_threads';
+
+import { serveOutputFolderDigestJobs, type IOutputFolderDigestWorkerData } from './OutputFolderDigestPool';
+
+// The entry point of each OutputFolderDigestPool worker.
+if (parentPort) {
+  serveOutputFolderDigestJobs(parentPort, (workerData as IOutputFolderDigestWorkerData).resultPort);
+}
diff --git a/libraries/rush-daemon/src/PhasedIterationDemand.ts b/libraries/rush-daemon/src/PhasedIterationDemand.ts
new file mode 100644
index 00000000000..6b3526b9304
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedIterationDemand.ts
@@ -0,0 +1,133 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IConfigurableOperation, IOperationExecutionResult, Operation } from '@microsoft/rush-lib';
+import { OperationStatus } from '@microsoft/rush-lib';
+
+import type { IRequestEventSink } from './PhasedRequestEventMultiplexer';
+import { TERMINAL_OPERATION_STATUSES } from './PhasedRequestEventSink';
+
+/** The statuses of a record that the graph has not handed to an execution slot yet. */
+const UNDISPATCHED_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Waiting,
+  OperationStatus.Ready
+]);
+
+/**
+ * Tracks whether the unfinished work of a shared iteration is still needed by one of the batch's remaining clients.
+ *
+ * @remarks
+ * A batch arms the tracker when a participating client leaves (cancellation or output failure) while other
+ * participants remain. From then on:
+ *
+ * - Operations that no remaining client needs and that the graph has not handed to an execution slot yet are
+ *   withheld: they are disabled, so they finish as skipped without running anything, like operations that no
+ *   client selected. An operation that already has a slot keeps it.
+ *
+ * - The tracker reports the iteration as abandoned, exactly once, as soon as every operation that a remaining client
+ *   needs has reached a terminal status while enabled operations that only departed clients needed are still
+ *   unfinished. Disabled operations finish without running anything, so they alone never make an iteration
+ *   abandoned.
+ *
+ * The tracker observes status changes rather than completion events: the graph dispatches an operation's dependents
+ * before that operation's completion event, so aborting on completion could start a process only to terminate it.
+ */
+export class PhasedIterationDemand implements IRequestEventSink {
+  readonly #onAbandoned: () => void;
+  readonly #unfinished: Set<IOperationExecutionResult> = new Set();
+  #abandoned: boolean = false;
+  #needed: ReadonlySet<Operation> | undefined;
+  #neededUnfinished: number = 0;
+
+  public constructor(onAbandoned: () => void) {
+    this.#onAbandoned = onAbandoned;
+  }
+
+  /** Whether the iteration was reported as abandoned. */
+  public get abandoned(): boolean {
+    return this.#abandoned;
+  }
+
+  /** Whether the tracker was armed; see {@link PhasedIterationDemand.restrictTo}. */
+  public get restricted(): boolean {
+    return this.#needed !== undefined;
+  }
+
+  /**
+   * Arms the tracker with, or narrows it to, the operations that the remaining clients still need.
+   */
+  public restrictTo(neededOperations: Iterable<Operation>): void {
+    this.#needed = new Set(neededOperations);
+    this.#withholdUnneeded();
+    this.#countNeededUnfinished();
+    this.#evaluate();
+  }
+
+  public onIterationScheduled(records: Iterable<IOperationExecutionResult>): void {
+    this.#unfinished.clear();
+    for (const record of records) {
+      if (!TERMINAL_OPERATION_STATUSES.has(record.status)) {
+        this.#unfinished.add(record);
+      }
+    }
+    this.#withholdUnneeded();
+    this.#countNeededUnfinished();
+    this.#evaluate();
+  }
+
+  public onOperationStatusChanged(record: IOperationExecutionResult): void {
+    if (!TERMINAL_OPERATION_STATUSES.has(record.status) || !this.#unfinished.delete(record)) {
+      return;
+    }
+    if (this.#needed?.has(record.operation)) {
+      this.#neededUnfinished--;
+      this.#evaluate();
+    }
+  }
+
+  #withholdUnneeded(): void {
+    const needed: ReadonlySet<Operation> | undefined = this.#needed;
+    if (!needed) {
+      return;
+    }
+    for (const record of this.#unfinished) {
+      if (
+        record.enabled &&
+        !needed.has(record.operation) &&
+        UNDISPATCHED_OPERATION_STATUSES.has(record.status)
+      ) {
+        // The iteration's records are the configurable operations of `configureIteration`. A record reads
+        // `enabled` when its execution starts, and so do the plugins that would otherwise restore it from the build
+        // cache or record its results.
+        const configurable: IConfigurableOperation = record;
+        configurable.enabled = false;
+      }
+    }
+  }
+
+  #countNeededUnfinished(): void {
+    let neededUnfinished: number = 0;
+    if (this.#needed) {
+      for (const record of this.#unfinished) {
+        if (this.#needed.has(record.operation)) {
+          neededUnfinished++;
+        }
+      }
+    }
+    this.#neededUnfinished = neededUnfinished;
+  }
+
+  #evaluate(): void {
+    if (this.#abandoned || !this.#needed || this.#neededUnfinished > 0) {
+      return;
+    }
+    // Every unfinished operation is now one that no remaining client needs.
+    for (const record of this.#unfinished) {
+      if (record.enabled) {
+        this.#abandoned = true;
+        this.#onAbandoned();
+        return;
+      }
+    }
+  }
+}
diff --git a/libraries/rush-daemon/src/PhasedIterationJoiner.ts b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
new file mode 100644
index 00000000000..6a6a9a315f0
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
@@ -0,0 +1,552 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IOperationExecutionResult,
+  IOperationGraph,
+  IOperationGraphExtensionResult,
+  Operation
+} from '@microsoft/rush-lib';
+import { EnvironmentVariableNames, OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+
+import type { PhasedIterationDemand } from './PhasedIterationDemand';
+import type { IRequestEventSink, PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
+import type { PhasedRequestEventSink } from './PhasedRequestEventSink';
+import type {
+  IBatchEntry,
+  IBatchTimings,
+  INewBatchEntry,
+  IPreparedPhasedRequest,
+  IResolvedSelection
+} from './PhasedRequestRouter';
+import { RequestExclusivityClass } from './RequestScheduler';
+import type { IWorkspaceInvalidationPeek } from './WorkspaceEngineComponentFactory';
+import type { RequestAdmissionController } from './WorkspaceRequestAdmission';
+import type { IWorkspaceSession } from './WorkspaceSession';
+import { writeRequestStartedAsync } from './RequestStartedNotice';
+
+/**
+ * A request that joined the executing iteration, or that failed as it was about to; an object, so that awaiting it
+ * does not await its result.
+ */
+export interface IJoinedRequest {
+  readonly resultPromise: Promise<IDaemonPhasedRequestResult>;
+  /** Why the request failed before it joined, if it did. */
+  readonly failure?: string;
+}
+
+/** What a request that joins the executing iteration needs of its batch, once the iteration is scheduled. */
+export interface IJoinableBatch {
+  /** The batch's entries; a request that joins is added to them. */
+  readonly batch: IBatchEntry[];
+  readonly demand: PhasedIterationDemand;
+  /** The participants that the iteration's operations are attributed to; see `addOperationParticipant`. */
+  readonly entryByOperation: Map<Operation, IBatchEntry>;
+  /** The timings of the requests that joined, whose iteration ends with the batch's. */
+  readonly joinedTimings: IBatchTimings[];
+  /** The batch's participants; a request that joins is added to them. */
+  readonly participants: IBatchEntry[];
+  readonly timings: IBatchTimings;
+}
+
+/** The handling of batches and their entries that `PhasedIterationJoiner` shares with the batch coordinator. */
+export interface IPhasedIterationJoinHost {
+  readonly graph: IOperationGraph;
+  readonly multiplexer: PhasedRequestEventMultiplexer;
+  readonly workspaceSession: IWorkspaceSession;
+  /** Enables the operations of the selections, and disables the other operations. */
+  applySelections(selections: ReadonlyArray<IResolvedSelection>): void;
+  createEntry(
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): INewBatchEntry;
+  createRequestSink(entry: IBatchEntry): PhasedRequestEventSink;
+  /** Produces the failed result of an entry whose execution could not start. */
+  failEntry(entry: IBatchEntry, error: unknown): void;
+  /** Publishes the result of a participant whose operations are done, if another participant needs the iteration. */
+  finishSettledEntry(entry: IBatchEntry): void;
+  /** Whether a live participant still needs the current batch's iteration. */
+  hasLiveParticipant(): boolean;
+  /** Whether another request waits for the graph. */
+  hasWaitingRequest(): boolean;
+  /** Lets the client of a participant cancel its request. */
+  listenForCancellation(entry: IBatchEntry): void;
+  /** Whether a live participant still waits for the iteration to produce its result, or continues until it ends. */
+  needsIteration(entry: IBatchEntry): boolean;
+  /** Narrows the iteration to the operations that its live participants need. */
+  restrictBatchDemand(): void;
+}
+
+/**
+ * The iteration of a shared-build batch that holds the operations that none of its participants needs, so that a
+ * compatible request that arrives while the iteration executes can add its work to it; see `PhasedIterationJoiner`.
+ */
+export class JoinableIteration implements IRequestEventSink {
+  public readonly requestSettingsKey: string;
+  /** Resolves with true once the iteration dispatches an operation, or with false if the batch ends before. */
+  public readonly dispatching: Promise<boolean>;
+  public batch: IJoinableBatch | undefined;
+  public records: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+  readonly #resolveDispatching: (dispatched: boolean) => void;
+  #dispatched: boolean = false;
+
+  public constructor(requestSettingsKey: string) {
+    this.requestSettingsKey = requestSettingsKey;
+    let resolveDispatching: ((dispatched: boolean) => void) | undefined;
+    this.dispatching = new Promise<boolean>((resolve: (dispatched: boolean) => void) => {
+      resolveDispatching = resolve;
+    });
+    this.#resolveDispatching = resolveDispatching!;
+  }
+
+  public get dispatched(): boolean {
+    return this.#dispatched;
+  }
+
+  public onIterationScheduled(records: Iterable<IOperationExecutionResult>): void {
+    this.records = new Map(
+      Array.from(records, (record: IOperationExecutionResult) => [record.operation, record] as const)
+    );
+  }
+
+  public onOperationStatusChanged(record: IOperationExecutionResult): void {
+    // The graph queues an operation only once its iteration dispatches operations.
+    if (record.status === OperationStatus.Queued && !this.#dispatched) {
+      this.#dispatched = true;
+      this.#resolveDispatching(true);
+    }
+  }
+
+  public end(): void {
+    this.#resolveDispatching(false);
+  }
+}
+
+/**
+ * Adds the work of a shared-build request that arrives while the current batch's iteration executes to that
+ * iteration, so that the request does not wait for the iteration to end. Experimental; only if the daemon
+ * configuration of the workspace session enables `joinRunningBatch` (`RUSH_DAEMON_JOIN_RUNNING_BATCH=1`).
+ *
+ * @remarks
+ * The request must have the batch's request settings, and it joins only while no other request waits for the
+ * graph, so that joining requests never keep a waiting request from running. It first waits for the iteration to
+ * dispatch operations, which the batch starts after its reconcile, as it would wait for the running build otherwise:
+ * an explicit wait timeout limits that wait and counts it, and a request that does not wait does not.
+ * Then the graph holds the operations that no participant needs while the inputs are read again, and adds the
+ * request's work to the iteration under those inputs (`tryExtendCurrentIteration`). If it cannot, for example
+ * because an operation that the request needs started before its inputs changed, nothing changes and the request
+ * waits for the iteration to end as before.
+ *
+ * A request that joins takes part in the batch like any participant: its result comes as soon as its own
+ * operations are done while other participants still need the iteration. A participant whose operations were
+ * already done gets its result when a request joins, instead of when the joined work is done. The request does not
+ * receive the output that operations wrote before it joined.
+ */
+export class PhasedIterationJoiner {
+  readonly #host: IPhasedIterationJoinHost;
+  /** The current batch's iteration while requests may join it. */
+  #joinable: JoinableIteration | undefined;
+  /** Requests join the executing iteration one at a time. */
+  #joinTail: Promise<void> = Promise.resolve();
+
+  public constructor(host: IPhasedIterationJoinHost) {
+    this.#host = host;
+  }
+
+  /**
+   * Lets requests join the iteration of the batch that starts with `first`, if they can, and returns the state that
+   * the batch completes once it schedules the iteration. Requests received after the batch's reconcile starts can no
+   * longer join the batch before it executes, so they may wait for its iteration to execute and join it then.
+   */
+  public open(first: IBatchEntry): JoinableIteration | undefined {
+    const joinable: JoinableIteration | undefined = this.#canJoin(first)
+      ? new JoinableIteration(first.requestSettingsKey)
+      : undefined;
+    this.#joinable = joinable;
+    return joinable;
+  }
+
+  /** Ends the requests' joining of the iteration; a request that waits for it to start waits for it to end. */
+  public close(joinable: JoinableIteration | undefined): void {
+    if (joinable && this.#joinable === joinable) {
+      this.#joinable = undefined;
+    }
+    joinable?.end();
+  }
+
+  /**
+   * Returns the request if it joined, or failed as it was about to, or undefined if it waits for the iteration to end
+   * as before.
+   */
+  public async tryJoinAsync(
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): Promise<IJoinedRequest | undefined> {
+    const joinable: JoinableIteration | undefined = this.#joinable;
+    if (
+      !joinable ||
+      request.exclusivityClass !== RequestExclusivityClass.SharedBuild ||
+      request.requestSettingsKey !== joinable.requestSettingsKey
+    ) {
+      return undefined;
+    }
+    const attemptStartTimeMs: number = performance.now();
+    // Requests wait for the iteration to start together, each within its own wait timeout, and then join it one at
+    // a time in the order in which they arrived.
+    const previousJoin: Promise<void> = this.#joinTail;
+    let endJoin: () => void = () => undefined;
+    const joinEnded: Promise<void> = new Promise<void>((resolve: () => void) => {
+      endJoin = resolve;
+    });
+    this.#joinTail = previousJoin.then(() => joinEnded);
+    let outcome: IJoinedRequest | string;
+    try {
+      const refusal: string | undefined = await this.#waitForDispatchAsync(
+        joinable,
+        request,
+        admissionController
+      );
+      if (refusal !== undefined) {
+        outcome = refusal;
+      } else {
+        let previousJoinFinished: boolean = false;
+        await Promise.race([
+          previousJoin.then(() => {
+            previousJoinFinished = true;
+          }),
+          Promise.resolve()
+        ]);
+        if (
+          !previousJoinFinished &&
+          (await admissionController.waitForGraphProgressAsync(previousJoin.then(() => true))) === undefined
+        ) {
+          outcome = 'an earlier request is still joining, and the request limits its wait';
+        } else {
+          outcome = await this.#joinAsync(joinable, request, admissionController);
+        }
+      }
+    } catch (error) {
+      // Once the request joined, `#extendIteration` handles failures itself, so the request did not join, and it
+      // waits for the iteration to end as before.
+      outcome = `joining failed: ${getErrorMessage(error)}`;
+    } finally {
+      endJoin();
+    }
+    logJoinAttempt(request.request.requestId, outcome, attemptStartTimeMs);
+    return typeof outcome === 'string' ? undefined : outcome;
+  }
+
+  /**
+   * Waits for the iteration to dispatch operations, as the request would wait for the running build otherwise (see
+   * `RequestAdmissionController.waitForGraphProgressAsync`), and returns why the request cannot join if it does not.
+   */
+  async #waitForDispatchAsync(
+    joinable: JoinableIteration,
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): Promise<string | undefined> {
+    if (joinable.dispatched) {
+      return undefined;
+    }
+    const dispatched: boolean | undefined = await admissionController.waitForGraphProgressAsync(
+      joinable.dispatching
+    );
+    if (dispatched === undefined) {
+      return request.request.admission?.noWait === true
+        ? 'the iteration has not started, and the request limits its wait'
+        : "the iteration did not start within the request's wait timeout";
+    }
+    return dispatched ? undefined : 'the iteration ended before it started';
+  }
+
+  #canJoin(first: IBatchEntry): boolean {
+    const { graph, workspaceSession } = this.#host;
+    return (
+      workspaceSession.rushConfiguration.daemon.joinRunningBatch &&
+      // A cobuild can hand an operation back to the queue, which adding work to the iteration does not expect.
+      !process.env[EnvironmentVariableNames.RUSH_COBUILD_CONTEXT_ID] &&
+      first.exclusivityClass === RequestExclusivityClass.SharedBuild &&
+      first.requestSettings?.isIncrementalBuildAllowed !== false &&
+      graph.tryExtendCurrentIteration !== undefined &&
+      graph.retainHeldOperations !== undefined &&
+      workspaceSession.peekInvalidationsAsync !== undefined
+    );
+  }
+
+  /** Returns the joined request, or why the request did not join. */
+  async #joinAsync(
+    joinable: JoinableIteration,
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): Promise<IJoinedRequest | string> {
+    const startTimeMs: number = performance.now();
+    const refusal: string | undefined = this.#getRefusal(joinable, request);
+    if (refusal !== undefined) {
+      return refusal;
+    }
+    // Operations that no participant needs would otherwise start while the inputs are read, and could then no
+    // longer do the request's work.
+    const endRetention: (() => void) | undefined = this.#host.graph.retainHeldOperations?.();
+    if (!endRetention) {
+      return 'the iteration holds no operations';
+    }
+    try {
+      const reconcileStartTimeMs: number = performance.now();
+      let peek: IWorkspaceInvalidationPeek | undefined;
+      try {
+        peek = await this.#host.workspaceSession.peekInvalidationsAsync?.({
+          executingIterationRecords: joinable.records!
+        });
+      } catch (error) {
+        return `reading the inputs failed: ${getErrorMessage(error)}`;
+      }
+      if (!peek) {
+        return 'the changed inputs cannot be added to an executing iteration';
+      }
+      const timings: IBatchTimings = {
+        startTimeMs,
+        joinedIteration: true,
+        batchSize: 0,
+        leasesAcquiredTimeMs: undefined,
+        reconcileStartTimeMs,
+        reconciledTimeMs: performance.now(),
+        selectionsAppliedTimeMs: undefined,
+        scheduleStartTimeMs: undefined,
+        scheduledTimeMs: undefined,
+        executionStartTimeMs: undefined,
+        iterationEndTimeMs: undefined
+      };
+      return this.#extendIteration(joinable, request, admissionController, peek, timings);
+    } finally {
+      endRetention();
+    }
+  }
+
+  /** Adds the request's work to the executing iteration, and commits or discards `peek`. */
+  #extendIteration(
+    joinable: JoinableIteration,
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController,
+    peek: IWorkspaceInvalidationPeek,
+    timings: IBatchTimings
+  ): IJoinedRequest | string {
+    const refusal: string | undefined = this.#getRefusal(joinable, request);
+    const batch: IJoinableBatch | undefined = joinable.batch;
+    if (refusal !== undefined || !batch) {
+      peek.discard();
+      return refusal ?? 'the iteration ended';
+    }
+    const host: IPhasedIterationJoinHost = this.#host;
+    const { entry, resultPromise } = host.createEntry(request, admissionController);
+    const start: { failure?: { readonly error: unknown } } = {};
+    const extensionRefusal: string | undefined = this.#addToIteration(batch, entry, peek, timings, () => {
+      // The graph calls this only once it takes the work, so a request that it refuses has not begun: its client is
+      // not told that it started, and the batch that later runs it starts it then. The graph dispatches the work as it
+      // commits, so unlike a batch's, this notice cannot be written before the work starts. Frames are sent in order,
+      // so it still precedes the request's output.
+      void writeRequestStartedAsync(entry.client);
+      // As a batch does before it schedules its iteration, so that none of the request's work starts if it throws.
+      try {
+        entry.onExecutionStarting?.();
+      } catch (error) {
+        start.failure = { error };
+        throw error;
+      }
+    });
+    if (start.failure) {
+      const { error } = start.failure;
+      host.failEntry(entry, error);
+      return { resultPromise, failure: `its execution could not start: ${getErrorMessage(error)}` };
+    }
+    if (extensionRefusal !== undefined) {
+      return extensionRefusal;
+    }
+    timings.scheduledTimeMs = timings.executionStartTimeMs = performance.now();
+    entry.executionStarted = true;
+    try {
+      peek.commit();
+      entry.requestSink = host.createRequestSink(entry);
+      entry.unsubscribe = host.multiplexer.subscribeToCurrentIteration(entry.requestSink);
+    } catch (error) {
+      entry.unsubscribe?.();
+      entry.unsubscribe = undefined;
+      entry.requestSink = undefined;
+      // The request's work is in the iteration, but no participant needs it.
+      host.restrictBatchDemand();
+      // A later participant that needs the work that did not start runs it in its own environment.
+      removeUndispatchedAttributions(batch.entryByOperation, entry, joinable.records!);
+      host.failEntry(entry, error);
+      return { resultPromise };
+    }
+    entry.participated = true;
+    entry.batchTimings = timings;
+    batch.batch.push(entry);
+    batch.participants.push(entry);
+    batch.joinedTimings.push(timings);
+    for (const batchTimings of [batch.timings, ...batch.joinedTimings]) {
+      batchTimings.batchSize = batch.participants.length;
+    }
+    host.listenForCancellation(entry);
+    if (batch.demand.restricted) {
+      host.restrictBatchDemand();
+    }
+    for (const participant of batch.participants) {
+      if (participant === entry || participant.finishPromise !== undefined) {
+        continue;
+      }
+      // A participant whose result was ready waited for the iteration to end only because no other participant
+      // needed the iteration.
+      if (participant.requestSink?.activeOperationsSettled) {
+        host.finishSettledEntry(participant);
+      } else {
+        participant.requestSink?.reofferEarlyFailure();
+      }
+    }
+    entry.requestSink.settleIfIdle();
+    return { resultPromise };
+  }
+
+  /**
+   * Enables the entry's operations and adds them to the executing iteration under the inputs of `peek`, calling
+   * `beforeCommit` once the iteration takes them. If the iteration cannot take them, or `beforeCommit` throws, restores
+   * the graph, discards `peek` and returns why.
+   */
+  #addToIteration(
+    batch: IJoinableBatch,
+    entry: IBatchEntry,
+    peek: IWorkspaceInvalidationPeek,
+    timings: IBatchTimings,
+    beforeCommit: () => void
+  ): string | undefined {
+    const { graph, multiplexer } = this.#host;
+    const enabledStates: ReadonlyMap<Operation, Operation['enabled']> = new Map(
+      Array.from(graph.operations, (operation: Operation) => [operation, operation.enabled] as const)
+    );
+    const attributedOperations: ReadonlyArray<Operation> = addOperationParticipant(
+      batch.entryByOperation,
+      entry
+    );
+    let extension: IOperationGraphExtensionResult | undefined;
+    try {
+      // Work that only departed participants needed stays withheld; see `restrictBatchDemand`.
+      this.#host.applySelections([
+        ...batch.participants
+          .filter((participant: IBatchEntry) => this.#host.needsIteration(participant))
+          .map((participant: IBatchEntry) => participant.selection),
+        entry.selection
+      ]);
+      timings.selectionsAppliedTimeMs = timings.scheduleStartTimeMs = performance.now();
+      // The joining request's reconcile invalidates retained results of earlier iterations, which the request sinks
+      // do not observe, as they do not observe the reconcile before an iteration.
+      extension = multiplexer.runForIterationRecords(() =>
+        graph.tryExtendCurrentIteration!({
+          inputsSnapshot: peek.inputsSnapshot,
+          neededOperations: entry.selection.activeOperations,
+          invalidatedOperations: peek.invalidatedOperations,
+          invalidationReason: peek.invalidationReason,
+          beforeCommit
+        })
+      );
+    } catch (error) {
+      extension = {
+        extended: false,
+        reason: `extending the iteration failed: ${getErrorMessage(error)}`,
+        changedOperations: new Set()
+      };
+    } finally {
+      if (!extension?.extended) {
+        peek.discard();
+        for (const operation of attributedOperations) {
+          batch.entryByOperation.delete(operation);
+        }
+        restoreEnabledStates(graph, enabledStates);
+      }
+    }
+    return extension.extended ? undefined : (extension.reason ?? 'the iteration was not extended');
+  }
+
+  /** Returns why the request cannot join the executing iteration now, or undefined if it can. */
+  #getRefusal(joinable: JoinableIteration, request: IPreparedPhasedRequest): string | undefined {
+    if (this.#joinable !== joinable || !joinable.batch || !joinable.records) {
+      return 'the iteration ended';
+    }
+    if (request.client.abortSignal.aborted) {
+      return 'the request was cancelled';
+    }
+    if (this.#host.hasWaitingRequest()) {
+      return 'another request waits for the graph';
+    }
+    if (joinable.batch.demand.abandoned || !this.#host.hasLiveParticipant()) {
+      return 'no participant needs the iteration';
+    }
+    return undefined;
+  }
+}
+
+/**
+ * Attributes the operations of a participant's selection that no earlier participant's selection includes to the
+ * participant, and returns them.
+ */
+export function addOperationParticipant(
+  entryByOperation: Map<Operation, IBatchEntry>,
+  entry: IBatchEntry
+): Operation[] {
+  const attributedOperations: Operation[] = [];
+  for (const operation of entry.selection.activeOperations) {
+    if (!entryByOperation.has(operation)) {
+      entryByOperation.set(operation, entry);
+      attributedOperations.push(operation);
+    }
+  }
+  return attributedOperations;
+}
+
+/** Removes the entry's attribution of the operations that the graph has not handed to an execution slot yet. */
+function removeUndispatchedAttributions(
+  entryByOperation: Map<Operation, IBatchEntry>,
+  entry: IBatchEntry,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>
+): void {
+  for (const [operation, participant] of entryByOperation) {
+    const status: OperationStatus | undefined = records.get(operation)?.status;
+    if (participant === entry && (status === OperationStatus.Waiting || status === OperationStatus.Ready)) {
+      entryByOperation.delete(operation);
+    }
+  }
+}
+
+function logJoinAttempt(requestId: string, outcome: IJoinedRequest | string, startTimeMs: number): void {
+  const durationMs: number = Math.round(performance.now() - startTimeMs);
+  const reason: string | undefined = typeof outcome === 'string' ? outcome : outcome.failure;
+  const message: string =
+    reason !== undefined
+      ? `Request ${requestId} did not join the executing iteration after ${durationMs} ms: ${reason}`
+      : `Request ${requestId} joined the executing iteration after ${durationMs} ms.`;
+  process.stderr.write(`${new Date().toISOString()} ${message}\n`);
+}
+
+function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/** Restores the enabled states that `applySelections` changed. */
+function restoreEnabledStates(
+  graph: IOperationGraph,
+  enabledStates: ReadonlyMap<Operation, Operation['enabled']>
+): void {
+  const operationsByState: Map<Operation['enabled'], Operation[]> = new Map();
+  for (const [operation, enabled] of enabledStates) {
+    if (operation.enabled !== enabled) {
+      let operations: Operation[] | undefined = operationsByState.get(enabled);
+      if (!operations) {
+        operations = [];
+        operationsByState.set(enabled, operations);
+      }
+      operations.push(operation);
+    }
+  }
+  for (const [enabled, operations] of operationsByState) {
+    graph.setEnabledStates(operations, enabled, 'unsafe');
+  }
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestClient.ts b/libraries/rush-daemon/src/PhasedRequestClient.ts
index 23a80288368..5ac1665aade 100644
--- a/libraries/rush-daemon/src/PhasedRequestClient.ts
+++ b/libraries/rush-daemon/src/PhasedRequestClient.ts
@@ -41,11 +41,7 @@ export interface IPhasedRequestClient {
   writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
 
   /** Writes one operation-scoped output chunk through the client's backpressured destination. */
-  writeLogChunkAsync(
-    operationId: string,
-    stream: 'stdout' | 'stderr',
-    chunk: Uint8Array
-  ): Promise<void>;
+  writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
 
   /** Signals that the client must execute this request in-process instead. */
   writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
@@ -55,4 +51,21 @@ export interface IPhasedRequestClient {
 
   /** Writes the request's current one-based scheduler queue position. */
   writeQueuePositionAsync?(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+
+  /**
+   * Tells the client that the request left every queue, if the client asked to be told. The daemon waits for the
+   * write before it applies anything from the request. Hosts that omit it never tell the client.
+   */
+  writeRequestStartedAsync?(): Promise<void>;
+
+  /**
+   * Resolves once the daemon's other clients that are still connecting have sent their requests, or are not about
+   * to send one. The wait is short and capped.
+   *
+   * @remarks
+   * The router calls it before a batch of shared builds starts its input reconcile. A request that the daemon
+   * receives before then can still join the batch, so a client that connected while the daemon was busy shares the
+   * batch's iteration instead of waiting for it and reconciling again.
+   */
+  waitForConnectingClientsAsync?(): Promise<void>;
 }
diff --git a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
index 25f78503399..5c07b8634ed 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
@@ -1,21 +1,32 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type {
-  IOperationExecutionResult,
+import {
+  type IOperationExecutionResult,
   OperationStatus,
-  _IOperationActivityOptions,
-  _IOperationGraphEventSink
+  type _IOperationActivityOptions,
+  type _IOperationGraphEventSink,
+  _formatIterationStartLines
 } from '@microsoft/rush-lib';
 import type { ITerminalChunk } from '@rushstack/terminal';
 
-interface IRequestEventSink extends _IOperationGraphEventSink {
+export interface IRequestEventSink extends _IOperationGraphEventSink {
   onIterationScheduled(records: Iterable<IOperationExecutionResult>): void;
 }
 
+/** The iteration that was last scheduled, as far as the request sinks have been told about it. */
+interface IAnnouncedIteration {
+  readonly records: ReadonlyArray<IOperationExecutionResult>;
+  /** The arguments of `onIterationStarting`, once the iteration started. */
+  start: { readonly parallelism: number; readonly quietMode: boolean } | undefined;
+}
+
 export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink {
   readonly #workspaceSink: _IOperationGraphEventSink | undefined;
   readonly #requestSinks: Set<IRequestEventSink> = new Set();
+  #iteration: IAnnouncedIteration | undefined;
+  /** While set, the status changes of other records reach only the workspace sink; see `runForIterationRecords`. */
+  #forwardedRecords: ReadonlySet<IOperationExecutionResult> | undefined;
 
   public constructor(workspaceSink: _IOperationGraphEventSink | undefined) {
     this.#workspaceSink = workspaceSink;
@@ -32,8 +43,60 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     };
   }
 
+  /**
+   * Subscribes a request sink to the iteration that is executing, as if it had been subscribed before the iteration
+   * was scheduled.
+   *
+   * @remarks
+   * The sink first receives the iteration's records, the registration of each record, the start of the iteration if
+   * it started, and, for each record whose status changed, a change from its initial status to its current one. It
+   * then receives the iteration's events as the other request sinks do. It does not receive the headers and output
+   * that operations wrote before it subscribed.
+   */
+  public subscribeToCurrentIteration(requestSink: IRequestEventSink): () => void {
+    const iteration: IAnnouncedIteration | undefined = this.#iteration;
+    if (!iteration) {
+      throw new Error('No iteration was scheduled.');
+    }
+    const { records, start } = iteration;
+    requestSink.onIterationScheduled(records);
+    for (const record of records) {
+      requestSink.onOperationRegistered?.(record.operation.name, record.silent, record, record.iterationId);
+    }
+    if (start) {
+      announceIteration(requestSink, records, start.parallelism, start.quietMode);
+    }
+    for (const record of records) {
+      const initialStatus: OperationStatus = getInitialStatus(record);
+      if (record.status !== initialStatus) {
+        requestSink.onOperationStatusChanged?.(record, initialStatus);
+      }
+    }
+    return this.subscribe(requestSink);
+  }
+
+  /**
+   * Runs `callback`, during which the status changes of records that are not the scheduled iteration's reach only the
+   * workspace sink.
+   *
+   * @remarks
+   * Adding a request's work to the executing iteration invalidates the retained results of earlier iterations whose
+   * inputs changed, as the reconciliation before an iteration does. No request sink is subscribed during that
+   * reconciliation, so no request sink observes those results change during this one either.
+   */
+  public runForIterationRecords<T>(callback: () => T): T {
+    const previous: ReadonlySet<IOperationExecutionResult> | undefined = this.#forwardedRecords;
+    this.#forwardedRecords = new Set(this.#iteration?.records);
+    try {
+      return callback();
+    } finally {
+      this.#forwardedRecords = previous;
+    }
+  }
+
   public onIterationScheduled(records: Iterable<IOperationExecutionResult>): void {
     const executionResults: IOperationExecutionResult[] = [...records];
+    this.#iteration = { records: executionResults, start: undefined };
     for (const requestSink of this.#requestSinks) {
       requestSink.onIterationScheduled(executionResults);
     }
@@ -53,6 +116,9 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
 
   public onOperationStatusChanged(result: IOperationExecutionResult, previousStatus: OperationStatus): void {
     this.#workspaceSink?.onOperationStatusChanged?.(result, previousStatus);
+    if (this.#forwardedRecords && !this.#forwardedRecords.has(result)) {
+      return;
+    }
     for (const requestSink of this.#requestSinks) {
       requestSink.onOperationStatusChanged?.(result, previousStatus);
     }
@@ -95,6 +161,28 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     }
   }
 
+  /**
+   * Lets each sink that announces iterations itself announce this one, so that each request sink can list only
+   * its own operations. Any other sink receives the announcement of all of the iteration's operations as activity,
+   * as it would without this multiplexer.
+   */
+  public onIterationStarting(
+    records: ReadonlyArray<IOperationExecutionResult>,
+    parallelism: number,
+    quietMode: boolean
+  ): void {
+    if (this.#iteration) {
+      this.#iteration.start = { parallelism, quietMode };
+    }
+    const lines: string[] = [];
+    if (this.#workspaceSink) {
+      announceIteration(this.#workspaceSink, records, parallelism, quietMode, lines);
+    }
+    for (const requestSink of this.#requestSinks) {
+      announceIteration(requestSink, records, parallelism, quietMode, lines);
+    }
+  }
+
   public onActivity(text: string, options?: _IOperationActivityOptions): void {
     this.#workspaceSink?.onActivity?.(text, options);
     for (const requestSink of this.#requestSinks) {
@@ -102,3 +190,41 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     }
   }
 }
+
+/**
+ * Lets a sink that announces iterations itself announce this one. Any other sink receives the announcement of all of
+ * the iteration's operations as activity; `lines` caches its lines for the other sinks.
+ */
+function announceIteration(
+  sink: _IOperationGraphEventSink,
+  records: ReadonlyArray<IOperationExecutionResult>,
+  parallelism: number,
+  quietMode: boolean,
+  lines: string[] = []
+): void {
+  if (sink.onIterationStarting) {
+    sink.onIterationStarting(records, parallelism, quietMode);
+  } else if (sink.onActivity) {
+    if (lines.length === 0) {
+      lines.push(..._formatIterationStartLines(getNonSilentOperationNames(records), parallelism, quietMode));
+    }
+    for (const line of lines) {
+      sink.onActivity(line);
+    }
+  }
+}
+
+/** The status with which Rush creates the record of an operation for an iteration. */
+function getInitialStatus(record: IOperationExecutionResult): OperationStatus {
+  return record.operation.dependencies.size > 0 ? OperationStatus.Waiting : OperationStatus.Ready;
+}
+
+function getNonSilentOperationNames(records: ReadonlyArray<IOperationExecutionResult>): string[] {
+  const operationNames: string[] = [];
+  for (const record of records) {
+    if (!record.silent) {
+      operationNames.push(record.operation.name);
+    }
+  }
+  return operationNames;
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index d4a315526fc..93506ccd504 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -3,13 +3,10 @@
 
 import { randomUUID } from 'node:crypto';
 
-import type {
-  IOperationExecutionResult,
-  Operation,
-  _IOperationActivityOptions,
-  _IOperationGraphEventSink
-} from '@microsoft/rush-lib';
-import { OperationStatus } from '@microsoft/rush-lib';
+import type { IOperationExecutionResult, Operation, _IOperationGraphEventSink } from '@microsoft/rush-lib';
+import { OperationStatus, _formatIterationStartLines } from '@microsoft/rush-lib';
+import { getCommandExecution } from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
+import type { ICommandExecution } from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
 import {
   DAEMON_PROTOCOL_VERSION,
   RUSHD_OPERATION_HEADER,
@@ -17,19 +14,22 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonEventType,
+  IDaemonActivityPayload,
   IDaemonEventEnvelope,
-  IDaemonEventScope
+  IDaemonEventScope,
+  IDaemonOperationStatusChangedPayload
 } from '@rushstack/rush-daemon-protocol';
 import { TerminalChunkKind } from '@rushstack/terminal';
 import type { ITerminalChunk } from '@rushstack/terminal';
 
+import type { IEngineActivityOptions } from './EngineActivityOptions';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 
 const EVENT_SOURCE_PACKAGE: string = '@microsoft/rush-lib';
 const EVENT_SOURCE_COMPONENT: string = 'OperationGraph';
 const TEXT_ENCODER: InstanceType<typeof TextEncoder> = new TextEncoder();
 // Mirrors rush-lib's TERMINAL_STATUSES, which is not part of its public API.
-const TERMINAL_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
+export const TERMINAL_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Success,
   OperationStatus.SuccessWithWarning,
   OperationStatus.Skipped,
@@ -40,6 +40,15 @@ const TERMINAL_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Aborted
 ]);
 
+/**
+ * Which command produced an operation's result, for an operation that has an incremental command. Rush records
+ * the command on the execution record, which is the result that the engine reports.
+ */
+function getCommandKind(result: IOperationExecutionResult): ICommandExecution['kind'] | undefined {
+  const execution: ICommandExecution | undefined = getCommandExecution(result);
+  return execution?.hasIncrementalCommand ? execution.kind : undefined;
+}
+
 interface IObservedOperationResult {
   readonly executionResult: IOperationExecutionResult;
   readonly status: OperationStatus;
@@ -50,6 +59,24 @@ interface IEventOptions {
   readonly scope?: IDaemonEventScope;
 }
 
+/** How a sink reports that a request which returns early on failure can have its result; see the constructor. */
+export interface IEarlyFailureOptions {
+  /** The operations whose results decide the request's outcome. */
+  readonly targetOperationIds: ReadonlySet<string>;
+  /** Receives the number of the client's operations, not counting silent ones, that are still unfinished. */
+  readonly onSettled: (unfinishedOperations: number) => void;
+}
+
+function isFailedStatus(status: OperationStatus): boolean {
+  return status === OperationStatus.Failure || status === OperationStatus.Blocked;
+}
+
+function hasCompletionEvent(record: IOperationExecutionResult): boolean {
+  const completed: boolean | undefined = (record as { readonly isOperationCompleted?: boolean })
+    .isOperationCompleted;
+  return completed ?? TERMINAL_OPERATION_STATUSES.has(record.status);
+}
+
 class OrderedClientWriter {
   readonly #client: IPhasedRequestClient;
   readonly #onFailure: (error: Error) => void;
@@ -65,11 +92,7 @@ class OrderedClientWriter {
     this.#enqueue(() => this.#client.writeEventAsync(createEvent()));
   }
 
-  public writeLogChunk(
-    operationId: string,
-    stream: 'stdout' | 'stderr',
-    chunk: Uint8Array
-  ): void {
+  public writeLogChunk(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): void {
     this.#enqueue(() => this.#client.writeLogChunkAsync(operationId, stream, chunk));
   }
 
@@ -103,8 +126,14 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
   readonly #rushVersion: string;
   readonly #writer: OrderedClientWriter;
   readonly #onActiveOperationsSettled: (() => void) | undefined;
+  readonly #earlyFailure: IEarlyFailureOptions | undefined;
   readonly #pendingOperationIds: Set<string> = new Set();
+  /** The current iteration's records of this client's operations; their statuses change as the iteration runs. */
+  readonly #scheduledResults: Map<Operation, IOperationExecutionResult> = new Map();
+  #activeOperationsSettled: boolean = false;
   #completedOperations: number = 0;
+  #failed: boolean = false;
+  #earlyFailureOffered: boolean = false;
   #settled: boolean = false;
   #totalOperations: number = 0;
 
@@ -120,19 +149,50 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
      * enqueued on this sink's writer before the callback runs.
      */
     onActiveOperationsSettled?: () => void;
+    /**
+     * For a request that returns early on failure: `onSettled` is called at most once per iteration, after any
+     * operation's completion event, when one of this client's operations failed or was blocked, none was aborted,
+     * none of the targets is unfinished, and `onActiveOperationsSettled` was not called.
+     */
+    earlyFailure?: IEarlyFailureOptions;
   }) {
     this.#activeOperationIds = options.activeOperationIds;
     this.#client = options.client;
     this.#getNextSequence = options.getNextSequence;
     this.#onActiveOperationsSettled = options.onActiveOperationsSettled;
+    this.#earlyFailure = options.earlyFailure;
     this.#rushVersion = options.rushVersion;
     this.#writer = new OrderedClientWriter(options.client, options.onWriteFailure);
   }
 
+  /** Whether `onActiveOperationsSettled` was called for the current iteration. */
+  public get activeOperationsSettled(): boolean {
+    return this.#activeOperationsSettled;
+  }
+
   public getObservedResult(operation: Operation): IObservedOperationResult | undefined {
     return this.#observedResults.get(operation);
   }
 
+  /** The current iteration's record of one of this client's operations, with its current status. */
+  public getScheduledResult(operation: Operation): IOperationExecutionResult | undefined {
+    return this.#scheduledResults.get(operation);
+  }
+
+  /**
+   * The names of this client's operations, not counting silent ones, that the current iteration has not finished.
+   * The records' statuses change as the iteration runs, so this is current even after the client unsubscribed.
+   */
+  public getUnfinishedOperationNames(): string[] {
+    const names: string[] = [];
+    for (const record of this.#scheduledResults.values()) {
+      if (!record.silent && !TERMINAL_OPERATION_STATUSES.has(record.status)) {
+        names.push(record.operation.name);
+      }
+    }
+    return names;
+  }
+
   public flushAsync(): Promise<void> {
     return this.#writer.flushAsync();
   }
@@ -147,40 +207,90 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     this.#completedOperations = 0;
     this.#totalOperations = 0;
     this.#pendingOperationIds.clear();
+    this.#scheduledResults.clear();
+    this.#failed = false;
+    this.#activeOperationsSettled = false;
+    this.#earlyFailureOffered = false;
     this.#settled = false;
     for (const record of records) {
       const operationId: string = record.operation.name;
       if (!this.#activeOperationIds.has(operationId)) {
         continue;
       }
+      this.#scheduledResults.set(record.operation, record);
+      this.#failed ||= isFailedStatus(record.status);
       if (!record.silent) {
         this.#totalOperations++;
       }
-      if (!TERMINAL_OPERATION_STATUSES.has(record.status)) {
+      if (!hasCompletionEvent(record)) {
         this.#pendingOperationIds.add(operationId);
       }
     }
   }
 
-  public onOperationCompleted(result: IOperationExecutionResult): void {
-    if (!this.#pendingOperationIds.delete(result.operation.name) || this.#settled) {
+  /**
+   * Announces the iteration to this client with only its own operations, as the iteration would be announced if
+   * the client's request were the only one in it.
+   */
+  public onIterationStarting(
+    records: ReadonlyArray<IOperationExecutionResult>,
+    parallelism: number,
+    quietMode: boolean
+  ): void {
+    const operationNames: string[] = [];
+    for (const record of records) {
+      const operationId: string = record.operation.name;
+      if (!record.silent && this.#activeOperationIds.has(operationId)) {
+        operationNames.push(operationId);
+      }
+    }
+    if (operationNames.length === 0) {
+      // Alone, a request with nothing to run starts no iteration, so it is not announced.
       return;
     }
-    if (result.status === OperationStatus.Aborted) {
-      // The iteration is being aborted or failed to start; leave this client's result to the batch.
-      this.#settled = true;
+    for (const line of _formatIterationStartLines(operationNames, parallelism, quietMode)) {
+      this.onActivity(line);
+    }
+  }
+
+  public onOperationCompleted(result: IOperationExecutionResult): void {
+    this.#settleActiveOperation(result);
+    // A failure elsewhere can block this client's operations, so any operation's completion can decide its result.
+    this.#offerEarlyFailure();
+  }
+
+  /**
+   * For a sink that subscribed to an iteration that was already executing: settles it if none of its client's
+   * operations is unfinished, as the completion of its last one would, and otherwise offers a failed request's
+   * result. Completion events settle it later as they settle any sink.
+   */
+  public settleIfIdle(): void {
+    if (!this.#settled && this.#pendingOperationIds.size === 0) {
+      for (const record of this.#scheduledResults.values()) {
+        if (record.status === OperationStatus.Aborted) {
+          // The iteration is being aborted; leave this client's result to the batch.
+          this.#settled = true;
+          return;
+        }
+      }
+      this.#settle();
       return;
     }
-    if (this.#pendingOperationIds.size === 0) {
-      this.#settled = true;
-      this.#onActiveOperationsSettled?.();
+    this.#offerEarlyFailure();
+  }
+
+  /**
+   * Offers a failed request's result again if it was offered, because the router may now accept an offer that it
+   * declined, for example once another request joined the iteration.
+   */
+  public reofferEarlyFailure(): void {
+    if (this.#earlyFailureOffered && !this.#settled) {
+      this.#earlyFailureOffered = false;
+      this.#offerEarlyFailure();
     }
   }
 
-  public onOperationStatusChanged(
-    result: IOperationExecutionResult,
-    previousStatus: OperationStatus
-  ): void {
+  public onOperationStatusChanged(result: IOperationExecutionResult, previousStatus: OperationStatus): void {
     const operationId: string = result.operation.name;
     if (!this.#activeOperationIds.has(operationId)) {
       return;
@@ -189,11 +299,21 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
       executionResult: result,
       status: result.status
     });
-    this.#emitEvent('operationStatusChanged', {
+    this.#failed ||= isFailedStatus(result.status);
+    // Summarizing clients (agent output) point at the full log of the operations that explain a failure, and say
+    // whether their incremental command ran, which can fail where their initial command would not.
+    const isProblem: boolean =
+      result.status === OperationStatus.Failure || result.status === OperationStatus.SuccessWithWarning;
+    const logFilePath: string | undefined = isProblem ? result.logFilePaths?.text : undefined;
+    const commandKind: ICommandExecution['kind'] | undefined = isProblem ? getCommandKind(result) : undefined;
+    const payload: IDaemonOperationStatusChangedPayload = {
       operationId,
       previousStatus,
-      status: result.status
-    });
+      status: result.status,
+      ...(logFilePath ? { logFilePath } : {}),
+      ...(commandKind ? { commandKind } : {})
+    };
+    this.#emitEvent('operationStatusChanged', payload);
   }
 
   public onOperationHeader(operationId: string): void {
@@ -218,8 +338,7 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     if (!this.#activeOperationIds.has(operationId)) {
       return;
     }
-    const stream: 'stdout' | 'stderr' =
-      chunk.kind === TerminalChunkKind.Stderr ? 'stderr' : 'stdout';
+    const stream: 'stdout' | 'stderr' = chunk.kind === TerminalChunkKind.Stderr ? 'stderr' : 'stdout';
     this.#writer.writeLogChunk(operationId, stream, TEXT_ENCODER.encode(chunk.text));
   }
 
@@ -236,16 +355,67 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     }
   }
 
-  public onActivity(text: string, options?: _IOperationActivityOptions): void {
+  public onActivity(text: string, options?: IEngineActivityOptions): void {
     const operationId: string | undefined = options?.operationId;
     if (operationId !== undefined && !this.#activeOperationIds.has(operationId)) {
       return;
     }
-    this.#emitEvent(
-      'activityChanged',
-      { stream: options?.stderr === true ? 'stderr' : 'stdout', text },
-      { required: true, scope: operationId === undefined ? undefined : { operationId } }
-    );
+    const payload: IDaemonActivityPayload = {
+      stream: options?.stderr === true ? 'stderr' : 'stdout',
+      text,
+      ...(options?.severity === undefined ? undefined : { severity: options.severity })
+    };
+    this.#emitEvent('activityChanged', payload, {
+      required: true,
+      scope: operationId === undefined ? undefined : { operationId }
+    });
+  }
+
+  #settleActiveOperation(result: IOperationExecutionResult): void {
+    if (!this.#pendingOperationIds.delete(result.operation.name) || this.#settled) {
+      return;
+    }
+    if (result.status === OperationStatus.Aborted) {
+      // The iteration is being aborted or failed to start; leave this client's result to the batch.
+      this.#settled = true;
+      return;
+    }
+    if (this.#pendingOperationIds.size === 0) {
+      this.#settle();
+    }
+  }
+
+  #settle(): void {
+    this.#settled = true;
+    this.#activeOperationsSettled = true;
+    this.#onActiveOperationsSettled?.();
+  }
+
+  /**
+   * Offers a failed request's result once nothing that is unfinished can change it. Blocked operations emit their
+   * completion events only when the iteration ends, so this reads the records' current statuses instead.
+   */
+  #offerEarlyFailure(): void {
+    if (!this.#earlyFailure || !this.#failed || this.#settled || this.#earlyFailureOffered) {
+      return;
+    }
+    const { targetOperationIds, onSettled } = this.#earlyFailure;
+    let unfinishedOperations: number = 0;
+    for (const record of this.#scheduledResults.values()) {
+      if (record.status === OperationStatus.Aborted) {
+        return;
+      }
+      if (!TERMINAL_OPERATION_STATUSES.has(record.status)) {
+        if (targetOperationIds.has(record.operation.name)) {
+          return;
+        }
+        if (!record.silent) {
+          unfinishedOperations++;
+        }
+      }
+    }
+    this.#earlyFailureOffered = true;
+    onSettled(unfinishedOperations);
   }
 
   #emitEvent(type: DaemonEventType, payload: unknown, options?: IEventOptions): void {
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index dda743a4983..cf2d80ec1ee 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -2,26 +2,50 @@
 // See LICENSE in the project root for license information.
 
 import type {
+  IExecutionResult,
   IOperationExecutionResult,
   IOperationGraph,
+  IOperationGraphIterationOptions,
   IPhasedCommandEngineRequestSettings,
   Operation,
   _IOperationGraphEventSink
 } from '@microsoft/rush-lib';
-import { OperationStatus } from '@microsoft/rush-lib';
+import {
+  getWorkspaceRequestOperationEnvironment,
+  OperationStatus,
+  PhasedCommandEngineBusyError
+} from '@microsoft/rush-lib';
 import { Sort } from '@rushstack/node-core-library';
+import type { ITerminal } from '@rushstack/terminal';
+import { findNativeLockHolder } from '@rushstack/rush-client-core';
 import type {
-  IDaemonPhasedEngineShape,
-  IDaemonPhasedOperationSelection,
+  IDaemonContinuingOperations,
+  IDaemonNativeLockHolder,
   IDaemonPhasedRequest,
   IDaemonPhasedRequestResult,
   IDaemonTerminalPolicyResult
 } from '@rushstack/rush-daemon-protocol';
 
-import { PhasedRequestEventSink } from './PhasedRequestEventSink';
+import { PhasedRequestEventSink, TERMINAL_OPERATION_STATUSES } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
-import { writePhasedRequestSummary } from './PhasedRequestSummary';
+import { PhasedIterationDemand } from './PhasedIterationDemand';
+import {
+  addOperationParticipant,
+  type IJoinedRequest,
+  type JoinableIteration,
+  PhasedIterationJoiner
+} from './PhasedIterationJoiner';
+import { writePhasedRequestSummaryAsync } from './PhasedRequestSummary';
+import {
+  collectSelectionClosure,
+  getTargetOperationIds,
+  indexOperations,
+  resolveSelection,
+  validateEngineShape,
+  validateNonemptyName
+} from './PhasedRequestSelection';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
+import { writeRequestStartedAsync } from './RequestStartedNotice';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
 import { DaemonShutdownError, getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IInteractiveRequestSession } from './InteractiveRequestInputRouter';
@@ -36,21 +60,30 @@ import {
 import {
   getRequestAdmissionErrorCode,
   getWorkspaceRequestScheduler,
+  type INativeLockWait,
   RequestAdmissionController
 } from './WorkspaceRequestAdmission';
-import type { IWorkspaceEngineShape } from './WorkspaceEngineComponentFactory';
+import { isNativeLockHeldByThisProcess } from './NativeRepositoryLock';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import {
   createPhasedCommandResult,
   type IPhasedOperationOutcome,
   parseWarningsAllowedByEnvironment
 } from './CommandResultPolicy';
+import {
+  collectPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryMeasure,
+  type IPhasedRequestTelemetryObservations,
+  type IPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryReport,
+  type IPhasedRequestTelemetrySink
+} from './PhasedRequestTelemetry';
 
 interface IDualEmitOperationGraph extends IOperationGraph {
   eventSink: _IOperationGraphEventSink | undefined;
 }
 
-interface IResolvedSelection {
+export interface IResolvedSelection {
   readonly activeOperations: ReadonlyArray<Operation>;
   readonly enabledOperations: ReadonlyArray<Operation>;
   readonly ignoreDependencyOperations: ReadonlyArray<Operation>;
@@ -62,39 +95,103 @@ interface IGraphRoutingState {
   readonly multiplexer: PhasedRequestEventMultiplexer;
 }
 
-interface IPreparedPhasedRequest {
+export interface IPreparedPhasedRequest {
   readonly onExecutionStarting: (() => void) | undefined;
+  /** The `performance.now()` timestamp at which the request was admitted. */
+  readonly admittedTimeMs: number;
   readonly client: IPhasedRequestClient;
   readonly exclusivityClass: RequestExclusivityClass;
   readonly interactiveSession: IInteractiveRequestSession | undefined;
+  /** Lets requests that cannot run alongside this one preempt its workspace admission; see `#settleEntry`. */
+  readonly markAdmissionPreemptible: (onPreempted: () => void) => void;
   readonly request: IDaemonPhasedRequest;
-  /** Only requests with the same settings share one graph iteration. */
+  /** The settings that the request's iteration applies to the graph. */
   readonly requestSettings: IPhasedCommandEngineRequestSettings | undefined;
+  /**
+   * Only requests with the same settings, and the same values for every variable that the graph's operations hash,
+   * share one graph iteration.
+   */
   readonly requestSettingsKey: string;
   readonly selection: IResolvedSelection;
+  /** The `performance.now()` timestamp at which the daemon received the request; see `#canJoinCurrentBatch`. */
+  readonly receivedTimeMs: number;
   /** The `performance.now()` timestamp at which the router received the request. */
   readonly startTimeMs: number;
+  readonly telemetry: IPhasedRequestTelemetrySink | undefined;
   readonly warningsAllowedByEnvironment: boolean;
 }
 
-interface IBatchEntry extends IPreparedPhasedRequest {
+/**
+ * `performance.now()` timestamps of one batch's handling, shared by its participants' telemetry. A request that
+ * joins the batch's iteration while it executes has its own: its handling starts when it starts joining, its
+ * reconcile reads the inputs for the iteration, and its schedule adds its work to the iteration.
+ */
+export interface IBatchTimings {
+  readonly startTimeMs: number;
+  /** Whether these are the timings of a request that joined the iteration while it executed. */
+  readonly joinedIteration: boolean;
+  batchSize: number;
+  leasesAcquiredTimeMs: number | undefined;
+  /** The end of the wait for connecting clients, where the input reconcile starts. */
+  reconcileStartTimeMs: number | undefined;
+  reconciledTimeMs: number | undefined;
+  selectionsAppliedTimeMs: number | undefined;
+  /** The start of `scheduleIterationAsync`, which is where a native iteration's duration starts. */
+  scheduleStartTimeMs: number | undefined;
+  scheduledTimeMs: number | undefined;
+  executionStartTimeMs: number | undefined;
+  iterationEndTimeMs: number | undefined;
+}
+
+export interface IBatchEntry extends IPreparedPhasedRequest {
   abortListener: (() => void) | undefined;
   abortRequested: boolean;
+  /** Waits for native Rush's repository lock for this request; see `#acquireExecutionLeaseAsync`. */
+  readonly admissionController: RequestAdmissionController;
+  batchTimings: IBatchTimings | undefined;
   completed: boolean;
+  /**
+   * Set when a failed result is published while operations of this request that the failure did not block are
+   * still unfinished. They keep running, and the request stays active until the iteration ends; see
+   * `#finishFailedEntry`.
+   */
+  continuesAfterResult: boolean;
   executionStarted: boolean;
   /**
    * Set when this entry's result starts being produced, so it is produced exactly once. An entry can finish while
    * its batch's iteration is still running for other participants; see `#finishSettledEntry`.
    */
   finishPromise: Promise<void> | undefined;
+  /**
+   * The `performance.now()` timestamp at which the entry was taken into a batch. A request that joins the executing
+   * iteration has batch timings of its own, which start when it tries to join, and leaves this unset.
+   */
+  joinedTimeMs: number | undefined;
+  /** Logs the telemetry entry of an entry that continues after its result, once its iteration ended. */
+  logTelemetryAfterIteration: (() => void) | undefined;
   outputError: unknown;
   participated: boolean;
   reject: (error: unknown) => void;
   requestSink: PhasedRequestEventSink | undefined;
   resolve: (result: IDaemonPhasedRequestResult) => void;
+  /** Settles the request of an entry that continues after its result, once its iteration ended. */
+  settleAfterIteration: (() => void) | undefined;
   unsubscribe: (() => void) | undefined;
 }
 
+/** A request's new batch entry, and the promise of the request's result. */
+export interface INewBatchEntry {
+  readonly entry: IBatchEntry;
+  readonly resultPromise: Promise<IDaemonPhasedRequestResult>;
+}
+
+/**
+ * How a result reports the client's operations: after the iteration ended (`'final'`), or while it still runs,
+ * with unfinished operations reported as aborted because the client stopped waiting for them (`'abandoned'`), or
+ * with their current status because they run on after an early failure result (`'running'`).
+ */
+type OperationReport = 'final' | 'abandoned' | 'running';
+
 const ROUTING_STATE_BY_GRAPH: WeakMap<IOperationGraph, IGraphRoutingState> = new WeakMap();
 const OBSERVED_STATUS_OVERRIDES_RETAINED: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Aborted,
@@ -107,6 +204,11 @@ const IN_PROGRESS_STATUSES: ReadonlySet<string> = new Set<string>([
   OperationStatus.Queued,
   OperationStatus.Executing
 ]);
+/**
+ * How many of the operations that continue after an early result a queue position or the workspace status names;
+ * see `describeContinuingOperations`. Their count covers the rest.
+ */
+const MAX_CONTINUING_OPERATION_NAMES: number = 3;
 
 /**
  * Routes one caller-resolved phased request through a real warm workspace operation graph.
@@ -125,13 +227,27 @@ export class PhasedRequestRouter {
     this.#workspaceSession = workspaceSession;
   }
 
-  /** Validates and executes one resolved phased request against the warm graph. */
+  /**
+   * Validates and executes one resolved phased request against the warm graph.
+   *
+   * @remarks
+   * If `telemetry` is provided, it receives this request's report once the request has taken part in a graph
+   * iteration or a no-op check, after the result was written to the client or the write failed. A failed
+   * result that is published while operations of the request still run is reported once the iteration ended.
+   *
+   * `receivedTimeMs` is the `performance.now()` timestamp at which the daemon received the request. The request can
+   * join a batch whose input reconcile started after this time. It defaults to the time of this call.
+   * `requestExclusivityClass` is the admission class chosen by the resolver; it defaults to `classifyRushCommand`.
+   */
   public async executeAsync(
     request: IDaemonPhasedRequest,
     client: IPhasedRequestClient,
     exactSelection: boolean = false,
     onExecutionStarting?: () => void,
-    requestSettings?: IPhasedCommandEngineRequestSettings
+    requestSettings?: IPhasedCommandEngineRequestSettings,
+    telemetry?: IPhasedRequestTelemetrySink,
+    receivedTimeMs?: number,
+    requestExclusivityClass?: RequestExclusivityClass
   ): Promise<IDaemonPhasedRequestResult> {
     const startTimeMs: number = performance.now();
     validateRequestIdentity(request);
@@ -150,10 +266,13 @@ export class PhasedRequestRouter {
     }
     const graph: IDualEmitOperationGraph = getDualEmitGraph(this.#workspaceSession);
     const routingState: IGraphRoutingState = getGraphRoutingState(graph, this.#workspaceSession);
-    const exclusivityClass: RequestExclusivityClass = classifyRushCommand({
-      commandName: request.commandName,
-      commandOrigin: request.commandOrigin
-    });
+    const exclusivityClass: RequestExclusivityClass =
+      requestExclusivityClass ??
+      classifyRushCommand({
+        commandName: request.commandName,
+        commandOrigin: request.commandOrigin
+      });
+    const workspaceScheduler: RequestScheduler = getWorkspaceRequestScheduler(this.#workspaceSession);
     let admissionController: RequestAdmissionController | undefined;
     let admissionLease: IRequestLease;
     try {
@@ -162,14 +281,18 @@ export class PhasedRequestRouter {
         client,
         requestId: request.requestId
       });
+      // A request that cannot run alongside the operations that a failed build left running stops them.
       admissionLease = await admissionController.acquireAsync(
-        getWorkspaceRequestScheduler(this.#workspaceSession),
-        exclusivityClass
+        workspaceScheduler,
+        exclusivityClass,
+        undefined,
+        () => routingState.coordinator.describeContinuingOperations()
       );
     } catch (error) {
       admissionController?.dispose();
       return await finishAfterAdmissionErrorAsync(request, client, interactiveSession, error);
     }
+    const admittedTimeMs: number = performance.now();
 
     try {
       let inputAttachment: Disposable | undefined;
@@ -204,16 +327,22 @@ export class PhasedRequestRouter {
           if (client.abortSignal.aborted) {
             return await writeAbortedResultAsync(request.requestId, client, interactiveSession);
           }
+          const lease: IRequestLease = admissionLease;
           return await routingState.coordinator.enqueueAsync(
             {
+              admittedTimeMs,
               client,
               exclusivityClass,
               interactiveSession,
+              markAdmissionPreemptible: (onPreempted: () => void) =>
+                workspaceScheduler.markLeasePreemptible(lease, onPreempted),
+              receivedTimeMs: receivedTimeMs ?? startTimeMs,
               request,
               requestSettings,
-              requestSettingsKey: JSON.stringify(requestSettings ?? null),
+              requestSettingsKey: getRequestSettingsKey(graph, request, requestSettings),
               selection,
               startTimeMs,
+              telemetry,
               warningsAllowedByEnvironment,
               onExecutionStarting
             },
@@ -238,15 +367,22 @@ export class PhasedRequestRouter {
 class PhasedRequestBatchCoordinator {
   readonly #graph: IDualEmitOperationGraph;
   readonly #graphExecutionScheduler: RequestScheduler;
+  readonly #joiner: PhasedIterationJoiner;
   readonly #multiplexer: PhasedRequestEventMultiplexer;
   readonly #pending: IBatchEntry[] = [];
   readonly #workspaceSession: IWorkspaceSession;
   readonly #abortErrors: unknown[] = [];
   #abortTail: Promise<void> = Promise.resolve();
   #acceptingCurrentBatch: boolean = false;
+  /** Set while the current batch's iteration may execute; see `#restrictBatchDemand`. */
+  #batchDemand: PhasedIterationDemand | undefined;
   #currentBatch: ReadonlyArray<IBatchEntry> | undefined;
   #drainScheduled: boolean = false;
   #nextGraphLeasePromise: Promise<IRequestLease> | undefined;
+  /** When the current batch's input reconcile started, or undefined before it starts. */
+  #reconcileStartTimeMs: number | undefined;
+  /** How many operations that continue after an early result the waiting requests were last told of. */
+  #reportedContinuingOperationCount: number | undefined;
   #running: boolean = false;
 
   public constructor(
@@ -259,6 +395,27 @@ class PhasedRequestBatchCoordinator {
     this.#graphExecutionScheduler = graphExecutionScheduler;
     this.#multiplexer = multiplexer;
     this.#workspaceSession = workspaceSession;
+    this.#joiner = new PhasedIterationJoiner({
+      graph,
+      multiplexer,
+      workspaceSession,
+      applySelections: (selections: ReadonlyArray<IResolvedSelection>) => applySelections(graph, selections),
+      createEntry,
+      createRequestSink: (entry: IBatchEntry) => this.#createRequestSink(entry),
+      failEntry: (entry: IBatchEntry, error: unknown) => {
+        void this.#finishEntryAsync(entry, false, error).catch((finishError: unknown) => {
+          this.#completeEntry(entry);
+          entry.reject(finishError);
+        });
+      },
+      finishSettledEntry: (entry: IBatchEntry) => this.#finishSettledEntry(entry),
+      hasLiveParticipant: () => this.#hasLiveBatchParticipant(),
+      hasWaitingRequest: () =>
+        this.#graphExecutionScheduler.queuedRequestCount > 0 || this.#pending.length > 0,
+      listenForCancellation: (entry: IBatchEntry) => this.#listenForCancellation(entry),
+      needsIteration: (entry: IBatchEntry) => this.#needsIteration(entry),
+      restrictBatchDemand: () => this.#restrictBatchDemand()
+    });
   }
 
   public async enqueueAsync(
@@ -266,36 +423,51 @@ class PhasedRequestBatchCoordinator {
     admissionController: RequestAdmissionController
   ): Promise<IDaemonPhasedRequestResult> {
     if (!this.#canJoinCurrentBatch(request)) {
+      const joined: IJoinedRequest | undefined = await this.#joiner.tryJoinAsync(
+        request,
+        admissionController
+      );
+      if (joined) {
+        return await joined.resultPromise;
+      }
       const graphExclusivityClass: RequestExclusivityClass =
         request.exclusivityClass === RequestExclusivityClass.SharedBuild
           ? RequestExclusivityClass.SharedBuild
           : RequestExclusivityClass.Exclusive;
       const graphWaitLease: IRequestLease = await admissionController.acquireGraphExecutionAsync(
         this.#graphExecutionScheduler,
-        graphExclusivityClass
+        graphExclusivityClass,
+        () => this.describeContinuingOperations()
       );
       graphWaitLease.release();
     }
-    return new Promise<IDaemonPhasedRequestResult>((resolve, reject) => {
-      const entry: IBatchEntry = {
-        ...request,
-        abortListener: undefined,
-        abortRequested: false,
-        completed: false,
-        executionStarted: false,
-        finishPromise: undefined,
-        outputError: undefined,
-        participated: false,
-        reject,
-        requestSink: undefined,
-        resolve,
-        unsubscribe: undefined
-      };
-      entry.abortListener = () => this.#deactivateEntry(entry, true);
-      request.client.abortSignal.addEventListener('abort', entry.abortListener, { once: true });
-      this.#pending.push(entry);
-      this.#scheduleDrain();
-    });
+    const { entry, resultPromise } = createEntry(request, admissionController);
+    this.#listenForCancellation(entry);
+    this.#pending.push(entry);
+    this.#scheduleDrain();
+    return await resultPromise;
+  }
+
+  /**
+   * Describes the operations that the running iteration still runs only for requests that already have their
+   * result (see `#finishFailedEntry`), or returns `undefined` if a request still waits for the iteration to produce
+   * its result, or if none of those operations is unfinished.
+   */
+  public describeContinuingOperations(): IDaemonContinuingOperations | undefined {
+    const participants: IBatchEntry[] = (this.#currentBatch ?? []).filter((entry: IBatchEntry) =>
+      this.#needsIteration(entry)
+    );
+    if (!participants.every((entry: IBatchEntry) => entry.continuesAfterResult)) {
+      return undefined;
+    }
+    const names: Set<string> = new Set(
+      participants.flatMap((entry: IBatchEntry) => entry.requestSink?.getUnfinishedOperationNames() ?? [])
+    );
+    if (names.size === 0) {
+      return undefined;
+    }
+    const sortedNames: string[] = Array.from(names).sort(Sort.compareByValue);
+    return { count: sortedNames.length, names: sortedNames.slice(0, MAX_CONTINUING_OPERATION_NAMES) };
   }
 
   #scheduleDrain(): void {
@@ -332,8 +504,11 @@ class PhasedRequestBatchCoordinator {
         }
         this.#currentBatch = batch;
         this.#acceptingCurrentBatch = first.exclusivityClass === RequestExclusivityClass.SharedBuild;
+        this.#reconcileStartTimeMs = undefined;
+        const joinedTimeMs: number = performance.now();
         for (const entry of batch) {
           entry.executionStarted = true;
+          entry.joinedTimeMs ??= joinedTimeMs;
         }
         try {
           await this.#executeBatchAsync(batch);
@@ -341,6 +516,7 @@ class PhasedRequestBatchCoordinator {
           await Promise.all(batch.map((entry: IBatchEntry) => this.#rejectEntryAsync(entry, error)));
         } finally {
           this.#acceptingCurrentBatch = false;
+          this.#reconcileStartTimeMs = undefined;
           this.#currentBatch = undefined;
         }
       }
@@ -361,6 +537,8 @@ class PhasedRequestBatchCoordinator {
     }
     return (
       this.#acceptingCurrentBatch &&
+      // A request received after the reconcile started may have changed an input that the reconcile already read.
+      (this.#reconcileStartTimeMs === undefined || request.receivedTimeMs < this.#reconcileStartTimeMs) &&
       this.#currentBatch?.[0]?.exclusivityClass === RequestExclusivityClass.SharedBuild &&
       this.#currentBatch[0].requestSettingsKey === request.requestSettingsKey
     );
@@ -376,6 +554,7 @@ class PhasedRequestBatchCoordinator {
       ) {
         this.#pending.splice(index, 1);
         entry.executionStarted = true;
+        entry.joinedTimeMs = performance.now();
         batch.push(entry);
       } else {
         index++;
@@ -384,6 +563,19 @@ class PhasedRequestBatchCoordinator {
   }
 
   async #executeBatchAsync(batch: IBatchEntry[]): Promise<void> {
+    const timings: IBatchTimings = {
+      startTimeMs: performance.now(),
+      joinedIteration: false,
+      batchSize: 0,
+      leasesAcquiredTimeMs: undefined,
+      reconcileStartTimeMs: undefined,
+      reconciledTimeMs: undefined,
+      selectionsAppliedTimeMs: undefined,
+      scheduleStartTimeMs: undefined,
+      scheduledTimeMs: undefined,
+      executionStartTimeMs: undefined,
+      iterationEndTimeMs: undefined
+    };
     const graphLeasePromise: Promise<IRequestLease> =
       this.#nextGraphLeasePromise ??
       this.#graphExecutionScheduler.acquireAsync({
@@ -391,6 +583,7 @@ class PhasedRequestBatchCoordinator {
       });
     this.#nextGraphLeasePromise = undefined;
     const graphLease: IRequestLease = await graphLeasePromise;
+    const joinable: JoinableIteration | undefined = this.#joiner.open(batch[0]);
     let executionLease: AsyncDisposable | undefined;
     let releasePromise: Promise<void> | undefined;
     const releaseExecutionLeaseAsync: () => Promise<void> = () => {
@@ -403,13 +596,24 @@ class PhasedRequestBatchCoordinator {
       if (this.#graph.hasScheduledIteration || this.#graph.status === OperationStatus.Executing) {
         throw new Error('The warm workspace operation graph is not idle.');
       }
-      executionLease = await this.#workspaceSession.acquireExecutionLeaseAsync?.();
+      executionLease = await this.#acquireExecutionLeaseAsync(batch);
+      timings.leasesAcquiredTimeMs = performance.now();
+      if (this.#acceptingCurrentBatch) {
+        // A client that connected while the daemon was busy may not have sent its request yet. Let it, so that
+        // the request is received before the reconcile starts and can join this batch.
+        await batch[0].client.waitForConnectingClientsAsync?.();
+      }
+      // Requests received before this point made their changes before the reconcile reads the inputs, so they can
+      // still join while it runs. Requests received later wait for the next batch, which reconciles again.
+      this.#reconcileStartTimeMs = timings.reconcileStartTimeMs = performance.now();
       await this.#workspaceSession.reconcileInvalidationsAsync();
+      timings.reconciledTimeMs = performance.now();
 
       if (batch[0].exclusivityClass === RequestExclusivityClass.SharedBuild) {
         this.#takeCompatiblePending(batch);
       }
       this.#acceptingCurrentBatch = false;
+
       const participants: IBatchEntry[] = batch.filter((entry: IBatchEntry) => this.#isEntryLive(entry));
       if (participants.length === 0) {
         const beforeResultAsync: (() => Promise<void>) | undefined = executionLease
@@ -423,32 +627,56 @@ class PhasedRequestBatchCoordinator {
         return;
       }
 
+      // Each client learns that its request left the queue before the batch applies anything from it.
+      await Promise.all(participants.map((entry: IBatchEntry) => writeRequestStartedAsync(entry.client)));
       applyRequestSettings(this.#graph, participants[0].requestSettings);
       applySelections(
         this.#graph,
         participants.map((entry: IBatchEntry) => entry.selection)
       );
+      timings.selectionsAppliedTimeMs = performance.now();
+      timings.batchSize = participants.length;
       for (const entry of batch) {
         if (!participants.includes(entry)) {
           // Clients that cancelled before execution must not wait for the participants' work.
           this.#finishDetachedEntry(entry);
         }
       }
+      // Batches never mix request settings (`requestSettingsKey`).
+      const isIncrementalBuildAllowed: boolean | undefined =
+        participants[0].requestSettings?.isIncrementalBuildAllowed;
+      if (isIncrementalBuildAllowed === false) {
+        // Like a native `rush rebuild` process, a non-incremental request starts every operation it runs cold.
+        await this.#graph.closeRunnersAsync(
+          Array.from(this.#graph.operations).filter((operation: Operation) => operation.enabled !== false)
+        );
+      }
+      const demand: PhasedIterationDemand = new PhasedIterationDemand(() => this.#onBatchAbandoned(demand));
+      this.#batchDemand = demand;
+      const unsubscribeDemand: () => void = this.#multiplexer.subscribe(demand);
+      this.#reportedContinuingOperationCount = undefined;
+      const unsubscribeContinuing: () => void = this.#multiplexer.subscribe({
+        onIterationScheduled(): void {
+          // describeContinuingOperations reads the records from the participants' sinks.
+        },
+        onOperationStatusChanged: (record: IOperationExecutionResult): void => {
+          if (!record.silent && TERMINAL_OPERATION_STATUSES.has(record.status)) {
+            this.#reportContinuingOperations();
+          }
+        }
+      });
       for (const entry of participants) {
         entry.participated = true;
-        const activeOperationIds: ReadonlySet<string> = new Set(
-          entry.selection.activeOperations.map((operation: Operation) => operation.name)
-        );
-        entry.requestSink = new PhasedRequestEventSink({
-          activeOperationIds,
-          client: entry.client,
-          getNextSequence: () => entry.client.getNextEventSequence(),
-          onWriteFailure: (error: Error) => this.#deactivateEntry(entry, false, error),
-          onActiveOperationsSettled: () => this.#finishSettledEntry(entry),
-          rushVersion: this.#workspaceSession.metadata.rushVersion
-        });
+        entry.batchTimings = timings;
+        entry.requestSink = this.#createRequestSink(entry);
         entry.unsubscribe = this.#multiplexer.subscribe(entry.requestSink);
       }
+      const entryByOperation: Map<Operation, IBatchEntry> = new Map();
+      let unsubscribeJoinable: (() => void) | undefined;
+      if (joinable) {
+        joinable.batch = { batch, demand, entryByOperation, joinedTimings: [], participants, timings };
+        unsubscribeJoinable = this.#multiplexer.subscribe(joinable);
+      }
 
       const previousPauseNextIteration: boolean = this.#graph.pauseNextIteration;
       setPauseNextIteration(this.#graph, true);
@@ -457,9 +685,14 @@ class PhasedRequestBatchCoordinator {
       const iterationCleanupErrors: unknown[] = [];
       try {
         for (const entry of participants) entry.onExecutionStarting?.();
+        timings.scheduleStartTimeMs = performance.now();
         scheduled = await this.#graph.scheduleIterationAsync({
-          inputsSnapshot: this.#workspaceSession.inputsSnapshot
+          inputsSnapshot: this.#workspaceSession.inputsSnapshot,
+          ...createOperationParticipantLookups(participants, entryByOperation),
+          isIncrementalBuildAllowed,
+          ...(joinable ? { holdUnneededOperations: true } : {})
         });
+        timings.scheduledTimeMs = performance.now();
         if (scheduled) {
           await Promise.all(
             participants.map(async (entry: IBatchEntry) => {
@@ -470,14 +703,19 @@ class PhasedRequestBatchCoordinator {
               }
             })
           );
+          timings.executionStartTimeMs = performance.now();
           const executionPromise: Promise<boolean> = this.#graph.executeScheduledIterationAsync();
-          if (!participants.some((entry: IBatchEntry) => this.#needsIteration(entry))) {
+          if (!participants.some((entry: IBatchEntry) => this.#needsIteration(entry)) || demand.abandoned) {
             // Let executeScheduledIterationAsync promote the scheduled iteration before aborting it.
             await Promise.resolve();
             this.#requestIterationAbort();
             await this.#abortTail;
           }
           await executionPromise;
+          timings.iterationEndTimeMs = performance.now();
+          for (const joinedTimings of joinable?.batch?.joinedTimings ?? []) {
+            joinedTimings.iterationEndTimeMs = timings.iterationEndTimeMs;
+          }
         }
       } catch (error) {
         executionError = error;
@@ -493,6 +731,11 @@ class PhasedRequestBatchCoordinator {
           }
         }
       } finally {
+        this.#joiner.close(joinable);
+        unsubscribeJoinable?.();
+        this.#batchDemand = undefined;
+        unsubscribeDemand();
+        unsubscribeContinuing();
         for (const entry of participants) {
           entry.unsubscribe?.();
           entry.unsubscribe = undefined;
@@ -511,14 +754,46 @@ class PhasedRequestBatchCoordinator {
         )
       );
     } finally {
+      this.#joiner.close(joinable);
       try {
         await releaseExecutionLeaseAsync();
       } finally {
         graphLease.release();
+        for (const entry of batch) {
+          this.#settleContinuingEntry(entry);
+        }
       }
     }
   }
 
+  #createRequestSink(entry: IBatchEntry): PhasedRequestEventSink {
+    const activeOperationIds: ReadonlySet<string> = new Set(
+      entry.selection.activeOperations.map((operation: Operation) => operation.name)
+    );
+    return new PhasedRequestEventSink({
+      activeOperationIds,
+      client: entry.client,
+      getNextSequence: () => entry.client.getNextEventSequence(),
+      onWriteFailure: (error: Error) => this.#deactivateEntry(entry, false, error),
+      onActiveOperationsSettled: () => this.#finishSettledEntry(entry),
+      earlyFailure:
+        entry.request.returnEarlyOnFailure === true &&
+        entry.exclusivityClass === RequestExclusivityClass.SharedBuild
+          ? {
+              targetOperationIds: getTargetOperationIds(entry.selection.activeOperations),
+              onSettled: (unfinishedOperations: number) =>
+                this.#finishFailedEntry(entry, unfinishedOperations)
+            }
+          : undefined,
+      rushVersion: this.#workspaceSession.metadata.rushVersion
+    });
+  }
+
+  #listenForCancellation(entry: IBatchEntry): void {
+    entry.abortListener = () => this.#deactivateEntry(entry, true);
+    entry.client.abortSignal.addEventListener('abort', entry.abortListener, { once: true });
+  }
+
   #deactivateEntry(entry: IBatchEntry, aborted: boolean, outputError?: Error): void {
     if (entry.completed) {
       return;
@@ -543,13 +818,12 @@ class PhasedRequestBatchCoordinator {
       }
     }
 
-    if (
-      entry.executionStarted &&
-      this.#currentBatch?.includes(entry) &&
-      this.#hasLiveBatchParticipant()
-    ) {
+    if (entry.executionStarted && this.#currentBatch?.includes(entry) && this.#hasLiveBatchParticipant()) {
       // Other live participants still need the shared work: detach this client and answer it now.
       this.#finishDetachedEntry(entry);
+      if (entry.participated) {
+        this.#restrictBatchDemand();
+      }
       return;
     }
 
@@ -570,13 +844,60 @@ class PhasedRequestBatchCoordinator {
       undefined,
       [],
       undefined,
-      true
+      'abandoned'
     ).catch((error: unknown) => {
       if (!entry.completed) {
         this.#completeEntry(entry);
         entry.reject(error);
       }
     });
+    this.#reportContinuingOperations();
+  }
+
+  /**
+   * Tells the requests that wait for the graph which operations they wait for, whenever the number of those
+   * operations changed: once the iteration runs only for entries that already have their result (see
+   * `describeContinuingOperations`), and again each time one of those operations ends, so that no waiting request
+   * is left naming an operation that has finished. A request that starts to wait later is told when it does.
+   *
+   * @remarks
+   * From the moment every entry that needs the iteration continues after its result, no entry can start to continue,
+   * so the set of those operations only shrinks, and its size tells whether it changed.
+   */
+  #reportContinuingOperations(): void {
+    const count: number | undefined = this.describeContinuingOperations()?.count;
+    if (count === this.#reportedContinuingOperationCount) {
+      return;
+    }
+    this.#reportedContinuingOperationCount = count;
+    if (count !== undefined) {
+      this.#graphExecutionScheduler.notifyQueuePositions();
+    }
+  }
+
+  /**
+   * Narrows the running iteration to the remaining participants' selections after a participant left it.
+   *
+   * @remarks
+   * The departed client's selection stays merged into the iteration, so without this the remaining participants
+   * would wait for, and queued requests would queue behind, work that only the departed client needed. Operations
+   * that no remaining participant needs and that have not been handed to an execution slot finish as skipped
+   * instead of starting. Once every operation a remaining participant needs has finished, the iteration is aborted
+   * if unneeded work is still running, which terminates that work, as when every client cancels.
+   */
+  #restrictBatchDemand(): void {
+    this.#batchDemand?.restrictTo(
+      (this.#currentBatch ?? []).flatMap((candidate: IBatchEntry) =>
+        this.#needsIteration(candidate) ? candidate.selection.activeOperations : []
+      )
+    );
+  }
+
+  #onBatchAbandoned(demand: PhasedIterationDemand): void {
+    // Before the iteration starts executing, `#executeBatchAsync` aborts it once it has been promoted.
+    if (this.#batchDemand === demand && this.#graph.status === OperationStatus.Executing) {
+      this.#requestIterationAbort();
+    }
   }
 
   #isEntryLive(entry: IBatchEntry): boolean {
@@ -600,9 +921,12 @@ class PhasedRequestBatchCoordinator {
     );
   }
 
-  /** Whether a live participant still waits for the running iteration to produce its result. */
+  /**
+   * Whether a live participant still waits for the running iteration to produce its result, or has its result but
+   * continues until the iteration ends.
+   */
   #needsIteration(entry: IBatchEntry): boolean {
-    return entry.finishPromise === undefined && this.#isEntryLive(entry);
+    return (entry.finishPromise === undefined || entry.continuesAfterResult) && this.#isEntryLive(entry);
   }
 
   /**
@@ -613,35 +937,109 @@ class PhasedRequestBatchCoordinator {
    * The sink invokes this after the operations' final events and log chunks were enqueued, and `#finishEntryAsync`
    * drains them before writing the result. The iteration, graph lease and execution lease stay owned by the batch.
    * The last participant that needs the iteration keeps the ordinary contract: its result follows iteration end
-   * and execution lease release, so single-client requests and warm-state retention are unchanged.
+   * and execution lease release, so single-client requests and warm-state retention are unchanged. When other
+   * participants left the batch, `#restrictBatchDemand` makes that end prompt by skipping or aborting work only they
+   * needed.
    */
   #finishSettledEntry(entry: IBatchEntry): void {
     if (
-      !this.#needsIteration(entry) ||
+      entry.finishPromise !== undefined ||
+      !this.#isEntryLive(entry) ||
       !entry.participated ||
-      !this.#currentBatch?.some(
-        (candidate: IBatchEntry) => candidate !== entry && this.#needsIteration(candidate)
-      )
+      !this.#hasOtherBatchParticipant(entry)
     ) {
       return;
     }
+    this.#startEarlyResult(entry, 'abandoned');
+  }
+
+  /**
+   * Publishes a failed result as soon as nothing that is unfinished can change it, for a request that asked for
+   * this (agent output): one of its operations failed or was blocked, and none of its targets is unfinished.
+   *
+   * @remarks
+   * Its operations that the failure did not block keep running, so that later requests find them done. The
+   * request stays active until the iteration ends, and `#settleContinuingEntry` then settles it. Meanwhile it keeps
+   * its admission, so exclusive requests still wait for that work, and it holds the iteration like any live
+   * participant, so another participant's departure does not abort that work. When none of its operations is
+   * unfinished and no other participant needs the iteration, the iteration is ending anyway, and the ordinary
+   * contract applies.
+   */
+  #finishFailedEntry(entry: IBatchEntry, unfinishedOperations: number): void {
+    if (
+      entry.finishPromise !== undefined ||
+      !this.#isEntryLive(entry) ||
+      !entry.participated ||
+      (unfinishedOperations === 0 && !this.#hasOtherBatchParticipant(entry))
+    ) {
+      return;
+    }
+    entry.continuesAfterResult = unfinishedOperations > 0;
+    this.#startEarlyResult(entry, 'running');
+  }
+
+  #hasOtherBatchParticipant(entry: IBatchEntry): boolean {
+    return !!this.#currentBatch?.some(
+      (candidate: IBatchEntry) => candidate !== entry && this.#needsIteration(candidate)
+    );
+  }
+
+  #startEarlyResult(entry: IBatchEntry, report: OperationReport): void {
     entry.unsubscribe?.();
     entry.unsubscribe = undefined;
-    entry.finishPromise = this.#produceEarlyResultAsync(entry).catch((error: unknown) => {
+    entry.finishPromise = this.#produceEarlyResultAsync(entry, report).catch((error: unknown) => {
       // Unlike a batch-wide failure, an early result's failure concerns only this client.
       if (!entry.completed) {
+        this.#abandonContinuingEntry(entry);
         this.#completeEntry(entry);
-        entry.reject(error);
+        // The abandoned operations may still be stopping, so the request keeps its admission until they are.
+        this.#settleEntry(entry, () => entry.reject(error));
       }
     });
+    this.#reportContinuingOperations();
   }
 
-  async #produceEarlyResultAsync(entry: IBatchEntry): Promise<void> {
+  async #produceEarlyResultAsync(entry: IBatchEntry, report: OperationReport): Promise<void> {
     // The sink is notified from the record's `finalizeOperation()`, which synchronously precedes the close of
     // the record's StdioSummarizer and ProblemCollector. The summary reads the failure tail from the closed
     // summarizer, so yield once to let the notifying record finish closing before the summary is written.
     await Promise.resolve();
-    await this.#produceResultAsync(entry, true, undefined, [], undefined, true);
+    await this.#produceResultAsync(entry, true, undefined, [], undefined, report);
+  }
+
+  /**
+   * Stops the work that only an entry which continues after its result still holds, for example when the daemon
+   * shuts down or when that result could not be produced.
+   */
+  #abandonContinuingEntry(entry: IBatchEntry): void {
+    if (!entry.continuesAfterResult || entry.abortRequested) {
+      return;
+    }
+    entry.abortRequested = true;
+    if (!this.#currentBatch?.includes(entry)) {
+      return;
+    }
+    if (this.#hasLiveBatchParticipant()) {
+      this.#restrictBatchDemand();
+    } else if (this.#graph.hasScheduledIteration || this.#graph.status === OperationStatus.Executing) {
+      this.#requestIterationAbort();
+    }
+  }
+
+  #settleContinuingEntry(entry: IBatchEntry): void {
+    const logTelemetry: (() => void) | undefined = entry.logTelemetryAfterIteration;
+    entry.logTelemetryAfterIteration = undefined;
+    logTelemetry?.();
+    const settle: (() => void) | undefined = entry.settleAfterIteration;
+    if (!settle) {
+      return;
+    }
+    entry.settleAfterIteration = undefined;
+    if (entry.abortListener) {
+      entry.client.abortSignal.removeEventListener('abort', entry.abortListener);
+      entry.abortListener = undefined;
+    }
+    settle();
   }
 
   #requestIterationAbort(): void {
@@ -667,7 +1065,7 @@ class PhasedRequestBatchCoordinator {
       executionError,
       batchCleanupErrors,
       beforeResultAsync,
-      false
+      'final'
     );
     return entry.finishPromise;
   }
@@ -678,7 +1076,7 @@ class PhasedRequestBatchCoordinator {
     executionError: unknown,
     batchCleanupErrors: ReadonlyArray<unknown>,
     beforeResultAsync: (() => Promise<void>) | undefined,
-    iterationInProgress: boolean
+    report: OperationReport
   ): Promise<void> {
     if (entry.completed) {
       return;
@@ -686,15 +1084,21 @@ class PhasedRequestBatchCoordinator {
     const cleanupErrors: unknown[] = [...batchCleanupErrors];
     if (entry.requestSink) {
       if (entry.participated && this.#isEntryLive(entry)) {
-        writePhasedRequestSummary({
-          activeOperations: entry.selection.activeOperations,
-          commandName: entry.request.commandName,
-          elapsedMs: performance.now() - entry.startTimeMs,
-          executionError,
-          graph: this.#graph,
-          sink: entry.requestSink,
-          warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
-        });
+        try {
+          await writePhasedRequestSummaryAsync({
+            activeOperations: entry.selection.activeOperations,
+            commandName: entry.request.commandName,
+            executionError,
+            graph: this.#graph,
+            onResultsAsync: this.#getRequestHookInvoker(entry),
+            sink: entry.requestSink,
+            startTimeMs: entry.startTimeMs,
+            warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
+          });
+        } catch (error) {
+          // A plugin's afterExecuteRequestAsync tap failed, which fails this request as it fails a native command.
+          cleanupErrors.push(error);
+        }
       }
       try {
         await entry.requestSink.flushAsync();
@@ -715,7 +1119,7 @@ class PhasedRequestBatchCoordinator {
           this.#graph,
           entry.requestSink,
           aborted && entry.participated,
-          iterationInProgress
+          report
         )
       : [];
     const result: IDaemonPhasedRequestResult = createPhasedCommandResult({
@@ -730,14 +1134,143 @@ class PhasedRequestBatchCoordinator {
       scheduled: entry.participated && batchScheduled,
       warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
     });
+    const logTelemetry: (() => void) | undefined = entry.participated
+      ? this.#prepareTelemetry(entry, result, batchScheduled, report !== 'final')
+      : undefined;
     try {
-      await entry.client.writeResultAsync(result);
+      try {
+        await entry.client.writeResultAsync(result);
+      } finally {
+        logTelemetry?.();
+      }
       this.#completeEntry(entry);
-      entry.resolve(result);
+      this.#settleEntry(entry, () => entry.resolve(result));
     } catch (error) {
       this.#completeEntry(entry);
-      entry.reject(error);
+      this.#settleEntry(entry, () => entry.reject(error));
+    }
+  }
+
+  /**
+   * Takes the request's telemetry report as of the result that is about to be written, and returns the function
+   * that logs it.
+   *
+   * @remarks
+   * The router logs the report once it wrote the result, or failed to. Logging an entry takes milliseconds. In a
+   * batch whose results are produced together, logging first would make every client of the batch wait for all of
+   * the batch's entries, and would add the earlier entries' logging to each entry's timing; now every result is
+   * written before any entry is logged. In a scheduled batch, results come in groups as operations finish, so each
+   * result is written before its own entry is logged, and an earlier group's entries may be logged before a later
+   * group's results are written.
+   *
+   * An entry that continues after its result gets no function: the operations that its failure did not block
+   * still run, so its report waits until the iteration ended, and `#settleContinuingEntry` sends it with their
+   * final statuses. Either way, the report has the timing of the result that the client receives.
+   */
+  #prepareTelemetry(
+    entry: IBatchEntry,
+    result: IDaemonPhasedRequestResult,
+    batchScheduled: boolean,
+    earlyResult: boolean
+  ): (() => void) | undefined {
+    const { batchTimings: timings, requestSink, telemetry } = entry;
+    if (!telemetry || !requestSink || !timings) {
+      return undefined;
+    }
+    let report: IPhasedRequestTelemetryReport;
+    try {
+      const resultTimeMs: number = performance.now();
+      const executionStartTimeMs: number = Math.max(timings.startTimeMs, entry.joinedTimeMs ?? 0);
+      // Measured now, because the batch timings go on changing until the iteration ends.
+      const measures: IPhasedRequestTelemetryMeasure[] = createTelemetryMeasures(
+        entry,
+        timings,
+        executionStartTimeMs,
+        resultTimeMs
+      );
+      const createReport = (
+        observations: IPhasedRequestTelemetryObservations
+      ): IPhasedRequestTelemetryReport => {
+        const { records, countRetained }: IPhasedRequestTelemetryRecords =
+          collectPhasedRequestTelemetryRecords({
+            activeOperations: entry.selection.activeOperations,
+            graph: this.#graph,
+            observations,
+            upToDateTimeMs: executionStartTimeMs
+          });
+        return {
+          request: entry.request,
+          result,
+          records,
+          countRetained,
+          batchSize: timings.batchSize,
+          scheduled: batchScheduled,
+          earlyResult,
+          ...(timings.joinedIteration ? { joinedIteration: true } : {}),
+          receivedTimeMs: entry.startTimeMs,
+          executionStartTimeMs,
+          iterationStartTimeMs: batchScheduled ? timings.scheduleStartTimeMs : undefined,
+          resultTimeMs,
+          measures
+        };
+      };
+      if (entry.continuesAfterResult) {
+        entry.logTelemetryAfterIteration = () => {
+          try {
+            telemetry.logRequest(createReport(getIterationObservations(requestSink)));
+          } catch {
+            // Telemetry never changes a request's result.
+          }
+        };
+        return undefined;
+      }
+      report = createReport(requestSink);
+    } catch {
+      // Telemetry never changes a request's result.
+      return undefined;
+    }
+    return () => {
+      try {
+        telemetry.logRequest(report);
+      } catch {
+        // Telemetry never changes a request's result.
+      }
+    };
+  }
+
+  #settleEntry(entry: IBatchEntry, settle: () => void): void {
+    if (!entry.continuesAfterResult) {
+      settle();
+      return;
     }
+    entry.settleAfterIteration = settle;
+    // The client has its result, so from now on its departure no longer matters, but the request's own abort
+    // (the daemon shutting down) still stops the work it holds.
+    entry.abortListener = () => this.#abandonContinuingEntry(entry);
+    entry.client.abortSignal.addEventListener('abort', entry.abortListener, { once: true });
+    // Nobody waits for that work, so it must not delay requests that cannot run alongside it, such as a rebuild.
+    entry.markAdmissionPreemptible(() => this.#abandonContinuingEntry(entry));
+  }
+
+  /**
+   * Returns the callback that invokes the graph's `afterExecuteRequestAsync` hook with one request's own results,
+   * or `undefined` when no plugin tapped it.
+   *
+   * @remarks
+   * A native command invokes the hook after each iteration. The daemon invokes it once for each request it serves
+   * instead, including a warm no-op request that needs no iteration, and in the request's own output.
+   */
+  #getRequestHookInvoker(
+    entry: IBatchEntry
+  ): ((results: IExecutionResult, terminal: ITerminal) => Promise<void>) | undefined {
+    const { afterExecuteRequestAsync } = this.#graph.hooks;
+    if (!afterExecuteRequestAsync.isUsed()) {
+      return undefined;
+    }
+    const { commandName, environment, requestId } = entry.request;
+    return async (results: IExecutionResult, terminal: ITerminal): Promise<void> => {
+      await afterExecuteRequestAsync.promise({ ...results, commandName, environment, requestId, terminal });
+    };
   }
 
   async #rejectEntryAsync(entry: IBatchEntry, error: unknown): Promise<void> {
@@ -749,6 +1282,8 @@ class PhasedRequestBatchCoordinator {
       }
     }
     if (entry.completed) {
+      // The batch failed after this entry's early result: its iteration has ended.
+      this.#settleContinuingEntry(entry);
       return;
     }
     entry.unsubscribe?.();
@@ -765,6 +1300,75 @@ class PhasedRequestBatchCoordinator {
     entry.reject(combineErrors(error, cleanupErrors));
   }
 
+  /**
+   * Acquires the workspace session's execution lease, which holds native Rush's repository lock. While another Rush
+   * process holds that lock, each request of the batch waits for it as it would for another request, within its own
+   * remaining admission budget, and its client is told which process it waits for; see
+   * `RequestAdmissionController.beginNativeLockWait`. A request that may not wait any longer leaves the batch with
+   * an admission error while the others wait on, and compatible requests that arrive meanwhile join the batch.
+   *
+   * @remarks
+   * The lease is acquired again rather than probed, since acquiring it invalidates what native Rush may have
+   * changed. If this process holds the lock itself, the batch fails at once, since waiting would not end.
+   */
+  async #acquireExecutionLeaseAsync(batch: IBatchEntry[]): Promise<AsyncDisposable | undefined> {
+    const session: IWorkspaceSession = this.#workspaceSession;
+    const lockFolder: string = session.rushConfiguration.commonTempFolder;
+    const waits: Map<IBatchEntry, INativeLockWait> = new Map();
+    try {
+      for (;;) {
+        try {
+          return await session.acquireExecutionLeaseAsync?.();
+        } catch (error) {
+          if (!(error instanceof PhasedCommandEngineBusyError) || isNativeLockHeldByThisProcess(lockFolder)) {
+            throw error;
+          }
+        }
+        if (batch[0].exclusivityClass === RequestExclusivityClass.SharedBuild) {
+          this.#takeCompatiblePending(batch);
+        }
+        const holder: IDaemonNativeLockHolder = findNativeLockHolder(lockFolder);
+        let retryDelayMs: number | undefined;
+        let lastError: unknown;
+        for (const entry of [...batch]) {
+          // A client that left the batch while others wait on has its answer already.
+          if (entry.finishPromise || entry.completed) continue;
+          let wait: INativeLockWait | undefined = waits.get(entry);
+          if (!wait) {
+            wait = entry.admissionController.beginNativeLockWait();
+            waits.set(entry, wait);
+          }
+          const error: RequestSchedulerError | undefined = wait.update(holder);
+          if (!error) {
+            retryDelayMs = Math.min(retryDelayMs ?? wait.retryDelayMs, wait.retryDelayMs);
+            continue;
+          }
+          batch.splice(batch.indexOf(entry), 1);
+          waits.delete(entry);
+          lastError = await wait.endAsync().then(
+            () => error,
+            (writeError: unknown) => writeError
+          );
+          await this.#rejectEntryAsync(entry, lastError);
+        }
+        if (retryDelayMs === undefined) {
+          throw lastError ?? new Error('No request of the batch waits for the repository lock any longer.');
+        }
+        await new Promise<void>((resolve: () => void) => setTimeout(resolve, retryDelayMs));
+      }
+    } finally {
+      await Promise.all(
+        Array.from(waits, async ([entry, wait]: [IBatchEntry, INativeLockWait]) => {
+          try {
+            await wait.endAsync();
+          } catch (error) {
+            this.#deactivateEntry(entry, false, error instanceof Error ? error : undefined);
+          }
+        })
+      );
+    }
+  }
+
   #completeEntry(entry: IBatchEntry): void {
     entry.completed = true;
     if (entry.abortListener) {
@@ -774,6 +1378,48 @@ class PhasedRequestBatchCoordinator {
   }
 }
 
+function createTelemetryMeasures(
+  entry: IBatchEntry,
+  timings: IBatchTimings,
+  executionStartTimeMs: number,
+  resultTimeMs: number
+): IPhasedRequestTelemetryMeasure[] {
+  const measures: IPhasedRequestTelemetryMeasure[] = [];
+  function addMeasure(name: string, startTimeMs: number | undefined, endTimeMs: number | undefined): void {
+    if (startTimeMs !== undefined && endTimeMs !== undefined) {
+      measures.push({ name: `rush:daemon:${name}`, startTimeMs, endTimeMs });
+    }
+  }
+  addMeasure('admission', entry.startTimeMs, entry.admittedTimeMs);
+  addMeasure('queueWait', entry.admittedTimeMs, executionStartTimeMs);
+  if (timings.joinedIteration) {
+    // Spans the reconcile, selection and schedule measures of the request that joined.
+    addMeasure('joinRunningIteration', timings.startTimeMs, timings.executionStartTimeMs);
+  }
+  addMeasure('acquireExecutionLease', timings.startTimeMs, timings.leasesAcquiredTimeMs);
+  addMeasure('awaitConnectingClients', timings.leasesAcquiredTimeMs, timings.reconcileStartTimeMs);
+  addMeasure('reconcileInvalidations', timings.reconcileStartTimeMs, timings.reconciledTimeMs);
+  addMeasure('applySelections', timings.reconciledTimeMs, timings.selectionsAppliedTimeMs);
+  addMeasure('scheduleIteration', timings.scheduleStartTimeMs, timings.scheduledTimeMs);
+  addMeasure('executeIteration', timings.executionStartTimeMs, timings.iterationEndTimeMs ?? resultTimeMs);
+  return measures;
+}
+
+/**
+ * The request's operations as the iteration's own records have them. The request's sink stops observing the
+ * iteration when it publishes an early result, so it has not seen what happened to them since. Once the
+ * iteration ended, these records have their final statuses.
+ */
+function getIterationObservations(requestSink: PhasedRequestEventSink): IPhasedRequestTelemetryObservations {
+  return {
+    getObservedResult: (operation: Operation) => {
+      const executionResult: IOperationExecutionResult | undefined =
+        requestSink.getScheduledResult(operation);
+      return executionResult ? { executionResult } : requestSink.getObservedResult(operation);
+    }
+  };
+}
+
 function createBatchReleaseBarrier(
   batch: ReadonlyArray<IBatchEntry>,
   releaseAsync: () => Promise<void>
@@ -819,6 +1465,18 @@ export function setPauseNextIteration(graph: IOperationGraph, pauseNextIteration
   graph.pauseNextIteration = pauseNextIteration;
 }
 
+/**
+ * Describes the operations that the workspace session's graph still runs only for requests that already have their
+ * result, such as the independent operations of a failed build that returned early, or returns `undefined` if there
+ * are none, or if a request still waits for the graph's running iteration to produce its result. It never waits.
+ */
+export function describeContinuingOperations(
+  workspaceSession: IWorkspaceSession
+): IDaemonContinuingOperations | undefined {
+  const graph: IOperationGraph | undefined = workspaceSession.operationGraph;
+  return graph ? ROUTING_STATE_BY_GRAPH.get(graph)?.coordinator.describeContinuingOperations() : undefined;
+}
+
 function getGraphRoutingState(
   graph: IDualEmitOperationGraph,
   workspaceSession: IWorkspaceSession
@@ -862,6 +1520,9 @@ function validateRequestIdentity(request: IDaemonPhasedRequest): void {
   if (request.acceptsStdin !== undefined && typeof request.acceptsStdin !== 'boolean') {
     throw new Error('Phased request acceptsStdin must be a boolean value.');
   }
+  if (request.returnEarlyOnFailure !== undefined && typeof request.returnEarlyOnFailure !== 'boolean') {
+    throw new Error('Phased request returnEarlyOnFailure must be a boolean value.');
+  }
   if (
     request.terminalRequirement !== undefined &&
     request.terminalRequirement !== 'none' &&
@@ -875,109 +1536,135 @@ function validateRequestIdentity(request: IDaemonPhasedRequest): void {
   }
 }
 
-function validateNonemptyName(value: string, kind: string): void {
-  if (value.length === 0 || value.trim() !== value) {
-    throw new Error(`Invalid phased request ${kind}: "${value}".`);
-  }
-}
-
-function validateEngineShape(
-  requestShape: IDaemonPhasedEngineShape,
-  workspaceShape: IWorkspaceEngineShape | undefined
-): void {
-  if (!workspaceShape) {
-    throw new Error('The workspace session does not declare a reusable engine shape.');
-  }
-  validateNameSet(requestShape.phaseNames, workspaceShape.phaseNames, 'phase');
-  validateNameSet(requestShape.pluginNames, workspaceShape.pluginNames, 'plugin');
-}
-
-function validateNameSet(
-  requestedNames: ReadonlyArray<string>,
-  workspaceNames: ReadonlyArray<string>,
-  kind: string
-): void {
-  const requested: Set<string> = new Set(requestedNames);
-  if (
-    requested.size !== requestedNames.length ||
-    requested.size !== workspaceNames.length ||
-    workspaceNames.some((name: string) => !requested.has(name))
-  ) {
-    throw new Error(`The phased request ${kind} shape does not match the warm workspace engine.`);
-  }
+/**
+ * Returns the key that decides which requests can share one graph iteration.
+ *
+ * @remarks
+ * An operation that several participants select runs once, in the first participant's environment, and hashes its
+ * `dependsOnEnvVars` from that environment. Variables that do not select a daemon, such as `WT_SESSION`, reach the
+ * operation from each request, so the key includes this request's value of every variable that an operation of the
+ * graph lists in `dependsOnEnvVars`. Requests that disagree on one of them get separate iterations, and each
+ * operation runs and is hashed as it would be for its own requester. The key takes each value as the operation hashes
+ * it, so an unset variable and an empty one are the same value.
+ */
+function getRequestSettingsKey(
+  graph: IOperationGraph,
+  request: IDaemonPhasedRequest,
+  requestSettings: IPhasedCommandEngineRequestSettings | undefined
+): string {
+  const names: ReadonlyArray<string> = getGraphDependsOnEnvVars(graph);
+  const environment: Readonly<Record<string, string>> =
+    names.length > 0 ? getWorkspaceRequestOperationEnvironment(process.env, request.environment) : {};
+  // InputsSnapshot hashes `environment[name] || ''`.
+  const values: ReadonlyArray<readonly [string, string]> = names.map((name: string) => [
+    name,
+    environment[name] || ''
+  ]);
+  return JSON.stringify([requestSettings ?? null, values]);
 }
 
-function indexOperations(operations: ReadonlySet<Operation>): ReadonlyMap<string, Operation> {
-  const operationById: Map<string, Operation> = new Map();
-  for (const operation of operations) {
-    const operationId: string = operation.name;
-    if (operationById.has(operationId)) {
-      throw new Error(`The workspace graph contains duplicate operation id "${operationId}".`);
+/** Returns the names of the environment variables that the graph's operations hash, sorted. */
+function getGraphDependsOnEnvVars(graph: IOperationGraph): ReadonlyArray<string> {
+  const names: Set<string> = new Set();
+  for (const operation of graph.operations) {
+    for (const name of operation.settings?.dependsOnEnvVars ?? []) {
+      names.add(name);
     }
-    operationById.set(operationId, operation);
   }
-  return operationById;
+  return Array.from(names).sort(Sort.compareByValue);
 }
 
-function resolveSelection(
-  requestedSelection: ReadonlyArray<IDaemonPhasedOperationSelection>,
-  operationById: ReadonlyMap<string, Operation>,
-  exact: boolean
-): IResolvedSelection {
-  if (!exact && requestedSelection.length === 0) {
-    throw new Error('A phased request must select at least one operation.');
-  }
-  const selectedIds: Set<string> = new Set();
-  const enabledOperations: Operation[] = [];
-  const ignoreDependencyOperations: Operation[] = [];
-  for (const selection of requestedSelection) {
-    validateNonemptyName(selection.operationId, 'operation id');
-    if (selectedIds.has(selection.operationId)) {
-      throw new Error(`Duplicate phased request operation id "${selection.operationId}".`);
-    }
-    selectedIds.add(selection.operationId);
-    const operation: Operation | undefined = operationById.get(selection.operationId);
-    if (!operation) {
-      throw new Error(`Unknown phased request operation id "${selection.operationId}".`);
+function createEntry(
+  request: IPreparedPhasedRequest,
+  admissionController: RequestAdmissionController
+): INewBatchEntry {
+  let entry: IBatchEntry | undefined;
+  const resultPromise: Promise<IDaemonPhasedRequestResult> = new Promise<IDaemonPhasedRequestResult>(
+    (resolve, reject) => {
+      entry = {
+        ...request,
+        abortListener: undefined,
+        abortRequested: false,
+        admissionController,
+        batchTimings: undefined,
+        completed: false,
+        continuesAfterResult: false,
+        executionStarted: false,
+        finishPromise: undefined,
+        joinedTimeMs: undefined,
+        logTelemetryAfterIteration: undefined,
+        outputError: undefined,
+        participated: false,
+        reject,
+        requestSink: undefined,
+        resolve,
+        settleAfterIteration: undefined,
+        unsubscribe: undefined
+      };
     }
-    addSelectedOperation(selection.enabledState, operation, enabledOperations, ignoreDependencyOperations);
-  }
-  return {
-    activeOperations: exact
-      ? [...enabledOperations, ...ignoreDependencyOperations]
-      : collectSelectionClosure(enabledOperations, ignoreDependencyOperations),
-    enabledOperations,
-    ignoreDependencyOperations,
-    exact
-  };
+  );
+  return { entry: entry!, resultPromise };
 }
 
-function addSelectedOperation(
-  enabledState: unknown,
-  operation: Operation,
-  enabledOperations: Operation[],
-  ignoreDependencyOperations: Operation[]
-): void {
-  if (enabledState === true) {
-    enabledOperations.push(operation);
-  } else if (enabledState === 'ignore-dependency-changes') {
-    ignoreDependencyOperations.push(operation);
-  } else {
-    throw new Error(`Invalid phased request enabled state: "${String(enabledState)}".`);
-  }
-}
+/**
+ * The lookups that attribute each operation of an iteration to one of its participants.
+ */
+type IOperationParticipantLookups = Required<
+  Pick<IOperationGraphIterationOptions, 'getOperationEnvironment' | 'getOperationRequestId'>
+>;
 
-function collectSelectionClosure(
-  enabledOperations: ReadonlyArray<Operation>,
-  ignoreDependencyOperations: ReadonlyArray<Operation>
-): ReadonlyArray<Operation> {
-  const activeOperations: Set<Operation> = new Set([...enabledOperations, ...ignoreDependencyOperations]);
-  for (const operation of activeOperations) {
-    for (const dependency of operation.dependencies) {
-      activeOperations.add(dependency);
-    }
+/**
+ * Attributes each operation of an iteration to the first participant that selected it, as a native command would
+ * run it for its invoker, or to the first participant if no participant selected it. `getOperationEnvironment`
+ * returns that participant's environment and `getOperationRequestId` its request id, so a plugin can attribute the
+ * operation to the request whose environment it ran in. An operation that several participants share runs once, in
+ * the first participant's environment; the participants agree on the hashed value of every variable that an
+ * operation hashes (see `getRequestSettingsKey`).
+ *
+ * @remarks
+ * Each environment is a copy of the daemon's `process.env` in which the variables that do not select a daemon take
+ * the participant's values. The copy is taken when it is asked for, so an operation starts from `process.env` as it
+ * is when the operation starts, as a native command's operation does. That includes the variables that a plugin
+ * sets, changes or deletes in the same iteration's `beforeExecuteIterationAsync`. Reading `process.env` is slow, and
+ * the graph hashes every operation while it schedules an iteration, so the calls made before the next microtask
+ * share one copy for each participant.
+ *
+ * @param participants - The iteration's participants, in the order in which they were taken into its batch.
+ * @param entryByOperation - Receives the attribution, which requests that join the executing iteration extend; see
+ * `addOperationParticipant`.
+ */
+function createOperationParticipantLookups(
+  participants: ReadonlyArray<IBatchEntry>,
+  entryByOperation: Map<Operation, IBatchEntry>
+): IOperationParticipantLookups {
+  for (const entry of participants) {
+    addOperationParticipant(entryByOperation, entry);
   }
-  return Array.from(activeOperations);
+  const firstEntry: IBatchEntry | undefined = participants[0];
+  const getEntry = (operation: Operation): IBatchEntry | undefined =>
+    entryByOperation.get(operation) ?? firstEntry;
+  let environmentByEntry: Map<IBatchEntry, Readonly<Record<string, string>>> | undefined;
+  return {
+    getOperationEnvironment: (operation: Operation) => {
+      const entry: IBatchEntry | undefined = getEntry(operation);
+      if (!entry) {
+        return process.env;
+      }
+      if (!environmentByEntry) {
+        environmentByEntry = new Map();
+        queueMicrotask(() => {
+          environmentByEntry = undefined;
+        });
+      }
+      let environment: Readonly<Record<string, string>> | undefined = environmentByEntry.get(entry);
+      if (!environment) {
+        environment = getWorkspaceRequestOperationEnvironment(process.env, entry.request.environment);
+        environmentByEntry.set(entry, environment);
+      }
+      return environment;
+    },
+    getOperationRequestId: (operation: Operation) => getEntry(operation)?.request.requestId
+  };
 }
 
 /** Presentation/scheduling settings are request-scoped, so they are applied per iteration, not per graph. */
@@ -1026,21 +1713,44 @@ function applySelections(graph: IOperationGraph, selections: ReadonlyArray<IReso
   graph.setEnabledStates(effectiveIgnoreDependencyOperations, 'ignore-dependency-changes', 'unsafe');
 }
 
+/**
+ * Reports the outcome of each of a client's operations for its result.
+ *
+ * @remarks
+ * `aborted` means that the client cancelled the request, or the daemon shut down, after the request joined an
+ * iteration. Such a request never reports a result that an earlier iteration left, which would report an operation
+ * that the cancel kept from starting as failed or succeeded. Once the iteration has ended, the request reports each
+ * operation's record in it, which holds the operation's final status in that iteration. The graph keeps that record
+ * only for an operation that ran, and an earlier iteration's record for one that was aborted or skipped.
+ */
 function collectOperationOutcomes(
   activeOperations: ReadonlyArray<Operation>,
   graph: IOperationGraph,
   requestSink: PhasedRequestEventSink,
-  fillMissingAsAborted: boolean = false,
-  iterationInProgress: boolean = false
+  aborted: boolean = false,
+  report: OperationReport = 'final'
 ): ReadonlyArray<IPhasedOperationOutcome> {
   const outcomes: IPhasedOperationOutcome[] = [];
   for (const operation of [...activeOperations].sort(compareOperations)) {
     const observed: ReturnType<PhasedRequestEventSink['getObservedResult']> =
       requestSink.getObservedResult(operation);
-    const retained: IOperationExecutionResult | undefined = graph.resultByOperation.get(operation);
+    const retained: IOperationExecutionResult | undefined = aborted
+      ? undefined
+      : graph.resultByOperation.get(operation);
+    const current: IOperationExecutionResult | undefined =
+      report === 'running' || (aborted && report === 'final')
+        ? requestSink.getScheduledResult(operation)
+        : undefined;
     let status: string | undefined;
     let errorMessage: string | undefined;
-    if (iterationInProgress && observed !== undefined) {
+    if (current !== undefined) {
+      if (current.silent && IN_PROGRESS_STATUSES.has(current.status)) {
+        // An operation that runs nothing, for example a phase that the project does not define.
+        continue;
+      }
+      status = current.status;
+      errorMessage = current.error?.message;
+    } else if (report !== 'final' && observed !== undefined) {
       // While the iteration still runs, retained results may predate this iteration, and work this client
       // stopped observing before it finished (a detached cancellation) was abandoned.
       status = IN_PROGRESS_STATUSES.has(observed.status) ? OperationStatus.Aborted : observed.status;
@@ -1055,8 +1765,8 @@ function collectOperationOutcomes(
       status = retained?.status ?? observed?.status;
       errorMessage = retained?.error?.message ?? observed?.executionResult.error?.message;
     }
-    status ??= fillMissingAsAborted ? OperationStatus.Aborted : undefined;
-    if (fillMissingAsAborted && status !== undefined && IN_PROGRESS_STATUSES.has(status)) {
+    status ??= aborted ? OperationStatus.Aborted : undefined;
+    if (aborted && status !== undefined && IN_PROGRESS_STATUSES.has(status)) {
       // The client stopped observing before this operation finished, e.g. because it was terminated.
       status = OperationStatus.Aborted;
     }
diff --git a/libraries/rush-daemon/src/PhasedRequestSelection.ts b/libraries/rush-daemon/src/PhasedRequestSelection.ts
new file mode 100644
index 00000000000..baaf5b343dc
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedRequestSelection.ts
@@ -0,0 +1,143 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { Operation } from '@microsoft/rush-lib';
+import type {
+  IDaemonPhasedEngineShape,
+  IDaemonPhasedOperationSelection
+} from '@rushstack/rush-daemon-protocol';
+
+import type { IResolvedSelection } from './PhasedRequestRouter';
+import type { IWorkspaceEngineShape } from './WorkspaceEngineComponentFactory';
+
+export function validateNonemptyName(value: string, kind: string): void {
+  if (value.length === 0 || value.trim() !== value) {
+    throw new Error(`Invalid phased request ${kind}: "${value}".`);
+  }
+}
+
+export function validateEngineShape(
+  requestShape: IDaemonPhasedEngineShape,
+  workspaceShape: IWorkspaceEngineShape | undefined
+): void {
+  if (!workspaceShape) {
+    throw new Error('The workspace session does not declare a reusable engine shape.');
+  }
+  validateNameSet(requestShape.phaseNames, workspaceShape.phaseNames, 'phase');
+  validateNameSet(requestShape.pluginNames, workspaceShape.pluginNames, 'plugin');
+}
+
+function validateNameSet(
+  requestedNames: ReadonlyArray<string>,
+  workspaceNames: ReadonlyArray<string>,
+  kind: string
+): void {
+  const requested: Set<string> = new Set(requestedNames);
+  if (
+    requested.size !== requestedNames.length ||
+    requested.size !== workspaceNames.length ||
+    workspaceNames.some((name: string) => !requested.has(name))
+  ) {
+    throw new Error(`The phased request ${kind} shape does not match the warm workspace engine.`);
+  }
+}
+
+export function indexOperations(operations: ReadonlySet<Operation>): ReadonlyMap<string, Operation> {
+  const operationById: Map<string, Operation> = new Map();
+  for (const operation of operations) {
+    const operationId: string = operation.name;
+    if (operationById.has(operationId)) {
+      throw new Error(`The workspace graph contains duplicate operation id "${operationId}".`);
+    }
+    operationById.set(operationId, operation);
+  }
+  return operationById;
+}
+
+export function resolveSelection(
+  requestedSelection: ReadonlyArray<IDaemonPhasedOperationSelection>,
+  operationById: ReadonlyMap<string, Operation>,
+  exact: boolean
+): IResolvedSelection {
+  if (!exact && requestedSelection.length === 0) {
+    throw new Error('A phased request must select at least one operation.');
+  }
+  const selectedIds: Set<string> = new Set();
+  const enabledOperations: Operation[] = [];
+  const ignoreDependencyOperations: Operation[] = [];
+  for (const selection of requestedSelection) {
+    validateNonemptyName(selection.operationId, 'operation id');
+    if (selectedIds.has(selection.operationId)) {
+      throw new Error(`Duplicate phased request operation id "${selection.operationId}".`);
+    }
+    selectedIds.add(selection.operationId);
+    const operation: Operation | undefined = operationById.get(selection.operationId);
+    if (!operation) {
+      throw new Error(`Unknown phased request operation id "${selection.operationId}".`);
+    }
+    addSelectedOperation(selection.enabledState, operation, enabledOperations, ignoreDependencyOperations);
+  }
+  return {
+    activeOperations: exact
+      ? [...enabledOperations, ...ignoreDependencyOperations]
+      : collectSelectionClosure(enabledOperations, ignoreDependencyOperations),
+    enabledOperations,
+    ignoreDependencyOperations,
+    exact
+  };
+}
+
+function addSelectedOperation(
+  enabledState: unknown,
+  operation: Operation,
+  enabledOperations: Operation[],
+  ignoreDependencyOperations: Operation[]
+): void {
+  if (enabledState === true) {
+    enabledOperations.push(operation);
+  } else if (enabledState === 'ignore-dependency-changes') {
+    ignoreDependencyOperations.push(operation);
+  } else {
+    throw new Error(`Invalid phased request enabled state: "${String(enabledState)}".`);
+  }
+}
+
+export function collectSelectionClosure(
+  enabledOperations: ReadonlyArray<Operation>,
+  ignoreDependencyOperations: ReadonlyArray<Operation>
+): ReadonlyArray<Operation> {
+  const activeOperations: Set<Operation> = new Set([...enabledOperations, ...ignoreDependencyOperations]);
+  for (const operation of activeOperations) {
+    for (const dependency of operation.dependencies) {
+      activeOperations.add(dependency);
+    }
+  }
+  return Array.from(activeOperations);
+}
+
+/**
+ * The operations whose results decide a request's outcome: those of the selected projects that no other selected
+ * project consumes, such as the projects named by `--to`. The other selected operations only feed them.
+ *
+ * @remarks
+ * Projects rather than operations are compared, because an operation that nothing consumes, such as the last
+ * phase of a dependency, still only serves a consuming project's request.
+ */
+export function getTargetOperationIds(activeOperations: ReadonlyArray<Operation>): ReadonlySet<string> {
+  const active: ReadonlySet<Operation> = new Set(activeOperations);
+  const consumedProjects: Set<Operation['associatedProject']> = new Set();
+  for (const consumer of activeOperations) {
+    for (const dependency of consumer.dependencies) {
+      if (active.has(dependency) && dependency.associatedProject !== consumer.associatedProject) {
+        consumedProjects.add(dependency.associatedProject);
+      }
+    }
+  }
+  const targetOperationIds: Set<string> = new Set();
+  for (const operation of activeOperations) {
+    if (!consumedProjects.has(operation.associatedProject)) {
+      targetOperationIds.add(operation.name);
+    }
+  }
+  return targetOperationIds;
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestSummary.ts b/libraries/rush-daemon/src/PhasedRequestSummary.ts
index ed0628d60b5..db25bd3d95a 100644
--- a/libraries/rush-daemon/src/PhasedRequestSummary.ts
+++ b/libraries/rush-daemon/src/PhasedRequestSummary.ts
@@ -2,16 +2,31 @@
 // See LICENSE in the project root for license information.
 
 import type {
+  IExecutionResult,
+  ILogFilePaths,
   IOperationExecutionResult,
   IOperationGraph,
+  IOperationStateHashComponents,
+  IStopwatchResult,
   Operation,
   _IOperationActivityOptions
 } from '@microsoft/rush-lib';
 import { OperationStatus, _printOperationStatus } from '@microsoft/rush-lib';
-import { Terminal, TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
+import {
+  StdioSummarizer,
+  Terminal,
+  TerminalProviderSeverity,
+  type IProblemCollector,
+  type ITerminal,
+  type ITerminalProvider
+} from '@rushstack/terminal';
+
+import { getEngineActivityOptions, type IEngineActivityOptions } from './EngineActivityOptions';
 
 const SECONDS_PER_MINUTE: number = 60;
 const MILLISECONDS_PER_SECOND: number = 1000;
+const STDOUT_ACTIVITY: IEngineActivityOptions = { stderr: false };
+const STDERR_ACTIVITY: IEngineActivityOptions = { stderr: true };
 const SUMMARIZED_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Aborted,
   OperationStatus.Blocked,
@@ -25,51 +40,137 @@ const SUMMARIZED_STATUSES: ReadonlySet<OperationStatus> = new Set([
 
 /** The subset of a request event sink used to render a request's end-of-run summary. */
 export interface IPhasedRequestSummarySink {
-  getObservedResult(operation: Operation): { readonly executionResult: IOperationExecutionResult } | undefined;
+  getObservedResult(
+    operation: Operation
+  ): { readonly executionResult: IOperationExecutionResult } | undefined;
+  /** The record of one of this request's operations in the iteration that it is part of. */
+  getScheduledResult(operation: Operation): IOperationExecutionResult | undefined;
   onActivity(text: string, options?: _IOperationActivityOptions): void;
 }
 
-export interface IWritePhasedRequestSummaryOptions {
+export interface IPhasedRequestResultsOptions {
   readonly activeOperations: ReadonlyArray<Operation>;
-  readonly commandName: string;
-  readonly elapsedMs: number;
-  readonly executionError: unknown;
   readonly graph: IOperationGraph;
   readonly sink: IPhasedRequestSummarySink;
   /** Whether the request environment allows warnings in a successful build (`RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD`). */
   readonly warningsAllowedByEnvironment: boolean;
 }
 
+export interface IWritePhasedRequestSummaryOptions extends IPhasedRequestResultsOptions {
+  readonly commandName: string;
+  readonly executionError: unknown;
+  /**
+   * Called with the request's results after the status tables and before the duration line. Its terminal writes
+   * into the request's own output, and, unlike the summary's own lines, its warnings and errors carry their
+   * severity. If it throws, the summary reports errors and then rethrows the error.
+   */
+  readonly onResultsAsync: ((results: IExecutionResult, terminal: ITerminal) => Promise<void>) | undefined;
+  /** The `performance.now()` timestamp at which the request started. */
+  readonly startTimeMs: number;
+}
+
+const NEVER_STARTED_STOPWATCH: IStopwatchResult = {
+  duration: 0,
+  endTime: undefined,
+  startTime: undefined,
+  toString: () => '0.00 seconds'
+};
+const NO_PROBLEMS: IProblemCollector = { problems: new Set() };
+const NO_OUTPUT: StdioSummarizer = new StdioSummarizer();
+NO_OUTPUT.close();
+
 /**
- * Buffers terminal output into request-scoped activity events, one event per contiguous stream run.
+ * The result of a selected operation that a request did not need to run, because the operation was already up to
+ * date. Unlike a result that the graph reports, it describes only this request, so it has the `Skipped` status, no
+ * error, no problems, no output or log files and a stopwatch that was never started. The iteration id and state
+ * hashes are those of the previous result, which produced the operation's current outputs.
+ */
+class UpToDateOperationResult implements IOperationExecutionResult {
+  public readonly enabled: boolean = false;
+  public readonly error: undefined = undefined;
+  public readonly logFilePaths: ILogFilePaths | undefined = undefined;
+  public readonly nonCachedDurationMs: undefined = undefined;
+  public readonly problemCollector: IProblemCollector = NO_PROBLEMS;
+  public readonly silent: boolean = false;
+  public readonly status: OperationStatus = OperationStatus.Skipped;
+  public readonly stdioSummarizer: StdioSummarizer = NO_OUTPUT;
+  public readonly stopwatch: IStopwatchResult = NEVER_STARTED_STOPWATCH;
+  readonly #previous: IOperationExecutionResult;
+
+  public constructor(previous: IOperationExecutionResult) {
+    this.#previous = previous;
+  }
+
+  public get iterationId(): number {
+    return this.#previous.iterationId;
+  }
+
+  public get metadataFolderPath(): string {
+    return this.#previous.metadataFolderPath;
+  }
+
+  public get operation(): Operation {
+    return this.#previous.operation;
+  }
+
+  public get shouldRunnerPersist(): boolean {
+    return this.#previous.shouldRunnerPersist;
+  }
+
+  public getStateHash(): string {
+    return this.#previous.getStateHash();
+  }
+
+  public getStateHashComponents(): IOperationStateHashComponents {
+    return this.#previous.getStateHashComponents();
+  }
+}
+
+/**
+ * The activity options of the summary's own lines. Warnings and errors among them carry no severity, because clients
+ * that print only a summary give their own verdict.
+ */
+function getSummaryActivityOptions(severity: TerminalProviderSeverity): IEngineActivityOptions {
+  return severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning
+    ? STDERR_ACTIVITY
+    : STDOUT_ACTIVITY;
+}
+
+/**
+ * Buffers terminal output into request-scoped activity events, one event per contiguous run of text that has the
+ * same activity options.
  */
 class RequestActivityTerminalProvider implements ITerminalProvider {
   public readonly supportsColor: boolean = false;
   public readonly eolCharacter: string = '\n';
   readonly #sink: IPhasedRequestSummarySink;
+  readonly #getActivityOptions: (severity: TerminalProviderSeverity) => IEngineActivityOptions;
   #buffer: string = '';
-  #stderr: boolean = false;
+  #activityOptions: IEngineActivityOptions = STDOUT_ACTIVITY;
 
-  public constructor(sink: IPhasedRequestSummarySink) {
+  public constructor(
+    sink: IPhasedRequestSummarySink,
+    getActivityOptions: (severity: TerminalProviderSeverity) => IEngineActivityOptions
+  ) {
     this.#sink = sink;
+    this.#getActivityOptions = getActivityOptions;
   }
 
   public write(text: string, severity: TerminalProviderSeverity): void {
     if (severity === TerminalProviderSeverity.verbose || severity === TerminalProviderSeverity.debug) {
       return;
     }
-    const stderr: boolean =
-      severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning;
-    if (stderr !== this.#stderr) {
+    const activityOptions: IEngineActivityOptions = this.#getActivityOptions(severity);
+    if (activityOptions !== this.#activityOptions) {
       this.flush();
-      this.#stderr = stderr;
+      this.#activityOptions = activityOptions;
     }
     this.#buffer += text;
   }
 
   public flush(): void {
     if (this.#buffer.length > 0) {
-      this.#sink.onActivity(this.#buffer, { stderr: this.#stderr });
+      this.#sink.onActivity(this.#buffer, this.#activityOptions);
       this.#buffer = '';
     }
   }
@@ -81,30 +182,76 @@ class RequestActivityTerminalProvider implements ITerminalProvider {
  *
  * @remarks
  * Coalesced requests share one graph iteration, so the summary is computed per request from the request's own
- * selection rather than from the whole iteration. Selected operations that the warm graph did not need to run are
- * reported as already up to date, so a warm no-op still reports what it checked.
+ * selection rather than from the whole iteration; see {@link collectPhasedRequestResults}.
  */
-export function writePhasedRequestSummary(options: IWritePhasedRequestSummaryOptions): void {
-  const { commandName, elapsedMs, executionError, sink } = options;
-  const provider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(sink);
+export async function writePhasedRequestSummaryAsync(
+  options: IWritePhasedRequestSummaryOptions
+): Promise<void> {
+  const { commandName, executionError, onResultsAsync, sink, startTimeMs } = options;
+  const provider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(
+    sink,
+    getSummaryActivityOptions
+  );
   const terminal: Terminal = new Terminal(provider);
-  const duration: string = formatDuration(elapsedMs);
-  if (executionError === undefined) {
-    const operationResults: ReadonlyMap<Operation, IOperationExecutionResult> =
-      collectSummaryResults(options);
-    _printOperationStatus(terminal, {
-      operationResults,
-      status: getSummaryStatus(operationResults, options.warningsAllowedByEnvironment)
-    });
-    terminal.writeLine(`rush ${commandName} (${duration})`);
-  } else {
-    terminal.writeErrorLine(`rush ${commandName} - Errors! (${duration})`);
+  let callbackFailed: boolean = false;
+  let callbackError: unknown;
+  try {
+    if (executionError === undefined) {
+      const results: IExecutionResult = collectPhasedRequestResults(options);
+      _printOperationStatus(terminal, results);
+      if (onResultsAsync) {
+        // The status tables precede what the callback writes.
+        provider.flush();
+        // The callback's warnings and errors keep their severity, as they do on the engine's terminal, so that
+        // clients that print only a summary still show them.
+        const callbackProvider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(
+          sink,
+          getEngineActivityOptions
+        );
+        try {
+          await onResultsAsync(results, new Terminal(callbackProvider));
+        } catch (error) {
+          callbackFailed = true;
+          callbackError = error;
+        } finally {
+          callbackProvider.flush();
+        }
+      }
+    }
+    const duration: string = formatDuration(performance.now() - startTimeMs);
+    if (executionError === undefined && !callbackFailed) {
+      terminal.writeLine(`rush ${commandName} (${duration})`);
+    } else {
+      terminal.writeErrorLine(`rush ${commandName} - Errors! (${duration})`);
+    }
+  } finally {
+    provider.flush();
+  }
+  if (callbackFailed) {
+    throw callbackError;
   }
-  provider.flush();
 }
 
-function collectSummaryResults(
-  options: IWritePhasedRequestSummaryOptions
+/**
+ * Collects the results of the operations that one phased request selected, and the request's overall status.
+ *
+ * @remarks
+ * Operations are listed in graph order, as in the native summary, and silent operations are left out. A selected
+ * operation that the warm graph did not need to run is reported as an {@link UpToDateOperationResult}, so a warm
+ * no-op still reports what it checked. A request that returns early leaves out the operations that have not
+ * finished.
+ */
+export function collectPhasedRequestResults(options: IPhasedRequestResultsOptions): IExecutionResult {
+  const operationResults: ReadonlyMap<Operation, IOperationExecutionResult> =
+    collectOperationResults(options);
+  return {
+    operationResults,
+    status: getSummaryStatus(operationResults, options.warningsAllowedByEnvironment)
+  };
+}
+
+function collectOperationResults(
+  options: IPhasedRequestResultsOptions
 ): ReadonlyMap<Operation, IOperationExecutionResult> {
   const { activeOperations, graph, sink } = options;
   const active: ReadonlySet<Operation> = new Set(activeOperations);
@@ -116,9 +263,11 @@ function collectSummaryResults(
     }
     const observed: IOperationExecutionResult | undefined =
       sink.getObservedResult(operation)?.executionResult;
-    if (observed && !observed.silent) {
-      if (SUMMARIZED_STATUSES.has(observed.status)) {
-        results.set(operation, observed);
+    // A request that returns early is summarized while its iteration runs, before some operations report.
+    const current: IOperationExecutionResult | undefined = observed ?? sink.getScheduledResult(operation);
+    if (current && !current.silent) {
+      if (SUMMARIZED_STATUSES.has(current.status)) {
+        results.set(operation, current);
       }
       continue;
     }
@@ -126,23 +275,13 @@ function collectSummaryResults(
     const previous: IOperationExecutionResult | undefined =
       observed ?? graph.resultByOperation.get(operation);
     if (previous) {
-      results.set(operation, createUpToDateResult(previous));
+      // The shared record itself must not change, because other requests and the next iteration read it.
+      results.set(operation, new UpToDateOperationResult(previous));
     }
   }
   return results;
 }
 
-function createUpToDateResult(previous: IOperationExecutionResult): IOperationExecutionResult {
-  // The summary only reads these members for skipped operations; the shared record itself must not change.
-  const upToDate: Pick<IOperationExecutionResult, 'operation' | 'silent' | 'status' | 'stopwatch'> = {
-    operation: previous.operation,
-    silent: false,
-    status: OperationStatus.Skipped,
-    stopwatch: previous.stopwatch
-  };
-  return upToDate as IOperationExecutionResult;
-}
-
 function getSummaryStatus(
   results: ReadonlyMap<Operation, IOperationExecutionResult>,
   warningsAllowedByEnvironment: boolean
diff --git a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
new file mode 100644
index 00000000000..bed32e6219a
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
@@ -0,0 +1,164 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IOperationExecutionResult,
+  IOperationGraph,
+  IPhasedCommandEngineTelemetryRecord,
+  Operation
+} from '@microsoft/rush-lib';
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonPhasedRequest, IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+
+/** One phase of a phased request's handling, with `performance.now()` times. @beta */
+export interface IPhasedRequestTelemetryMeasure {
+  /** The measure name, such as `rush:daemon:queueWait`. */
+  readonly name: string;
+  /** A `performance.now()` value. */
+  readonly startTimeMs: number;
+  /** A `performance.now()` value. */
+  readonly endTimeMs: number;
+}
+
+/**
+ * The outcome and timing of one phased request that took part in a graph iteration or no-op check.
+ *
+ * @remarks
+ * All times are `performance.now()` values of the daemon process.
+ *
+ * @beta
+ */
+export interface IPhasedRequestTelemetryReport {
+  /** The request as the router executed it. */
+  readonly request: IDaemonPhasedRequest;
+  /** The result sent to the client. */
+  readonly result: IDaemonPhasedRequestResult;
+  /**
+   * The request's non-silent selected operations. Operations that this request did not need to run, because
+   * the warm graph had them up to date, are reported as `Skipped` with a zero-length stopwatch. For a failed
+   * result that was published while operations of the request still ran, the records are collected once the
+   * iteration ended, so those operations have their final statuses.
+   */
+  readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+  /** How many of `records` were already up to date. */
+  readonly countRetained: number;
+  /** How many requests took part in the same graph iteration or no-op check. */
+  readonly batchSize: number;
+  /** Whether the graph scheduled an iteration for the batch. */
+  readonly scheduled: boolean;
+  /**
+   * Whether the result was produced while the graph iteration was still running, for other requests or for
+   * operations of this request that its failure did not block.
+   */
+  readonly earlyResult: boolean;
+  /**
+   * Set when the request joined a graph iteration that was already executing for other requests, instead of waiting
+   * for it to end. Its `iterationStartTimeMs` is then when its work was added to the iteration.
+   */
+  readonly joinedIteration?: boolean;
+  /** When the router received the request. */
+  readonly receivedTimeMs: number;
+  /** When this request's batch began handling it. */
+  readonly executionStartTimeMs: number;
+  /** When the graph iteration began executing operations, if one was scheduled. */
+  readonly iterationStartTimeMs: number | undefined;
+  /** When the request's result was produced. */
+  readonly resultTimeMs: number;
+  /** The router's handling phases for this request, in order. */
+  readonly measures: ReadonlyArray<IPhasedRequestTelemetryMeasure>;
+}
+
+/**
+ * Receives one report for each phased request that took part in a graph iteration or no-op check.
+ *
+ * @remarks
+ * The router invokes the sink once it wrote the request's result, or failed to, so that logging never delays a
+ * result. A failed result that the router publishes while operations of the request that the failure did not
+ * block still run is reported once the iteration ended instead, so that those operations have their final
+ * statuses. Either way, the report has the timing of the result that the client received. The sink must not
+ * throw; the router ignores its errors so that telemetry never changes a result.
+ *
+ * @beta
+ */
+export interface IPhasedRequestTelemetrySink {
+  /**
+   * Called once for each request, after its result was written to the client or the write failed, or once the
+   * iteration ended for a failed result that was published while operations of the request still ran. Errors are
+   * ignored.
+   */
+  logRequest(report: IPhasedRequestTelemetryReport): void;
+}
+
+/** The subset of a request event sink used to collect a request's telemetry records. */
+export interface IPhasedRequestTelemetryObservations {
+  getObservedResult(operation: Operation): { readonly executionResult: IOperationExecutionResult } | undefined;
+}
+
+export interface ICollectPhasedRequestTelemetryRecordsOptions {
+  readonly activeOperations: ReadonlyArray<Operation>;
+  readonly graph: IOperationGraph;
+  readonly observations: IPhasedRequestTelemetryObservations;
+  /** The timestamp given to operations that the request did not need to run. */
+  readonly upToDateTimeMs: number;
+}
+
+export interface IPhasedRequestTelemetryRecords {
+  readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+  readonly countRetained: number;
+}
+
+const UNFINISHED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Waiting,
+  OperationStatus.Ready,
+  OperationStatus.Queued,
+  OperationStatus.Executing
+]);
+
+/**
+ * Collects the telemetry records of one request's selection, matching the request's own end-of-run summary.
+ */
+export function collectPhasedRequestTelemetryRecords(
+  options: ICollectPhasedRequestTelemetryRecordsOptions
+): IPhasedRequestTelemetryRecords {
+  const { activeOperations, graph, observations, upToDateTimeMs } = options;
+  const active: ReadonlySet<Operation> = new Set(activeOperations);
+  const records: Map<Operation, IPhasedCommandEngineTelemetryRecord> = new Map();
+  let countRetained: number = 0;
+  // Iterate the graph so that entries list operations in the same order as native entries.
+  for (const operation of graph.operations) {
+    if (!active.has(operation) || operation.runner?.silent !== false) {
+      continue;
+    }
+    const observed: IOperationExecutionResult | undefined =
+      observations.getObservedResult(operation)?.executionResult;
+    if (observed && !observed.silent) {
+      records.set(
+        operation,
+        UNFINISHED_STATUSES.has(observed.status) ? createAbortedRecord(observed) : observed
+      );
+    } else if (observed ?? graph.resultByOperation.get(operation)) {
+      // A silent observed record belongs to an operation the graph disabled because it was already up to date.
+      // Its retained stopwatch describes an earlier request, so it is not reported again.
+      records.set(operation, {
+        status: OperationStatus.Skipped,
+        silent: false,
+        stopwatch: { startTime: upToDateTimeMs, endTime: upToDateTimeMs },
+        nonCachedDurationMs: undefined
+      });
+      countRetained++;
+    }
+  }
+  return { records, countRetained };
+}
+
+function createAbortedRecord(observed: IOperationExecutionResult): IPhasedCommandEngineTelemetryRecord {
+  // The client stopped observing before this operation finished. The operation may still finish before the report
+  // is logged, so the report keeps the times it had when it was taken.
+  const { startTime, endTime } = observed.stopwatch;
+  return {
+    status: OperationStatus.Aborted,
+    silent: false,
+    stopwatch: { startTime, endTime },
+    nonCachedDurationMs: undefined
+  };
+}
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 69518fef3af..9b33813ae8b 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -1,32 +1,43 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import * as path from 'node:path';
-
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import type { LockFile } from '@rushstack/node-core-library';
 import {
+  EnvironmentVariableNames,
   getWorkspaceFingerprintEnvironmentEntries,
   PhasedCommandEngine,
   PhasedCommandEngineBusyError,
   PhasedCommandEngineConfigurationChangedError,
+  PhasedCommandEngineProjectConfigurationError,
+  PhasedCommandEngineUsageError,
   type IPhasedCommandEngine,
+  type IPhasedCommandEngineLogTelemetryOptions,
+  type IPhasedCommandEngineSharingLabels,
   type IInputsSnapshot,
   type IOperationGraph,
+  type ITelemetryData,
   type Operation,
-  type OperationEnabledState
+  type OperationEnabledState,
+  type RushSession
 } from '@microsoft/rush-lib';
-import type { IDaemonPhasedOperationSelection } from '@rushstack/rush-daemon-protocol';
+import type {
+  IDaemonPhasedOperationSelection,
+  IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
 
 import {
   DaemonRequestDispatchError,
+  DaemonRequestEnvironmentError,
   type IDaemonRequestResolver,
   type IResolveDaemonRequestOptions,
   type ResolvedDaemonRequest
 } from './DaemonRequestDispatcher';
+import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import {
   WorkspaceEngineComponentFactory,
   WorkspaceEngineRecreationRequiredError,
-  type IMapWorkspaceInvalidationsOptions,
+  type IPeekWorkspaceInvalidationsOptions,
   type IWorkspaceEngineShape,
   type IWorkspaceInvalidationReconciliation
 } from './WorkspaceEngineComponentFactory';
@@ -34,78 +45,201 @@ import type { IWorkspaceSession, IWorkspaceSessionComponents } from './Workspace
 import { EngineTerminalProvider } from './EngineTerminalProvider';
 import { OperationOutputFingerprints } from './OperationOutputFingerprints';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
-import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { BUILT_IN_RUSH_COMMAND_CLASSIFICATION, classifyPhasedRushCommand } from './RushCommandRequestPolicy';
+import { createInputsCompatibilityCheck, getOperationsWithChangedInputs } from './WorkspaceInputsComparison';
+import { createDaemonRequestTelemetrySink, type IDaemonEngineCreationTiming } from './DaemonRequestTelemetry';
+
+const BUILT_IN_PHASED_COMMAND_NAMES: ReadonlySet<string> = new Set(['build', 'rebuild']);
+
+/** The parsed command that created an engine, and the Rush session that its plugins were applied to. */
+interface IBoundEngine {
+  readonly command: PhasedCommandEngine;
+  readonly rushSession: RushSession | undefined;
+}
+
+/** A native parse of the command line of a request. */
+interface IParsedCommand {
+  readonly command: PhasedCommandEngine;
+  readonly terminal: EngineTerminalProvider;
+  readonly envelope: IDaemonRequestEnvelope;
+  readonly workspaceSession: IWorkspaceSession;
+}
 
 /**
- * Binds the standalone host to a real native build/rebuild graph on its first request.
+ * Binds the standalone host to a real native phased command graph on its first request.
  *
  * @remarks
- * A host is pinned to its first command and graph-affecting, non-selection parameters. Presentation and
- * scheduling parameters (`--verbose`, `--parallelism`, `--timeline`) are applied per request instead.
- * Incompatible parameters,
+ * A host is pinned to the engine of its first command. That engine serves every later request whose command it can
+ * serve (`PhasedCommandEngine.getEngineSharingBlocker`): requests of the same command whose graph-affecting,
+ * non-selection parameters are the same, and, if the first command is incremental, requests of other commands, for
+ * example `rebuild` on the engine of `build`, or `build` on the engine of `test`. Presentation and scheduling
+ * parameters (`--verbose`, `--parallelism`, `--timeline`) and whether the command is incremental are applied per
+ * request instead.
+ * Another built-in command, or another custom command whose own engine could serve the first command, replaces
+ * the engine through a reload; any other custom command is unsupported, so that the host never switches back and
+ * forth between two engines. Incompatible parameters,
  * environments, or graph inputs are rejected before scheduling; no request is retried automatically.
- * The initial supported surface excludes external plugins, .env initialization, install/watch,
- * event-hook scripts, and rushx/global commands. Use the unchanged native CLI for those surfaces.
+ * It serves build, rebuild and the phased commands of command-line.json. The initial supported surface excludes
+ * external plugins that participate in the requested command
+ * (unless their manifest or the repository declares them daemon-compatible), .env initialization,
+ * install/watch, build event-hook scripts, and rushx/global commands. Use the unchanged native CLI for those surfaces.
  * @beta
  */
 export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   #binding: Promise<void> | undefined;
-  #parameterIdentity: string | undefined;
+  #boundCommand: PhasedCommandEngine | undefined;
+  /** The request whose handling created the warm engine, and when it did. */
+  #engineCreation: (IDaemonEngineCreationTiming & { readonly requestId: string }) | undefined;
+  #logTelemetry: EngineLogTelemetry | undefined;
+  #loggedRequestCount: number = 0;
   #workspaceSession: IWorkspaceSession | undefined;
-  readonly #environmentIdentity: string = environmentIdentity(process.env);
+  readonly #environmentIdentity: string;
   readonly #preparationLock: LockFile | undefined;
+  /** The daemon's environment when it started. Replacement sessions keep it; see `createForSession`. */
+  readonly #startupEnvironment: Readonly<Record<string, string | undefined>>;
   readonly #validateGraphInputsAsync: (() => Promise<void>) | undefined;
+  // The workspace lifecycle checks the command identity of a request, and then resolves the request under the same
+  // admission lease. Keyed by the abort signal of the request, a parse is kept only as long as its request.
+  readonly #identityParses: WeakMap<AbortSignal, IParsedCommand> = new WeakMap();
 
   public constructor(options?: {
     readonly preparationLock?: LockFile;
     readonly validateGraphInputsAsync?: () => Promise<void>;
+    /** The environment that requests must match. Defaults to a copy of `process.env`. */
+    readonly startupEnvironment?: Readonly<Record<string, string | undefined>>;
   }) {
     this.#preparationLock = options?.preparationLock;
     this.#validateGraphInputsAsync = options?.validateGraphInputsAsync;
+    this.#startupEnvironment = options?.startupEnvironment ?? { ...process.env };
+    this.#environmentIdentity = environmentIdentity(this.#startupEnvironment);
   }
 
   public get workspaceLifecycle(): IWorkspaceResolverLifecycle {
     return this;
   }
 
-  /** Creates an unbound resolver for a replacement session without carrying old runner definitions. */
+  /**
+   * Creates an unbound resolver for a replacement session without carrying old runner definitions.
+   * It keeps the startup environment, because a plugin may have added names to `process.env` since then.
+   */
   public createForSession(
     preparationLock?: LockFile,
     validateGraphInputsAsync?: () => Promise<void>
   ): ProductionDaemonRequestResolver {
-    return new ProductionDaemonRequestResolver({ preparationLock, validateGraphInputsAsync });
+    return new ProductionDaemonRequestResolver({
+      preparationLock,
+      validateGraphInputsAsync,
+      startupEnvironment: this.#startupEnvironment
+    });
+  }
+
+  /**
+   * Rejects a rushx script and a built-in command that is not phased, since the resolver never serves either.
+   *
+   * @remarks
+   * It reads only the envelope, so it needs no session: command-line.json cannot redefine a built-in command, so
+   * the name identifies one without a parse. Whether the resolver serves a custom command is known only once its
+   * command line is parsed (`getCommandParameterIdentityAsync`), so this never rejects one.
+   */
+  public getUnsupportedCommandError(
+    envelope: IDaemonRequestEnvelope
+  ): DaemonRequestDispatchError | undefined {
+    if (isRushxInvocation(envelope)) {
+      return new DaemonRequestDispatchError('unsupported', 'A rushx script is not a phased command request.');
+    }
+    if (
+      Object.hasOwn(BUILT_IN_RUSH_COMMAND_CLASSIFICATION, envelope.commandName) &&
+      !BUILT_IN_PHASED_COMMAND_NAMES.has(envelope.commandName)
+    ) {
+      return new DaemonRequestDispatchError(
+        'unsupported',
+        `"${envelope.commandName}" is a built-in command that is not phased.`
+      );
+    }
+    return undefined;
   }
 
-  /** Inspects the native command shape without constructing or executing an operation graph. */
+  /**
+   * Inspects the native command shape without constructing or executing an operation graph.
+   *
+   * @remarks
+   * Returns the identity of the bound engine's command when that engine can serve the request, so that the
+   * lifecycle reuses it, and the request's own identity otherwise, so that the lifecycle reloads. A custom command
+   * that the bound engine cannot serve, and whose own engine could not serve the bound engine's command, is
+   * unsupported. A request whose environment differs from the startup environment is rejected only after its
+   * command line parses as a phased command, so that a lifecycle restarts the daemon only for such a command.
+   */
   public async getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string> {
-    return (await this.#parseCommandAsync(options, new EngineTerminalProvider())).parameterIdentity;
+    const { envelope, workspaceSession } = options;
+    this.#assertServedCommand(envelope);
+    const parsed: IParsedCommand = await this.#parseCommandLineAsync(options);
+    this.#assertStartupEnvironment(envelope);
+    // Resolving the same request uses this parse instead of parsing the same command line again.
+    this.#identityParses.set(options.abortSignal, parsed);
+    const { command } = parsed;
+    const engine: IBoundEngine | undefined = await this.#tryGetBoundEngineAsync(workspaceSession);
+    if (!engine) return command.parameterIdentity;
+    const engineName: string = engine.command.commandName;
+    const requestName: string = command.commandName;
+    const labels: IPhasedCommandEngineSharingLabels | undefined = getSharingLabels(engineName, requestName);
+    const blocker: string | undefined = getEngineSharingBlocker(engine, command, labels);
+    if (blocker === undefined) return engine.command.parameterIdentity;
+    if (envelope.commandOrigin === 'custom') {
+      const reverseBlocker: string | undefined = getEngineSharingBlocker(
+        { command, rushSession: engine.rushSession },
+        engine.command,
+        labels && { engine: labels.request, request: labels.engine }
+      );
+      if (reverseBlocker !== undefined) {
+        throw new DaemonRequestDispatchError(
+          'unsupported',
+          describeUnsharedEngines(engineName, requestName, blocker, reverseBlocker)
+        );
+      }
+    }
+    return command.parameterIdentity;
   }
 
   public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
+    const resolveStartTimeMs: number = performance.now();
     const { envelope, workspaceSession } = options;
-    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
-    const command: PhasedCommandEngine = await this.#parseCommandAsync(options, terminal);
+    const { command, terminal }: IParsedCommand = await this.#parseCommandAsync(
+      options,
+      this.#takeIdentityParse(options)
+    );
+    let bindingStartTimeMs: number | undefined;
     if (this.#binding) {
-      if (
-        this.#parameterIdentity !== command.parameterIdentity ||
-        this.#workspaceSession !== workspaceSession
-      ) {
+      if (!(await this.#canServeAsync(command, workspaceSession))) {
         throw new WorkspaceEngineRecreationRequiredError();
       }
     } else {
-      this.#parameterIdentity = command.parameterIdentity;
+      this.#boundCommand = command;
       this.#workspaceSession = workspaceSession;
-      const binding: Promise<void> = this.#bindAsync(command, terminal, workspaceSession);
+      bindingStartTimeMs = performance.now();
+      const binding: Promise<void> = this.#bindAsync(
+        command,
+        terminal,
+        workspaceSession,
+        options.engineCreationSignal
+      );
       this.#binding = binding;
       void binding.catch((error: unknown) => {
         if (error instanceof PhasedCommandEngineBusyError && this.#binding === binding) {
           this.#binding = undefined;
-          this.#parameterIdentity = undefined;
+          this.#boundCommand = undefined;
           this.#workspaceSession = undefined;
         }
       });
     }
     await this.#binding;
+    if (bindingStartTimeMs !== undefined) {
+      this.#engineCreation = {
+        requestId: envelope.requestId,
+        startTimeMs: bindingStartTimeMs,
+        endTimeMs: performance.now()
+      };
+    }
     const graph: IOperationGraph | undefined = workspaceSession.operationGraph;
     const shape: IWorkspaceEngineShape | undefined = workspaceSession.engineShape;
     if (!graph || !shape) throw new Error('Native engine initialization did not bind a workspace graph.');
@@ -119,58 +253,151 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     for (const [operation, enabledState] of selection) {
       if (enabledState !== false) operationSelection.push({ operationId: operation.name, enabledState });
     }
+    const logTelemetry: EngineLogTelemetry | undefined = this.#logTelemetry;
+    // A workspace lifecycle may bind the engine with this request before it dispatches the request.
+    const engineCreation: IDaemonEngineCreationTiming | undefined =
+      this.#engineCreation?.requestId === envelope.requestId ? this.#engineCreation : undefined;
     return {
       kind: 'phased',
       exactSelection: true,
       requestSettings: command.requestSettings,
+      exclusivityClass: classifyPhasedRushCommand({
+        commandName: command.commandName,
+        commandOrigin: envelope.commandOrigin,
+        isIncremental: command.isIncremental
+      }),
+      telemetry: logTelemetry
+        ? createDaemonRequestTelemetrySink({
+            command,
+            logTelemetry,
+            workspaceSession,
+            lifecycleInfo: options.lifecycleInfo,
+            resolveStartTimeMs,
+            resolveEndTimeMs: performance.now(),
+            engineCreation,
+            getRequestIndex: () => ++this.#loggedRequestCount
+          })
+        : undefined,
       request: {
         admission: envelope.admission,
         commandName: envelope.commandName,
         commandOrigin: envelope.commandOrigin,
         engineShape: shape,
-        environment: envelope.environment,
+        // Native Rush assigns the invocation's folder at CLI startup (Rush._assignRushInvokedFolder).
+        environment: {
+          ...envelope.environment,
+          [EnvironmentVariableNames.RUSH_INVOKED_FOLDER]: envelope.cwd
+        },
         operationSelection,
         requestId: envelope.requestId,
+        returnEarlyOnFailure: envelope.returnEarlyOnFailure,
         terminalRequirement: envelope.terminal.terminalRequirement
       }
     };
   }
 
+  /** Whether the engine bound to `session` can serve `command`; see `PhasedCommandEngine.getEngineSharingBlocker`. */
+  async #canServeAsync(command: PhasedCommandEngine, session: IWorkspaceSession): Promise<boolean> {
+    if (this.#workspaceSession !== session) return false;
+    // Equal identities need no initialized engine; the caller then awaits the binding and sees its error, if any.
+    if (this.#boundCommand?.parameterIdentity === command.parameterIdentity) return true;
+    const engine: IBoundEngine | undefined = await this.#tryGetBoundEngineAsync(session);
+    return !!engine && getEngineSharingBlocker(engine, command) === undefined;
+  }
+
+  /**
+   * The command and session of the engine bound to `session`, or undefined if none is bound to it or it failed to
+   * initialize. The lifecycle binds engines under an exclusive transition lease, so no request that holds a lease
+   * waits here for a binding in progress.
+   */
+  async #tryGetBoundEngineAsync(session: IWorkspaceSession): Promise<IBoundEngine | undefined> {
+    const binding: Promise<void> | undefined = this.#binding;
+    const command: PhasedCommandEngine | undefined = this.#boundCommand;
+    if (!binding || !command || this.#workspaceSession !== session) return undefined;
+    try {
+      await binding;
+    } catch {
+      return undefined;
+    }
+    return { command, rushSession: session.rushSession };
+  }
+
+  /** Returns the parse of the identity check of this request, if its command line and session are unchanged. */
+  #takeIdentityParse(options: IResolveDaemonRequestOptions): IParsedCommand | undefined {
+    const parsed: IParsedCommand | undefined = this.#identityParses.get(options.abortSignal);
+    this.#identityParses.delete(options.abortSignal);
+    return parsed && isSameCommandLine(parsed, options) ? parsed : undefined;
+  }
+
   async #parseCommandAsync(
     options: IResolveDaemonRequestOptions,
-    terminal: EngineTerminalProvider
-  ): Promise<PhasedCommandEngine> {
-    const { envelope, workspaceSession, abortSignal } = options;
-    if (!['build', 'rebuild'].includes(envelope.commandName) || envelope.commandOrigin !== 'built-in') {
-      throw new DaemonRequestDispatchError(
-        'unsupported',
-        'The production daemon requires an explicitly identified native build/rebuild request. Ambiguous custom/rushx requests require --no-daemon.'
-      );
+    identityParse?: IParsedCommand
+  ): Promise<IParsedCommand> {
+    // Skips parsing for a command that the resolver never serves.
+    this.#assertServedCommand(options.envelope);
+    this.#assertStartupEnvironment(options.envelope);
+    return await this.#parseCommandLineAsync(options, identityParse);
+  }
+
+  /** Throws the error of `getUnsupportedCommandError`, if it returns one. */
+  #assertServedCommand(envelope: IDaemonRequestEnvelope): void {
+    const unsupported: DaemonRequestDispatchError | undefined = this.getUnsupportedCommandError(envelope);
+    if (unsupported) throw unsupported;
+  }
+
+  /** Rejects a request whose environment, or the daemon's own environment, differs from the startup environment. */
+  #assertStartupEnvironment(envelope: IDaemonRequestEnvelope): void {
+    if (environmentIdentity(envelope.environment) !== this.#environmentIdentity) {
+      throw new DaemonRequestEnvironmentError();
     }
-    if (
-      environmentIdentity(envelope.environment) !== this.#environmentIdentity ||
-      environmentIdentity(process.env) !== this.#environmentIdentity
-    ) {
+    const changedNames: string[] = this.#getChangedStartupNames();
+    if (changedNames.length > 0) {
       throw new DaemonRequestDispatchError(
         'unsupported',
-        'The request environment differs from the daemon startup environment. Restart the daemon from this environment or use --no-daemon.'
+        `The daemon's own environment changed after it started (${changedNames.join(', ')}); a Rush plugin ` +
+          'may have changed process.env. Restart the daemon or use --no-daemon.'
       );
     }
-    let command: PhasedCommandEngine;
-    try {
-      command = await PhasedCommandEngine.parseAsync({
-        argv: envelope.argv,
-        cwd: envelope.cwd,
-        rushConfiguration: workspaceSession.rushConfiguration,
-        terminalProvider: terminal
-      });
-    } catch (error) {
-      throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
+  }
+
+  /** Parses the command line of the request, unless `identityParse` is given, and checks the parsed command. */
+  async #parseCommandLineAsync(
+    options: IResolveDaemonRequestOptions,
+    identityParse?: IParsedCommand
+  ): Promise<IParsedCommand> {
+    const { envelope, workspaceSession, abortSignal } = options;
+    let parsed: IParsedCommand | undefined = identityParse;
+    if (!parsed) {
+      const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+      try {
+        const command: PhasedCommandEngine = await PhasedCommandEngine.parseAsync({
+          argv: envelope.argv,
+          cwd: envelope.cwd,
+          environment: envelope.environment,
+          rushConfiguration: workspaceSession.rushConfiguration,
+          terminalProvider: terminal
+        });
+        parsed = { command, terminal, envelope, workspaceSession };
+      } catch (error) {
+        // Answer only for a command line of the requested command; in-process Rush reports any other one.
+        if (error instanceof PhasedCommandEngineUsageError && envelope.argv[0] === envelope.commandName) {
+          throw new DaemonRequestUsageError(terminal.describeError(error), error.exitCode, {
+            cause: error,
+            usage: error.usage
+          });
+        }
+        throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
+      }
     }
-    if (command.commandName !== envelope.commandName) {
+    // Clients mark only build and rebuild as built-in; every other phased command comes from command-line.json.
+    if (
+      parsed.command.commandName !== envelope.commandName ||
+      BUILT_IN_PHASED_COMMAND_NAMES.has(parsed.command.commandName) !==
+        (envelope.commandOrigin === 'built-in')
+    ) {
       throw new DaemonRequestDispatchError(
         'invalidRequest',
-        'The command name does not match the native parsed argv.'
+        'The command name or origin does not match the native parsed argv.'
       );
     }
     if (abortSignal.aborted)
@@ -179,28 +406,63 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         getDaemonShutdownReason(abortSignal)?.message ??
           'The request was cancelled before engine initialization.'
       );
-    return command;
+    return parsed;
+  }
+
+  /**
+   * The names of the startup environment whose value in `process.env` changed or was removed since startup.
+   *
+   * @remarks
+   * Engine code runs in this process, and a plugin may add its own names to `process.env`, for example to pass
+   * a session ID to its operations. Native Rush keeps such names for the rest of the command, so they are not
+   * a difference from the client's environment, and are not reported here. Otherwise every request after the
+   * plugin's first write would fall back to in-process Rush. A request whose own environment sets an added name
+   * still differs from the startup environment.
+   *
+   * Both values are compared as the workspace fingerprint records them. The startup entries drop repeated PATH
+   * entries, so a raw live PATH that repeats an entry would otherwise count as changed on every request.
+   */
+  #getChangedStartupNames(): string[] {
+    const liveEnvironment: NodeJS.ProcessEnv = process.env;
+    return getWorkspaceFingerprintEnvironmentEntries(this.#startupEnvironment)
+      .filter(([name, value]) => getFingerprintValue(name, liveEnvironment[name]) !== value)
+      .map(([name]) => name);
   }
 
   async #bindAsync(
     command: PhasedCommandEngine,
     terminal: EngineTerminalProvider,
-    session: IWorkspaceSession
+    session: IWorkspaceSession,
+    abortSignal: AbortSignal | undefined
   ): Promise<void> {
     if (!session.initializeEngineAsync) throw new Error('This session cannot bind a native engine.');
+    if (command.unmatchedCompatiblePluginNames.length > 0) {
+      // The binding request's output also carries this warning; the launcher log keeps it for daemon diagnostics.
+      process.stderr.write(
+        `Warning: the daemon's compatible plugin list names plugins that are not configured in ` +
+          `rush-plugins.json: ${command.unmatchedCompatiblePluginNames.join(', ')}\n`
+      );
+    }
     await session.initializeEngineAsync(async (options) => {
       let engine: IPhasedCommandEngine;
       try {
-        engine = await command.createEngineAsync(this.#preparationLock);
+        engine = await command.createEngineAsync(this.#preparationLock, abortSignal);
       } catch (error) {
         if (error instanceof PhasedCommandEngineBusyError) throw error;
+        if (error instanceof PhasedCommandEngineProjectConfigurationError) {
+          throw createProjectConfigurationFallback(error);
+        }
         throw new Error(terminal.describeError(error), { cause: error });
       }
       try {
+        this.#logTelemetry = engine.logTelemetry;
         terminal.attach(engine.operationGraph);
         const outputFingerprints: OperationOutputFingerprints = new OperationOutputFingerprints(
           engine.operationGraph
         );
+        const checkInputsCompatibility: (snapshot: IInputsSnapshot) => void = createInputsCompatibilityCheck(
+          engine.inputsSnapshot
+        );
         const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
           createEngineComponentsAsync: async () => ({
             ...engine,
@@ -214,8 +476,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
                 }
                 throw error;
               }
-              if (snapshot && !this.#validateGraphInputsAsync)
-                assertCompatibleInputs(engine.inputsSnapshot, snapshot);
+              if (snapshot && !this.#validateGraphInputsAsync) checkInputsCompatibility(snapshot);
               return snapshot;
             }
           }),
@@ -223,24 +484,35 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           refreshInputsOnEveryRequest: true,
           validateGraphInputsAsync: this.#validateGraphInputsAsync,
           mapInvalidationsToOperationsAsync: async (invalidationOptions) => [
-            ...getChangedOperations(invalidationOptions),
+            ...getOperationsWithChangedInputs(invalidationOptions),
             // Outputs are git-ignored and absent from state hashes, so check them separately.
-            ...outputFingerprints.getOperationsWithChangedOutputs()
+            ...(invalidationOptions.executingIterationRecords
+              ? outputFingerprints.peekOperationsWithChangedOutputs(
+                  invalidationOptions.executingIterationRecords
+                )
+              : outputFingerprints.getOperationsWithChangedOutputs())
           ]
         });
         const components: IWorkspaceSessionComponents = await factory.createAsync(options);
         return {
           ...components,
+          // A rebuild runs every operation of each request, so no request can join another's iteration
+          peekInvalidationsAsync: async (peekOptions: IPeekWorkspaceInvalidationsOptions) =>
+            engine.isIncremental ? await components.peekInvalidationsAsync!(peekOptions) : undefined,
           reconcileInvalidationsAsync: async () => {
-            const result: IWorkspaceInvalidationReconciliation =
-              await terminal.reconcileWithRequestDiagnosticsAsync(() =>
-                components.reconcileInvalidationsAsync!()
-              );
-            if (!engine.isIncremental) engine.operationGraph.invalidateOperations(undefined, 'rebuild');
-            return result;
+            const reconcileAsync = (): Promise<IWorkspaceInvalidationReconciliation> =>
+              terminal.reconcileWithRequestDiagnosticsAsync(() => components.reconcileInvalidationsAsync!());
+            if (!engine.isIncremental) {
+              // Every operation runs, so no output contents are checked.
+              const rebuildResult: IWorkspaceInvalidationReconciliation = await reconcileAsync();
+              engine.operationGraph.invalidateOperations(undefined, 'rebuild');
+              return rebuildResult;
+            }
+            return await outputFingerprints.walkWhileReconcilingAsync(reconcileAsync);
           }
         };
       } catch (error) {
+        this.#logTelemetry = undefined;
         try {
           await engine[Symbol.asyncDispose]();
         } catch (cleanupError) {
@@ -255,34 +527,98 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   }
 }
 
+/**
+ * An engine loads the configuration of every project, whereas native Rush loads only the projects that a request
+ * selects. In-process Rush can therefore serve a request that the daemon cannot, for example after a filtered
+ * install, and it reports the error itself if the request selects the project.
+ */
+function createProjectConfigurationFallback(
+  error: PhasedCommandEngineProjectConfigurationError
+): DaemonRequestDispatchError {
+  // The launcher log keeps the whole error for daemon diagnostics; the client prints one line.
+  process.stderr.write(`Warning: ${error.message}\n`);
+  const cause: unknown = error.cause;
+  const detail: string =
+    cause instanceof Error && !(cause instanceof AlreadyReportedError)
+      ? `: ${cause.message.split('\n', 1)[0]}`
+      : '';
+  const hint: string =
+    (cause as { code?: unknown } | undefined)?.code === 'MODULE_NOT_FOUND'
+      ? ' (the daemon loads every project, so it needs a full "rush install")'
+      : '';
+  return new DaemonRequestDispatchError(
+    'unsupported',
+    `The daemon could not load the configuration of project "${error.projectName}"${detail}${hint}`,
+    { cause: error }
+  );
+}
+
+type EngineLogTelemetry = (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
+
 function environmentIdentity(environment: Readonly<Record<string, string | undefined>>): string {
   return JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment));
 }
 
-function getChangedOperations(options: IMapWorkspaceInvalidationsOptions): Iterable<Operation> {
-  const { currentInputsSnapshot: current, nextInputsSnapshot: next, operationGraph } = options;
-  return Array.from(operationGraph.operations).filter(
-    (operation) =>
-      current.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name) !==
-      next.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name)
-  );
+/** Explains why `engine` cannot serve `request`, or returns undefined if it can. */
+function getEngineSharingBlocker(
+  engine: IBoundEngine,
+  request: PhasedCommandEngine,
+  labels?: IPhasedCommandEngineSharingLabels
+): string | undefined {
+  if (engine.command.parameterIdentity === request.parameterIdentity) return undefined;
+  if (!engine.rushSession) return 'the engine has no Rush session';
+  return engine.command.getEngineSharingBlocker(request, engine.rushSession, labels);
 }
 
-function assertCompatibleInputs(current: IInputsSnapshot, next: IInputsSnapshot): void {
-  const paths: Set<string> = new Set([...current.hashes.keys(), ...next.hashes.keys()]);
-  for (const filePath of paths) {
-    if (isGraphDefinitionPath(filePath) && current.hashes.get(filePath) !== next.hashes.get(filePath)) {
-      throw new WorkspaceEngineRecreationRequiredError();
-    }
-  }
+/**
+ * How the reasons name the command that created the daemon's engine and the requested command if both have the same
+ * name, or undefined for the quoted names.
+ */
+function getSharingLabels(
+  engineName: string,
+  requestName: string
+): IPhasedCommandEngineSharingLabels | undefined {
+  return engineName === requestName
+    ? { engine: `the earlier "${engineName}"`, request: `this "${requestName}"` }
+    : undefined;
+}
+
+/**
+ * Why neither the daemon's engine nor an engine created by the requested command could serve the other's command.
+ * If both reasons are the same, it gives the reason once.
+ */
+function describeUnsharedEngines(
+  engineName: string,
+  requestName: string,
+  blocker: string,
+  reverseBlocker: string
+): string {
+  const sameName: boolean = engineName === requestName;
+  const creator: string = sameName ? `an earlier "${engineName}"` : `"${engineName}"`;
+  const served: string = sameName ? 'the earlier one' : `"${engineName}"`;
+  const request: string = sameName ? `this "${requestName}"` : `"${requestName}"`;
+  const unserved: string = `The daemon's engine, created by ${creator}, cannot serve ${request}`;
+  return blocker === reverseBlocker
+    ? `${unserved}, and an engine created by ${request} could not serve ${served} either, because ${blocker}.`
+    : `${unserved} because ${blocker}, and an engine created by ${request} could not serve ${served} ` +
+        `because ${reverseBlocker}.`;
 }
 
-function isGraphDefinitionPath(filePath: string): boolean {
-  const normalized: string = filePath.replace(/\\/g, '/');
+/** Whether a parse has exactly the inputs that parsing the command line of this request would have. */
+function isSameCommandLine(parsed: IParsedCommand, options: IResolveDaemonRequestOptions): boolean {
+  const { envelope, workspaceSession } = options;
   return (
-    /(^|\/)config\//.test(normalized) ||
-    ['rush.json', 'package.json', '.gitignore', '.npmrc', '.env', 'pnpm-lock.yaml'].includes(
-      path.basename(filePath)
-    )
+    parsed.workspaceSession === workspaceSession &&
+    parsed.envelope.requestId === envelope.requestId &&
+    parsed.envelope.argv === envelope.argv &&
+    parsed.envelope.cwd === envelope.cwd &&
+    parsed.envelope.environment === envelope.environment
   );
 }
+
+/** The value of one variable as {@link getWorkspaceFingerprintEnvironmentEntries} records it, if it is set. */
+function getFingerprintValue(name: string, value: string | undefined): string | undefined {
+  return value === undefined
+    ? undefined
+    : getWorkspaceFingerprintEnvironmentEntries({ [name]: value })[0]?.[1];
+}
diff --git a/libraries/rush-daemon/src/ReducingGarbageCollection.ts b/libraries/rush-daemon/src/ReducingGarbageCollection.ts
new file mode 100644
index 00000000000..e3623691809
--- /dev/null
+++ b/libraries/rush-daemon/src/ReducingGarbageCollection.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as v8 from 'node:v8';
+import * as vm from 'node:vm';
+
+interface IGarbageCollectionOptions {
+  readonly type: 'major';
+  readonly execution: 'sync';
+  readonly flavor: 'last-resort';
+}
+
+type GarbageCollectionFunction = (options?: IGarbageCollectionOptions) => void;
+
+const REDUCING_GARBAGE_COLLECTION: IGarbageCollectionOptions = {
+  type: 'major',
+  execution: 'sync',
+  // V8 runs full collections that reduce the memory footprint until nothing more is freed. Only these return the
+  // freed pages to the operating system; a regular full collection keeps them pooled for reuse.
+  flavor: 'last-resort'
+};
+
+// V8 11 (Node.js 20) reads an options object without `type: 'minor'` or `execution: 'async'` like a truthy
+// legacy argument, which asks for a minor collection. It gets no argument, which asks for a full collection.
+const READS_GARBAGE_COLLECTION_OPTIONS: boolean = Number.parseInt(process.versions.v8, 10) >= 12;
+
+/**
+ * Returns a function that runs V8's memory-reducing full garbage collection, which returns the heap pages that it
+ * frees to the operating system. On Node.js 20, whose V8 does not have it, the function runs a regular full
+ * collection.
+ *
+ * @remarks
+ * Unless the process already exposes `gc`, `--expose-gc` is set only while one new context is created, so
+ * `globalThis.gc` stays undefined and contexts that are created later get no `gc` global.
+ */
+export function getReducingGarbageCollection(): () => void {
+  let gc: unknown = (globalThis as { gc?: unknown }).gc;
+  if (typeof gc !== 'function') {
+    v8.setFlagsFromString('--expose-gc');
+    try {
+      gc = vm.runInNewContext('gc');
+    } finally {
+      v8.setFlagsFromString('--no-expose-gc');
+    }
+  }
+  if (typeof gc !== 'function') {
+    throw new Error('V8 did not provide a garbage collection function.');
+  }
+  const collect: GarbageCollectionFunction = gc as GarbageCollectionFunction;
+  return READS_GARBAGE_COLLECTION_OPTIONS ? () => collect(REDUCING_GARBAGE_COLLECTION) : () => collect();
+}
diff --git a/libraries/rush-daemon/src/RequestScheduler.ts b/libraries/rush-daemon/src/RequestScheduler.ts
index b5fdab30205..748d57dd1b0 100644
--- a/libraries/rush-daemon/src/RequestScheduler.ts
+++ b/libraries/rush-daemon/src/RequestScheduler.ts
@@ -67,10 +67,24 @@ export interface IRequestSchedulerAcquireOptions {
   abortSignal?: AbortSignal;
 
   /**
-   * Called with the request's one-based position whenever the queue changes. If the callback throws,
-   * the scheduler reports the error as a process warning and continues processing the queue.
+   * Called with the request's one-based position whenever the queue changes, and while the request is first in the
+   * queue, when every active lease becomes preemptible (see {@link RequestScheduler.markLeasePreemptible}). If the
+   * callback throws, the scheduler reports the error as a process warning and continues processing the queue.
    */
   onQueuePositionChanged?: (position: number) => void;
+
+  /**
+   * Admit a shared request at once, ahead of the queued requests, if it is compatible with every active request and
+   * one of them was admitted in queue order, so that the queued requests wait for that one anyway. Otherwise the
+   * request waits in queue order like any other.
+   *
+   * @remarks
+   * For a short request that should not wait behind a queued request that itself waits for a long one, such as a
+   * rushx script, which needs its lease only until it starts, behind a reload that waits for a running build. Such
+   * requests cannot keep the queued requests waiting indefinitely: once every active request was admitted ahead of
+   * the queue, later ones wait in it.
+   */
+  admitAheadOfQueue?: boolean;
 }
 
 /**
@@ -93,7 +107,13 @@ interface IQueuedRequest {
 
 interface ILeaseState {
   exclusivityClass: RequestExclusivityClass;
+  /** Whether the lease was admitted ahead of queued requests; see `admitAheadOfQueue`. */
+  readonly aheadOfQueue: boolean;
+  onPreempted: (() => void) | undefined;
+  /** Whether `onPreempted` was called, so that the lease's owner is stopping its work. */
+  preempted: boolean;
   released: boolean;
+  readonly onReleased: (() => void)[];
 }
 
 /**
@@ -101,7 +121,9 @@ interface ILeaseState {
  *
  * Requests of the same shared class may execute concurrently. Different shared classes are serialized because
  * they access different consistency views of the workspace. Exclusive requests execute alone. Once an exclusive
- * request reaches the queue, it gates all requests behind it until it has executed.
+ * request reaches the queue, it gates all requests behind it until it has executed. The one exception is a shared
+ * request that asks to be admitted ahead of the queue (`admitAheadOfQueue`) while a compatible request that was
+ * admitted in queue order is still active.
  *
  * @public
  */
@@ -109,6 +131,9 @@ export class RequestScheduler {
   readonly #queue: IQueuedRequest[] = [];
   #activeClass: RequestExclusivityClass | undefined;
   #activeRequestCount: number = 0;
+  /** How many of the active leases were admitted ahead of queued requests. */
+  #aheadOfQueueCount: number = 0;
+  readonly #activeLeaseStates: Set<ILeaseState> = new Set();
   readonly #leaseStates: WeakMap<IRequestLease, ILeaseState> = new WeakMap();
 
   /**
@@ -128,6 +153,59 @@ export class RequestScheduler {
     this.#drainQueue();
   }
 
+  /**
+   * Lets requests that cannot be admitted alongside an active lease preempt it. `onPreempted` is called once, as
+   * soon as such a request waits for admission; the lease's owner should then stop its work and release the lease.
+   *
+   * @remarks
+   * For a request that no client waits for any more, such as a failed build that returned its result while its
+   * independent operations continue, so that it never delays another request.
+   *
+   * If every active lease is then preemptible (see {@link RequestScheduler.activeLeasesArePreemptible}), a request
+   * that already waits first in the queue now waits only while their owners stop their work. Its position is reported
+   * to it again before `onPreempted` is called, so that its report can say what they stop while they can still tell.
+   * Only the first queued request's report can change then, so the others are not reported again.
+   */
+  public markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void {
+    const state: ILeaseState | undefined = this.#leaseStates.get(lease);
+    if (!state || state.released) {
+      throw new Error('Only an active lease from this scheduler can be marked preemptible.');
+    }
+    state.onPreempted = onPreempted;
+    const head: IQueuedRequest | undefined = this.#queue[0];
+    if (head && this.activeLeasesArePreemptible) {
+      this.#reportQueuePosition(head, 1);
+    }
+    this.#preemptIfContended();
+  }
+
+  /**
+   * Preempts every active lease that was marked preemptible, as a request that cannot be admitted alongside it
+   * would, and resolves once all of them are released. Other leases and queued requests are not affected.
+   *
+   * @remarks
+   * For a request that the daemon does not serve, so that the command which its client then runs in-process does
+   * not run alongside work that nobody waits for.
+   */
+  public preemptLeasesAsync(): Promise<void> {
+    const releases: Promise<void>[] = [];
+    for (const state of Array.from(this.#activeLeaseStates)) {
+      if (state.onPreempted || state.preempted) {
+        releases.push(new Promise((resolve) => state.onReleased.push(resolve)));
+        this.#preempt(state);
+      }
+    }
+    return Promise.all(releases).then(() => undefined);
+  }
+
+  /**
+   * Reports every queued request's position to it again, as when the queue changes, for a caller whose reports say
+   * more than the position, such as what the queue waits for, when that changed.
+   */
+  public notifyQueuePositions(): void {
+    this.#notifyQueuePositions();
+  }
+
   /**
    * The number of requests currently waiting for admission.
    */
@@ -143,7 +221,18 @@ export class RequestScheduler {
   }
 
   /**
-   * Waits until the request is compatible with all active requests and earlier queued requests.
+   * Whether a request holds a lease, and every lease that is held was marked preemptible (see
+   * {@link RequestScheduler.markLeasePreemptible}) or was already preempted. A queued request that cannot be admitted
+   * alongside them then waits only while their owners stop their work.
+   */
+  public get activeLeasesArePreemptible(): boolean {
+    const states: ILeaseState[] = Array.from(this.#activeLeaseStates);
+    return states.length > 0 && states.every((state: ILeaseState) => !!state.onPreempted || state.preempted);
+  }
+
+  /**
+   * Waits until the request is compatible with all active requests and earlier queued requests. With
+   * `admitAheadOfQueue`, compatibility with the active requests can be enough; see that option.
    */
   public acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease> {
     try {
@@ -161,8 +250,13 @@ export class RequestScheduler {
       );
     }
 
-    if (this.#queue.length === 0 && this.#canAdmit(options.exclusivityClass)) {
-      return Promise.resolve(this.#createLease(options.exclusivityClass));
+    if (this.#canAdmit(options.exclusivityClass)) {
+      if (this.#queue.length === 0) {
+        return Promise.resolve(this.#createLease(options.exclusivityClass, false));
+      }
+      if (options.admitAheadOfQueue && this.#activeRequestCount > this.#aheadOfQueueCount) {
+        return Promise.resolve(this.#createLease(options.exclusivityClass, true));
+      }
     }
 
     if (options.noWait) {
@@ -232,11 +326,19 @@ export class RequestScheduler {
     return exclusivityClass !== RequestExclusivityClass.Exclusive && exclusivityClass === this.#activeClass;
   }
 
-  #createLease(exclusivityClass: RequestExclusivityClass): IRequestLease {
+  #createLease(exclusivityClass: RequestExclusivityClass, aheadOfQueue: boolean): IRequestLease {
     this.#activeClass = exclusivityClass;
     this.#activeRequestCount++;
-
-    const state: ILeaseState = { exclusivityClass, released: false };
+    if (aheadOfQueue) this.#aheadOfQueueCount++;
+
+    const state: ILeaseState = {
+      exclusivityClass,
+      aheadOfQueue,
+      onPreempted: undefined,
+      preempted: false,
+      released: false,
+      onReleased: []
+    };
     const lease: IRequestLease = {
       get exclusivityClass(): RequestExclusivityClass {
         return state.exclusivityClass;
@@ -247,14 +349,21 @@ export class RequestScheduler {
         }
 
         state.released = true;
+        state.onPreempted = undefined;
+        this.#activeLeaseStates.delete(state);
         this.#activeRequestCount--;
+        if (state.aheadOfQueue) this.#aheadOfQueueCount--;
         if (this.#activeRequestCount === 0) {
           this.#activeClass = undefined;
         }
         this.#drainQueue();
+        for (const onReleased of state.onReleased.splice(0)) {
+          onReleased();
+        }
       }
     };
     this.#leaseStates.set(lease, state);
+    this.#activeLeaseStates.add(state);
     return lease;
   }
 
@@ -268,13 +377,40 @@ export class RequestScheduler {
 
       this.#queue.shift();
       this.#cleanupQueuedRequest(request);
-      request.resolve(this.#createLease(request.options.exclusivityClass));
+      request.resolve(this.#createLease(request.options.exclusivityClass, false));
       admittedRequest = true;
     }
 
     if (admittedRequest) {
       this.#notifyQueuePositions();
     }
+    this.#preemptIfContended();
+  }
+
+  #preemptIfContended(): void {
+    const head: IQueuedRequest | undefined = this.#queue[0];
+    if (!head || this.#canAdmit(head.options.exclusivityClass)) {
+      return;
+    }
+    for (const state of Array.from(this.#activeLeaseStates)) {
+      this.#preempt(state);
+    }
+  }
+
+  #preempt(state: ILeaseState): void {
+    const onPreempted: (() => void) | undefined = state.onPreempted;
+    if (!onPreempted) {
+      return;
+    }
+    state.onPreempted = undefined;
+    state.preempted = true;
+    try {
+      onPreempted();
+    } catch (error) {
+      process.emitWarning(error instanceof Error ? error : String(error), {
+        code: 'RUSH_DAEMON_LEASE_PREEMPTION_CALLBACK_ERROR'
+      });
+    }
   }
 
   #rejectQueuedRequest(request: IQueuedRequest, error: Error): void {
@@ -303,13 +439,17 @@ export class RequestScheduler {
 
   #notifyQueuePositions(): void {
     for (let index: number = 0; index < this.#queue.length; index++) {
-      try {
-        this.#queue[index].options.onQueuePositionChanged?.(index + 1);
-      } catch (error) {
-        process.emitWarning(error instanceof Error ? error : String(error), {
-          code: 'RUSH_DAEMON_QUEUE_POSITION_CALLBACK_ERROR'
-        });
-      }
+      this.#reportQueuePosition(this.#queue[index], index + 1);
+    }
+  }
+
+  #reportQueuePosition(request: IQueuedRequest, position: number): void {
+    try {
+      request.options.onQueuePositionChanged?.(position);
+    } catch (error) {
+      process.emitWarning(error instanceof Error ? error : String(error), {
+        code: 'RUSH_DAEMON_QUEUE_POSITION_CALLBACK_ERROR'
+      });
     }
   }
 }
diff --git a/libraries/rush-daemon/src/RequestStartedNotice.ts b/libraries/rush-daemon/src/RequestStartedNotice.ts
new file mode 100644
index 00000000000..5bbcce30c45
--- /dev/null
+++ b/libraries/rush-daemon/src/RequestStartedNotice.ts
@@ -0,0 +1,20 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/** A request's client that the daemon can tell that the request left the queue. */
+export interface IRequestStartedClient {
+  writeRequestStartedAsync?(): Promise<void>;
+}
+
+/**
+ * Tells the client that its request left the queue, and waits until the operating system holds the frame, so that
+ * the client learns it before the request can have an effect, even if the daemon exits next. A failed write is left
+ * to the request's later frames, which report it.
+ */
+export async function writeRequestStartedAsync(client: IRequestStartedClient): Promise<void> {
+  try {
+    await client.writeRequestStartedAsync?.();
+  } catch {
+    // The client is gone, or it will see the connection close.
+  }
+}
diff --git a/libraries/rush-daemon/src/RushCommandRequestPolicy.ts b/libraries/rush-daemon/src/RushCommandRequestPolicy.ts
index 44c753ac24e..ef44219d06b 100644
--- a/libraries/rush-daemon/src/RushCommandRequestPolicy.ts
+++ b/libraries/rush-daemon/src/RushCommandRequestPolicy.ts
@@ -51,7 +51,8 @@ export const BUILT_IN_RUSH_COMMAND_CLASSIFICATION: Readonly<Record<string, Reque
  * Classifies a parsed Rush command for workspace admission.
  *
  * @remarks
- * Repository-defined, plugin-defined, and future commands fail closed to `EXCLUSIVE`.
+ * Repository-defined, plugin-defined, and future commands fail closed to `EXCLUSIVE`. A resolver that has
+ * parsed a repository-defined phased command classifies it with `classifyPhasedRushCommand` instead.
  *
  * @beta
  */
@@ -63,3 +64,24 @@ export function classifyRushCommand(options: IRushCommandClassificationOptions):
     ? BUILT_IN_RUSH_COMMAND_CLASSIFICATION[options.commandName]
     : RequestExclusivityClass.Exclusive;
 }
+
+export interface IPhasedRushCommandClassificationOptions extends IRushCommandClassificationOptions {
+  /** False for `rebuild` and for command-line.json phased commands with `"incremental": false`. */
+  readonly isIncremental: boolean;
+}
+
+/**
+ * Classifies a phased command that the daemon parsed natively and serves on its warm graph.
+ *
+ * @remarks
+ * Built-in commands use {@link BUILT_IN_RUSH_COMMAND_CLASSIFICATION}. A phased command from command-line.json
+ * shares build admission when it is incremental, like `build`, and is exclusive otherwise, like `rebuild`.
+ */
+export function classifyPhasedRushCommand(
+  options: IPhasedRushCommandClassificationOptions
+): RequestExclusivityClass {
+  if (options.commandOrigin === 'custom') {
+    return options.isIncremental ? RequestExclusivityClass.SharedBuild : RequestExclusivityClass.Exclusive;
+  }
+  return classifyRushCommand(options);
+}
diff --git a/libraries/rush-daemon/src/RushDaemonCommandLine.ts b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
index 3d4a93892ea..7cad249a5d4 100644
--- a/libraries/rush-daemon/src/RushDaemonCommandLine.ts
+++ b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
@@ -50,13 +50,32 @@ export async function launchRushDaemonAsync(startingFolder: string = process.cwd
     requestResolver: new RushDaemonRequestResolver(new ProductionDaemonRequestResolver()),
     idleTimeoutSeconds: configuration.idleTimeoutSeconds,
     onError: (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`),
+    onLog: (message: string) => process.stderr.write(`${new Date().toISOString()} ${message}\n`),
     onReady: (host) => {
-      process.stdout.write(`rushd ready at ${host.paths.socketPath}\n`);
+      process.stdout.write(
+        `${new Date().toISOString()} rushd ready at ${host.paths.socketPath} (PID ${process.pid})\n`
+      );
     }
   };
   await serveRushDaemonAsync(serveOptions);
 }
 
+/**
+ * An 'error' listener for the process's stdout and stderr that lets `rushd` go on without its output once whatever
+ * read that output has gone.
+ *
+ * @remarks
+ * After `rushd 2>&1 | tee rushd.log`, Ctrl+C stops `tee` as well as `rushd`. The next write, such as the ready line
+ * or the shutdown line, then fails with EPIPE, which Node.js reports as an 'error' event on the stream. Unhandled,
+ * that error would end the process with code 1 before the daemon removed its socket and lockfile. Any other error
+ * is thrown, as it was without a listener.
+ */
+export function ignoreClosedReader(error: NodeJS.ErrnoException): void {
+  if (error.code !== 'EPIPE') {
+    throw error;
+  }
+}
+
 function findRushJsonPath(startingFolder: string): string {
   let currentFolder: string = path.resolve(startingFolder);
   while (true) {
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 17ff4a7bed9..17a85f7f513 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -1,8 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import { realpath } from 'node:fs/promises';
 
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import { DeferredCacheEntryWrites } from '@microsoft/rush-lib/lib/logic/buildCache/DeferredCacheEntryWrites';
+import { LockFile } from '@rushstack/node-core-library';
 import { connectOrStartDaemonAsync, type DaemonClient } from '@rushstack/rush-client-core';
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
@@ -11,19 +15,28 @@ import {
   DaemonFrameListener,
   resolveDaemonPathsFromProcess
 } from '@rushstack/rush-daemon-transport';
-import type { DaemonFrameConnection, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type { DaemonFileChange, DaemonFrameConnection, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
+import { ConnectingClientTracker } from './ConnectingClientTracker';
 import { DaemonControlSession } from './DaemonControlSession';
+import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
+import { DaemonIdleGarbageCollector, type IDaemonIdleGarbageCollection } from './DaemonIdleGarbageCollector';
 import { DaemonIdleTimer } from './DaemonIdleTimer';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
+import { getOrphanReapLogOptions } from './DaemonOrphanReapLog';
 import { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
 import type { IDaemonRequestResolver } from './DaemonRequestDispatcher';
+import { DaemonShutdownDeadline } from './DaemonShutdownDeadline';
+import { DaemonShutdownDeadlineError, type DaemonShutdownStage } from './DaemonShutdownDeadlineError';
 import { DaemonShutdownError, type DaemonShutdownInitiator } from './DaemonShutdownError';
+import { DaemonSocketWatch } from './DaemonSocketWatch';
+import { getReducingGarbageCollection } from './ReducingGarbageCollection';
 import { WorkspaceSession } from './WorkspaceSession';
 import type { IWorkspaceSession, WorkspaceSessionFactory } from './WorkspaceSession';
 import { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 import { getWorkspaceStatus } from './WorkspaceStatus';
 import { WorkspaceRequestLifecycle } from './WorkspaceRequestLifecycle';
+import { isGraphBusy } from './WorkspaceWarmSet';
 import type {
   GetWorkspaceSuccessorLaunchAsync,
   IWorkspaceProcessRestartPlan,
@@ -44,8 +57,41 @@ export interface IRushDaemonHostOptions {
   readonly daemonVersion: string;
   /** Shuts down after this many seconds without pending requests. Disabled when omitted. */
   readonly idleTimeoutSeconds?: number;
-  /** Reports connection-level failures. */
+  /**
+   * After a request, once no request has been pending for this many milliseconds and the operation graph is idle,
+   * runs one full garbage collection that returns the freed heap pages to the operating system, and logs what it
+   * returned through {@link IRushDaemonHostOptions.onLog}. It runs again only after another request. Without it, the
+   * process keeps the resident memory of its busiest recent request until V8 finds it idle by itself, which after
+   * some requests doesn't happen. Disabled when omitted, except that {@link serveRushDaemonAsync} defaults it for a
+   * daemon that owns its process.
+   */
+  readonly idleGarbageCollectionDelayMs?: number;
+  /**
+   * How long {@link RushDaemonHost.closeAsync} waits for shutdown cleanup before it rejects with
+   * {@link DaemonShutdownDeadlineError}, so that an await that ignores cancellation cannot keep the daemon from
+   * exiting. The cleanup goes on in the background. No deadline when omitted, except that
+   * {@link serveRushDaemonAsync} defaults it for a daemon that owns its process.
+   */
+  readonly shutdownDeadlineMs?: number;
+  /** Reports connection-level failures. A client that goes away before its reply is not one (see `onLog`). */
   readonly onError?: (error: Error) => void;
+  /**
+   * Receives messages for the daemon log: one for each rejected request, with the stack when the failure was
+   * unexpected, one for each restart that the clients must finish, one when the daemon's socket was deleted
+   * or replaced, one for each reply that could not reach a client because the client went away, one with the
+   * process ID and the reason when the host begins to shut down, one for each set of process groups that
+   * an exited daemon left running and that startup stopped when it reclaimed the endpoint, and one for each
+   * build cache entry that the `deferCacheWrites` setting writes in the background, fails to write or drops.
+   * Without it, each such set of process groups is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+   */
+  readonly onLog?: (message: string) => void;
+  /**
+   * Reports a folder of this daemon's installation that was removed or replaced after startup. Checked before
+   * each request: after a change, new and queued requests get a typed restart result, and once running requests
+   * finish, the host closes without a successor so that the clients start one. `pong` reports the change.
+   * Not checked when omitted.
+   */
+  readonly checkInstallation?: CheckDaemonInstallation;
   /** Resolves validated wire envelopes into existing typed phased or global requests. */
   readonly requestResolver?: IDaemonRequestResolver;
   /** Receives the request-scoped interactive broker owned by each accepted connection. */
@@ -61,11 +107,20 @@ export interface IRushDaemonHostOptions {
 /**
  * A bound, workspace-keyed Rush daemon host.
  *
+ * @remarks
+ * On POSIX, the host checks every 5 seconds that its socket still has its published name. No client can connect
+ * after the socket file was deleted (for example by a cleaner of the temp folder) or its name was taken by
+ * another file, and none can start another daemon while this one owns the lockfile. After such a change, the host
+ * therefore closes as soon as no request is running, as after an idle timeout, so that the next client starts a
+ * new daemon.
+ *
  * @beta
  */
 export class RushDaemonHost {
   readonly #listener: DaemonFrameListener;
   readonly #idleTimer: DaemonIdleTimer;
+  readonly #idleGarbageCollector: DaemonIdleGarbageCollector | undefined;
+  #socketWatch: DaemonSocketWatch | undefined;
   readonly #sessions: Set<DaemonControlSession>;
   readonly #workspaceSessionProvider: WorkspaceSessionProvider;
   readonly #readWorkspaceStatus: () => IDaemonWorkspaceStatus;
@@ -73,16 +128,25 @@ export class RushDaemonHost {
   readonly #requestDispatcher: DaemonRequestDispatcher;
   public readonly paths: IDaemonPaths;
   #closePromise: Promise<void> | undefined;
+  #closeStage: DaemonShutdownStage = 'requests';
   #notifyClosed: (() => void) | undefined;
+  readonly #shutdownDeadline: DaemonShutdownDeadline;
   readonly #options: IRushDaemonHostOptions;
   readonly #startedAt: string;
-  #restartPromise: Promise<IWorkspaceProcessRestartResult> | undefined;
+  #restartPromise: Promise<IWorkspaceProcessRestartResult | undefined> | undefined;
+  #restartPlan: IWorkspaceProcessRestartPlan | undefined;
   #resolveRestart: ((result: IWorkspaceProcessRestartResult | undefined) => void) | undefined;
   #rejectRestart: ((error: Error) => void) | undefined;
-  /** Settles after an accepted restart reaches a new ready process, or normal shutdown finishes without restarting. */
+  /**
+   * Settles after an accepted restart reaches a new ready process, or normal shutdown finishes without restarting.
+   * Resolves `undefined` when the installation changed, because the clients start the next process.
+   */
   public readonly restartCompleted: Promise<IWorkspaceProcessRestartResult | undefined>;
 
-  /** Resolves after shutdown cleanup finishes. Use closeAsync() to observe cleanup failures. */
+  /**
+   * Resolves after shutdown cleanup finishes, fails, or is cut short by its deadline. Use closeAsync() to observe
+   * cleanup failures.
+   */
   public readonly closed: Promise<void>;
 
   private constructor(
@@ -93,6 +157,7 @@ export class RushDaemonHost {
     requestDispatcher: DaemonRequestDispatcher,
     workspaceSessionProvider: WorkspaceSessionProvider,
     idleTimer: DaemonIdleTimer,
+    idleGarbageCollector: DaemonIdleGarbageCollector | undefined,
     options: IRushDaemonHostOptions,
     startedAt: string,
     readWorkspaceStatus: () => IDaemonWorkspaceStatus
@@ -108,8 +173,19 @@ export class RushDaemonHost {
     this.#workspaceSessionProvider = workspaceSessionProvider;
     this.#readWorkspaceStatus = readWorkspaceStatus;
     this.#idleTimer = idleTimer;
+    this.#idleGarbageCollector = idleGarbageCollector;
     this.#options = options;
     this.#startedAt = startedAt;
+    this.#shutdownDeadline = new DaemonShutdownDeadline({
+      timeoutMs: options.shutdownDeadlineMs,
+      getProgress: () => ({
+        stage: this.#closeStage,
+        unfinishedRequests: Array.from(this.#sessions, (session: DaemonControlSession) =>
+          session.describeActiveRequests()
+        ).flat()
+      }),
+      onLateFailure: (error: Error) => this.#reportError(error)
+    });
     this.restartCompleted = new Promise((resolve, reject) => {
       this.#resolveRestart = resolve;
       this.#rejectRestart = reject;
@@ -120,6 +196,8 @@ export class RushDaemonHost {
   /** Resolves only after the transport is bound and its lockfile has been written. */
   public static async startAsync(options: IRushDaemonHostOptions): Promise<RushDaemonHost> {
     const idleTimer: DaemonIdleTimer = new DaemonIdleTimer(options.idleTimeoutSeconds);
+    // The `deferCacheWrites` setting writes build cache entries after their operations complete.
+    DeferredCacheEntryWrites.instance.setLog(options.onLog);
     const canonicalRepoRoot: string = await realpath(options.repoRoot);
     const workspaceKey: string = computeDaemonWorkspaceKey({
       canonicalRepoRoot,
@@ -137,6 +215,10 @@ export class RushDaemonHost {
         rushVersion: options.rushVersion
       }
     );
+    const idleGarbageCollector: DaemonIdleGarbageCollector | undefined = createIdleGarbageCollector(
+      options,
+      workspaceSessionProvider
+    );
     const startedAtMs: number = Date.now();
     const workspaceSession: IWorkspaceSession = await workspaceSessionProvider.getSessionAsync();
     let requestLifecycle: WorkspaceRequestLifecycle | undefined;
@@ -147,31 +229,38 @@ export class RushDaemonHost {
           resolver: options.requestResolver,
           rushVersion: options.rushVersion,
           getSuccessorLaunchAsync: options.getSuccessorLaunchAsync,
-          onRestartRequested: requestRestart
+          onRestartRequested: requestRestart,
+          checkInstallation: options.checkInstallation,
+          onLog: options.onLog
         });
       }
     } catch (error) {
       await workspaceSessionProvider[Symbol.asyncDispose]();
       throw error;
     }
-    const readWorkspaceStatus = (): IDaemonWorkspaceStatus =>
-      getWorkspaceStatus(workspaceSessionProvider, requestLifecycle?.lastReloadTier ?? 0);
+    const readWorkspaceStatus = (omitWarmSet: boolean = false): IDaemonWorkspaceStatus =>
+      getWorkspaceStatus(workspaceSessionProvider, requestLifecycle?.lastReloadTier ?? 0, omitWarmSet);
     const requestDispatcher: DaemonRequestDispatcher = new DaemonRequestDispatcher(
       workspaceSession,
       options.requestResolver,
       requestLifecycle
     );
+    const connectingClients: ConnectingClientTracker = new ConnectingClientTracker();
     let listener: DaemonFrameListener;
     try {
       listener = await DaemonFrameListener.listenAsync(paths, {
+        ...getOrphanReapLogOptions(options.onLog),
         protocolVersion: DAEMON_PROTOCOL_VERSION,
         startedAt: new Date(startedAtMs).toISOString(),
         onConnection: (connection: DaemonFrameConnection) => {
           const session: DaemonControlSession = new DaemonControlSession(connection, {
+            connectingClients,
             daemonVersion: options.daemonVersion,
             dispatcher: requestDispatcher,
             startedAtMs,
             getWorkspaceStatus: readWorkspaceStatus,
+            checkInstallation: options.checkInstallation,
+            onLog: options.onLog,
             onInteractiveConnection: options.onInteractiveConnection,
             onClosed: (closedSession: DaemonControlSession, error: Error | undefined) => {
               sessions.delete(closedSession);
@@ -180,7 +269,14 @@ export class RushDaemonHost {
               }
             },
             onError: (error: Error) => options.onError?.(error),
-            onRequestStarted: () => idleTimer.acquire(),
+            onRequestStarted: () => {
+              const releaseIdleTimer: () => void = idleTimer.acquire();
+              const releaseIdleGarbageCollector: (() => void) | undefined = idleGarbageCollector?.acquire();
+              return () => {
+                releaseIdleTimer();
+                releaseIdleGarbageCollector?.();
+              };
+            },
             onShutdownRequested: () => requestShutdown('controlClient'),
             getActiveRequestCount: () => {
               let count: number = 0;
@@ -222,6 +318,7 @@ export class RushDaemonHost {
       requestDispatcher,
       workspaceSessionProvider,
       idleTimer,
+      idleGarbageCollector,
       options,
       new Date(startedAtMs).toISOString(),
       readWorkspaceStatus
@@ -231,11 +328,23 @@ export class RushDaemonHost {
     }
     function requestShutdown(initiator: DaemonShutdownInitiator): void {
       void host.closeAsync(new DaemonShutdownError({ initiator })).catch((error: Error) => {
-        if (options.onError) options.onError(error);
-        else process.emitWarning(error);
+        // The host's owner sees a shutdown cut short through closeAsync(), and decides whether to exit.
+        if (!(error instanceof DaemonShutdownDeadlineError)) host.#reportError(error);
       });
     }
-    idleTimer.start(() => requestShutdown('idleTimeout'));
+    let idleInitiator: DaemonShutdownInitiator = 'idleTimeout';
+    idleTimer.start(() => requestShutdown(idleInitiator));
+    host.#socketWatch = new DaemonSocketWatch(
+      () => listener.checkSocket(),
+      (change: DaemonFileChange) => {
+        options.onLog?.(
+          `rushd: the socket ${paths.socketPath} was ${change}, so no client can connect to this daemon; ` +
+            'exiting once running requests finish, so that the next client starts a new daemon'
+        );
+        idleInitiator = 'socketLost';
+        idleTimer.expire();
+      }
+    );
     return host;
   }
 
@@ -257,16 +366,55 @@ export class RushDaemonHost {
   /**
    * Closes active connections, stops listening, and removes transport artifacts.
    *
+   * @remarks
+   * Rejects with {@link DaemonShutdownDeadlineError} when the cleanup does not finish within
+   * {@link IRushDaemonHostOptions.shutdownDeadlineMs}, or when {@link RushDaemonHost.expireShutdownDeadline} is
+   * called first. The listener then keeps its socket and lockfile; see {@link RushDaemonHost.releaseForExit}.
+   *
    * @param reason - Delivered to requests that are still running; only the first close call's reason is used.
    */
   public closeAsync(reason?: DaemonShutdownError): Promise<void> {
-    this.#closePromise ??= this.#closeOnceAsync(reason).finally(() => {
+    this.#closePromise ??= this.#shutdownDeadline.raceAsync(this.#closeOnceAsync(reason)).finally(() => {
       this.#notifyClosed?.();
       if (!this.#restartPromise) this.#resolveRestart?.(undefined);
     });
     return this.#closePromise;
   }
 
+  /**
+   * Cuts the shutdown short, for example on a second termination signal: a running or later
+   * {@link RushDaemonHost.closeAsync} rejects with {@link DaemonShutdownDeadlineError} at once.
+   *
+   * @param forcedBy - What cut the shutdown short, such as "a second SIGTERM", for the error message.
+   */
+  public expireShutdownDeadline(forcedBy: string): void {
+    this.#shutdownDeadline.expire(forcedBy);
+  }
+
+  /**
+   * For a daemon process that exits after its shutdown was cut short: removes the socket, the lockfile and this
+   * process's repository lock (`common/temp/rush#<pid>.lock`), unless the daemon still has child processes. Then
+   * they all stay, as after a crash, so that the next daemon reaps those processes when it reclaims the socket.
+   *
+   * @returns Whether they were removed.
+   */
+  public releaseForExit(): boolean {
+    if (!this.#listener.releaseForExit()) return false;
+    const session: IWorkspaceSession | undefined = this.#workspaceSessionProvider.currentSession;
+    // On Windows the lock is an open handle that the exit releases.
+    if (session && process.platform !== 'win32') {
+      fs.rmSync(LockFile.getLockFilePath(session.rushConfiguration.commonTempFolder, 'rush'), {
+        force: true
+      });
+    }
+    return true;
+  }
+
+  #reportError(error: Error): void {
+    if (this.#options.onError) this.#options.onError(error);
+    else process.emitWarning(error);
+  }
+
   #requestRestart(plan: IWorkspaceProcessRestartPlan): void {
     if (this.#restartPromise || this.#closePromise) return;
     this.#restartPromise = Promise.resolve().then(() => this.#restartOnceAsync(plan));
@@ -275,14 +423,17 @@ export class RushDaemonHost {
       (error: unknown) => {
         const failure: Error = error instanceof Error ? error : new Error(String(error));
         this.#rejectRestart?.(failure);
-        if (this.#options.onError) this.#options.onError(failure);
-        else process.emitWarning(failure);
+        this.#reportError(failure);
       }
     );
   }
 
-  async #restartOnceAsync(plan: IWorkspaceProcessRestartPlan): Promise<IWorkspaceProcessRestartResult> {
+  async #restartOnceAsync(
+    plan: IWorkspaceProcessRestartPlan
+  ): Promise<IWorkspaceProcessRestartResult | undefined> {
+    this.#restartPlan = plan;
     await this.closeAsync(new DaemonShutdownError({ initiator: 'restart' }));
+    if (plan.reason === 'installation-changed') return undefined;
     if (plan.failure) throw plan.failure;
     if (!plan.launch) throw new Error('A successor was not selected.');
     const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
@@ -308,11 +459,15 @@ export class RushDaemonHost {
   }
 
   async #closeOnceAsync(reason: DaemonShutdownError | undefined): Promise<void> {
+    this.#logShutdown(reason);
     this.#idleTimer[Symbol.dispose]();
+    this.#idleGarbageCollector?.[Symbol.dispose]();
+    this.#socketWatch?.[Symbol.dispose]();
     this.#lifecycle.closing = true;
     const errors: unknown[] = [];
     // Refuse new sessions but keep the listener's live ownership until every resource join succeeds.
     // A failed standalone host must not exit naturally and become reclaimable over unjoined children.
+    this.#closeStage = 'requests';
     const sessionSettlements: PromiseSettledResult<void>[] = await Promise.allSettled(
       Array.from(this.#sessions, (session: DaemonControlSession) =>
         session.closeAsync(!!this.#restartPromise, reason ?? new DaemonShutdownError({ initiator: 'host' }))
@@ -323,24 +478,37 @@ export class RushDaemonHost {
         errors.push(settlement.reason);
       }
     }
+    this.#closeStage = 'workspaceMaintenance';
     try {
       const workspace: IWorkspaceSession = await this.#workspaceSessionProvider.getSessionAsync();
       await workspace.quiesceWarmSetAsync?.();
     } catch (error) {
       throw new AggregateError([...errors, error], 'Could not quiesce workspace maintenance for shutdown.');
     }
+    this.#closeStage = 'requestDispatcher';
     try {
       await this.#requestDispatcher[Symbol.asyncDispose]();
     } catch (error) {
       errors.push(error);
     }
+    this.#closeStage = 'workspaceSession';
     try {
       await this.#workspaceSessionProvider[Symbol.asyncDispose]();
     } catch (error) {
       errors.push(error);
     }
+    // No operation runs now, so no build cache entry is queued. The pending ones are dropped: a stopping daemon
+    // must not wait for them, and the entries are only a cache.
+    this.#closeStage = 'cacheWrites';
+    try {
+      await DeferredCacheEntryWrites.instance.abortAsync();
+    } catch (error) {
+      // Only files in the common temp folder are left behind, so the daemon still releases its listener.
+      this.#reportError(error as Error);
+    }
 
     if (errors.length === 0) {
+      this.#closeStage = 'listener';
       try {
         await this.#listener.closeAsync();
       } catch (error) {
@@ -353,4 +521,75 @@ export class RushDaemonHost {
       throw new AggregateError(errors, 'Failed to close Rush daemon host resources.');
     }
   }
+
+  #logShutdown(reason: DaemonShutdownError | undefined): void {
+    const description: string = describeShutdown(reason, this.#restartPlan, this.#options.idleTimeoutSeconds);
+    try {
+      this.#options.onLog?.(`rushd (PID ${process.pid}) shutting down: ${description}`);
+    } catch {
+      // An onLog callback that throws must not keep the daemon from shutting down.
+    }
+  }
+}
+
+function describeShutdown(
+  reason: DaemonShutdownError | undefined,
+  restartPlan: IWorkspaceProcessRestartPlan | undefined,
+  idleTimeoutSeconds: number | undefined
+): string {
+  switch (reason?.initiator) {
+    case 'signal':
+      return `received ${reason?.signal ?? 'a termination signal'}`;
+    case 'controlClient':
+      return 'requested by a client ("rush-client daemon stop" or "daemon restart")';
+    case 'idleTimeout':
+      return idleTimeoutSeconds === undefined ? 'idle timeout' : `idle for ${idleTimeoutSeconds} s`;
+    case 'restart':
+      switch (restartPlan?.reason) {
+        case 'hard-input-change':
+          return `restarting for Rush ${restartPlan.rushVersion}, because a request needs a new process`;
+        case 'native-mutation':
+          return `restarting for Rush ${restartPlan.rushVersion} after "rush install" or "rush update"`;
+        case 'installation-changed':
+          return 'its installation changed, so the next client starts a new daemon';
+        default:
+          return 'restarting';
+      }
+    case 'socketLost':
+      return 'its socket file was deleted or replaced, so the next client starts a new daemon';
+    default:
+      return 'the daemon host was closed';
+  }
+}
+
+const BYTES_PER_MB: number = 1024 * 1024;
+
+function createIdleGarbageCollector(
+  options: IRushDaemonHostOptions,
+  workspaceSessionProvider: WorkspaceSessionProvider
+): DaemonIdleGarbageCollector | undefined {
+  const { idleGarbageCollectionDelayMs: delayMs, onLog } = options;
+  if (delayMs === undefined) return undefined;
+  let collect: (() => void) | undefined;
+  return new DaemonIdleGarbageCollector({
+    delayMs,
+    collect: () => (collect ??= getReducingGarbageCollection())(),
+    isEngineBusy: () => {
+      const graph: IOperationGraph | undefined = workspaceSessionProvider.currentSession?.operationGraph;
+      return graph !== undefined && isGraphBusy(graph);
+    },
+    onCollected: (collection: IDaemonIdleGarbageCollection) =>
+      onLog?.(formatIdleGarbageCollection(collection)),
+    onError: (error: Error) =>
+      onLog?.(`rushd: idle garbage collection failed and is now off: ${error.message}`)
+  });
+}
+
+function formatIdleGarbageCollection(collection: IDaemonIdleGarbageCollection): string {
+  const toMB = (bytes: number): number => Math.round(bytes / BYTES_PER_MB);
+  return (
+    `rushd: idle garbage collection: resident memory ${toMB(collection.residentBytesBefore)} MB -> ` +
+    `${toMB(collection.residentBytesAfter)} MB, heap ${toMB(collection.heapUsedBytesBefore)} MB -> ` +
+    `${toMB(collection.heapUsedBytesAfter)} MB, paused ${Math.round(collection.durationMs)} ms`
+  );
 }
diff --git a/libraries/rush-daemon/src/RushEnvironmentValidation.ts b/libraries/rush-daemon/src/RushEnvironmentValidation.ts
index 73197a1e9f8..c668787b499 100644
--- a/libraries/rush-daemon/src/RushEnvironmentValidation.ts
+++ b/libraries/rush-daemon/src/RushEnvironmentValidation.ts
@@ -35,7 +35,9 @@ const KNOWN_VARIABLES: ReadonlySet<string> = new Set(Object.values(EnvironmentVa
  *
  * @throws An error with the same message as native Rush for the first invalid value.
  */
-export function validateRequestRushEnvironment(environment: Readonly<Record<string, string | undefined>>): void {
+export function validateRequestRushEnvironment(
+  environment: Readonly<Record<string, string | undefined>>
+): void {
   // Native validation resolves the RUSH_DAEMON_* settings first.
   resolveDaemonConfiguration({}, environment);
   const unknown: string[] = [];
@@ -70,4 +72,18 @@ export function validateRequestRushEnvironment(environment: Readonly<Record<stri
         `Only one may be specified.`
     );
   }
-}
\ No newline at end of file
+}
+
+/** The request's Rush environment would prevent a successor from starting; the current daemon is kept. */
+export class InvalidRequestEnvironment extends Error {}
+
+/** Runs {@link validateRequestRushEnvironment}, rethrowing its error as an {@link InvalidRequestEnvironment}. */
+export function assertValidRequestEnvironment(
+  environment: Readonly<Record<string, string | undefined>>
+): void {
+  try {
+    validateRequestRushEnvironment(environment);
+  } catch (error) {
+    throw new InvalidRequestEnvironment(error instanceof Error ? error.message : String(error));
+  }
+}
diff --git a/libraries/rush-daemon/src/RushLibPathHandoff.ts b/libraries/rush-daemon/src/RushLibPathHandoff.ts
new file mode 100644
index 00000000000..14a924e5ac5
--- /dev/null
+++ b/libraries/rush-daemon/src/RushLibPathHandoff.ts
@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+/**
+ * Returns the daemon's own `_RUSH_LIB_PATH` value for the rush-lib at `entryPoint`.
+ *
+ * @remarks
+ * When rush-lib loads, it may spell its entry point through a `node_modules` link, so that plugins can
+ * resolve it by name (for example in a `rush deploy` output). That spelling is kept whenever it names the
+ * same file as `entryPoint`. Anything else, such as a foreign client's engine, is replaced by `entryPoint`.
+ */
+export function getRushLibPathHandoff(entryPoint: string, currentValue: string | undefined): string {
+  if (currentValue === undefined || currentValue === entryPoint) {
+    return entryPoint;
+  }
+  const realEntryPoint: string | undefined = tryGetRealPath(entryPoint);
+  return realEntryPoint !== undefined && tryGetRealPath(currentValue) === realEntryPoint
+    ? currentValue
+    : entryPoint;
+}
+
+function tryGetRealPath(filePath: string): string | undefined {
+  try {
+    return fs.realpathSync.native(filePath);
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts b/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts
index 0d08c2f830a..0ccd334714b 100644
--- a/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts
@@ -12,6 +12,7 @@ import {
   daemonEnvironmentVariables,
   RushConfiguration,
   RushXCommand,
+  workspaceRequestScopedEnvironmentVariables,
   type IRushXCommandLineArguments
 } from '@microsoft/rush-lib';
 import { EnvironmentMap, FileSystem, JsonFile } from '@rushstack/node-core-library';
@@ -40,6 +41,8 @@ export class RushXDaemonRequestResolver implements IDaemonRequestResolver {
   readonly #startupEnvironment: NodeJS.ProcessEnv = { ...process.env };
   readonly #requestLocalRushVariables: ReadonlySet<string> = new Set([
     ...Object.values(daemonEnvironmentVariables),
+    // A daemon host starts without these, so any request that sets one differs from the startup environment.
+    ...workspaceRequestScopedEnvironmentVariables,
     'RUSH_DAEMON_EXPERIMENTAL',
     'RUSH_INVOKED_FOLDER',
     'RUSH_QUIET_MODE'
diff --git a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
index 7b8a6b1d2cf..9a621d480eb 100644
--- a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
+++ b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
@@ -13,6 +13,8 @@ import {
   type IDaemonInstallationMetadata,
   type IInstalledDaemonLauncher
 } from './DaemonInstallation';
+import { getRushLibPathHandoff } from './RushLibPathHandoff';
+import { installWindowsHideDefault } from './WindowsSubprocessConsoles';
 
 async function mainAsync(): Promise<void> {
   const [mode, packageJsonPath, expectedVersion, repoRoot] = process.argv.slice(2);
@@ -29,7 +31,8 @@ async function mainAsync(): Promise<void> {
     throw new Error(`Rush runtime and installed metadata disagree for ${metadata.launcherPath}.`);
   }
   // This is the native Rush SDK handoff, pointing at the actual selected engine, not the caller's engine.
-  process.env._RUSH_LIB_PATH = rushLibEntryPoint;
+  // Loading the selected rush-lib already set it; its spelling is kept if it names that engine.
+  process.env._RUSH_LIB_PATH = getRushLibPathHandoff(rushLibEntryPoint, process.env._RUSH_LIB_PATH);
   const protocol: { DAEMON_PROTOCOL_VERSION?: IDaemonProtocolVersion } = selectedRequire(
     '@rushstack/rush-daemon-protocol'
   );
@@ -95,6 +98,10 @@ async function mainAsync(): Promise<void> {
     configured.daemon,
     process.env
   );
+  if (process.platform === 'win32') {
+    // This process was started detached, without a console; keep its tools from opening console windows.
+    installWindowsHideDefault();
+  }
   await serveRushDaemonAsync({
     repoRoot,
     rushVersion: installation.rushVersion,
@@ -104,8 +111,14 @@ async function mainAsync(): Promise<void> {
     onError: (error) => {
       process.stderr.write(`${error.stack ?? error.message}\n`);
     },
+    onLog: (message) => {
+      process.stderr.write(`${new Date().toISOString()} ${message}\n`);
+    },
     onReady: (host) => {
-      process.stdout.write(`rushd ready at ${host.paths.socketPath} (Rush ${installation.rushVersion})\n`);
+      process.stdout.write(
+        `${new Date().toISOString()} rushd ready at ${host.paths.socketPath} ` +
+          `(Rush ${installation.rushVersion}, PID ${process.pid})\n`
+      );
     }
   });
 }
diff --git a/libraries/rush-daemon/src/SelectedDaemonInstaller.ts b/libraries/rush-daemon/src/SelectedDaemonInstaller.ts
index d479d46c748..2f0717b9fd9 100644
--- a/libraries/rush-daemon/src/SelectedDaemonInstaller.ts
+++ b/libraries/rush-daemon/src/SelectedDaemonInstaller.ts
@@ -42,7 +42,8 @@ async function mainAsync(): Promise<void> {
 
 if (require.main === module) {
   mainAsync().catch((error: Error) => {
-    process.stderr.write(`${error.stack ?? error.message}\n`);
+    // The launcher puts this report in the error it throws.
+    process.stderr.write(`${error.message}\n`);
     process.exitCode = 1;
   });
 }
diff --git a/libraries/rush-daemon/src/StoppedContinuingOperations.ts b/libraries/rush-daemon/src/StoppedContinuingOperations.ts
new file mode 100644
index 00000000000..c08c5e246ce
--- /dev/null
+++ b/libraries/rush-daemon/src/StoppedContinuingOperations.ts
@@ -0,0 +1,34 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
+
+/**
+ * Adds to the rejection of a request whose client then runs the command in-process a line that says that the daemon
+ * first stopped the operations that an earlier failed command left running (see `describeContinuingOperations`).
+ * The line follows the rejection's first line, which the client prints as its fallback line, and precedes the others.
+ */
+export function addStoppedContinuingOperations(
+  rejection: DaemonRequestDispatchError,
+  stopped: IDaemonContinuingOperations
+): DaemonRequestDispatchError {
+  const lines: string[] = rejection.message.split('\n');
+  const firstLineIndex: number = lines.findIndex((line: string) => line.trim() !== '');
+  lines.splice(firstLineIndex + 1, 0, formatStoppedContinuingOperations(stopped));
+  return new DaemonRequestDispatchError(rejection.code, lines.join('\n'), { cause: rejection });
+}
+
+/**
+ * Formats that line, for example "rushd stopped 5 operations left running by an earlier failed command (a, b, c
+ * +2 more), so that this command can run in-process.", where the count says how many are not named.
+ */
+export function formatStoppedContinuingOperations({ count, names }: IDaemonContinuingOperations): string {
+  const more: number = count - names.length;
+  const named: string = names.length > 0 ? ` (${names.join(', ')}${more > 0 ? ` +${more} more` : ''})` : '';
+  return (
+    `rushd stopped ${count} ${count === 1 ? 'operation' : 'operations'} left running by an earlier failed ` +
+    `command${named}, so that this command can run in-process.`
+  );
+}
diff --git a/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts b/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
index f931b842775..080c98e2c0b 100644
--- a/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
+++ b/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
@@ -2,18 +2,26 @@
 // See LICENSE in the project root for license information.
 
 import { spawn, type ChildProcess } from 'node:child_process';
-import { once } from 'node:events';
+import type { BigIntStats } from 'node:fs';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 
-import { _FlagFile } from '@microsoft/rush-lib';
+import { _FlagFile, EnvironmentVariableNames, getWorkspaceHostEnvironment } from '@microsoft/rush-lib';
 import { EnvironmentConfiguration } from '@microsoft/rush-lib/lib/api/EnvironmentConfiguration';
 import {
   DependencySpecifier,
   DependencySpecifierType
 } from '@microsoft/rush-lib/lib/logic/DependencySpecifier';
 import { Utilities } from '@microsoft/rush-lib/lib/utilities/Utilities';
-import { FileSystem, JsonFile, PackageJsonLookup, User } from '@rushstack/node-core-library';
+import {
+  Executable,
+  FileSystem,
+  JsonFile,
+  PackageJsonLookup,
+  SubprocessTerminator,
+  User,
+  type IWaitForExitResult
+} from '@rushstack/node-core-library';
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonStartCommand } from '@rushstack/rush-client-core';
 
@@ -25,6 +33,14 @@ import {
 
 const DAEMON_PACKAGE: string = '@rushstack/rush-daemon';
 
+/** How long a registry answer that leaves no usable launcher for an engine stands before the registry is asked again. */
+const UNAVAILABLE_VERDICT_TTL_MS: number = 24 * 60 * 60 * 1000;
+/** How long a failed or unfinished registry lookup stands, so an unreachable registry costs one deadline per period. */
+const REGISTRY_FAILURE_VERDICT_TTL_MS: number = 60 * 60 * 1000;
+/** npm's --fetch-timeout does not cover the TCP connect: against a black-holed registry, `npm view` took 133 s. */
+const DEFAULT_REGISTRY_TIMEOUT_MS: number = 30 * 1000;
+const VERDICT_SCHEMA_VERSION: number = 1;
+
 export interface IDaemonLauncherContext {
   readonly repoRoot: string;
   readonly rushVersion: string;
@@ -35,16 +51,48 @@ export interface IVersionSelectedDaemonLaunch extends IInstalledDaemonLauncher {
   readonly startCommand: IDaemonStartCommand;
 }
 
+export interface ISelectDaemonLauncherOptions {
+  /** When false, selects only among cached installations and never queries the registry. */
+  readonly allowInstall?: boolean;
+  /** Stops a registry lookup that has not finished after this many milliseconds. */
+  readonly registryTimeoutMs?: number;
+}
+
 export class DaemonLauncherUnavailableError extends Error {
   public readonly installation: IInstalledDaemonLauncher | undefined;
+  /** Why no launcher is available: the message without its fixed prefix and suffix. */
+  public readonly reason: string;
 
   public constructor(rushVersion: string, reason: string, installation?: IInstalledDaemonLauncher) {
     super(`Cannot launch selected Rush ${rushVersion}: ${reason} Use native Rush instead.`);
     this.name = 'DaemonLauncherUnavailableError';
+    this.reason = reason;
     this.installation = installation;
   }
 }
 
+/** A registry lookup that failed or did not finish, as opposed to an answer from the registry. */
+class RegistryLookupError extends DaemonLauncherUnavailableError {}
+
+interface IIncompatibleInstallationRecord {
+  readonly folderName: string;
+  /** Changes whenever the installer writes the installation's last-install marker. */
+  readonly markerIdentity: string;
+  readonly installation: IInstalledDaemonLauncher;
+}
+
+/** Why the last selection for an engine found no usable launcher, and what it saw in the cache. */
+interface IUnavailableVerdict {
+  readonly schemaVersion: number;
+  readonly rushVersion: string;
+  readonly client: string;
+  readonly checkedAt: string;
+  readonly expiresAt: string;
+  readonly reason: string;
+  readonly installation?: IInstalledDaemonLauncher;
+  readonly incompatibleInstallations: ReadonlyArray<IIncompatibleInstallationRecord>;
+}
+
 /** Native-style, node-specific cache, resolved against the captured environment without mutating process.env. */
 export function getDaemonVersionCacheFolder(environment: Readonly<NodeJS.ProcessEnv>): string {
   const globalFolder: string =
@@ -77,13 +125,8 @@ export function getSelectedDaemonStartCommand(
       context.repoRoot
     ],
     cwd: context.repoRoot,
-    environment: Object.freeze(
-      Object.fromEntries(
-        Object.entries(context.environment).filter(
-          (entry): entry is [string, string] => entry[1] !== undefined
-        )
-      )
-    )
+    // The daemon outlives the client that starts it, so it keeps none of that client's request-scoped values.
+    environment: Object.freeze(getWorkspaceHostEnvironment(context.environment))
   };
 }
 
@@ -101,33 +144,43 @@ export async function inspectDaemonLauncherAsync(
     captureExitCodeAndSignal: true
   });
   if (exitCode !== 0 || signal) throw new Error(`Daemon version attestation failed: ${stderr}`);
-  const installation: IInstalledDaemonLauncher = JSON.parse(stdout);
-  if (
-    typeof installation.rushVersion !== 'string' ||
-    typeof installation.daemonVersion !== 'string' ||
-    typeof installation.launcherPath !== 'string' ||
-    typeof installation.rushLibEntryPoint !== 'string' ||
-    !installation.protocolVersion ||
-    !Number.isSafeInteger(installation.protocolVersion.major) ||
-    !Number.isSafeInteger(installation.protocolVersion.minor) ||
-    typeof installation.daemonPackageJsonPath !== 'string' ||
-    typeof installation.canLaunchRequests !== 'boolean'
-  ) {
+  const installation: unknown = JSON.parse(stdout);
+  if (!isInstalledDaemonLauncher(installation)) {
     throw new Error('Daemon version attestation returned an invalid result.');
   }
   return installation;
 }
 
+function isInstalledDaemonLauncher(installation: unknown): installation is IInstalledDaemonLauncher {
+  return (
+    isRecord(installation) &&
+    typeof installation.rushVersion === 'string' &&
+    typeof installation.daemonVersion === 'string' &&
+    typeof installation.launcherPath === 'string' &&
+    typeof installation.rushLibEntryPoint === 'string' &&
+    isRecord(installation.protocolVersion) &&
+    Number.isSafeInteger(installation.protocolVersion.major) &&
+    Number.isSafeInteger(installation.protocolVersion.minor) &&
+    typeof installation.daemonPackageJsonPath === 'string' &&
+    typeof installation.canLaunchRequests === 'boolean'
+  );
+}
+
 /**
  * Reuses a verified available installation or installs a daemon release that pins the exact requested engine.
  * Unlike RushVersionSelector.ensureRushVersionInstalledAsync(), this never executes a Rush command.
  * Registry selection uses the newest release declaring that exact engine dependency, without overrides.
  * Installation runs the native Rush installer in an isolated process and keeps its mutex outside the
  * directory that the installer replaces. Cached-only selection never queries the registry.
+ *
+ * When the registry path finds no usable launcher, the cache folder keeps that verdict: for a day after an answer
+ * from the registry, and for an hour after a lookup that failed or did not finish. While the verdict stands and the
+ * engine's cached installations are the ones it saw, selection fails at once with the same error, without
+ * attesting those installations again or asking the registry. Cached-only selection neither reads nor writes it.
  */
 export async function selectDaemonLauncherAsync(
   input: IDaemonLauncherContext,
-  options: { readonly allowInstall?: boolean } = {}
+  options: ISelectDaemonLauncherOptions = {}
 ): Promise<IVersionSelectedDaemonLaunch> {
   const override: string | undefined = EnvironmentConfiguration._getRushGlobalFolderOverride(
     input.environment
@@ -154,10 +207,18 @@ export async function selectDaemonLauncherAsync(
   const bundledPackage: string | undefined =
     PackageJsonLookup.instance.tryGetPackageJsonFilePathFor(__dirname);
   if (!bundledPackage) throw new Error('Cannot locate the bundled daemon package.');
-  if (readDaemonInstallationMetadata(bundledPackage).rushVersion === context.rushVersion) {
+  const bundled: IDaemonInstallationMetadata = readDaemonInstallationMetadata(bundledPackage);
+  if (bundled.rushVersion === context.rushVersion) {
     return createLaunch(await inspectDaemonLauncherAsync(bundledPackage, context), context);
   }
-  let incompatible: IInstalledDaemonLauncher | undefined;
+  // A verdict holds only for the client that reached it; another client may accept other launchers.
+  const client: string = `${bundled.daemonVersion} protocol ${DAEMON_PROTOCOL_VERSION.major}.${DAEMON_PROTOCOL_VERSION.minor}`;
+  const verdictPath: string = path.join(cacheFolder, `unavailable-${context.rushVersion}.json`);
+  const verdict: IUnavailableVerdict | undefined =
+    options.allowInstall === false
+      ? undefined
+      : await tryReadLiveVerdictAsync(verdictPath, context.rushVersion, client);
+  const incompatible: IIncompatibleInstallationRecord[] = [];
   if (await FileSystem.existsAsync(cacheFolder)) {
     for (const entry of await fs.readdir(cacheFolder, { withFileTypes: true })) {
       if (!entry.isDirectory() || !entry.name.startsWith('daemon-')) continue;
@@ -180,25 +241,69 @@ export async function selectDaemonLauncherAsync(
       if (metadata.daemonVersion !== version)
         throw new Error(`Daemon cache version does not match ${folder}.`);
       if (metadata.rushVersion !== context.rushVersion) continue;
-      const installed: IInstalledDaemonLauncher = await inspectDaemonLauncherAsync(packagePath, context);
+      const markerIdentity: string = await getMarkerIdentityAsync(marker.path);
+      const installed: IInstalledDaemonLauncher =
+        verdict?.incompatibleInstallations.find(
+          (record) => record.folderName === entry.name && record.markerIdentity === markerIdentity
+        )?.installation ?? (await inspectDaemonLauncherAsync(packagePath, context));
       if (supportsClient(installed)) return createLaunch(installed, context);
-      incompatible = installed;
+      incompatible.push({ folderName: entry.name, markerIdentity, installation: installed });
     }
   }
   if (options.allowInstall === false) {
-    if (incompatible) return createLaunch(incompatible, context);
+    if (incompatible.length) return createLaunch(incompatible[incompatible.length - 1].installation, context);
     throw new DaemonLauncherUnavailableError(
       context.rushVersion,
       'No matching installed daemon launcher is available.'
     );
   }
-  const versions: unknown = await npmViewAsync(DAEMON_PACKAGE, 'versions', context);
+  if (verdict && isSameInstallationSet(verdict.incompatibleInstallations, incompatible)) {
+    throw new DaemonLauncherUnavailableError(context.rushVersion, verdict.reason, verdict.installation);
+  }
+  try {
+    return await installFromRegistryAsync(
+      context,
+      cacheFolder,
+      options.registryTimeoutMs ?? DEFAULT_REGISTRY_TIMEOUT_MS
+    );
+  } catch (error) {
+    if (error instanceof DaemonLauncherUnavailableError) {
+      await tryWriteVerdictAsync(verdictPath, {
+        schemaVersion: VERDICT_SCHEMA_VERSION,
+        rushVersion: context.rushVersion,
+        client,
+        ttlMs:
+          error instanceof RegistryLookupError ? REGISTRY_FAILURE_VERDICT_TTL_MS : UNAVAILABLE_VERDICT_TTL_MS,
+        reason: error.reason,
+        installation: error.installation,
+        incompatibleInstallations: await addInstalledRecordAsync(
+          incompatible,
+          error.installation,
+          cacheFolder
+        )
+      });
+    }
+    throw error;
+  }
+}
+
+async function installFromRegistryAsync(
+  context: IDaemonLauncherContext,
+  cacheFolder: string,
+  registryTimeoutMs: number
+): Promise<IVersionSelectedDaemonLaunch> {
+  const versions: unknown = await npmViewAsync(DAEMON_PACKAGE, 'versions', context, registryTimeoutMs);
   const candidates: unknown[] = Array.isArray(versions) ? versions : [versions];
   // npm view returns its versions field in semver order; no second version parser is needed here.
   for (const candidate of candidates.reverse()) {
     if (typeof candidate !== 'string') throw new Error('npm returned an invalid daemon version list.');
     assertExactDaemonVersion(candidate);
-    const metadata: unknown = await npmViewAsync(`${DAEMON_PACKAGE}@${candidate}`, undefined, context);
+    const metadata: unknown = await npmViewAsync(
+      `${DAEMON_PACKAGE}@${candidate}`,
+      undefined,
+      context,
+      registryTimeoutMs
+    );
     if (!isRecord(metadata) || metadata.name !== DAEMON_PACKAGE || metadata.version !== candidate) {
       throw new Error(`npm returned invalid metadata for ${DAEMON_PACKAGE}@${candidate}.`);
     }
@@ -215,12 +320,22 @@ export async function selectDaemonLauncherAsync(
       {
         cwd: context.repoRoot,
         env: { ...context.environment },
-        stdio: ['ignore', 2, 2]
+        // Keep the installer's output off this process's streams; the error below reports why it failed.
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
+    );
+    const { exitCode, signal, stderr }: IWaitForExitResult<string> = await Executable.waitForExitAsync(
+      child,
+      {
+        encoding: 'utf8'
       }
     );
-    const [exitCode, signal] = await once(child, 'close');
     if (exitCode !== 0 || signal) {
-      throw new Error(`Installing ${DAEMON_PACKAGE}@${candidate} failed (${signal ?? exitCode}).`);
+      const report: string = stderr.trim();
+      throw new Error(
+        `Installing ${DAEMON_PACKAGE}@${candidate} failed (${signal ?? exitCode})` +
+          (report ? `: ${report}` : '.')
+      );
     }
     const packagePath: string = path.join(
       cacheFolder,
@@ -241,6 +356,109 @@ export async function selectDaemonLauncherAsync(
   );
 }
 
+async function getMarkerIdentityAsync(markerPath: string): Promise<string> {
+  const stats: BigIntStats = await fs.stat(markerPath, { bigint: true });
+  return `${stats.size}:${stats.mtimeNs}:${stats.ino}`;
+}
+
+function isSameInstallationSet(
+  recorded: ReadonlyArray<IIncompatibleInstallationRecord>,
+  current: ReadonlyArray<IIncompatibleInstallationRecord>
+): boolean {
+  return (
+    recorded.length === current.length &&
+    current.every((installation) =>
+      recorded.some(
+        (record) =>
+          record.folderName === installation.folderName &&
+          record.markerIdentity === installation.markerIdentity
+      )
+    )
+  );
+}
+
+/** Adds the installation that the registry path installed and attested, so the next selection accepts the verdict. */
+async function addInstalledRecordAsync(
+  incompatible: ReadonlyArray<IIncompatibleInstallationRecord>,
+  installation: IInstalledDaemonLauncher | undefined,
+  cacheFolder: string
+): Promise<IIncompatibleInstallationRecord[]> {
+  const records: IIncompatibleInstallationRecord[] = [...incompatible];
+  if (!installation || supportsClient(installation)) return records;
+  const folderName: string = `daemon-${installation.daemonVersion}`;
+  if (records.some((record) => record.folderName === folderName)) return records;
+  const marker: _FlagFile = new _FlagFile(path.join(cacheFolder, folderName), 'last-install', {
+    node: process.versions.node,
+    daemonVersion: installation.daemonVersion
+  });
+  if (await marker.isValidAsync()) {
+    records.push({ folderName, markerIdentity: await getMarkerIdentityAsync(marker.path), installation });
+  }
+  return records;
+}
+
+async function tryReadLiveVerdictAsync(
+  verdictPath: string,
+  rushVersion: string,
+  client: string
+): Promise<IUnavailableVerdict | undefined> {
+  let verdict: unknown;
+  try {
+    verdict = JSON.parse(await fs.readFile(verdictPath, 'utf8'));
+  } catch {
+    return undefined;
+  }
+  if (!isRecord(verdict)) return undefined;
+  const now: number = Date.now();
+  const checkedAt: number = typeof verdict.checkedAt === 'string' ? Date.parse(verdict.checkedAt) : NaN;
+  const expiresAt: number = typeof verdict.expiresAt === 'string' ? Date.parse(verdict.expiresAt) : NaN;
+  if (
+    verdict.schemaVersion !== VERDICT_SCHEMA_VERSION ||
+    verdict.rushVersion !== rushVersion ||
+    verdict.client !== client ||
+    // A clock that moved back since the check cannot say how old the verdict is.
+    !(checkedAt <= now && now < expiresAt) ||
+    typeof verdict.reason !== 'string' ||
+    (verdict.installation !== undefined && !isInstalledDaemonLauncher(verdict.installation)) ||
+    !Array.isArray(verdict.incompatibleInstallations) ||
+    !verdict.incompatibleInstallations.every(
+      (record: unknown) =>
+        isRecord(record) &&
+        typeof record.folderName === 'string' &&
+        typeof record.markerIdentity === 'string' &&
+        isInstalledDaemonLauncher(record.installation) &&
+        // A recorded attestation only ever stands in for a refusal, never for a launch.
+        !supportsClient(record.installation)
+    )
+  ) {
+    return undefined;
+  }
+  return verdict as unknown as IUnavailableVerdict;
+}
+
+async function tryWriteVerdictAsync(
+  verdictPath: string,
+  input: Omit<IUnavailableVerdict, 'checkedAt' | 'expiresAt'> & { readonly ttlMs: number }
+): Promise<void> {
+  const { ttlMs, ...fields } = input;
+  const now: number = Date.now();
+  const verdict: IUnavailableVerdict = {
+    ...fields,
+    checkedAt: new Date(now).toISOString(),
+    expiresAt: new Date(now + ttlMs).toISOString()
+  };
+  // Readers never see a partial file: each writer renames its own complete copy into place.
+  const temporaryPath: string = `${verdictPath}.${process.pid}-${now}.tmp`;
+  try {
+    await fs.mkdir(path.dirname(verdictPath), { recursive: true });
+    await fs.writeFile(temporaryPath, JSON.stringify(verdict, undefined, 2));
+    await fs.rename(temporaryPath, verdictPath);
+  } catch {
+    // The verdict only saves time; without it, the next selection checks again.
+    await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+  }
+}
+
 function supportsClient(installation: IInstalledDaemonLauncher): boolean {
   return (
     installation.protocolVersion.major === DAEMON_PROTOCOL_VERSION.major &&
@@ -274,34 +492,128 @@ function createLaunch(
 async function npmViewAsync(
   specifier: string,
   field: string | undefined,
-  context: IDaemonLauncherContext
+  context: IDaemonLauncherContext,
+  timeoutMs: number
 ): Promise<unknown> {
   const configFolder: string = path.join(context.repoRoot, 'common', 'config', 'rush');
-  const { stdout, stderr, exitCode, signal } = await Utilities.executeCommandAndCaptureOutputAsync({
-    command: 'npm',
-    args: [
-      'view',
-      specifier,
-      ...(field ? [field] : []),
-      '--json',
-      '--fetch-retries=0',
-      '--fetch-timeout=30000',
-      '--no-update-notifier'
-    ],
-    workingDirectory: (await FileSystem.existsAsync(configFolder)) ? configFolder : context.repoRoot,
-    environment: { ...context.environment },
-    keepEnvironment: false,
-    captureExitCodeAndSignal: true
-  });
-  if (exitCode !== 0 || signal) {
-    throw new DaemonLauncherUnavailableError(
+  const currentWorkingDirectory: string = (await FileSystem.existsAsync(configFolder))
+    ? configFolder
+    : context.repoRoot;
+  const environment: NodeJS.ProcessEnv = getRushCommandEnvironment(context.environment);
+  const args: string[] = [
+    'view',
+    specifier,
+    ...(field ? [field] : []),
+    '--json',
+    '--fetch-retries=0',
+    '--fetch-timeout=30000',
+    '--no-update-notifier'
+  ];
+  let timedOut: boolean = false;
+  let result: IWaitForExitResult<string>;
+  try {
+    // No shell: a POSIX shell need not exec its command, and stopping only the shell would leave npm running
+    // with the output pipes open, so the wait would last as long as npm's own connect timeout.
+    const child: ChildProcess = spawnRegistryLookup(args, currentWorkingDirectory, environment);
+    const timer: NodeJS.Timeout = setTimeout(() => {
+      if (child.exitCode !== null || child.signalCode !== null) return;
+      timedOut = true;
+      stopRegistryLookup(child);
+    }, timeoutMs);
+    try {
+      result = await Executable.waitForExitAsync(child, { encoding: 'utf8' });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch (error) {
+    throw new RegistryLookupError(
       context.rushVersion,
-      `Registry lookup for ${specifier} failed: ${stderr}`
+      `Registry lookup for ${specifier} failed: ${(error as Error).message}`
     );
   }
+  if (timedOut) {
+    throw new RegistryLookupError(
+      context.rushVersion,
+      `Registry lookup for ${specifier} did not finish within ${timeoutMs / 1000} s.`
+    );
+  }
+  const { stdout, stderr, exitCode, signal } = result;
+  if (exitCode !== 0 || signal) {
+    throw new RegistryLookupError(context.rushVersion, `Registry lookup for ${specifier} failed: ${stderr}`);
+  }
   return JSON.parse(stdout);
 }
 
+function spawnRegistryLookup(
+  args: string[],
+  currentWorkingDirectory: string,
+  environment: NodeJS.ProcessEnv
+): ChildProcess {
+  if (process.platform === 'win32') {
+    return Executable.spawn('npm', args, {
+      currentWorkingDirectory,
+      environment,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+  }
+  const npmPath: string | undefined = Executable.tryResolve('npm', {
+    currentWorkingDirectory,
+    environment
+  });
+  if (!npmPath) {
+    throw new Error('The executable file was not found: "npm"');
+  }
+  return spawn(npmPath, args, {
+    cwd: currentWorkingDirectory,
+    detached: true,
+    env: environment,
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+}
+
+function stopRegistryLookup(child: ChildProcess): void {
+  child.stdout?.destroy();
+  child.stderr?.destroy();
+  if (process.platform === 'win32') {
+    // There npm is a batch file, so the child is cmd.exe; end npm with it.
+    try {
+      SubprocessTerminator.killProcessTree(child, { detached: false });
+      return;
+    } catch {
+      // Fall back to ending the child alone.
+    }
+  } else {
+    try {
+      SubprocessTerminator.killProcessTree(child, { detached: true });
+      return;
+    } catch {
+      // Fall back to ending the child alone.
+    }
+  }
+  child.kill('SIGKILL');
+}
+
+/** The environment that Utilities gives a Rush command, which is what npm view ran with before it had a deadline. */
+function getRushCommandEnvironment(environment: Readonly<NodeJS.ProcessEnv>): NodeJS.ProcessEnv {
+  const result: NodeJS.ProcessEnv = {};
+  for (const key of Object.getOwnPropertyNames(environment)) {
+    const value: string | undefined = environment[key];
+    if (value === undefined) continue;
+    const normalizedKey: string =
+      process.platform === 'win32' && !/^pnpm_config_\/\//i.test(key) ? key.toUpperCase() : key;
+    if (
+      normalizedKey === 'INIT_CWD' ||
+      /^NPM_CONFIG_/.test(normalizedKey) ||
+      normalizedKey.startsWith('RUSH_DAEMON')
+    ) {
+      continue;
+    }
+    result[normalizedKey] = value;
+  }
+  result[EnvironmentVariableNames._RUSH_RECURSIVE_RUSHX_CALL] = '1';
+  return result;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
diff --git a/libraries/rush-daemon/src/WindowsSubprocessConsoles.ts b/libraries/rush-daemon/src/WindowsSubprocessConsoles.ts
new file mode 100644
index 00000000000..26af264836a
--- /dev/null
+++ b/libraries/rush-daemon/src/WindowsSubprocessConsoles.ts
@@ -0,0 +1,101 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import childProcessModule from 'node:child_process';
+import { syncBuiltinESMExports } from 'node:module';
+import { promisify } from 'node:util';
+
+type ChildProcessFunction = (...args: unknown[]) => unknown;
+type PromisifiableChildProcessFunction = ChildProcessFunction & {
+  [promisify.custom]?: (...args: unknown[]) => unknown;
+};
+
+/**
+ * The index of the options argument of a child_process function, given its arguments.
+ */
+type OptionsIndexSelector = (args: ReadonlyArray<unknown>) => number;
+
+const installedTargets: WeakSet<object> = new WeakSet();
+
+/** `(command, args?, options?, callback?)`: spawn, spawnSync, execFile, execFileSync and fork. */
+function afterOptionalArgs(args: ReadonlyArray<unknown>): number {
+  return Array.isArray(args[1]) || (args[1] === undefined && args.length > 2) || args[1] === null ? 2 : 1;
+}
+
+/** `(command, options?, callback?)`: exec and execSync. */
+function afterCommand(): number {
+  return 1;
+}
+
+const OPTIONS_INDEX_BY_FUNCTION: ReadonlyMap<string, OptionsIndexSelector> = new Map([
+  ['spawn', afterOptionalArgs],
+  ['spawnSync', afterOptionalArgs],
+  ['execFile', afterOptionalArgs],
+  ['execFileSync', afterOptionalArgs],
+  ['fork', afterOptionalArgs],
+  ['exec', afterCommand],
+  ['execSync', afterCommand]
+]);
+
+/**
+ * Returns the arguments with `windowsHide: true` added to the options, unless the caller specified it.
+ */
+export function withWindowsHideDefault(args: ReadonlyArray<unknown>, optionsIndex: number): unknown[] {
+  const result: unknown[] = [...args];
+  const options: unknown = result[optionsIndex];
+  if (options === undefined || options === null) {
+    result[optionsIndex] = { windowsHide: true };
+  } else if (typeof options === 'function') {
+    // A callback occupies the options position, as in `execFile(file, callback)`.
+    result.splice(optionsIndex, 0, { windowsHide: true });
+  } else if (
+    typeof options === 'object' &&
+    (options as { windowsHide?: unknown }).windowsHide === undefined
+  ) {
+    result[optionsIndex] = { ...options, windowsHide: true };
+  }
+  return result;
+}
+
+/**
+ * Makes every child process started by this process default to `windowsHide: true`.
+ *
+ * @remarks
+ * The standalone daemon is started as a detached Windows process, which has no console. Windows then
+ * gives each console program it starts (Git, tar, the shell running an operation, and so on) a new,
+ * visible console window, unless that program is started with `windowsHide`. A hidden child instead
+ * owns a windowless console, which its own descendants inherit, so defaulting this process's direct
+ * children is sufficient. Library and plugin code starts those children, so the default is applied
+ * where they all resolve it: the `node:child_process` module. Explicit `windowsHide` values are kept.
+ *
+ * Only the dedicated daemon process calls this, and only on Windows. It is idempotent.
+ */
+export function installWindowsHideDefault(
+  target: Record<string, unknown> = childProcessModule as unknown as Record<string, unknown>
+): void {
+  if (installedTargets.has(target)) {
+    return;
+  }
+  installedTargets.add(target);
+  for (const [name, getOptionsIndex] of OPTIONS_INDEX_BY_FUNCTION) {
+    const original: PromisifiableChildProcessFunction = target[name] as PromisifiableChildProcessFunction;
+    if (typeof original !== 'function') {
+      continue;
+    }
+    function wrapper(this: unknown, ...args: unknown[]): unknown {
+      return original.apply(this, withWindowsHideDefault(args, getOptionsIndex(args)));
+    }
+    const promisifiableWrapper: PromisifiableChildProcessFunction = wrapper;
+    const promisifyCustom: ((...args: unknown[]) => unknown) | undefined = original[promisify.custom];
+    if (promisifyCustom) {
+      promisifiableWrapper[promisify.custom] = function (this: unknown, ...args: unknown[]): unknown {
+        return promisifyCustom.apply(this, withWindowsHideDefault(args, getOptionsIndex(args)));
+      };
+    }
+    target[name] = promisifiableWrapper;
+  }
+  if (target === (childProcessModule as unknown as Record<string, unknown>)) {
+    // Also update the named exports seen by ECMAScript modules.
+    syncBuiltinESMExports();
+  }
+}
diff --git a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
index 1f2686cacd6..6df1483c204 100644
--- a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
+++ b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
@@ -6,6 +6,7 @@ import * as path from 'node:path';
 import type {
   GetInputsSnapshotAsyncFn,
   IInputsSnapshot,
+  IOperationExecutionResult,
   IOperationGraph,
   Operation,
   RushConfiguration,
@@ -23,6 +24,8 @@ import type {
   WorkspaceInvalidationTracker
 } from './WorkspaceInvalidationTracker';
 
+// Rush's incremental execution guard keeps the base of an operation that is invalidated with this reason, because it
+// compares the operation's inputs itself (INPUTS_CHANGED_INVALIDATION_REASON in rush-lib). Keep the two in sync.
 const INVALIDATION_REASON: 'workspace-inputs-changed' = 'workspace-inputs-changed';
 
 /**
@@ -89,6 +92,15 @@ export type CreateWorkspaceEngineComponentsAsync = (
 export interface IMapWorkspaceInvalidationsOptions {
   readonly changedPaths: ReadonlyArray<string>;
   readonly currentInputsSnapshot: IInputsSnapshot;
+  /**
+   * The records of the executing iteration, if the operations are mapped to add another request's work to it.
+   *
+   * @remarks
+   * The caller may then discard the result, so the mapper must keep any state that a later mapping of the same
+   * changes needs. The iteration may be running some operations, which may be writing their outputs, and may
+   * already have run others.
+   */
+  readonly executingIterationRecords?: ReadonlyMap<Operation, IOperationExecutionResult>;
   readonly nextInputsSnapshot: IInputsSnapshot;
   readonly operationGraph: IOperationGraph;
 }
@@ -140,6 +152,41 @@ export interface IWorkspaceInvalidationReconciliation {
   readonly sequence: number;
 }
 
+/**
+ * Options for reading retained watcher invalidations for an iteration that is executing.
+ *
+ * @beta
+ */
+export interface IPeekWorkspaceInvalidationsOptions {
+  /** The records of the executing iteration, which another request's work would be added to. */
+  readonly executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>;
+}
+
+/**
+ * Retained watcher invalidations that were mapped onto operations without applying them to the graph, so that
+ * another request's work can be added to an executing iteration.
+ *
+ * @remarks
+ * Until the caller commits or discards it, no other reconciliation starts.
+ *
+ * @beta
+ */
+export interface IWorkspaceInvalidationPeek {
+  /** The newer inputs snapshot, which the invalidations were mapped against. */
+  readonly inputsSnapshot: IInputsSnapshot;
+  /** The operations whose inputs or outputs changed since the engine's inputs snapshot. */
+  readonly invalidatedOperations: ReadonlySet<Operation>;
+  /** The reason with which the caller invalidates `invalidatedOperations` in the graph. */
+  readonly invalidationReason: string;
+  /**
+   * Makes `inputsSnapshot` the engine's inputs snapshot and acknowledges the invalidations, once the caller
+   * invalidated `invalidatedOperations` in the graph.
+   */
+  commit(): void;
+  /** Leaves the engine's inputs snapshot and the invalidations unchanged. */
+  discard(): void;
+}
+
 /**
  * Indicates that retained changes require the owning workspace session to be recreated.
  *
@@ -166,7 +213,13 @@ export interface IWorkspaceEngineComponentFactoryOptions {
   readonly isEngineRecreationRequiredAsync?: IsWorkspaceEngineRecreationRequiredAsync;
   readonly mapInvalidationsToOperationsAsync: MapWorkspaceInvalidationsToOperationsAsync;
   readonly shape: IWorkspaceEngineShape;
-  /** Refresh inputs even without a watcher notification (for request-time freshness). */
+  /**
+   * Refresh inputs even without a watcher notification (for request-time freshness).
+   *
+   * @remarks
+   * The inputs snapshot is then taken while the graph inputs are validated. If the validation fails, the
+   * reconciliation waits for the snapshot to finish, and discards it.
+   */
   readonly refreshInputsOnEveryRequest?: boolean;
   /** Authoritative graph-definition validation, awaited on every reconciliation before trusting path hints. */
   readonly validateGraphInputsAsync?: () => Promise<void>;
@@ -233,6 +286,35 @@ class WorkspaceEngineLifecycle {
     return reconciliationPromise;
   }
 
+  /**
+   * Maps the retained invalidations onto operations as a reconciliation would, without invalidating them in the
+   * graph, acknowledging them or replacing the inputs snapshot.
+   *
+   * @remarks
+   * Returns undefined if the changes invalidate every operation. Throws, leaving the invalidations retained, where a
+   * reconciliation would throw. Later reconciliations wait until the returned peek is committed or discarded.
+   */
+  public peekInvalidationsAsync(
+    options: IPeekWorkspaceInvalidationsOptions
+  ): Promise<IWorkspaceInvalidationPeek | undefined> {
+    if (this.#isDisposing) {
+      return Promise.reject(new Error('The workspace engine is being disposed.'));
+    }
+
+    let settle: () => void = noop;
+    const settled: Promise<void> = new Promise<void>((resolve: () => void) => {
+      settle = resolve;
+    });
+    const peekPromise: Promise<IWorkspaceInvalidationPeek | undefined> = this.#reconciliationTail.then(() =>
+      this.#peekOnceAsync(options, settle)
+    );
+    this.#reconciliationTail = peekPromise.then(
+      (peek: IWorkspaceInvalidationPeek | undefined) => (peek ? settled : undefined),
+      () => undefined
+    );
+    return peekPromise;
+  }
+
   public [Symbol.asyncDispose](): Promise<void> {
     this.#isDisposing = true;
     this.#disposePromise ??= this.#disposeOnceAsync();
@@ -240,15 +322,12 @@ class WorkspaceEngineLifecycle {
   }
 
   async #reconcileOnceAsync(): Promise<IWorkspaceInvalidationReconciliation> {
-    await this.#validateGraphInputsAsync?.();
+    // Read before the inputs, so that the inputs snapshot includes each change that this reconciliation acknowledges
     const invalidationSnapshot: IWorkspaceInvalidationSnapshot = this.#invalidations.getSnapshot();
-    if (await this.#requiresEngineRecreationAsync(invalidationSnapshot)) {
-      throw new WorkspaceEngineRecreationRequiredError();
-    }
-    const isFullInvalidation: boolean =
-      this.#requiresFullInvalidation ||
-      invalidationSnapshot.hasUnknownChanges ||
-      !invalidationSnapshot.isWatcherHealthy;
+    const nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined =
+      this.#startInputsSnapshot();
+    await this.#checkInvalidationsAsync(invalidationSnapshot, nextInputsSnapshotPromise);
+    const isFullInvalidation: boolean = this.#isFullInvalidation(invalidationSnapshot);
     if (
       !this.#refreshInputsOnEveryRequest &&
       !isFullInvalidation &&
@@ -262,36 +341,24 @@ class WorkspaceEngineLifecycle {
       };
     }
 
-    const nextInputsSnapshot: IInputsSnapshot | undefined = await this.#components.getInputsSnapshotAsync();
-    if (!nextInputsSnapshot) {
-      throw new Error('Rush could not capture the next workspace inputs snapshot.');
-    }
-
+    const nextInputsSnapshot: IInputsSnapshot =
+      await this.#getNextInputsSnapshotAsync(nextInputsSnapshotPromise);
     const operationGraph: IOperationGraph = this.#components.operationGraph;
     let invalidatedOperationCount: number;
     if (isFullInvalidation) {
       operationGraph.invalidateOperations(undefined, INVALIDATION_REASON);
       invalidatedOperationCount = operationGraph.operations.size;
     } else {
-      const mappedOperations: Iterable<Operation> = await this.#mapInvalidationsToOperationsAsync({
-        changedPaths: invalidationSnapshot.changedPaths,
-        currentInputsSnapshot: this.#currentInputsSnapshot,
+      const invalidatedOperations: ReadonlySet<Operation> = await this.#mapInvalidationsAsync(
+        invalidationSnapshot,
         nextInputsSnapshot,
-        operationGraph
-      });
-      const invalidatedOperations: ReadonlySet<Operation> = validateMappedOperations(
-        mappedOperations,
-        operationGraph
+        undefined
       );
       operationGraph.invalidateOperations(invalidatedOperations, INVALIDATION_REASON);
       invalidatedOperationCount = invalidatedOperations.size;
     }
 
-    this.#currentInputsSnapshot = nextInputsSnapshot;
-    this.#invalidations.acknowledgeThrough(invalidationSnapshot.sequence);
-    this.#requiresFullInvalidation =
-      !this.#refreshInputsOnEveryRequest &&
-      this.#invalidations.getSnapshot().sequence > invalidationSnapshot.sequence;
+    this.#acknowledge(invalidationSnapshot, nextInputsSnapshot);
     return {
       inputsSnapshot: nextInputsSnapshot,
       invalidatedOperationCount,
@@ -300,6 +367,133 @@ class WorkspaceEngineLifecycle {
     };
   }
 
+  async #peekOnceAsync(
+    options: IPeekWorkspaceInvalidationsOptions,
+    settle: () => void
+  ): Promise<IWorkspaceInvalidationPeek | undefined> {
+    const invalidationSnapshot: IWorkspaceInvalidationSnapshot = this.#invalidations.getSnapshot();
+    const nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined =
+      this.#startInputsSnapshot();
+    await this.#checkInvalidationsAsync(invalidationSnapshot, nextInputsSnapshotPromise);
+    if (this.#isFullInvalidation(invalidationSnapshot)) {
+      // Invalidating every operation would also invalidate those that the iteration already ran
+      await nextInputsSnapshotPromise?.then(noop, noop);
+      return undefined;
+    }
+
+    let isSettled: boolean = false;
+    const settleOnce = (): void => {
+      if (isSettled) {
+        throw new Error('The workspace invalidation peek was already committed or discarded.');
+      }
+      isSettled = true;
+      settle();
+    };
+    if (!this.#refreshInputsOnEveryRequest && invalidationSnapshot.changedPaths.length === 0) {
+      return {
+        inputsSnapshot: this.#currentInputsSnapshot,
+        invalidatedOperations: new Set(),
+        invalidationReason: INVALIDATION_REASON,
+        commit: settleOnce,
+        discard: settleOnce
+      };
+    }
+
+    const nextInputsSnapshot: IInputsSnapshot =
+      await this.#getNextInputsSnapshotAsync(nextInputsSnapshotPromise);
+    const invalidatedOperations: ReadonlySet<Operation> = await this.#mapInvalidationsAsync(
+      invalidationSnapshot,
+      nextInputsSnapshot,
+      options.executingIterationRecords
+    );
+    return {
+      inputsSnapshot: nextInputsSnapshot,
+      invalidatedOperations,
+      invalidationReason: INVALIDATION_REASON,
+      commit: () => {
+        settleOnce();
+        this.#acknowledge(invalidationSnapshot, nextInputsSnapshot);
+      },
+      discard: settleOnce
+    };
+  }
+
+  /**
+   * A reconciliation that refreshes the inputs reads them in any case, so it starts reading them before the
+   * checks, which run meanwhile.
+   */
+  #startInputsSnapshot(): Promise<IInputsSnapshot | undefined> | undefined {
+    return this.#refreshInputsOnEveryRequest ? this.#components.getInputsSnapshotAsync() : undefined;
+  }
+
+  /** Validates the graph inputs, and throws if the invalidations require a new engine. */
+  async #checkInvalidationsAsync(
+    invalidationSnapshot: IWorkspaceInvalidationSnapshot,
+    nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined
+  ): Promise<void> {
+    // The snapshot may fail before the checks finish, which must not be reported as an unhandled rejection
+    const nextInputsSnapshotSettledPromise: Promise<void> | undefined = nextInputsSnapshotPromise?.then(
+      noop,
+      noop
+    );
+    try {
+      await this.#validateGraphInputsAsync?.();
+      if (await this.#requiresEngineRecreationAsync(invalidationSnapshot)) {
+        throw new WorkspaceEngineRecreationRequiredError();
+      }
+    } catch (error) {
+      // No command may still read the inputs once the reconciliation failed
+      await nextInputsSnapshotSettledPromise;
+      throw error;
+    }
+  }
+
+  #isFullInvalidation(invalidationSnapshot: IWorkspaceInvalidationSnapshot): boolean {
+    return (
+      this.#requiresFullInvalidation ||
+      invalidationSnapshot.hasUnknownChanges ||
+      !invalidationSnapshot.isWatcherHealthy
+    );
+  }
+
+  async #getNextInputsSnapshotAsync(
+    nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined
+  ): Promise<IInputsSnapshot> {
+    const nextInputsSnapshot: IInputsSnapshot | undefined = await (nextInputsSnapshotPromise ??
+      this.#components.getInputsSnapshotAsync());
+    if (!nextInputsSnapshot) {
+      throw new Error('Rush could not capture the next workspace inputs snapshot.');
+    }
+    return nextInputsSnapshot;
+  }
+
+  async #mapInvalidationsAsync(
+    invalidationSnapshot: IWorkspaceInvalidationSnapshot,
+    nextInputsSnapshot: IInputsSnapshot,
+    executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined
+  ): Promise<ReadonlySet<Operation>> {
+    const operationGraph: IOperationGraph = this.#components.operationGraph;
+    const mappedOperations: Iterable<Operation> = await this.#mapInvalidationsToOperationsAsync({
+      changedPaths: invalidationSnapshot.changedPaths,
+      currentInputsSnapshot: this.#currentInputsSnapshot,
+      ...(executingIterationRecords ? { executingIterationRecords } : {}),
+      nextInputsSnapshot,
+      operationGraph
+    });
+    return validateMappedOperations(mappedOperations, operationGraph);
+  }
+
+  #acknowledge(
+    invalidationSnapshot: IWorkspaceInvalidationSnapshot,
+    nextInputsSnapshot: IInputsSnapshot
+  ): void {
+    this.#currentInputsSnapshot = nextInputsSnapshot;
+    this.#invalidations.acknowledgeThrough(invalidationSnapshot.sequence);
+    this.#requiresFullInvalidation =
+      !this.#refreshInputsOnEveryRequest &&
+      this.#invalidations.getSnapshot().sequence > invalidationSnapshot.sequence;
+  }
+
   async #disposeOnceAsync(): Promise<void> {
     await this.#reconciliationTail;
     await this.#components[Symbol.asyncDispose]();
@@ -409,6 +603,8 @@ export class WorkspaceEngineComponentFactory {
         return lifecycle.inputsSnapshot;
       },
       operationGraph: components.operationGraph,
+      peekInvalidationsAsync: (peekOptions: IPeekWorkspaceInvalidationsOptions) =>
+        lifecycle.peekInvalidationsAsync(peekOptions),
       reconcileInvalidationsAsync: () => lifecycle.reconcileInvalidationsAsync(),
       rushSession: components.rushSession
     };
@@ -521,6 +717,10 @@ function validateComponents(
   }
 }
 
+function noop(): void {
+  // Nothing to do
+}
+
 function validateMappedOperations(
   operations: Iterable<Operation>,
   operationGraph: IOperationGraph
diff --git a/libraries/rush-daemon/src/WorkspaceInputsComparison.ts b/libraries/rush-daemon/src/WorkspaceInputsComparison.ts
new file mode 100644
index 00000000000..c2545d155c7
--- /dev/null
+++ b/libraries/rush-daemon/src/WorkspaceInputsComparison.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import type { IInputsSnapshot, Operation } from '@microsoft/rush-lib';
+
+import {
+  WorkspaceEngineRecreationRequiredError,
+  type IMapWorkspaceInvalidationsOptions
+} from './WorkspaceEngineComponentFactory';
+
+/**
+ * Returns the operations whose own state hashes differ between the current and the next inputs snapshots.
+ */
+export function getOperationsWithChangedInputs(options: IMapWorkspaceInvalidationsOptions): Operation[] {
+  const { currentInputsSnapshot: current, nextInputsSnapshot: next, operationGraph } = options;
+  if (current === next) {
+    // A snapshot computes the same hashes each time
+    return [];
+  }
+
+  return Array.from(operationGraph.operations).filter(
+    (operation) =>
+      current.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name) !==
+      next.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name)
+  );
+}
+
+/**
+ * Returns a function that checks that an inputs snapshot is compatible with the snapshot that an engine was
+ * created from, as {@link assertCompatibleInputs} does. It checks a snapshot only if it differs from the last
+ * compatible one.
+ */
+export function createInputsCompatibilityCheck(
+  initialSnapshot: IInputsSnapshot
+): (snapshot: IInputsSnapshot) => void {
+  let compatibleSnapshot: IInputsSnapshot = initialSnapshot;
+  return (snapshot: IInputsSnapshot): void => {
+    if (snapshot !== compatibleSnapshot) {
+      assertCompatibleInputs(initialSnapshot, snapshot);
+      compatibleSnapshot = snapshot;
+    }
+  };
+}
+
+/**
+ * Throws {@link WorkspaceEngineRecreationRequiredError} if a file that may define the operation graph has
+ * different hashes in the two snapshots.
+ */
+export function assertCompatibleInputs(current: IInputsSnapshot, next: IInputsSnapshot): void {
+  if (current.hashes === next.hashes) {
+    return;
+  }
+
+  const paths: Set<string> = new Set([...current.hashes.keys(), ...next.hashes.keys()]);
+  for (const filePath of paths) {
+    if (isGraphDefinitionPath(filePath) && current.hashes.get(filePath) !== next.hashes.get(filePath)) {
+      throw new WorkspaceEngineRecreationRequiredError();
+    }
+  }
+}
+
+function isGraphDefinitionPath(filePath: string): boolean {
+  const normalized: string = filePath.replace(/\\/g, '/');
+  return (
+    /(^|\/)config\//.test(normalized) ||
+    ['rush.json', 'package.json', '.gitignore', '.npmrc', '.env', 'pnpm-lock.yaml'].includes(
+      path.basename(filePath)
+    )
+  );
+}
diff --git a/libraries/rush-daemon/src/WorkspaceProcessRestart.ts b/libraries/rush-daemon/src/WorkspaceProcessRestart.ts
index 26897d86022..cffa3483539 100644
--- a/libraries/rush-daemon/src/WorkspaceProcessRestart.ts
+++ b/libraries/rush-daemon/src/WorkspaceProcessRestart.ts
@@ -5,12 +5,20 @@ import type { IDaemonStartCommand } from '@rushstack/rush-client-core';
 
 import { selectDaemonLauncherAsync } from './VersionSelectedDaemonLauncher';
 
-/** Inputs for selecting a successor, before the old host gives up ownership. @beta */
+/**
+ * Inputs for selecting a successor, before the old host gives up ownership.
+ *
+ * @remarks
+ * For `installation-changed`, the host selects no successor: its installation was removed or replaced, so it
+ * exits once running requests finish, and each client starts a daemon with its own launcher.
+ *
+ * @beta
+ */
 export interface IWorkspaceProcessRestartContext {
   readonly repoRoot: string;
   readonly rushVersion: string;
   readonly environment: Readonly<Record<string, string>>;
-  readonly reason: 'hard-input-change' | 'native-mutation';
+  readonly reason: 'hard-input-change' | 'native-mutation' | 'installation-changed';
 }
 
 /** An explicitly selected launch command consumed by the existing core startup contract. @beta */
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index a541976266c..1982ed78df4 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -1,12 +1,23 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { validateDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+import {
+  MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS,
+  validateDaemonRequestAdmissionOptions
+} from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonRequestAdmissionErrorCode,
+  DaemonRestartReason,
+  IDaemonContinuingOperations,
+  IDaemonNativeLockHolder,
   IDaemonRequestAdmissionOptions,
   IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
+import {
+  formatDaemonRestartCause,
+  formatNativeLockHolder,
+  type IDaemonRestartWaitDetails
+} from '@rushstack/rush-client-core';
 
 import {
   type IRequestLease,
@@ -18,7 +29,14 @@ import {
 } from './RequestScheduler';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
-import type { IWorkspaceRestartTicket, WorkspaceRestartArbiter } from './WorkspaceRestartArbiter';
+import type {
+  IWorkspaceRestartDrainOptions,
+  IWorkspaceRestartRecheck,
+  IWorkspaceRestartTicket,
+  IWorkspaceRestartWaitReport,
+  IWorkspaceRestartWaitResult,
+  WorkspaceRestartArbiter
+} from './WorkspaceRestartArbiter';
 
 export interface IRequestAdmissionClient {
   readonly abortSignal: AbortSignal;
@@ -32,8 +50,134 @@ export interface IRequestAdmissionControllerOptions {
   readonly requestId: string;
 }
 
+/**
+ * A request's wait for native Rush's repository lock while another Rush process holds it; see
+ * {@link RequestAdmissionController.beginNativeLockWait}.
+ */
+export interface INativeLockWait {
+  /** How long to wait before trying the lock again: 250ms, or less when the wait timeout runs out sooner. */
+  readonly retryDelayMs: number;
+  /**
+   * Records which process holds the lock, after the request failed to take it, and tells the client when that
+   * process changed.
+   *
+   * @returns The error that ends the wait, if the request may not wait any longer.
+   */
+  update(holder: IDaemonNativeLockHolder): RequestSchedulerError | undefined;
+  /**
+   * Ends the wait: spends its time from the request's wait timeout, and waits until the client has been told about
+   * it. Calling it again returns the same promise.
+   */
+  endAsync(): Promise<void>;
+}
+
+/**
+ * A wait of the request that owns a graph transition for the rushx scripts that the daemon runs to exit, before the
+ * daemon restarts; see {@link AdmissionProgress.scriptWait}.
+ */
+export interface IAdmissionScriptWait {
+  /** How many of the scripts still run. */
+  readonly scriptCount: number;
+  /**
+   * Why the daemon then restarts, as the requests that wait behind the owner are told: the owner's own reason, or
+   * for a native `install` or `update`, which runs once the scripts exit, a `nativeMutation` reason.
+   */
+  readonly restartReason: DaemonRestartReason;
+}
+
+/**
+ * The graph transition that a request owns while it waits for the rushx scripts that the daemon runs to exit; see
+ * {@link RequestAdmissionController.waitForServedScriptsAsync}.
+ */
+export interface IScriptWaitTransition {
+  /** The transition's progress, which records the wait for the requests that wait behind the transition. */
+  readonly progress: AdmissionProgress;
+  /** Why the daemon restarts once the scripts exit, as those requests are told. */
+  readonly restartReason: DaemonRestartReason;
+}
+
 const REQUEST_SCHEDULER_BY_SESSION: WeakMap<IWorkspaceSession, RequestScheduler> = new WeakMap();
 
+/** What a remaining admission budget does not show about the request that it came from. */
+interface IAdmissionBudgetHistory {
+  /** The wait timeout that the client asked for. */
+  readonly waitTimeoutMs: number;
+  /** Time spent behind another request's graph load or reload, which did not count against the wait timeout. */
+  readonly pausedMs: number;
+}
+
+/**
+ * The history of each remaining budget that a controller hands to another routing boundary, so that the boundary's
+ * timeout message names the client's timeout and the time that did not count, rather than the remainder alone.
+ */
+const HISTORY_BY_REMAINING_ADMISSION: WeakMap<IDaemonRequestAdmissionOptions, IAdmissionBudgetHistory> =
+  new WeakMap();
+/** A request waits for another request's graph load or reload for up to this many times its wait timeout. */
+const GRAPH_LOAD_WAIT_FACTOR: number = 10;
+// Only the per-invocation flag is offered: Rush versions that do not recognize the environment variable reject it.
+const WAIT_LONGER_HINT: string = 'Use --wait-timeout <seconds> to wait longer.';
+/** Native Rush does not say when it releases the repository's lock, so a request that waits for it tries this often. */
+const NATIVE_LOCK_RETRY_MS: number = 250;
+
+function formatSeconds(ms: number): string {
+  return `${Math.round(ms / 100) / 10}s`;
+}
+
+/**
+ * Whether `found`, what can be found out now about the process that holds native Rush's repository lock, replaces
+ * `known`, the process that the client was told about. A process that cannot be identified, for instance once the one
+ * that was found exits, does not replace it. Nor does the same process without its command: a process's command can
+ * no longer be read once it exits, yet it holds the lock until it is reaped.
+ */
+function replacesNativeLockHolder(known: IDaemonNativeLockHolder, found: IDaemonNativeLockHolder): boolean {
+  if (found.pid === undefined) return known.pid === undefined;
+  return found.pid !== known.pid || found.command !== undefined;
+}
+
+/** Describes time that did not count against a request's wait timeout, unless it rounds to nothing. */
+function formatUncountedTime(pausedMs: number, spentWhile: string): string {
+  const seconds: string = formatSeconds(pausedMs);
+  return seconds === '0s' ? '' : `; ${seconds} spent ${spentWhile} did not count`;
+}
+
+/**
+ * Describes the request that owns a graph transition, to a request that waits behind it while it waits for the rushx
+ * scripts that the daemon runs to exit.
+ */
+function formatScriptWaitAhead(scriptWait: IAdmissionScriptWait): string {
+  const { scriptCount, restartReason } = scriptWait;
+  const cause: string | undefined = formatDaemonRestartCause(restartReason, 'anotherRequest');
+  return (
+    `another request that waits for ${scriptCount} rushx script${scriptCount === 1 ? '' : 's'} that this ` +
+    `daemon runs to exit before it restarts the daemon${cause ? ` ${cause}` : ''}`
+  );
+}
+
+/** Resolves after `delayMs`, or as soon as `abortSignal` aborts. */
+function delayAsync(delayMs: number, abortSignal: AbortSignal): Promise<void> {
+  return new Promise<void>((resolve: () => void) => {
+    const timer: ReturnType<typeof setTimeout> = setTimeout(finish, delayMs);
+    abortSignal.addEventListener('abort', finish, { once: true });
+    if (abortSignal.aborted) finish();
+
+    function finish(): void {
+      clearTimeout(timer);
+      abortSignal.removeEventListener('abort', finish);
+      resolve();
+    }
+  });
+}
+
+/** Returns a frozen copy of admission options that keeps the history of a remaining budget. */
+export function freezeDaemonRequestAdmissionOptions(
+  admission: IDaemonRequestAdmissionOptions
+): IDaemonRequestAdmissionOptions {
+  const copy: IDaemonRequestAdmissionOptions = Object.freeze({ ...admission });
+  const history: IAdmissionBudgetHistory | undefined = HISTORY_BY_REMAINING_ADMISSION.get(admission);
+  if (history) HISTORY_BY_REMAINING_ADMISSION.set(copy, history);
+  return copy;
+}
+
 class WorkspaceRequestScheduler extends RequestScheduler {
   readonly #session: IWorkspaceSession;
 
@@ -55,6 +199,79 @@ class WorkspaceRequestScheduler extends RequestScheduler {
   }
 }
 
+/**
+ * Admits the rushx scripts that a daemon runs, each with a shared lease that it holds until it exits, and tells a
+ * request that waits for all of them to exit (see {@link RequestAdmissionController.waitForServedScriptsAsync}) how
+ * many still run. Its leases can only be released: they cannot be downgraded or marked preemptible.
+ */
+export class ServedScriptScheduler extends RequestScheduler {
+  readonly #listeners: Set<(runningCount: number) => void> = new Set();
+
+  public override async acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease> {
+    const lease: IRequestLease = await super.acquireAsync(options);
+    let released: boolean = false;
+    return {
+      get exclusivityClass(): RequestExclusivityClass {
+        return lease.exclusivityClass;
+      },
+      release: (): void => {
+        if (released) return;
+        released = true;
+        // Counted first: the release can admit the request that waits, which then holds a lease itself.
+        const runningCount: number = this.activeRequestCount - 1;
+        lease.release();
+        if (runningCount > 0) {
+          for (const listener of [...this.#listeners]) listener(runningCount);
+        }
+      }
+    };
+  }
+
+  /**
+   * Calls `listener` with the number of leases that are still held each time one is released while others remain,
+   * until the returned function is called.
+   */
+  public onLeaseReleased(listener: (runningCount: number) => void): () => void {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+}
+
+/**
+ * Lets the rushx scripts that a daemon runs pass a graph transition while it waits for another Rush process, which
+ * may run for any length of time. While the passage is open, a script is admitted at once with a lease of its own,
+ * which it holds until it starts, instead of waiting for the transition. Closing the passage waits until every
+ * script that passed it has started or failed, so that none of them starts on a generation that has been replaced.
+ */
+export class ScriptPassage {
+  readonly #scheduler: RequestScheduler = new RequestScheduler();
+  #opened: AbortController = new AbortController();
+
+  public get isOpen(): boolean {
+    return this.#opened.signal.aborted;
+  }
+
+  /** Aborted when the passage next opens, so that a script that waits for the transition can pass instead. */
+  public get opened(): AbortSignal {
+    return this.#opened.signal;
+  }
+
+  public open(): void {
+    this.#opened.abort();
+  }
+
+  /** Admits a script while the passage is open. */
+  public passAsync(admission: RequestAdmissionController): Promise<IRequestLease> {
+    return admission.acquireAsync(this.#scheduler, RequestExclusivityClass.SharedBuild);
+  }
+
+  /** Closes the passage and waits until every script that passed it has released its lease. */
+  public async closeAsync(): Promise<void> {
+    if (this.isOpen) this.#opened = new AbortController();
+    (await this.#scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive })).release();
+  }
+}
+
 class QueuePositionWriter {
   readonly #abortController: AbortController;
   readonly #requestId: string;
@@ -74,14 +291,77 @@ class QueuePositionWriter {
       writeQueuePositionAsync.call(client, message);
   }
 
-  public enqueue(position: number): void {
+  /**
+   * Reports a wait for native Rush's repository lock, which `holder` holds, at `position`. That is 1 for a request
+   * that waits for the lock itself, and the request's own position for one that waits behind a graph transition
+   * that waits for the lock.
+   */
+  public enqueueNativeLockWait(holder: IDaemonNativeLockHolder, position: number = 1): void {
+    this.#enqueuePayload({ position, requestId: this.#requestId, nativeLockHolder: holder });
+  }
+
+  public enqueue(
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails
+  ): void {
+    const { scriptCount, restartsForAnotherRequest } = restartWait ?? {};
+    this.#enqueuePayload({
+      position,
+      requestId: this.#requestId,
+      ...(restartReason && {
+        restartReason,
+        ...(scriptCount ? { scriptCount } : undefined),
+        ...(restartsForAnotherRequest && { restartsForAnotherRequest })
+      })
+    });
+  }
+
+  /**
+   * Reports a wait for the graph's running iteration, and with `continuingOperations`, that the iteration still runs
+   * only operations that requests which already have their result left running.
+   */
+  public enqueueGraphWait(
+    position: number,
+    continuingOperations: IDaemonContinuingOperations | undefined
+  ): void {
+    this.#enqueuePayload({
+      position,
+      requestId: this.#requestId,
+      ...(continuingOperations && { continuingOperations })
+    });
+  }
+
+  /**
+   * Reports that the request, first in the queue, waits only while the daemon stops `continuingOperations`, which
+   * requests that already have their result left running, since it cannot run alongside them.
+   */
+  public enqueueStoppingWait(continuingOperations: IDaemonContinuingOperations): void {
+    this.#enqueuePayload({
+      position: 1,
+      requestId: this.#requestId,
+      continuingOperations: { ...continuingOperations, stopping: true }
+    });
+  }
+
+  /**
+   * Reports a wait for the rushx scripts that the daemon runs to exit, as a position that counts them. With a
+   * `restartReason`, the daemon then restarts for it. Without one, the request runs once they exit, and then restarts
+   * the daemon, as a native install or update does. A request that waits for no script reports nothing.
+   */
+  public enqueueScriptWait(scriptCount: number, restartReason: DaemonRestartReason | undefined): void {
+    if (scriptCount < 1) return;
+    this.#enqueuePayload({
+      position: scriptCount,
+      requestId: this.#requestId,
+      ...(restartReason && { restartReason }),
+      scriptCount
+    });
+  }
+
+  #enqueuePayload(payload: IDaemonRequestQueuePositionMessage['payload']): void {
     this.#tail = this.#tail
-      .then(() =>
-        this.#writeQueuePositionAsync({
-          kind: 'queuePosition',
-          payload: { position, requestId: this.#requestId }
-        })
-      )
+      .then(() => this.#writeQueuePositionAsync({ kind: 'queuePosition', payload }))
       .catch((error: unknown) => {
         this.#failure ??= error;
         this.#abortController.abort(error);
@@ -96,22 +376,197 @@ class QueuePositionWriter {
   }
 }
 
+/** Reports a request's queue position in a scheduler's queue to its client. */
+type ReportQueuePosition = (writer: QueuePositionWriter, position: number) => void;
+
+const reportQueuePosition: ReportQueuePosition = (writer: QueuePositionWriter, position: number) =>
+  writer.enqueue(position);
+
+/**
+ * Reports a queue position that names what `describe` returns, as operations that the daemon stops for the request,
+ * while the request is first in `scheduler`'s queue and every lease that it waits for is preemptible, so that it
+ * waits only while they stop. They stop as soon as the request waits, and from then on `describe` no longer returns
+ * them, so a position reported again while they stop names what the first one named. Other positions are plain.
+ */
+function reportStoppingContinuingOperations(
+  scheduler: RequestScheduler,
+  describe: () => IDaemonContinuingOperations | undefined
+): ReportQueuePosition {
+  let stopping: IDaemonContinuingOperations | undefined;
+  return (writer: QueuePositionWriter, position: number) => {
+    stopping = position === 1 && scheduler.activeLeasesArePreemptible ? (describe() ?? stopping) : undefined;
+    if (stopping) writer.enqueueStoppingWait(stopping);
+    else writer.enqueue(position);
+  };
+}
+
+/**
+ * Reports whether a request that other requests wait behind is doing work on their behalf, such as loading the
+ * workspace graph that they need, and what it waits for instead: which Rush process, while it waits for native Rush's
+ * repository lock, or how many rushx scripts, while it waits for the scripts that the daemon runs to exit.
+ */
+export class AdmissionProgress {
+  readonly #listeners: Set<() => void> = new Set();
+  readonly #nativeLockHolderListeners: Set<() => void> = new Set();
+  readonly #scriptWaitListeners: Set<() => void> = new Set();
+  #active: boolean = false;
+  #nativeLockHolder: IDaemonNativeLockHolder | undefined;
+  #scriptWait: IAdmissionScriptWait | undefined;
+
+  public get active(): boolean {
+    return this.#active;
+  }
+
+  /**
+   * While the request waits for another Rush process to release native Rush's repository lock, what is known about
+   * that process.
+   */
+  public get nativeLockHolder(): IDaemonNativeLockHolder | undefined {
+    return this.#nativeLockHolder;
+  }
+
+  /**
+   * While the request waits for the rushx scripts that the daemon runs to exit before the daemon restarts, how many
+   * still run, and why the daemon then restarts.
+   */
+  public get scriptWait(): IAdmissionScriptWait | undefined {
+    return this.#scriptWait;
+  }
+
+  public setActive(active: boolean): void {
+    if (this.#active === active) return;
+    this.#active = active;
+    for (const listener of [...this.#listeners]) listener();
+  }
+
+  public setNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): void {
+    if (this.#nativeLockHolder === holder) return;
+    this.#nativeLockHolder = holder;
+    for (const listener of [...this.#nativeLockHolderListeners]) listener();
+  }
+
+  public setScriptWait(scriptWait: IAdmissionScriptWait | undefined): void {
+    if (this.#scriptWait === scriptWait) return;
+    this.#scriptWait = scriptWait;
+    for (const listener of [...this.#scriptWaitListeners]) listener();
+  }
+
+  public subscribe(listener: () => void): () => void {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+
+  /** Calls `listener` whenever `nativeLockHolder` changes, until the returned function is called. */
+  public subscribeToNativeLockHolder(listener: () => void): () => void {
+    this.#nativeLockHolderListeners.add(listener);
+    return () => this.#nativeLockHolderListeners.delete(listener);
+  }
+
+  /** Calls `listener` whenever `scriptWait` changes, until the returned function is called. */
+  public subscribeToScriptWait(listener: () => void): () => void {
+    this.#scriptWaitListeners.add(listener);
+    return () => this.#scriptWaitListeners.delete(listener);
+  }
+}
+
+/**
+ * A wait budget that is spent only while `progress` is inactive.
+ *
+ * @remarks
+ * Waiting while `progress` is active is limited separately, to `maxPausedMs` in total, so that a wedged transition
+ * does not hold the requests behind it indefinitely. `onExhausted` receives whether that limit, rather than the
+ * budget, ran out.
+ */
+class ProgressPausedBudget {
+  readonly #maxPausedMs: number;
+  readonly #onExhausted: (pausedLimitReached: boolean) => void;
+  readonly #progress: AdmissionProgress;
+  readonly #unsubscribe: () => void;
+  #intervalStartMs: number = 0;
+  #paused: boolean = false;
+  #pausedMs: number = 0;
+  #remainingMs: number;
+  #timer: ReturnType<typeof setTimeout> | undefined;
+
+  public constructor(
+    remainingMs: number,
+    maxPausedMs: number,
+    progress: AdmissionProgress,
+    onExhausted: (pausedLimitReached: boolean) => void
+  ) {
+    this.#remainingMs = remainingMs;
+    this.#maxPausedMs = maxPausedMs;
+    this.#progress = progress;
+    this.#onExhausted = onExhausted;
+    this.#unsubscribe = progress.subscribe(() => {
+      this.#endInterval();
+      this.#startInterval();
+    });
+    this.#startInterval();
+  }
+
+  /** The time that was not spent from the budget because `progress` was active. */
+  public get pausedMs(): number {
+    return this.#pausedMs;
+  }
+
+  /** The unspent budget. */
+  public get remainingMs(): number {
+    return this.#remainingMs;
+  }
+
+  /** Stops spending; `pausedMs` and `remainingMs` are final afterwards. Calling it again has no effect. */
+  public stop(): void {
+    this.#unsubscribe();
+    this.#endInterval();
+  }
+
+  #startInterval(): void {
+    this.#paused = this.#progress.active;
+    this.#intervalStartMs = Date.now();
+    const delayMs: number = this.#paused ? this.#maxPausedMs - this.#pausedMs : this.#remainingMs;
+    this.#timer = setTimeout(() => this.#onExhausted(this.#paused), Math.max(0, delayMs));
+  }
+
+  #endInterval(): void {
+    if (this.#timer === undefined) return;
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+    const elapsedMs: number = Date.now() - this.#intervalStartMs;
+    if (this.#paused) {
+      this.#pausedMs += elapsedMs;
+    } else {
+      this.#remainingMs = Math.max(0, this.#remainingMs - elapsedMs);
+    }
+  }
+}
+
 export class RequestAdmissionController {
   readonly #abortController: AbortController = new AbortController();
   readonly #abortFromClient: () => void;
   readonly #admission: IDaemonRequestAdmissionOptions | undefined;
   readonly #client: IRequestAdmissionClient;
-  readonly #deadlineMs: number | undefined;
+  /** The wait timeout that the client asked for; `#admission` holds only the remainder at a later boundary. */
+  readonly #configuredWaitTimeoutMs: number | undefined;
+  /** Time spent behind another request's graph load or reload, which did not count against the wait timeout. */
+  #pausedMs: number;
+  /**
+   * The unspent wait timeout, or undefined when waiting is not limited. Only this controller's waits for other
+   * requests spend it, so the request's own work, such as capturing its inputs, loading or reloading the workspace
+   * graph, routing and execution, does not.
+   */
+  #remainingMs: number | undefined;
   readonly #writer: QueuePositionWriter | undefined;
 
   public constructor(options: IRequestAdmissionControllerOptions) {
     validateDaemonRequestAdmissionOptions(options.admission);
     this.#admission = options.admission;
+    const history: IAdmissionBudgetHistory | undefined =
+      options.admission && HISTORY_BY_REMAINING_ADMISSION.get(options.admission);
+    this.#configuredWaitTimeoutMs = history?.waitTimeoutMs ?? options.admission?.waitTimeoutMs;
+    this.#pausedMs = history?.pausedMs ?? 0;
     this.#client = options.client;
-    this.#deadlineMs =
-      options.admission?.waitTimeoutMs === undefined
-        ? undefined
-        : Date.now() + options.admission.waitTimeoutMs;
+    this.#remainingMs = options.admission?.waitTimeoutMs;
     this.#writer =
       options.client.supportsRequestAdmission === true
         ? new QueuePositionWriter(options.client, options.requestId, this.#abortController)
@@ -124,16 +579,32 @@ export class RequestAdmissionController {
     }
   }
 
-  /** Waits for workspace admission, bounded by the request's absolute admission deadline. */
+  /**
+   * Waits for workspace admission within the request's remaining admission budget. A wait-timeout error says the
+   * request was waiting for `waitingFor`.
+   *
+   * @remarks
+   * Pass `describeStoppingContinuingOperations` for a request that the daemon lets stop the operations which earlier
+   * requests left running after their result (see {@link RequestScheduler.markLeasePreemptible}), instead of waiting
+   * for them to end. While the request is first in the queue, and every lease that it waits for is preemptible, its
+   * queue position then carries what `describeStoppingContinuingOperations` returns, marked as `stopping`, so that
+   * the client can say which operations the daemon stops for it. Other positions are plain.
+   */
   public async acquireAsync(
     scheduler: RequestScheduler,
-    exclusivityClass: RequestExclusivityClass
+    exclusivityClass: RequestExclusivityClass,
+    waitingFor: string = 'workspace admission',
+    describeStoppingContinuingOperations?: () => IDaemonContinuingOperations | undefined
   ): Promise<IRequestLease> {
     return await this.#acquireAsync(
       scheduler,
       exclusivityClass,
-      this.#getRemainingWaitTimeoutMs(),
-      'workspace admission'
+      this.#remainingMs,
+      waitingFor,
+      this.#abortController.signal,
+      describeStoppingContinuingOperations
+        ? reportStoppingContinuingOperations(scheduler, describeStoppingContinuingOperations)
+        : reportQueuePosition
     );
   }
 
@@ -143,38 +614,334 @@ export class RequestAdmissionController {
    * @remarks
    * A shared-build request that reaches this gate is only waiting behind running compatible shared builds, which is
    * progress rather than contention. A client-default timeout therefore does not apply to that wait; an explicit
-   * `noWait` or `waitTimeoutMs` still applies, using the same absolute deadline as workspace admission.
+   * `noWait` or `waitTimeoutMs` still applies, using the request's remaining admission budget.
+   *
+   * Each queue position carries what `describeContinuingOperations` returns when it is reported: the operations that
+   * the running iteration still runs only for requests that already have their result, if the request waits only
+   * for those.
    */
   public async acquireGraphExecutionAsync(
     scheduler: RequestScheduler,
-    exclusivityClass: RequestExclusivityClass
+    exclusivityClass: RequestExclusivityClass,
+    describeContinuingOperations: () => IDaemonContinuingOperations | undefined = () => undefined
   ): Promise<IRequestLease> {
     const waitTimeoutMs: number | undefined =
       exclusivityClass === RequestExclusivityClass.SharedBuild && this.#admission?.waitTimeoutIsDefault
         ? undefined
-        : this.#getRemainingWaitTimeoutMs();
+        : this.#remainingMs;
     return await this.#acquireAsync(
       scheduler,
       exclusivityClass,
       waitTimeoutMs,
-      'the running build of the workspace operation graph'
+      'the running build of the workspace operation graph',
+      this.#abortController.signal,
+      (writer: QueuePositionWriter, position: number) =>
+        writer.enqueueGraphWait(position, describeContinuingOperations())
+    );
+  }
+
+  /**
+   * Waits for `progress` of the running build of the workspace operation graph, as a shared-build request waits for
+   * that build at the per-graph execution gate ({@link RequestAdmissionController.acquireGraphExecutionAsync}): a
+   * client-default timeout does not limit the wait, an explicit `waitTimeoutMs` limits it and spends the request's
+   * remaining admission budget on it, and with `noWait` the request does not wait.
+   *
+   * @returns what `progress` resolves to, or undefined if the request may not wait for it any longer.
+   */
+  public async waitForGraphProgressAsync<T>(progress: Promise<T>): Promise<T | undefined> {
+    if (this.#admission?.noWait === true) {
+      return undefined;
+    }
+    const abortSignal: AbortSignal = this.#abortController.signal;
+    if (abortSignal.aborted) {
+      throw new RequestSchedulerError(
+        RequestSchedulerErrorCode.Aborted,
+        'The request was aborted while waiting for graph progress.'
+      );
+    }
+    let abortListener: (() => void) | undefined;
+    const aborted: Promise<T> = new Promise<T>((resolve, reject) => {
+      void resolve;
+      abortListener = () =>
+        reject(
+          new RequestSchedulerError(
+            RequestSchedulerErrorCode.Aborted,
+            'The request was aborted while waiting for graph progress.'
+          )
+        );
+      abortSignal.addEventListener('abort', abortListener, { once: true });
+    });
+    const waitTimeoutMs: number | undefined = this.#admission?.waitTimeoutIsDefault
+      ? undefined
+      : this.#remainingMs;
+    const startMs: number = Date.now();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      if (waitTimeoutMs === undefined) {
+        return await Promise.race([progress, aborted]);
+      }
+      return await Promise.race<T | undefined>([
+        progress,
+        aborted,
+        new Promise<undefined>((resolve: (value: undefined) => void) => {
+          timer = setTimeout(() => resolve(undefined), waitTimeoutMs);
+        })
+      ]);
+    } finally {
+      clearTimeout(timer);
+      if (abortListener) {
+        abortSignal.removeEventListener('abort', abortListener);
+      }
+      if (waitTimeoutMs !== undefined) {
+        this.#spend(Date.now() - startMs);
+      }
+    }
+  }
+
+  /**
+   * After the restart drain ({@link RequestAdmissionController.waitForRestartDrainAsync}), waits until no other
+   * request holds `scheduler`, so that this request can be answered with a restart result for `restartReason`
+   * without interrupting them.
+   *
+   * @remarks
+   * Once the drain is over, only requests that the drain does not track can still hold `scheduler`, such as
+   * observers that are winding down after their cancellation, so this wait uses the request's remaining admission
+   * budget. Queue positions carry `restartReason`, and a timeout names it, so that the client can say why it waits.
+   */
+  public async acquireBeforeRestartAsync(
+    scheduler: RequestScheduler,
+    restartReason: DaemonRestartReason
+  ): Promise<IRequestLease> {
+    return await this.#acquireAsync(
+      scheduler,
+      RequestExclusivityClass.Exclusive,
+      this.#remainingMs,
+      'the running requests to finish before the daemon restarts ' +
+        (formatDaemonRestartCause(restartReason, 'thisRequest') ?? 'for its environment'),
+      this.#abortController.signal,
+      (writer: QueuePositionWriter, position: number) => writer.enqueue(position, restartReason)
+    );
+  }
+
+  /**
+   * Waits until none of the rushx scripts that `scripts` admits still runs, for a request that holds the workspace's
+   * exclusive gate, so that no script can start meanwhile. What comes next would end them with this process: the
+   * daemon restarts for `restartReason`, or without one, the request runs and then restarts the daemon, as a native
+   * install or update does.
+   *
+   * @remarks
+   * Queue positions count the scripts that still run (`scriptCount`), and carry `restartReason`, so that the client
+   * can say what the request waits for, and why. The request's remaining admission budget applies, since a script
+   * may not exit until it is stopped, and a timeout names what the request waited for.
+   *
+   * With `transition`, the graph transition that the request owns, the wait is also recorded in its progress until
+   * the wait ends, with the reason that `transition` gives, so that the requests that wait behind the transition can
+   * say what they wait for; see {@link RequestAdmissionController.acquireBehindTransitionAsync}.
+   */
+  public async waitForServedScriptsAsync(
+    scripts: ServedScriptScheduler,
+    restartReason: DaemonRestartReason | undefined,
+    transition?: IScriptWaitTransition
+  ): Promise<void> {
+    const cause: string | undefined = restartReason && formatDaemonRestartCause(restartReason, 'thisRequest');
+    const publish = (scriptCount: number): void =>
+      transition?.progress.setScriptWait({ scriptCount, restartReason: transition.restartReason });
+    const unsubscribe: () => void = scripts.onLeaseReleased((runningCount: number) => {
+      this.#writer?.enqueueScriptWait(runningCount, restartReason);
+      publish(runningCount);
+    });
+    try {
+      if (scripts.activeRequestCount > 0) publish(scripts.activeRequestCount);
+      const lease: IRequestLease = await this.#acquireAsync(
+        scripts,
+        RequestExclusivityClass.Exclusive,
+        this.#remainingMs,
+        `a rushx script that this daemon runs to exit${cause ? `, before the daemon restarts ${cause}` : ''}`,
+        this.#abortController.signal,
+        // Until it is admitted, the request does not hold a lease itself.
+        (writer: QueuePositionWriter) => writer.enqueueScriptWait(scripts.activeRequestCount, restartReason)
+      );
+      lease.release();
+    } finally {
+      unsubscribe();
+      transition?.progress.setScriptWait(undefined);
+    }
+  }
+
+  /**
+   * Waits for shared-build workspace admission while another request loads or reloads the workspace graph.
+   *
+   * @remarks
+   * While `transition` reports progress, the other request holds the exclusive gate and is loading the graph that
+   * this request needs, so the request's wait timeout is not spent: at a cold start every concurrent build waits for
+   * the first build's graph load, whether its timeout is the client default or explicit. That wait is limited
+   * separately, to `GRAPH_LOAD_WAIT_FACTOR` times the wait timeout, so a wedged load does not hold its followers
+   * indefinitely. The timeout is still spent while the transition itself waits for another request, so a transition
+   * that cannot start does not hold its followers either. Unspent time carries over to later waits of this request.
+   * `noWait` still fails at once.
+   *
+   * With `admitAheadOfQueue`, a request that the transition's owner waits for anyway, such as a running build, lets
+   * this request be admitted at once, ahead of the owner and of the requests that wait behind it; see
+   * `IRequestSchedulerAcquireOptions.admitAheadOfQueue`. The lifecycle sets it for a rushx script while the owner of
+   * a reload has yet to replace the current generation, which the script needs only to start.
+   *
+   * While the transition waits for another Rush process to release native Rush's repository lock, as
+   * `transition.nativeLockHolder` says, this request waits for that process too: its queue positions name the
+   * process, as the transition's own do, and so does its timeout.
+   *
+   * While the transition's owner waits for the rushx scripts that the daemon runs to exit before the daemon restarts,
+   * as `transition.scriptWait` says, this request's queue positions count those scripts and the owner ahead of it,
+   * with the reason for the restart and `restartsForAnotherRequest`, and its timeout names that wait.
+   */
+  public acquireBehindTransitionAsync(
+    scheduler: RequestScheduler,
+    transition: AdmissionProgress,
+    admitAheadOfQueue?: boolean
+  ): Promise<IRequestLease>;
+  /**
+   * Waits as the other overload does, but only until `stopWaiting` is aborted, and then returns undefined. The time
+   * that the request waited is spent as it would be if it had been admitted then.
+   */
+  public acquireBehindTransitionAsync(
+    scheduler: RequestScheduler,
+    transition: AdmissionProgress,
+    admitAheadOfQueue: boolean,
+    stopWaiting: AbortSignal
+  ): Promise<IRequestLease | undefined>;
+  public async acquireBehindTransitionAsync(
+    scheduler: RequestScheduler,
+    transition: AdmissionProgress,
+    admitAheadOfQueue: boolean = false,
+    stopWaiting?: AbortSignal
+  ): Promise<IRequestLease | undefined> {
+    const waitingFor: string = "another request's load or reload of the workspace graph";
+    const remainingMs: number | undefined = this.#remainingMs;
+    const waitTimeoutMs: number | undefined = this.#configuredWaitTimeoutMs;
+    const abortSignals: AbortSignal[] = stopWaiting
+      ? [this.#abortController.signal, stopWaiting]
+      : [this.#abortController.signal];
+    const stoppedWaiting = (): boolean => !!stopWaiting?.aborted && !this.#abortController.signal.aborted;
+    const writer: QueuePositionWriter | undefined = this.#writer;
+    let lastPosition: number | undefined;
+    const reportPosition: ReportQueuePosition = (target: QueuePositionWriter, position: number) => {
+      lastPosition = position;
+      // The owner waits for one of these at a time: for scripts before a restart or a native mutation, and for the
+      // lock while it reloads. If both were published, positions and a timeout would name the wait for scripts.
+      const scriptWait: IAdmissionScriptWait | undefined = transition.scriptWait;
+      const holder: IDaemonNativeLockHolder | undefined = transition.nativeLockHolder;
+      if (scriptWait) {
+        const { scriptCount, restartReason } = scriptWait;
+        target.enqueue(scriptCount + position, restartReason, {
+          scriptCount,
+          restartsForAnotherRequest: true
+        });
+      } else if (holder) target.enqueueNativeLockWait(holder, position);
+      else target.enqueue(position);
+    };
+    // The owner publishes a holder or a script wait only while it holds the gate exclusively, so no request is
+    // admitted meanwhile.
+    const reportAgain = (): void => {
+      // A script that stopped waiting, to pass the transition instead, has no position to report again.
+      if (writer && lastPosition !== undefined && !stopWaiting?.aborted) reportPosition(writer, lastPosition);
+    };
+    const unsubscribeFromHolder: () => void = transition.subscribeToNativeLockHolder(reportAgain);
+    const unsubscribeFromScriptWait: () => void = transition.subscribeToScriptWait(reportAgain);
+    const unsubscribe = (): void => {
+      unsubscribeFromHolder();
+      unsubscribeFromScriptWait();
+    };
+    if (remainingMs === undefined || waitTimeoutMs === undefined) {
+      try {
+        return await this.#acquireAsync(
+          scheduler,
+          RequestExclusivityClass.SharedBuild,
+          remainingMs,
+          waitingFor,
+          AbortSignal.any(abortSignals),
+          reportPosition,
+          admitAheadOfQueue
+        );
+      } catch (error) {
+        if (stoppedWaiting()) return undefined;
+        throw error;
+      } finally {
+        unsubscribe();
+      }
+    }
+    const exhausted: AbortController = new AbortController();
+    let pausedLimitReached: boolean = false;
+    let nativeLockHolder: IDaemonNativeLockHolder | undefined;
+    let scriptWait: IAdmissionScriptWait | undefined;
+    const budget: ProgressPausedBudget = new ProgressPausedBudget(
+      remainingMs,
+      Math.min(GRAPH_LOAD_WAIT_FACTOR * waitTimeoutMs, MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS),
+      transition,
+      (reachedPausedLimit: boolean) => {
+        if (!exhausted.signal.aborted) {
+          pausedLimitReached = reachedPausedLimit;
+          nativeLockHolder = transition.nativeLockHolder;
+          scriptWait = transition.scriptWait;
+          exhausted.abort();
+        }
+      }
     );
+    try {
+      return await this.#acquireAsync(
+        scheduler,
+        RequestExclusivityClass.SharedBuild,
+        undefined,
+        waitingFor,
+        AbortSignal.any([...abortSignals, exhausted.signal]),
+        reportPosition,
+        admitAheadOfQueue
+      );
+    } catch (error) {
+      budget.stop();
+      if (stoppedWaiting() && !exhausted.signal.aborted) return undefined;
+      if (!exhausted.signal.aborted || this.#abortController.signal.aborted) throw error;
+      const lockWait: string = nativeLockHolder
+        ? `, which waits for ${formatNativeLockHolder(nativeLockHolder)} to release this repository's lock`
+        : '';
+      const waitedFor: string = scriptWait ? formatScriptWaitAhead(scriptWait) : `${waitingFor}${lockWait}`;
+      // A zero timeout has no paused allowance, so it fails at once without reaching a limit worth naming.
+      const message: string =
+        pausedLimitReached && waitTimeoutMs > 0
+          ? `The request was not admitted within ${GRAPH_LOAD_WAIT_FACTOR} times its ${waitTimeoutMs}ms wait ` +
+            `timeout because ${waitingFor} was still running after ${formatSeconds(budget.pausedMs)}.`
+          : `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ` +
+            `${waitedFor}` +
+            `${formatUncountedTime(this.#pausedMs + budget.pausedMs, 'while that request loaded the graph')}.`;
+      throw new RequestSchedulerError(
+        RequestSchedulerErrorCode.WaitTimeout,
+        `${message} ${WAIT_LONGER_HINT}`
+      );
+    } finally {
+      unsubscribe();
+      budget.stop();
+      this.#pausedMs += budget.pausedMs;
+      this.#remainingMs = budget.remainingMs;
+    }
   }
 
   async #acquireAsync(
     scheduler: RequestScheduler,
     exclusivityClass: RequestExclusivityClass,
     waitTimeoutMs: number | undefined,
-    waitingFor: string
+    waitingFor: string,
+    abortSignal: AbortSignal = this.#abortController.signal,
+    reportPosition: ReportQueuePosition = reportQueuePosition,
+    admitAheadOfQueue: boolean = false
   ): Promise<IRequestLease> {
     const writer: QueuePositionWriter | undefined = this.#writer;
+    const startMs: number = Date.now();
     let lease: IRequestLease | undefined;
     try {
       lease = await scheduler.acquireAsync({
-        abortSignal: this.#abortController.signal,
+        abortSignal,
+        admitAheadOfQueue,
         exclusivityClass,
         noWait: this.#admission?.noWait,
-        onQueuePositionChanged: writer ? (position: number) => writer.enqueue(position) : undefined,
+        onQueuePositionChanged: writer ? (position: number) => reportPosition(writer, position) : undefined,
         waitTimeoutMs
       });
       await writer?.flushAsync();
@@ -189,20 +956,93 @@ export class RequestAdmissionController {
       lease?.release();
       await writer?.flushAsync();
       throw this.#getReportedError(error, waitingFor);
+    } finally {
+      // A wait that the timeout does not limit does not spend it either; see `acquireGraphExecutionAsync`.
+      if (waitTimeoutMs !== undefined) this.#spend(Date.now() - startMs);
     }
   }
 
-  /** Waits, within the same admission budget, until a restart would not preempt another request. */
+  /**
+   * Waits until a restart would not preempt another request. The client is told how many requests it waits for,
+   * as a queue position, since a restart waits as long as their builds.
+   *
+   * @remarks
+   * Like the per-graph execution gate, waiting for the requests that this process was already serving when the wait
+   * began is progress rather than contention. A client-default timeout therefore does not apply while one of them is
+   * still being served and no rushx script is, and that time does not count against it. The default still limits
+   * the wait while a rushx script is served, since a script may not exit until it is stopped, and waiting for
+   * requests that arrived later, which could otherwise keep the request waiting for as long as they keep arriving.
+   * An explicit `noWait` or `waitTimeoutMs` applies to the whole wait, using the same budget as workspace admission.
+   *
+   * A `restartReason` says why the request needs the restart. Queue positions carry it, as do those of rushx scripts
+   * that wait for the restart, and admission errors name it. Without it, they say that the daemon restarts for the
+   * request's environment. Queue positions also say how many of the requests that they count run a rushx script.
+   *
+   * @returns true once the drain finishes, or false if `recheck` found that the request no longer needs the restart.
+   */
   public async waitForRestartDrainAsync(
+    arbiter: WorkspaceRestartArbiter,
+    ticket: IWorkspaceRestartTicket,
+    restartReason?: DaemonRestartReason,
+    recheck?: IWorkspaceRestartRecheck
+  ): Promise<boolean> {
+    const result: IWorkspaceRestartWaitResult = await this.#waitForRestartArbiterAsync(
+      (options: IWorkspaceRestartDrainOptions) => arbiter.waitForDrainAsync(ticket, options, recheck),
+      restartReason
+    );
+    return !result.restartWithdrawn;
+  }
+
+  /**
+   * Waits, for a rushx script, until no other request needs to restart the daemon, so that the restart does not also
+   * wait for the script. The client is told how many requests are served or need a restart, as a queue position,
+   * and why the first request that needs a restart needs it.
+   *
+   * @remarks
+   * The wait timeout applies as it does to the restart drain, relative to the requests served when this wait began:
+   * a client-default timeout is not spent while one of them is still being served and no rushx script is.
+   */
+  public async waitForPendingRestartAsync(
     arbiter: WorkspaceRestartArbiter,
     ticket: IWorkspaceRestartTicket
   ): Promise<void> {
-    // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
-    await arbiter.waitForDrainAsync(ticket, {
-      abortSignal: this.#abortController.signal,
-      noWait: this.#admission?.noWait,
-      waitTimeoutMs: this.#getRemainingWaitTimeoutMs()
-    });
+    await this.#waitForRestartArbiterAsync(
+      (options: IWorkspaceRestartDrainOptions) => arbiter.waitForPendingRestartAsync(ticket, options),
+      undefined,
+      true
+    );
+  }
+
+  async #waitForRestartArbiterAsync(
+    waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<IWorkspaceRestartWaitResult>,
+    restartReason?: DaemonRestartReason,
+    restartsForAnotherRequest?: boolean
+  ): Promise<IWorkspaceRestartWaitResult> {
+    const writer: QueuePositionWriter | undefined = this.#writer;
+    const startMs: number = Date.now();
+    let waivedMs: number = 0;
+    try {
+      // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
+      const result: IWorkspaceRestartWaitResult = await waitAsync({
+        abortSignal: this.#abortController.signal,
+        noWait: this.#admission?.noWait,
+        waitTimeoutMs: this.#remainingMs,
+        waivesTimeoutForServedWork: this.#admission?.waitTimeoutIsDefault === true,
+        restartReason,
+        onServingCountChanged: writer
+          ? (count: number, report: IWorkspaceRestartWaitReport) =>
+              writer.enqueue(count, report.restartReason, {
+                scriptCount: report.scriptCount,
+                restartsForAnotherRequest
+              })
+          : undefined
+      });
+      waivedMs = result.waivedMs;
+      return result;
+    } finally {
+      await writer?.flushAsync();
+      this.#spend(Date.now() - startMs - waivedMs);
+    }
   }
 
   public dispose(): void {
@@ -211,17 +1051,155 @@ export class RequestAdmissionController {
 
   /** Passes the remaining admission budget to another existing routing boundary. */
   public get remainingAdmission(): IDaemonRequestAdmissionOptions | undefined {
-    return this.#admission
-      ? { ...this.#admission, waitTimeoutMs: this.#getRemainingWaitTimeoutMs() }
-      : undefined;
+    if (!this.#admission) return undefined;
+    const remaining: IDaemonRequestAdmissionOptions = {
+      ...this.#admission,
+      waitTimeoutMs: this.#remainingMs
+    };
+    if (this.#configuredWaitTimeoutMs !== undefined) {
+      HISTORY_BY_REMAINING_ADMISSION.set(remaining, {
+        waitTimeoutMs: this.#configuredWaitTimeoutMs,
+        pausedMs: this.#pausedMs
+      });
+    }
+    return remaining;
+  }
+
+  /**
+   * Begins a wait for native Rush's repository lock while another Rush process holds it. The request waits as it
+   * does for another request, within its remaining admission budget: `noWait` and a zero timeout fail at once, and
+   * otherwise the client is told which process the request waits for, as the first queue position, each time that
+   * process changes. A client-default timeout applies, since the other process can run for any length of time.
+   *
+   * @remarks
+   * {@link RequestAdmissionController.acquireNativeLockAsync} waits for the lock with it. A caller that waits once for
+   * several requests uses it directly: it tries the lock again, and then calls `update` for each request, which says
+   * when the request may not wait any longer, and finally `endAsync`.
+   *
+   * With `transition`, the progress of a graph transition that the request owns, the process is also recorded there
+   * until the wait ends, so that the requests that wait behind the transition can name it too; see
+   * {@link RequestAdmissionController.acquireBehindTransitionAsync}.
+   */
+  public beginNativeLockWait(transition?: AdmissionProgress): INativeLockWait {
+    const writer: QueuePositionWriter | undefined = this.#writer;
+    const startMs: number = Date.now();
+    const budgetMs: number | undefined = this.#remainingMs;
+    let holder: IDaemonNativeLockHolder = {};
+    let reportedHolder: string | undefined;
+    let ended: Promise<void> | undefined;
+    return {
+      get retryDelayMs(): number {
+        return budgetMs === undefined
+          ? NATIVE_LOCK_RETRY_MS
+          : Math.min(NATIVE_LOCK_RETRY_MS, Math.max(0, budgetMs - (Date.now() - startMs)));
+      },
+      update: (foundHolder: IDaemonNativeLockHolder): RequestSchedulerError | undefined => {
+        if (replacesNativeLockHolder(holder, foundHolder)) holder = foundHolder;
+        const error: RequestSchedulerError | undefined = this.#getNativeLockWaitError(
+          formatNativeLockHolder(holder),
+          Date.now() - startMs,
+          budgetMs
+        );
+        const key: string = `${holder.pid}:${holder.command}`;
+        if (!error && !ended && key !== reportedHolder) {
+          reportedHolder = key;
+          writer?.enqueueNativeLockWait(holder);
+          transition?.setNativeLockHolder(holder);
+        }
+        return error;
+      },
+      endAsync: (): Promise<void> => {
+        if (!ended) {
+          this.#spend(Date.now() - startMs);
+          transition?.setNativeLockHolder(undefined);
+          ended = writer ? writer.flushAsync() : Promise.resolve();
+        }
+        return ended;
+      }
+    };
   }
 
-  #getRemainingWaitTimeoutMs(): number | undefined {
-    return this.#deadlineMs === undefined ? undefined : Math.max(0, this.#deadlineMs - Date.now());
+  /**
+   * Takes native Rush's repository lock with `tryAcquire`, which returns undefined while another Rush process holds
+   * it, and waits for that process as {@link RequestAdmissionController.beginNativeLockWait} describes. `findHolder`
+   * says which process holds the lock, and `transition`, if the request owns a graph transition, lets the requests
+   * that wait behind it name that process too.
+   *
+   * @remarks
+   * The lock is tried every 250ms, since native Rush does not say when it releases it, and it is released again if
+   * the client could not be told about the wait.
+   */
+  public async acquireNativeLockAsync<TLock extends { release(): void }>(
+    tryAcquire: () => TLock | undefined,
+    findHolder: () => IDaemonNativeLockHolder,
+    transition?: AdmissionProgress
+  ): Promise<TLock> {
+    let lock: TLock | undefined = tryAcquire();
+    if (lock) return lock;
+    const wait: INativeLockWait = this.beginNativeLockWait(transition);
+    const abortSignal: AbortSignal = this.#abortController.signal;
+    try {
+      while (!lock) {
+        const error: RequestSchedulerError | undefined = wait.update(findHolder());
+        if (error) throw error;
+        await delayAsync(wait.retryDelayMs, abortSignal);
+        if (!abortSignal.aborted) lock = tryAcquire();
+      }
+      await wait.endAsync();
+      return lock;
+    } catch (error) {
+      lock?.release();
+      await wait.endAsync();
+      throw error;
+    }
+  }
+
+  /** Returns the error that ends a wait for native Rush's repository lock, which `holder` holds, if it must end. */
+  #getNativeLockWaitError(
+    holder: string,
+    elapsedMs: number,
+    budgetMs: number | undefined
+  ): RequestSchedulerError | undefined {
+    if (this.#abortController.signal.aborted) {
+      return new RequestSchedulerError(
+        RequestSchedulerErrorCode.Aborted,
+        `The request was aborted while waiting for ${holder} to release this repository's lock.`
+      );
+    }
+    if (this.#admission?.noWait) {
+      return new RequestSchedulerError(
+        RequestSchedulerErrorCode.NoWait,
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock, and ` +
+          '--no-wait was specified.'
+      );
+    }
+    if (this.#configuredWaitTimeoutMs === 0) {
+      return new RequestSchedulerError(
+        RequestSchedulerErrorCode.WaitTimeout,
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock. ` +
+          'Use --wait-timeout <seconds> to wait for it.'
+      );
+    }
+    if (budgetMs === undefined || elapsedMs < budgetMs) return undefined;
+    const waitingFor: string = `${holder} to release this repository's lock`;
+    return this.#getReportedError(
+      new RequestSchedulerError(
+        RequestSchedulerErrorCode.WaitTimeout,
+        `The request timed out while waiting for ${waitingFor}.`
+      ),
+      waitingFor
+    ) as RequestSchedulerError;
+  }
+
+  /** Spends `elapsedMs` of the wait timeout, if one applies. */
+  #spend(elapsedMs: number): void {
+    if (this.#remainingMs !== undefined) {
+      this.#remainingMs = Math.max(0, this.#remainingMs - Math.max(0, elapsedMs));
+    }
   }
 
   #getReportedError(error: unknown, waitingFor: string): unknown {
-    const waitTimeoutMs: number | undefined = this.#admission?.waitTimeoutMs;
+    const waitTimeoutMs: number | undefined = this.#configuredWaitTimeoutMs;
     if (
       waitTimeoutMs !== undefined &&
       error instanceof RequestSchedulerError &&
@@ -229,8 +1207,9 @@ export class RequestAdmissionController {
     ) {
       return new RequestSchedulerError(
         RequestSchedulerErrorCode.WaitTimeout,
-        `The request was not admitted within ${waitTimeoutMs}ms while waiting for ${waitingFor}. ` +
-          'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.'
+        `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ${waitingFor}` +
+          `${formatUncountedTime(this.#pausedMs, 'earlier while another request loaded the workspace graph')}. ` +
+          WAIT_LONGER_HINT
       );
     }
     return error;
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 3c52ba43b3d..179012d9ed1 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -9,23 +9,42 @@ import {
   classifyWorkspaceInputChange,
   EnvironmentVariableNames,
   PhasedCommandEngineBusyError,
+  PhasedCommandEngineProjectConfigurationError,
   Rush,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
-  type IWorkspaceInputFingerprint
+  type IWorkspaceInputFingerprint,
+  type RushConfiguration
 } from '@microsoft/rush-lib';
-import { LockFile } from '@rushstack/node-core-library';
+import type { LockFile } from '@rushstack/node-core-library';
 import { NoOpTerminalProvider, Terminal } from '@rushstack/terminal';
-import type { IDaemonCommandResult, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import { findNativeLockHolder } from '@rushstack/rush-client-core';
+import type {
+  DaemonRestartReason,
+  IDaemonCommandResult,
+  IDaemonContinuingOperations,
+  IDaemonEnvironmentChangedRestartReason,
+  IDaemonInstallationChange,
+  IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
 
 import {
   DaemonRequestDispatchError,
+  DaemonRequestEnvironmentError,
+  isDaemonGraphCommand,
   type DispatchWorkspaceRequestAsync,
   type IDaemonRequestDispatchClient,
   type IDaemonRequestLifecycle,
-  type IDaemonRequestResolver
+  type IDaemonRequestResolver,
+  type IResolveDaemonRequestOptions
 } from './DaemonRequestDispatcher';
+import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import { createNativeMutationResolver } from './NativeMutationRequest';
+import {
+  captureNativeMutationInstallationStateAsync,
+  isInstallationUnchangedByMutation,
+  type INativeMutationInstallationState
+} from './NativeMutationInstallationState';
 import { parseDaemonGraphRequest, type IDaemonGraphRequest } from './DaemonGraphRequest';
 import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
 import {
@@ -35,14 +54,29 @@ import {
   type IRequestLease
 } from './RequestScheduler';
 import {
+  AdmissionProgress,
   RequestAdmissionController,
+  ScriptPassage,
+  ServedScriptScheduler,
   getRequestAdmissionErrorCode,
   getWorkspaceRequestScheduler
 } from './WorkspaceRequestAdmission';
 import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
+import { tryAcquireNativeLock } from './NativeRepositoryLock';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
-import { validateRequestRushEnvironment } from './RushEnvironmentValidation';
+import { getRushLibPathHandoff } from './RushLibPathHandoff';
+import {
+  BackgroundPreparationBusyError,
+  BackgroundPreparationScheduler,
+  getCaptureEnvironmentKey,
+  getErrorMessage,
+  isSameCommandLine,
+  type IPreparationCheck,
+  type IPreparationHint
+} from './BackgroundPreparationScheduler';
+import { assertValidRequestEnvironment, InvalidRequestEnvironment } from './RushEnvironmentValidation';
 import type { IWorkspaceSession } from './WorkspaceSession';
+import type { IWorkspaceInvalidationSnapshot } from './WorkspaceInvalidationTracker';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
 import type {
@@ -51,7 +85,32 @@ import type {
   IWorkspaceProcessRestartPlan,
   IWorkspaceSuccessorLaunch
 } from './WorkspaceProcessRestart';
-import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './WorkspaceRestartArbiter';
+import {
+  WorkspaceRestartArbiter,
+  type IWorkspaceRestartRecheck,
+  type IWorkspaceRestartTicket
+} from './WorkspaceRestartArbiter';
+import { classifyRushCommand } from './RushCommandRequestPolicy';
+import { describeContinuingOperations } from './PhasedRequestRouter';
+import { addStoppedContinuingOperations } from './StoppedContinuingOperations';
+import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
+import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
+import {
+  getEnvironmentIdentityEntries,
+  getEnvironmentRestartReason,
+  type EnvironmentIdentityEntries
+} from './EnvironmentRestartReason';
+
+/** How often a request that waits for a restart drain checks whether it still needs the restart. */
+const RESTART_RECHECK_INTERVAL_MS: number = 1000;
+/** A restart reason names at most this many of the changed files of Rush and its plugins. */
+const MAX_REASON_IMPLEMENTATION_FILES: number = 3;
+
+interface IRecheckCapture {
+  /** On the clock of `performance.now()`. */
+  readonly startTimeMs: number;
+  readonly fingerprint: Promise<IWorkspaceInputFingerprint>;
+}
 
 interface IExecutionState {
   began: boolean;
@@ -67,12 +126,42 @@ interface IPreparedGeneration {
   readonly fingerprint: IWorkspaceInputFingerprint;
 }
 
+interface IReloadOptions {
+  /** See `IResolveDaemonRequestOptions.abortSignal`. */
+  readonly abortSignal: AbortSignal;
+  /** See `IResolveDaemonRequestOptions.engineCreationSignal`. The reload also checks it before it replaces anything. */
+  readonly engineCreationSignal?: AbortSignal;
+  /** Takes the session's workspace request scheduler exclusively. */
+  readonly acquireWorkspaceLeaseAsync: (scheduler: RequestScheduler) => Promise<IRequestLease>;
+  /** Takes native Rush's repository lock in `lockFolder`. */
+  readonly acquireNativeLockAsync: (lockFolder: string) => Promise<LockFile>;
+}
+
+interface IReloadResult {
+  readonly session: IWorkspaceSession;
+  readonly fingerprint: IWorkspaceInputFingerprint;
+  /** Set when the command line's selection failed after the new generation was bound; see `isSelectionRejection`. */
+  readonly selectionRejection: DaemonRequestDispatchError | undefined;
+  /** The invalidation sequence of `session` when the capture of `fingerprint` started. */
+  readonly invalidationSequence: number;
+}
+
+interface IBackgroundPreparation {
+  readonly envelope: IDaemonRequestEnvelope;
+  /** Stops the preparation at its next step; see `#stopPreparationUnlessJoined`. */
+  readonly controller: AbortController;
+}
+
 export interface IWorkspaceRequestLifecycleOptions {
   readonly provider: WorkspaceSessionProvider;
   readonly resolver: IDaemonRequestResolver;
   readonly rushVersion: string;
   readonly getSuccessorLaunchAsync: GetWorkspaceSuccessorLaunchAsync | undefined;
   readonly onRestartRequested: (plan: IWorkspaceProcessRestartPlan) => void;
+  /** Checked before each request; a removed or replaced installation restarts the process without a successor. */
+  readonly checkInstallation?: CheckDaemonInstallation;
+  /** Receives messages for the daemon log. */
+  readonly onLog?: (message: string) => void;
 }
 
 class RestartBeforeExecution extends Error {
@@ -102,14 +191,11 @@ class RestartPendingBeforeExecution extends Error {
   }
 }
 
-/** The request's Rush environment would prevent a successor from starting; the current daemon is kept. */
-class InvalidRequestEnvironment extends Error {}
-
-function assertValidRequestEnvironment(envelope: IDaemonRequestEnvelope): void {
-  try {
-    validateRequestRushEnvironment(envelope.environment);
-  } catch (error) {
-    throw new InvalidRequestEnvironment(error instanceof Error ? error.message : String(error));
+class InstallationChangedBeforeExecution extends Error {
+  public constructor(change: IDaemonInstallationChange) {
+    super(
+      `The daemon's installation at ${change.folder} was ${change.change}. No operation was scheduled or executed. Reconnect and submit a new request after restart.`
+    );
   }
 }
 
@@ -120,13 +206,44 @@ function assertValidRequestEnvironment(envelope: IDaemonRequestEnvelope): void {
 export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #options: IWorkspaceRequestLifecycleOptions;
   readonly #gate: RequestScheduler = new RequestScheduler();
+  /**
+   * A served rushx script needs its generation only to resolve, so once it starts it releases `#gate` and holds a
+   * shared lease here until it exits: a reload no longer waits for a dev server or watch script. Whatever
+   * would end the script with this process (a restart, a native mutation, disposal) waits for this lease after
+   * taking `#gate` exclusively, when no other script can start.
+   */
+  readonly #scripts: ServedScriptScheduler = new ServedScriptScheduler();
+  /**
+   * Open while a reload waits for another Rush process to release the repository's lock, which may take any length of
+   * time: a served rushx script that arrives or waits then passes the reload, and resolves and starts on the current
+   * generation, as it would have before the reload began. The reload waits for it only until it has started.
+   */
+  readonly #scriptPassage: ScriptPassage = new ScriptPassage();
   readonly #restartArbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   readonly #abortController: AbortController = new AbortController();
   readonly #observers: Set<AbortController> = new Set();
   readonly #terminal: Terminal = new Terminal(new NoOpTerminalProvider());
   readonly #runtimePaths: ReadonlyArray<string> = [__dirname, path.resolve(__dirname, '../package.json')];
+  // Resolved once: after the installation is removed, resolving it again would fail before the restart check.
+  readonly #rushLibPath: string = getRushLibPathHandoff(
+    require.resolve('@microsoft/rush-lib'),
+    process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
+  );
+  readonly #repoRoot: string;
+  /** The daemon's environment before any engine ran. A plugin may add names to `process.env` later. */
+  readonly #startupEnvironment: Record<string, string>;
+  /** The variables of `#startupEnvironment` that the startup fingerprint's `environmentHash` includes. */
+  readonly #startupEnvironmentEntries: EnvironmentIdentityEntries;
   readonly #startupFingerprint: IWorkspaceInputFingerprint;
   readonly #runtimeCache: WorkspaceRuntimeFingerprintCache;
+  // Concurrent requests share captures; each capture still starts after the requests it serves arrived.
+  // The coalescers' default clock, performance.now(), is also the clock of receivedTimeMs.
+  readonly #fingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, IWorkspaceInputFingerprint> =
+    new FreshCaptureCoalescer();
+  readonly #projectFingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, string> =
+    new FreshCaptureCoalescer();
+  /** The latest capture that a request waiting for a restart drain started, for each workspace configuration. */
+  readonly #recheckCaptures: WeakMap<RushConfiguration, IRecheckCapture> = new WeakMap();
   #fingerprint: IWorkspaceInputFingerprint;
   #projectFingerprint: string | undefined;
   #commandIdentity: string | undefined;
@@ -136,21 +253,60 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   #forceReload: boolean = false;
   #closing: boolean = false;
   #restartPending: boolean = false;
+  /** Why the pending restart happens, when the request that it is for has a different environment. */
+  #restartReason: IDaemonEnvironmentChangedRestartReason | undefined;
   #lastReloadTier: WorkspaceInputChangeTier = WorkspaceInputChangeTier.Reuse;
+  #installationChange: IDaemonInstallationChange | undefined;
   #transitioning: boolean = false;
+  /**
+   * Whether a served rushx script may be admitted ahead of the transition while its owner waits for `#gate`: only if
+   * the owner reloads the graph, which leaves scripts running, rather than restarting the daemon or running a native
+   * mutation, which would end them with this process. The script then starts on the current generation, as it would
+   * have before the reload was requested; it reads its package.json when it runs. Each owner sets it, and it is read
+   * only while `#transitioning`.
+   */
+  #scriptsMayPassTransition: boolean = false;
+  /** Active while the transition owner holds the exclusive gate and loads or reloads the workspace graph. */
+  readonly #transitionProgress: AdmissionProgress = new AdmissionProgress();
   #cleanupFailure: unknown;
   #disposePromise: Promise<void> | undefined;
+  /** How many calls of `dispatchAsync` have not returned. */
+  #activeDispatchCount: number = 0;
+  /** Keeps the command line of the last phased command that was served, and says when to prepare it again. */
+  readonly #preparations: BackgroundPreparationScheduler;
+  /** `getCaptureEnvironmentKey` of the environment of every background preparation. */
+  readonly #preparationEnvironmentKey: string;
+  /** The background preparation that holds `#gate`. */
+  #preparation: IBackgroundPreparation | undefined;
+  #preparationCount: number = 0;
 
   private constructor(
     options: IWorkspaceRequestLifecycleOptions,
+    repoRoot: string,
     fingerprint: IWorkspaceInputFingerprint,
-    runtimeCache: WorkspaceRuntimeFingerprintCache
+    runtimeCache: WorkspaceRuntimeFingerprintCache,
+    startupEnvironment: Record<string, string>
   ) {
     this.#options = options;
+    this.#repoRoot = repoRoot;
     this.#startupFingerprint = this.#fingerprint = fingerprint;
     this.#resolver = options.resolver;
     this.#ownedResolvers.add(options.resolver);
     this.#runtimeCache = runtimeCache;
+    this.#startupEnvironment = startupEnvironment;
+    this.#startupEnvironmentEntries = getEnvironmentIdentityEntries(startupEnvironment);
+    // The daemon's own environment, which each request that it serves has too, as far as the workspace fingerprint
+    // reads it, with the engine that `dispatchAsync` sets for every request. A client's other variables are never kept.
+    const preparationEnvironment: Readonly<Record<string, string>> = Object.freeze({
+      ...startupEnvironment,
+      [EnvironmentVariableNames._RUSH_LIB_PATH]: this.#rushLibPath
+    });
+    this.#preparationEnvironmentKey = getCaptureEnvironmentKey(preparationEnvironment);
+    this.#preparations = new BackgroundPreparationScheduler({
+      environment: preparationEnvironment,
+      checkAsync: () => this.#tryStartPreparationAsync(),
+      onLog: (message: string) => this.#options.onLog?.(message)
+    });
   }
 
   public static async createAsync(
@@ -158,13 +314,23 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   ): Promise<WorkspaceRequestLifecycle> {
     const session: IWorkspaceSession = await options.provider.getSessionAsync();
     const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+    // The startup fingerprint hashes this copy, so that a restart for another environment can name what differs.
+    const startupEnvironment: Record<string, string> = Object.fromEntries(
+      Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+    );
     const fingerprint: IWorkspaceInputFingerprint = await captureWorkspaceInputFingerprintAsync({
       rushConfiguration: session.rushConfiguration,
-      environment: process.env,
+      environment: startupEnvironment,
       runtimePaths: [__dirname, path.resolve(__dirname, '../package.json')],
       runtimeCache
     });
-    return new WorkspaceRequestLifecycle(options, fingerprint, runtimeCache);
+    return new WorkspaceRequestLifecycle(
+      options,
+      session.metadata.repoRoot,
+      fingerprint,
+      runtimeCache,
+      startupEnvironment
+    );
   }
 
   /** The last applied input decision; reading status never changes or reloads the workspace. */
@@ -175,63 +341,129 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   public async dispatchAsync(
     request: IDaemonRequestEnvelope,
     destination: IDaemonRequestDispatchClient,
-    dispatchAsync: DispatchWorkspaceRequestAsync
+    dispatchWorkspaceRequestAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
-    // Native Rush owns its SDK handoff; a foreign client's bundled engine must not override this one.
+    this.#activeDispatchCount++;
+    try {
+      await this.#dispatchCoreAsync(request, destination, dispatchWorkspaceRequestAsync);
+    } finally {
+      this.#activeDispatchCount--;
+      this.#preparations.resume(this.#isIdle());
+    }
+  }
+
+  async #dispatchCoreAsync(
+    request: IDaemonRequestEnvelope,
+    destination: IDaemonRequestDispatchClient,
+    dispatchWorkspaceRequestAsync: DispatchWorkspaceRequestAsync
+  ): Promise<void> {
+    const receivedTimeMs: number = destination.receivedTimeMs ?? performance.now();
+    const dispatchAsync: DispatchWorkspaceRequestAsync = (options) =>
+      dispatchWorkspaceRequestAsync({
+        ...options,
+        lifecycleInfo: {
+          receivedTimeMs,
+          preparedTimeMs: performance.now(),
+          reloadTier: this.#lastReloadTier
+        }
+      });
     const envelope: IDaemonRequestEnvelope = {
       ...request,
       environment: {
         ...request.environment,
-        [EnvironmentVariableNames._RUSH_LIB_PATH]: require.resolve('@microsoft/rush-lib')
+        [EnvironmentVariableNames._RUSH_LIB_PATH]: this.#rushLibPath
       }
     };
+    this.#stopPreparationUnlessJoined(envelope);
+    this.#detectInstallationChange();
     if (this.#restartPending) {
       await destination.interactiveSession.finishAsync();
-      await destination.writeResultAsync({
-        ...preExecutionFailure(envelope.requestId, new RestartPendingBeforeExecution()),
-        retryAfterRestart: true
-      });
+      await destination.writeResultAsync(
+        this.#restartPendingResult(envelope.requestId, new RestartPendingBeforeExecution())
+      );
       return;
     }
     if (this.#closing)
       throw new Error('The workspace lifecycle is closing. No operation was scheduled or executed.');
-    if (this.#cleanupFailure !== undefined) throw this.#cleanupFailure;
+    if (this.#cleanupFailure !== undefined && !this.#installationChange) throw this.#cleanupFailure;
     const state: IExecutionState = { began: false, terminalAttempted: false, resultDrained: false };
     const observer: AbortController | undefined = isGraphWatch(envelope) ? new AbortController() : undefined;
     if (observer) this.#observers.add(observer);
+    const preemption: AbortController = new AbortController();
     const signal: AbortSignal = AbortSignal.any([
       destination.abortSignal,
       this.#abortController.signal,
+      preemption.signal,
       ...(observer ? [observer.signal] : [])
     ]);
-    const client: IDaemonRequestDispatchClient = createLifecycleClient(destination, signal, state);
+    let canYieldAfterResult: boolean = false;
+    let onResultDrained: (() => void) | undefined;
+    const client: IDaemonRequestDispatchClient = createLifecycleClient(
+      destination,
+      signal,
+      state,
+      () => onResultDrained?.(),
+      (exclusivityClass: RequestExclusivityClass) => {
+        canYieldAfterResult = mayContinueAfterResult(envelope, exclusivityClass);
+      }
+    );
     const admission: RequestAdmissionController = new RequestAdmissionController({
       admission: envelope.admission,
       client,
       requestId: envelope.requestId
     });
-    // Long-lived observers are cancelled by a transition, so they never delay a restart.
-    const ticket: IWorkspaceRestartTicket | undefined = observer ? undefined : this.#restartArbiter.enter();
+    let ticket: IWorkspaceRestartTicket | undefined = observer
+      ? undefined
+      : this.#restartArbiter.enter({ runsScript: isRushxInvocation(envelope) });
     let generation: IPreparedGeneration | undefined;
     try {
       for (let attempt: number = 0; ; attempt++) {
+        if (this.#installationChange) {
+          // An observer waits for the restart like any other request, so from here on the drain tracks it too.
+          ticket ??= this.#restartArbiter.enter();
+          await this.#restartForInstallationAsync(
+            envelope,
+            client,
+            admission,
+            ticket,
+            this.#installationChange
+          );
+          return;
+        }
+        let scriptLease: IRequestLease | undefined;
         try {
-          generation = await this.#prepareAsync(envelope, client, admission, ticket);
+          canYieldAfterResult = false;
+          this.#throwIfUnsupportedCommand(envelope);
+          const prepared: IPreparedGeneration = await this.#prepareAsync(
+            envelope,
+            client,
+            admission,
+            ticket,
+            receivedTimeMs
+          );
+          generation = prepared;
+          if (envelope.returnEarlyOnFailure === true)
+            onResultDrained = () =>
+              canYieldAfterResult && this.#yieldAfterResult(prepared.lease, ticket, preemption);
+          if (isRushxInvocation(envelope)) {
+            scriptLease = await admission.acquireAsync(this.#scripts, RequestExclusivityClass.SharedBuild);
+          }
           const requestEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
             admission: admission.remainingAdmission
           };
           if (isMutation(envelope)) {
-            await this.#executeMutationAsync(generation, requestEnvelope, client, state, dispatchAsync);
+            await this.#executeMutationAsync(prepared, requestEnvelope, client, state, dispatchAsync);
           } else {
             await dispatchAsync({
               envelope: requestEnvelope,
               client,
-              workspaceSession: generation.session,
-              resolver: generation.resolver,
+              workspaceSession: prepared.session,
+              resolver: prepared.resolver,
               onExecutionStarting: () => {
-                this.#assertGeneration(generation!);
+                this.#assertGeneration(prepared);
                 state.began = true;
+                if (scriptLease) prepared.lease.release();
               }
             });
           }
@@ -248,16 +480,26 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             continue;
           }
           if (error instanceof RestartBeforeExecution && !state.began && !state.terminalAttempted) {
+            const restartReason: IDaemonEnvironmentChangedRestartReason | undefined =
+              getEnvironmentRestartReason(this.#startupEnvironmentEntries, error.plan.environment);
             try {
               await client.interactiveSession.finishAsync();
               await client.writeResultAsync({
                 ...preExecutionFailure(envelope.requestId, error),
-                retryAfterRestart: true
+                retryAfterRestart: true,
+                ...(restartReason && { restartReason })
               });
               error.session.retire?.();
               this.#lastReloadTier = WorkspaceInputChangeTier.Restart;
+              this.#restartReason = restartReason;
               this.#restartPending = true;
               this.#closing = true;
+              if (restartReason) {
+                this.#options.onLog?.(
+                  `rushd: restarting for request ${envelope.requestId}, whose environment differs from this ` +
+                    `daemon's in ${restartReason.variableNames.join(', ')}`
+                );
+              }
               this.#options.onRestartRequested(error.plan);
             } finally {
               error.workspaceLease.release();
@@ -267,10 +509,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           }
           if (error instanceof RestartPendingBeforeExecution && !state.began && !state.terminalAttempted) {
             await client.interactiveSession.finishAsync();
-            await client.writeResultAsync({
-              ...preExecutionFailure(envelope.requestId, error),
-              retryAfterRestart: true
-            });
+            await client.writeResultAsync(this.#restartPendingResult(envelope.requestId, error));
             return;
           }
           if (error instanceof InvalidRequestEnvironment && !state.began && !state.terminalAttempted) {
@@ -279,21 +518,29 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             return;
           }
           if (error instanceof RequestSchedulerError && !state.began && !state.terminalAttempted) {
-            await client.interactiveSession.finishAsync();
-            await client.writeResultAsync({
-              ...preExecutionFailure(
-                envelope.requestId,
-                getDaemonShutdownReason(client.abortSignal) ?? error
-              ),
-              aborted: client.abortSignal.aborted,
-              admissionErrorCode: getRequestAdmissionErrorCode(error)
-            });
+            await writeAdmissionFailureAsync(envelope, client, error);
             return;
           }
+          // A request that failed before it began because the installation changed under it, for example on a
+          // module that the daemon could no longer load, waits for the restart like any other request.
+          if (!state.began && !state.terminalAttempted && this.#detectInstallationChange()) continue;
+          if (
+            isFallbackRejection(error) &&
+            !state.began &&
+            !state.terminalAttempted &&
+            !mayFallBackAlongsideContinuingWork(envelope)
+          ) {
+            // The client runs this command in-process instead. Work that finished requests continue would run
+            // alongside it, like two Rush commands in one checkout.
+            generation?.lease.release();
+            throw await this.#stopContinuingWorkBeforeFallbackAsync(error, client.abortSignal);
+          }
           throw error;
         } finally {
+          onResultDrained = undefined;
           generation?.lease.release();
           generation = undefined;
+          scriptLease?.release();
         }
       }
     } finally {
@@ -303,31 +550,93 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * A request that may return its result before its work ends (a failed build whose independent operations
+   * continue) must not delay other requests once its client has that result, since nobody waits for that work:
+   * a restart no longer waits for it, and a request that needs this generation exclusively stops it, as does a
+   * request that the client runs in-process instead (see `#stopContinuingWorkAsync`).
+   */
+  #yieldAfterResult(
+    lease: IRequestLease,
+    ticket: IWorkspaceRestartTicket | undefined,
+    preemption: AbortController
+  ): void {
+    if (ticket) this.#restartArbiter.leave(ticket);
+    this.#gate.markLeasePreemptible(lease, () =>
+      preemption.abort(
+        new Error('A request that cannot run alongside this finished request stopped its remaining work.')
+      )
+    );
+  }
+
+  /** Stops the work that finished requests continue (see `#yieldAfterResult`) and waits until it has stopped. */
+  async #stopContinuingWorkAsync(abortSignal: AbortSignal): Promise<void> {
+    const stopped: Promise<void> = this.#gate.preemptLeasesAsync();
+    if (abortSignal.aborted) return;
+    let onAbort: () => void = () => undefined;
+    const aborted: Promise<void> = new Promise((resolve) => {
+      onAbort = resolve;
+      abortSignal.addEventListener('abort', onAbort, { once: true });
+    });
+    try {
+      await Promise.race([stopped, aborted]);
+    } finally {
+      abortSignal.removeEventListener('abort', onAbort);
+    }
+  }
+
+  /**
+   * Stops the work that finished requests continue before the client of `rejection` runs its command in-process, and
+   * returns the rejection to send. If that stopped all of the operations that an earlier failed command left running,
+   * and the client still waits, the rejection names them.
+   */
+  async #stopContinuingWorkBeforeFallbackAsync(
+    rejection: DaemonRequestDispatchError,
+    abortSignal: AbortSignal
+  ): Promise<DaemonRequestDispatchError> {
+    const session: IWorkspaceSession | undefined = this.#options.provider.currentSession;
+    const continuing: IDaemonContinuingOperations | undefined =
+      session && describeContinuingOperations(session);
+    await this.#stopContinuingWorkAsync(abortSignal);
+    if (!session || !continuing || abortSignal.aborted || describeContinuingOperations(session)) {
+      return rejection;
+    }
+    return addStoppedContinuingOperations(rejection, continuing);
+  }
+
   async #prepareAsync(
     envelope: IDaemonRequestEnvelope,
     client: IDaemonRequestDispatchClient,
     admission: RequestAdmissionController,
     ticket: IWorkspaceRestartTicket | undefined,
+    receivedTimeMs: number,
     admittedLease?: IRequestLease
   ): Promise<IPreparedGeneration> {
     let lease: IRequestLease =
-      admittedLease ?? (await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
+      admittedLease ??
+      (isRushxInvocation(envelope)
+        ? await this.#admitScriptAsync(admission)
+        : this.#transitioning
+          ? await admission.acquireBehindTransitionAsync(this.#gate, this.#transitionProgress)
+          : await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
     let ownsTransition: boolean = false;
     try {
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      this.#throwIfInstallationChanged();
       if (this.#closing)
         throw new Error('The workspace is restarting. No operation was scheduled or executed.');
       if (this.#cleanupFailure !== undefined) throw this.#cleanupFailure;
       let session: IWorkspaceSession = await this.#options.provider.getSessionAsync();
       assertWorkspaceRequestResourcesHealthy(session);
       if (isRushxInvocation(envelope)) {
-        return {
-          session,
-          resolver: this.#resolver,
-          generation: this.#options.provider.generation,
-          lease,
-          fingerprint: this.#fingerprint
-        };
+        if (ticket && this.#restartArbiter.hasPendingRestart(ticket)) {
+          // The restart would wait for the script to exit, so the script waits for the restart instead. If the restart
+          // is planned, the next attempt tells the client to run the script on the successor.
+          lease.release();
+          await admission.waitForPendingRestartAsync(this.#restartArbiter, ticket);
+          return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
+        }
+        return this.#createPreparedGeneration(session, lease);
       }
       if (isGraphRequest(envelope)) {
         const graphRequest: IDaemonGraphRequest = parseDaemonGraphRequest(envelope);
@@ -335,92 +644,73 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           // Graph control environment flags are not a request to change the retained engine environment.
           const controlEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
-            environment: Object.fromEntries(
-              Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
-            )
+            environment: { ...this.#startupEnvironment }
           };
           const current: IWorkspaceInputFingerprint = await this.#captureAsync(session, controlEnvelope);
           const currentTier: WorkspaceInputChangeTier = this.#classify(current, false);
           if (currentTier === WorkspaceInputChangeTier.Restart) {
-            lease.release();
-            if (ticket) {
-              // Like build requests, a graph-control restart must not preempt requests this process can serve.
-              await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket);
-              if (this.#restartPending) throw new RestartPendingBeforeExecution();
-            }
-            this.#cancelObservers();
-            lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
-            session = await this.#options.provider.getSessionAsync();
-            await this.#quiesceWarmSetAsync(session);
-            const workspaceLease: IRequestLease = await admission.acquireAsync(
-              getWorkspaceRequestScheduler(session),
-              RequestExclusivityClass.Exclusive
+            await this.#restartBeforeExecutionAsync(
+              controlEnvelope,
+              admission,
+              ticket,
+              lease,
+              session,
+              current,
+              false
             );
-            try {
-              const plan: IWorkspaceProcessRestartPlan = await this.#restartPlanAsync(
-                session,
-                controlEnvelope,
-                'hard-input-change'
-              );
-              throw new RestartBeforeExecution(plan, session, lease, workspaceLease);
-            } catch (error) {
-              if (!(error instanceof RestartBeforeExecution)) workspaceLease.release();
-              throw error;
-            }
+            return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
           }
           if (
             currentTier !== WorkspaceInputChangeTier.Reuse ||
             (this.#boundSession &&
-              this.#projectFingerprint !==
-                (await captureProjectConfigurationFingerprintAsync(
-                  session.rushConfiguration,
-                  this.#terminal
-                )))
+              this.#projectFingerprint !== (await this.#captureProjectFingerprintAsync(session)))
           ) {
             throw new Error(
               'Graph inputs changed. Load the new generation with a supported build request; no operation was scheduled or executed.'
             );
           }
         }
-        return {
-          session,
-          resolver: this.#resolver,
-          generation: this.#options.provider.generation,
-          lease,
-          fingerprint: this.#fingerprint
-        };
+        return this.#createPreparedGeneration(session, lease);
       }
       if (
-        envelope.commandOrigin !== 'built-in' ||
+        envelope.commandOrigin === 'built-in' &&
         !['build', 'rebuild', 'install', 'update'].includes(envelope.commandName)
       ) {
-        return {
-          session,
-          resolver: this.#resolver,
-          generation: this.#options.provider.generation,
-          lease,
-          fingerprint: this.#fingerprint
-        };
+        return this.#createPreparedGeneration(session, lease);
       }
-      let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
-      let tier: WorkspaceInputChangeTier = this.#classify(fingerprint, isMutation(envelope));
-      if (tier === WorkspaceInputChangeTier.Restart) assertValidRequestEnvironment(envelope);
       let commandIdentity: string | undefined;
-      let projectFingerprint: string | undefined;
-      if (tier !== WorkspaceInputChangeTier.Restart && !isMutation(envelope)) {
-        commandIdentity = await getResolverLifecycle(this.#resolver).getCommandParameterIdentityAsync({
+      if (envelope.commandOrigin === 'custom') {
+        // Only phased custom commands are served. Parsing before any input capture rejects a global command
+        // before it can reload or restart this workspace. A phased command whose environment differs from this
+        // daemon's continues to the capture, which restarts the daemon for it, as it does for build.
+        commandIdentity = await tryGetCustomCommandParameterIdentityAsync(this.#resolver, {
           envelope,
           workspaceSession: session,
           abortSignal: client.abortSignal
         });
+      }
+      // The client changes the workspace before it sends a request, so any capture that started after the request
+      // was received sees those changes. Captures that must detect changes made during a transition stay strict.
+      let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(
+        session,
+        envelope,
+        receivedTimeMs
+      );
+      let tier: WorkspaceInputChangeTier = this.#classify(fingerprint, isMutation(envelope));
+      if (tier === WorkspaceInputChangeTier.Restart) assertValidRequestEnvironment(envelope.environment);
+      let projectFingerprint: string | undefined;
+      if (tier !== WorkspaceInputChangeTier.Restart && !isMutation(envelope)) {
+        commandIdentity ??= await getCommandParameterIdentityAsync(
+          this.#resolver,
+          { envelope, workspaceSession: session, abortSignal: client.abortSignal },
+          this.#isConfigurationCurrent(session, tier)
+        );
         if (tier === WorkspaceInputChangeTier.Reuse) {
-          projectFingerprint = await captureProjectConfigurationFingerprintAsync(
-            session.rushConfiguration,
-            this.#terminal
-          );
+          projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session, receivedTimeMs);
           if (
             this.#boundSession !== session ||
             this.#commandIdentity !== commandIdentity ||
+            projectFingerprint === undefined ||
             this.#projectFingerprint !== projectFingerprint ||
             this.#forceReload ||
             !session.invalidations.getSnapshot().isWatcherHealthy ||
@@ -431,56 +721,58 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       }
       if (tier === WorkspaceInputChangeTier.Reuse && !isMutation(envelope)) {
         this.#lastReloadTier = WorkspaceInputChangeTier.Reuse;
-        return {
-          session,
-          resolver: this.#resolver,
-          generation: this.#options.provider.generation,
-          lease,
-          fingerprint
-        };
+        this.#preparations.remember(session, envelope);
+        return this.#createPreparedGeneration(session, lease, fingerprint);
       }
 
-      lease.release();
       if (tier === WorkspaceInputChangeTier.Restart && ticket) {
-        // Serve every queued or in-flight request that matches this process before restarting for another one.
-        await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket);
-        if (this.#restartPending) throw new RestartPendingBeforeExecution();
+        await this.#restartBeforeExecutionAsync(
+          envelope,
+          admission,
+          ticket,
+          lease,
+          session,
+          fingerprint,
+          isMutation(envelope)
+        );
+        return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
+      } else {
+        lease.release();
       }
       if (this.#transitioning) {
-        const shared: IRequestLease = await admission.acquireAsync(
+        const shared: IRequestLease = await admission.acquireBehindTransitionAsync(
           this.#gate,
-          RequestExclusivityClass.SharedBuild
+          this.#transitionProgress
         );
-        return await this.#prepareAsync(envelope, client, admission, ticket, shared);
+        return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs, shared);
       }
       this.#transitioning = ownsTransition = true;
+      this.#scriptsMayPassTransition = tier === WorkspaceInputChangeTier.Reload && !isMutation(envelope);
       this.#cancelObservers();
-      lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
+      const continuingSession: IWorkspaceSession = session;
+      lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive, undefined, () =>
+        describeContinuingOperations(continuingSession)
+      );
+      this.#transitionProgress.setActive(true);
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      this.#throwIfInstallationChanged();
       if (this.#closing)
         throw new Error('The workspace is restarting. No operation was scheduled or executed.');
       session = await this.#options.provider.getSessionAsync();
       fingerprint = await this.#captureAsync(session, envelope);
       tier = this.#classify(fingerprint, isMutation(envelope));
       if (tier === WorkspaceInputChangeTier.Restart) {
-        assertValidRequestEnvironment(envelope);
-        await this.#quiesceWarmSetAsync(session);
-        const workspaceLease: IRequestLease = await admission.acquireAsync(
-          getWorkspaceRequestScheduler(session),
-          RequestExclusivityClass.Exclusive
+        assertValidRequestEnvironment(envelope.environment);
+        await this.#throwRestartBeforeExecutionAsync(
+          envelope,
+          admission,
+          lease,
+          session,
+          fingerprint,
+          isMutation(envelope)
         );
-        try {
-          const plan: IWorkspaceProcessRestartPlan = await this.#restartPlanAsync(
-            session,
-            envelope,
-            'hard-input-change'
-          );
-          throw new RestartBeforeExecution(plan, session, lease, workspaceLease);
-        } catch (error) {
-          if (!(error instanceof RestartBeforeExecution)) workspaceLease.release();
-          throw error;
-        }
       }
+      if (ticket) this.#restartArbiter.withdrawRestart(ticket);
       if (isMutation(envelope)) {
         if (!this.#options.getSuccessorLaunchAsync) {
           throw new DaemonRequestDispatchError(
@@ -488,21 +780,20 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             'Native mutations require a successor launcher. No worker was started.'
           );
         }
+        await this.#waitForServedScriptsAsync(admission, undefined, {
+          kind: 'nativeMutation',
+          commandName: envelope.commandName
+        });
         await this.#quiesceWarmSetAsync(session);
-        return {
-          session,
-          resolver: this.#resolver,
-          generation: this.#options.provider.generation,
-          lease,
-          fingerprint
-        };
+        this.#throwIfInstallationChanged();
+        return this.#createPreparedGeneration(session, lease, fingerprint);
       }
 
-      commandIdentity = await getResolverLifecycle(this.#resolver).getCommandParameterIdentityAsync({
-        envelope,
-        workspaceSession: session,
-        abortSignal: client.abortSignal
-      });
+      commandIdentity = await getCommandParameterIdentityAsync(
+        this.#resolver,
+        { envelope, workspaceSession: session, abortSignal: client.abortSignal },
+        this.#isConfigurationCurrent(session, tier)
+      );
       if (
         this.#boundSession === session &&
         this.#commandIdentity === commandIdentity &&
@@ -511,124 +802,501 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         session.invalidations.getSnapshot().isWatcherHealthy &&
         !session.invalidations.hasUnattributedUnknownChanges
       ) {
-        projectFingerprint = await captureProjectConfigurationFingerprintAsync(
-          session.rushConfiguration,
-          this.#terminal
-        );
-        if (projectFingerprint === this.#projectFingerprint) {
+        projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
+        if (projectFingerprint !== undefined && projectFingerprint === this.#projectFingerprint) {
           this.#lastReloadTier = WorkspaceInputChangeTier.Reuse;
+          this.#preparations.remember(session, envelope);
           this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
-          return {
-            session,
-            resolver: this.#resolver,
-            generation: this.#options.provider.generation,
-            lease,
-            fingerprint
-          };
+          return this.#createPreparedGeneration(session, lease, fingerprint);
         }
       }
-      await this.#quiesceWarmSetAsync(session);
-      const workspaceLease: IRequestLease = await admission.acquireAsync(
-        getWorkspaceRequestScheduler(session),
-        RequestExclusivityClass.Exclusive
-      );
-      const nativeLock: LockFile | undefined = LockFile.tryAcquire(
-        session.rushConfiguration.commonTempFolder,
-        'rush'
+      const reload: IReloadResult = await this.#reloadAsync(session, envelope, {
+        abortSignal: client.abortSignal,
+        acquireWorkspaceLeaseAsync: (scheduler: RequestScheduler) =>
+          admission.acquireAsync(scheduler, RequestExclusivityClass.Exclusive),
+        acquireNativeLockAsync: async (lockFolder: string) => {
+          const loading: boolean = this.#transitionProgress.active;
+          this.#transitionProgress.setActive(false);
+          try {
+            return await this.#acquireReloadLockAsync(admission, lockFolder);
+          } finally {
+            this.#transitionProgress.setActive(loading);
+          }
+        }
+      });
+      if (reload.selectionRejection) throw reload.selectionRejection;
+      this.#preparations.remember(reload.session, envelope, reload.invalidationSequence);
+      this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
+      return this.#createPreparedGeneration(reload.session, lease, reload.fingerprint);
+    } catch (error) {
+      if (!(error instanceof RestartBeforeExecution)) lease.release();
+      throw error;
+    } finally {
+      if (ownsTransition) {
+        this.#transitioning = false;
+        this.#transitionProgress.setActive(false);
+      }
+    }
+  }
+
+  #createPreparedGeneration(
+    session: IWorkspaceSession,
+    lease: IRequestLease,
+    fingerprint: IWorkspaceInputFingerprint = this.#fingerprint
+  ): IPreparedGeneration {
+    const resolver: IDaemonRequestResolver = this.#resolver;
+    const generation: number = this.#options.provider.generation;
+    return { session, resolver, generation, lease, fingerprint };
+  }
+
+  async #restartBeforeExecutionAsync(
+    envelope: IDaemonRequestEnvelope,
+    admission: RequestAdmissionController,
+    ticket: IWorkspaceRestartTicket | undefined,
+    lease: IRequestLease,
+    session: IWorkspaceSession,
+    fingerprint: IWorkspaceInputFingerprint,
+    mutation: boolean
+  ): Promise<void> {
+    lease.release();
+    if (ticket) {
+      const drained: boolean = await admission.waitForRestartDrainAsync(
+        this.#restartArbiter,
+        ticket,
+        this.#getRestartReason(fingerprint, envelope.environment, mutation),
+        this.#createRestartRecheck(session, envelope, fingerprint, mutation)
       );
-      if (!nativeLock) {
-        workspaceLease.release();
-        throw new PhasedCommandEngineBusyError();
+      if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      if (!drained) return;
+    }
+    this.#cancelObservers();
+    const exclusiveLease: IRequestLease = await admission.acquireAsync(
+      this.#gate,
+      RequestExclusivityClass.Exclusive
+    );
+    try {
+      if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      this.#throwIfInstallationChanged();
+      if (this.#closing)
+        throw new Error('The workspace is restarting. No operation was scheduled or executed.');
+      const currentSession: IWorkspaceSession = await this.#options.provider.getSessionAsync();
+      const current: IWorkspaceInputFingerprint = await this.#captureAsync(currentSession, envelope);
+      if (this.#classify(current, mutation) !== WorkspaceInputChangeTier.Restart) {
+        if (ticket) this.#restartArbiter.withdrawRestart(ticket);
+        exclusiveLease.release();
+        return;
       }
-      try {
-        const before: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
-        let expectedFingerprint: IWorkspaceInputFingerprint = before;
-        const validationContext: { session?: IWorkspaceSession } = {};
-        const previousResolver: IDaemonRequestResolver = this.#resolver;
-        const resolver: IDaemonRequestResolver = getResolverLifecycle(previousResolver).createForSession(
-          nativeLock,
-          async () => {
-            const replacementSession: IWorkspaceSession | undefined = validationContext.session;
-            if (!replacementSession) throw new Error('The replacement generation is not initialized.');
-            const current: IWorkspaceInputFingerprint = await this.#captureAsync(
-              replacementSession,
-              envelope
-            );
-            if (
-              classifyWorkspaceInputChange(expectedFingerprint, current) !== WorkspaceInputChangeTier.Reuse
-            ) {
-              throw new WorkspaceEngineRecreationRequiredError();
-            }
-          }
-        );
-        this.#ownedResolvers.add(resolver);
-        try {
-          if (resolver === previousResolver) {
-            throw new Error('A new workspace generation must receive a new resolver instance.');
+      assertValidRequestEnvironment(envelope.environment);
+      await this.#throwRestartBeforeExecutionAsync(
+        envelope,
+        admission,
+        exclusiveLease,
+        currentSession,
+        current,
+        mutation
+      );
+    } catch (error) {
+      if (!(error instanceof RestartBeforeExecution)) exclusiveLease.release();
+      throw error;
+    }
+  }
+
+  async #throwRestartBeforeExecutionAsync(
+    envelope: IDaemonRequestEnvelope,
+    admission: RequestAdmissionController,
+    lease: IRequestLease,
+    session: IWorkspaceSession,
+    fingerprint: IWorkspaceInputFingerprint,
+    mutation: boolean
+  ): Promise<never> {
+    await this.#waitForServedScriptsAsync(
+      admission,
+      this.#getRestartReason(fingerprint, envelope.environment, mutation)
+    );
+    await this.#quiesceWarmSetAsync(session);
+    const workspaceLease: IRequestLease = await admission.acquireAsync(
+      getWorkspaceRequestScheduler(session),
+      RequestExclusivityClass.Exclusive
+    );
+    try {
+      this.#throwIfInstallationChanged();
+      const plan: IWorkspaceProcessRestartPlan = await this.#restartPlanAsync(
+        session,
+        envelope,
+        'hard-input-change'
+      );
+      throw new RestartBeforeExecution(plan, session, lease, workspaceLease);
+    } catch (error) {
+      if (!(error instanceof RestartBeforeExecution)) workspaceLease.release();
+      throw error;
+    }
+  }
+
+  /**
+   * Replaces the current generation: loads a new session and binds a new resolver's engine to it with the command line
+   * of `envelope`. The caller owns the transition and holds `#gate` exclusively. A reload that fails leaves
+   * `#forceReload` set, so that the next request reloads again.
+   */
+  async #reloadAsync(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    options: IReloadOptions
+  ): Promise<IReloadResult> {
+    const { abortSignal, engineCreationSignal } = options;
+    await this.#quiesceWarmSetAsync(session);
+    const workspaceLease: IRequestLease = await options.acquireWorkspaceLeaseAsync(
+      getWorkspaceRequestScheduler(session)
+    );
+    let nativeLock: LockFile;
+    try {
+      nativeLock = await options.acquireNativeLockAsync(session.rushConfiguration.commonTempFolder);
+    } catch (error) {
+      workspaceLease.release();
+      throw error;
+    }
+    let selectionRejection: DaemonRequestDispatchError | undefined;
+    try {
+      const before: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
+      let expectedFingerprint: IWorkspaceInputFingerprint = before;
+      const validationContext: { session?: IWorkspaceSession } = {};
+      const previousResolver: IDaemonRequestResolver = this.#resolver;
+      // A background preparation that a request stopped replaces nothing. From here on it stops only in the engine's
+      // own steps, once the new session and resolver are in place.
+      engineCreationSignal?.throwIfAborted();
+      const resolver: IDaemonRequestResolver = getResolverLifecycle(previousResolver).createForSession(
+        nativeLock,
+        async () => {
+          const replacementSession: IWorkspaceSession | undefined = validationContext.session;
+          if (!replacementSession) throw new Error('The replacement generation is not initialized.');
+          const current: IWorkspaceInputFingerprint = await this.#captureAsync(replacementSession, envelope);
+          if (classifyWorkspaceInputChange(expectedFingerprint, current) !== WorkspaceInputChangeTier.Reuse) {
+            throw new WorkspaceEngineRecreationRequiredError();
           }
-          getResolverLifecycle(resolver);
-        } catch (error) {
-          this.#cleanupFailure = error;
-          throw error;
         }
-        this.#resolver = resolver;
-        try {
-          await previousResolver[Symbol.asyncDispose]?.();
-          this.#ownedResolvers.delete(previousResolver);
-        } catch (error) {
-          this.#cleanupFailure = error;
-          throw error;
+      );
+      this.#ownedResolvers.add(resolver);
+      try {
+        if (resolver === previousResolver) {
+          throw new Error('A new workspace generation must receive a new resolver instance.');
         }
-        const replacementSession: IWorkspaceSession = await this.#options.provider.reloadAsync();
-        validationContext.session = replacementSession;
-        session = replacementSession;
+        getResolverLifecycle(resolver);
+      } catch (error) {
+        this.#cleanupFailure = error;
+        throw error;
+      }
+      this.#resolver = resolver;
+      try {
+        await previousResolver[Symbol.asyncDispose]?.();
+        this.#ownedResolvers.delete(previousResolver);
+      } catch (error) {
+        this.#cleanupFailure = error;
+        throw error;
+      }
+      const replacementSession: IWorkspaceSession = await this.#options.provider.reloadAsync();
+      validationContext.session = replacementSession;
+      session = replacementSession;
+      try {
         await resolver.resolveRequestAsync({
           envelope,
           workspaceSession: session,
-          abortSignal: client.abortSignal
+          abortSignal,
+          engineCreationSignal
         });
-        const after: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
-        if (classifyWorkspaceInputChange(before, after) !== WorkspaceInputChangeTier.Reuse) {
-          this.#forceReload = true;
-          throw new WorkspaceEngineRecreationRequiredError();
-        }
-        this.#resolver = resolver;
-        expectedFingerprint = after;
-        this.#boundSession = session;
-        this.#fingerprint = after;
-        this.#projectFingerprint = await captureProjectConfigurationFingerprintAsync(
-          session.rushConfiguration,
-          this.#terminal
-        );
-        this.#commandIdentity = await getResolverLifecycle(resolver).getCommandParameterIdentityAsync({
-          envelope,
-          workspaceSession: session,
-          abortSignal: client.abortSignal
-        });
-        this.#lastReloadTier = WorkspaceInputChangeTier.Reload;
-        this.#forceReload = false;
-        fingerprint = after;
       } catch (error) {
+        // An invalid selection (such as an unknown project) fails after the new graph was bound. Keep that
+        // generation, so that the next request does not load the whole workspace again.
+        if (!isSelectionRejection(error, session)) throw error;
+        selectionRejection = error;
+      }
+      const invalidationSequence: number = session.invalidations.getSnapshot().sequence;
+      const after: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
+      if (classifyWorkspaceInputChange(before, after) !== WorkspaceInputChangeTier.Reuse) {
         this.#forceReload = true;
-        if (error instanceof AggregateError) this.#cleanupFailure = error;
-        throw error;
-      } finally {
-        nativeLock.release();
-        workspaceLease.release();
+        throw new WorkspaceEngineRecreationRequiredError();
       }
-      this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
-      return {
-        session,
-        resolver: this.#resolver,
-        generation: this.#options.provider.generation,
-        lease,
-        fingerprint
-      };
+      this.#resolver = resolver;
+      expectedFingerprint = after;
+      this.#boundSession = session;
+      this.#fingerprint = after;
+      this.#projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
+      this.#commandIdentity = await getResolverLifecycle(resolver).getCommandParameterIdentityAsync({
+        envelope,
+        workspaceSession: session,
+        abortSignal
+      });
+      this.#lastReloadTier = WorkspaceInputChangeTier.Reload;
+      this.#forceReload = false;
+      return { session, fingerprint: after, selectionRejection, invalidationSequence };
     } catch (error) {
-      if (!(error instanceof RestartBeforeExecution)) lease.release();
+      this.#forceReload = true;
+      if (error instanceof AggregateError) this.#cleanupFailure = error;
       throw error;
     } finally {
-      if (ownsTransition) this.#transitioning = false;
+      nativeLock.release();
+      workspaceLease.release();
+    }
+  }
+
+  /**
+   * Whether nothing runs or waits on this daemon: no request, served rushx script, graph observer, transition or
+   * background preparation, and no pending restart, closing, cleanup failure or installation change.
+   */
+  #isIdle(): boolean {
+    return (
+      this.#activeDispatchCount === 0 &&
+      this.#preparation === undefined &&
+      !this.#transitioning &&
+      !this.#restartPending &&
+      !this.#closing &&
+      this.#cleanupFailure === undefined &&
+      this.#installationChange === undefined &&
+      this.#gate.activeRequestCount === 0 &&
+      this.#gate.queuedRequestCount === 0 &&
+      this.#scripts.activeRequestCount === 0 &&
+      this.#scripts.queuedRequestCount === 0
+    );
+  }
+
+  /**
+   * Starts a background preparation if the kept command line's next request would reload the workspace graph (the
+   * same classification as `#prepareAsync`, from a capture that starts now), the daemon is idle and no other Rush
+   * process holds the repository's lock. It checks each state of the workspace once: a later change, request or
+   * reload makes it check again. It does not act on a change that its capture cannot see, such as an unknown change
+   * or an unhealthy watcher, and it never restarts the daemon; the next request does both, as it would anyway.
+   */
+  async #tryStartPreparationAsync(): Promise<void> {
+    const hint: IPreparationHint | undefined = this.#preparations.hint;
+    if (!hint) return;
+    if (!this.#isIdle()) {
+      this.#preparations.defer();
+      return;
+    }
+    const { session } = hint;
+    if (this.#options.provider.currentSession !== session || this.#detectInstallationChange()) return;
+    const snapshot: IWorkspaceInvalidationSnapshot = session.invalidations.getSnapshot();
+    const check: IPreparationCheck = {
+      session,
+      sequence: snapshot.sequence,
+      boundSession: this.#boundSession,
+      forceReload: this.#forceReload
+    };
+    if (this.#preparations.isChecked(check)) return;
+    if (!snapshot.isWatcherHealthy) {
+      this.#preparations.markChecked(check);
+      return;
+    }
+    if (findNativeLockHolder(session.rushConfiguration.commonTempFolder).pid !== undefined) {
+      this.#preparations.retry();
+      return;
+    }
+    const fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, hint.envelope);
+    if (
+      this.#preparations.hint !== hint ||
+      this.#options.provider.currentSession !== session ||
+      !this.#isIdle()
+    ) {
+      this.#preparations.defer();
+      this.#preparations.resume(this.#isIdle());
+      return;
+    }
+    const tier: WorkspaceInputChangeTier = this.#classify(fingerprint, false);
+    if (
+      tier === WorkspaceInputChangeTier.Restart ||
+      (tier === WorkspaceInputChangeTier.Reuse && this.#boundSession === session && !this.#forceReload)
+    ) {
+      this.#preparations.markChecked(check);
+      return;
+    }
+    this.#startPreparation(hint);
+  }
+
+  /** Takes `#gate` for a background preparation, which the daemon is idle enough to admit at once. */
+  #startPreparation(hint: IPreparationHint): void {
+    const lease: Promise<IRequestLease> = this.#gate.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      noWait: true
+    });
+    const preparation: IBackgroundPreparation = {
+      envelope: { ...hint.envelope, requestId: `background-prepare-${++this.#preparationCount}` },
+      controller: new AbortController()
+    };
+    this.#preparation = preparation;
+    // Requests that arrive now wait behind the transition, with their wait budgets paused while it loads.
+    this.#transitioning = true;
+    this.#scriptsMayPassTransition = true;
+    this.#transitionProgress.setActive(true);
+    void this.#runPreparationAsync(hint, preparation, lease);
+  }
+
+  /**
+   * Reloads the workspace graph and binds the kept command line's engine to it, as the request path does, but never
+   * dispatches the command. It takes native Rush's repository lock before it quiesces anything, without waiting.
+   * A request that it does not serve stops it at its next step (`#stopPreparationUnlessJoined`).
+   */
+  async #runPreparationAsync(
+    hint: IPreparationHint,
+    preparation: IBackgroundPreparation,
+    admitted: Promise<IRequestLease>
+  ): Promise<void> {
+    const { envelope, controller } = preparation;
+    const signal: AbortSignal = AbortSignal.any([this.#abortController.signal, controller.signal]);
+    const description: string = `"rush ${envelope.argv.join(' ')}" in the background (${envelope.requestId})`;
+    const startTimeMs: number = performance.now();
+    let lease: IRequestLease | undefined;
+    let busy: boolean = false;
+    try {
+      lease = await admitted;
+      signal.throwIfAborted();
+      if (this.#restartPending || this.#closing || this.#cleanupFailure !== undefined) return;
+      if (this.#detectInstallationChange()) return;
+      const session: IWorkspaceSession | undefined = this.#options.provider.currentSession;
+      if (session !== hint.session) return;
+      const nativeLock: LockFile | undefined = tryAcquireNativeLock(
+        session.rushConfiguration.commonTempFolder
+      );
+      if (!nativeLock) throw new BackgroundPreparationBusyError();
+      let lockPassed: boolean = false;
+      let result: IReloadResult;
+      try {
+        result = await this.#reloadAsync(session, envelope, {
+          // The resolver keys its parses by this signal, so each preparation needs its own.
+          abortSignal: AbortSignal.any([this.#abortController.signal]),
+          engineCreationSignal: signal,
+          acquireWorkspaceLeaseAsync: (scheduler: RequestScheduler) =>
+            scheduler.acquireAsync({
+              exclusivityClass: RequestExclusivityClass.Exclusive,
+              abortSignal: signal
+            }),
+          acquireNativeLockAsync: async () => {
+            lockPassed = true;
+            return nativeLock;
+          }
+        });
+      } finally {
+        if (!lockPassed) nativeLock.release();
+      }
+      this.#preparations.markPrepared();
+      this.#preparations.remember(result.session, hint.envelope, result.invalidationSequence);
+      const elapsedMs: number = Math.round(performance.now() - startTimeMs);
+      this.#options.onLog?.(
+        result.selectionRejection
+          ? `rushd: loaded the workspace graph for ${description} in ${elapsedMs} ms, but its selection failed: ` +
+              result.selectionRejection.message
+          : `rushd: prepared ${description} in ${elapsedMs} ms`
+      );
+    } catch (error) {
+      if (error instanceof BackgroundPreparationBusyError || error instanceof PhasedCommandEngineBusyError) {
+        busy = true;
+      } else if (signal.aborted || error instanceof WorkspaceEngineRecreationRequiredError) {
+        const reason: unknown = signal.aborted ? signal.reason : error;
+        this.#options.onLog?.(`rushd: stopped preparing ${description}: ${getErrorMessage(reason)}`);
+        // Once the daemon is idle, it checks again, on the session that the preparation loaded if it loaded one.
+        const current: IWorkspaceSession | undefined = this.#options.provider.currentSession;
+        if (current && current !== hint.session && this.#preparations.hint === hint) {
+          this.#preparations.remember(current, hint.envelope);
+        }
+        this.#preparations.defer();
+      } else {
+        this.#preparations.forget();
+        this.#options.onLog?.(`rushd: could not prepare ${description}: ${getErrorMessage(error)}`);
+      }
+    } finally {
+      if (this.#preparation === preparation) this.#preparation = undefined;
+      this.#transitioning = false;
+      this.#transitionProgress.setActive(false);
+      lease?.release();
+      if (busy) this.#preparations.retry();
+      else this.#preparations.resume(this.#isIdle());
+    }
+  }
+
+  /**
+   * Stops the background preparation at its next step unless `envelope` has the same command line and environment,
+   * so that its request can run on the engine that the preparation creates. That request waits behind the
+   * preparation as behind any transition. Any other request needs the workspace for something else.
+   */
+  #stopPreparationUnlessJoined(envelope: IDaemonRequestEnvelope): void {
+    const preparation: IBackgroundPreparation | undefined = this.#preparation;
+    if (!preparation || this.#canJoinPreparation(preparation.envelope, envelope)) return;
+    this.#preparations.defer();
+    preparation.controller.abort(new Error(`request ${envelope.requestId} needs the workspace`));
+  }
+
+  #canJoinPreparation(prepared: IDaemonRequestEnvelope, envelope: IDaemonRequestEnvelope): boolean {
+    return (
+      !isRushxInvocation(envelope) &&
+      !isGraphRequest(envelope) &&
+      !isMutation(envelope) &&
+      isSameCommandLine(envelope, prepared) &&
+      getCaptureEnvironmentKey(envelope.environment) === this.#preparationEnvironmentKey
+    );
+  }
+
+  /**
+   * Admits a served rushx script with a `#gate` lease, or with a `#scriptPassage` lease while the passage is open. A
+   * script that waits behind a transition may be admitted ahead of a reload's owner that still waits for `#gate` (see
+   * `#scriptsMayPassTransition`), and passes once the passage opens.
+   */
+  async #admitScriptAsync(admission: RequestAdmissionController): Promise<IRequestLease> {
+    for (;;) {
+      if (this.#scriptPassage.isOpen) return await this.#scriptPassage.passAsync(admission);
+      if (!this.#transitioning)
+        return await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild);
+      const lease: IRequestLease | undefined = await admission.acquireBehindTransitionAsync(
+        this.#gate,
+        this.#transitionProgress,
+        this.#scriptsMayPassTransition,
+        this.#scriptPassage.opened
+      );
+      if (lease) return lease;
+    }
+  }
+
+  /**
+   * Takes native Rush's repository lock for a reload. While another Rush process holds it, served rushx scripts pass
+   * the reload (see `#scriptPassage`), and the reload then waits until each of them has started or failed. The
+   * requests that still wait behind the reload wait for that process too, and `#transitionProgress` names it.
+   */
+  async #acquireReloadLockAsync(
+    admission: RequestAdmissionController,
+    lockFolder: string
+  ): Promise<LockFile> {
+    const lock: LockFile | undefined = tryAcquireNativeLock(lockFolder);
+    if (lock) return lock;
+    this.#scriptPassage.open();
+    try {
+      return await admission.acquireNativeLockAsync(
+        () => tryAcquireNativeLock(lockFolder),
+        () => findNativeLockHolder(lockFolder),
+        this.#transitionProgress
+      );
+    } finally {
+      await this.#scriptPassage.closeAsync();
+    }
+  }
+
+  /**
+   * Waits, while holding `#gate` exclusively, until no served rushx script is running; none can start meanwhile.
+   * This is contention, not graph-load progress, so requests queued behind it spend their wait timeouts. The client
+   * learns how many scripts still run and, with `restartReason`, why the daemon then restarts; without one, the
+   * request is a native mutation, which runs once they exit and then restarts the daemon. `#transitionProgress`
+   * records the wait, with `followerReason`, so that the requests queued behind this one can say what they wait for.
+   */
+  async #waitForServedScriptsAsync(
+    admission: RequestAdmissionController,
+    restartReason: DaemonRestartReason | undefined,
+    followerReason: DaemonRestartReason | undefined = restartReason
+  ): Promise<void> {
+    const loading: boolean = this.#transitionProgress.active;
+    this.#transitionProgress.setActive(false);
+    try {
+      await admission.waitForServedScriptsAsync(
+        this.#scripts,
+        restartReason,
+        followerReason && { progress: this.#transitionProgress, restartReason: followerReason }
+      );
+    } finally {
+      this.#transitionProgress.setActive(loading);
     }
   }
 
@@ -642,15 +1310,148 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Whether the session's configuration is known to match the workspace inputs: a reload bound this session after
+   * checking that its inputs did not change while it loaded, and they have not changed since. The session that the
+   * daemon loads at startup is not checked that way. An edit made after it loaded, while the startup capture runs,
+   * is in the startup fingerprint but not in the session. Nor does a session count while a reload is pending, for
+   * example after a reload found the Rush lock busy; until a build reloads, a usage error goes to in-process Rush.
+   */
+  #isConfigurationCurrent(session: IWorkspaceSession, tier: WorkspaceInputChangeTier): boolean {
+    return tier === WorkspaceInputChangeTier.Reuse && this.#boundSession === session && !this.#forceReload;
+  }
+
   #captureAsync(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    notBeforeMs?: number
+  ): Promise<IWorkspaceInputFingerprint> {
+    const { rushConfiguration } = session;
+    const { environment } = envelope;
+    return this.#fingerprintCaptures.captureAsync(
+      rushConfiguration,
+      getCaptureEnvironmentKey(environment),
+      () =>
+        captureWorkspaceInputFingerprintAsync({
+          rushConfiguration,
+          environment,
+          runtimePaths: this.#runtimePaths,
+          runtimeCache: this.#runtimeCache
+        }),
+      notBeforeMs
+    );
+  }
+
+  #captureProjectFingerprintAsync(session: IWorkspaceSession, notBeforeMs?: number): Promise<string> {
+    const { rushConfiguration } = session;
+    return this.#projectFingerprintCaptures.captureAsync(
+      rushConfiguration,
+      '',
+      () => captureProjectConfigurationFingerprintAsync(rushConfiguration, this.#terminal),
+      notBeforeMs
+    );
+  }
+
+  /**
+   * Returns undefined, which must not match any fingerprint, if a project's configuration cannot be loaded.
+   * Binding a new generation then reports the error, or hands the request to in-process Rush, which loads only
+   * the projects that a request selects.
+   */
+  async #tryCaptureProjectFingerprintAsync(
+    session: IWorkspaceSession,
+    notBeforeMs?: number
+  ): Promise<string | undefined> {
+    try {
+      return await this.#captureProjectFingerprintAsync(session, notBeforeMs);
+    } catch (error) {
+      if (error instanceof PhasedCommandEngineProjectConfigurationError) return undefined;
+      throw error;
+    }
+  }
+
+  /**
+   * The change that needs a restart may be reverted while the request waits for the restart drain, and requests that
+   * do not need a restart can keep the drain from finishing for as long as they keep arriving. The request therefore
+   * captures its inputs again while it waits, and stops waiting once they no longer need a restart. A request's
+   * environment does not change, so a request that needs a restart for its environment does not capture again.
+   */
+  #createRestartRecheck(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    fingerprint: IWorkspaceInputFingerprint,
+    mutation: boolean
+  ): IWorkspaceRestartRecheck | undefined {
+    if (fingerprint.environmentHash !== this.#startupFingerprint.environmentHash) return undefined;
+    return {
+      intervalMs: RESTART_RECHECK_INTERVAL_MS,
+      stillNeedsRestartAsync: async () =>
+        this.#classify(await this.#recheckCaptureAsync(session, envelope), mutation) ===
+        WorkspaceInputChangeTier.Restart
+    };
+  }
+
+  /**
+   * Every request that waits for a restart drain checks its inputs once per interval, so the waiters share the
+   * latest check's capture, whether it still runs or has settled, until it is one interval old. The checks then cost
+   * one capture per interval however many requests wait, and each waiter still sees a change within about two
+   * intervals. Only requests whose environments match this process's environment check again (see
+   * `#createRestartRecheck`), so every waiter of one workspace configuration requests the same capture.
+   */
+  #recheckCaptureAsync(
     session: IWorkspaceSession,
     envelope: IDaemonRequestEnvelope
   ): Promise<IWorkspaceInputFingerprint> {
-    return captureWorkspaceInputFingerprintAsync({
-      rushConfiguration: session.rushConfiguration,
-      environment: envelope.environment,
-      runtimePaths: this.#runtimePaths,
-      runtimeCache: this.#runtimeCache
+    const { rushConfiguration } = session;
+    const nowMs: number = performance.now();
+    const latest: IRecheckCapture | undefined = this.#recheckCaptures.get(rushConfiguration);
+    if (latest && nowMs - latest.startTimeMs < RESTART_RECHECK_INTERVAL_MS) return latest.fingerprint;
+    const fingerprint: Promise<IWorkspaceInputFingerprint> = this.#captureAsync(session, envelope);
+    this.#recheckCaptures.set(rushConfiguration, { startTimeMs: nowMs, fingerprint });
+    return fingerprint;
+  }
+
+  /**
+   * Says why a request whose inputs need a restart (see `#classify`) needs it, for the request and for rushx scripts
+   * that wait for the restart. A request whose environment differs from the daemon's gets the names of the variables
+   * that differ, whatever else differs. Otherwise the reason names the files that changed, as the latest capture
+   * found them, and the Rush version that the request selects if the daemon does not run it.
+   */
+  #getRestartReason(
+    fingerprint: IWorkspaceInputFingerprint,
+    environment: Readonly<Record<string, string | undefined>>,
+    mutation: boolean
+  ): DaemonRestartReason {
+    const environmentReason: DaemonRestartReason | undefined = getEnvironmentRestartReason(
+      this.#startupEnvironmentEntries,
+      environment
+    );
+    if (environmentReason) return environmentReason;
+    const startup: IWorkspaceInputFingerprint = this.#startupFingerprint;
+    const { selectedRushVersion } = fingerprint;
+    return {
+      kind: 'workspaceInputsChanged',
+      ...(!mutation &&
+        fingerprint.installationHash !== startup.installationHash && {
+          installationFiles: this.#toWorkspacePaths(this.#runtimeCache.changedInstallationPaths)
+        }),
+      ...(fingerprint.runtimeHash !== startup.runtimeHash && {
+        implementationFiles: this.#toWorkspacePaths(
+          this.#runtimeCache.changedPaths.slice(0, MAX_REASON_IMPLEMENTATION_FILES)
+        )
+      }),
+      ...((selectedRushVersion !== Rush.version || selectedRushVersion !== this.#options.rushVersion) && {
+        selectedRushVersion
+      })
+    };
+  }
+
+  /** Makes the paths inside the workspace relative to its root, with forward slashes. */
+  #toWorkspacePaths(filePaths: ReadonlyArray<string>): string[] {
+    return filePaths.map((filePath: string) => {
+      const relativePath: string = path.relative(this.#repoRoot, filePath);
+      return relativePath && !relativePath.startsWith('..') && !path.isAbsolute(relativePath)
+        ? relativePath.split(path.sep).join('/')
+        : filePath;
     });
   }
 
@@ -710,26 +1511,56 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     dispatchAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
     let restart: IWorkspaceProcessRestartPlan | undefined;
+    let installationChange: IDaemonInstallationChange | undefined;
+    // The exit code of a mutation that failed before it changed the installation, as far as the daemon can tell when the
+    // worker exits. The worker's processes are joined after that, so the daemon keeps running only if that still holds.
+    let keptExitCode: number | undefined;
+    const installationBefore: INativeMutationInstallationState | undefined =
+      await captureNativeMutationInstallationStateAsync(generation.session.rushConfiguration);
+    const planWithoutSuccessor = (
+      reason: IWorkspaceProcessRestartPlan['reason'],
+      failure: Error | undefined
+    ): IWorkspaceProcessRestartPlan => ({
+      repoRoot: generation.session.metadata.repoRoot,
+      rushVersion: generation.fingerprint.selectedRushVersion,
+      environment: Object.freeze({ ...envelope.environment }),
+      reason,
+      launch: undefined,
+      failure
+    });
     const prepareRestartAsync: () => Promise<void> = async () => {
       try {
-        restart = await this.#restartPlanAsync(generation.session, envelope, 'native-mutation');
+        // A daemon whose installation changed selects no successor, which would run code that is gone or replaced.
+        if (!this.#detectInstallationChange())
+          restart = await this.#restartPlanAsync(generation.session, envelope, 'native-mutation');
       } catch (error) {
-        restart = {
-          repoRoot: generation.session.metadata.repoRoot,
-          rushVersion: generation.fingerprint.selectedRushVersion,
-          environment: Object.freeze({ ...envelope.environment }),
-          reason: 'native-mutation',
-          launch: undefined,
-          failure: error instanceof Error ? error : new Error(String(error))
-        };
+        restart = planWithoutSuccessor(
+          'native-mutation',
+          error instanceof Error ? error : new Error(String(error))
+        );
       }
+      // Also when it changed while the successor was selected, or made that fail: each client starts one instead.
+      installationChange = this.#detectInstallationChange();
+      if (installationChange) restart = planWithoutSuccessor('installation-changed', undefined);
     };
     const resolver: IDaemonRequestResolver = createNativeMutationResolver(
       envelope,
       generation.fingerprint.selectedRushVersion,
-      async (context) => {
+      async (context, exitCode: number) => {
+        if (
+          exitCode !== 0 &&
+          (await this.#mayKeepAfterFailedMutationAsync(generation, envelope, installationBefore))
+        ) {
+          keptExitCode = exitCode;
+          return;
+        }
         await prepareRestartAsync();
-        if (restart?.failure)
+        if (installationChange)
+          context.terminal.writeWarningLine(
+            `The daemon's installation at ${installationChange.folder} was ${installationChange.change}, so the ` +
+              'daemon exits after this command without starting a new one; the next command starts one.'
+          );
+        else if (restart?.failure)
           context.terminal.writeErrorLine(
             `Mutation completed, but successor startup is unavailable: ${restart.failure.message}`
           );
@@ -748,11 +1579,23 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         }
       });
     } finally {
-      if (state.began) {
+      if (
+        keptExitCode !== undefined &&
+        (await this.#isInstallationUnchangedAfterJoinAsync(generation, installationBefore))
+      ) {
+        // This daemon is now in the state that a reload which found the Rush lock busy leaves: quiescing the warm set
+        // required a reload, so the next request that needs the graph loads it again.
+        this.#options.onLog?.(
+          `rushd: "rush ${envelope.commandName}" failed (exit code ${keptExitCode}) before it changed the ` +
+            'installation, so this daemon keeps running and reloads the workspace for the next request'
+        );
+      } else if (state.began) {
         if (!restart) await prepareRestartAsync();
         if (!state.resultDrained) {
           restart = {
             ...restart!,
+            // Unlike a changed installation, this is a failure that the host reports.
+            reason: 'native-mutation',
             launch: undefined,
             failure: new Error(
               'Mutation result could not be drained; stopping without an automatic successor.'
@@ -761,13 +1604,177 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         }
         this.#lastReloadTier = WorkspaceInputChangeTier.Restart;
         this.#closing = true;
-        this.#restartPending = restart!.launch !== undefined && restart!.failure === undefined;
+        // Requests that are answered from now on retry on the successor, or on the daemon that their client starts.
+        this.#restartPending =
+          restart!.failure === undefined &&
+          (restart!.launch !== undefined || restart!.reason === 'installation-changed');
         generation.session.retire?.();
         this.#options.onRestartRequested(restart!);
       }
     }
   }
 
+  /**
+   * Whether a native mutation that failed may keep this daemon: when its worker exited, the installation was as it
+   * was before, and the workspace inputs don't require a new daemon process for any other reason.
+   */
+  async #mayKeepAfterFailedMutationAsync(
+    generation: IPreparedGeneration,
+    envelope: IDaemonRequestEnvelope,
+    installationBefore: INativeMutationInstallationState | undefined
+  ): Promise<boolean> {
+    try {
+      if (!(await this.#isInstallationUnchangedAsync(generation, installationBefore))) return false;
+      // Classified as for a build, which also compares the installation files, such as a lockfile that the mutation
+      // wrote: a daemon that the next build would restart for its inputs restarts now instead.
+      const fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(generation.session, envelope);
+      return (
+        this.#classify(fingerprint, false) !== WorkspaceInputChangeTier.Restart &&
+        !this.#detectInstallationChange()
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  /** Whether the installation is still as it was once the worker's processes were joined. */
+  async #isInstallationUnchangedAfterJoinAsync(
+    generation: IPreparedGeneration,
+    installationBefore: INativeMutationInstallationState | undefined
+  ): Promise<boolean> {
+    try {
+      // A worker whose processes could not be joined may still be changing the installation.
+      assertWorkspaceRequestResourcesHealthy(generation.session);
+      return await this.#isInstallationUnchangedAsync(generation, installationBefore);
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Whether the files that show a native `install` or `update` changed the installation are as they were before its
+   * worker started, and the daemon's own installation did not change.
+   */
+  async #isInstallationUnchangedAsync(
+    generation: IPreparedGeneration,
+    installationBefore: INativeMutationInstallationState | undefined
+  ): Promise<boolean> {
+    if (!installationBefore) return false;
+    const installationAfter: INativeMutationInstallationState | undefined =
+      await captureNativeMutationInstallationStateAsync(generation.session.rushConfiguration);
+    return (
+      installationAfter !== undefined &&
+      isInstallationUnchangedByMutation(installationBefore, installationAfter) &&
+      !this.#detectInstallationChange()
+    );
+  }
+
+  /**
+   * Returns the change when the daemon's installation was removed or replaced. Such a daemon cannot load the rest of
+   * its code, so from the first detection on it admits no more requests; each request waits in the restart drain for
+   * the requests that the daemon is serving and then gets a restart result instead.
+   */
+  #detectInstallationChange(): IDaemonInstallationChange | undefined {
+    if (this.#installationChange || this.#closing) return this.#installationChange;
+    const change: IDaemonInstallationChange | undefined = this.#options.checkInstallation?.();
+    if (!change) return undefined;
+    this.#installationChange = change;
+    this.#cancelObservers();
+    this.#preparation?.controller.abort(
+      new Error(`the installation at ${change.folder} was ${change.change}`)
+    );
+    this.#options.onLog?.(
+      `rushd: the installation at ${change.folder} was ${change.change}; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon'
+    );
+    return change;
+  }
+
+  /**
+   * Rejects a command that the resolver never serves before the request waits for admission, so that its client can
+   * run the command in-process at once. Otherwise the request would wait, for example behind a build that waits for
+   * the running build before it reloads the graph, and could fail when its own wait timeout ran out. The rejection is
+   * handled as one after admission: once the installation changed, the request gets the restart result instead.
+   */
+  #throwIfUnsupportedCommand(envelope: IDaemonRequestEnvelope): void {
+    if (isRushxInvocation(envelope) || isDaemonGraphCommand(envelope) || isMutation(envelope)) return;
+    const unsupported: DaemonRequestDispatchError | undefined =
+      this.#resolver.workspaceLifecycle?.getUnsupportedCommandError?.(envelope);
+    if (unsupported) throw unsupported;
+  }
+
+  #throwIfInstallationChanged(): void {
+    const change: IDaemonInstallationChange | undefined = this.#detectInstallationChange();
+    if (change) throw new InstallationChangedBeforeExecution(change);
+  }
+
+  /**
+   * Answers a request with a restart result once the requests that the daemon is serving finish (the restart drain),
+   * so that its client does not wait for this daemon to exit while a long build still runs. The first request to get
+   * there asks the host to exit without selecting a successor; each client then starts one with its own launcher.
+   */
+  async #restartForInstallationAsync(
+    envelope: IDaemonRequestEnvelope,
+    client: IDaemonRequestDispatchClient,
+    admission: RequestAdmissionController,
+    ticket: IWorkspaceRestartTicket,
+    change: IDaemonInstallationChange
+  ): Promise<void> {
+    const restartReason: DaemonRestartReason = {
+      kind: 'installationChanged',
+      change: change.change,
+      folder: change.folder
+    };
+    let lease: IRequestLease;
+    try {
+      await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket, restartReason);
+      lease = await admission.acquireBeforeRestartAsync(this.#gate, restartReason);
+    } catch (error) {
+      if (!(error instanceof RequestSchedulerError)) throw error;
+      await writeAdmissionFailureAsync(envelope, client, error);
+      return;
+    }
+    const restarting: boolean = !this.#restartPending;
+    this.#lastReloadTier = WorkspaceInputChangeTier.Restart;
+    this.#restartPending = true;
+    this.#closing = true;
+    try {
+      await client.interactiveSession.finishAsync();
+      await client.writeResultAsync(
+        this.#restartPendingResult(envelope.requestId, new RestartPendingBeforeExecution())
+      );
+    } finally {
+      if (restarting) {
+        this.#options.onRestartRequested({
+          repoRoot: this.#repoRoot,
+          rushVersion: this.#options.rushVersion,
+          environment: Object.freeze({ ...envelope.environment }),
+          reason: 'installation-changed',
+          launch: undefined,
+          failure: undefined
+        });
+      }
+      lease.release();
+    }
+  }
+
+  #restartPendingResult(requestId: string, pending: RestartPendingBeforeExecution): IDaemonCommandResult {
+    const change: IDaemonInstallationChange | undefined = this.#installationChange;
+    if (!change) {
+      const restartReason: IDaemonEnvironmentChangedRestartReason | undefined = this.#restartReason;
+      return {
+        ...preExecutionFailure(requestId, pending),
+        retryAfterRestart: true,
+        ...(restartReason && { restartReason })
+      };
+    }
+    return {
+      ...preExecutionFailure(requestId, new InstallationChangedBeforeExecution(change)),
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: change.change, folder: change.folder }
+    };
+  }
+
   #assertGeneration(generation: IPreparedGeneration): void {
     assertWorkspaceRequestResourcesHealthy(generation.session);
     generation.session.assertActive?.();
@@ -784,6 +1791,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   public [Symbol.asyncDispose](): Promise<void> {
     this.#closing = true;
+    this.#preparations.close();
     this.#abortController.abort();
     this.#cancelObservers();
     this.#disposePromise ??= (async () => {
@@ -792,6 +1800,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       });
       const failures: unknown[] = [];
       try {
+        // Served scripts don't hold `#gate`; they were aborted above, so wait for them to stop.
+        (await this.#scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive })).release();
         for (const resolver of this.#ownedResolvers) {
           try {
             await resolver[Symbol.asyncDispose]?.();
@@ -834,10 +1844,105 @@ function getResolverLifecycle(resolver: IDaemonRequestResolver): IWorkspaceResol
   return resolver.workspaceLifecycle;
 }
 
+/**
+ * Parses the command with the session's configuration. A command line that this configuration rejects fails as
+ * native Rush would only if the configuration is current (`isConfigurationCurrent`). Otherwise native Rush might
+ * accept the command line, for example with a parameter that experiments.json adds, so the client runs it
+ * in-process instead.
+ */
+async function getCommandParameterIdentityAsync(
+  resolver: IDaemonRequestResolver,
+  options: IResolveDaemonRequestOptions,
+  isConfigurationCurrent: boolean
+): Promise<string> {
+  try {
+    return await getResolverLifecycle(resolver).getCommandParameterIdentityAsync(options);
+  } catch (error) {
+    if (error instanceof DaemonRequestUsageError && !isConfigurationCurrent) {
+      throw new DaemonRequestDispatchError('unsupported', error.message, { cause: error });
+    }
+    throw error;
+  }
+}
+
+/**
+ * Parses a custom command before the input capture, or returns `undefined` for a usage error or for an environment
+ * that differs from the daemon's. The parse after the capture answers a usage error only if the configuration is
+ * current (`getCommandParameterIdentityAsync`). The capture classifies an environment that differs, so the daemon
+ * restarts for the request, as it does for build; if the capture found no difference, that parse rejects it.
+ */
+async function tryGetCustomCommandParameterIdentityAsync(
+  resolver: IDaemonRequestResolver,
+  options: IResolveDaemonRequestOptions
+): Promise<string | undefined> {
+  try {
+    return await getResolverLifecycle(resolver).getCommandParameterIdentityAsync(options);
+  } catch (error) {
+    if (error instanceof DaemonRequestUsageError || error instanceof DaemonRequestEnvironmentError) {
+      return undefined;
+    }
+    throw error;
+  }
+}
+
+/** A request rejected as invalid after the resolver bound a graph to the session: its selection failed. */
+function isSelectionRejection(
+  error: unknown,
+  session: IWorkspaceSession
+): error is DaemonRequestDispatchError {
+  return (
+    error instanceof DaemonRequestDispatchError &&
+    error.code === 'invalidRequest' &&
+    session.operationGraph !== undefined
+  );
+}
+
 function isGraphWatch(envelope: IDaemonRequestEnvelope): boolean {
   return isGraphRequest(envelope) && envelope.argv[1] === 'graph' && envelope.argv[2] === 'watch';
 }
 
+/** Only shared builds honor `returnEarlyOnFailure`, as `PhasedRequestRouter` does. */
+function mayContinueAfterResult(
+  envelope: IDaemonRequestEnvelope,
+  exclusivityClass: RequestExclusivityClass
+): boolean {
+  return envelope.returnEarlyOnFailure === true && exclusivityClass === RequestExclusivityClass.SharedBuild;
+}
+
+/** A rejection after which the client runs the command in-process. */
+function isFallbackRejection(error: unknown): error is DaemonRequestDispatchError {
+  return error instanceof DaemonRequestDispatchError && error.code === 'unsupported';
+}
+
+/**
+ * Whether a command that the client runs in-process may run alongside the work that finished requests continue:
+ * a rushx script, or a built-in command that only reads the workspace, such as `rush list`.
+ *
+ * @remarks
+ * The client cannot tell a built-in command from a custom one, so it sends every command that the daemon does not
+ * serve as a custom command. command-line.json cannot reuse a built-in command's name, so the name identifies one.
+ */
+function mayFallBackAlongsideContinuingWork(envelope: IDaemonRequestEnvelope): boolean {
+  return (
+    isRushxInvocation(envelope) ||
+    classifyRushCommand({ commandName: envelope.commandName, commandOrigin: 'built-in' }) ===
+      RequestExclusivityClass.SharedRead
+  );
+}
+
+async function writeAdmissionFailureAsync(
+  envelope: IDaemonRequestEnvelope,
+  client: IDaemonRequestDispatchClient,
+  error: RequestSchedulerError
+): Promise<void> {
+  await client.interactiveSession.finishAsync();
+  await client.writeResultAsync({
+    ...preExecutionFailure(envelope.requestId, getDaemonShutdownReason(client.abortSignal) ?? error),
+    aborted: client.abortSignal.aborted,
+    admissionErrorCode: getRequestAdmissionErrorCode(error)
+  });
+}
+
 function preExecutionFailure(requestId: string, error: Error): IDaemonCommandResult {
   return { requestId, exitCode: 1, outcome: 'failure', aborted: false, errorMessage: error.message };
 }
@@ -845,14 +1950,18 @@ function preExecutionFailure(requestId: string, error: Error): IDaemonCommandRes
 function createLifecycleClient(
   client: IDaemonRequestDispatchClient,
   abortSignal: AbortSignal,
-  state: IExecutionState
+  state: IExecutionState,
+  onResultDrained: () => void,
+  onRequestExclusivityClass: (exclusivityClass: RequestExclusivityClass) => void
 ): IDaemonRequestDispatchClient {
   return {
     abortSignal,
     interactiveSession: client.interactiveSession,
+    receivedTimeMs: client.receivedTimeMs,
     sessionId: client.sessionId,
     supportsRequestAdmission: client.supportsRequestAdmission,
     getNextEventSequence: () => client.getNextEventSequence(),
+    waitForConnectingClientsAsync: async () => await client.waitForConnectingClientsAsync?.(),
     writeEventAsync: (event) => {
       state.began = true;
       return client.writeEventAsync(event);
@@ -862,6 +1971,7 @@ function createLifecycleClient(
       return client.writeLogChunkAsync(operationId, stream, chunk);
     },
     writeQueuePositionAsync: (message) => client.writeQueuePositionAsync(message),
+    writeRequestStartedAsync: client.writeRequestStartedAsync && (() => client.writeRequestStartedAsync!()),
     writeTerminalChunkAsync: (stream, chunk) => {
       state.began = true;
       return client.writeTerminalChunkAsync(stream, chunk);
@@ -874,6 +1984,17 @@ function createLifecycleClient(
       state.terminalAttempted = true;
       await client.writeResultAsync(result);
       state.resultDrained = true;
-    }
+      try {
+        onResultDrained();
+      } catch (error) {
+        // The result was delivered, so this must not turn into a failure to write it.
+        process.emitWarning(error instanceof Error ? error : String(error), {
+          code: 'RUSH_DAEMON_RESULT_DRAINED_CALLBACK_ERROR'
+        });
+      }
+    },
+    onRequestExclusivityClass
+  } as IDaemonRequestDispatchClient & {
+    readonly onRequestExclusivityClass: (exclusivityClass: RequestExclusivityClass) => void;
   };
 }
diff --git a/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts b/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts
index 4c223399eef..23235c98aec 100644
--- a/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts
@@ -4,7 +4,11 @@
 import type { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
-import type { IDaemonRequestResolver, IResolveDaemonRequestOptions } from './DaemonRequestDispatcher';
+import type {
+  DaemonRequestDispatchError,
+  IDaemonRequestResolver,
+  IResolveDaemonRequestOptions
+} from './DaemonRequestDispatcher';
 
 /** Optional lifecycle capabilities retained by resolver decorators across workspace generations. @beta */
 export interface IWorkspaceResolverLifecycle {
@@ -13,6 +17,13 @@ export interface IWorkspaceResolverLifecycle {
     preparationLock?: LockFile,
     validateGraphInputsAsync?: () => Promise<void>
   ): IDaemonRequestResolver;
+  /**
+   * Returns the rejection of a command that the resolver never serves, whatever the state of the workspace, or
+   * undefined. It reads only the envelope, and the workspace lifecycle asks it before it admits the request, so the
+   * client can run such a command in-process at once instead of waiting behind other requests. It is asked about Rush
+   * commands only: not about rushx scripts, `daemon` graph requests, or `install` and `update`.
+   */
+  getUnsupportedCommandError?(envelope: IDaemonRequestEnvelope): DaemonRequestDispatchError | undefined;
 }
 
 /**
@@ -28,7 +39,8 @@ export function wrapWorkspaceResolverLifecycle(
   return (
     lifecycle && {
       getCommandParameterIdentityAsync: (options) => lifecycle.getCommandParameterIdentityAsync(options),
-      createForSession: (lock, validateAsync) => wrap(lifecycle.createForSession(lock, validateAsync))
+      createForSession: (lock, validateAsync) => wrap(lifecycle.createForSession(lock, validateAsync)),
+      getUnsupportedCommandError: (envelope) => lifecycle.getUnsupportedCommandError?.(envelope)
     }
   );
 }
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index 9fb26f6455e..5979ec14dd1 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -1,18 +1,82 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+import { formatDaemonRestartCause, type DaemonRestartRequester } from '@rushstack/rush-client-core';
+
 import { RequestSchedulerError, RequestSchedulerErrorCode } from './RequestScheduler';
 
 const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
+const ENVIRONMENT_RESTART_CAUSE: string = 'for its environment';
+const SCRIPT_TIMEOUT_CLAUSE: string = ', including a rushx script that may not exit until it is stopped';
+// Waiting longer may not help behind a script, such as a dev server, that runs until it is stopped.
+const SCRIPT_TIMEOUT_REMEDY: string = 'Stop the script, or use --wait-timeout <seconds> to wait longer.';
+const TIMEOUT_REMEDY: string = 'Use --wait-timeout <seconds> to wait longer.';
+
+/** Says why the daemon restarts, as the end of "the daemon restarts <cause>", if the reason is known. */
+function formatCause(
+  restartReason: DaemonRestartReason | undefined,
+  requester: DaemonRestartRequester
+): string | undefined {
+  return restartReason && formatDaemonRestartCause(restartReason, requester);
+}
+
+/** Names the waived time, since a drain that waived time times out that much later than the wait timeout. */
+function formatWaivedTime(waivedMs: number): string {
+  const seconds: number = Math.round(waivedMs / 100) / 10;
+  return seconds === 0
+    ? ''
+    : `; ${seconds}s spent waiting for requests that were already running did not count`;
+}
 
 /** One dispatched request tracked by a {@link WorkspaceRestartArbiter}. */
 export interface IWorkspaceRestartTicket {
   readonly waitingForDrain: boolean;
 }
 
+/** Options for {@link WorkspaceRestartArbiter.enter}. */
+export interface IWorkspaceRestartTicketOptions {
+  /** The request runs a rushx script, which can run until it is stopped (for example, a dev server). */
+  readonly runsScript?: boolean;
+}
+
 interface IMutableTicket {
+  /** The request waits for a drain or for a pending restart, so it is not counted as served. */
   waitingForDrain: boolean;
   left: boolean;
+  readonly runsScript: boolean;
+  /** Why the request needs a restart, while it is a restart candidate. */
+  restartReason: DaemonRestartReason | undefined;
+}
+
+interface IWaitKind {
+  /**
+   * The request waits to restart the daemon, so {@link WorkspaceRestartArbiter.hasPendingRestart} reports its restart
+   * to other requests until it leaves.
+   */
+  readonly restarts: boolean;
+  /** Whether the request must keep waiting. */
+  readonly isBlocked: () => boolean;
+  /** The other requests that the request waits for. Their number is reported as its queue position. */
+  readonly getWaitedFor: () => ReadonlySet<IMutableTicket>;
+  /** Why the daemon restarts, if that is known. */
+  readonly getRestartReason: () => DaemonRestartReason | undefined;
+  /** Lets a request that waits to restart find that it no longer needs to. */
+  readonly recheck: IWorkspaceRestartRecheck | undefined;
+  readonly getNoWaitMessage: () => string;
+  /** Begins the timeout message, which goes on to name the requests that the restart waits for. */
+  readonly getTimeoutPrefix: () => string;
+}
+
+/** What a request that waits for a restart waits for, besides how many requests. */
+export interface IWorkspaceRestartWaitReport {
+  /** How many of the requests that the request waits for run a rushx script. */
+  readonly scriptCount: number;
+  /**
+   * Why the daemon restarts: for a restart drain, the request's own reason, and for a rushx script that waits for a
+   * pending restart, the reason of the first request that needs one. Undefined if that request gave no reason.
+   */
+  readonly restartReason: DaemonRestartReason | undefined;
 }
 
 /** Options for {@link WorkspaceRestartArbiter.waitForDrainAsync}, supplied by request admission. */
@@ -20,25 +84,126 @@ export interface IWorkspaceRestartDrainOptions {
   readonly abortSignal: AbortSignal;
   readonly noWait: boolean | undefined;
   readonly waitTimeoutMs: number | undefined;
+  /**
+   * Do not spend `waitTimeoutMs` while a request that was already being served when the wait began is still being
+   * served and no rushx script is. The timeout then limits waiting while a rushx script is served, since a script
+   * may not exit until it is stopped, and waiting for requests that arrived later, which could otherwise keep the
+   * request waiting for as long as they keep arriving.
+   */
+  readonly waivesTimeoutForServedWork?: boolean;
+  /**
+   * Why the request needs the restart that {@link WorkspaceRestartArbiter.waitForDrainAsync} waits for. The admission
+   * errors of the drain name it, as do those of rushx scripts that wait for the restart, and their reports. Without
+   * it, they say that the daemon restarts for the request's environment.
+   */
+  readonly restartReason?: DaemonRestartReason;
+  /**
+   * Called while the request waits with the number of other requests that it waits for, when the wait begins and
+   * whenever that number or the report changes, so that the client can report the wait as a queue position.
+   */
+  readonly onServingCountChanged?: (servingCount: number, report: IWorkspaceRestartWaitReport) => void;
+}
+
+/**
+ * Lets a request that waits for a restart drain find that it no longer needs the restart. The change that needed it
+ * may be reverted during the drain, while requests that do not need a restart keep the drain from finishing.
+ */
+export interface IWorkspaceRestartRecheck {
+  /**
+   * Resolves whether the request still needs the restart. It is called every `intervalMs` while the request waits,
+   * each time after the previous call settles. A call that rejects counts as true.
+   */
+  readonly stillNeedsRestartAsync: () => Promise<boolean>;
+  readonly intervalMs: number;
+}
+
+/** How a wait for a restart drain or a pending restart ended. */
+export interface IWorkspaceRestartWaitResult {
+  /**
+   * How many milliseconds of the wait did not spend `waitTimeoutMs`
+   * (see {@link IWorkspaceRestartDrainOptions.waivesTimeoutForServedWork}).
+   */
+  readonly waivedMs: number;
+  /**
+   * The wait ended because {@link IWorkspaceRestartRecheck.stillNeedsRestartAsync} resolved false, so the request no
+   * longer counts as a pending restart. Otherwise the wait ended because the request no longer had to wait.
+   */
+  readonly restartWithdrawn: boolean;
+}
+
+/** Calls {@link IWorkspaceRestartRecheck.stillNeedsRestartAsync} while a restart candidate waits. */
+class RestartRecheck {
+  /** A call resolved false. */
+  public withdrawn: boolean = false;
+  readonly #recheck: IWorkspaceRestartRecheck;
+  readonly #onWithdrawn: () => void;
+  #timer: ReturnType<typeof setTimeout> | undefined;
+  #stopped: boolean = false;
+
+  public constructor(recheck: IWorkspaceRestartRecheck, onWithdrawn: () => void) {
+    this.#recheck = recheck;
+    this.#onWithdrawn = onWithdrawn;
+    this.#schedule();
+  }
+
+  /** Ignores a call that is still running, and makes no more. */
+  public stop(): void {
+    this.#stopped = true;
+    clearTimeout(this.#timer);
+  }
+
+  #schedule(): void {
+    this.#timer = setTimeout(() => {
+      void this.#recheckAsync();
+    }, this.#recheck.intervalMs);
+  }
+
+  async #recheckAsync(): Promise<void> {
+    let stillNeeded: boolean = true;
+    try {
+      stillNeeded = await this.#recheck.stillNeedsRestartAsync();
+    } catch {
+      // For example, a file that the capture reads was being rewritten. The next call tries again.
+    }
+    if (this.#stopped) return;
+    if (stillNeeded) {
+      this.#schedule();
+    } else {
+      this.withdrawn = true;
+      this.#onWithdrawn();
+    }
+  }
 }
 
 /**
  * Arbitrates process restarts between requests whose environments differ from the running daemon.
  * A request that needs a restart waits until every other request this process can serve has finished,
  * so a mismatched environment never preempts queued or in-flight work that matches the running process.
+ * A request that finds during or after the drain that it no longer needs the restart, since the change that needed it
+ * was reverted, withdraws the restart.
+ * A rushx script that arrives while a restart is pending waits for the restart instead, since it may not exit until
+ * it is stopped and the restart would otherwise wait for it.
  */
 export class WorkspaceRestartArbiter {
   readonly #listeners: Set<() => void> = new Set();
-  #servingCount: number = 0;
+  readonly #countListeners: Set<() => void> = new Set();
+  readonly #serving: Set<IMutableTicket> = new Set();
+  /** Requests that began a restart drain and have not left, so their restarts are still pending. */
+  readonly #restartCandidates: Set<IMutableTicket> = new Set();
 
   /** The number of tracked requests that are not waiting for a restart. */
   public get servingCount(): number {
-    return this.#servingCount;
+    return this.#serving.size;
   }
 
-  public enter(): IWorkspaceRestartTicket {
-    this.#servingCount++;
-    const ticket: IMutableTicket = { waitingForDrain: false, left: false };
+  public enter(options?: IWorkspaceRestartTicketOptions): IWorkspaceRestartTicket {
+    const ticket: IMutableTicket = {
+      waitingForDrain: false,
+      left: false,
+      runsScript: options?.runsScript === true,
+      restartReason: undefined
+    };
+    this.#serve(ticket);
     return ticket;
   }
 
@@ -46,47 +211,194 @@ export class WorkspaceRestartArbiter {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left) return;
     state.left = true;
-    if (!state.waitingForDrain) this.#decrement();
+    this.#restartCandidates.delete(state);
+    if (!state.waitingForDrain) this.#stopServing(state);
+  }
+
+  /**
+   * Whether another tracked request needs to restart the daemon for its environment: it waits for the drain, or it
+   * has drained and not yet left. A request that needs a restart leaves once the restart is planned, or once it
+   * fails or is cancelled. A request that finds it no longer needs one withdraws its restart.
+   */
+  public hasPendingRestart(ticket: IWorkspaceRestartTicket): boolean {
+    return Array.from(this.#restartCandidates).some((candidate: IMutableTicket) => candidate !== ticket);
+  }
+
+  /**
+   * Records that a request which drained for a restart no longer needs one, for example because the change was
+   * reverted, so that requests waiting for its restart stop waiting. Does nothing for other requests.
+   */
+  public withdrawRestart(ticket: IWorkspaceRestartTicket): void {
+    if (this.#restartCandidates.delete(ticket as IMutableTicket)) this.#notifyChange();
   }
 
   /**
    * Waits until no other tracked request is still being served by this process, then counts the ticket
-   * as served again so concurrent restart candidates proceed one at a time.
+   * as served again so concurrent restart candidates proceed one at a time. From when the wait begins until the
+   * ticket leaves, {@link WorkspaceRestartArbiter.hasPendingRestart} reports the restart to other requests. If
+   * `recheck` finds that the request no longer needs the restart, the wait ends then and the restart is withdrawn.
    */
   public async waitForDrainAsync(
+    ticket: IWorkspaceRestartTicket,
+    options: IWorkspaceRestartDrainOptions,
+    recheck?: IWorkspaceRestartRecheck
+  ): Promise<IWorkspaceRestartWaitResult> {
+    const cause: string | undefined = formatCause(options.restartReason, 'thisRequest');
+    return await this.#waitAsync(ticket, options, {
+      restarts: true,
+      isBlocked: () => this.#serving.size > 0,
+      getWaitedFor: () => this.#serving,
+      getRestartReason: () => options.restartReason,
+      recheck,
+      getNoWaitMessage: () =>
+        cause === undefined
+          ? 'Another environment is still being served; the request did not wait for a restart.'
+          : `The daemon is still serving other requests, which finish before it restarts ${cause}; ` +
+            'the request did not wait for a restart.',
+      getTimeoutPrefix: () =>
+        cause === undefined
+          ? `The request was not admitted before the daemon could restart ${ENVIRONMENT_RESTART_CAUSE}, which waits for`
+          : `The request was not admitted before the daemon could restart ${cause}. The restart waits for`
+    });
+  }
+
+  /**
+   * Waits, for a request that runs a rushx script, until no other tracked request needs to restart the daemon for
+   * its environment, then counts the ticket as served again. A script may not exit until it is stopped, so it waits
+   * for a pending restart instead of starting and delaying the restart until it exits. The options apply as for
+   * {@link WorkspaceRestartArbiter.waitForDrainAsync}, and the queue position counts the requests that are served or
+   * need a restart.
+   */
+  public async waitForPendingRestartAsync(
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions
-  ): Promise<void> {
+  ): Promise<IWorkspaceRestartWaitResult> {
+    const getRestartReason = (): DaemonRestartReason | undefined =>
+      Array.from(this.#restartCandidates).find((candidate: IMutableTicket) => candidate !== ticket)
+        ?.restartReason;
+    return await this.#waitAsync(ticket, options, {
+      restarts: false,
+      isBlocked: () => this.hasPendingRestart(ticket),
+      getWaitedFor: () => new Set([...this.#serving, ...this.#restartCandidates]),
+      getRestartReason,
+      recheck: undefined,
+      getNoWaitMessage: () => {
+        const cause: string = formatCause(getRestartReason(), 'anotherRequest') ?? ENVIRONMENT_RESTART_CAUSE;
+        return `Another request is waiting to restart the daemon ${cause}; the rushx script did not wait for the restart.`;
+      },
+      getTimeoutPrefix: () => {
+        const cause: string | undefined = formatCause(getRestartReason(), 'anotherRequest');
+        return (
+          (cause === undefined
+            ? "The rushx script was not admitted before the daemon could restart for another request's environment."
+            : `The rushx script was not admitted before the daemon could restart for another request, ${cause}.`) +
+          ' A script waits for a pending restart so that the restart does not wait for the script, and the ' +
+          'restart waits for'
+        );
+      }
+    });
+  }
+
+  async #waitAsync(
+    ticket: IWorkspaceRestartTicket,
+    options: IWorkspaceRestartDrainOptions,
+    kind: IWaitKind
+  ): Promise<IWorkspaceRestartWaitResult> {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left || state.waitingForDrain) throw new Error('The restart ticket is not being served.');
+    if (kind.restarts) {
+      state.restartReason = options.restartReason;
+      this.#restartCandidates.add(state);
+    }
     state.waitingForDrain = true;
-    this.#decrement();
+    this.#stopServing(state);
+    const waivedFor: IMutableTicket[] = options.waivesTimeoutForServedWork ? Array.from(this.#serving) : [];
+    let remainingMs: number | undefined = options.waitTimeoutMs;
+    let waivedMs: number = 0;
+    let reported: string | undefined;
+    const report = (): void => {
+      const waitedFor: ReadonlySet<IMutableTicket> = kind.getWaitedFor();
+      if (waitedFor.size === 0) return;
+      const waitReport: IWorkspaceRestartWaitReport = {
+        scriptCount: Array.from(waitedFor).filter((waited: IMutableTicket) => waited.runsScript).length,
+        restartReason: kind.getRestartReason()
+      };
+      const key: string = JSON.stringify([waitedFor.size, waitReport.scriptCount, waitReport.restartReason]);
+      if (key !== reported) {
+        reported = key;
+        options.onServingCountChanged?.(waitedFor.size, waitReport);
+      }
+    };
+    // The ticket is a restart candidate for as long as the wait lasts, so withdrawing its restart wakes the wait.
+    const recheck: RestartRecheck | undefined = kind.recheck
+      ? new RestartRecheck(kind.recheck, () => this.withdrawRestart(ticket))
+      : undefined;
     try {
-      const deadline: number | undefined =
-        options.waitTimeoutMs === undefined ? undefined : Date.now() + options.waitTimeoutMs;
-      while (this.#servingCount > 0) {
+      while (!recheck?.withdrawn && kind.isBlocked()) {
         if (options.noWait) {
-          throw new RequestSchedulerError(
-            RequestSchedulerErrorCode.NoWait,
-            'Another environment is still being served; the request did not wait for a restart.'
+          throw new RequestSchedulerError(RequestSchedulerErrorCode.NoWait, kind.getNoWaitMessage());
+        }
+        report();
+        const waived: boolean =
+          !this.#isServingScript() && waivedFor.some((served: IMutableTicket) => this.#serving.has(served));
+        const startedAt: number = Date.now();
+        this.#countListeners.add(report);
+        try {
+          await this.#waitForChangeAsync(
+            options.abortSignal,
+            waived || remainingMs === undefined ? undefined : startedAt + remainingMs,
+            () => this.#createTimeoutError(kind, waivedMs)
           );
+        } finally {
+          this.#countListeners.delete(report);
+          const elapsedMs: number = Date.now() - startedAt;
+          if (waived) waivedMs += elapsedMs;
+          else if (remainingMs !== undefined) remainingMs -= elapsedMs;
         }
-        await this.#waitForChangeAsync(options.abortSignal, deadline);
       }
+      return { waivedMs, restartWithdrawn: recheck?.withdrawn === true };
     } finally {
+      recheck?.stop();
       state.waitingForDrain = false;
-      this.#servingCount++;
+      this.#serve(state);
     }
   }
 
-  #decrement(): void {
-    this.#servingCount--;
-    if (this.#servingCount === 0) {
-      for (const listener of Array.from(this.#listeners)) listener();
-    }
+  #serve(ticket: IMutableTicket): void {
+    this.#serving.add(ticket);
+    this.#notifyChange();
+  }
+
+  #stopServing(ticket: IMutableTicket): void {
+    this.#serving.delete(ticket);
+    this.#notifyChange();
+  }
+
+  /** Reports the new count, and wakes every waiting request to re-check what it waits for. */
+  #notifyChange(): void {
+    for (const listener of Array.from(this.#countListeners)) listener();
+    for (const listener of Array.from(this.#listeners)) listener();
   }
 
-  #waitForChangeAsync(abortSignal: AbortSignal, deadline: number | undefined): Promise<void> {
+  #isServingScript(): boolean {
+    return Array.from(this.#serving).some((served: IMutableTicket) => served.runsScript);
+  }
+
+  #createTimeoutError(kind: IWaitKind, waivedMs: number): RequestSchedulerError {
+    const script: boolean = this.#isServingScript();
+    return new RequestSchedulerError(
+      RequestSchedulerErrorCode.WaitTimeout,
+      `${kind.getTimeoutPrefix()} the requests that the daemon is serving to finish` +
+        `${script ? SCRIPT_TIMEOUT_CLAUSE : ''}${formatWaivedTime(waivedMs)}. ` +
+        (script ? SCRIPT_TIMEOUT_REMEDY : TIMEOUT_REMEDY)
+    );
+  }
+
+  #waitForChangeAsync(
+    abortSignal: AbortSignal,
+    deadline: number | undefined,
+    createTimeoutError: () => RequestSchedulerError
+  ): Promise<void> {
     return new Promise<void>((resolve, reject) => {
       let timer: ReturnType<typeof setTimeout> | undefined;
       const unsubscribe: AbortController = new AbortController();
@@ -99,7 +411,10 @@ export class WorkspaceRestartArbiter {
       };
       const settleAborted = (): void =>
         settle(
-          new RequestSchedulerError(RequestSchedulerErrorCode.Aborted, 'The request was aborted before execution.')
+          new RequestSchedulerError(
+            RequestSchedulerErrorCode.Aborted,
+            'The request was aborted before execution.'
+          )
         );
       if (abortSignal.aborted) {
         settleAborted();
@@ -109,14 +424,7 @@ export class WorkspaceRestartArbiter {
       abortSignal.addEventListener('abort', settleAborted, { once: true, signal: unsubscribe.signal });
       if (deadline !== undefined) {
         timer = setTimeout(
-          () =>
-            settle(
-              new RequestSchedulerError(
-                RequestSchedulerErrorCode.WaitTimeout,
-                'The request was not admitted before the daemon could restart for its environment. ' +
-                  'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.'
-              )
-            ),
+          () => settle(createTimeoutError()),
           Math.min(MAX_TIMER_DELAY_MS, Math.max(0, deadline - Date.now()))
         );
       }
diff --git a/libraries/rush-daemon/src/WorkspaceSession.ts b/libraries/rush-daemon/src/WorkspaceSession.ts
index 620fc006cba..d2216568554 100644
--- a/libraries/rush-daemon/src/WorkspaceSession.ts
+++ b/libraries/rush-daemon/src/WorkspaceSession.ts
@@ -13,7 +13,9 @@ import { WorkspaceWarmSet, type IWorkspaceWarmSetStatus } from './WorkspaceWarmS
 import { getWorkspaceRequestScheduler } from './WorkspaceRequestAdmission';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
 import type {
+  IPeekWorkspaceInvalidationsOptions,
   IWorkspaceEngineShape,
+  IWorkspaceInvalidationPeek,
   IWorkspaceInvalidationReconciliation
 } from './WorkspaceEngineComponentFactory';
 
@@ -63,6 +65,10 @@ export interface IWorkspaceSessionComponents extends AsyncDisposable {
    * `WorkspaceSession` directly disposes only the default watcher that it creates itself.
    */
   readonly projectWatcher?: IWorkspaceInvalidationWatcher;
+  /** Maps retained watcher changes onto operations for an executing iteration, without applying them. */
+  readonly peekInvalidationsAsync?: (
+    options: IPeekWorkspaceInvalidationsOptions
+  ) => Promise<IWorkspaceInvalidationPeek | undefined>;
   readonly reconcileInvalidationsAsync?: () => Promise<IWorkspaceInvalidationReconciliation>;
   readonly rushSession?: RushSession;
 }
@@ -124,6 +130,13 @@ export interface IWorkspaceSession extends AsyncDisposable {
   readonly rushSession: RushSession | undefined;
   /** Binds the first command-dependent engine, if this session supports lazy engine initialization. */
   initializeEngineAsync?(factory: CreateWorkspaceSessionComponentsAsync): Promise<void>;
+  /**
+   * Maps retained watcher changes onto operations for an executing iteration, so that another request's work can
+   * be added to it. Returns undefined if the changes cannot be added to an executing iteration.
+   */
+  peekInvalidationsAsync?(
+    options: IPeekWorkspaceInvalidationsOptions
+  ): Promise<IWorkspaceInvalidationPeek | undefined>;
   reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined>;
 }
 
@@ -411,6 +424,33 @@ export class WorkspaceSession implements IWorkspaceSession {
     return result;
   }
 
+  /**
+   * Maps retained watcher changes onto operations for an executing iteration, without applying them, when
+   * configured. Committing the result also makes its inputs snapshot the session's.
+   */
+  public async peekInvalidationsAsync(
+    options: IPeekWorkspaceInvalidationsOptions
+  ): Promise<IWorkspaceInvalidationPeek | undefined> {
+    assertWorkspaceRequestResourcesHealthy(this);
+    if (this.#isDisposing) {
+      throw new Error('The workspace session is being disposed.');
+    }
+    const peek: IWorkspaceInvalidationPeek | undefined =
+      await this.#components.peekInvalidationsAsync?.(options);
+    return (
+      peek && {
+        inputsSnapshot: peek.inputsSnapshot,
+        invalidatedOperations: peek.invalidatedOperations,
+        invalidationReason: peek.invalidationReason,
+        commit: () => {
+          peek.commit();
+          this.#inputsSnapshot = peek.inputsSnapshot;
+        },
+        discard: () => peek.discard()
+      }
+    );
+  }
+
   async #disposeOnceAsync(): Promise<void> {
     await this.quiesceWarmSetAsync();
     let watcherError: unknown;
diff --git a/libraries/rush-daemon/src/WorkspaceStatus.ts b/libraries/rush-daemon/src/WorkspaceStatus.ts
index 9a35089cd0b..5f032b2dd49 100644
--- a/libraries/rush-daemon/src/WorkspaceStatus.ts
+++ b/libraries/rush-daemon/src/WorkspaceStatus.ts
@@ -4,13 +4,19 @@
 import type { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 
+import { describeContinuingOperations } from './PhasedRequestRouter';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 
-/** Status must never initialize a cold graph or wait behind reload/execution leases. */
+/**
+ * Status must never initialize a cold graph or wait behind reload/execution leases. With `omitWarmSet`, it leaves
+ * the warm set out without reading it, for a ping that only proves the daemon ready. It includes the operations that
+ * the graph still runs only for requests that already have their result; see `describeContinuingOperations`.
+ */
 export function getWorkspaceStatus(
   provider: WorkspaceSessionProvider,
-  lastReloadTier?: WorkspaceInputChangeTier
+  lastReloadTier?: WorkspaceInputChangeTier,
+  omitWarmSet: boolean = false
 ): IDaemonWorkspaceStatus {
   const session: IWorkspaceSession | undefined = provider.currentSession;
   return {
@@ -18,6 +24,7 @@ export function getWorkspaceStatus(
     lastReloadTier,
     generationToken: provider.currentGenerationToken,
     graphInitialized: session?.operationGraph !== undefined,
-    warmSet: session?.warmSetStatus
+    warmSet: omitWarmSet ? undefined : session?.warmSetStatus,
+    continuingOperations: session ? describeContinuingOperations(session) : undefined
   };
 }
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 3b7e5aa5f50..c48aed3b423 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -8,12 +8,14 @@ import {
   type IDaemonConfigurationJson,
   type IOperationExecutionResult,
   type IOperationGraph,
+  type IOperationGraphIterationOptions,
   type IOperationRunner,
   type Operation
 } from '@microsoft/rush-lib';
 import type { IDaemonWarmSetStatus } from '@rushstack/rush-daemon-protocol';
 import { isResourceFreeNullOperationRunner } from '@microsoft/rush-lib/lib/logic/operations/NullOperationRunner';
 
+import { readResidentMemoryBytes } from './DaemonResidentMemory';
 import {
   RequestExclusivityClass,
   RequestSchedulerError,
@@ -56,6 +58,20 @@ interface IProjectHistory {
   requestedTarget: boolean;
 }
 
+interface IRequestedProject {
+  readonly name: string;
+  readonly project: IProjectHistory;
+  /** Whether the project owns a selection root (an enabled operation with no enabled consumer). */
+  readonly requestedTarget: boolean;
+}
+
+/** The projects that one `configureIteration` call planned to run. */
+interface IPlannedRequest {
+  /** The options of the call, which `extendIteration` receives again if the graph accepts the plan. */
+  readonly context: IOperationGraphIterationOptions;
+  readonly projects: ReadonlyArray<IRequestedProject>;
+}
+
 interface IOperationTiming {
   coldDurationMs: number | undefined;
   timeSavedMs: number | undefined;
@@ -84,6 +100,10 @@ export class WorkspaceWarmSet implements AsyncDisposable {
   readonly #projects: Map<string, IProjectHistory> = new Map();
   readonly #timings: Map<Operation, IOperationTiming> = new Map();
   readonly #reusedRunners: WeakSet<IOperationExecutionResult> = new WeakSet();
+  /** The projects that the current iteration requested. */
+  readonly #iterationProjects: Set<IProjectHistory> = new Set();
+  /** A plan of the executing iteration for another request's work, until the graph accepts it. */
+  #extensionPlan: IPlannedRequest | undefined;
   readonly #cleanupFailures: Map<string, string> = new Map();
   #configuration: Readonly<Required<WorkspaceWarmSetConfiguration>>;
   #timer: NodeJS.Timeout | undefined;
@@ -108,24 +128,25 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       project.operations.push(operation);
     }
     const graph: IOperationGraph = options.operationGraph;
-    graph.hooks.configureIteration.tap({ name: PLUGIN_NAME, stage: Infinity }, () => {
-      if (this.#disposed) return;
-      const requested: string[] = [];
-      const requestedAt: number = performance.now();
-      for (const [name, project] of this.#projects) {
-        const enabled: Operation[] = project.operations.filter((operation) => operation.enabled !== false);
-        if (!enabled.length) continue;
-        project.lastUsed = requestedAt;
-        project.frequency++;
-        project.requestedTarget = enabled.some((operation) => !hasEnabledConsumer(operation));
-        requested.push(name);
-      }
-      try {
-        if (this.#configuration.watch) options.watcher.watchProjects(requested);
-      } catch (error) {
-        this.#reportWatcherPolicyFailure(error);
+    graph.hooks.configureIteration.tap(
+      { name: PLUGIN_NAME, stage: Infinity },
+      (states, lastResults, context) => {
+        if (this.#disposed) return;
+        const plan: IPlannedRequest = { context, projects: this.#getRequestedProjects() };
+        if (context.startedOperations) {
+          // The graph can still refuse this plan of the executing iteration for another request's work
+          this.#extensionPlan = plan;
+        } else {
+          this.#extensionPlan = undefined;
+          this.#iterationProjects.clear();
+          this.#countRequest(plan);
+        }
       }
-      this.#schedule(0);
+    );
+    graph.hooks.extendIteration.tap(PLUGIN_NAME, (records, context) => {
+      const plan: IPlannedRequest | undefined = this.#extensionPlan;
+      this.#extensionPlan = undefined;
+      if (!this.#disposed && plan?.context === context) this.#countRequest(plan);
     });
     graph.hooks.beforeExecuteOperationAsync.tap(PLUGIN_NAME, (record) => {
       if (!this.#disposed && record.operation.runner?.isActive) this.#reusedRunners.add(record);
@@ -186,7 +207,7 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       if (isMeasuredMemory(bytes)) measuredRunnerMemoryBytes += bytes;
       else unmeasuredRunnerCount++;
     }
-    const daemonResidentMemoryBytes: number = process.memoryUsage().rss;
+    const daemonResidentMemoryBytes: number = readResidentMemoryBytes();
     return {
       configuration: this.#configuration,
       maintenanceState: this.#getMaintenanceState(),
@@ -233,11 +254,13 @@ export class WorkspaceWarmSet implements AsyncDisposable {
           const now: number = performance.now();
           const delay: number = Math.min(
             MAX_POLL_DELAY_MS,
-            ...this.#rankProjects().map((project) => {
-              const remaining: number =
-                project.lastUsed + this.#configuration.warmIdleTimeoutSeconds * 1000 - now;
-              return remaining > 0 ? Math.max(1, remaining) : RETRY_DELAY_MS;
-            })
+            ...this.#rankProjects()
+              .filter((project) => this.#mayRelease(project))
+              .map((project) => {
+                const remaining: number =
+                  project.lastUsed + this.#configuration.warmIdleTimeoutSeconds * 1000 - now;
+                return remaining > 0 ? Math.max(1, remaining) : RETRY_DELAY_MS;
+              })
           );
           this.#schedule(
             this.#deferredReason || this.#watcherPolicyFailure ? Math.min(delay, RETRY_DELAY_MS) : delay
@@ -286,12 +309,17 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         } else if (isGraphBusy(graph)) {
           this.#deferredReason = 'graph-busy';
         } else {
-          nativeLease = await this.#options.acquireExecutionLeaseAsync();
-          if (this.#disposed) this.#deferredReason = 'disposed';
-          else if (isGraphBusy(graph)) this.#deferredReason = 'graph-busy';
-          else {
-            await this.#evictIdleAsync();
-            if (!this.#disposed) await this.#reconcileWatcherPolicyAsync();
+          const status: IWorkspaceWarmSetStatus = this.getStatus();
+          // Native Rush commands can't start while the repository lock is held, so a pass that would neither
+          // release anything nor change project observation doesn't take it.
+          if (this.#needsNativeLease(status)) {
+            nativeLease = await this.#options.acquireExecutionLeaseAsync();
+            if (this.#disposed) this.#deferredReason = 'disposed';
+            else if (isGraphBusy(graph)) this.#deferredReason = 'graph-busy';
+            else {
+              await this.#evictIdleAsync(status);
+              if (!this.#disposed) await this.#reconcileWatcherPolicyAsync();
+            }
           }
         }
       }
@@ -351,22 +379,82 @@ export class WorkspaceWarmSet implements AsyncDisposable {
     this.#diagnose(this.#watcherPolicyFailure);
   }
 
-  async #evictIdleAsync(): Promise<void> {
+  #getRequestedProjects(): IRequestedProject[] {
+    const requested: IRequestedProject[] = [];
+    for (const [name, project] of this.#projects) {
+      const enabled: Operation[] = project.operations.filter((operation) => operation.enabled !== false);
+      if (enabled.length) {
+        const requestedTarget: boolean = enabled.some((operation) => !hasEnabledConsumer(operation));
+        requested.push({ name, project, requestedTarget });
+      }
+    }
+    return requested;
+  }
+
+  /**
+   * Records the use of the projects of a plan that the graph runs, and observes them. A plan of the executing
+   * iteration for another request's work counts only the projects that the iteration did not request yet.
+   */
+  #countRequest({ projects }: IPlannedRequest): void {
+    const requestedAt: number = performance.now();
+    for (const { project, requestedTarget } of projects) {
+      project.lastUsed = requestedAt;
+      if (!this.#iterationProjects.has(project)) {
+        this.#iterationProjects.add(project);
+        project.frequency++;
+      }
+      project.requestedTarget = requestedTarget;
+    }
+    try {
+      if (this.#configuration.watch) this.#options.watcher.watchProjects(projects.map(({ name }) => name));
+    } catch (error) {
+      this.#reportWatcherPolicyFailure(error);
+    }
+    this.#schedule(0);
+  }
+
+  /** Whether a pass must own the repository to release resources or to apply the observation policy. */
+  #needsNativeLease(status: IWorkspaceWarmSetStatus): boolean {
+    if (this.#watcherPolicyFailure) return true;
+    const projects: IWarmProject[] = this.#rankProjects();
+    if (projects.some((project) => this.#shouldEvict(project, status))) return true;
+    const watched: ReadonlySet<string> = this.#options.watcher.watchedProjectNames;
+    // The same projects that #reconcileWatcherPolicyAsync observes or stops observing.
+    return this.#configuration.watch
+      ? projects.some((project) => !this.#cleanupFailures.has(project.key) && !watched.has(project.key))
+      : projects.some((project) => !project.protected && watched.has(project.key));
+  }
+
+  #shouldEvict(project: IWarmProject, status: IWorkspaceWarmSetStatus): boolean {
+    if (project.protected) return false;
+    const graph: IOperationGraph = this.#options.operationGraph;
+    const expired: boolean =
+      performance.now() - project.lastUsed >= this.#configuration.warmIdleTimeoutSeconds * 1000;
+    const unrequested: boolean =
+      project.frequency === 0 &&
+      project.operations.every(
+        (operation) => !graph.resultByOperation.has(operation) && !operation.runner?.isActive
+      );
+    // Idle expiry and every limit release runners and watchers, and finish an eviction that failed earlier.
+    // Otherwise the retained results of a resource-free project stay until the generation ends: they are
+    // revalidated on every request, they are what makes a warm no-op skip possible, and dropping them cannot
+    // bring daemon RSS below the budget.
+    return (
+      unrequested ||
+      (this.#mayRelease(project) && (expired || status.overMemoryBudget || status.overProjectLimit))
+    );
+  }
+
+  async #evictIdleAsync(initialStatus: IWorkspaceWarmSetStatus): Promise<void> {
     const { operationGraph: graph, watcher } = this.#options;
+    // getStatus() re-ranks every project. Only an eviction attempt (which awaits) can change it during a pass, so
+    // it is reused until then; recomputing it per project made a pass without evictions quadratic.
+    let currentStatus: IWorkspaceWarmSetStatus | undefined = initialStatus;
     // Retention and eviction use exactly the same ordering, reversed only to release the lowest value first.
     for (const project of this.#rankProjects().reverse()) {
       if (this.#disposed) break;
       if (project.protected) continue;
-      const status: IWorkspaceWarmSetStatus = this.getStatus();
-      const expired: boolean =
-        performance.now() - project.lastUsed >= this.#configuration.warmIdleTimeoutSeconds * 1000;
-      const unrequested: boolean =
-        project.frequency === 0 &&
-        project.operations.every(
-          (operation) => !graph.resultByOperation.has(operation) && !operation.runner?.isActive
-        );
-      const overProjectLimit: boolean = status.overProjectLimit && project.holdsResources;
-      if (!unrequested && !expired && !status.overMemoryBudget && !overProjectLimit) continue;
+      if (!this.#shouldEvict(project, (currentStatus ??= this.getStatus()))) continue;
       try {
         await graph.closeRunnersAsync(project.operations);
         if (project.operations.some((operation) => operation.runner?.isActive)) {
@@ -381,9 +469,14 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         this.#cleanupFailures.set(project.key, message);
         this.#diagnose(new Error(message, { cause: error }));
       }
+      currentStatus = undefined;
     }
   }
 
+  #mayRelease(project: IWarmProject): boolean {
+    return project.holdsResources || this.#cleanupFailures.has(project.key);
+  }
+
   #rankProjects(): IWarmProject[] {
     const { operationGraph: graph, watcher, getProtectedOperations } = this.#options;
     const protectedOperations: ReadonlySet<Operation> | undefined = getProtectedOperations?.();
@@ -463,14 +556,14 @@ export class WorkspaceWarmSet implements AsyncDisposable {
   }
 
   #reportPressure(status: IWorkspaceWarmSetStatus): void {
-    // A queued project-cap cleanup is normal during a request; status still exposes the deferral.
-    if (status.deferredReason && !status.overMemoryBudget) return;
+    // Cleanup queued behind a request is normal and status still exposes the deferral. Only a completed pass
+    // shows what remains, and the key ignores the deferral so alternating busy/idle passes do not repeat it.
+    if (status.deferredReason) return;
     const key: string | undefined =
       status.overMemoryBudget || status.overProjectLimit
         ? JSON.stringify([
             status.overMemoryBudget,
             status.overProjectLimit,
-            status.deferredReason,
             status.protectedProjectNames,
             status.cleanupFailures,
             status.unmeasuredRunnerCount
@@ -483,7 +576,7 @@ export class WorkspaceWarmSet implements AsyncDisposable {
             `limit ${this.#configuration.warmSetMaxProjects} projects): daemon RSS ${status.daemonResidentMemoryBytes} bytes, ` +
             `measured child RSS ${status.measuredRunnerMemoryBytes} bytes, ${status.unmeasuredRunnerCount} unmeasured runners, ` +
             `${status.retainedProjectNames.length} retained projects, ${status.protectedProjectNames.length} protected. ` +
-            `Deferred: ${status.deferredReason ?? 'no'}. Active/protected resources and remaining daemon memory cannot be forced below the budget.`
+            `Active or protected resources, resource-free retained results and remaining daemon memory are not released to meet the budget.`
         )
       );
     }
@@ -525,7 +618,8 @@ function hasEnabledConsumer(operation: Operation): boolean {
   return false;
 }
 
-function isGraphBusy(graph: IOperationGraph): boolean {
+/** Whether the graph has an iteration scheduled or running, or is closing. */
+export function isGraphBusy(graph: IOperationGraph): boolean {
   return (
     graph.hasScheduledIteration ||
     graph.status === OperationStatus.Executing ||
diff --git a/libraries/rush-daemon/src/index.ts b/libraries/rush-daemon/src/index.ts
index b8952268723..61d187b0dcb 100644
--- a/libraries/rush-daemon/src/index.ts
+++ b/libraries/rush-daemon/src/index.ts
@@ -10,6 +10,7 @@ export {
   type IDaemonRequestDispatchClient,
   type IDaemonRequestResolver,
   type IDaemonRequestLifecycle,
+  type IDaemonRequestLifecycleInfo,
   type IDispatchWorkspaceRequestOptions,
   type DispatchWorkspaceRequestAsync,
   type IResolvedDaemonGlobalRequest,
@@ -57,11 +58,17 @@ export {
   type IGlobalCommandRequestResult
 } from './GlobalCommandRequestRouter';
 export { RushDaemonHost, type IRushDaemonHostOptions } from './RushDaemonHost';
+export { captureDaemonInstallation, type CheckDaemonInstallation } from './DaemonInstallationMonitor';
 export {
   DaemonShutdownError,
   type DaemonShutdownInitiator,
   type IDaemonShutdownErrorOptions
 } from './DaemonShutdownError';
+export {
+  DaemonShutdownDeadlineError,
+  type DaemonShutdownStage,
+  type IDaemonShutdownDeadlineErrorOptions
+} from './DaemonShutdownDeadlineError';
 export { serveRushDaemonAsync, type IRushDaemonServeOptions } from './serveRushDaemon';
 export {
   WorkspaceEngineComponentFactory,
@@ -70,9 +77,11 @@ export {
   type IClassifyWorkspaceInvalidationsOptions,
   type ICreateWorkspaceEngineComponentsOptions,
   type IMapWorkspaceInvalidationsOptions,
+  type IPeekWorkspaceInvalidationsOptions,
   type IWorkspaceEngineComponentFactoryOptions,
   type IWorkspaceEngineComponents,
   type IWorkspaceEngineShape,
+  type IWorkspaceInvalidationPeek,
   type IWorkspaceInvalidationReconciliation,
   type IsWorkspaceEngineRecreationRequiredAsync,
   type MapWorkspaceInvalidationsToOperationsAsync
@@ -94,6 +103,11 @@ export {
 } from './WorkspaceInvalidationTracker';
 export { type IPhasedRequestClient } from './PhasedRequestClient';
 export { PhasedRequestRouter } from './PhasedRequestRouter';
+export type {
+  IPhasedRequestTelemetryMeasure,
+  IPhasedRequestTelemetryReport,
+  IPhasedRequestTelemetrySink
+} from './PhasedRequestTelemetry';
 export { ProductionDaemonRequestResolver } from './ProductionDaemonRequestResolver';
 export { getWorkspaceGenerationToken } from './WorkspaceGeneration';
 export { RushDaemonRequestResolver } from './RushDaemonRequestResolver';
diff --git a/libraries/rush-daemon/src/serveRushDaemon.ts b/libraries/rush-daemon/src/serveRushDaemon.ts
index 1baec925df9..f7baceaa7f4 100644
--- a/libraries/rush-daemon/src/serveRushDaemon.ts
+++ b/libraries/rush-daemon/src/serveRushDaemon.ts
@@ -1,7 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
+
+import { captureDaemonInstallation, getDaemonInstallationFolders } from './DaemonInstallationMonitor';
+import { DaemonShutdownDeadlineError } from './DaemonShutdownDeadlineError';
 import { DaemonShutdownError } from './DaemonShutdownError';
+import { listenForShutdownSignals } from './DaemonShutdownSignals';
 import { RushDaemonHost } from './RushDaemonHost';
 import type { IRushDaemonHostOptions } from './RushDaemonHost';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from './WorkspaceProcessRestart';
@@ -14,23 +19,94 @@ import { getInstalledWorkspaceSuccessorLaunchAsync } from './WorkspaceProcessRes
 export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
   /** Called after the listener is bound and the lockfile is available. */
   readonly onReady?: (host: RushDaemonHost) => void | Promise<void>;
-  /** Requests a clean shutdown. Process signals are used when omitted. */
+  /**
+   * Requests a clean shutdown. When omitted, the daemon owns its process: the first SIGINT or SIGTERM requests a
+   * clean shutdown, {@link IRushDaemonHostOptions.shutdownDeadlineMs} defaults to 10 seconds and
+   * {@link IRushDaemonHostOptions.idleGarbageCollectionDelayMs} defaults to 10 seconds. If the shutdown
+   * does not finish by then, or another signal arrives first, the daemon reports why, releases what it safely can
+   * and exits the process with code 1. Once it stops, if something else keeps the process running for 2 seconds,
+   * it writes its PID, when it stopped and the active resources that Node.js lists to the daemon log
+   * ({@link IRushDaemonHostOptions.onLog}, or stderr without it) and exits the process, keeping
+   * `process.exitCode`. An embedded daemon never exits the process.
+   */
   readonly shutdownSignal?: AbortSignal;
 }
 
+/**
+ * How long a daemon that owns its process waits for its shutdown to finish before it exits anyway. It covers the
+ * 5 seconds for which a closing connection waits for its requests.
+ */
+export const DEFAULT_SHUTDOWN_DEADLINE_MS: number = 10000;
+
+/**
+ * How long a daemon that owns its process waits after a request, with no request pending and its operation graph
+ * idle, before it returns the heap pages that the request freed to the operating system. V8's memory reducer checks
+ * whether the process is idle every 8 seconds; after requests in a large workspace, it returned them only 12 to 17
+ * seconds after the request, or not at all.
+ */
+export const DEFAULT_IDLE_GARBAGE_COLLECTION_DELAY_MS: number = 10000;
+
+/**
+ * How long a daemon that owns its process waits, after it stops serving, for the process to end by itself before it
+ * exits anyway. By then it has released its socket and lockfile, so `daemon status` and `daemon stop` can no longer
+ * see it; a timer or handle that something else left behind (a plugin, a tool, an SDK) must not keep it running.
+ */
+const EXIT_AFTER_STOP_MS: number = 2000;
+
 /**
  * Starts a daemon host, signals readiness, and serves until shutdown is requested.
  *
+ * @remarks
+ * Unless `checkInstallation` is given, the host checks the folders that this process loaded the daemon and the
+ * Rush engine from before each request. After one of them was removed or replaced, it starts no more requests
+ * and exits once running requests finish.
+ *
  * @beta
  */
 export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Promise<void> {
-  const signalRegistration: IShutdownSignalRegistration = options.shutdownSignal
-    ? { signal: options.shutdownSignal, dispose: () => undefined }
-    : createProcessShutdownSignal();
+  if (options.shutdownSignal) {
+    await serveUntilClosedAsync(options, { signal: options.shutdownSignal, dispose: () => undefined });
+    return;
+  }
+  let host: RushDaemonHost | undefined;
+  const signalRegistration: IShutdownSignalRegistration = listenForShutdownSignals({
+    emitter: process,
+    onForce: (signal: NodeJS.Signals) => {
+      // Nothing to release before the host has started.
+      if (host) host.expireShutdownDeadline(`a second ${signal}`);
+      else process.exit(1);
+    }
+  });
+  try {
+    await serveUntilClosedAsync(
+      {
+        ...options,
+        shutdownDeadlineMs: options.shutdownDeadlineMs ?? DEFAULT_SHUTDOWN_DEADLINE_MS,
+        idleGarbageCollectionDelayMs:
+          options.idleGarbageCollectionDelayMs ?? DEFAULT_IDLE_GARBAGE_COLLECTION_DELAY_MS
+      },
+      signalRegistration,
+      (startedHost: RushDaemonHost) => (host = startedHost)
+    );
+  } catch (error) {
+    if (host && error instanceof DaemonShutdownDeadlineError) exitAfterShutdownDeadline(host, error, options);
+    throw error;
+  } finally {
+    exitIfStillRunning(options);
+  }
+}
+
+async function serveUntilClosedAsync(
+  options: IRushDaemonServeOptions,
+  signalRegistration: IShutdownSignalRegistration,
+  onStarted?: (host: RushDaemonHost) => void
+): Promise<void> {
   let host: RushDaemonHost | undefined;
   try {
     host = await RushDaemonHost.startAsync({
       ...options,
+      checkInstallation:
+        options.checkInstallation ?? captureDaemonInstallation(getDaemonInstallationFolders()),
       getSuccessorLaunchAsync:
         options.getSuccessorLaunchAsync ??
         (async (context) => {
@@ -40,13 +116,100 @@ export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Pr
           return await getInstalledWorkspaceSuccessorLaunchAsync(context);
         })
     });
+    onStarted?.(host);
     await options.onReady?.(host);
     await waitForShutdownAsync(host, signalRegistration.signal);
     await host.closeAsync(getShutdownReason(signalRegistration.signal));
     await host.restartCompleted;
   } finally {
-    signalRegistration.dispose();
-    await host?.closeAsync();
+    try {
+      await host?.closeAsync();
+    } finally {
+      signalRegistration.dispose();
+    }
+  }
+}
+
+/**
+ * Exits a daemon process whose shutdown was cut short. The requests that did not finish already have their typed
+ * results. The 'exit' hook of SubprocessTerminator kills the child processes that it tracks.
+ */
+function exitAfterShutdownDeadline(
+  host: RushDaemonHost,
+  error: DaemonShutdownDeadlineError,
+  options: IRushDaemonServeOptions
+): never {
+  let outcome: string;
+  try {
+    outcome = host.releaseForExit()
+      ? 'The daemon released its socket, lockfile and repository lock, and exits.'
+      : 'The daemon exits and leaves its socket and lockfile to the next daemon, which reaps its child processes.';
+  } catch (releaseError) {
+    outcome = `The daemon exits; it could not release its socket and lockfile: ${String(releaseError)}`;
+  }
+  const report: Error = new Error(`${error.message} ${outcome}`, { cause: error });
+  reportBeforeExit(report, options);
+  process.exit(1);
+}
+
+/**
+ * Exits the process {@link EXIT_AFTER_STOP_MS} after the daemon stopped serving, if it is still running then, and
+ * logs what kept it running. The timer does not keep the process running itself. `process.exit()` keeps an exit
+ * code that the caller set, and the 'exit' hook of SubprocessTerminator kills the child processes that it still
+ * tracks. A successor daemon is not one of them: it is started detached and untracked.
+ */
+function exitIfStillRunning(options: IRushDaemonServeOptions): void {
+  const stoppedAt: string = new Date().toISOString();
+  setTimeout(() => {
+    // Not a failure, so no stack. The log is shared by every daemon of the workspace, hence the PID and the time.
+    logBeforeExit(
+      `rushd (PID ${process.pid}) stopped at ${stoppedAt}, but something kept its process running for ` +
+        `${EXIT_AFTER_STOP_MS / 1000} s, so it exits now. Active resources that Node.js reports: ` +
+        `${describeActiveResources()}.`,
+      options
+    );
+    process.exit();
+  }, EXIT_AFTER_STOP_MS).unref();
+}
+
+function describeActiveResources(): string {
+  const counts: Map<string, number> = new Map();
+  for (const resource of process.getActiveResourcesInfo()) {
+    counts.set(resource, (counts.get(resource) ?? 0) + 1);
+  }
+  const resources: string[] = [];
+  for (const [resource, count] of counts) {
+    resources.push(count > 1 ? `${resource} (${count})` : resource);
+  }
+  return resources.length > 0 ? resources.join(', ') : 'none';
+}
+
+/**
+ * Reports an error right before `process.exit()`. Without `onError`, the report is written synchronously:
+ * `process.emitWarning` prints on the next tick, which never comes.
+ */
+function reportBeforeExit(report: Error, options: IRushDaemonServeOptions): void {
+  if (options.onError) {
+    options.onError(report);
+    return;
+  }
+  writeToStderrBeforeExit(report.stack ?? report.message);
+}
+
+/** Writes a message for the daemon log right before `process.exit()`, synchronously without `onLog`. */
+function logBeforeExit(message: string, options: IRushDaemonServeOptions): void {
+  if (options.onLog) {
+    options.onLog(message);
+    return;
+  }
+  writeToStderrBeforeExit(message);
+}
+
+function writeToStderrBeforeExit(text: string): void {
+  try {
+    fs.writeSync(process.stderr.fd, `${text}\n`);
+  } catch {
+    // The process exits either way.
   }
 }
 
@@ -62,21 +225,6 @@ interface IShutdownSignalRegistration {
   readonly dispose: () => void;
 }
 
-function createProcessShutdownSignal(): IShutdownSignalRegistration {
-  const controller: AbortController = new AbortController();
-  const onSignal: (signal: NodeJS.Signals) => void = (signal: NodeJS.Signals) =>
-    controller.abort(new DaemonShutdownError({ initiator: 'signal', signal }));
-  process.once('SIGINT', onSignal);
-  process.once('SIGTERM', onSignal);
-  return {
-    signal: controller.signal,
-    dispose: () => {
-      process.off('SIGINT', onSignal);
-      process.off('SIGTERM', onSignal);
-    }
-  };
-}
-
 function waitForShutdownAsync(host: RushDaemonHost, signal: AbortSignal): Promise<void> {
   if (signal.aborted) {
     return Promise.resolve();
diff --git a/libraries/rush-daemon/src/start.ts b/libraries/rush-daemon/src/start.ts
index 7f1b6378c24..9234d053b0d 100644
--- a/libraries/rush-daemon/src/start.ts
+++ b/libraries/rush-daemon/src/start.ts
@@ -3,7 +3,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { launchRushDaemonAsync } from './RushDaemonCommandLine';
+import { ignoreClosedReader, launchRushDaemonAsync } from './RushDaemonCommandLine';
+
+process.stdout.on('error', ignoreClosedReader);
+process.stderr.on('error', ignoreClosedReader);
 
 launchRushDaemonAsync().catch((error: Error) => {
   process.stderr.write(`${error.stack ?? error.message}\n`);
diff --git a/libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts b/libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts
new file mode 100644
index 00000000000..a8b48a372b3
--- /dev/null
+++ b/libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts
@@ -0,0 +1,288 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import {
+  BACKGROUND_PREPARE_QUIET_MS,
+  BackgroundPreparationScheduler,
+  getCaptureEnvironmentKey,
+  isSameCommandLine,
+  type IPreparationCheck
+} from '../BackgroundPreparationScheduler';
+import { WorkspaceInvalidationTracker } from '../WorkspaceInvalidationTracker';
+import type { IWorkspaceSession } from '../WorkspaceSession';
+
+const DAEMON_ENVIRONMENT: Readonly<Record<string, string>> = Object.freeze({ PATH: '/daemon/bin' });
+const BUSY_LOG: string =
+  "rushd: another Rush process holds this repository's lock; the daemon prepares in the background " +
+  'once that process releases it';
+
+function createSession(backgroundPrepare: boolean = true): IWorkspaceSession {
+  return {
+    rushConfiguration: { daemon: { backgroundPrepare } },
+    invalidations: new WorkspaceInvalidationTracker()
+  } as unknown as IWorkspaceSession;
+}
+
+function createEnvelope(overrides: Partial<IDaemonRequestEnvelope> = {}): IDaemonRequestEnvelope {
+  return {
+    requestId: 'request-1',
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    argv: ['build', '--to', 'b'],
+    cwd: '/repo/b',
+    environment: { PATH: '/client/bin', TRACEPARENT: '00-client-trace-01' },
+    terminal: { isTTY: true, supportsColor: true, columns: 120 },
+    admission: { waitTimeoutMs: 600_000 },
+    returnEarlyOnFailure: true,
+    ...overrides
+  };
+}
+
+interface ITestScheduler {
+  readonly scheduler: BackgroundPreparationScheduler;
+  readonly checks: jest.Mock<Promise<void>, []>;
+  readonly logs: string[];
+}
+
+function createScheduler(checkAsync: () => Promise<void> = async () => undefined): ITestScheduler {
+  const checks: jest.Mock<Promise<void>, []> = jest.fn(checkAsync);
+  const logs: string[] = [];
+  const scheduler: BackgroundPreparationScheduler = new BackgroundPreparationScheduler({
+    environment: DAEMON_ENVIRONMENT,
+    checkAsync: checks,
+    onLog: (message: string) => logs.push(message)
+  });
+  return { scheduler, checks, logs };
+}
+
+describe(BackgroundPreparationScheduler.name, () => {
+  beforeEach(() => jest.useFakeTimers());
+  afterEach(() => jest.useRealTimers());
+
+  it('S1: checks once, when the remembered session has reported no change for the quiet period', () => {
+    const { scheduler, checks } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    session.invalidations.invalidate('/repo/rush.json');
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    session.invalidations.invalidate('/repo/common/config/rush/command-line.json');
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    expect(checks).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checks).toHaveBeenCalledTimes(1);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).toHaveBeenCalledTimes(1);
+  });
+
+  it("S2: keeps the command line with the daemon's environment, and nothing else of the request", () => {
+    const { scheduler } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    const envelope: IDaemonRequestEnvelope = createEnvelope({ invocationKind: 'rush' });
+    scheduler.remember(session, envelope);
+    expect(scheduler.hint?.session).toBe(session);
+    expect(scheduler.hint?.envelope).toStrictEqual({
+      requestId: '',
+      argv: ['build', '--to', 'b'],
+      commandName: 'build',
+      commandOrigin: 'built-in',
+      cwd: '/repo/b',
+      invocationKind: 'rush',
+      environment: DAEMON_ENVIRONMENT,
+      terminal: { isTTY: false, supportsColor: false }
+    });
+    expect(scheduler.hint?.envelope.argv).not.toBe(envelope.argv);
+    scheduler.remember(session, createEnvelope());
+    expect(scheduler.hint?.envelope).not.toHaveProperty('invocationKind');
+  });
+
+  it('S3: keeps nothing unless the workspace turns the setting on, or after it closes', () => {
+    const { scheduler, checks } = createScheduler();
+    const on: IWorkspaceSession = createSession();
+    scheduler.remember(on, createEnvelope());
+    const off: IWorkspaceSession = createSession(false);
+    scheduler.remember(off, createEnvelope());
+    expect(scheduler.hint).toBeUndefined();
+    on.invalidations.invalidate('/repo/rush.json');
+    off.invalidations.invalidate('/repo/rush.json');
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    scheduler.remember(on, createEnvelope());
+    on.invalidations.invalidate('/repo/rush.json');
+    scheduler.close();
+    scheduler.remember(on, createEnvelope());
+    expect(scheduler.hint).toBeUndefined();
+    on.invalidations.invalidate('/repo/rush.json');
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+  });
+
+  it('S4: waits twice as long for each check while the lock is held, up to 60 s, and logs once per wait', () => {
+    const { scheduler, checks, logs } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    const waits: number[] = [];
+    for (let i: number = 0; i < 8; i++) {
+      const calls: number = checks.mock.calls.length;
+      scheduler.retry();
+      let waitedMs: number = 0;
+      // Gives up after 2 minutes, so that a check that never comes fails this test instead of hanging it.
+      while (checks.mock.calls.length === calls && waitedMs < 120_000) {
+        jest.advanceTimersByTime(1000);
+        waitedMs += 1000;
+      }
+      waits.push(waitedMs);
+    }
+    expect(waits).toEqual([2000, 4000, 8000, 16_000, 32_000, 60_000, 60_000, 60_000]);
+    expect(logs).toEqual([BUSY_LOG]);
+
+    const check: IPreparationCheck = { session, sequence: 0, boundSession: session, forceReload: false };
+    for (const endWait of [() => scheduler.markChecked(check), () => scheduler.markPrepared()]) {
+      endWait();
+      const calls: number = checks.mock.calls.length;
+      scheduler.retry();
+      jest.advanceTimersByTime(1999);
+      expect(checks).toHaveBeenCalledTimes(calls);
+      jest.advanceTimersByTime(1);
+      expect(checks).toHaveBeenCalledTimes(calls + 1);
+    }
+    expect(logs).toEqual([BUSY_LOG, BUSY_LOG, BUSY_LOG]);
+  });
+
+  it('S5: arms a check that was due while the daemon was busy once it is idle', () => {
+    const { scheduler, checks } = createScheduler();
+    scheduler.remember(createSession(), createEnvelope());
+    scheduler.resume(true);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    scheduler.defer();
+    scheduler.resume(false);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+    scheduler.resume(true);
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    expect(checks).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checks).toHaveBeenCalledTimes(1);
+    scheduler.resume(true);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).toHaveBeenCalledTimes(1);
+  });
+
+  it('S6: checks a new session for a change that its watcher reported after its capture', () => {
+    const { scheduler, checks } = createScheduler();
+    const quiet: IWorkspaceSession = createSession();
+    scheduler.remember(quiet, createEnvelope(), quiet.invalidations.getSnapshot().sequence);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    const changed: IWorkspaceSession = createSession();
+    const capturedSequence: number = changed.invalidations.getSnapshot().sequence;
+    changed.invalidations.invalidate('/repo/rush.json');
+    scheduler.remember(changed, createEnvelope(), capturedSequence);
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    expect(checks).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checks).toHaveBeenCalledTimes(1);
+
+    // The same session again: its changes since the subscription were already due.
+    scheduler.remember(changed, createEnvelope(), capturedSequence);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).toHaveBeenCalledTimes(1);
+  });
+
+  it('S7: records the state in which a check found nothing to do, until the session changes', () => {
+    const { scheduler } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    const other: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    const check: IPreparationCheck = { session, sequence: 3, boundSession: session, forceReload: false };
+    expect(scheduler.isChecked(check)).toBe(false);
+    scheduler.markChecked(check);
+    expect(scheduler.isChecked({ ...check })).toBe(true);
+    for (const changed of [
+      { session: other },
+      { sequence: 4 },
+      { boundSession: other },
+      { boundSession: undefined },
+      { forceReload: true }
+    ]) {
+      expect(scheduler.isChecked({ ...check, ...changed })).toBe(false);
+    }
+    scheduler.remember(session, createEnvelope({ argv: ['build'] }));
+    expect(scheduler.isChecked(check)).toBe(true);
+    scheduler.remember(other, createEnvelope());
+    expect(scheduler.isChecked(check)).toBe(false);
+  });
+
+  it('S8: forgets the command line, its pending check and its subscription', () => {
+    const { scheduler, checks } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    session.invalidations.invalidate('/repo/rush.json');
+    scheduler.forget();
+    expect(scheduler.hint).toBeUndefined();
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    session.invalidations.invalidate('/repo/rush.json');
+    scheduler.defer();
+    scheduler.resume(true);
+    scheduler.retry();
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+  });
+
+  it('S9: logs a check that fails', async () => {
+    const { scheduler, logs } = createScheduler(async () => {
+      throw new Error('the capture failed');
+    });
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    session.invalidations.invalidate('/repo/rush.json');
+    await jest.advanceTimersByTimeAsync(BACKGROUND_PREPARE_QUIET_MS);
+    expect(logs).toEqual(['rushd: could not check whether to prepare in the background: the capture failed']);
+  });
+});
+
+describe(isSameCommandLine.name, () => {
+  it('S10: compares the command line and working directory, and nothing else', () => {
+    const envelope: IDaemonRequestEnvelope = createEnvelope();
+    expect(
+      isSameCommandLine(
+        envelope,
+        createEnvelope({
+          requestId: 'request-2',
+          environment: {},
+          terminal: { isTTY: false, supportsColor: false }
+        })
+      )
+    ).toBe(true);
+    for (const changed of [
+      { argv: ['build', '--to', 'c'] },
+      { argv: ['build', '--to'] },
+      { argv: ['build', '--to', 'b', '--verbose'] },
+      { cwd: '/repo' },
+      { commandName: 'rebuild' },
+      { commandOrigin: 'custom' as const },
+      { invocationKind: 'rush' as const }
+    ]) {
+      expect(isSameCommandLine(envelope, createEnvelope(changed))).toBe(false);
+      expect(isSameCommandLine(createEnvelope(changed), envelope)).toBe(false);
+    }
+  });
+});
+
+describe(getCaptureEnvironmentKey.name, () => {
+  it('S11: ignores variables that no workspace capture reads', () => {
+    const environment: Record<string, string> = { PATH: '/bin', MY_TOOL_FLAG: '1' };
+    const key: string = getCaptureEnvironmentKey(environment);
+    expect(getCaptureEnvironmentKey({ ...environment, TRACEPARENT: '00-trace-01' })).toBe(key);
+    expect(getCaptureEnvironmentKey({ ...environment, MY_TOOL_FLAG: '2' })).not.toBe(key);
+    expect(getCaptureEnvironmentKey({ ...environment, RUSH_PREVIEW_VERSION: '5.0.0' })).not.toBe(key);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
new file mode 100644
index 00000000000..913e91cce7d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
@@ -0,0 +1,629 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync)
+  };
+});
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import * as rushLib from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import type { WorkspaceSession } from '../WorkspaceSession';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import {
+  createDeferred,
+  type DaemonRequestWireClient,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const BUILD_B_DESCRIPTION: string = '"rush build --to b --parallelism 3" in the background';
+const BUSY_LOG: string =
+  "rushd: another Rush process holds this repository's lock; the daemon prepares in the background " +
+  'once that process releases it';
+/** Longer than any wait in these tests, so that only the preparation's own progress ends it. */
+const WAIT_TIMEOUT_MS: number = 40_000;
+// A script such as a dev server, which runs until it is stopped.
+const SERVE_A: string = withScriptDeadline(
+  "const fs=require('node:fs');fs.appendFileSync('../runs.txt','serve\\n');" +
+    "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
+    'wait();'
+);
+
+const workspaceCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
+  jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
+
+// The capture's options hold the whole process environment, and jest prints a mock's arguments when an assertion
+// about its calls fails. Tests count the calls instead, so that a failure prints only numbers.
+function captureCount(): number {
+  return workspaceCaptureMock.mock.calls.length;
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/** Matches the log of the preparation with the number `preparation`, or of any preparation without one. */
+function prepared(preparation?: number): RegExp {
+  return new RegExp(
+    `^rushd: prepared ${escapeRegExp(BUILD_B_DESCRIPTION)} ` +
+      `\\(background-prepare-${preparation ?? '\\d+'}\\) in \\d+ ms$`
+  );
+}
+
+function stopped(preparation: number, reason: string): RegExp {
+  return new RegExp(
+    `^rushd: stopped preparing ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-${preparation}\\): ` +
+      `${reason}$`
+  );
+}
+
+/** The daemon's log lines about background preparations. */
+function backgroundLogs(fixture: DaemonGraphTestFixture): string[] {
+  return fixture.logs.filter((message: string) => message.includes('in the background'));
+}
+
+async function waitForLogAsync(fixture: DaemonGraphTestFixture, pattern: RegExp): Promise<void> {
+  await waitForAsync(
+    () => fixture.logs.some((message: string) => pattern.test(message)),
+    `the daemon to log ${pattern}`
+  );
+}
+
+/**
+ * Projects a and b have the build of every fixture. Project a's `quick` script appends `quick` to runs.txt and exits;
+ * its `serve` script runs until the test writes common/temp/release.flag.
+ */
+function createFixtureAsync(
+  backgroundPrepare: boolean = true,
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created) => {
+    created.servesRushx = true;
+    const rushJson: Record<string, unknown> = readRushJson(created);
+    created.write(
+      'rush.json',
+      JSON.stringify({ ...rushJson, daemon: { warmMemoryBudgetMB: 100_000, backgroundPrepare } })
+    );
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: { '_phase:compile': 'node build.cjs', quick: 'node quick.cjs', serve: 'node serve.cjs' }
+      })
+    );
+    created.write('a/quick.cjs', "require('node:fs').appendFileSync('../runs.txt','quick\\n');");
+    created.write('a/serve.cjs', SERVE_A);
+    configure?.(created);
+  });
+}
+
+function readRushJson(fixture: DaemonGraphTestFixture): Record<string, unknown> {
+  return JSON.parse(fs.readFileSync(path.join(fixture.folder, 'rush.json'), 'utf8'));
+}
+
+let rushJsonChanges: number = 0;
+
+/** Changes rush.json, which the daemon watches, so that the next build reloads the workspace graph. */
+function changeRushJson(fixture: DaemonGraphTestFixture, changes: Record<string, unknown> = {}): void {
+  fixture.write(
+    'rush.json',
+    JSON.stringify({ ...readRushJson(fixture), projectFolderMaxDepth: 2 + ++rushJsonChanges, ...changes })
+  );
+}
+
+let commandLineChanges: number = 0;
+
+/** Adds a global command to command-line.json, which the daemon watches, so that the next build reloads the graph. */
+function changeCommandLineJson(fixture: DaemonGraphTestFixture): void {
+  const filename: string = path.join(fixture.folder, 'common/config/rush/command-line.json');
+  const commandLine: { commands: unknown[] } = JSON.parse(fs.readFileSync(filename, 'utf8'));
+  commandLine.commands.push({
+    commandKind: 'global',
+    name: `hello-${++commandLineChanges}`,
+    summary: 'Says hello.',
+    shellCommand: 'node -e ""'
+  });
+  fs.writeFileSync(filename, JSON.stringify(commandLine));
+}
+
+function getScriptEnvelope(fixture: DaemonGraphTestFixture): Partial<IDaemonRequestEnvelope> {
+  return { commandOrigin: 'custom', invocationKind: 'rushx', cwd: path.join(fixture.folder, 'a') };
+}
+
+interface IHold {
+  readonly reached: Promise<void>;
+  release(): void;
+}
+
+/** Holds the next time that the current generation quiesces its warm set, as a reload does first. */
+function holdQuiesce(fixture: DaemonGraphTestFixture): IHold {
+  const session: WorkspaceSession = fixture.session;
+  const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+  const reached: IDeferred<void> = createDeferred<void>();
+  const released: IDeferred<void> = createDeferred<void>();
+  jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementationOnce(async () => {
+    reached.resolve();
+    await released.promise;
+    await quiesceAsync();
+  });
+  return { reached: reached.promise, release: () => released.resolve() };
+}
+
+/** Holds the next workspace session that the daemon creates, before it loads it. */
+function holdSessionCreation(fixture: DaemonGraphTestFixture): IHold {
+  const reached: IDeferred<void> = createDeferred<void>();
+  const released: IDeferred<void> = createDeferred<void>();
+  fixture.beforeCreateSessionAsync = async () => {
+    fixture.beforeCreateSessionAsync = undefined;
+    reached.resolve();
+    await released.promise;
+  };
+  return { reached: reached.promise, release: () => released.resolve() };
+}
+
+interface ILockHolder {
+  releaseAsync(): Promise<void>;
+}
+
+/** Holds native Rush's repository lock in another process, as `rush install` would, until it is released. */
+async function holdRepositoryLockAsync(fixture: DaemonGraphTestFixture): Promise<ILockHolder> {
+  const script: string = [
+    `const { LockFile } = require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))});`,
+    `const lock = LockFile.tryAcquire(${JSON.stringify(path.join(fixture.folder, 'common/temp'))}, 'rush');`,
+    "process.stdout.write(lock ? 'held' : 'busy');",
+    'process.stdin.resume();',
+    "process.stdin.on('end', () => { lock?.release(); process.exit(0); });"
+  ].join('\n');
+  const child: ChildProcess = spawn(process.execPath, ['-e', script], { stdio: ['pipe', 'pipe', 'inherit'] });
+  const releaseAsync = async (): Promise<void> => {
+    if (child.exitCode !== null || child.signalCode !== null) return;
+    const closed: Promise<unknown[]> = once(child, 'close');
+    child.stdin!.end();
+    await closed;
+  };
+  try {
+    const [output] = await once(child.stdout!, 'data');
+    expect(String(output)).toBe('held');
+  } catch (error) {
+    await releaseAsync();
+    throw error;
+  }
+  return { releaseAsync };
+}
+
+interface IStreamedRequest {
+  readonly exchange: Promise<ITerminalExchange>;
+  /** Whether the daemon has reported a queue position for the request. */
+  readonly queued: () => boolean;
+  readonly settled: () => boolean;
+}
+
+/** Starts a request, recording whether it waits in a queue. */
+async function startRequestAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope> = {}
+): Promise<IStreamedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const payload: IDaemonRequestEnvelope = fixture.envelope(argv, {
+    admission: { waitTimeoutMs: WAIT_TIMEOUT_MS },
+    ...overrides
+  });
+  await client.sendControlAsync({ kind: 'requestStart', payload });
+  let queued: boolean = false;
+  let settled: boolean = false;
+  const readAsync = async (): Promise<ITerminalExchange> => {
+    const frames: IDaemonFrame[] = [];
+    try {
+      for (;;) {
+        const frame: IDaemonFrame = await client.readFrameAsync();
+        frames.push(frame);
+        if (frame.kind !== DaemonFrameType.controlJson) continue;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'queuePosition') queued = true;
+        if (
+          (message.kind === 'requestResult' || message.kind === 'requestRejected') &&
+          message.payload.requestId === payload.requestId
+        ) {
+          return { frames, terminal: message };
+        }
+      }
+    } finally {
+      settled = true;
+      await client.closeAsync();
+    }
+  };
+  const exchange: Promise<ITerminalExchange> = readAsync();
+  // A failed expectation leaves the exchange unread until the fixture closes the connection.
+  exchange.catch(() => undefined);
+  return { exchange, queued: () => queued, settled: () => settled };
+}
+
+/**
+ * Holds the next background preparation before it quiesces anything, sends a request while it is held, and releases
+ * it once the request waits behind it.
+ */
+async function sendDuringPreparationAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides?: Partial<IDaemonRequestEnvelope>,
+  change: (changed: DaemonGraphTestFixture) => void = changeRushJson
+): Promise<ITerminalExchange> {
+  const loading: IHold = holdQuiesce(fixture);
+  try {
+    change(fixture);
+    await loading.reached;
+    const request: IStreamedRequest = await startRequestAsync(fixture, argv, overrides);
+    await waitForAsync(
+      () => request.settled() || request.queued(),
+      `"${argv.join(' ')}" to wait behind the preparation`
+    );
+    expect(request.settled()).toBe(false);
+    loading.release();
+    return await request.exchange;
+  } finally {
+    // A failed expectation must not leave the preparation held, or disposing the fixture would wait for it.
+    loading.release();
+  }
+}
+
+describe('background preparation', () => {
+  let fixture: DaemonGraphTestFixture | undefined;
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    const disposed: DaemonGraphTestFixture | undefined = fixture;
+    fixture = undefined;
+    await disposed?.[Symbol.asyncDispose]();
+  });
+
+  it('A1: prepares the next engine of the last build once its inputs change, and the build then reuses it', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    const runs: string[] = fixture.runs();
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(1));
+    expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(prepared(1))]);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.runs()).toEqual(runs);
+
+    // It keeps up with a later change too, with no request in between.
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(2));
+    expect(fixture.host.workspaceGeneration).toBe(generation + 2);
+    expect(engines).toHaveBeenCalledTimes(2);
+
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).toHaveBeenCalledTimes(2);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 2);
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(prepared(1)),
+      expect.stringMatching(prepared(2))
+    ]);
+  });
+
+  it('A2: serves a build of the same command line on the engine that it is preparing', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    expectSuccess(await sendDuringPreparationAsync(fixture, BUILD_B));
+    expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(prepared(1))]);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A3a: stops for a rushx script, and prepares again once the daemon is idle', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+
+    // A served rushx script never runs on a loaded rush.json that changed since, so this changes command-line.json.
+    expectSuccess(
+      await sendDuringPreparationAsync(fixture, ['quick'], getScriptEnvelope(fixture), changeCommandLineJson)
+    );
+    expect(fixture.runs().filter((line: string) => line === 'quick')).toHaveLength(1);
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(stopped(1, 'request graph-\\d+ needs the workspace'))
+    ]);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+
+    await waitForLogAsync(fixture, prepared(2));
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A3b: stops for a graph request, and prepares again once the daemon is idle', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+
+    expectSuccess(await sendDuringPreparationAsync(fixture, ['daemon', 'graph', 'status']));
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(stopped(1, 'request graph-\\d+ needs the workspace'))
+    ]);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+
+    await waitForLogAsync(fixture, prepared(2));
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A3c: stops for a build of another command line, which then loads the workspace itself', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+
+    expectSuccess(await sendDuringPreparationAsync(fixture, ['build', '--to', 'a', '--parallelism', '3']));
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(stopped(1, 'request graph-\\d+ needs the workspace'))
+    ]);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A4: waits while another Rush process holds the repository lock, and logs that once', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const holder: ILockHolder = await holdRepositoryLockAsync(fixture);
+    try {
+      const quiesce: jest.SpyInstance = jest.spyOn(fixture.session, 'quiesceWarmSetAsync');
+      changeRushJson(fixture);
+      await waitForAsync(() => fixture!.logs.includes(BUSY_LOG), 'the preparation to find the lock held');
+      // The next check, 2 s later, finds it held too.
+      await delayAsync(3000);
+      expect(backgroundLogs(fixture)).toEqual([BUSY_LOG]);
+      expect(quiesce).not.toHaveBeenCalled();
+    } finally {
+      await holder.releaseAsync();
+    }
+    // Windows lock files don't say which process holds them, so there each check that finds the lock held starts a
+    // preparation, which stops at once without a log, and the preparation that runs has a later number.
+    const preparation: number | undefined = process.platform === 'win32' ? undefined : 1;
+    await waitForLogAsync(fixture, prepared(preparation));
+    expect(backgroundLogs(fixture)).toEqual([BUSY_LOG, expect.stringMatching(prepared(preparation))]);
+  });
+
+  it('A5: does not prepare for a change that restarts the daemon', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    const quiesce: jest.SpyInstance = jest.spyOn(fixture.session, 'quiesceWarmSetAsync');
+    workspaceCaptureMock.mockClear();
+
+    fixture.write(
+      'common/config/rush/npm-shrinkwrap.json',
+      '{"lockfileVersion":3,"packages":{},"requires":true}'
+    );
+    await waitForAsync(() => workspaceCaptureMock.mock.calls.length > 0, 'the daemon to check the change');
+    await Promise.allSettled(workspaceCaptureMock.mock.results.map((result) => result.value));
+    await delayAsync(500);
+    expect(quiesce).not.toHaveBeenCalled();
+    expect(backgroundLogs(fixture)).toEqual([]);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+  });
+
+  it('A6: does nothing unless rush.json turns it on', async () => {
+    fixture = await createFixtureAsync(false);
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    workspaceCaptureMock.mockClear();
+
+    changeRushJson(fixture);
+    await delayAsync(4000);
+    expect(captureCount()).toBe(0);
+    expect(backgroundLogs(fixture)).toEqual([]);
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+  });
+
+  it('A7: prepares again when the inputs change while it loads', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const loading: IHold = holdSessionCreation(fixture);
+    try {
+      changeRushJson(fixture);
+      await loading.reached;
+      changeRushJson(fixture);
+    } finally {
+      loading.release();
+    }
+    await waitForLogAsync(fixture, prepared(2));
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(
+        stopped(1, 'Workspace changes require the reusable engine and session to be recreated\\.')
+      ),
+      expect.stringMatching(prepared(2))
+    ]);
+
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).not.toHaveBeenCalled();
+  });
+
+  it('A8: stops preparing after a failure until a phased command is served again, and never runs event hooks', async () => {
+    fixture = await createFixtureAsync(true, (created) => {
+      created.write('hook.cjs', "require('node:fs').writeFileSync(__dirname + '/hook-marker.txt', '');");
+    });
+    expectSuccess(await fixture.runAsync(BUILD_B));
+
+    changeRushJson(fixture, { eventHooks: { preRushBuild: ['node hook.cjs'] } });
+    const failed: RegExp = new RegExp(
+      `^rushd: could not prepare ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-1\\): ` +
+        '.*Build event-hook scripts require --no-daemon'
+    );
+    await waitForLogAsync(fixture, failed);
+    workspaceCaptureMock.mockClear();
+    changeRushJson(fixture);
+    await delayAsync(4000);
+    expect(captureCount()).toBe(0);
+    expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(failed)]);
+    expect(fs.existsSync(path.join(fixture.folder, 'hook-marker.txt'))).toBe(false);
+  });
+
+  it('A9: waits until no rushx script runs', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const serving: Promise<ITerminalExchange> = fixture.runAsync(['serve'], getScriptEnvelope(fixture));
+    await Promise.race([
+      waitForAsync(() => fixture!.runs().includes('serve'), 'the script to start'),
+      serving.then((exchange: ITerminalExchange) => {
+        throw new Error(`The script ended before it ran: ${JSON.stringify(exchange.terminal)}`);
+      })
+    ]);
+    const quiesce: jest.SpyInstance = jest.spyOn(fixture.session, 'quiesceWarmSetAsync');
+    workspaceCaptureMock.mockClear();
+
+    try {
+      changeRushJson(fixture);
+      await delayAsync(5000);
+      expect(captureCount()).toBe(0);
+      expect(quiesce).not.toHaveBeenCalled();
+      expect(backgroundLogs(fixture)).toEqual([]);
+    } finally {
+      fixture.write('common/temp/release.flag', '');
+    }
+    expectSuccess(await serving);
+    await waitForLogAsync(fixture, prepared(1));
+  });
+
+  it('A10: builds an input change made after the preparation, on the engine that it prepared', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const runs: string[] = fixture.runs();
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(1));
+    fixture.write('a/input.txt', 'two');
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.runs()).toEqual([...runs, 'a', 'b']);
+  });
+
+  it('A11: builds an input change made while the preparation runs, after its capture', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const runs: string[] = fixture.runs();
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    const loading: IHold = holdQuiesce(fixture);
+    try {
+      changeRushJson(fixture);
+      await loading.reached;
+      fixture.write('a/input.txt', 'two');
+    } finally {
+      loading.release();
+    }
+    await waitForLogAsync(fixture, prepared(1));
+    expect(fixture.runs()).toEqual(runs);
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.runs()).toEqual([...runs, 'a', 'b']);
+  });
+
+  it('A12: stops preparing after a failure that leaves its session current, until a phased command is served again', async () => {
+    const captureAsync: typeof rushLib.captureWorkspaceInputFingerprintAsync =
+      jest.requireActual<typeof rushLib>('@microsoft/rush-lib').captureWorkspaceInputFingerprintAsync;
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    try {
+      // The check captures first. The preparation's own capture comes next, before the reload replaces the session.
+      workspaceCaptureMock
+        .mockImplementationOnce(captureAsync)
+        .mockRejectedValueOnce(new Error('The capture failed.'));
+      changeRushJson(fixture);
+      const failed: RegExp = new RegExp(
+        `^rushd: could not prepare ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-1\\): ` +
+          'The capture failed\\.$'
+      );
+      await waitForLogAsync(fixture, failed);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      workspaceCaptureMock.mockClear();
+      changeRushJson(fixture);
+      await delayAsync(4000);
+      expect(captureCount()).toBe(0);
+      expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(failed)]);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      // Serving the build again turns it back on.
+      expectSuccess(await fixture.runAsync(BUILD_B));
+      changeRushJson(fixture);
+      await waitForLogAsync(fixture, prepared(2));
+      expect(backgroundLogs(fixture)).toEqual([
+        expect.stringMatching(failed),
+        expect.stringMatching(prepared(2))
+      ]);
+    } finally {
+      // A capture queued above that the daemon never made must not reach a later test.
+      workspaceCaptureMock.mockReset();
+      workspaceCaptureMock.mockImplementation(captureAsync);
+    }
+  });
+
+  it('E1: prepares with the environment of the daemon, and not of the client whose build it prepares again', async () => {
+    const traceParent: string = '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01';
+    fixture = await createFixtureAsync();
+    const traced: Partial<IDaemonRequestEnvelope> = {
+      environment: { ...fixture.environment, TRACEPARENT: traceParent }
+    };
+    expectSuccess(await fixture.runAsync(BUILD_B, traced));
+    const parses: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine, 'parseAsync');
+
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(1));
+    expect(parses).toHaveBeenCalled();
+    for (const [options] of parses.mock.calls as [rushLib.IParsePhasedCommandOptions][]) {
+      expect(options.environment?.TRACEPARENT).not.toBe(traceParent);
+    }
+
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+    expectSuccess(await fixture.runAsync(BUILD_B, traced));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).not.toHaveBeenCalled();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts b/libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts
new file mode 100644
index 00000000000..a5b2fd2d71d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts
@@ -0,0 +1,166 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { ConnectingClientTracker } from '../ConnectingClientTracker';
+import type { IConnectingClient } from '../ConnectingClientTracker';
+
+interface IObservedWait {
+  readonly done: boolean;
+}
+
+function observe(waitPromise: Promise<void>): IObservedWait {
+  const observed: { done: boolean } = { done: false };
+  void waitPromise.then(() => {
+    observed.done = true;
+  });
+  return observed;
+}
+
+// With fake timers, an immediate that is queued while timers run fires 1 ms later. So a wait that the tracker
+// resumes from a timer, which then lets the event loop poll, ends a few milliseconds after that timer.
+describe(ConnectingClientTracker.name, () => {
+  beforeEach(() => jest.useFakeTimers());
+  afterEach(() => jest.useRealTimers());
+
+  it('does not wait when no connection is connecting', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(5);
+    expect(wait.done).toBe(true);
+    expect(jest.getTimerCount()).toBe(0);
+  });
+
+  it('waits for a connection that the event loop accepts after the wait began', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    // The daemon accepts a connection when the event loop polls for I/O. The wait's first immediate can run before
+    // that poll, and this one runs after it.
+    setImmediate(() => tracker.add());
+    await jest.advanceTimersByTimeAsync(99);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(11);
+    expect(wait.done).toBe(true);
+  });
+
+  it('stops waiting as soon as the connection settles', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const client: IConnectingClient = tracker.add();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(40);
+    expect(wait.done).toBe(false);
+    client.settle();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.done).toBe(true);
+    expect(jest.getTimerCount()).toBe(0);
+  });
+
+  it('counts a connection as idle once its latest frame is as old as the idle limit', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 1000
+    });
+    tracker.add();
+    await jest.advanceTimersByTimeAsync(99);
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(1);
+    expect(wait.done).toBe(true);
+  });
+
+  it('measures the idle limit from the latest frame rather than from the start of the wait', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 1000
+    });
+    tracker.add();
+    await jest.advanceTimersByTimeAsync(30);
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(60);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(20);
+    expect(wait.done).toBe(true);
+
+    // The connection never sent a request, so it stays tracked, but a later wait does not wait for it.
+    await jest.advanceTimersByTimeAsync(500);
+    const laterWait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(5);
+    expect(laterWait.done).toBe(true);
+  });
+
+  it('keeps waiting while the connection receives frames, up to the wait limit', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 250
+    });
+    const client: IConnectingClient = tracker.add();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(90);
+    client.touch();
+    await jest.advanceTimersByTimeAsync(90);
+    expect(wait.done).toBe(false);
+    client.touch();
+    await jest.advanceTimersByTimeAsync(69);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(11);
+    expect(wait.done).toBe(true);
+  });
+
+  it('reads the frames that already arrived before it decides that another connection is idle', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 1000
+    });
+    const other: IConnectingClient = tracker.add();
+    await jest.advanceTimersByTimeAsync(50);
+    const requesting: IConnectingClient = tracker.add();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(70);
+
+    // The event loop reads the other connection's frame in the same poll as the request, after it.
+    setImmediate(() => other.touch());
+    requesting.settle();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(99);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(11);
+    expect(wait.done).toBe(true);
+  });
+
+  it('ignores frames and repeated settles after the connection settled', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const client: IConnectingClient = tracker.add();
+    client.settle();
+    client.settle();
+    client.touch();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(5);
+    expect(wait.done).toBe(true);
+  });
+
+  it('wakes every wait when a connection settles, and each keeps waiting for the others', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const first: IConnectingClient = tracker.add();
+    const second: IConnectingClient = tracker.add();
+    const waits: IObservedWait[] = [observe(tracker.waitAsync()), observe(tracker.waitAsync())];
+    await jest.advanceTimersByTimeAsync(10);
+    first.settle();
+    await jest.advanceTimersByTimeAsync(5);
+    expect(waits.map((wait: IObservedWait) => wait.done)).toEqual([false, false]);
+    second.settle();
+    await jest.advanceTimersByTimeAsync(5);
+    expect(waits.map((wait: IObservedWait) => wait.done)).toEqual([true, true]);
+    expect(jest.getTimerCount()).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonClientGone.test.ts b/libraries/rush-daemon/src/test/DaemonClientGone.test.ts
new file mode 100644
index 00000000000..2d050acfd0d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonClientGone.test.ts
@@ -0,0 +1,308 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  createDaemonHello,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage,
+  encodeDaemonFrame
+} from '@rushstack/rush-daemon-protocol';
+import type { DaemonControlMessage, IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+import { DaemonTransportError, DaemonTransportErrorCode } from '@rushstack/rush-daemon-transport';
+import type { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
+
+import { DaemonControlSession } from '../DaemonControlSession';
+import { DaemonRequestDispatchError } from '../DaemonRequestDispatcher';
+import type { DaemonRequestDispatcher } from '../DaemonRequestDispatcher';
+import { RushDaemonHost } from '../RushDaemonHost';
+import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+const DAEMON_VERSION: string = '0.1.0-test';
+const WENT_AWAY: string = 'rushd: a client went away before its reply; dropped';
+const LOG_WAIT_MS: number = 2000;
+const LOG_POLL_MS: number = 10;
+
+const posixDescribe: jest.Describe = process.platform === 'win32' ? describe.skip : describe;
+
+function createSocketError(code: string, message: string): NodeJS.ErrnoException {
+  return Object.assign(new Error(message), { code });
+}
+
+function createClosedConnectionError(): DaemonTransportError {
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.transportClosed,
+    'Cannot send a frame on a closed connection.'
+  );
+}
+
+/** Lets every pending promise callback and `process.nextTick` callback run. */
+function flushAsync(): Promise<void> {
+  return new Promise((resolve: () => void) => setImmediate(resolve));
+}
+
+/**
+ * Stands in for a socket connection. A send that fails first closes the connection with its error and then
+ * rejects, in the order that a socket reports a failed write.
+ */
+class FakeConnection {
+  public readonly sentKinds: string[] = [];
+  public failSendsWith: Error | undefined;
+  #frameHandler: ((frame: IDaemonFrame) => void | Promise<void>) | undefined;
+  #closedHandler: ((error: Error | undefined) => void) | undefined;
+  #closed: boolean = false;
+
+  public onFrame(handler: (frame: IDaemonFrame) => void | Promise<void>): void {
+    this.#frameHandler = handler;
+  }
+
+  public onClosed(handler: (error: Error | undefined) => void): void {
+    this.#closedHandler = handler;
+  }
+
+  public async sendFrameAsync(frame: IDaemonFrame): Promise<void> {
+    if (this.#closed) throw createClosedConnectionError();
+    if (this.failSendsWith) {
+      this.closeFromPeer(this.failSendsWith);
+      throw this.failSendsWith;
+    }
+    this.sentKinds.push(decodeDaemonControlMessage(frame.payload).kind);
+  }
+
+  public async closeAsync(): Promise<void> {
+    process.nextTick(() => this.closeFromPeer(undefined));
+  }
+
+  public abort(error: Error): void {
+    process.nextTick(() => this.closeFromPeer(error));
+  }
+
+  public async receiveAsync(message: DaemonControlMessage): Promise<void> {
+    await this.#frameHandler!({
+      kind: DaemonFrameType.controlJson,
+      payload: encodeDaemonControlMessage(message)
+    });
+  }
+
+  public closeFromPeer(error: Error | undefined): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#closedHandler?.(error);
+  }
+}
+
+interface ITestSession {
+  readonly connection: FakeConnection;
+  readonly session: DaemonControlSession;
+  readonly errors: Error[];
+  readonly logs: string[];
+  readonly closeErrors: (Error | undefined)[];
+  readonly shutdownRequests: string[];
+}
+
+function createTestSession(dispatcher: Partial<DaemonRequestDispatcher> = {}): ITestSession {
+  const connection: FakeConnection = new FakeConnection();
+  const errors: Error[] = [];
+  const logs: string[] = [];
+  const closeErrors: (Error | undefined)[] = [];
+  const shutdownRequests: string[] = [];
+  const session: DaemonControlSession = new DaemonControlSession(
+    connection as unknown as DaemonFrameConnection,
+    {
+      daemonVersion: DAEMON_VERSION,
+      dispatcher: dispatcher as DaemonRequestDispatcher,
+      startedAtMs: Date.now(),
+      onClosed: (closedSession: DaemonControlSession, error: Error | undefined) => closeErrors.push(error),
+      onError: (error: Error) => errors.push(error),
+      onLog: (message: string) => logs.push(message),
+      onShutdownRequested: () => shutdownRequests.push('shutdown')
+    }
+  );
+  return { connection, session, errors, logs, closeErrors, shutdownRequests };
+}
+
+async function handshakeAsync(connection: FakeConnection): Promise<void> {
+  await connection.receiveAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+  await connection.receiveAsync({
+    kind: 'subscribe',
+    payload: { isTTY: false, supportsRequestLifecycle: true }
+  });
+}
+
+describe('DaemonControlSession with a client that went away', () => {
+  it('logs one line, and reports no error, for a reply whose send fails with EPIPE', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    await connection.receiveAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, closeErrors }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the helloAck (write EPIPE)`],
+      closeErrors: [undefined]
+    });
+  });
+
+  it('treats ECONNRESET the same as EPIPE', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('ECONNRESET', 'write ECONNRESET');
+    await connection.receiveAsync({ kind: 'ping', payload: {} });
+    await flushAsync();
+    await session.closeAsync();
+    expect(connection.sentKinds).toEqual(['helloAck']);
+    expect({ errors, logs, closeErrors }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the pong (write ECONNRESET)`],
+      closeErrors: [undefined]
+    });
+  });
+
+  it('logs one line for each later reply that finds the connection closed', async () => {
+    const { connection, session, errors, logs } = createTestSession();
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    // Both pings are handled before the first pong fails, as when a client sends them and leaves.
+    await Promise.all([
+      connection.receiveAsync({ kind: 'ping', payload: {} }),
+      connection.receiveAsync({ kind: 'ping', payload: {} })
+    ]);
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs }).toEqual({
+      errors: [],
+      logs: [
+        `${WENT_AWAY} the pong (write EPIPE)`,
+        `${WENT_AWAY} the pong (Cannot send a frame on a closed connection.)`
+      ]
+    });
+  });
+
+  it('logs one line for a lost shutdown acknowledgement and still requests the shutdown', async () => {
+    const { connection, session, errors, logs, shutdownRequests } = createTestSession();
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    await connection.receiveAsync({ kind: 'shutdown', payload: {} });
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, shutdownRequests }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the shutdownAck (write EPIPE)`],
+      shutdownRequests: ['shutdown']
+    });
+  });
+
+  it('logs one line for a lost request outcome', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession({
+      dispatchAsync: async () => {
+        throw new DaemonRequestDispatchError('unsupported', 'No route for "build".');
+      }
+    });
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    await connection.receiveAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope('request-1', 'build', os.tmpdir())
+    });
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, closeErrors }).toEqual({
+      errors: [],
+      logs: [
+        'rushd: rejected request request-1 (unsupported): No route for "build".',
+        `${WENT_AWAY} the result of "build" (write EPIPE)`
+      ],
+      closeErrors: [undefined]
+    });
+  });
+
+  it('reports nothing when a client resets a connection that has no reply pending', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    await handshakeAsync(connection);
+    connection.closeFromPeer(createSocketError('ECONNRESET', 'read ECONNRESET'));
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, closeErrors }).toEqual({ errors: [], logs: [], closeErrors: [undefined] });
+  });
+
+  it.each([
+    ['another socket error', createSocketError('EIO', 'write EIO')],
+    ['a closed connection that no client-gone error closed', createClosedConnectionError()]
+  ])('still reports %s as an error', async (description: string, failure: Error) => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    connection.failSendsWith = failure;
+    await connection.receiveAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+    await flushAsync();
+    await session.closeAsync();
+    expect(logs).toEqual([]);
+    expect(errors).toHaveLength(1);
+    expect(errors[0]).toBe(failure);
+    expect(closeErrors).toHaveLength(1);
+    expect(closeErrors[0]).toBe(failure);
+  });
+});
+
+// Only the POSIX socket error codes were observed; a Windows named pipe may report a closed client differently.
+posixDescribe('RushDaemonHost with a client socket that closes before its reply', () => {
+  let repoRoot: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-daemon-client-gone-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  it('logs one line, and reports no error, for the lost hello acknowledgement', async () => {
+    const errors: Error[] = [];
+    const logs: string[] = [];
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      daemonVersion: DAEMON_VERSION,
+      repoRoot,
+      rushVersion: '5.178.1',
+      createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+      onError: (error: Error) => errors.push(error),
+      onLog: (message: string) => logs.push(message)
+    });
+    try {
+      const socket: net.Socket = await new Promise(
+        (resolve: (socket: net.Socket) => void, reject: (error: Error) => void) => {
+          const connecting: net.Socket = net.createConnection(host.paths.socketPath, () =>
+            resolve(connecting)
+          );
+          connecting.once('error', reject);
+        }
+      );
+      const socketClosed: Promise<void> = new Promise((resolve: () => void) => socket.once('close', resolve));
+      socket.write(
+        encodeDaemonFrame({
+          kind: DaemonFrameType.controlJson,
+          payload: encodeDaemonControlMessage(createDaemonHello(DAEMON_PROTOCOL_VERSION))
+        })
+      );
+      socket.destroy();
+      await socketClosed;
+      const deadlineMs: number = Date.now() + LOG_WAIT_MS;
+      while (!logs.some((message: string) => message.startsWith(WENT_AWAY)) && Date.now() < deadlineMs) {
+        await new Promise<void>((resolve: () => void) => setTimeout(resolve, LOG_POLL_MS));
+      }
+    } finally {
+      await host.closeAsync();
+    }
+    expect({
+      errors,
+      logs: logs.filter((message: string) => message.startsWith(WENT_AWAY))
+    }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the helloAck (write EPIPE)`]
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts b/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
new file mode 100644
index 00000000000..8f22e1c18af
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
@@ -0,0 +1,169 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
+import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
+
+const RUSHD_PATH: string = path.join(__dirname, '..', 'start.js');
+const POLL_INTERVAL_MS: number = 20;
+const START_TIMEOUT_MS: number = 15000;
+// Far longer than the daemon takes to write its ready line once it listens.
+const AFTER_READY_MS: number = 500;
+const READY_LINE: RegExp = /rushd ready at (\S+) \(PID \d+\)\n/;
+
+interface IProcessExit {
+  readonly code: number | undefined;
+  readonly signal: NodeJS.Signals | undefined;
+}
+
+interface IRushd {
+  readonly process: ChildProcess;
+  readonly exited: Promise<IProcessExit>;
+  readonly getStderr: () => string;
+}
+
+// As after `rushd 2>&1 | tee rushd.log`, when Ctrl+C stops tee as well as rushd.
+(process.platform === 'win32' ? describe.skip : describe)('rushd when nothing reads its output', () => {
+  let folder: string;
+  let repoRoot: string;
+  let runtimeBase: string;
+  let rushd: IRushd | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-closed-output-'));
+    repoRoot = path.join(folder, 'repo');
+    runtimeBase = createDaemonTestRuntimeBase();
+    createTemporaryRepo(repoRoot);
+  });
+
+  afterEach(async () => {
+    const started: IRushd | undefined = rushd;
+    rushd = undefined;
+    // Only the rushd process that this test started, if a failed test left it running.
+    if (started && started.process.exitCode === null && started.process.signalCode === null) {
+      started.process.kill('SIGKILL');
+      await started.exited;
+    }
+    fs.rmSync(folder, { force: true, recursive: true });
+    fs.rmSync(runtimeBase, { force: true, recursive: true });
+  });
+
+  function startRushd(): IRushd {
+    const child: ChildProcess = spawn(process.execPath, [RUSHD_PATH], {
+      cwd: repoRoot,
+      env: { ...process.env, RUSHD_RUNTIME_DIR: runtimeBase, RUSH_TEMP_FOLDER: undefined },
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let stderr: string = '';
+    child.stderr?.setEncoding('utf8').on('data', (chunk: string) => (stderr += chunk));
+    const exited: Promise<IProcessExit> = new Promise((resolve) => {
+      child.once('exit', (code, signal) => resolve({ code: code ?? undefined, signal: signal ?? undefined }));
+    });
+    rushd = { process: child, exited, getStderr: () => stderr };
+    return rushd;
+  }
+
+  /** Resolves with the socket path from the ready line. */
+  function readReadyLineAsync(started: IRushd): Promise<string> {
+    return new Promise((resolve, reject) => {
+      let stdout: string = '';
+      const timer: NodeJS.Timeout = setTimeout(
+        () => reject(new Error(`rushd was not ready within ${START_TIMEOUT_MS} ms:\n${started.getStderr()}`)),
+        START_TIMEOUT_MS
+      );
+      started.process.stdout?.setEncoding('utf8').on('data', (chunk: string) => {
+        stdout += chunk;
+        const match: RegExpExecArray | null = READY_LINE.exec(stdout);
+        if (match) {
+          clearTimeout(timer);
+          resolve(match[1]);
+        }
+      });
+      void started.exited.then(({ code, signal }) => {
+        clearTimeout(timer);
+        reject(new Error(`rushd exited (${code ?? signal}) before it was ready:\n${started.getStderr()}`));
+      });
+    });
+  }
+
+  /** Resolves with the socket path, once rushd has written its socket and lockfile. */
+  async function waitForDaemonFilesAsync(started: IRushd): Promise<string> {
+    const deadlineMs: number = Date.now() + START_TIMEOUT_MS;
+    while (true) {
+      for (const runtimeDir of fs.readdirSync(runtimeBase)) {
+        const names: string[] = fs.readdirSync(path.join(runtimeBase, runtimeDir));
+        const socketName: string | undefined = names.find((name) => name.endsWith('.sock'));
+        if (socketName && names.includes(lockfileNameOf(socketName))) {
+          return path.join(runtimeBase, runtimeDir, socketName);
+        }
+      }
+      if (started.process.exitCode !== null || Date.now() > deadlineMs) {
+        throw new Error(`rushd did not write its socket and lockfile:\n${started.getStderr()}`);
+      }
+      await delayAsync(POLL_INTERVAL_MS);
+    }
+  }
+
+  function lockfileNameOf(socketName: string): string {
+    return socketName.replace(/\.sock$/, '.pid.json');
+  }
+
+  function getDaemonFiles(socketPath: string): { socket: boolean; lockfile: boolean } {
+    const lockfilePath: string = path.join(
+      path.dirname(socketPath),
+      lockfileNameOf(path.basename(socketPath))
+    );
+    return { socket: fs.existsSync(socketPath), lockfile: fs.existsSync(lockfilePath) };
+  }
+
+  it.each<NodeJS.Signals>(['SIGTERM', 'SIGINT'])(
+    'stops on %s and removes its socket and lockfile when nothing reads its stderr',
+    async (signal: NodeJS.Signals) => {
+      const started: IRushd = startRushd();
+      const socketPath: string = await readReadyLineAsync(started);
+      expect(getDaemonFiles(socketPath)).toEqual({ socket: true, lockfile: true });
+
+      started.process.stderr?.destroy();
+      started.process.kill(signal);
+
+      // The shutdown line, which goes to stderr, used to end the process with an unhandled EPIPE.
+      const exit: IProcessExit = await started.exited;
+      expect({ ...exit, ...getDaemonFiles(socketPath) }).toEqual({
+        code: 0,
+        signal: undefined,
+        socket: false,
+        lockfile: false
+      });
+    },
+    30000
+  );
+
+  it('keeps running when nothing reads its stdout, and then stops cleanly', async () => {
+    const started: IRushd = startRushd();
+    started.process.stdout?.destroy();
+    const socketPath: string = await waitForDaemonFilesAsync(started);
+    await delayAsync(AFTER_READY_MS);
+
+    // The ready line, which goes to stdout, used to end the process with an unhandled EPIPE.
+    expect({ exitCode: started.process.exitCode, stderr: started.getStderr() }).toEqual({
+      exitCode: null,
+      stderr: ''
+    });
+    started.process.kill('SIGTERM');
+
+    const exit: IProcessExit = await started.exited;
+    expect({ ...exit, ...getDaemonFiles(socketPath) }).toEqual({
+      code: 0,
+      signal: undefined,
+      socket: false,
+      lockfile: false
+    });
+    expect(started.getStderr()).toMatch(/^\S+ rushd \(PID \d+\) shutting down: received SIGTERM\n$/);
+  }, 30000);
+});
diff --git a/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts b/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts
index c4d7f83414d..b1131a1cebb 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts
@@ -5,7 +5,7 @@ import * as fs from 'node:fs';
 
 import { RushDaemonHost } from '../RushDaemonHost';
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
-import { createDeferred } from './DaemonRequestWireTestUtilities';
+import { createDeferred, hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 import * as testProcessExit from './TestProcessExit';
 
 describe('daemon graph fixture initialization ownership', () => {
@@ -66,13 +66,14 @@ describe('daemon graph fixture initialization ownership', () => {
       expect(settled).toBe(false);
       expect(closed).toBe(false);
       expect(fs.existsSync(captured!.folder)).toBe(true);
-      expect(published).toBeUndefined();
+      // A fixture holds the whole process environment, so a failure prints only a boolean.
+      expect(published === undefined).toBe(true);
       release.resolve();
       expect(await joined).toEqual([{ status: 'rejected', reason: controller.signal.reason }]);
       expect(closed).toBe(true);
       expect(fs.existsSync(captured!.folder)).toBe(false);
       expect(fs.existsSync(host.paths.lockfilePath)).toBe(false);
-      expect(published).toBeUndefined();
+      expect(published === undefined).toBe(true);
     } finally {
       await cleanupAsync();
     }
@@ -82,10 +83,12 @@ describe('daemon graph fixture initialization ownership', () => {
     const failure: Error = new Error('injected partial graph fixture setup failure');
     let captured: DaemonGraphTestFixture | undefined;
     await expect(
-      DaemonGraphTestFixture.createAsync((created) => {
-        captured = created;
-        throw failure;
-      })
+      hideResolvedValueAsync(
+        DaemonGraphTestFixture.createAsync((created) => {
+          captured = created;
+          throw failure;
+        })
+      )
     ).rejects.toBe(failure);
     expect(fs.existsSync(captured!.folder)).toBe(false);
     expect(captured!.host).toBeUndefined();
@@ -98,10 +101,12 @@ describe('daemon graph fixture initialization ownership', () => {
     const remove = jest.spyOn(testProcessExit, 'removeTestFolderAsync').mockRejectedValueOnce(cleanupFailure);
     try {
       await expect(
-        DaemonGraphTestFixture.createAsync((created) => {
-          captured = created;
-          throw failure;
-        })
+        hideResolvedValueAsync(
+          DaemonGraphTestFixture.createAsync((created) => {
+            captured = created;
+            throw failure;
+          })
+        )
       ).rejects.toMatchObject({ errors: [failure, cleanupFailure] });
       expect(fs.existsSync(captured!.folder)).toBe(true);
     } finally {
@@ -116,13 +121,15 @@ describe('daemon graph fixture initialization ownership', () => {
     let captured: DaemonGraphTestFixture | undefined;
     try {
       await expect(
-        DaemonGraphTestFixture.createAsync(
-          (created) => {
-            captured = created;
-            controller.abort();
-          },
-          true,
-          controller.signal
+        hideResolvedValueAsync(
+          DaemonGraphTestFixture.createAsync(
+            (created) => {
+              captured = created;
+              controller.abort();
+            },
+            true,
+            controller.signal
+          )
         )
       ).rejects.toBe(controller.signal.reason);
       expect(start).not.toHaveBeenCalled();
diff --git a/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts b/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts
index 85691cc7037..dae915e0ba0 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts
@@ -90,8 +90,9 @@ describe('graph-generation fencing over the native daemon wire', () => {
 
     it('rejects an old reference after same-process soft reload without applying it to the replacement graph', () =>
       runWithFixtureAsync(async (fixture) => {
+        // A graph-affecting parameter replaces the engine; `rebuild` would run on the engine of `build`.
         assertSuccessfulNativeBuild(
-          await fixture.runAsync(['rebuild', '--to', 'b', '--parallelism', '3']),
+          await fixture.runAsync(['build', '--to', 'b', '--parallelism', '3', '--changed-projects-only']),
           fixture.session.operationGraph
         );
         const current = responseSnapshot(await fixture.graphAsync('status'));
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index 21b01d472c1..f4a6d0459a4 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -19,9 +19,11 @@ import {
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IDaemonRequestResolver } from '../DaemonRequestDispatcher';
 import { RushDaemonHost } from '../RushDaemonHost';
+import { RushDaemonRequestResolver } from '../RushDaemonRequestResolver';
 import { WorkspaceSession } from '../WorkspaceSession';
 import { getWorkspaceGenerationToken } from '../WorkspaceGeneration';
 import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import type { CheckDaemonInstallation } from '../DaemonInstallationMonitor';
 import {
   createWireEnvelope,
   DaemonRequestWireClient,
@@ -29,11 +31,69 @@ import {
 } from './DaemonRequestWireTestUtilities';
 import { assertSuccessfulNativeBuild } from './NativeBuildTestResult';
 import { removeTestFolderAsync } from './TestProcessExit';
+import { trackTestDaemonHostAsync } from './TestDaemonHostCleanup';
+
+/**
+ * How long a fixture script that waits for its test may run. Keep it longer than the timeout of every test that uses
+ * it (60 s at most today). Each of these scripts runs in its own session (the daemon starts every operation that way),
+ * so when a test never reaches the `finally` that releases its script (the test timed out, or its Jest worker exited
+ * first), nothing else ends the script.
+ */
+export const FIXTURE_SCRIPT_DEADLINE_MS: number = 120_000;
+
+/**
+ * Quotes `value` as a JavaScript string literal for fixture script source, escaping the characters that could end a
+ * script or a string in the code around it.
+ */
+function stringifyForJavaScript(value: string): string {
+  return JSON.stringify(value).replace(/[<>/\u2028\u2029]/g, (character: string) => {
+    switch (character) {
+      case '<':
+        return '\\u003C';
+      case '>':
+        return '\\u003E';
+      case '/':
+        return '\\u002F';
+      case '\u2028':
+        return '\\u2028';
+      case '\u2029':
+        return '\\u2029';
+    }
+    return character;
+  });
+}
+
+/**
+ * Prefixes `script` with a timer that ends it with exit code 1 once `deadlineMs` has passed. Use it for every fixture
+ * script that waits for a marker file its test writes or removes. The timer is unref'd, so a script that its test
+ * released still exits as soon as it finishes.
+ */
+export function withScriptDeadline(script: string, deadlineMs: number = FIXTURE_SCRIPT_DEADLINE_MS): string {
+  if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= 0) {
+    throw new RangeError(`Expected a positive whole number of milliseconds, not ${deadlineMs}.`);
+  }
+  const message: string = `fixture script: its test did not release it within ${deadlineMs} ms`;
+  return `setTimeout(()=>{console.error(${stringifyForJavaScript(message)});process.exit(1);},${deadlineMs}).unref();${script}`;
+}
 
 export class DaemonGraphTestFixture implements AsyncDisposable {
   public session!: WorkspaceSession;
   public host!: RushDaemonHost;
   public getSuccessorLaunchAsync: GetWorkspaceSuccessorLaunchAsync | undefined;
+  public checkInstallation: CheckDaemonInstallation | undefined;
+  /** Every message the host wrote to its daemon log. */
+  public readonly logs: string[] = [];
+  /** Awaited before each workspace session is created, including a request's graph load or reload. */
+  public beforeCreateSessionAsync: (() => Promise<void>) | undefined;
+  /** Awaited after each workspace session is created, before the host or the request that created it uses it. */
+  public afterCreateSessionAsync: (() => Promise<void>) | undefined;
+  /** Also serves rushx package scripts, like the production host. Set it in `createAsync`'s `configure`. */
+  public servesRushx: boolean = false;
+  /**
+   * Wraps the resolver that the host serves requests with. The wrapper also serves later generations if it keeps the
+   * resolver's `workspaceLifecycle` (see `wrapWorkspaceResolverLifecycle`). Set it in `createAsync`'s `configure`.
+   */
+  public wrapResolver: ((resolver: IDaemonRequestResolver) => IDaemonRequestResolver) | undefined;
   public readonly folder: string = fs.realpathSync.native(
     fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-graph-'))
   );
@@ -110,6 +170,9 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
       execFileSync(
         'git',
         [
+          // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+          '-c',
+          'maintenance.auto=false',
           '-c',
           'user.name=Graph Test',
           '-c',
@@ -139,12 +202,18 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   }
 
   private async _startAsync(): Promise<void> {
-    const resolver: IDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const production: IDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const served: IDaemonRequestResolver = this.servesRushx
+      ? new RushDaemonRequestResolver(production)
+      : production;
+    const resolver: IDaemonRequestResolver = this.wrapResolver?.(served) ?? served;
     this.host = await RushDaemonHost.startAsync({
       repoRoot: this.folder,
       rushVersion: Rush.version,
       daemonVersion: 'graph-test',
       getSuccessorLaunchAsync: this.getSuccessorLaunchAsync,
+      checkInstallation: this.checkInstallation,
+      onLog: (message: string) => this.logs.push(message),
       requestResolver: this._lifecycle
         ? resolver
         : {
@@ -154,10 +223,13 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
             }
           },
       createWorkspaceSessionAsync: async (options) => {
+        await this.beforeCreateSessionAsync?.();
         this.session = await WorkspaceSession.createAsync(options);
+        await this.afterCreateSessionAsync?.();
         return this.session;
       }
     });
+    await trackTestDaemonHostAsync(this.host);
   }
 
   public async restartAsync(): Promise<void> {
diff --git a/libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts
new file mode 100644
index 00000000000..ec478098eab
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts
@@ -0,0 +1,236 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../ReducingGarbageCollection', () => ({ getReducingGarbageCollection: jest.fn() }));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { OperationStatus, type IOperationGraph } from '@microsoft/rush-lib';
+
+import type { GlobalCommandExecutor } from '../GlobalCommandRequestRouter';
+import { getReducingGarbageCollection } from '../ReducingGarbageCollection';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { serveRushDaemonAsync } from '../serveRushDaemon';
+import {
+  CallbackDaemonRequestResolver,
+  createDeferred,
+  createWireEnvelope,
+  DaemonRequestWireClient,
+  type IDeferred
+} from './DaemonRequestWireTestUtilities';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+const DELAY_MS: number = 10000;
+const COLLECTION_LOG: RegExp =
+  /^rushd: idle garbage collection: resident memory \d+ MB -> \d+ MB, heap \d+ MB -> \d+ MB, paused \d+ ms$/;
+
+class GraphWorkspaceSession extends TestWorkspaceSession {
+  public override operationGraph: IOperationGraph | undefined = undefined;
+}
+
+interface IBusyGraph {
+  hasScheduledIteration: boolean;
+  readonly status: OperationStatus;
+  readonly abortController: AbortController;
+}
+
+/** Lets the daemon finish a request that its client has already seen end, with real I/O and immediates. */
+async function settleAsync(): Promise<void> {
+  for (let i: number = 0; i < 20; i++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+describe('daemon idle garbage collection', () => {
+  let repoRoot: string;
+  let collect: jest.Mock;
+  let logs: string[];
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-idle-gc-'));
+    jest.useFakeTimers({ doNotFake: ['nextTick', 'setImmediate'] });
+    collect = jest.fn();
+    jest.mocked(getReducingGarbageCollection).mockReset().mockReturnValue(collect);
+    logs = [];
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  function createOptions(
+    executorAsync: GlobalCommandExecutor = () => Promise.resolve({ exitCode: 0 }),
+    session: TestWorkspaceSession = new TestWorkspaceSession(repoRoot)
+  ): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(session),
+      daemonVersion: 'idle-gc-test',
+      idleGarbageCollectionDelayMs: DELAY_MS,
+      onLog: (message: string) => logs.push(message),
+      repoRoot,
+      requestResolver: new CallbackDaemonRequestResolver(async () => ({
+        kind: 'global',
+        executor: executorAsync
+      })),
+      rushVersion: '5.178.1'
+    };
+  }
+
+  async function connectAsync(host: RushDaemonHost): Promise<DaemonRequestWireClient> {
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    return client;
+  }
+
+  async function startRequestAsync(client: DaemonRequestWireClient, requestId: string): Promise<void> {
+    await client.sendControlAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope(requestId, 'custom', repoRoot)
+    });
+  }
+
+  async function runRequestAsync(client: DaemonRequestWireClient, requestId: string): Promise<void> {
+    await startRequestAsync(client, requestId);
+    expect((await client.readTerminalAsync(requestId)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    await settleAsync();
+  }
+
+  it('collects once after a request, logs what it returned, and waits for the next request', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).not.toHaveBeenCalled();
+      await runRequestAsync(client, 'first');
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+      expect(logs.filter((message: string) => COLLECTION_LOG.test(message))).toHaveLength(1);
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+      await runRequestAsync(client, 'second');
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(2);
+      expect(getReducingGarbageCollection).toHaveBeenCalledTimes(1);
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('does not collect while a request is pending', async () => {
+    const executing: IDeferred<void> = createDeferred<void>();
+    const executed: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(
+      createOptions(async () => {
+        executing.resolve();
+        await executed.promise;
+        return { exitCode: 0 };
+      })
+    );
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await startRequestAsync(client, 'pending');
+      await executing.promise;
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).not.toHaveBeenCalled();
+      executed.resolve();
+      await client.readTerminalAsync('pending');
+      await settleAsync();
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+    } finally {
+      executed.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('waits while the operation graph is busy after its requests ended', async () => {
+    const session: GraphWorkspaceSession = new GraphWorkspaceSession(repoRoot);
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions(undefined, session));
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'left-iteration');
+      const graph: IBusyGraph = {
+        hasScheduledIteration: true,
+        status: OperationStatus.Ready,
+        abortController: new AbortController()
+      };
+      session.operationGraph = graph as unknown as IOperationGraph;
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).not.toHaveBeenCalled();
+      graph.hasScheduledIteration = false;
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+    } finally {
+      session.operationGraph = undefined;
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('logs a failed collection once and stops collecting', async () => {
+    jest.mocked(getReducingGarbageCollection).mockImplementation(() => {
+      throw new Error('no gc here');
+    });
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'first');
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      await runRequestAsync(client, 'second');
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(getReducingGarbageCollection).toHaveBeenCalledTimes(1);
+      expect(logs.filter((message: string) => message.startsWith('rushd: idle garbage collection'))).toEqual([
+        'rushd: idle garbage collection failed and is now off: no gc here'
+      ]);
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('does not collect once the host closes', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'first');
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+    await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+  });
+
+  it('is off for a daemon that does not own its process unless the delay is set', async () => {
+    const shutdown: AbortController = new AbortController();
+    const ready: IDeferred<RushDaemonHost> = createDeferred<RushDaemonHost>();
+    const serving: Promise<void> = serveRushDaemonAsync({
+      ...createOptions(),
+      idleGarbageCollectionDelayMs: undefined,
+      onReady: (host: RushDaemonHost) => ready.resolve(host),
+      shutdownSignal: shutdown.signal
+    });
+    const host: RushDaemonHost = await ready.promise;
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'first');
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(getReducingGarbageCollection).not.toHaveBeenCalled();
+      expect(collect).not.toHaveBeenCalled();
+    } finally {
+      await client.closeAsync();
+      shutdown.abort();
+      await serving;
+      await host.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
new file mode 100644
index 00000000000..3e788fdf1b8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
@@ -0,0 +1,179 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DaemonIdleGarbageCollector,
+  type IDaemonIdleGarbageCollection,
+  type IDaemonIdleGarbageCollectorOptions
+} from '../DaemonIdleGarbageCollector';
+import * as DaemonResidentMemory from '../DaemonResidentMemory';
+
+const DELAY_MS: number = 10000;
+const MIB: number = 1024 * 1024;
+
+describe(DaemonIdleGarbageCollector.name, () => {
+  let collect: jest.Mock;
+  let onCollected: jest.Mock;
+  let onError: jest.Mock;
+  let engineBusy: boolean;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    collect = jest.fn();
+    onCollected = jest.fn();
+    onError = jest.fn();
+    engineBusy = false;
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    jest.useRealTimers();
+  });
+
+  function createCollector(
+    options?: Partial<IDaemonIdleGarbageCollectorOptions>
+  ): DaemonIdleGarbageCollector {
+    return new DaemonIdleGarbageCollector({
+      delayMs: DELAY_MS,
+      collect,
+      isEngineBusy: () => engineBusy,
+      onCollected,
+      onError,
+      ...options
+    });
+  }
+
+  it('does not collect before the first request settles', () => {
+    createCollector();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+  });
+
+  it('collects once, a full delay after the last pending request settles, and never while one is pending', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    const releaseFirst: () => void = collector.acquire();
+    const releaseSecond: () => void = collector.acquire();
+    releaseFirst();
+    releaseFirst();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+    releaseSecond();
+    jest.advanceTimersByTime(DELAY_MS - 1);
+    expect(collect).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(collect).toHaveBeenCalledTimes(1);
+    jest.advanceTimersByTime(100 * DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+  });
+
+  it('collects again only after another request settles', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+    const release: () => void = collector.acquire();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+    release();
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(2);
+  });
+
+  it('gives a request that starts during the delay a full delay after it settles', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS - 1);
+    const release: () => void = collector.acquire();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+    release();
+    jest.advanceTimersByTime(DELAY_MS - 1);
+    expect(collect).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(collect).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits a full delay again while the engine is busy without a request', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    engineBusy = true;
+    collector.acquire()();
+    jest.advanceTimersByTime(3 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+    engineBusy = false;
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+  });
+
+  it('reports the memory before and after the collection and the time it took', () => {
+    // The resident memory comes from readResidentMemoryBytes, and not from process.memoryUsage()'s rss.
+    let collected: boolean = false;
+    collect.mockImplementation(() => {
+      collected = true;
+    });
+    jest
+      .spyOn(DaemonResidentMemory, 'readResidentMemoryBytes')
+      .mockImplementation(() => (collected ? 200 * MIB : 300 * MIB));
+    jest
+      .spyOn(process, 'memoryUsage')
+      .mockReturnValueOnce({ rss: 1800, heapTotal: 1500, heapUsed: 1300, external: 0, arrayBuffers: 0 })
+      .mockReturnValueOnce({ rss: 600, heapTotal: 500, heapUsed: 440, external: 0, arrayBuffers: 0 });
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(onCollected).toHaveBeenCalledTimes(1);
+    const collection: IDaemonIdleGarbageCollection = onCollected.mock.calls[0][0];
+    expect(collection).toMatchObject({
+      heapUsedBytesBefore: 1300,
+      heapUsedBytesAfter: 440,
+      residentBytesBefore: 300 * MIB,
+      residentBytesAfter: 200 * MIB
+    });
+    expect(collection.durationMs).toBeGreaterThanOrEqual(0);
+  });
+
+  it('reports a failed collection once and stops', () => {
+    const error: Error = new Error('no gc');
+    collect.mockImplementation(() => {
+      throw error;
+    });
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    collector.acquire()();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+    expect(onError).toHaveBeenCalledTimes(1);
+    expect(onError).toHaveBeenCalledWith(error);
+    expect(onCollected).not.toHaveBeenCalled();
+  });
+
+  it('reports a failure to read the memory use once and stops', () => {
+    const error: Error = new Error('EMFILE: too many open files, uv_resident_set_memory');
+    jest.spyOn(process, 'memoryUsage').mockImplementation(() => {
+      throw error;
+    });
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    collector.acquire()();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(onError).toHaveBeenCalledTimes(1);
+    expect(onError).toHaveBeenCalledWith(error);
+    expect(collect).not.toHaveBeenCalled();
+    expect(onCollected).not.toHaveBeenCalled();
+  });
+
+  it('does not collect after it is disposed', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    const release: () => void = collector.acquire();
+    collector[Symbol.dispose]();
+    release();
+    jest.runAllTimers();
+    expect(collect).not.toHaveBeenCalled();
+  });
+
+  it.each([0, -1, NaN, Infinity, 2147483648])('rejects the delay %s', (delayMs: number) => {
+    expect(() => createCollector({ delayMs })).toThrow(RangeError);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts b/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts
index 401702dca35..f87a5a648d4 100644
--- a/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts
@@ -47,8 +47,10 @@ describe('daemon idle shutdown', () => {
 
   it('finishes serving and removes transport artifacts after idle shutdown', async () => {
     const ready = createDeferred<RushDaemonHost>();
+    const logs: string[] = [];
     const serving: Promise<void> = serveRushDaemonAsync({
       ...createOptions(),
+      onLog: (message: string) => logs.push(message),
       onReady: (host) => ready.resolve(host),
       shutdownSignal: new AbortController().signal
     });
@@ -58,6 +60,7 @@ describe('daemon idle shutdown', () => {
       await serving;
       expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
       await expect(host.closed).resolves.toBeUndefined();
+      expect(logs).toEqual([`rushd (PID ${process.pid}) shutting down: idle for ${IDLE_TIMEOUT_SECONDS} s`]);
     } finally {
       await host.closeAsync();
     }
diff --git a/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts b/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts
index 8b67e7e3413..05eb8de4de7 100644
--- a/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts
@@ -59,6 +59,39 @@ describe(DaemonIdleTimer.name, () => {
     expect(onIdle).not.toHaveBeenCalled();
   });
 
+  it('expires as soon as no request runs, also without a configured timeout', () => {
+    const onIdle: jest.Mock = jest.fn();
+    const timer: DaemonIdleTimer = new DaemonIdleTimer(undefined);
+    timer.start(onIdle);
+    timer.expire();
+    expect(onIdle).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(0);
+    expect(onIdle).toHaveBeenCalledTimes(1);
+  });
+
+  it('expires only after the running requests finish, without waiting for the idle timeout', () => {
+    const onIdle: jest.Mock = jest.fn();
+    const timer: DaemonIdleTimer = new DaemonIdleTimer(IDLE_TIMEOUT_SECONDS);
+    timer.start(onIdle);
+    const release: () => void = timer.acquire();
+    timer.expire();
+    jest.advanceTimersByTime(IDLE_TIMEOUT_MS * 2);
+    expect(onIdle).not.toHaveBeenCalled();
+    release();
+    jest.advanceTimersByTime(0);
+    expect(onIdle).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not expire once disposed', () => {
+    const onIdle: jest.Mock = jest.fn();
+    const timer: DaemonIdleTimer = new DaemonIdleTimer(IDLE_TIMEOUT_SECONDS);
+    timer.start(onIdle);
+    timer[Symbol.dispose]();
+    timer.expire();
+    jest.runAllTimers();
+    expect(onIdle).not.toHaveBeenCalled();
+  });
+
   it.each([0, -1, NaN, Infinity, 2147484])('rejects invalid timeout %s', (timeout: number) => {
     expect(() => new DaemonIdleTimer(timeout)).toThrow(RangeError);
   });
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
new file mode 100644
index 00000000000..2f386552575
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -0,0 +1,742 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  decodeDaemonLogChunk,
+  type DaemonControlMessage,
+  type IDaemonCommandResult,
+  type IDaemonFrame,
+  type IDaemonInstallationChange,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import { captureDaemonInstallation, type CheckDaemonInstallation } from '../DaemonInstallationMonitor';
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import type { RushDaemonHost } from '../RushDaemonHost';
+import {
+  getInstalledWorkspaceSuccessorLaunchAsync,
+  type GetWorkspaceSuccessorLaunchAsync
+} from '../WorkspaceProcessRestart';
+import { WorkspaceRequestLifecycle } from '../WorkspaceRequestLifecycle';
+import type { WorkspaceSession } from '../WorkspaceSession';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import {
+  createDeferred,
+  type DaemonRequestWireClient,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+import { assertSuccessfulNativeBuild } from './NativeBuildTestResult';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(30_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const LONG_BUILD_A: string = withScriptDeadline(
+  "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+    "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('finished-a'):setTimeout(wait,20);" +
+    'wait();'
+);
+// A script such as a dev server, which runs until it is stopped.
+const SERVE_A: string = withScriptDeadline(
+  "const fs=require('node:fs');fs.appendFileSync('../runs.txt','serve\\n');" +
+    "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
+    'wait();'
+);
+const INSTALLATION_CHANGED_SHUTDOWN: string =
+  `rushd (PID ${process.pid}) shutting down: its installation changed, ` +
+  'so the next client starts a new daemon';
+
+function queuePositions(
+  frames: ReadonlyArray<IDaemonFrame>
+): IDaemonRequestQueuePositionMessage['payload'][] {
+  return frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .filter((message: DaemonControlMessage) => message.kind === 'queuePosition')
+    .map((message: DaemonControlMessage) => (message as IDaemonRequestQueuePositionMessage).payload);
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<IDaemonFrame[]> {
+  const frames: IDaemonFrame[] = [];
+  while (queuePositions(frames).length === 0) frames.push(await client.readFrameAsync());
+  return frames;
+}
+
+async function waitForAsync(predicate: () => boolean): Promise<void> {
+  while (!predicate()) await delayAsync(20);
+}
+
+interface IInstallation {
+  readonly root: string;
+  readonly folder: string;
+  readonly lib: string;
+}
+
+function createInstallation(): IInstallation {
+  const root: string = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-installation-')));
+  const folder: string = path.join(root, 'daemon');
+  const lib: string = path.join(folder, 'lib-commonjs');
+  fs.mkdirSync(lib, { recursive: true });
+  return { root, folder, lib };
+}
+
+describe(captureDaemonInstallation.name, () => {
+  let installation: IInstallation;
+  beforeEach(() => {
+    installation = createInstallation();
+  });
+  afterEach(() => {
+    fs.rmSync(installation.root, { recursive: true, force: true });
+  });
+
+  it('ignores files that change inside the folders', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.lib]);
+    fs.writeFileSync(path.join(installation.lib, 'index.js'), '');
+    fs.mkdirSync(path.join(installation.lib, 'nested'));
+    fs.rmSync(path.join(installation.lib, 'index.js'));
+    expect(check()).toBeUndefined();
+  });
+
+  it('reports the outermost folder that was renamed away, and nothing once it is back', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.lib]);
+    fs.renameSync(installation.folder, `${installation.folder}.moved`);
+    expect(check()).toEqual({ change: 'removed', folder: installation.folder });
+    fs.renameSync(`${installation.folder}.moved`, installation.folder);
+    expect(check()).toBeUndefined();
+  });
+
+  it('reports a folder that another folder took the place of', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.lib]);
+    // The old folder stays on disk, so the new one cannot reuse its inode.
+    fs.renameSync(installation.folder, `${installation.folder}.old`);
+    fs.mkdirSync(installation.lib, { recursive: true });
+    expect(check()).toEqual({ change: 'replaced', folder: installation.folder });
+  });
+
+  it('reports only the innermost folder when its parents are intact', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.folder, installation.lib]);
+    fs.renameSync(installation.lib, `${installation.lib}.old`);
+    fs.mkdirSync(installation.lib);
+    expect(check()).toEqual({ change: 'replaced', folder: installation.lib });
+    fs.rmSync(installation.lib, { recursive: true });
+    expect(check()).toEqual({ change: 'removed', folder: installation.lib });
+  });
+
+  it('does not watch a folder that was missing at startup', () => {
+    const missing: string = path.join(installation.root, 'missing');
+    const check: CheckDaemonInstallation = captureDaemonInstallation([missing]);
+    fs.mkdirSync(missing);
+    expect(check()).toBeUndefined();
+  });
+});
+
+describe('a daemon whose installation changed', () => {
+  let installation: IInstallation;
+  let fixture: DaemonGraphTestFixture | undefined;
+  beforeEach(() => {
+    installation = createInstallation();
+  });
+  afterEach(async () => {
+    const created: DaemonGraphTestFixture | undefined = fixture;
+    fixture = undefined;
+    await created?.[Symbol.asyncDispose]();
+    fs.rmSync(installation.root, { recursive: true, force: true });
+  });
+
+  it('asks the client to start a new daemon, exits without a successor, and says why', async () => {
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = captureDaemonInstallation([installation.lib]);
+    });
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    expect((await pongAsync(fixture)).installationChange).toBeUndefined();
+
+    fs.renameSync(installation.folder, `${installation.folder}.moved`);
+    expect((await pongAsync(fixture)).installationChange).toEqual({
+      change: 'removed',
+      folder: installation.folder
+    });
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal.kind).toBe('requestResult');
+    const result: IDaemonCommandResult = terminal.payload as IDaemonCommandResult;
+    expect(result).toMatchObject({
+      exitCode: 1,
+      outcome: 'failure',
+      aborted: false,
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+    });
+    expect(result.errorMessage).toContain(`installation at ${installation.folder} was removed`);
+
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    expect(fixture.logs).toEqual([
+      `rushd: the installation at ${installation.folder} was removed; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon',
+      INSTALLATION_CHANGED_SHUTDOWN
+    ]);
+  });
+
+  it('answers a request that arrives during a running build once that build finishes', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.write('a/build.cjs', LONG_BUILD_A);
+    });
+    const running: Promise<ITerminalExchange> = fixture.buildAsync();
+    await waitForAsync(() => fixture!.runs().includes('a'));
+    current.change = { change: 'replaced', folder: installation.folder };
+
+    // The build runs for longer than a client-default wait timeout, which must not fail the request.
+    let answered: boolean = false;
+    const queued: Promise<ITerminalExchange> = fixture
+      .runAsync(BUILD_B, { admission: { waitTimeoutMs: 100, waitTimeoutIsDefault: true } })
+      .finally(() => {
+        answered = true;
+      });
+    let restarted: boolean = false;
+    void fixture.host.restartCompleted.then(() => {
+      restarted = true;
+    });
+    expect((await pongAsync(fixture)).installationChange).toEqual(current.change);
+    await delayAsync(300);
+    expect(answered).toBe(false);
+    expect(restarted).toBe(false);
+
+    fixture.write('common/temp/release.flag', '');
+    assertSuccessfulNativeBuild(await running, fixture.session.operationGraph);
+    const { frames, terminal } = await queued;
+    const restartReason: object = {
+      kind: 'installationChanged',
+      change: 'replaced',
+      folder: installation.folder
+    };
+    expect(terminal.payload).toMatchObject({ retryAfterRestart: true, restartReason });
+    expect(queuePositions(frames)).toEqual([expect.objectContaining({ position: 1, restartReason })]);
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    expect(fixture.logs).toHaveLength(2);
+    expect(fixture.logs[1]).toBe(INSTALLATION_CHANGED_SHUTDOWN);
+  });
+
+  it('applies an explicit wait timeout to that wait, and restarts for a later request', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.write('a/build.cjs', LONG_BUILD_A);
+    });
+    const running: Promise<ITerminalExchange> = fixture.buildAsync();
+    await waitForAsync(() => fixture!.runs().includes('a'));
+    current.change = { change: 'removed', folder: installation.folder };
+
+    const timedOut: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+      admission: { waitTimeoutMs: 100 }
+    });
+    expect(timedOut.terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+    });
+    expect((timedOut.terminal.payload as IDaemonCommandResult).retryAfterRestart).toBeUndefined();
+    const notWaiting: ITerminalExchange = await fixture.runAsync(BUILD_B, { admission: { noWait: true } });
+    expect(notWaiting.terminal).toMatchObject({ payload: { exitCode: 1, admissionErrorCode: 'no-wait' } });
+
+    fixture.write('common/temp/release.flag', '');
+    assertSuccessfulNativeBuild(await running, fixture.session.operationGraph);
+    let restarted: boolean = false;
+    void fixture.host.restartCompleted.then(() => {
+      restarted = true;
+    });
+    await delayAsync(100);
+    expect(restarted).toBe(false);
+
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal.payload).toMatchObject({
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it('still applies a client-default timeout to that wait while a rushx script runs, and says why', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.servesRushx = true;
+      created.write(
+        'a/package.json',
+        JSON.stringify({
+          name: 'a',
+          version: '1.0.0',
+          scripts: { '_phase:compile': 'node build.cjs', serve: 'node serve.cjs' }
+        })
+      );
+      created.write('a/serve.cjs', SERVE_A);
+    });
+    const serving: Promise<ITerminalExchange> = fixture.runAsync(['serve'], {
+      invocationKind: 'rushx',
+      commandOrigin: 'custom',
+      cwd: path.join(fixture.folder, 'a')
+    });
+    await Promise.race([
+      waitForAsync(() => fixture!.runs().includes('serve')),
+      serving.then((exchange: ITerminalExchange) => {
+        throw new Error(`The script ended before it ran: ${JSON.stringify(exchange.terminal)}`);
+      })
+    ]);
+    current.change = { change: 'replaced', folder: installation.folder };
+
+    const timedOut: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+      admission: { waitTimeoutMs: 100, waitTimeoutIsDefault: true }
+    });
+    expect(timedOut.terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+    });
+    const result: IDaemonCommandResult = timedOut.terminal.payload as IDaemonCommandResult;
+    expect(result.retryAfterRestart).toBeUndefined();
+    expect(result.errorMessage).toContain(
+      `could restart because its installation at ${installation.folder} was replaced. The restart waits for the ` +
+        'requests that the daemon is serving to finish, including a rushx script that may not exit until it is ' +
+        'stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
+    );
+
+    fixture.write('common/temp/release.flag', '');
+    expect((await serving).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal.payload).toMatchObject({
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['serve']);
+  });
+
+  it('answers a request that waited behind a graph load with the restart instead of running it', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+    });
+    const loadStarted: IDeferred<void> = createDeferred<void>();
+    const releaseLoad: IDeferred<void> = createDeferred<void>();
+    // Only the first build's graph load waits; the one that shuts the daemon down does not.
+    let loaded: boolean = false;
+    fixture.beforeCreateSessionAsync = async () => {
+      if (loaded) return;
+      loaded = true;
+      loadStarted.resolve();
+      await releaseLoad.promise;
+    };
+    const loading: Promise<ITerminalExchange> = fixture.buildAsync();
+    await loadStarted.promise;
+    const client: DaemonRequestWireClient = await fixture.connectAsync();
+    try {
+      const envelope: IDaemonRequestEnvelope = fixture.envelope(BUILD_B);
+      await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+      const frames: IDaemonFrame[] = await readUntilQueuedAsync(client);
+      current.change = { change: 'removed', folder: installation.folder };
+      releaseLoad.resolve();
+
+      // The load was admitted before the change, so its build runs on the code that is already loaded.
+      assertSuccessfulNativeBuild(await loading, fixture.session.operationGraph);
+      const exchange: ITerminalExchange = await client.readTerminalAsync(envelope.requestId);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          retryAfterRestart: true,
+          restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+        }
+      });
+      expect(queuePositions([...frames, ...exchange.frames])[0]).not.toHaveProperty('restartReason');
+    } finally {
+      releaseLoad.resolve();
+      await client.closeAsync();
+    }
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it('answers a request that waited to reload the graph with the restart instead of reloading', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.write('a/build.cjs', LONG_BUILD_A);
+    });
+    const running: Promise<ITerminalExchange> = fixture.buildAsync();
+    await waitForAsync(() => fixture!.runs().includes('a'));
+    const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+    const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+    const client: DaemonRequestWireClient = await fixture.connectAsync();
+    try {
+      // Needs a reload, so it waits for exclusive admission until the running build ends.
+      const envelope: IDaemonRequestEnvelope = fixture.envelope(BUILD_B);
+      await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+      await readUntilQueuedAsync(client);
+      current.change = { change: 'replaced', folder: installation.folder };
+      fixture.write('common/temp/release.flag', '');
+
+      assertSuccessfulNativeBuild(await running, fixture.session.operationGraph);
+      expect((await client.readTerminalAsync(envelope.requestId)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          retryAfterRestart: true,
+          restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+        }
+      });
+    } finally {
+      await client.closeAsync();
+    }
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it('answers a request that the change broke before it began with the restart', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+    });
+    // Only the first build's graph load fails; the one that shuts the daemon down succeeds.
+    fixture.beforeCreateSessionAsync = async () => {
+      if (current.change) return;
+      current.change = { change: 'removed', folder: installation.folder };
+      throw new Error("Cannot find module 'validate-npm-package-name'");
+    };
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        retryAfterRestart: true,
+        restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+      }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual([]);
+    expect(fixture.logs).toEqual([
+      `rushd: the installation at ${installation.folder} was removed; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon',
+      INSTALLATION_CHANGED_SHUTDOWN
+    ]);
+  });
+
+  it('answers a graph watch that arrives after the change with the restart, like any other request', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+    });
+    await fixture.buildSuccessfullyAsync();
+    current.change = { change: 'removed', folder: installation.folder };
+
+    // A watch has no restart ticket, since a restart cancels it, until it waits for this restart itself.
+    const { terminal } = await fixture.graphAsync('watch');
+    expect(terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        retryAfterRestart: true,
+        restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+      }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it.each([
+    { kind: 'a graph control request', argv: ['daemon', 'graph', 'pause'] },
+    { kind: 'a build', argv: BUILD_B }
+  ])(
+    'answers $kind that waited to restart the daemon for its inputs with the restart for a change during that wait',
+    async ({ argv }: { argv: string[] }) => {
+      const current: { change?: IDaemonInstallationChange } = {};
+      const created: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((configured) => {
+        setDaemonPolicy(configured, {});
+        configured.checkInstallation = () => current.change;
+        configured.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      });
+      fixture = created;
+      try {
+        await created.buildSuccessfullyAsync();
+        // Another install state needs a new daemon process, so the request would select a successor.
+        created.write('common/temp/last-install.flag', '{}');
+        // The installation changes after the request's last check before its waits end, while the warm set stops.
+        const session: WorkspaceSession = created.session;
+        const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+        jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementation(async () => {
+          current.change ??= { change: 'replaced', folder: installation.folder };
+          await quiesceAsync();
+        });
+
+        const { terminal } = await created.runAsync(argv);
+        expect(terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: {
+            retryAfterRestart: true,
+            restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+          }
+        });
+        // The daemon exits without a successor, which each client then starts with its own launcher.
+        await expect(created.host.restartCompleted).resolves.toBeUndefined();
+        expect(created.runs()).toEqual(['a', 'b']);
+      } finally {
+        jest.restoreAllMocks();
+        await created.host.closeAsync();
+        await created.host.restartCompleted;
+        await stopSuccessorAsync(created.host.paths);
+      }
+    }
+  );
+
+  it('keeps serving while its installation is intact', async () => {
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = captureDaemonInstallation([installation.lib]);
+    });
+    await fixture.buildSuccessfullyAsync();
+    fs.writeFileSync(path.join(installation.lib, 'late.js'), '');
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.logs).toEqual([]);
+  });
+});
+
+describe('a native install or update in a daemon whose installation changes', () => {
+  const current: { change?: IDaemonInstallationChange } = {};
+  let installation: IInstallation;
+  let fixture: DaemonGraphTestFixture;
+  let launcher: jest.MockedFunction<GetWorkspaceSuccessorLaunchAsync>;
+  let workerSpawns: number;
+  /** Called as the native mutation worker is spawned, after the request's last check before it runs. */
+  let onWorkerSpawn: () => void;
+
+  beforeEach(async () => {
+    installation = createInstallation();
+    current.change = undefined;
+    workerSpawns = 0;
+    onWorkerSpawn = () => undefined;
+    // A mutation requires a successor launcher. This one never starts a daemon, even for code that selects one.
+    launcher = jest.fn<
+      ReturnType<GetWorkspaceSuccessorLaunchAsync>,
+      Parameters<GetWorkspaceSuccessorLaunchAsync>
+    >(() => Promise.reject(new Error('No successor was expected.')));
+    const nativeChildProcess: typeof childProcess = jest.requireActual('node:child_process');
+    const spawn: typeof childProcess.spawn = nativeChildProcess.spawn;
+    jest.spyOn(nativeChildProcess, 'spawn').mockImplementation(((
+      ...args: Parameters<typeof childProcess.spawn>
+    ) => {
+      if (args[1]?.some((arg: string) => arg.endsWith(`${path.sep}NativeMutationWorker.js`))) {
+        workerSpawns++;
+        onWorkerSpawn();
+      }
+      return spawn(...args);
+    }) as typeof childProcess.spawn);
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.getSuccessorLaunchAsync = launcher;
+    });
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted.catch(() => undefined);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+      fs.rmSync(installation.root, { recursive: true, force: true });
+    }
+  });
+
+  function changeInstallation(): void {
+    current.change ??= { change: 'replaced', folder: installation.folder };
+  }
+
+  // The launcher's context holds the request's environment, which is the whole process environment, and jest prints a
+  // mock's arguments when an assertion about its calls fails. Tests count the calls instead, so that a failure prints
+  // only numbers.
+  function launchCount(): number {
+    return launcher.mock.calls.length;
+  }
+
+  function stderrText(exchange: ITerminalExchange): string {
+    return exchange.frames
+      .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.logStderr)
+      .map((frame: IDaemonFrame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
+      .join('');
+  }
+
+  const installationChangedResult: () => object = () => ({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+    }
+  });
+
+  const exitWithoutSuccessorLine: () => string = () =>
+    `The daemon's installation at ${installation.folder} was replaced, so the daemon exits after this command ` +
+    'without starting a new one; the next command starts one.';
+
+  it('answers an install whose waits end after the change with the restart, and runs no worker', async () => {
+    await fixture.buildSuccessfullyAsync();
+    // The installation changes while the install waits for the warm set to stop, after its earlier checks.
+    const session: WorkspaceSession = fixture.session;
+    const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+    jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementation(async () => {
+      changeInstallation();
+      await quiesceAsync();
+    });
+
+    // --help runs the real worker, which would install nothing.
+    const { terminal } = await fixture.runAsync(['install', '--help']);
+    expect(terminal).toMatchObject(installationChangedResult());
+    expect(workerSpawns).toBe(0);
+    expect(launchCount()).toBe(0);
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.logs).toEqual([
+      `rushd: the installation at ${installation.folder} was replaced; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon',
+      INSTALLATION_CHANGED_SHUTDOWN
+    ]);
+  });
+
+  it('exits without selecting a successor when the installation changes while the worker runs, and says why', async () => {
+    onWorkerSpawn = changeInstallation;
+
+    const exchange: ITerminalExchange = await fixture.runAsync(['install', '--help']);
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    expect(exchange.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(workerSpawns).toBe(1);
+    const stderr: string = stderrText(exchange);
+    expect(stderr).toContain(exitWithoutSuccessorLine());
+    expect(stderr).not.toContain('Mutation completed');
+    // The successor would run code that is gone or replaced.
+    expect(launchCount()).toBe(0);
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+  });
+
+  it('reports an install result that could not be delivered as a failure, even though the installation changed', async () => {
+    onWorkerSpawn = changeInstallation;
+    const warnings: unknown[] = [];
+    jest.spyOn(process, 'emitWarning').mockImplementation((warning) => {
+      warnings.push(warning);
+    });
+    // The result is lost, as it is when the client's connection fails while the worker runs.
+    jest
+      .spyOn(DaemonWireRequestClient.prototype, 'writeResultAsync')
+      .mockRejectedValueOnce(new Error('The connection to the client failed.'));
+
+    const { terminal } = await fixture.runAsync(['install', '--help']);
+    // The session answers a request whose result was not delivered with a rejection.
+    expect(terminal.kind).toBe('requestRejected');
+    expect(workerSpawns).toBe(1);
+    const undrained: string =
+      'Mutation result could not be drained; stopping without an automatic successor.';
+    // Unlike the change on its own, which the host does not report, this is a failure that it reports.
+    await expect(fixture.host.restartCompleted).rejects.toThrow(undrained);
+    expect(warnings).toContainEqual(expect.objectContaining({ message: undrained }));
+    expect(launchCount()).toBe(0);
+  });
+
+  it('exits without a successor when the installation changes while the successor is selected', async () => {
+    launcher.mockImplementation(async () => {
+      changeInstallation();
+      // The launcher could not load a module that the change removed.
+      throw new Error("Cannot find module 'successor'");
+    });
+
+    const exchange: ITerminalExchange = await fixture.runAsync(['install', '--help']);
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    const stderr: string = stderrText(exchange);
+    expect(stderr).toContain(exitWithoutSuccessorLine());
+    expect(stderr).not.toContain('Mutation completed');
+    expect(launcher).toHaveBeenCalledTimes(1);
+    // The host reports no failure, since each client starts a daemon with its own launcher.
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+  });
+
+  it('answers a request that reaches the lifecycle after the install finished with the restart', async () => {
+    onWorkerSpawn = changeInstallation;
+    // The later request is held where it enters the lifecycle until the daemon starts to exit.
+    const late: IDaemonRequestEnvelope = fixture.envelope(BUILD_B);
+    const lateEntered: IDeferred<void> = createDeferred<void>();
+    const releaseLate: IDeferred<void> = createDeferred<void>();
+    const dispatchAsync: WorkspaceRequestLifecycle['dispatchAsync'] =
+      WorkspaceRequestLifecycle.prototype.dispatchAsync;
+    jest.spyOn(WorkspaceRequestLifecycle.prototype, 'dispatchAsync').mockImplementation(async function (
+      this: WorkspaceRequestLifecycle,
+      ...args: Parameters<WorkspaceRequestLifecycle['dispatchAsync']>
+    ) {
+      if (args[0].requestId === late.requestId) {
+        lateEntered.resolve();
+        await releaseLate.promise;
+      }
+      return await dispatchAsync.apply(this, args);
+    });
+    const closeAsync: RushDaemonHost['closeAsync'] = fixture.host.closeAsync.bind(fixture.host);
+    jest.spyOn(fixture.host, 'closeAsync').mockImplementation((reason) => {
+      releaseLate.resolve();
+      return closeAsync(reason);
+    });
+
+    const client: DaemonRequestWireClient = await fixture.connectAsync();
+    try {
+      await client.sendControlAsync({ kind: 'requestStart', payload: late });
+      await lateEntered.promise;
+      const install: ITerminalExchange = await fixture.runAsync(['install', '--help']);
+      expect(install.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(stderrText(install)).toContain(exitWithoutSuccessorLine());
+
+      expect((await client.readTerminalAsync(late.requestId)).terminal).toMatchObject(
+        installationChangedResult()
+      );
+    } finally {
+      releaseLate.resolve();
+      await client.closeAsync();
+    }
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(launchCount()).toBe(0);
+    expect(fixture.runs()).toEqual([]);
+  });
+});
+
+it('logs each rejected request, with the stack of an unexpected failure', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    const { terminal } = await fixture.graphAsync('pause');
+    expect(terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'routingFailed' } });
+    const { requestId, message } = terminal.payload as { requestId: string; message: string };
+    expect(fixture.logs).toHaveLength(1);
+    expect(fixture.logs[0]).toMatch(
+      new RegExp(`^rushd: rejected request ${requestId} \\(routingFailed\\): `)
+    );
+    expect(fixture.logs[0]).toContain(message);
+    expect(fixture.logs[0]).toMatch(/\n\s+at /);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts b/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
new file mode 100644
index 00000000000..8fa016b1e14
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
@@ -0,0 +1,248 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import {
+  computeDaemonWorkspaceKey,
+  ensureDaemonRuntimeDir,
+  isDaemonProcessAlive,
+  resolveDaemonPathsFromProcess,
+  writeDaemonLockfile
+} from '@rushstack/rush-daemon-transport';
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonPaths,
+  IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
+
+import {
+  formatOperationGroupLeftRunningLogLine,
+  formatOrphanReapLogLine,
+  getOrphanReapLogOptions
+} from '../DaemonOrphanReapLog';
+import { RushDaemonHost } from '../RushDaemonHost';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+const RUSH_VERSION: string = '5.178.1';
+const DEAD_PID: number = 4242;
+const POLL_ATTEMPTS: number = 250;
+const POLL_INTERVAL_MS: number = 20;
+// Above the reaper's SIGTERM and SIGKILL grace periods plus the wait for the orphan to exit.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A stand-in for a daemon that is SIGKILLed while it runs an operation. The operation is spawned without
+// `detached`, so it stays in the daemon's process group; it exits by itself after a minute, so that a
+// regression cannot leave it running.
+const FAKE_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process').spawn(process.execPath,['-e','setTimeout(()=>{},60000)'],{stdio:'ignore'});" +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+// A detached operation leads its own process group and session. It exits by itself after a minute.
+const DETACHED_OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+// No process of a test starts one clock tick after boot, so a record with this start time names no leader.
+const OTHER_START_TIME: string = '1';
+const LEFT_RUNNING_PREFIX: string = 'rushd: left process group ';
+const GROUP_LEFT_RUNNING: IDaemonOperationGroupLeftRunning = {
+  daemonPid: DEAD_PID,
+  processGroupId: 5001,
+  reason: 'otherSession'
+};
+
+describe(formatOrphanReapLogLine.name, () => {
+  it('names the exited daemon and its process group', () => {
+    expect(
+      formatOrphanReapLogLine({ daemonPid: DEAD_PID, processGroupIds: [DEAD_PID], outcome: 'terminated' })
+    ).toBe(
+      'rushd: stopped the operations that the exited daemon (PID 4242) left running (process group 4242)'
+    );
+  });
+
+  it('names every process group, and says so when they needed SIGKILL', () => {
+    expect(
+      formatOrphanReapLogLine({
+        daemonPid: DEAD_PID,
+        processGroupIds: [11, 12, 13, 14, 15],
+        outcome: 'killed'
+      })
+    ).toBe(
+      'rushd: killed the operations that the exited daemon (PID 4242) left running ' +
+        '(process groups 11, 12, 13, 14 and 15); they did not exit after SIGTERM'
+    );
+  });
+});
+
+describe(formatOperationGroupLeftRunningLogLine.name, () => {
+  it('names the group, the exited daemon and the reason that the reclaim left the group running', () => {
+    expect(formatOperationGroupLeftRunningLogLine(GROUP_LEFT_RUNNING)).toBe(
+      'rushd: left process group 5001 running, which the exited daemon (PID 4242) recorded for an ' +
+        'operation: its leader has exited, and a process of the group is in another session'
+    );
+  });
+});
+
+describe(getOrphanReapLogOptions.name, () => {
+  it('keeps the process warning without onLog', () => {
+    expect(getOrphanReapLogOptions(undefined)).toEqual({});
+  });
+
+  it('writes each set of stopped process groups to onLog', () => {
+    const messages: string[] = [];
+    const reap: IDaemonOrphanReap = { daemonPid: DEAD_PID, processGroupIds: [11, 12], outcome: 'terminated' };
+    getOrphanReapLogOptions((message: string) => messages.push(message)).onOrphansReaped?.(reap);
+    expect(messages).toEqual([formatOrphanReapLogLine(reap)]);
+  });
+
+  it('writes each operation group that the reclaim left running to onLog', () => {
+    const messages: string[] = [];
+    const options: IDaemonReclaimOptions = getOrphanReapLogOptions((message: string) =>
+      messages.push(message)
+    );
+    options.onOperationGroupLeftRunning?.(GROUP_LEFT_RUNNING);
+    expect(messages).toEqual([formatOperationGroupLeftRunningLogLine(GROUP_LEFT_RUNNING)]);
+  });
+});
+
+interface ICrashedDaemon {
+  readonly daemonPid: number;
+  readonly orphanPid: number;
+}
+
+/** Leaves what a daemon that was SIGKILLed while running an operation leaves: the operation, lockfile and socket. */
+async function crashFakeDaemonAsync(paths: IDaemonPaths): Promise<ICrashedDaemon> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', FAKE_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const stdout: Readable = daemon.stdout as Readable;
+  const [chunk] = (await once(stdout, 'data')) as [Buffer];
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  stdout.destroy();
+  const daemonPid: number = Number(daemon.pid);
+  ensureDaemonRuntimeDir(paths);
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: daemonPid,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+  fs.writeFileSync(paths.socketPath, 'stale');
+  return { daemonPid, orphanPid: Number(chunk.toString().trim()) };
+}
+
+/** Records a group for the daemon `daemonPid`, as that daemon does when it starts a detached operation. */
+function recordOperationGroup(
+  paths: IDaemonPaths,
+  daemonPid: number,
+  groupId: number,
+  startTime: string
+): string {
+  const folder: string = `${paths.lockfilePath}.groups-${daemonPid}`;
+  fs.mkdirSync(folder, { mode: 0o700 });
+  fs.writeFileSync(path.join(folder, `${groupId}-${startTime}`), '', { mode: 0o600 });
+  return folder;
+}
+
+async function waitUntilDeadAsync(pid: number): Promise<boolean> {
+  for (let attempt: number = 0; attempt < POLL_ATTEMPTS && isDaemonProcessAlive(pid); attempt++) {
+    await delayAsync(POLL_INTERVAL_MS);
+  }
+  return !isDaemonProcessAlive(pid);
+}
+
+describe('startup reclaim', () => {
+  let repoRoot: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-orphan-log-'));
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  linuxIt(
+    'writes the operations that it stops for a SIGKILLed daemon to the daemon log, not as a process warning',
+    async () => {
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      const workspaceKey: string = computeDaemonWorkspaceKey({
+        canonicalRepoRoot: fs.realpathSync.native(repoRoot),
+        rushVersion: RUSH_VERSION
+      });
+      const { daemonPid, orphanPid } = await crashFakeDaemonAsync(
+        resolveDaemonPathsFromProcess(workspaceKey)
+      );
+      const messages: string[] = [];
+      const host: RushDaemonHost = await RushDaemonHost.startAsync({
+        createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+        daemonVersion: 'orphan-log-test',
+        repoRoot,
+        rushVersion: RUSH_VERSION,
+        onLog: (message: string) => messages.push(message)
+      });
+      await host.closeAsync();
+      // The host logs other things too, such as its shutdown. The reclaim must add exactly this one line.
+      expect(messages.filter((message: string) => message.includes('left running'))).toEqual([
+        `rushd: stopped the operations that the exited daemon (PID ${daemonPid}) left running ` +
+          `(process group ${daemonPid})`
+      ]);
+      expect(warning).not.toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+      );
+      expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
+    },
+    REAP_TEST_TIMEOUT_MS
+  );
+
+  linuxIt(
+    'writes a recorded operation group that it cannot prove to the daemon log, and leaves it running',
+    async () => {
+      const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
+        computeDaemonWorkspaceKey({
+          canonicalRepoRoot: fs.realpathSync.native(repoRoot),
+          rushVersion: RUSH_VERSION
+        })
+      );
+      const operation: ChildProcess = spawn(process.execPath, ['-e', DETACHED_OPERATION_SCRIPT], {
+        detached: true,
+        stdio: 'ignore'
+      });
+      const groupId: number = Number(operation.pid);
+      try {
+        const { daemonPid } = await crashFakeDaemonAsync(paths);
+        const folder: string = recordOperationGroup(paths, daemonPid, groupId, OTHER_START_TIME);
+        const messages: string[] = [];
+        const host: RushDaemonHost = await RushDaemonHost.startAsync({
+          createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+          daemonVersion: 'orphan-log-test',
+          repoRoot,
+          rushVersion: RUSH_VERSION,
+          onLog: (message: string) => messages.push(message)
+        });
+        await host.closeAsync();
+        expect(messages.filter((message: string) => message.startsWith(LEFT_RUNNING_PREFIX))).toEqual([
+          `${LEFT_RUNNING_PREFIX}${groupId} running, which the exited daemon (PID ${daemonPid}) recorded ` +
+            `for an operation: the process with PID ${groupId} now is not the leader that the daemon recorded`
+        ]);
+        expect(isDaemonProcessAlive(groupId)).toBe(true);
+        expect(fs.existsSync(folder)).toBe(false);
+      } finally {
+        // The operation is this test's own child, which has not been waited for, so its PID is still its own.
+        operation.kill('SIGKILL');
+      }
+    },
+    REAP_TEST_TIMEOUT_MS
+  );
+});
diff --git a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
new file mode 100644
index 00000000000..f4018208ebe
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
@@ -0,0 +1,263 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
+import type { LeftBehind, Ownership, Reporter } from './fixtures/LingeringDaemon';
+import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
+
+const FIXTURE_PATH: string = path.join(__dirname, 'fixtures', 'LingeringDaemon.js');
+const POLL_INTERVAL_MS: number = 20;
+const START_TIMEOUT_MS: number = 15000;
+// Far beyond the 2 s after which the daemon exits anyway, and far below the test's timeout.
+const EXIT_TIMEOUT_MS: number = 8000;
+// Well past the 2 s after which a daemon that owns its process exits it.
+const EMBEDDED_WAIT_MS: number = 3000;
+const LINGER_REPORT: RegExp =
+  /rushd \(PID (\d+)\) stopped at (\S+), but something kept its process running for 2 s, so it exits now\. Active resources that Node\.js reports: [^\n]*\bTimeout\b/;
+
+interface IProcessExit {
+  readonly code: number | undefined;
+  readonly signal: NodeJS.Signals | undefined;
+}
+
+interface IFixtureDaemon {
+  readonly process: ChildProcess;
+  readonly exited: Promise<IProcessExit>;
+  readonly getStderr: () => string;
+}
+
+type StopRoute = 'daemon stop' | 'SIGTERM';
+
+/**
+ * Deletes a daemon's socket with no stat of it (`fs.rmSync` would stat it first). After a sync stat of a socket,
+ * Node 22's `fs.realpathSync` can return a path with a link unresolved (it checks a stale stat), and jest then
+ * fails to load its own modules.
+ */
+function unlinkSocket(socketPath: string): void {
+  fs.unlinkSync(socketPath);
+}
+
+(process.platform === 'win32' ? describe.skip : describe)('a daemon process after the daemon stops', () => {
+  let folder: string;
+  let runtimeBase: string;
+  let repoRoot: string;
+  let controlFolder: string;
+  let daemon: IFixtureDaemon | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-process-exit-'));
+    runtimeBase = createDaemonTestRuntimeBase();
+    repoRoot = path.join(folder, 'repo');
+    controlFolder = path.join(folder, 'control');
+    createTemporaryRepo(repoRoot);
+    fs.mkdirSync(controlFolder);
+  });
+
+  afterEach(async () => {
+    const startedDaemon: IFixtureDaemon | undefined = daemon;
+    daemon = undefined;
+    // Only the fixture process that this test started, if a failed test left it running.
+    if (
+      startedDaemon &&
+      startedDaemon.process.exitCode === null &&
+      startedDaemon.process.signalCode === null
+    ) {
+      startedDaemon.process.kill('SIGKILL');
+      await startedDaemon.exited;
+    }
+    fs.rmSync(folder, { force: true, recursive: true });
+    fs.rmSync(runtimeBase, { force: true, recursive: true });
+  });
+
+  function startDaemon(leftBehind: LeftBehind, reporter: Reporter, ownership: Ownership): IFixtureDaemon {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [FIXTURE_PATH, repoRoot, controlFolder, leftBehind, reporter, ownership],
+      {
+        // Like a daemon that rush-client launches: the leader of its own process group.
+        detached: true,
+        env: { ...process.env, RUSHD_RUNTIME_DIR: runtimeBase, RUSH_TEMP_FOLDER: undefined },
+        stdio: ['ignore', 'ignore', 'pipe']
+      }
+    );
+    let stderr: string = '';
+    child.stderr?.setEncoding('utf8').on('data', (chunk: string) => (stderr += chunk));
+    const exited: Promise<IProcessExit> = new Promise((resolve) => {
+      child.once('exit', (code, signal) => resolve({ code: code ?? undefined, signal: signal ?? undefined }));
+    });
+    daemon = { process: child, exited, getStderr: () => stderr };
+    return daemon;
+  }
+
+  async function waitForJsonAsync<T>(fixture: IFixtureDaemon, name: string): Promise<T> {
+    const filename: string = path.join(controlFolder, name);
+    const deadlineMs: number = Date.now() + START_TIMEOUT_MS;
+    while (!fs.existsSync(filename)) {
+      if (fixture.process.exitCode !== null || Date.now() > deadlineMs) {
+        throw new Error(`The fixture did not write ${name}. Its stderr:\n${fixture.getStderr()}`);
+      }
+      await delayAsync(POLL_INTERVAL_MS);
+    }
+    return JSON.parse(fs.readFileSync(filename, 'utf8'));
+  }
+
+  async function stopAsync(fixture: IFixtureDaemon, paths: IDaemonPaths, route: StopRoute): Promise<void> {
+    if (route === 'SIGTERM') {
+      fixture.process.kill('SIGTERM');
+      return;
+    }
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(paths.socketPath);
+    try {
+      await client.handshakeAsync();
+      await client.sendControlAsync({ kind: 'shutdown', payload: {} });
+      expect(await client.readControlAsync()).toEqual({
+        kind: 'shutdownAck',
+        payload: { activeRequests: 0 }
+      });
+      await client.closed;
+    } finally {
+      await client.closeAsync();
+    }
+  }
+
+  /** Resolves with the exit, when the daemon stopped and how long after that the exit came. */
+  async function waitForExitAsync(
+    fixture: IFixtureDaemon
+  ): Promise<IProcessExit & { stoppedAtMs: number; afterStopMs: number }> {
+    const { stoppedAtMs } = await waitForJsonAsync<{ stoppedAtMs: number }>(fixture, 'stopped.json');
+    const timeout: AbortController = new AbortController();
+    const exit: IProcessExit | undefined = await Promise.race([
+      fixture.exited,
+      delayAsync(EXIT_TIMEOUT_MS, undefined, { signal: timeout.signal }).catch(() => undefined)
+    ]);
+    timeout.abort();
+    if (!exit) {
+      throw new Error(
+        `The fixture process was still running ${EXIT_TIMEOUT_MS} ms after the daemon stopped. ` +
+          `Its stderr:\n${fixture.getStderr()}`
+      );
+    }
+    return { ...exit, stoppedAtMs, afterStopMs: Date.now() - stoppedAtMs };
+  }
+
+  /** Checks the report of what kept the process running: its PID, and the time the daemon stopped. */
+  function expectLingerReport(fixture: IFixtureDaemon, stoppedAtMs: number): void {
+    const match: RegExpExecArray | null = LINGER_REPORT.exec(fixture.getStderr());
+    if (!match) {
+      throw new Error(`The fixture did not report what kept it running. Its stderr:\n${fixture.getStderr()}`);
+    }
+    expect(Number(match[1])).toBe(fixture.process.pid);
+    // The daemon stopped, and then the fixture wrote stopped.json.
+    const reportedStopMs: number = Date.parse(match[2]);
+    expect(new Date(reportedStopMs).toISOString()).toBe(match[2]);
+    expect(reportedStopMs).toBeLessThanOrEqual(stoppedAtMs);
+    expect(stoppedAtMs - reportedStopMs).toBeLessThan(1000);
+  }
+
+  it.each<[StopRoute, Reporter, RegExp]>([
+    ['daemon stop', 'callbacks', /^fixture log: rushd \(PID \d+\) stopped at /m],
+    ['SIGTERM', 'default', /^rushd \(PID \d+\) stopped at /m]
+  ])(
+    'exits 2 s after %s if a timer that it did not start keeps it running, and logs that (%s)',
+    async (route: StopRoute, reporter: Reporter, reportLine: RegExp) => {
+      const fixture: IFixtureDaemon = startDaemon('timer', reporter, 'process');
+      const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+      await stopAsync(fixture, paths, route);
+
+      const { code, signal, stoppedAtMs, afterStopMs } = await waitForExitAsync(fixture);
+      expect({ code, signal }).toEqual({ code: 0, signal: undefined });
+      expect(afterStopMs).toBeGreaterThanOrEqual(1900);
+      expect(afterStopMs).toBeLessThan(3000);
+      expectLingerReport(fixture, stoppedAtMs);
+      // A message for the daemon log, through onLog when there is one: not an error, and no stack.
+      expect(fixture.getStderr()).toMatch(reportLine);
+      expect(fixture.getStderr().match(/kept its process running/g)).toHaveLength(1);
+      expect(fixture.getStderr()).not.toMatch(/fixture error: |Error: rushd|^\s+at /m);
+      expect(fs.existsSync(paths.socketPath)).toBe(false);
+      expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+    },
+    30000
+  );
+
+  it('keeps the exit code that its caller set when it failed', async () => {
+    const fixture: IFixtureDaemon = startDaemon('failing', 'callbacks', 'process');
+
+    const { code, signal, stoppedAtMs, afterStopMs } = await waitForExitAsync(fixture);
+    expect({ code, signal }).toEqual({ code: 1, signal: undefined });
+    expect(afterStopMs).toBeGreaterThanOrEqual(1900);
+    expect(fixture.getStderr()).toMatch(/The fixture failed after it started\./);
+    expectLingerReport(fixture, stoppedAtMs);
+  }, 30000);
+
+  it('never exits the process when it is embedded, even if a timer keeps the process running', async () => {
+    const fixture: IFixtureDaemon = startDaemon('timer', 'callbacks', 'embedded');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    await stopAsync(fixture, paths, 'daemon stop');
+    await waitForJsonAsync<{ stoppedAtMs: number }>(fixture, 'stopped.json');
+
+    await delayAsync(EMBEDDED_WAIT_MS);
+    // afterEach ends the fixture process, which only its own timer keeps running now.
+    expect({ code: fixture.process.exitCode, signal: fixture.process.signalCode }).toEqual({
+      code: null,
+      signal: null
+    });
+    expect(fixture.getStderr()).not.toMatch(/kept its process running/);
+    expect(fs.existsSync(paths.socketPath)).toBe(false);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  }, 30000);
+
+  it('exits as soon as it stops if nothing keeps it running', async () => {
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'callbacks', 'process');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    await stopAsync(fixture, paths, 'daemon stop');
+
+    const { code, signal } = await waitForExitAsync(fixture);
+    expect({ code, signal }).toEqual({ code: 0, signal: undefined });
+    expect(fixture.getStderr()).not.toMatch(/kept its process running/);
+    expect(fs.existsSync(paths.socketPath)).toBe(false);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  }, 30000);
+
+  it('exits as soon as it stops, without an error, after a file took the name of its runtime folder', async () => {
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'callbacks', 'process');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    const runtimeDir: string = paths.runtimeDir ?? '';
+    unlinkSocket(paths.socketPath);
+    fs.rmSync(runtimeDir, { recursive: true });
+    fs.writeFileSync(runtimeDir, 'another file');
+    await stopAsync(fixture, paths, 'SIGTERM');
+
+    const { code, signal } = await waitForExitAsync(fixture);
+    expect({ code, signal }).toEqual({ code: 0, signal: undefined });
+    expect(fixture.getStderr()).not.toMatch(/fixture error: |ENOTDIR|kept its process running|^\s+at /m);
+    expect(fs.readFileSync(runtimeDir, 'utf8')).toBe('another file');
+  }, 30000);
+
+  it('exits as soon as it stops when it cannot delete its files, and reports why', async () => {
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'callbacks', 'process');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    const runtimeDir: string = paths.runtimeDir ?? '';
+    // A runtime folder that became a link to itself: every path through it fails with ELOOP.
+    fs.renameSync(runtimeDir, `${runtimeDir}.moved`);
+    fs.symlinkSync(runtimeDir, runtimeDir);
+    await stopAsync(fixture, paths, 'SIGTERM');
+
+    const { code, signal } = await waitForExitAsync(fixture);
+    // The daemon could not delete its socket, so the test does.
+    unlinkSocket(path.join(`${runtimeDir}.moved`, path.basename(paths.socketPath)));
+    expect({ code, signal }).toEqual({ code: 1, signal: undefined });
+    // Both failures are reported: the socket's first, then the lockfile's.
+    expect(fixture.getStderr()).toContain(`lstat '${paths.socketPath}'. Then: ELOOP`);
+    expect(fixture.getStderr()).toContain(`lstat '${paths.lockfilePath}'`);
+    expect(fixture.getStderr()).not.toMatch(/kept its process running/);
+  }, 30000);
+});
diff --git a/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
new file mode 100644
index 00000000000..d09ff4fb6e4
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
@@ -0,0 +1,593 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import { DaemonFrameType, decodeDaemonControlMessage } from '@rushstack/rush-daemon-protocol';
+import type {
+  DaemonControlMessage,
+  IDaemonFrame,
+  IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
+import type { ITerminal } from '@rushstack/terminal';
+
+import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
+import { DaemonRequestDispatchError } from '../DaemonRequestDispatcher';
+import { DaemonShutdownError, getDaemonShutdownReason } from '../DaemonShutdownError';
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import {
+  CallbackDaemonRequestResolver,
+  DaemonRequestWireClient,
+  createDeferred,
+  createWireEnvelope
+} from './DaemonRequestWireTestUtilities';
+import type { IDeferred, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+const DAEMON_VERSION: string = 'wire-test';
+const RUSH_VERSION: string = '5.178.1';
+const OPERATION_A: string = 'project-a (_phase:test)';
+/** How long a test gives the daemon to do what it must not do yet. */
+const SETTLE_MS: number = 50;
+const testRepoRoots: Set<string> = new Set();
+
+afterEach(() => {
+  for (const repoRoot of testRepoRoots) fs.rmSync(repoRoot, { force: true, recursive: true });
+  testRepoRoots.clear();
+});
+
+function createRepoRoot(): string {
+  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-wire-started-'));
+  testRepoRoots.add(repoRoot);
+  return repoRoot;
+}
+
+async function startGlobalHostAsync(
+  repoRoot: string,
+  executorFor: (requestId: string) => GlobalCommandExecutor
+): Promise<RushDaemonHost> {
+  const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+    executor: executorFor(envelope.requestId),
+    kind: 'global'
+  }));
+  return await startHostAsync(repoRoot, resolver);
+}
+
+async function startHostAsync(repoRoot: string, resolver: IDaemonRequestResolver): Promise<RushDaemonHost> {
+  const options: IRushDaemonHostOptions = {
+    createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+    daemonVersion: DAEMON_VERSION,
+    repoRoot,
+    requestResolver: resolver,
+    rushVersion: RUSH_VERSION
+  };
+  return await RushDaemonHost.startAsync(options);
+}
+
+async function connectAsync(
+  host: RushDaemonHost,
+  supportsRequestStarted: boolean | undefined
+): Promise<DaemonRequestWireClient> {
+  const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+  await client.handshakeAsync(supportsRequestStarted === undefined ? {} : { supportsRequestStarted });
+  return client;
+}
+
+async function startAsync(
+  client: DaemonRequestWireClient,
+  envelope: IDaemonRequestEnvelope
+): Promise<ITerminalExchange> {
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  return await client.readTerminalAsync(envelope.requestId);
+}
+
+/** Each frame of the exchange as a control message kind, or as `output` for a log or event frame. */
+function describeFrames(frames: ReadonlyArray<IDaemonFrame>): string[] {
+  return frames.map((frame: IDaemonFrame) =>
+    frame.kind === DaemonFrameType.controlJson ? decodeDaemonControlMessage(frame.payload).kind : 'output'
+  );
+}
+
+function findStarted(frames: ReadonlyArray<IDaemonFrame>): DaemonControlMessage[] {
+  return frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .filter((message: DaemonControlMessage) => message.kind === 'requestStarted');
+}
+
+/**
+ * Makes the daemon's requestStarted writes wait for `release` before they write, and records in `order` when each
+ * write starts and ends.
+ */
+function holdRequestStartedWrites(
+  order: string[],
+  writeStarted: IDeferred<void>,
+  release: Promise<void>
+): jest.SpyInstance {
+  const writeAsync: () => Promise<void> = DaemonWireRequestClient.prototype.writeRequestStartedAsync;
+  return jest
+    .spyOn(DaemonWireRequestClient.prototype, 'writeRequestStartedAsync')
+    .mockImplementation(async function (this: DaemonWireRequestClient): Promise<void> {
+      order.push('write');
+      writeStarted.resolve();
+      await release;
+      await writeAsync.call(this);
+      order.push('written');
+    });
+}
+
+async function settleAsync(): Promise<void> {
+  await new Promise<void>((resolve) => setTimeout(resolve, SETTLE_MS));
+}
+
+describe('requestStarted', () => {
+  it('tells a client that asked for it when a global command starts, once and before its output', async () => {
+    const repoRoot: string = createRepoRoot();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async (context) => {
+      context.terminal.write('first');
+      context.terminal.write('second');
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchange: ITerminalExchange = await startAsync(
+        client,
+        createWireEnvelope('global', 'custom', repoRoot)
+      );
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'global' } }
+      ]);
+      const kinds: string[] = describeFrames(exchange.frames);
+      expect(kinds.indexOf('output')).toBeGreaterThan(kinds.indexOf('requestStarted'));
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it.each([false, undefined])(
+    'tells a client whose subscribe has supportsRequestStarted %s nothing',
+    async (supportsRequestStarted: boolean | undefined) => {
+      const repoRoot: string = createRepoRoot();
+      const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async (context) => {
+        context.terminal.write('output');
+        return { exitCode: 0 };
+      });
+      const client: DaemonRequestWireClient = await connectAsync(host, supportsRequestStarted);
+      try {
+        const exchange: ITerminalExchange = await startAsync(
+          client,
+          createWireEnvelope('global', 'custom', repoRoot)
+        );
+        expect(describeFrames(exchange.frames)).not.toContain('requestStarted');
+        expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      } finally {
+        await client.closeAsync();
+        await host.closeAsync();
+      }
+    }
+  );
+
+  it('tells a queued request only once the request ahead of it finishes and it starts', async () => {
+    const repoRoot: string = createRepoRoot();
+    const holderStarted: IDeferred<void> = createDeferred<void>();
+    const releaseHolder: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, (requestId: string) => async () => {
+      if (requestId === 'holder') {
+        holderStarted.resolve();
+        await releaseHolder.promise;
+      }
+      return { exitCode: 0 };
+    });
+    const holder: DaemonRequestWireClient = await connectAsync(host, true);
+    const queued: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await holder.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('holder', 'custom', repoRoot)
+      });
+      await holderStarted.promise;
+      await queued.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('queued', 'custom', repoRoot)
+      });
+      expect(await queued.readControlAsync()).toMatchObject({
+        kind: 'queuePosition',
+        payload: { requestId: 'queued' }
+      });
+      // The daemon answers in order, so a requestStarted that it had sent would arrive before the pong.
+      await queued.sendControlAsync({ kind: 'ping', payload: {} });
+      expect((await queued.readControlAsync()).kind).toBe('pong');
+      releaseHolder.resolve();
+      const holderExchange: ITerminalExchange = await holder.readTerminalAsync('holder');
+      expect(findStarted(holderExchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'holder' } }
+      ]);
+      const exchange: ITerminalExchange = await queued.readTerminalAsync('queued');
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'queued' } }
+      ]);
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      releaseHolder.resolve();
+      await Promise.all([holder.closeAsync(), queued.closeAsync()]);
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a request whose resolver had not returned at shutdown that it did not start', async () => {
+    const repoRoot: string = createRepoRoot();
+    const resolving: IDeferred<void> = createDeferred<void>();
+    // Like ProductionDaemonRequestResolver, it stops when its request is aborted and reports the shutdown's reason.
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ abortSignal }) => {
+      await new Promise<void>((resolve) => {
+        abortSignal.addEventListener('abort', () => resolve(), { once: true });
+        resolving.resolve();
+      });
+      const reason: DaemonShutdownError | undefined = getDaemonShutdownReason(abortSignal);
+      throw new DaemonRequestDispatchError(
+        'routingFailed',
+        reason?.message ?? 'The request was not shut down.'
+      );
+    });
+    const host: RushDaemonHost = await startHostAsync(repoRoot, resolver);
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('resolving', 'custom', repoRoot)
+      });
+      await resolving.promise;
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })
+      );
+      const exchange: ITerminalExchange = await client.readTerminalAsync('resolving');
+      expect(findStarted(exchange.frames)).toEqual([]);
+      expect(exchange.terminal).toEqual({
+        kind: 'requestRejected',
+        payload: {
+          code: 'routingFailed',
+          message:
+            'The Rush daemon was shut down (the daemon process received SIGTERM) while this request was ' +
+            'queued; it did not start. Re-run the command.',
+          requestId: 'resolving'
+        }
+      });
+      await closePromise;
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a request queued for admission that it did not start, and sends it no requestStarted', async () => {
+    const repoRoot: string = createRepoRoot();
+    const holderStarted: IDeferred<void> = createDeferred<void>();
+    const releaseHolder: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, (requestId: string) => async () => {
+      if (requestId === 'holder') {
+        holderStarted.resolve();
+        await releaseHolder.promise;
+      }
+      return { exitCode: 0 };
+    });
+    const holder: DaemonRequestWireClient = await connectAsync(host, true);
+    const queued: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await holder.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('holder', 'custom', repoRoot)
+      });
+      await holderStarted.promise;
+      await queued.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('queued', 'custom', repoRoot)
+      });
+      expect(await queued.readControlAsync()).toMatchObject({
+        kind: 'queuePosition',
+        payload: { requestId: 'queued' }
+      });
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'controlClient' })
+      );
+      releaseHolder.resolve();
+      const exchange: ITerminalExchange = await queued.readTerminalAsync('queued');
+      expect(findStarted(exchange.frames)).toEqual([]);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was queued; it did not start. Re-run the command.',
+          requestId: 'queued'
+        }
+      });
+      await closePromise;
+    } finally {
+      releaseHolder.resolve();
+      await Promise.all([holder.closeAsync(), queued.closeAsync()]);
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a request that got requestStarted that it was running when the daemon shut down', async () => {
+    const repoRoot: string = createRepoRoot();
+    const started: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => {
+      started.resolve();
+      await release.promise;
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('started', 'custom', repoRoot)
+      });
+      await started.promise;
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'controlClient' })
+      );
+      release.resolve();
+      const exchange: ITerminalExchange = await client.readTerminalAsync('started');
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'started' } }
+      ]);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was running; re-run the command.',
+          requestId: 'started'
+        }
+      });
+      await closePromise;
+    } finally {
+      release.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a client when a phased request starts, before the events and output of its operations', async () => {
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [
+          OPERATION_A,
+          new TestOperationRunner(OPERATION_A, OperationStatus.Success, async (terminal: ITerminal) =>
+            terminal.writeLine('operation-output')
+          )
+        ]
+      ])
+    );
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+      kind: 'phased',
+      request: {
+        commandName: envelope.commandName,
+        commandOrigin: envelope.commandOrigin,
+        engineShape: TEST_ENGINE_SHAPE,
+        environment: envelope.environment,
+        operationSelection: [{ enabledState: true, operationId: OPERATION_A }],
+        requestId: envelope.requestId
+      }
+    }));
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      createWorkspaceSessionAsync: () => Promise.resolve(fixture.session),
+      daemonVersion: DAEMON_VERSION,
+      repoRoot,
+      requestResolver: resolver,
+      rushVersion: RUSH_VERSION
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchange: ITerminalExchange = await startAsync(
+        client,
+        createWireEnvelope('phased', 'build', repoRoot, {
+          argv: ['build', OPERATION_A],
+          commandOrigin: 'built-in'
+        })
+      );
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'phased' } }
+      ]);
+      const kinds: string[] = describeFrames(exchange.frames);
+      expect(kinds).toContain('output');
+      expect(kinds.indexOf('output')).toBeGreaterThan(kinds.indexOf('requestStarted'));
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('runs a global command only once its requestStarted frame is written', async () => {
+    const repoRoot: string = createRepoRoot();
+    const order: string[] = [];
+    const writeStarted: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const spy: jest.SpyInstance = holdRequestStartedWrites(order, writeStarted, release.promise);
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => {
+      order.push('executor');
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchangePromise: Promise<ITerminalExchange> = startAsync(
+        client,
+        createWireEnvelope('global', 'custom', repoRoot)
+      );
+      // A failed expectation closes the connection before the exchange is awaited.
+      exchangePromise.catch(() => undefined);
+      await writeStarted.promise;
+      await settleAsync();
+      expect(order).toEqual(['write']);
+      release.resolve();
+      const exchange: ITerminalExchange = await exchangePromise;
+      expect(order).toEqual(['write', 'written', 'executor']);
+      expect(findStarted(exchange.frames)).toHaveLength(1);
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      release.resolve();
+      spy.mockRestore();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('runs a global command only once the operating system holds its requestStarted frame', async () => {
+    const repoRoot: string = createRepoRoot();
+    const order: string[] = [];
+    const writeStarted: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const sendFrameWrittenAsync: (frame: IDaemonFrame) => Promise<void> =
+      DaemonFrameConnection.prototype.sendFrameWrittenAsync;
+    // The daemon waits here as it would for a socket that has not written the frame yet.
+    const spy: jest.SpyInstance = jest
+      .spyOn(DaemonFrameConnection.prototype, 'sendFrameWrittenAsync')
+      .mockImplementation(async function (this: DaemonFrameConnection, frame: IDaemonFrame): Promise<void> {
+        order.push('write');
+        writeStarted.resolve();
+        await release.promise;
+        await sendFrameWrittenAsync.call(this, frame);
+        order.push('written');
+      });
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => {
+      order.push('executor');
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchangePromise: Promise<ITerminalExchange> = startAsync(
+        client,
+        createWireEnvelope('global', 'custom', repoRoot)
+      );
+      // A failed expectation closes the connection before the exchange is awaited.
+      exchangePromise.catch(() => undefined);
+      await Promise.race([writeStarted.promise, exchangePromise.then(() => undefined)]);
+      await settleAsync();
+      expect(order).toEqual(['write']);
+      release.resolve();
+      const exchange: ITerminalExchange = await exchangePromise;
+      expect(order).toEqual(['write', 'written', 'executor']);
+      expect(findStarted(exchange.frames)).toHaveLength(1);
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      release.resolve();
+      spy.mockRestore();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a phased request after its batch reconciles, and runs it only once the frame is written', async () => {
+    const repoRoot: string = createRepoRoot();
+    const order: string[] = [];
+    const writeStarted: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const runner: TestOperationRunner = new TestOperationRunner(
+      OPERATION_A,
+      OperationStatus.Success,
+      async () => {
+        order.push('operation');
+      }
+    );
+    const fixture: ITestRoutingFixture = createRoutingFixture(new Map([[OPERATION_A, runner]]));
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      order.push('reconcile');
+    };
+    // A rebuild closes the runners before it schedules, which must also wait for the frame.
+    const rebuildSettings: IPhasedCommandEngineRequestSettings = {
+      isIncrementalBuildAllowed: false,
+      parallelism: 1,
+      quietMode: true
+    };
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+      kind: 'phased',
+      request: {
+        commandName: envelope.commandName,
+        commandOrigin: envelope.commandOrigin,
+        engineShape: TEST_ENGINE_SHAPE,
+        environment: envelope.environment,
+        operationSelection: [{ enabledState: true, operationId: OPERATION_A }],
+        requestId: envelope.requestId
+      },
+      requestSettings: rebuildSettings
+    }));
+    const spy: jest.SpyInstance = holdRequestStartedWrites(order, writeStarted, release.promise);
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      createWorkspaceSessionAsync: () => Promise.resolve(fixture.session),
+      daemonVersion: DAEMON_VERSION,
+      repoRoot,
+      requestResolver: resolver,
+      rushVersion: RUSH_VERSION
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchangePromise: Promise<ITerminalExchange> = startAsync(
+        client,
+        createWireEnvelope('phased', 'build', repoRoot, {
+          argv: ['build', OPERATION_A],
+          commandOrigin: 'built-in'
+        })
+      );
+      // A failed expectation closes the connection before the exchange is awaited.
+      exchangePromise.catch(() => undefined);
+      await writeStarted.promise;
+      await settleAsync();
+      expect(order).toEqual(['reconcile', 'write']);
+      expect(runner.closeCount).toBe(0);
+      release.resolve();
+      const exchange: ITerminalExchange = await exchangePromise;
+      expect(order).toEqual(['reconcile', 'write', 'written', 'operation']);
+      expect(runner.closeCount).toBeGreaterThan(0);
+      expect(findStarted(exchange.frames)).toHaveLength(1);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+    } finally {
+      release.resolve();
+      spy.mockRestore();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('rejects a requestStarted that a client sends as a protocol error', async () => {
+    const repoRoot: string = createRepoRoot();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => ({ exitCode: 0 }));
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await client.sendControlAsync({ kind: 'requestStarted', payload: { requestId: 'client-sent' } });
+      expect(await client.readControlAsync()).toMatchObject({
+        kind: 'error',
+        payload: { code: 'malformedControlMessage' }
+      });
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
new file mode 100644
index 00000000000..dcd035e76c6
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
@@ -0,0 +1,221 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+
+// These cases start real hosts and run Git/build subprocesses rather than mocked unit work.
+jest.setTimeout(30_000);
+
+const message: string = 'rush build: error: Unrecognized arguments: --nope.';
+const invalid: string[] = ['build', '--to', 'b', '--nope'];
+const LOCK_WAIT_TIMEOUT_MS: number = 1000;
+// Native Rush prints the usage of the command to stdout before the message.
+const usageFailure: object = {
+  kind: 'requestResult',
+  payload: {
+    exitCode: 2,
+    outcome: 'failure',
+    aborted: false,
+    errorMessage: message,
+    usage: expect.stringMatching(/^usage: rush build \[-h\] .*\[-t PROJECT\]/s)
+  }
+};
+const inProcess: object = { kind: 'requestRejected', payload: { code: 'unsupported', message } };
+const success: object = { kind: 'requestResult', payload: { exitCode: 0 } };
+
+function experimentsJson(useIPCScriptsInWatchMode: boolean): string {
+  return JSON.stringify({ useIPCScriptsInWatchMode });
+}
+
+it('fails an invalid command line with the exit code of native Rush instead of handing it to in-process Rush', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    // Until a build binds a session, the daemon has not checked the configuration that it loaded at startup.
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    const generation: number = fixture.host.workspaceGeneration;
+    const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.session.operationGraph).toBe(graph);
+    // The daemon answers only for a command line that starts with the requested command.
+    const globalFlag: string[] = ['--debug', ...invalid];
+    expect((await fixture.runAsync(globalFlag, { commandName: 'build' })).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect(fixture.session.operationGraph).toBe(graph);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
+it('answers an invalid command line of a custom phased command as it does one of build, and of no other custom command', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: [
+          {
+            commandKind: 'phased',
+            name: 'build',
+            phases: ['_phase:compile'],
+            incremental: true,
+            enableParallelism: true
+          },
+          {
+            commandKind: 'phased',
+            name: 'test',
+            summary: 'Builds and tests',
+            phases: ['_phase:compile'],
+            incremental: true,
+            enableParallelism: true
+          },
+          { commandKind: 'global', name: 'hello', summary: 'Hello', shellCommand: 'echo hello' }
+        ]
+      })
+    );
+  });
+  try {
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    const testMessage: string = 'rush test: error: Unrecognized arguments: --nope.';
+    const invalidTest: string[] = ['test', '--to', 'b', '--nope'];
+    // A custom command is parsed before the input capture, but its usage error waits for the same check as build's.
+    expect((await fixture.runAsync(invalidTest, custom)).terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { code: 'unsupported', message: testMessage }
+    });
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalidTest, custom)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        exitCode: 2,
+        outcome: 'failure',
+        aborted: false,
+        errorMessage: testMessage,
+        usage: expect.stringMatching(/^usage: rush test \[-h\] /)
+      }
+    });
+    // The daemon serves no global or unknown command, so in-process Rush reports its invalid command line.
+    for (const argv of [
+      ['hello', '--nope'],
+      ['nope', '--to', 'b']
+    ]) {
+      expect((await fixture.runAsync(argv, custom)).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported' }
+      });
+    }
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
+it('hands an invalid command line to in-process Rush after a configuration change, which parses it again', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    // The warm session's configuration may be stale, for example without a parameter that experiments.json adds.
+    fixture.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        scripts: { '_phase:compile': 'node build.cjs --changed' }
+      })
+    );
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    expect(fixture.runs()).toEqual(['a', 'b', 'a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
+it('hands an invalid command line to in-process Rush while the warm set waits for a reload that found the Rush lock busy', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    // A graph-affecting parameter needs a reload (the engine of build serves --ignore-hooks itself). The reload
+    // stops the warm set before it takes the Rush lock, which this test holds.
+    const native: LockFile | undefined = LockFile.tryAcquire(
+      fixture.session.rushConfiguration.commonTempFolder,
+      'rush'
+    );
+    expect(native).toBeDefined();
+    try {
+      // Windows lock files don't say which process holds them, so there the daemon waits for this one until the
+      // request's wait timeout ends.
+      const busy: object =
+        process.platform === 'win32'
+          ? { kind: 'requestResult', payload: { admissionErrorCode: 'wait-timeout', exitCode: 1 } }
+          : {
+              kind: 'requestRejected',
+              payload: { message: expect.stringContaining('Another Rush command') }
+            };
+      expect(
+        (
+          await fixture.runAsync(['build', '--to', 'b', '--changed-projects-only'], {
+            admission: { waitTimeoutMs: LOCK_WAIT_TIMEOUT_MS }
+          })
+        ).terminal
+      ).toMatchObject(busy);
+    } finally {
+      native?.release();
+    }
+    // The inputs did not change, but the daemon answers again only after a build reloads.
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
+it('hands an invalid command line to in-process Rush when the configuration changed while the daemon started', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
+    // A build that has watch phases gets --no-ipc when experiments.json turns on useIPCScriptsInWatchMode.
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: [
+          {
+            commandKind: 'phased',
+            name: 'build',
+            phases: ['_phase:compile'],
+            incremental: true,
+            enableParallelism: true,
+            watchOptions: { alwaysWatch: false, watchPhases: ['_phase:compile'] }
+          }
+        ]
+      })
+    );
+    created.write('common/config/rush/experiments.json', experimentsJson(false));
+    created.afterCreateSessionAsync = async () => {
+      created.afterCreateSessionAsync = undefined;
+      // The startup capture reads this edit, but the session that the daemon loaded read experiments.json before it.
+      created.write('common/config/rush/experiments.json', experimentsJson(true));
+    };
+  });
+  try {
+    const noIpc: string[] = ['build', '--to', 'b', '--no-ipc'];
+    expect((await fixture.runAsync(noIpc)).terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { code: 'unsupported', message: 'rush build: error: Unrecognized arguments: --no-ipc.' }
+    });
+    // The first build binds a session that reads the edited experiments.json.
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(noIpc)).terminal).toMatchObject(success);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts
new file mode 100644
index 00000000000..66c57759d1b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts
@@ -0,0 +1,201 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { RushDaemonHost } from '../RushDaemonHost';
+import { RequestExclusivityClass } from '../RequestScheduler';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import {
+  CallbackDaemonRequestResolver,
+  DaemonRequestWireClient,
+  createDeferred,
+  createWireEnvelope
+} from './DaemonRequestWireTestUtilities';
+import type { IDeferred, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const testRepoRoots: Set<string> = new Set();
+
+afterEach(() => {
+  for (const repoRoot of testRepoRoots) fs.rmSync(repoRoot, { force: true, recursive: true });
+  testRepoRoots.clear();
+});
+
+interface IEarlyFailureHost {
+  readonly abortSpy: jest.SpyInstance;
+  readonly fixture: ITestRoutingFixture;
+  readonly host: RushDaemonHost;
+  readonly releaseC: IDeferred<void>;
+  readonly repoRoot: string;
+}
+
+/** A consumes B and C. B fails once C runs, and C runs until `releaseC` resolves. */
+async function startEarlyFailureHostAsync(sharedBuildCommandName?: string): Promise<IEarlyFailureHost> {
+  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-wire-early-failure-'));
+  testRepoRoots.add(repoRoot);
+  const startedC: IDeferred<void> = createDeferred<void>();
+  const releaseC: IDeferred<void> = createDeferred<void>();
+  const fixture: ITestRoutingFixture = createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Failure, () => startedC.promise)],
+      [
+        OPERATION_C,
+        new TestOperationRunner(OPERATION_C, OperationStatus.Success, async (): Promise<void> => {
+          startedC.resolve();
+          await releaseC.promise;
+        })
+      ]
+    ]),
+    [
+      [OPERATION_A, OPERATION_B],
+      [OPERATION_A, OPERATION_C]
+    ],
+    { parallelism: 2 }
+  );
+  const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+  const host: RushDaemonHost = await RushDaemonHost.startAsync({
+    createWorkspaceSessionAsync: () => Promise.resolve(fixture.session),
+    daemonVersion: 'wire-test',
+    repoRoot,
+    requestResolver: new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+      kind: 'phased',
+      exclusivityClass:
+        envelope.commandName === sharedBuildCommandName ? RequestExclusivityClass.SharedBuild : undefined,
+      request: {
+        commandName: envelope.commandName,
+        commandOrigin: envelope.commandOrigin,
+        engineShape: TEST_ENGINE_SHAPE,
+        environment: envelope.environment,
+        operationSelection: envelope.argv
+          .slice(1)
+          .map((operationId: string) => ({ enabledState: true, operationId })),
+        requestId: envelope.requestId,
+        returnEarlyOnFailure: envelope.returnEarlyOnFailure
+      }
+    })),
+    rushVersion: '5.178.1'
+  });
+  return { abortSpy, fixture, host, releaseC, repoRoot };
+}
+
+/** Counts the aborts that the router requested; every iteration's start also calls the spy without options. */
+function countTerminatingAborts(abortSpy: jest.SpyInstance): number {
+  return abortSpy.mock.calls.filter(
+    ([options]: ReadonlyArray<{ terminateRunning?: boolean } | undefined>) =>
+      options?.terminateRunning === true
+  ).length;
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+async function buildAndDisconnectAsync(
+  { host, repoRoot }: IEarlyFailureHost,
+  commandName: string = 'build',
+  commandOrigin: 'built-in' | 'custom' = 'built-in'
+): Promise<ITerminalExchange> {
+  const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+  await client.handshakeAsync();
+  const envelope: IDaemonRequestEnvelope = createWireEnvelope('agent', commandName, repoRoot, {
+    argv: [commandName, OPERATION_A],
+    commandOrigin,
+    returnEarlyOnFailure: true
+  });
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  const exchange: ITerminalExchange = await client.readTerminalAsync('agent');
+  await client.closeAsync();
+  await client.closed;
+  return exchange;
+}
+
+describe('daemon requests that return early on failure', () => {
+  it('keeps the work that continues after the result when the client disconnects, until the daemon closes', async () => {
+    const setup: IEarlyFailureHost = await startEarlyFailureHostAsync();
+    try {
+      const exchange: ITerminalExchange = await buildAndDisconnectAsync(setup);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure', requestId: 'agent' }
+      });
+      await settleAsync();
+      expect(setup.fixture.graph.status).toBe(OperationStatus.Executing);
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(0);
+
+      const closed: Promise<void> = setup.host.closeAsync();
+      await settleAsync();
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(1);
+      setup.releaseC.resolve();
+      await closed;
+    } finally {
+      setup.releaseC.resolve();
+      await setup.host.closeAsync();
+    }
+  });
+
+  it('yields a custom incremental command lease after its early failure result', async () => {
+    const setup: IEarlyFailureHost = await startEarlyFailureHostAsync('test');
+    let client: DaemonRequestWireClient | undefined;
+    try {
+      const exchange: ITerminalExchange = await buildAndDisconnectAsync(setup, 'test', 'custom');
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure', requestId: 'agent' }
+      });
+
+      client = await DaemonRequestWireClient.connectAsync(setup.host.paths.socketPath);
+      await client.handshakeAsync();
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('exclusive', 'retest', setup.repoRoot, {
+          argv: ['retest', OPERATION_A],
+          commandOrigin: 'custom'
+        })
+      });
+      await settleAsync();
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(1);
+    } finally {
+      setup.releaseC.resolve();
+      await client?.closeAsync();
+      await setup.host.closeAsync();
+    }
+  });
+
+  it('lets the work that continues finish after the client disconnects', async () => {
+    const setup: IEarlyFailureHost = await startEarlyFailureHostAsync();
+    try {
+      await buildAndDisconnectAsync(setup);
+      setup.releaseC.resolve();
+      while (setup.fixture.graph.status === OperationStatus.Executing) {
+        await settleAsync();
+      }
+      await settleAsync();
+      await setup.host.closeAsync();
+
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(0);
+      const retainedC: OperationStatus | undefined = [...setup.fixture.graph.resultByOperation.values()].find(
+        ({ operation }) => operation.name === OPERATION_C
+      )?.status;
+      expect(retainedC).toBe(OperationStatus.Success);
+    } finally {
+      setup.releaseC.resolve();
+      await setup.host.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
index e570988009c..363bed3cc86 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
@@ -5,7 +5,11 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
-import { DaemonFrameType, decodeDaemonLogChunk } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  decodeDaemonLogChunk
+} from '@rushstack/rush-daemon-protocol';
 import type { DaemonControlMessage, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
 import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
@@ -26,6 +30,8 @@ const DAEMON_VERSION: string = 'wire-test';
 const RUSH_VERSION: string = '5.178.1';
 const INPUT_BYTE: number = 0xff;
 const WAIT_TIMEOUT_MS: number = 20;
+/** Long enough for the daemon to read a ping from a local socket. */
+const PING_READ_WAIT_MS: number = 100;
 const FAILURE_EXIT_CODE: number = 7;
 const testRepoRoots: Set<string> = new Set();
 
@@ -304,7 +310,7 @@ describe('daemon global request wire integration', () => {
     }
   });
 
-  it('tells a request queued for admission that the daemon shut down', async () => {
+  it('tells a request queued for admission that it did not start when the daemon shut down', async () => {
     const repoRoot: string = createRepoRoot();
     const holderStarted: IDeferred<void> = createDeferred<void>();
     const releaseHolder: IDeferred<void> = createDeferred<void>();
@@ -337,9 +343,26 @@ describe('daemon global request wire integration', () => {
       });
       const closePromise: Promise<void> = host.closeAsync(shutdown);
       releaseHolder.resolve();
+      // Neither client subscribed to requestStarted; the daemon still knows which request started.
       expect((await clients[1].readTerminalAsync('queued')).terminal).toMatchObject({
         kind: 'requestResult',
-        payload: { aborted: true, admissionErrorCode: 'aborted', errorMessage: shutdown.message }
+        payload: {
+          aborted: true,
+          admissionErrorCode: 'aborted',
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was queued; it did not start. Re-run the command.'
+        }
+      });
+      // The request ahead of it had started.
+      expect((await clients[0].readTerminalAsync('holder')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was running; re-run the command.'
+        }
       });
       await closePromise;
     } finally {
@@ -349,6 +372,60 @@ describe('daemon global request wire integration', () => {
     }
   });
 
+  it('ignores a ping that arrives while a shutdown stops a running request, and still sends its result', async () => {
+    const repoRoot: string = createRepoRoot();
+    const started: IDeferred<void> = createDeferred<void>();
+    const aborted: IDeferred<void> = createDeferred<void>();
+    const releaseAborted: IDeferred<void> = createDeferred<void>();
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async () => {
+      const executorAsync: GlobalCommandExecutor = async (context) => {
+        started.resolve();
+        if (!context.abortSignal.aborted) {
+          await new Promise((resolve) =>
+            context.abortSignal.addEventListener('abort', resolve, { once: true })
+          );
+        }
+        aborted.resolve();
+        await releaseAborted.promise;
+        return { exitCode: 0 };
+      };
+      return { executor: executorAsync, kind: 'global' };
+    });
+    const errors: Error[] = [];
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      ...createHostOptions(repoRoot, resolver),
+      onError: (error: Error) => errors.push(error)
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('keepalive', 'custom', repoRoot)
+      });
+      await started.promise;
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'controlClient' })
+      );
+      // The shutdown marks the session closing and aborts the request; the session then waits for its result.
+      await aborted.promise;
+      await client.sendControlAsync({ kind: 'ping', payload: {} });
+      await new Promise((resolve) => setTimeout(resolve, PING_READ_WAIT_MS));
+      releaseAborted.resolve();
+      const exchange: ITerminalExchange = await client.readTerminalAsync('keepalive');
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { aborted: true, requestId: 'keepalive' }
+      });
+      expect(readControlKinds(exchange)).not.toContain('error');
+      await closePromise;
+      expect(errors).toEqual([]);
+    } finally {
+      releaseAborted.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
   it('rejects a second active request on one connection without cancelling the first', async () => {
     const repoRoot: string = createRepoRoot();
     const started: IDeferred<void> = createDeferred<void>();
@@ -476,3 +553,9 @@ function readLogText(exchange: ITerminalExchange): string {
     .map((frame) => new TextDecoder().decode(decodeDaemonLogChunk(frame.payload).chunk))
     .join('');
 }
+
+function readControlKinds(exchange: ITerminalExchange): string[] {
+  return exchange.frames
+    .filter((frame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame) => decodeDaemonControlMessage(frame.payload).kind);
+}
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts
index d98de894d45..0951837e4df 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts
@@ -7,7 +7,9 @@ import * as path from 'node:path';
 
 import { OperationStatus } from '@microsoft/rush-lib';
 import {
+  DAEMON_PROTOCOL_VERSION,
   DaemonFrameType,
+  createDaemonHello,
   decodeDaemonControlMessage,
   decodeDaemonEventFrame,
   decodeDaemonLogChunk
@@ -19,10 +21,12 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import type { ITerminal } from '@rushstack/terminal';
 
+import { ConnectingClientTracker } from '../ConnectingClientTracker';
 import type { IDaemonRequestResolver } from '../DaemonRequestDispatcher';
 import { RushDaemonHost } from '../RushDaemonHost';
 import type { IRushDaemonHostOptions } from '../RushDaemonHost';
 import { WorkspaceEngineRecreationRequiredError } from '../WorkspaceEngineComponentFactory';
+import type { IWorkspaceWarmSetStatus } from '../WorkspaceWarmSet';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -228,6 +232,160 @@ describe('daemon phased request wire integration', () => {
     }
   });
 
+  it('lets a client that connected while the daemon was busy send a request that joins the batch', async () => {
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ])
+    );
+    const leaseRequested: IDeferred<void> = createDeferred<void>();
+    const grantLease: IDeferred<void> = createDeferred<void>();
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      leaseRequested.resolve();
+      await grantLease.promise;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    const reconcileStarted: IDeferred<void> = createDeferred<void>();
+    const lateRequestResolved: IDeferred<void> = createDeferred<void>();
+    let reconcileCount: number = 0;
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      if (reconcileCount++ === 0) {
+        reconcileStarted.resolve();
+        // Like a slower reconcile, this one lets the late request reach the router before it ends.
+        await lateRequestResolved.promise;
+        await settleAsync();
+      }
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => {
+      if (envelope.requestId === 'late') {
+        // Like a slower resolver, this one reaches the router after the reconcile started. The request still joins,
+        // because the daemon received it before then.
+        await reconcileStarted.promise;
+        lateRequestResolved.resolve();
+      }
+      return { kind: 'phased', request: createPhasedRequest(envelope) };
+    });
+    const host: RushDaemonHost = await startHostAsync(repoRoot, fixture, resolver);
+    const clients: DaemonRequestWireClient[] = [await connectAsync(host)];
+    try {
+      const early: Promise<ITerminalExchange> = startAsync(
+        clients[0],
+        phasedEnvelope(repoRoot, 'early', OPERATION_A)
+      );
+      await leaseRequested.promise;
+      // The late client connects, then takes a while before its handshake, as when the daemon replies slowly.
+      clients.push(await DaemonRequestWireClient.connectAsync(host.paths.socketPath));
+      await sleepAsync(150);
+      await clients[1].handshakeAsync();
+      grantLease.resolve();
+      await settleAsync();
+      const late: ITerminalExchange = await startAsync(
+        clients[1],
+        phasedEnvelope(repoRoot, 'late', OPERATION_C)
+      );
+
+      for (const exchange of [await early, late]) {
+        expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      }
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
+  it('counts a connection as connecting until it sends its first request or closes', async () => {
+    const addSpy: jest.SpyInstance = jest.spyOn(ConnectingClientTracker.prototype, 'add');
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([[OPERATION_A, new TestOperationRunner(OPERATION_A)]])
+    );
+    const leaseRequested: IDeferred<void> = createDeferred<void>();
+    const grantLease: IDeferred<void> = createDeferred<void>();
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      leaseRequested.resolve();
+      await grantLease.promise;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    const host: RushDaemonHost = await startHostAsync(repoRoot, fixture);
+    const clients: DaemonRequestWireClient[] = [];
+    try {
+      clients.push(await connectAsync(host));
+      const tracker: ConnectingClientTracker = addSpy.mock.contexts[0] as ConnectingClientTracker;
+      expect(await isWaitingAsync(tracker)).toBe(true);
+      const exchange: Promise<ITerminalExchange> = startAsync(
+        clients[0],
+        phasedEnvelope(repoRoot, 'request', OPERATION_A)
+      );
+      // The request's own batch must not wait for the connection that sent it.
+      await leaseRequested.promise;
+      expect(await isWaitingAsync(tracker)).toBe(false);
+      grantLease.resolve();
+      expect((await exchange).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(await isWaitingAsync(tracker)).toBe(false);
+
+      clients.push(await connectAsync(host));
+      expect(await isWaitingAsync(tracker)).toBe(true);
+      await clients[1].closeAsync();
+      await clients[1].closed;
+      expect(await isWaitingAsync(tracker)).toBe(false);
+      expect(addSpy).toHaveBeenCalledTimes(2);
+    } finally {
+      addSpy.mockRestore();
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
+  it('counts a connection as connecting again once the daemon finishes writing a reply that waited', async () => {
+    const addSpy: jest.SpyInstance = jest.spyOn(ConnectingClientTracker.prototype, 'add');
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([[OPERATION_A, new TestOperationRunner(OPERATION_A)]])
+    );
+    const host: RushDaemonHost = await startHostAsync(repoRoot, fixture);
+    const clients: DaemonRequestWireClient[] = [];
+    try {
+      clients.push(await connectAsync(host));
+      const tracker: ConnectingClientTracker = addSpy.mock.contexts[0] as ConnectingClientTracker;
+      // The first request installs the session, whose warm set status each pong then carries. As in a large repo,
+      // that makes the pong larger than the socket's buffers.
+      const first: ITerminalExchange = await startAsync(
+        clients[0],
+        phasedEnvelope(repoRoot, 'first', OPERATION_A)
+      );
+      expect(first.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      fixture.session.warmSetStatus = createLargeWarmSetStatus();
+
+      const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(
+        host.paths.socketPath
+      );
+      clients.push(client);
+      await client.sendControlAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+      expect((await client.readControlAsync()).kind).toBe('helloAck');
+      await settleAsync();
+      client.pauseReading();
+      await client.sendControlAsync({ kind: 'ping', payload: {} });
+      // The daemon read the ping but cannot finish writing the pong. A client that stops reading must not hold
+      // batches, so its connection still counts as idle once the frame it sent last is old enough.
+      await sleepAsync(150);
+      expect(await isWaitingAsync(tracker)).toBe(false);
+
+      // As when the daemon was too busy to finish writing the pong, the client gets the pong only now, and has not
+      // sent its request yet.
+      client.resumeReading();
+      expect((await client.readControlAsync()).kind).toBe('pong');
+      expect(await isWaitingAsync(tracker)).toBe(true);
+    } finally {
+      addSpy.mockRestore();
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
   it('fails closed with a typed recreation-required outcome before scheduling stale work', async () => {
     const repoRoot: string = createRepoRoot();
     const fixture: ITestRoutingFixture = createRoutingFixture(
@@ -360,3 +518,45 @@ async function readUntilControlKindAsync(
     if (message.kind === kind) return message;
   }
 }
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+function sleepAsync(durationMs: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, durationMs));
+}
+
+/** Whether a batch would still wait for a connecting client after the daemon handled the frames it received. */
+async function isWaitingAsync(tracker: ConnectingClientTracker): Promise<boolean> {
+  return await Promise.race([tracker.waitAsync().then(() => false), settleAsync().then(() => true)]);
+}
+
+/** A warm set status of about 2 MB, like a large repo's, which is larger than any platform's socket buffers. */
+function createLargeWarmSetStatus(): IWorkspaceWarmSetStatus {
+  const projectNames: string[] = Array.from(
+    { length: 20_000 },
+    (unused, index) => `@example/${'large-project-name-'.repeat(5)}${index}`
+  );
+  return {
+    cleanupFailures: [],
+    configuration: {
+      autoWarmByTelemetry: false,
+      warmIdleTimeoutSeconds: 60,
+      warmMemoryBudgetMB: 1024,
+      warmSetMaxProjects: 20_000
+    },
+    daemonResidentMemoryBytes: 0,
+    deferredReason: undefined,
+    maintenanceState: 'running',
+    measuredRunnerMemoryBytes: 0,
+    overMemoryBudget: false,
+    overProjectLimit: false,
+    protectedProjectNames: [],
+    retainedProjectNames: projectNames,
+    unmeasuredRunnerCount: 0,
+    watchedProjectNames: []
+  };
+}
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
index 62d9a9c9135..f070f368c97 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
@@ -11,6 +11,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonControlMessage,
+  IDaemonClientCaps,
   IDaemonFrame,
   IDaemonRequestEnvelope
 } from '@rushstack/rush-daemon-protocol';
@@ -58,7 +59,7 @@ export class DaemonRequestWireClient {
     return new DaemonRequestWireClient(await connectDaemonAsync(socketPath));
   }
 
-  public async handshakeAsync(): Promise<void> {
+  public async handshakeAsync(capabilities: Partial<IDaemonClientCaps> = {}): Promise<void> {
     await this.sendControlAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
     expect((await this.readControlAsync()).kind).toBe('helloAck');
     await this.sendControlAsync({
@@ -67,7 +68,8 @@ export class DaemonRequestWireClient {
         isTTY: true,
         supportsInteractiveIO: true,
         supportsRequestAdmission: true,
-        supportsRequestLifecycle: true
+        supportsRequestLifecycle: true,
+        ...capabilities
       }
     });
     await this.sendControlAsync({ kind: 'ping', payload: {} });
@@ -117,6 +119,19 @@ export class DaemonRequestWireClient {
     return this.#connection.closeAsync();
   }
 
+  /**
+   * Stops reading from the socket, so that what the daemon writes backs up in the socket's buffers. Call it only
+   * while no frame is being received.
+   */
+  public pauseReading(): void {
+    this.#connection.socket.pause();
+  }
+
+  /** Reads from the socket again after {@link DaemonRequestWireClient.pauseReading}. */
+  public resumeReading(): void {
+    this.#connection.socket.resume();
+  }
+
   #receive(frame: IDaemonFrame): void {
     const waiter: IFrameWaiter | undefined = this.#waiters.shift();
     if (waiter) waiter.resolve(frame);
@@ -163,6 +178,15 @@ export function createDeferred<T>(): IDeferred<T> {
   return { promise, resolve: resolvePromise };
 }
 
+/**
+ * Rejects as `promise` does, but resolves to a fixed string instead of its value. A test that expects a rejection
+ * passes this to `expect(...).rejects`, whose failure prints the value that the promise resolved to: in these tests,
+ * that value can hold a request's environment, which is the whole process environment.
+ */
+export function hideResolvedValueAsync(promise: Promise<unknown>): Promise<string> {
+  return promise.then(() => 'The promise resolved.');
+}
+
 export function createWireEnvelope(
   requestId: string,
   commandName: string,
diff --git a/libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts b/libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts
new file mode 100644
index 00000000000..9f4b8e01a3b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts
@@ -0,0 +1,108 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { readResidentMemoryBytes } from '../DaemonResidentMemory';
+
+const PROC_SELF_STATUS: string = '/proc/self/status';
+const FALLBACK_BYTES: number = 777_777_777;
+// As the kernel writes it: a tab after each key, and each value right-aligned in 8 columns.
+const KERNEL_STATUS: string = [
+  'Name:\tnode',
+  'VmPeak:\t 9000000 kB',
+  'VmSize:\t 8000000 kB',
+  'VmHWM:\t  700000 kB',
+  'VmRSS:\t  123456 kB',
+  'RssAnon:\t  100000 kB',
+  'RssFile:\t   20000 kB',
+  'RssShmem:\t    3456 kB',
+  'Threads:\t18',
+  ''
+].join('\n');
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+function readVmRssBytes(): number {
+  const match: RegExpExecArray | null = /^VmRSS:\s*(\d+) kB$/m.exec(fs.readFileSync(PROC_SELF_STATUS, 'utf8'));
+  return Number(match?.[1]) * 1024;
+}
+
+// Answers the reads of /proc/self/status in turn, with a text or by throwing, and passes every other read through.
+function answerStatusReads(...answers: (string | Error)[]): jest.SpyInstance {
+  const { readFileSync } = fs;
+  return jest.spyOn(fs, 'readFileSync').mockImplementation(((
+    ...args: Parameters<typeof readFileSync>
+  ): string | Buffer => {
+    const [file] = args;
+    if (file !== PROC_SELF_STATUS) return readFileSync(...args);
+    const answer: string | Error | undefined = answers.shift();
+    if (answer instanceof Error) throw answer;
+    return String(answer);
+  }) as typeof readFileSync);
+}
+
+function createReadError(code: string): NodeJS.ErrnoException {
+  return Object.assign(new Error(`${code}: cannot read ${PROC_SELF_STATUS}`), { code });
+}
+
+describe(readResidentMemoryBytes.name, () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  linuxIt('returns VmRSS, between the values read just before and just after it', () => {
+    const before: number = readVmRssBytes();
+    const bytes: number = readResidentMemoryBytes();
+    const after: number = readVmRssBytes();
+    expect(bytes).toBeGreaterThanOrEqual(Math.min(before, after));
+    expect(bytes).toBeLessThanOrEqual(Math.max(before, after));
+  });
+
+  linuxIt("reads VmRSS's line in kibibytes, from a new read on each call", () => {
+    const reads: jest.SpyInstance = answerStatusReads(
+      KERNEL_STATUS,
+      'VmHWM: 2000 kB\nVmRSS: 1500 kB\nVmSize: 9000 kB'
+    );
+    expect([readResidentMemoryBytes(), readResidentMemoryBytes()]).toEqual([126_418_944, 1_536_000]);
+    expect(reads.mock.calls.filter(([file]) => file === PROC_SELF_STATUS)).toHaveLength(2);
+  });
+
+  linuxIt(
+    'falls back to process.memoryUsage.rss() when /proc/self/status cannot be read or has no VmRSS value',
+    () => {
+      jest.spyOn(process.memoryUsage, 'rss').mockReturnValue(FALLBACK_BYTES);
+      answerStatusReads(
+        createReadError('ENOENT'),
+        createReadError('EACCES'),
+        KERNEL_STATUS.replace(/^VmRSS:.*\n/m, ''),
+        KERNEL_STATUS.replace('123456', 'abc'),
+        'garbage\n'
+      );
+      const readings: number[] = [1, 2, 3, 4, 5].map(() => readResidentMemoryBytes());
+      expect(readings).toEqual([FALLBACK_BYTES, FALLBACK_BYTES, FALLBACK_BYTES, FALLBACK_BYTES, FALLBACK_BYTES]);
+    }
+  );
+
+  it('throws when the fallback cannot read the resident memory either', () => {
+    const error: Error = new Error('EMFILE: too many open files, uv_resident_set_memory');
+    jest.spyOn(process.memoryUsage, 'rss').mockImplementation(() => {
+      throw error;
+    });
+    answerStatusReads(createReadError('EMFILE'));
+    expect(() => readResidentMemoryBytes()).toThrow(error);
+  });
+
+  it('returns process.memoryUsage.rss() on other platforms, without reading /proc', () => {
+    const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+    jest.spyOn(process.memoryUsage, 'rss').mockReturnValue(FALLBACK_BYTES);
+    const reads: jest.SpyInstance = answerStatusReads(KERNEL_STATUS);
+    Object.defineProperty(process, 'platform', { ...platform, value: 'darwin' });
+    try {
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    } finally {
+      Object.defineProperty(process, 'platform', platform);
+    }
+    expect(reads.mock.calls.filter(([file]) => file === PROC_SELF_STATUS)).toHaveLength(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts b/libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts
new file mode 100644
index 00000000000..831df767e00
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { serveRushDaemonAsync, type IRushDaemonServeOptions } from '../serveRushDaemon';
+
+// The host never starts, so these tests bind no socket, write no lockfile, and start or signal no process.
+const START_ERROR: Error = new Error('The test stops the daemon before its host starts.');
+const SHUTDOWN_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM'];
+
+// Both shipped entry points serve without a shutdown signal, so every daemon that they start owns its process.
+describe('serveRushDaemonAsync for a daemon that owns its process', () => {
+  let startAsyncSpy: jest.SpyInstance<Promise<RushDaemonHost>, [IRushDaemonHostOptions]>;
+  let exitSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    // After the daemon stops, a timer exits the process; with fake timers it never fires.
+    jest.useFakeTimers();
+    startAsyncSpy = jest.spyOn(RushDaemonHost, 'startAsync').mockRejectedValue(START_ERROR);
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation();
+  });
+
+  afterEach(() => {
+    jest.clearAllTimers();
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  async function getHostOptionsAsync(
+    options: Partial<IRushDaemonServeOptions> = {}
+  ): Promise<IRushDaemonHostOptions> {
+    await expect(
+      serveRushDaemonAsync({
+        checkInstallation: () => undefined,
+        daemonVersion: 'serve-defaults-test',
+        getSuccessorLaunchAsync: () => Promise.reject(new Error('This test starts no successor.')),
+        repoRoot: 'serve-defaults-test',
+        rushVersion: '5.178.1',
+        ...options
+      })
+    ).rejects.toBe(START_ERROR);
+    expect(startAsyncSpy).toHaveBeenCalledTimes(1);
+    expect(exitSpy).not.toHaveBeenCalled();
+    return startAsyncSpy.mock.calls[0][0];
+  }
+
+  // Literals, not the exported constants: the shutdownSignal option's documentation gives both as 10 seconds.
+  it('gives the host a 10 s shutdown deadline and a 10 s idle garbage collection delay', async () => {
+    const hostOptions: IRushDaemonHostOptions = await getHostOptionsAsync();
+    expect(hostOptions.shutdownDeadlineMs).toBe(10_000);
+    expect(hostOptions.idleGarbageCollectionDelayMs).toBe(10_000);
+  });
+
+  it('keeps a shutdown deadline and an idle garbage collection delay that it was given', async () => {
+    const hostOptions: IRushDaemonHostOptions = await getHostOptionsAsync({
+      shutdownDeadlineMs: 1_234,
+      idleGarbageCollectionDelayMs: 5_678
+    });
+    expect(hostOptions.shutdownDeadlineMs).toBe(1_234);
+    expect(hostOptions.idleGarbageCollectionDelayMs).toBe(5_678);
+  });
+
+  it('listens for SIGINT and SIGTERM only until it stops', async () => {
+    const countListeners = (): number[] => SHUTDOWN_SIGNALS.map((signal) => process.listenerCount(signal));
+    const before: number[] = countListeners();
+    let whileStarting: number[] | undefined;
+    startAsyncSpy.mockImplementation(() => {
+      whileStarting = countListeners();
+      return Promise.reject(START_ERROR);
+    });
+    await getHostOptionsAsync();
+    expect(whileStarting).toEqual(before.map((count: number) => count + 1));
+    expect(countListeners()).toEqual(before);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
index c2c8c91e3d1..218870a5c1b 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
@@ -8,20 +8,31 @@ import * as path from 'node:path';
 import { createDaemonHello, DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
+import * as DaemonResidentMemory from '../DaemonResidentMemory';
+import { DaemonShutdownError } from '../DaemonShutdownError';
 import { RushDaemonHost } from '../RushDaemonHost';
+import { serveRushDaemonAsync } from '../serveRushDaemon';
 import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
 import { TestWorkspaceSession } from './TestWorkspaceSession';
 
+const SHUTTING_DOWN: string = `rushd (PID ${process.pid}) shutting down: `;
+const RESIDENT_MEMORY_BYTES: number = 5_000_000_000;
+
 describe('daemon management shutdown', () => {
   let repoRoot: string;
   let host: RushDaemonHost;
   let client: DaemonRequestWireClient;
+  let logs: string[];
+  let writeLog: (message: string) => void;
 
   beforeEach(async () => {
     repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-shutdown-'));
+    logs = [];
+    writeLog = (message: string) => logs.push(message);
     host = await RushDaemonHost.startAsync({
       createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
       daemonVersion: 'shutdown-test',
+      onLog: (message: string) => writeLog(message),
       repoRoot,
       rushVersion: '5.178.1'
     });
@@ -42,6 +53,9 @@ describe('daemon management shutdown', () => {
     await client.closed;
     await host.closed;
     expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+    expect(logs).toEqual([
+      `${SHUTTING_DOWN}requested by a client ("rush-client daemon stop" or "daemon restart")`
+    ]);
   });
 
   it('requires a handshake before a client can stop the daemon', async () => {
@@ -49,6 +63,49 @@ describe('daemon management shutdown', () => {
     expect((await client.readControlAsync()).kind).toBe('error');
     await client.closed;
     expect(readDaemonLockfile(host.paths.lockfilePath)).toBeDefined();
+    expect(logs).toEqual([]);
+  });
+
+  it('logs only the first reason when it is closed more than once', async () => {
+    await Promise.all([
+      host.closeAsync(new DaemonShutdownError({ initiator: 'signal', signal: 'SIGINT' })),
+      host.closeAsync()
+    ]);
+    await host.closeAsync(new DaemonShutdownError({ initiator: 'idleTimeout' }));
+    expect(logs).toEqual([`${SHUTTING_DOWN}received SIGINT`]);
+  });
+
+  it('logs a close without a reason', async () => {
+    await host.closeAsync();
+    expect(logs).toEqual([`${SHUTTING_DOWN}the daemon host was closed`]);
+  });
+
+  it('still shuts down when its onLog callback throws', async () => {
+    writeLog = () => {
+      throw new Error('The log callback failed.');
+    };
+    await host.closeAsync(new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' }));
+    expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+  });
+
+  it('logs the signal that stopped a served daemon', async () => {
+    const servedRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-shutdown-served-'));
+    const served: string[] = [];
+    const controller: AbortController = new AbortController();
+    try {
+      await serveRushDaemonAsync({
+        createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(servedRoot)),
+        daemonVersion: 'shutdown-test',
+        onLog: (message: string) => served.push(message),
+        onReady: () => controller.abort(new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })),
+        repoRoot: servedRoot,
+        rushVersion: '5.178.1',
+        shutdownSignal: controller.signal
+      });
+    } finally {
+      fs.rmSync(servedRoot, { force: true, recursive: true });
+    }
+    expect(served).toEqual([`${SHUTTING_DOWN}received SIGTERM`]);
   });
 
   it('does not accept lifecycle controls from an older negotiated minor', async () => {
@@ -69,4 +126,20 @@ describe('daemon management shutdown', () => {
       payload: { pid: process.pid, residentMemoryBytes: expect.any(Number) }
     });
   });
+
+  it("reports the daemon's own resident memory from readResidentMemoryBytes in status probes", async () => {
+    const readResident: jest.SpyInstance = jest
+      .spyOn(DaemonResidentMemory, 'readResidentMemoryBytes')
+      .mockReturnValue(RESIDENT_MEMORY_BYTES);
+    try {
+      await client.handshakeAsync();
+      await client.sendControlAsync({ kind: 'ping', payload: {} });
+      expect(await client.readControlAsync()).toMatchObject({
+        kind: 'pong',
+        payload: { pid: process.pid, residentMemoryBytes: RESIDENT_MEMORY_BYTES }
+      });
+    } finally {
+      readResident.mockRestore();
+    }
+  });
 });
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts
new file mode 100644
index 00000000000..5da3550b9d6
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts
@@ -0,0 +1,117 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { DeferredCacheEntryWrites } from '@microsoft/rush-lib/lib/logic/buildCache/DeferredCacheEntryWrites';
+import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+
+import { DaemonShutdownDeadlineError } from '../DaemonShutdownDeadlineError';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { CallbackDaemonRequestResolver, createDeferred } from './DaemonRequestWireTestUtilities';
+import { captureTestDaemonListenerAsync } from './TestDaemonListener';
+import { createTemporaryRepo, TemporaryRepoWorkspaceSession } from './TemporaryRepoWorkspaceSession';
+
+describe('daemon shutdown with build cache entries that are written in the background', () => {
+  let repoRoot: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-cache-writes-'));
+    createTemporaryRepo(repoRoot);
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  function createOptions(overrides: Partial<IRushDaemonHostOptions> = {}): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+      daemonVersion: 'cache-writes-test',
+      repoRoot,
+      rushVersion: '5.178.1',
+      requestResolver: new CallbackDaemonRequestResolver(() => new Promise(() => undefined)),
+      ...overrides
+    };
+  }
+
+  it('drops them after it disposes the workspace session and before it closes its listener', async () => {
+    const events: string[] = [];
+    class RecordingWorkspaceSession extends TemporaryRepoWorkspaceSession {
+      public override async [Symbol.asyncDispose](): Promise<void> {
+        events.push('workspace session disposed');
+        await super[Symbol.asyncDispose]();
+      }
+    }
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(
+      createOptions({
+        createWorkspaceSessionAsync: () => Promise.resolve(new RecordingWorkspaceSession(repoRoot)),
+        onLog: (message: string) => events.push(message)
+      })
+    );
+    const isListening = (): boolean => readDaemonLockfile(host.paths.lockfilePath)?.pid === process.pid;
+    const folderPath: string = fs.mkdtempSync(path.join(repoRoot, 'staging-'));
+    const writeStarted = createDeferred<void>();
+    DeferredCacheEntryWrites.instance.enqueue({
+      cacheId: 'acme-wizard-1',
+      operationName: 'acme-wizard (build)',
+      sealedOutputs: { folderPath, fileCount: 1, byteCount: 1 },
+      writeAsync: async (terminal, abortSignal: AbortSignal) => {
+        writeStarted.resolve();
+        // Like tar, which the abort signal kills
+        await once(abortSignal, 'abort');
+        events.push(`write aborted (listening: ${isListening()})`);
+        return undefined;
+      }
+    });
+    await writeStarted.promise;
+
+    await host.closeAsync();
+    events.push(`closed (listening: ${isListening()})`);
+
+    expect(events).toEqual([
+      expect.stringMatching(/^rushd \(PID \d+\) shutting down: /),
+      'workspace session disposed',
+      'write aborted (listening: true)',
+      'Dropped the build cache entry acme-wizard-1 for acme-wizard (build), which was being written.',
+      'closed (listening: false)'
+    ]);
+    expect(fs.existsSync(folderPath)).toBe(false);
+  });
+
+  it('reports a failure to drop them and still closes its listener', async () => {
+    const failure: Error = new Error('Could not delete the staging folder');
+    jest.spyOn(DeferredCacheEntryWrites.instance, 'abortAsync').mockRejectedValue(failure);
+    const onError: jest.Mock = jest.fn();
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions({ onError }));
+
+    await host.closeAsync();
+
+    expect(onError.mock.calls).toEqual([[failure]]);
+    expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+  });
+
+  it('is cut short at its deadline while it drops them', async () => {
+    jest.spyOn(DeferredCacheEntryWrites.instance, 'abortAsync').mockReturnValue(new Promise(() => undefined));
+    const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+      RushDaemonHost.startAsync(createOptions({ shutdownDeadlineMs: 300 }))
+    );
+    try {
+      const error: unknown = await host.closeAsync().catch((closeError: unknown) => closeError);
+
+      expect(error).toBeInstanceOf(DaemonShutdownDeadlineError);
+      expect(error).toMatchObject({ forcedBy: undefined, stage: 'cacheWrites' });
+      expect((error as Error).message).toMatch(
+        /^The Rush daemon's shutdown did not finish within \d+\.\d s, while stopping the build cache writes\.$/
+      );
+      // The daemon still owns its endpoint.
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+    } finally {
+      await listener.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
new file mode 100644
index 00000000000..c7a6bbb36be
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
@@ -0,0 +1,253 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { LockFile } from '@rushstack/node-core-library';
+import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+
+import { DaemonShutdownDeadline } from '../DaemonShutdownDeadline';
+import { DaemonShutdownDeadlineError } from '../DaemonShutdownDeadlineError';
+import { DaemonShutdownError } from '../DaemonShutdownError';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import {
+  CallbackDaemonRequestResolver,
+  createDeferred,
+  createWireEnvelope,
+  DaemonRequestWireClient
+} from './DaemonRequestWireTestUtilities';
+import { captureTestDaemonListenerAsync } from './TestDaemonListener';
+import { createTemporaryRepo, TemporaryRepoWorkspaceSession } from './TemporaryRepoWorkspaceSession';
+
+const REQUEST_ID: string = 'waits-for-lock';
+// The daemon records the process groups of its detached children on Linux only.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+describe('daemon shutdown deadline', () => {
+  let repoRoot: string;
+  let commonTempFolder: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-deadline-'));
+    commonTempFolder = createTemporaryRepo(repoRoot);
+  });
+  afterEach(() => fs.rmSync(repoRoot, { force: true, recursive: true }));
+
+  function createOptions(overrides: Partial<IRushDaemonHostOptions> = {}): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+      daemonVersion: 'deadline-test',
+      repoRoot,
+      rushVersion: '5.178.1',
+      // Like a request that waits for a lock that another process holds, it ignores its abort signal.
+      requestResolver: new CallbackDaemonRequestResolver(() => new Promise(() => undefined)),
+      ...overrides
+    };
+  }
+
+  async function startRequestAsync(host: RushDaemonHost): Promise<DaemonRequestWireClient> {
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    await client.sendControlAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope(REQUEST_ID, 'build', repoRoot, { argv: ['build', '-t', 'mini-a'] })
+    });
+    // The daemon handles a connection's frames in order, so the request has started once the pong arrives.
+    await client.sendControlAsync({ kind: 'ping', payload: {} });
+    while ((await client.readControlAsync()).kind !== 'pong') {
+      // Skip the request's own messages.
+    }
+    return client;
+  }
+
+  async function stopAsync(host: RushDaemonHost): Promise<void> {
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    await client.sendControlAsync({ kind: 'shutdown', payload: {} });
+    expect(await client.readControlAsync()).toEqual({ kind: 'shutdownAck', payload: { activeRequests: 1 } });
+  }
+
+  it('cuts a stopped daemon short, gives the request a typed result and releases on exit', async () => {
+    const onError: jest.Mock = jest.fn();
+    const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+      RushDaemonHost.startAsync(createOptions({ onError, shutdownDeadlineMs: 300 }))
+    );
+    const client: DaemonRequestWireClient = await startRequestAsync(host);
+    // The lock that the stuck request would hold.
+    const repoLock: LockFile | undefined = LockFile.tryAcquire(commonTempFolder, 'rush');
+    try {
+      expect(repoLock).toBeDefined();
+      await stopAsync(host);
+      await host.closed;
+      const error: unknown = await host.closeAsync().catch((closeError: unknown) => closeError);
+      expect(error).toBeInstanceOf(DaemonShutdownDeadlineError);
+      expect(error).toMatchObject({ forcedBy: undefined, stage: 'requests' });
+      expect((error as DaemonShutdownDeadlineError).unfinishedRequests).toEqual([
+        expect.stringMatching(/^"build -t mini-a" \(running for \d+\.\d s\)$/)
+      ]);
+      expect((error as Error).message).toMatch(
+        /^The Rush daemon's shutdown did not finish within \d+\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a" \(running for \d+\.\d s\)\.$/
+      );
+      expect(onError).not.toHaveBeenCalled();
+      // The shutdown was cut short, so the daemon still owns its endpoint and the repository lock.
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+      if (process.platform !== 'win32') expect(fs.existsSync(host.paths.socketPath)).toBe(true);
+
+      // The request never finishes, so its connection's drain times out and the client gets a typed result.
+      // It never left its resolver, so the result says that it was queued.
+      expect((await client.readTerminalAsync(REQUEST_ID)).terminal).toEqual({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was queued; it did not start. Re-run the command.',
+          exitCode: 1,
+          outcome: 'failure',
+          requestId: REQUEST_ID
+        }
+      });
+      await client.closed;
+
+      expect(host.releaseForExit()).toBe(true);
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+      if (process.platform !== 'win32') {
+        expect(fs.existsSync(host.paths.socketPath)).toBe(false);
+        expect(fs.existsSync(LockFile.getLockFilePath(commonTempFolder, 'rush'))).toBe(false);
+      }
+    } finally {
+      repoLock?.release();
+      await client.closeAsync();
+      await listener.closeAsync();
+    }
+  }, 20000);
+
+  linuxIt(
+    'keeps its files and the repository lock while a recorded child runs',
+    async () => {
+      const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+        RushDaemonHost.startAsync(createOptions({ shutdownDeadlineMs: 300 }))
+      );
+      const client: DaemonRequestWireClient = await startRequestAsync(host);
+      const repoLock: LockFile | undefined = LockFile.tryAcquire(commonTempFolder, 'rush');
+      const repoLockPath: string = LockFile.getLockFilePath(commonTempFolder, 'rush');
+      // Like an operation of the stuck request: detached, so the daemon records its group while it runs.
+      const operation: ChildProcess = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], {
+        detached: true,
+        stdio: 'ignore'
+      });
+      try {
+        await once(operation, 'spawn');
+        expect(repoLock).toBeDefined();
+        await stopAsync(host);
+        await host.closed;
+        await expect(host.closeAsync()).rejects.toBeInstanceOf(DaemonShutdownDeadlineError);
+
+        // A successor must reap the child first, so everything stays, as after a crash.
+        expect(host.releaseForExit()).toBe(false);
+        expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+        expect(fs.existsSync(host.paths.socketPath)).toBe(true);
+        expect(fs.existsSync(repoLockPath)).toBe(true);
+
+        operation.kill('SIGKILL');
+        await once(operation, 'exit');
+        expect(host.releaseForExit()).toBe(true);
+        expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+        expect(fs.existsSync(host.paths.socketPath)).toBe(false);
+        expect(fs.existsSync(repoLockPath)).toBe(false);
+      } finally {
+        if (operation.exitCode === null && operation.signalCode === null) operation.kill('SIGKILL');
+        repoLock?.release();
+        await client.closeAsync();
+        await listener.closeAsync();
+      }
+    },
+    20000
+  );
+
+  it('cuts a running shutdown short when it is expired, as a second signal does', async () => {
+    const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+      RushDaemonHost.startAsync(createOptions())
+    );
+    const client: DaemonRequestWireClient = await startRequestAsync(host);
+    try {
+      const closing: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })
+      );
+      host.expireShutdownDeadline('a second SIGTERM');
+      await expect(closing).rejects.toThrow(
+        /^The Rush daemon's shutdown was cut short by a second SIGTERM after \d+\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a"/
+      );
+      await expect(closing).rejects.toMatchObject({ forcedBy: 'a second SIGTERM', stage: 'requests' });
+    } finally {
+      await client.closeAsync();
+      await listener.closeAsync();
+    }
+  });
+
+  it('does not change a shutdown that finishes in time', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(
+      createOptions({ shutdownDeadlineMs: 10000 })
+    );
+    await host.closeAsync();
+    await host.closed;
+    expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+  });
+});
+
+describe(DaemonShutdownDeadline.name, () => {
+  function createDeadline(
+    timeoutMs: number | undefined,
+    onLateFailure: jest.Mock = jest.fn()
+  ): DaemonShutdownDeadline {
+    return new DaemonShutdownDeadline({
+      timeoutMs,
+      getProgress: () => ({ stage: 'workspaceSession', unfinishedRequests: [] }),
+      onLateFailure
+    });
+  }
+
+  it('settles as the cleanup does when it finishes in time', async () => {
+    await expect(createDeadline(10000).raceAsync(Promise.resolve())).resolves.toBeUndefined();
+    const failure: Error = new Error('cleanup failed');
+    await expect(createDeadline(10000).raceAsync(Promise.reject(failure))).rejects.toBe(failure);
+  });
+
+  it('rejects at the deadline and reports a cleanup that fails later', async () => {
+    const onLateFailure: jest.Mock = jest.fn();
+    const cleanup = createDeferred<void>();
+    const failing: Promise<void> = cleanup.promise.then(() => {
+      throw new Error('late failure');
+    });
+    await expect(createDeadline(10, onLateFailure).raceAsync(failing)).rejects.toMatchObject({
+      forcedBy: undefined,
+      stage: 'workspaceSession',
+      message: expect.stringMatching(
+        /^The Rush daemon's shutdown did not finish within \d+\.\d s, while disposing the workspace session\.$/
+      )
+    });
+    cleanup.resolve();
+    await failing.catch(() => undefined);
+    expect(onLateFailure).toHaveBeenCalledWith(new Error('late failure'));
+  });
+
+  it('is cut short by expire(), also when that comes before the shutdown starts', async () => {
+    const running: DaemonShutdownDeadline = createDeadline(undefined);
+    const racing: Promise<void> = running.raceAsync(new Promise(() => undefined));
+    running.expire('a second SIGINT');
+    await expect(racing).rejects.toMatchObject({ forcedBy: 'a second SIGINT' });
+
+    const early: DaemonShutdownDeadline = createDeadline(undefined);
+    early.expire('a second SIGTERM');
+    early.expire('a third SIGTERM');
+    await expect(early.raceAsync(new Promise(() => undefined))).rejects.toMatchObject({
+      forcedBy: 'a second SIGTERM'
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownError.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownError.test.ts
new file mode 100644
index 00000000000..24bdf6f8a95
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownError.test.ts
@@ -0,0 +1,87 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DaemonShutdownError,
+  getDaemonShutdownReason,
+  getRequestShutdownReason,
+  type IDaemonShutdownErrorOptions
+} from '../DaemonShutdownError';
+
+const INITIATORS: ReadonlyArray<[IDaemonShutdownErrorOptions, string]> = [
+  [{ initiator: 'controlClient' }, 'requested by "rush-client daemon stop" or "daemon restart"'],
+  [{ initiator: 'signal', signal: 'SIGTERM' }, 'the daemon process received SIGTERM'],
+  [{ initiator: 'signal' }, 'the daemon process received a termination signal'],
+  [{ initiator: 'idleTimeout' }, 'idle timeout'],
+  [{ initiator: 'restart' }, 'the daemon restarted to apply workspace changes'],
+  [{ initiator: 'host' }, 'the daemon host was closed'],
+  [
+    { initiator: 'socketLost' },
+    'its socket file was deleted or replaced, so no new client could connect to it'
+  ]
+];
+
+describe(DaemonShutdownError.name, () => {
+  it.each(INITIATORS)(
+    'says that a request that started was running (%j)',
+    (options: IDaemonShutdownErrorOptions, initiator: string) => {
+      const expected: string =
+        `The Rush daemon was shut down (${initiator}) while this request was running; ` +
+        're-run the command.';
+      expect(new DaemonShutdownError(options).message).toBe(expected);
+      expect(new DaemonShutdownError({ ...options, requestStarted: true }).message).toBe(expected);
+      expect(new DaemonShutdownError(options).requestStarted).toBe(true);
+    }
+  );
+
+  it.each(INITIATORS)(
+    'says that a request that did not start was queued (%j)',
+    (options: IDaemonShutdownErrorOptions, initiator: string) => {
+      const error: DaemonShutdownError = new DaemonShutdownError({ ...options, requestStarted: false });
+      expect(error.message).toBe(
+        `The Rush daemon was shut down (${initiator}) while this request was queued; it did not start. ` +
+          'Re-run the command.'
+      );
+      expect(error).toMatchObject({
+        initiator: options.initiator,
+        name: 'DaemonShutdownError',
+        requestStarted: false,
+        signal: options.signal
+      });
+    }
+  );
+});
+
+describe(getRequestShutdownReason.name, () => {
+  it('gives a request that did not start a queued copy of the shutdown reason', () => {
+    const shutdown: DaemonShutdownError = new DaemonShutdownError({ initiator: 'signal', signal: 'SIGINT' });
+    const reason: Error = getRequestShutdownReason(shutdown, false);
+    expect(reason).toBeInstanceOf(DaemonShutdownError);
+    expect(reason).not.toBe(shutdown);
+    expect(reason).toMatchObject({ initiator: 'signal', requestStarted: false, signal: 'SIGINT' });
+    expect(reason.message).toBe(
+      'The Rush daemon was shut down (the daemon process received SIGINT) while this request was queued; ' +
+        'it did not start. Re-run the command.'
+    );
+    expect(shutdown.requestStarted).toBe(true);
+
+    // The routers read the reason from the request's abort signal.
+    const controller: AbortController = new AbortController();
+    controller.abort(reason);
+    expect(getDaemonShutdownReason(controller.signal)).toBe(reason);
+  });
+
+  it('gives a request that started the shutdown reason itself', () => {
+    const shutdown: DaemonShutdownError = new DaemonShutdownError({ initiator: 'controlClient' });
+    expect(getRequestShutdownReason(shutdown, true)).toBe(shutdown);
+  });
+
+  it('keeps a queued reason and any other error as they are', () => {
+    const queued: DaemonShutdownError = new DaemonShutdownError({ initiator: 'host', requestStarted: false });
+    expect(getRequestShutdownReason(queued, false)).toBe(queued);
+    expect(getRequestShutdownReason(queued, true)).toBe(queued);
+    const closed: Error = new Error('The daemon client connection closed.');
+    expect(getRequestShutdownReason(closed, false)).toBe(closed);
+    expect(getRequestShutdownReason(closed, true)).toBe(closed);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
new file mode 100644
index 00000000000..ba5fd8e2c29
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
@@ -0,0 +1,206 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { LockFile } from '@rushstack/node-core-library';
+import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DEFAULT_SHUTDOWN_DEADLINE_MS } from '../serveRushDaemon';
+import { createWireEnvelope, DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
+import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
+import {
+  captureTestProcessIdentity,
+  isTestProcessRunning,
+  type ITestProcessIdentity
+} from './TestProcessExit';
+
+const FIXTURE_PATH: string = path.join(__dirname, 'fixtures', 'StuckShutdownDaemon.js');
+const REQUEST_ID: string = 'stuck-request';
+const POLL_INTERVAL_MS: number = 20;
+const START_TIMEOUT_MS: number = 15000;
+
+interface IProcessExit {
+  readonly code: number | undefined;
+  readonly signal: NodeJS.Signals | undefined;
+}
+
+interface IStuckDaemon {
+  readonly process: ChildProcess;
+  readonly pid: number;
+  readonly exited: Promise<IProcessExit>;
+  readonly getStderr: () => string;
+}
+
+interface IStuckRequest {
+  readonly client: DaemonRequestWireClient;
+  readonly paths: IDaemonPaths;
+  readonly operation: ITestProcessIdentity;
+  readonly repoLockPath: string;
+}
+
+// A daemon process whose request ignores its abort signal, as one that waits for another process's lock does.
+(process.platform === 'win32' ? describe.skip : describe)('a daemon process whose shutdown is stuck', () => {
+  let folder: string;
+  let runtimeBase: string;
+  let repoRoot: string;
+  let commonTempFolder: string;
+  let controlFolder: string;
+  let daemon: IStuckDaemon | undefined;
+  let client: DaemonRequestWireClient | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-stuck-shutdown-'));
+    runtimeBase = createDaemonTestRuntimeBase();
+    repoRoot = path.join(folder, 'repo');
+    controlFolder = path.join(folder, 'control');
+    commonTempFolder = createTemporaryRepo(repoRoot);
+    fs.mkdirSync(controlFolder);
+  });
+
+  afterEach(async () => {
+    const openClient: DaemonRequestWireClient | undefined = client;
+    const startedDaemon: IStuckDaemon | undefined = daemon;
+    client = undefined;
+    daemon = undefined;
+    await openClient?.closeAsync();
+    // Only the fixture process that this test started, if a failed test left it running.
+    if (
+      startedDaemon &&
+      startedDaemon.process.exitCode === null &&
+      startedDaemon.process.signalCode === null
+    ) {
+      startedDaemon.process.kill('SIGKILL');
+      await startedDaemon.exited;
+    }
+    fs.rmSync(folder, { force: true, recursive: true });
+    fs.rmSync(runtimeBase, { force: true, recursive: true });
+  });
+
+  async function waitForJsonAsync<T>(stuckDaemon: IStuckDaemon, name: string): Promise<T> {
+    const filename: string = path.join(controlFolder, name);
+    const deadlineMs: number = Date.now() + START_TIMEOUT_MS;
+    while (!fs.existsSync(filename)) {
+      if (stuckDaemon.process.exitCode !== null || Date.now() > deadlineMs) {
+        throw new Error(`The fixture did not write ${name}. Its stderr:\n${stuckDaemon.getStderr()}`);
+      }
+      await delayAsync(POLL_INTERVAL_MS);
+    }
+    return JSON.parse(fs.readFileSync(filename, 'utf8'));
+  }
+
+  function startDaemon(shutdownDeadlineMs: number | 'default'): IStuckDaemon {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [FIXTURE_PATH, repoRoot, controlFolder, String(shutdownDeadlineMs)],
+      {
+        // Like a daemon that rush-client launches: the leader of its own process group.
+        detached: true,
+        env: { ...process.env, RUSHD_RUNTIME_DIR: runtimeBase, RUSH_TEMP_FOLDER: undefined },
+        stdio: ['ignore', 'ignore', 'pipe']
+      }
+    );
+    let stderr: string = '';
+    child.stderr?.setEncoding('utf8').on('data', (chunk: string) => (stderr += chunk));
+    const exited: Promise<IProcessExit> = new Promise((resolve) => {
+      child.once('exit', (code, signal) => resolve({ code: code ?? undefined, signal: signal ?? undefined }));
+    });
+    if (child.pid === undefined) throw new Error('The fixture did not start.');
+    daemon = { process: child, pid: child.pid, exited, getStderr: () => stderr };
+    return daemon;
+  }
+
+  async function startStuckRequestAsync(stuckDaemon: IStuckDaemon): Promise<IStuckRequest> {
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(stuckDaemon, 'ready.json');
+    const requestClient: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(
+      paths.socketPath
+    );
+    client = requestClient;
+    await requestClient.handshakeAsync();
+    await requestClient.sendControlAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope(REQUEST_ID, 'build', repoRoot, { argv: ['build', '-t', 'mini-a'] })
+    });
+    const { operationPid } = await waitForJsonAsync<{ operationPid: number }>(stuckDaemon, 'request.json');
+    const repoLockPath: string = LockFile.getLockFilePath(commonTempFolder, 'rush', stuckDaemon.pid);
+    expect(fs.existsSync(repoLockPath)).toBe(true);
+    return {
+      client: requestClient,
+      paths,
+      operation: captureTestProcessIdentity(operationPid),
+      repoLockPath
+    };
+  }
+
+  function expectReleased(request: IStuckRequest): void {
+    // SubprocessTerminator killed the operation on the first signal, so there was nothing left to reap.
+    expect(isTestProcessRunning(request.operation)).toBe(false);
+    expect(fs.existsSync(request.paths.socketPath)).toBe(false);
+    expect(readDaemonLockfile(request.paths.lockfilePath)).toBeUndefined();
+    expect(fs.existsSync(request.repoLockPath)).toBe(false);
+  }
+
+  it('exits at its deadline, after its request gets a typed result, and releases what it owned', async () => {
+    const stuckDaemon: IStuckDaemon = startDaemon(6000);
+    const request: IStuckRequest = await startStuckRequestAsync(stuckDaemon);
+    const signaledAtMs: number = Date.now();
+    // SubprocessTerminator sends this signal to the daemon again; that copy must not force the exit.
+    stuckDaemon.process.kill('SIGTERM');
+
+    // The fixture's request is stuck in its resolver, so it never started, and its result says that it was queued.
+    expect((await request.client.readTerminalAsync(REQUEST_ID)).terminal).toEqual({
+      kind: 'requestResult',
+      payload: {
+        aborted: true,
+        errorMessage:
+          'The Rush daemon was shut down (the daemon process received SIGTERM) while this request was ' +
+          'queued; it did not start. Re-run the command.',
+        exitCode: 1,
+        outcome: 'failure',
+        requestId: REQUEST_ID
+      }
+    });
+    expect(await stuckDaemon.exited).toEqual({ code: 1, signal: undefined });
+    expect(Date.now() - signaledAtMs).toBeGreaterThanOrEqual(5900);
+    expect(stuckDaemon.getStderr()).toMatch(
+      /The Rush daemon's shutdown did not finish within 6\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a" \(running for \d+\.\d s\)\. The daemon released its socket, lockfile and repository lock, and exits\./
+    );
+    expectReleased(request);
+  }, 30000);
+
+  it('exits at the default deadline when it has none of its own', async () => {
+    const stuckDaemon: IStuckDaemon = startDaemon('default');
+    const request: IStuckRequest = await startStuckRequestAsync(stuckDaemon);
+    const signaledAtMs: number = Date.now();
+    stuckDaemon.process.kill('SIGTERM');
+
+    expect(await stuckDaemon.exited).toEqual({ code: 1, signal: undefined });
+    expect(Date.now() - signaledAtMs).toBeGreaterThanOrEqual(DEFAULT_SHUTDOWN_DEADLINE_MS - 100);
+    expect(stuckDaemon.getStderr()).toMatch(
+      /The Rush daemon's shutdown did not finish within 10\.\d s, while waiting for requests to finish\./
+    );
+    await request.client.closed;
+    expectReleased(request);
+  }, 40000);
+
+  it('exits at once on a second signal', async () => {
+    // Far beyond the test's timeout, so only the second signal can end the shutdown in time.
+    const stuckDaemon: IStuckDaemon = startDaemon(60000);
+    const request: IStuckRequest = await startStuckRequestAsync(stuckDaemon);
+    stuckDaemon.process.kill('SIGTERM');
+    await delayAsync(1500);
+    stuckDaemon.process.kill('SIGTERM');
+
+    expect(await stuckDaemon.exited).toEqual({ code: 1, signal: undefined });
+    expect(stuckDaemon.getStderr()).toMatch(
+      /The Rush daemon's shutdown was cut short by a second SIGTERM after \d+\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a" \(running for \d+\.\d s\)\. The daemon released its socket, lockfile and repository lock, and exits\./
+    );
+    await request.client.closed;
+    expectReleased(request);
+  }, 30000);
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts
new file mode 100644
index 00000000000..4d8bcc7ec26
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { EventEmitter } from 'node:events';
+
+import { DaemonShutdownError } from '../DaemonShutdownError';
+import { listenForShutdownSignals, type IShutdownSignals } from '../DaemonShutdownSignals';
+
+describe(listenForShutdownSignals.name, () => {
+  let emitter: EventEmitter;
+  let nowMs: number;
+  let onForce: jest.Mock;
+  let signals: IShutdownSignals;
+
+  beforeEach(() => {
+    emitter = new EventEmitter();
+    nowMs = 1000;
+    onForce = jest.fn();
+    signals = listenForShutdownSignals({ emitter, onForce, getNowMs: () => nowMs });
+  });
+  afterEach(() => signals.dispose());
+
+  function send(signal: NodeJS.Signals, afterMs: number = 0): void {
+    nowMs += afterMs;
+    emitter.emit(signal, signal);
+  }
+
+  it('requests a clean shutdown on the first signal', () => {
+    expect(signals.signal.aborted).toBe(false);
+    send('SIGTERM');
+    expect(signals.signal.reason).toBeInstanceOf(DaemonShutdownError);
+    expect(signals.signal.reason).toMatchObject({ initiator: 'signal', signal: 'SIGTERM' });
+    expect(onForce).not.toHaveBeenCalled();
+  });
+
+  it("ignores SubprocessTerminator's relay of the first signal, and forces on the next one", () => {
+    send('SIGTERM');
+    send('SIGTERM', 5);
+    expect(onForce).not.toHaveBeenCalled();
+    send('SIGTERM', 5);
+    expect(onForce).toHaveBeenCalledWith('SIGTERM');
+  });
+
+  it('forces on a different signal, or on the same one after a moment', () => {
+    send('SIGTERM');
+    send('SIGINT', 5);
+    expect(onForce).toHaveBeenLastCalledWith('SIGINT');
+
+    signals.dispose();
+    onForce = jest.fn();
+    signals = listenForShutdownSignals({ emitter, onForce, getNowMs: () => nowMs });
+    send('SIGINT');
+    send('SIGINT', 1500);
+    expect(onForce).toHaveBeenCalledWith('SIGINT');
+  });
+
+  it('stops listening when disposed', () => {
+    expect(emitter.listenerCount('SIGINT')).toBe(1);
+    expect(emitter.listenerCount('SIGTERM')).toBe(1);
+    signals.dispose();
+    expect(emitter.listenerCount('SIGINT')).toBe(0);
+    expect(emitter.listenerCount('SIGTERM')).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts b/libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts
new file mode 100644
index 00000000000..6a184ce219f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts
@@ -0,0 +1,171 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+
+import type { DaemonShutdownError } from '../DaemonShutdownError';
+import { DAEMON_SOCKET_CHECK_INTERVAL_MS } from '../DaemonSocketWatch';
+import type { GlobalCommandExecutor } from '../GlobalCommandRequestRouter';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { serveRushDaemonAsync } from '../serveRushDaemon';
+import {
+  CallbackDaemonRequestResolver,
+  createDeferred,
+  createWireEnvelope,
+  DaemonRequestWireClient
+} from './DaemonRequestWireTestUtilities';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+// A named pipe has no file identity, and it can't be deleted while its server runs.
+const posixDescribe: jest.Describe = process.platform === 'win32' ? describe.skip : describe;
+const SUCCESSOR: string = 'a successor';
+
+posixDescribe('daemon whose socket was deleted or replaced', () => {
+  let repoRoot: string;
+  let logs: string[];
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-socket-loss-'));
+    logs = [];
+    jest.useFakeTimers({ doNotFake: ['nextTick', 'setImmediate'] });
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  // The first check finds the change. Fake timers delay a zero-delay timeout set by a timer by 1 ms, so the idle
+  // timer's expiry fires only when the clock advances again.
+  async function advancePastSocketLossAsync(): Promise<void> {
+    await jest.advanceTimersByTimeAsync(DAEMON_SOCKET_CHECK_INTERVAL_MS);
+    expect(logs).toHaveLength(1);
+    await jest.advanceTimersByTimeAsync(1);
+  }
+
+  // No idle timeout, so only the lost socket can end the daemon.
+  function createOptions(): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+      daemonVersion: 'socket-loss-test',
+      onLog: (message: string) => logs.push(message),
+      repoRoot,
+      rushVersion: '5.178.1'
+    };
+  }
+
+  it('stops serving once idle after its socket was deleted, and removes its lockfile', async () => {
+    const ready = createDeferred<RushDaemonHost>();
+    const serving: Promise<void> = serveRushDaemonAsync({
+      ...createOptions(),
+      onReady: (startedHost: RushDaemonHost) => ready.resolve(startedHost),
+      shutdownSignal: new AbortController().signal
+    });
+    const host: RushDaemonHost = await ready.promise;
+    const closeSpy: jest.SpyInstance = jest.spyOn(host, 'closeAsync');
+    try {
+      fs.rmSync(host.paths.socketPath);
+      await advancePastSocketLossAsync();
+      await serving;
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+      expect(logs).toEqual([
+        `rushd: the socket ${host.paths.socketPath} was removed, so no client can connect to this daemon; ` +
+          'exiting once running requests finish, so that the next client starts a new daemon',
+        `rushd (PID ${process.pid}) shutting down: its socket file was deleted or replaced, so the next client ` +
+          'starts a new daemon'
+      ]);
+      const reason: DaemonShutdownError | undefined = closeSpy.mock.calls[0][0];
+      expect(reason?.initiator).toBe('socketLost');
+      expect(reason?.message).toContain('(its socket file was deleted or replaced, so no new client could');
+    } finally {
+      await host.closeAsync();
+    }
+  });
+
+  it('closes once idle after another file took its socket name, and leaves that file', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    try {
+      fs.rmSync(host.paths.socketPath);
+      fs.writeFileSync(host.paths.socketPath, SUCCESSOR);
+      await advancePastSocketLossAsync();
+      await host.closed;
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+      expect(fs.readFileSync(host.paths.socketPath, 'utf8')).toBe(SUCCESSOR);
+      expect(logs).toEqual([
+        expect.stringContaining(' was replaced, so no client can connect'),
+        expect.stringContaining(' shutting down: its socket file was deleted or replaced')
+      ]);
+    } finally {
+      await host.closeAsync();
+      fs.rmSync(host.paths.socketPath, { force: true });
+    }
+  });
+
+  it('finishes a running request before it closes', async () => {
+    const executing = createDeferred<void>();
+    const executed = createDeferred<void>();
+    const executorAsync: GlobalCommandExecutor = async () => {
+      executing.resolve();
+      await executed.promise;
+      return { exitCode: 0 };
+    };
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      ...createOptions(),
+      requestResolver: new CallbackDaemonRequestResolver(async () => ({
+        kind: 'global',
+        executor: executorAsync
+      }))
+    });
+    let closed: boolean = false;
+    void host.closed.then(() => (closed = true));
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    try {
+      await client.handshakeAsync();
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('running', 'custom', repoRoot)
+      });
+      await executing.promise;
+      fs.rmSync(host.paths.socketPath);
+      await jest.advanceTimersByTimeAsync(DAEMON_SOCKET_CHECK_INTERVAL_MS * 3);
+      expect(logs).toHaveLength(1);
+      expect(closed).toBe(false);
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+      executed.resolve();
+      expect((await client.readTerminalAsync('running')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      await jest.advanceTimersByTimeAsync(0);
+      await host.closed;
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+    } finally {
+      executed.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('keeps serving while its socket has its name, and stops checking when it closes', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    try {
+      await jest.advanceTimersByTimeAsync(DAEMON_SOCKET_CHECK_INTERVAL_MS * 3);
+      const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(
+        host.paths.socketPath
+      );
+      await client.handshakeAsync();
+      await client.closeAsync();
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+      expect(logs).toEqual([]);
+    } finally {
+      await host.closeAsync();
+    }
+    expect(jest.getTimerCount()).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts b/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
new file mode 100644
index 00000000000..e6dc65d87a1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonFileChange } from '@rushstack/rush-daemon-transport';
+
+import { DAEMON_SOCKET_CHECK_INTERVAL_MS, DaemonSocketWatch } from '../DaemonSocketWatch';
+
+describe(DaemonSocketWatch.name, () => {
+  beforeEach(() => jest.useFakeTimers());
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  it('checks the socket at each interval and reports only the first change', () => {
+    const results: (DaemonFileChange | undefined)[] = [undefined, 'removed', 'replaced'];
+    const checkSocket: jest.Mock = jest.fn(() => results.shift());
+    const onChanged: jest.Mock = jest.fn();
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(checkSocket, onChanged);
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS - 1);
+    expect(checkSocket).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checkSocket).toHaveBeenCalledTimes(1);
+    expect(onChanged).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS);
+    expect(onChanged).toHaveBeenCalledWith('removed');
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS * 3);
+    expect(checkSocket).toHaveBeenCalledTimes(2);
+    expect(onChanged).toHaveBeenCalledTimes(1);
+    expect(jest.getTimerCount()).toBe(0);
+    watch[Symbol.dispose]();
+  });
+
+  it('stops checking once disposed', () => {
+    const checkSocket: jest.Mock = jest.fn(() => undefined);
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(checkSocket, jest.fn());
+    watch[Symbol.dispose]();
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS * 2);
+    expect(checkSocket).not.toHaveBeenCalled();
+    expect(jest.getTimerCount()).toBe(0);
+  });
+
+  it('does not keep the process running', () => {
+    jest.useRealTimers();
+    const setIntervalSpy: jest.SpyInstance = jest.spyOn(global, 'setInterval');
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(() => undefined, jest.fn());
+    try {
+      const timer: NodeJS.Timeout = setIntervalSpy.mock.results[0].value;
+      expect(timer.hasRef()).toBe(false);
+    } finally {
+      watch[Symbol.dispose]();
+    }
+  });
+
+  // A literal, not the exported constant: RushDaemonHost documents the 5 s and gives the watch no interval.
+  it('checks the socket every 5 seconds when it is given no interval', () => {
+    const checkSocket: jest.Mock = jest.fn(() => undefined);
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(checkSocket, jest.fn());
+    try {
+      jest.advanceTimersByTime(4_999);
+      expect(checkSocket).not.toHaveBeenCalled();
+      jest.advanceTimersByTime(1);
+      expect(checkSocket).toHaveBeenCalledTimes(1);
+    } finally {
+      watch[Symbol.dispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts
new file mode 100644
index 00000000000..d3f75dc8698
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts
@@ -0,0 +1,165 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  computeDaemonWorkspaceKey,
+  resolveDaemonPaths,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import {
+  chooseTestRuntimeRoot,
+  createDaemonTestRuntimeBase,
+  getLongestTestSocketPath,
+  getMaxTestSocketPathBytes
+} from './DaemonTestRuntimeBase';
+
+const SOCKET_PLATFORMS: readonly NodeJS.Platform[] = ['linux', 'darwin', 'freebsd'];
+// Longer than any real temporary folder.
+const LONGEST_TMPDIR_LENGTH: number = 300;
+// As long as the temporary folder with which some of these tests used to fail.
+const TMPDIR_OF_27_BYTES: string = `/${'t'.repeat(26)}`;
+// Twenty two-byte characters: 21 characters, but 41 bytes, too long to keep on Linux.
+const TWO_BYTE_TMPDIR: string = `/${'é'.repeat(20)}`;
+// The shape of the temporary folder of a macOS user.
+const DARWIN_TMPDIR: string = '/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T';
+const PRIVATE_FOLDER_MODE: number = 0o700;
+const TEST_SOURCE_FOLDER: string = path.resolve(__dirname, '../../src/test');
+// The helper and this file name the variable to test the helper itself.
+const HELPER_FILES: ReadonlySet<string> = new Set([
+  'DaemonTestRuntimeBase.ts',
+  'DaemonTestRuntimeBase.test.ts'
+]);
+// The files whose tests start daemons, each with a runtime folder of its own.
+const FILES_THAT_START_DAEMONS: readonly string[] = [
+  'DaemonClosedOutput.test.ts',
+  'DaemonProcessExit.test.ts',
+  'DaemonShutdownProcess.test.ts',
+  'SuccessfulMutationFixture.ts',
+  'VersionSelectedDaemonLauncher.test.ts'
+];
+// The value in `RUSHD_RUNTIME_DIR: value`, `[DAEMON_RUNTIME_DIR_ENV_VAR]: value` or `.RUSHD_RUNTIME_DIR = value`.
+const RUNTIME_DIR_VALUE: RegExp =
+  /(?:\bRUSHD_RUNTIME_DIR\b|\[DAEMON_RUNTIME_DIR_ENV_VAR\])\s*(?::|=(?!=))\s*([^,;}\r\n]*)/g;
+const RUNTIME_BASE_REFERENCE: RegExp = /^(?:this\.)?runtimeBase$/;
+// A fixed path, which does not depend on TMPDIR.
+const FIXED_PATH: RegExp = /^'[^']*'$/;
+// The value in `runtimeBase = value` or `runtimeBase: string = value`.
+const RUNTIME_BASE_VALUE: RegExp = /\bruntimeBase(?:\s*:\s*string)?\s*=(?!=)\s*([^;\r\n]*)/g;
+
+function createTmpdir(bytes: number): string {
+  return `/${'t'.repeat(bytes - 1)}`;
+}
+
+function getValues(source: string, pattern: RegExp): string[] {
+  return Array.from(source.matchAll(pattern), (match: RegExpMatchArray) => match[1].trim());
+}
+
+function listTypeScriptFiles(folder: string): string[] {
+  return fs.readdirSync(folder, { withFileTypes: true }).flatMap((entry: fs.Dirent) => {
+    const entryPath: string = path.join(folder, entry.name);
+    if (entry.isDirectory()) return listTypeScriptFiles(entryPath);
+    return entry.name.endsWith('.ts') ? [entryPath] : [];
+  });
+}
+
+describe('runtime base folders for test daemons', () => {
+  it.each(SOCKET_PLATFORMS)(
+    'keep the longest socket path within the limit on %s, however long TMPDIR is',
+    (platform: NodeJS.Platform) => {
+      const maxBytes: number = getMaxTestSocketPathBytes(platform);
+      const tooLong: string[] = [];
+      for (let length: number = 1; length <= LONGEST_TMPDIR_LENGTH; length++) {
+        // One byte per character, and two.
+        for (const tmpdir of [createTmpdir(length), `/${'é'.repeat(length - 1)}`]) {
+          const root: string = chooseTestRuntimeRoot(tmpdir, platform);
+          const socketPath: string = getLongestTestSocketPath(root, platform);
+          if (Buffer.byteLength(socketPath) > maxBytes) tooLong.push(socketPath);
+        }
+      }
+      expect(tooLong).toEqual([]);
+    }
+  );
+
+  it('leaves one byte of sun_path for its terminating NUL', () => {
+    expect(getMaxTestSocketPathBytes('linux')).toBe(107);
+    expect(getMaxTestSocketPathBytes('darwin')).toBe(103);
+  });
+
+  it.each(SOCKET_PLATFORMS)('keeps a short temporary folder on %s', (platform: NodeJS.Platform) => {
+    expect(chooseTestRuntimeRoot(TMPDIR_OF_27_BYTES, platform)).toBe(TMPDIR_OF_27_BYTES);
+  });
+
+  it('uses /tmp instead of a temporary folder that is too long', () => {
+    expect(chooseTestRuntimeRoot(DARWIN_TMPDIR, 'darwin')).toBe('/tmp');
+    expect(chooseTestRuntimeRoot(createTmpdir(LONGEST_TMPDIR_LENGTH), 'linux')).toBe('/tmp');
+  });
+
+  it('counts bytes, not characters', () => {
+    expect(chooseTestRuntimeRoot(TWO_BYTE_TMPDIR, 'linux')).toBe('/tmp');
+  });
+
+  it('keeps any temporary folder on Windows, where daemons listen at named pipes', () => {
+    const tmpdir: string = `C:\\${'t'.repeat(LONGEST_TMPDIR_LENGTH)}`;
+    expect(chooseTestRuntimeRoot(tmpdir, 'win32')).toBe(tmpdir);
+  });
+
+  it('creates an empty private folder in which the socket path of a daemon stays within the limit', () => {
+    const base: string = createDaemonTestRuntimeBase();
+    try {
+      const root: string = path.dirname(base);
+      expect(root).toBe(chooseTestRuntimeRoot(path.resolve(os.tmpdir()), process.platform));
+      expect(fs.readdirSync(base)).toEqual([]);
+      // Windows has no POSIX file modes, and its daemons listen at named pipes.
+      if (process.platform === 'win32') return;
+      // The permission bits are the mode's last three octal digits.
+      expect(fs.statSync(base).mode % 0o1000).toBe(PRIVATE_FOLDER_MODE);
+      const uid: number | undefined = process.getuid?.();
+      const paths: IDaemonPaths = resolveDaemonPaths(
+        {
+          platform: process.platform,
+          env: { [DAEMON_RUNTIME_DIR_ENV_VAR]: base },
+          tmpdir: os.tmpdir(),
+          uid
+        },
+        computeDaemonWorkspaceKey({ canonicalRepoRoot: base, rushVersion: '0.0.0' })
+      );
+      expect(paths.runtimeDir).toBe(path.join(base, `rushd-${uid}`));
+      const bytes: number = Buffer.byteLength(paths.socketPath);
+      expect(bytes).toBeLessThanOrEqual(Buffer.byteLength(getLongestTestSocketPath(root, process.platform)));
+      expect(bytes).toBeLessThanOrEqual(getMaxTestSocketPathBytes(process.platform));
+    } finally {
+      fs.rmdirSync(base);
+    }
+  });
+
+  it('is where every test that starts a daemon puts its runtime folder', () => {
+    const filesWithBase: string[] = [];
+    const unguarded: string[] = [];
+    for (const file of listTypeScriptFiles(TEST_SOURCE_FOLDER)) {
+      const name: string = path.relative(TEST_SOURCE_FOLDER, file);
+      if (HELPER_FILES.has(name)) continue;
+      const source: string = fs.readFileSync(file, 'utf8');
+      const runtimeDirs: string[] = getValues(source, RUNTIME_DIR_VALUE);
+      for (const runtimeDir of runtimeDirs) {
+        if (!RUNTIME_BASE_REFERENCE.test(runtimeDir) && !FIXED_PATH.test(runtimeDir)) {
+          unguarded.push(`${name}: RUSHD_RUNTIME_DIR is ${runtimeDir}`);
+        }
+      }
+      if (!runtimeDirs.some((runtimeDir: string) => RUNTIME_BASE_REFERENCE.test(runtimeDir))) continue;
+      filesWithBase.push(name);
+      const bases: string[] = getValues(source, RUNTIME_BASE_VALUE);
+      if (bases.length === 0) unguarded.push(`${name}: runtimeBase is never set`);
+      for (const base of bases) {
+        if (base !== 'createDaemonTestRuntimeBase()') unguarded.push(`${name}: runtimeBase is ${base}`);
+      }
+    }
+    expect(filesWithBase).toEqual(expect.arrayContaining(FILES_THAT_START_DAEMONS));
+    expect(unguarded).toEqual([]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts
new file mode 100644
index 00000000000..5ec7b7604f8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts
@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  computeDaemonWorkspaceKey,
+  resolveDaemonPaths,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+// fs.mkdtempSync appends six characters to this prefix.
+const BASE_PREFIX: string = 'rdt-';
+const MKDTEMP_SUFFIX: string = 'XXXXXX';
+// The largest 32-bit user ID: no user ID has more digits.
+const WIDEST_UID: number = 0xffffffff;
+// Where the product keeps its runtime folders when RUSHD_RUNTIME_DIR is not set.
+const SHARED_POSIX_TEMP_DIR: string = '/tmp';
+// The size of sockaddr_un.sun_path.
+const LINUX_SUN_PATH_BYTES: number = 108;
+const OTHER_SUN_PATH_BYTES: number = 104;
+
+/**
+ * The longest socket path, in bytes, that a test daemon may get on `platform`: the size of `sun_path` less
+ * its terminating NUL.
+ */
+export function getMaxTestSocketPathBytes(platform: NodeJS.Platform): number {
+  return (platform === 'linux' ? LINUX_SUN_PATH_BYTES : OTHER_SUN_PATH_BYTES) - 1;
+}
+
+/**
+ * The longest socket path that a daemon can get in a folder that {@link createDaemonTestRuntimeBase} creates
+ * in `root`: the one for the widest user ID.
+ */
+export function getLongestTestSocketPath(root: string, platform: NodeJS.Platform): string {
+  const base: string = path.posix.join(root, `${BASE_PREFIX}${MKDTEMP_SUFFIX}`);
+  const paths: IDaemonPaths = resolveDaemonPaths(
+    { platform, env: { [DAEMON_RUNTIME_DIR_ENV_VAR]: base }, tmpdir: root, uid: WIDEST_UID },
+    computeDaemonWorkspaceKey({ canonicalRepoRoot: root, rushVersion: '0.0.0' })
+  );
+  return paths.socketPath;
+}
+
+/**
+ * The folder in which {@link createDaemonTestRuntimeBase} creates its folders: `tmpdir` if the longest
+ * socket path in it is within the limit, and otherwise `/tmp`, where the product keeps its runtime folders
+ * by default.
+ * Windows daemons listen at named pipes, whose names do not depend on any folder.
+ */
+export function chooseTestRuntimeRoot(tmpdir: string, platform: NodeJS.Platform): string {
+  if (platform === 'win32') return tmpdir;
+  const longestBytes: number = Buffer.byteLength(getLongestTestSocketPath(tmpdir, platform));
+  return longestBytes <= getMaxTestSocketPathBytes(platform) ? tmpdir : SHARED_POSIX_TEMP_DIR;
+}
+
+/**
+ * Creates an empty private folder for a test to pass to its daemons as `RUSHD_RUNTIME_DIR`, so that their
+ * socket paths stay within the limit however long `TMPDIR` is. The caller deletes it.
+ */
+export function createDaemonTestRuntimeBase(): string {
+  const root: string = chooseTestRuntimeRoot(path.resolve(os.tmpdir()), process.platform);
+  return fs.mkdtempSync(path.join(root, BASE_PREFIX));
+}
diff --git a/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts b/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
new file mode 100644
index 00000000000..c488bd1a0e8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
@@ -0,0 +1,63 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonControlMessage } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import type { IInteractiveRequestSession } from '../InteractiveRequestInputRouter';
+import { createDeferred } from './DaemonRequestWireTestUtilities';
+import type { IDeferred } from './DaemonRequestWireTestUtilities';
+
+const REQUEST_ID: string = 'request';
+
+function createClient(
+  supportsRequestStarted: boolean,
+  sendControlWrittenAsync: (message: DaemonControlMessage) => Promise<void>
+): DaemonWireRequestClient {
+  const interactiveSession: IInteractiveRequestSession = {
+    requestId: REQUEST_ID,
+    attachInputSink: () => ({ [Symbol.dispose]: () => undefined }),
+    finishAsync: () => Promise.resolve(),
+    setRawModeAsync: () => Promise.resolve()
+  };
+  return new DaemonWireRequestClient({
+    abortSignal: new AbortController().signal,
+    getNextEventSequence: () => 0,
+    interactiveSession,
+    receivedTimeMs: 0,
+    requestId: REQUEST_ID,
+    sendControlAsync: () => Promise.resolve(),
+    sendControlWrittenAsync,
+    sendFrameAsync: () => Promise.resolve(),
+    sessionId: 'session',
+    supportsRequestAdmission: true,
+    supportsRequestStarted
+  });
+}
+
+describe(DaemonWireRequestClient.name, () => {
+  it.each([true, false])(
+    'counts a request as started before its requestStarted is written (supportsRequestStarted %s)',
+    async (supportsRequestStarted: boolean) => {
+      const written: IDeferred<void> = createDeferred<void>();
+      const sent: DaemonControlMessage[] = [];
+      const client: DaemonWireRequestClient = createClient(
+        supportsRequestStarted,
+        (message: DaemonControlMessage) => {
+          sent.push(message);
+          return written.promise;
+        }
+      );
+      expect(client.requestStarted).toBe(false);
+      const writePromise: Promise<void> = client.writeRequestStartedAsync();
+      // A shutdown during the write must not tell a client that may receive requestStarted that it did not start.
+      expect(client.requestStarted).toBe(true);
+      written.resolve();
+      await writePromise;
+      expect(client.requestStarted).toBe(true);
+      expect(sent).toEqual(
+        supportsRequestStarted ? [{ kind: 'requestStarted', payload: { requestId: REQUEST_ID } }] : []
+      );
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/EngineActivity.test.ts b/libraries/rush-daemon/src/test/EngineActivity.test.ts
new file mode 100644
index 00000000000..87859ca4f14
--- /dev/null
+++ b/libraries/rush-daemon/src/test/EngineActivity.test.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+import { EngineTerminalProvider } from '../EngineTerminalProvider';
+import { PhasedRequestEventMultiplexer } from '../PhasedRequestEventMultiplexer';
+import { PhasedRequestEventSink } from '../PhasedRequestEventSink';
+import { TestPhasedRequestClient } from './PhasedRequestRouterTestUtilities';
+
+type HookName = 'configureIteration' | 'beforeExecuteIterationAsync' | 'afterExecuteIterationAsync';
+
+interface IActivityHarness {
+  readonly client: TestPhasedRequestClient;
+  readonly sink: PhasedRequestEventSink;
+  readonly terminal: EngineTerminalProvider;
+  callHook(name: HookName): void;
+}
+
+function createHarness(): IActivityHarness {
+  const taps: Map<HookName, () => void> = new Map();
+  const hook = (name: HookName): { tap(options: unknown, fn: () => void): void } => ({
+    tap: (options: unknown, fn: () => void) => taps.set(name, fn)
+  });
+  const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+  const graph: IOperationGraph = {
+    debugMode: false,
+    eventSink: multiplexer,
+    hooks: {
+      configureIteration: hook('configureIteration'),
+      beforeExecuteIterationAsync: hook('beforeExecuteIterationAsync'),
+      afterExecuteIterationAsync: hook('afterExecuteIterationAsync')
+    }
+  } as unknown as IOperationGraph;
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const sink: PhasedRequestEventSink = new PhasedRequestEventSink({
+    activeOperationIds: new Set(),
+    client,
+    getNextSequence: () => client.getNextEventSequence(),
+    onWriteFailure: () => undefined,
+    rushVersion: '5.178.1'
+  });
+  multiplexer.subscribe(sink);
+  const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+  terminal.attach(graph);
+  return { client, sink, terminal, callHook: (name: HookName) => taps.get(name)!() };
+}
+
+async function getActivityPayloadsAsync(harness: IActivityHarness): Promise<unknown[]> {
+  await harness.sink.flushAsync();
+  return harness.client.writes
+    .map(({ event }) => event)
+    .filter((event: IDaemonEventEnvelope | undefined) => event?.type === 'activityChanged')
+    .map((event: IDaemonEventEnvelope | undefined) => event!.payload);
+}
+
+describe('engine terminal activity', () => {
+  it('marks warnings and errors that Rush or a plugin writes, whether buffered or written during an iteration', async () => {
+    const harness: IActivityHarness = createHarness();
+    harness.terminal.write('buffered warning\n', TerminalProviderSeverity.warning);
+    harness.terminal.write('buffered output\n', TerminalProviderSeverity.log);
+    harness.callHook('configureIteration');
+    harness.callHook('beforeExecuteIterationAsync');
+    harness.terminal.write('plugin warning\n', TerminalProviderSeverity.warning);
+    harness.terminal.write('plugin error\n', TerminalProviderSeverity.error);
+    harness.terminal.write('plugin output\n', TerminalProviderSeverity.log);
+    harness.terminal.write('plugin detail\n', TerminalProviderSeverity.verbose);
+
+    expect(await getActivityPayloadsAsync(harness)).toStrictEqual([
+      { severity: 'warning', stream: 'stderr', text: 'buffered warning\n' },
+      { stream: 'stdout', text: 'buffered output\n' },
+      { severity: 'warning', stream: 'stderr', text: 'plugin warning\n' },
+      { severity: 'error', stream: 'stderr', text: 'plugin error\n' },
+      { stream: 'stdout', text: 'plugin output\n' }
+    ]);
+  });
+
+  it('leaves other activity, such as the end-of-run summary, without a severity', async () => {
+    const harness: IActivityHarness = createHarness();
+    harness.sink.onActivity('Operations failed.\n', { stderr: true });
+    harness.sink.onActivity('rush build (1.00 seconds)\n');
+
+    expect(await getActivityPayloadsAsync(harness)).toStrictEqual([
+      { stream: 'stderr', text: 'Operations failed.\n' },
+      { stream: 'stdout', text: 'rush build (1.00 seconds)\n' }
+    ]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
index 2c6fcbfdf7a..ea9f908169a 100644
--- a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
+++ b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { TerminalProviderSeverity } from '@rushstack/terminal';
 
 import { EngineTerminalProvider } from '../EngineTerminalProvider';
@@ -11,7 +12,7 @@ describe(EngineTerminalProvider.name, () => {
     const terminal: EngineTerminalProvider = new EngineTerminalProvider();
     terminal.write('Permission denied', TerminalProviderSeverity.error);
     expect(terminal.hasBufferedMessages).toBe(true);
-    expect(terminal.describeError(new Error('snapshot failed'))).toBe('Permission denied\nsnapshot failed');
+    expect(terminal.describeError(new Error('snapshot failed'))).toBe('snapshot failed\nPermission denied');
     expect(terminal.hasBufferedMessages).toBe(false);
     expect(terminal.describeError(new Error('next request'))).toBe('next request');
   });
@@ -34,13 +35,67 @@ describe(EngineTerminalProvider.name, () => {
         throw failure;
       })
     ).rejects.toBe(failure);
-    expect(failure.message).toBe('binding request diagnostic\nPermission denied\ncould not capture');
+    expect(failure.message).toBe('could not capture\nbinding request diagnostic\nPermission denied');
 
     terminal.write('stale', TerminalProviderSeverity.warning);
     await expect(terminal.reconcileWithRequestDiagnosticsAsync(async () => 'ok')).resolves.toBe('ok');
     expect(terminal.hasBufferedMessages).toBe(false);
   });
 
+  it('describes a failure without the verbose and debug messages that loading a workspace writes', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('Incremental strategy: cache restoration\n', TerminalProviderSeverity.verbose);
+    for (let index: number = 0; index < 1000; index++) {
+      terminal.write(
+        `Configuration file "p${index}/config/rush-project.json" not found.\n`,
+        TerminalProviderSeverity.debug
+      );
+    }
+    terminal.write('\n', TerminalProviderSeverity.log);
+    terminal.write('Project "a" has no "build" script.\n', TerminalProviderSeverity.warning);
+    expect(terminal.describeError(new Error('selection failed'))).toBe(
+      'selection failed\nProject "a" has no "build" script.'
+    );
+  });
+
+  it('describes an already reported error by the error lines written before it', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('Incremental strategy: cache restoration\n', TerminalProviderSeverity.verbose);
+    terminal.write(
+      'The project name "@x/nope" passed to "--to" does not exist in rush.json.\n',
+      TerminalProviderSeverity.error
+    );
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(
+      'The project name "@x/nope" passed to "--to" does not exist in rush.json.'
+    );
+
+    terminal.write('No error line was written.\n', TerminalProviderSeverity.warning);
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(
+      'An error occurred.\nNo error line was written.'
+    );
+  });
+
+  it('gives the error first, since clients give the first line as the reason, and the other lines in order', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    const warning: string =
+      `The daemon's compatible plugin list names plugins that are not configured in rush-plugins.json: ` +
+      `"no-such-plugin".`;
+    const unknownProject: string = 'The project name "@x/nope" passed to "--to" does not exist in rush.json.';
+    terminal.write(`${warning}\n`, TerminalProviderSeverity.warning);
+    terminal.write(`${unknownProject}\n`, TerminalProviderSeverity.error);
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(`${unknownProject}\n${warning}`);
+
+    terminal.write(`${warning}\n`, TerminalProviderSeverity.warning);
+    expect(terminal.describeError(new Error('Plugins must be daemon-compatible.'))).toBe(
+      `Plugins must be daemon-compatible.\n${warning}`
+    );
+
+    terminal.write(`${warning}\n`, TerminalProviderSeverity.warning);
+    terminal.write('first error\n', TerminalProviderSeverity.error);
+    terminal.write('second error\n', TerminalProviderSeverity.error);
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(`first error\n${warning}\nsecond error`);
+  });
+
   it('drops diagnostics when the engine must be recreated', async () => {
     const terminal: EngineTerminalProvider = new EngineTerminalProvider();
     const recreate: WorkspaceEngineRecreationRequiredError = new WorkspaceEngineRecreationRequiredError();
diff --git a/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
new file mode 100644
index 00000000000..e6abd4630be
--- /dev/null
+++ b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
@@ -0,0 +1,112 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { getEnvironmentIdentityEntries, getEnvironmentRestartReason } from '../EnvironmentRestartReason';
+
+const STARTUP: Record<string, string> = {
+  HOME: '/home/agent',
+  NODE_OPTIONS: '--max-old-space-size=8192',
+  PATH: ['/usr/local/bin', '/usr/bin'].join(path.delimiter),
+  TERM: 'xterm-256color'
+};
+
+describe(getEnvironmentRestartReason.name, () => {
+  const startupEntries = getEnvironmentIdentityEntries(STARTUP);
+
+  it('returns undefined when only variables that the fingerprint ignores or normalizes differ', () => {
+    expect(getEnvironmentRestartReason(startupEntries, { ...STARTUP })).toBeUndefined();
+    expect(
+      getEnvironmentRestartReason(startupEntries, {
+        TERM: 'dumb',
+        PWD: '/elsewhere',
+        PATH: [STARTUP.PATH, '/usr/bin'].join(path.delimiter),
+        NODE_OPTIONS: STARTUP.NODE_OPTIONS,
+        HOME: STARTUP.HOME,
+        UNSET: undefined
+      })
+    ).toBeUndefined();
+  });
+
+  it('names each variable that is changed, added or removed, sorted, and never a value', () => {
+    const requested: Record<string, string | undefined> = {
+      ...STARTUP,
+      NODE_OPTIONS: '--inspect',
+      FOO: 'bar'
+    };
+    delete requested.HOME;
+    const reason = getEnvironmentRestartReason(startupEntries, requested);
+    expect(reason).toEqual({ kind: 'environmentChanged', variableNames: ['FOO', 'HOME', 'NODE_OPTIONS'] });
+    expect(JSON.stringify(reason)).not.toMatch(/bar|inspect|agent/);
+  });
+
+  it('names PATH when its entries differ, not only their repetition', () => {
+    expect(
+      getEnvironmentRestartReason(startupEntries, {
+        ...STARTUP,
+        PATH: ['/usr/bin', '/usr/local/bin'].join(path.delimiter)
+      })
+    ).toEqual({ kind: 'environmentChanged', variableNames: ['PATH'] });
+  });
+
+  it('treats a variable that is set to an empty string as set', () => {
+    expect(getEnvironmentRestartReason(startupEntries, { ...STARTUP, NODE_OPTIONS: '' })).toEqual({
+      kind: 'environmentChanged',
+      variableNames: ['NODE_OPTIONS']
+    });
+    expect(
+      getEnvironmentRestartReason(getEnvironmentIdentityEntries({ ...STARTUP, EMPTY: '' }), STARTUP)
+    ).toEqual({ kind: 'environmentChanged', variableNames: ['EMPTY'] });
+  });
+
+  it('writes each control character of a name as an escape, so that the names print on one line', () => {
+    const reason = getEnvironmentRestartReason(startupEntries, {
+      ...STARTUP,
+      'NAME_NL\nSECOND_LINE': 'a',
+      'NAME_ESC\u001b[31mRED\u001b[0m': 'b',
+      'NAME_C1\u009b2J\u007f': 'c',
+      'NAME_PRINTABLE_\u00e9': 'd'
+    });
+    expect(reason).toEqual({
+      kind: 'environmentChanged',
+      variableNames: [
+        'NAME_C1\\x9b2J\\x7f',
+        'NAME_ESC\\x1b[31mRED\\x1b[0m',
+        'NAME_NL\\x0aSECOND_LINE',
+        'NAME_PRINTABLE_\u00e9'
+      ]
+    });
+  });
+
+  it('escapes line and paragraph separators and format characters, such as a bidirectional override', () => {
+    const reason = getEnvironmentRestartReason(startupEntries, {
+      ...STARTUP,
+      'NAME_LS\u2028PS\u2029': 'a',
+      'NAME_BIDI\u202eRLO\u2066LRI\u200bZWSP': 'b',
+      'NAME_SHY\u00adTAG\u{e0001}': 'c',
+      'NAME_PRINTABLE_\u{1f600}': 'd'
+    });
+    expect(reason).toEqual({
+      kind: 'environmentChanged',
+      variableNames: [
+        'NAME_BIDI\\u{202e}RLO\\u{2066}LRI\\u{200b}ZWSP',
+        'NAME_LS\\u{2028}PS\\u{2029}',
+        'NAME_PRINTABLE_\u{1f600}',
+        'NAME_SHY\\xadTAG\\u{e0001}'
+      ]
+    });
+  });
+
+  it('escapes a backslash, so that ESC and the text "\\x1b" in a name print differently', () => {
+    const reason = getEnvironmentRestartReason(startupEntries, {
+      ...STARTUP,
+      'NAME_Q\u001b': 'a',
+      'NAME_Q\\x1b': 'b'
+    });
+    expect(reason).toEqual({
+      kind: 'environmentChanged',
+      variableNames: ['NAME_Q\\x1b', 'NAME_Q\\x5cx1b']
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts b/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
new file mode 100644
index 00000000000..1a252067211
--- /dev/null
+++ b/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
@@ -0,0 +1,423 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import type { LockFile } from '@rushstack/node-core-library';
+import {
+  DaemonFrameType,
+  decodeDaemonLogChunk,
+  type IDaemonCommandResult,
+  type IDaemonFrame,
+  type IDaemonInstallationChange
+} from '@rushstack/rush-daemon-protocol';
+import type { DaemonFrameListener } from '@rushstack/rush-daemon-transport';
+
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import * as linuxProcessGroupExit from '../LinuxProcessGroupExit';
+import * as installationState from '../NativeMutationInstallationState';
+import { tryAcquireNativeLock } from '../NativeRepositoryLock';
+import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { WorkspaceRequestResourceCleanupError } from '../WorkspaceRequestResources';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { captureTestDaemonListenerAsync } from './TestDaemonListener';
+import { removeTestFolderAsync } from './TestProcessExit';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(60_000);
+
+const FLAG: string = 'common/temp/last-install.flag';
+const HOTLINK_STATE: string = 'common/temp/rush-hotlink-state.json';
+const NO_SUCCESSOR: string = 'No successor was expected.';
+const JOIN_FAILURE: string = 'The worker process group could not be joined.';
+/** So that a flag that is written again never has the times of the first one. */
+const OLD_TIME: Date = new Date('2000-01-01T00:00:00Z');
+/** How long a test waits for a restart that should have been requested, before it fails. */
+const RESTART_WAIT_MS: number = 10_000;
+
+function outputText(exchange: ITerminalExchange): string {
+  return exchange.frames
+    .filter(
+      (frame: IDaemonFrame) =>
+        frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr
+    )
+    .map((frame: IDaemonFrame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
+    .join('');
+}
+
+function keptLine(commandName: string, exitCode: number): string {
+  return (
+    `rushd: "rush ${commandName}" failed (exit code ${exitCode}) before it changed the installation, so this ` +
+    'daemon keeps running and reloads the workspace for the next request'
+  );
+}
+
+function keptLines(logs: ReadonlyArray<string>): string[] {
+  return logs.filter((line: string) => line.includes('keeps running'));
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await setImmediateAsync();
+  return settled;
+}
+
+interface IExpectRestartOptions {
+  /** How many daemon log lines came before the request, so that keep lines logged earlier are not counted. */
+  earlierLogCount?: number;
+  /**
+   * Whether the daemon decided to restart as the worker exited, so the command's output says why no successor
+   * starts. A decision that is made once the worker's processes were joined comes after the output.
+   */
+  explained?: boolean;
+}
+
+/** Returns how the restart ended, so that a daemon that was wrongly kept fails its test before the test times out. */
+async function getRestartOutcomeAsync(
+  restartCompleted: Promise<unknown>
+): Promise<{ error?: unknown } | 'none'> {
+  const timeout: AbortController = new AbortController();
+  try {
+    return await Promise.race([
+      restartCompleted.then(
+        () => ({}),
+        (error: unknown) => ({ error })
+      ),
+      setTimeoutAsync(RESTART_WAIT_MS, 'none' as const, { signal: timeout.signal })
+    ]);
+  } finally {
+    timeout.abort();
+  }
+}
+
+describe('a native install or update that fails', () => {
+  const current: { change?: IDaemonInstallationChange } = {};
+  let fixture: DaemonGraphTestFixture | undefined;
+  let listener: DaemonFrameListener | undefined;
+  let launcher: jest.MockedFunction<GetWorkspaceSuccessorLaunchAsync>;
+  let workerSpawns: number;
+  /** Called as the native mutation worker is spawned, after the request's last check before it runs. */
+  let onWorkerSpawn: () => void;
+
+  beforeEach(() => {
+    current.change = undefined;
+    fixture = undefined;
+    listener = undefined;
+    workerSpawns = 0;
+    onWorkerSpawn = () => undefined;
+    // A mutation requires a successor launcher. This one never starts a daemon, so a restart ends the host.
+    launcher = jest.fn<
+      ReturnType<GetWorkspaceSuccessorLaunchAsync>,
+      Parameters<GetWorkspaceSuccessorLaunchAsync>
+    >(() => Promise.reject(new Error(NO_SUCCESSOR)));
+    const nativeChildProcess: typeof childProcess = jest.requireActual('node:child_process');
+    const spawn: typeof childProcess.spawn = nativeChildProcess.spawn;
+    jest.spyOn(nativeChildProcess, 'spawn').mockImplementation(((
+      ...args: Parameters<typeof childProcess.spawn>
+    ) => {
+      if (args[1]?.some((arg: string) => arg.endsWith(`${path.sep}NativeMutationWorker.js`))) {
+        workerSpawns++;
+        onWorkerSpawn();
+      }
+      return spawn(...args);
+    }) as typeof childProcess.spawn);
+    // The host reports a restart without a successor as a warning.
+    jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    if (!fixture) return;
+    try {
+      await fixture.host.closeAsync();
+    } catch (error) {
+      // A daemon whose worker could not be joined keeps its listener, which only the test may release.
+      if (!(error instanceof WorkspaceRequestResourceCleanupError)) throw error;
+      await listener?.closeAsync();
+    } finally {
+      await fixture.host.restartCompleted.catch(() => undefined);
+      await removeTestFolderAsync(fixture.folder, true);
+    }
+  });
+
+  /** Starts a daemon on a workspace that was installed, unless `configure` says otherwise, and loads its graph. */
+  async function startAsync(
+    configure?: (created: DaemonGraphTestFixture) => void
+  ): Promise<DaemonGraphTestFixture> {
+    const captured: { value: DaemonGraphTestFixture; listener: DaemonFrameListener } =
+      await captureTestDaemonListenerAsync(() =>
+        DaemonGraphTestFixture.createAsync((starting: DaemonGraphTestFixture) => {
+          setDaemonPolicy(starting, {});
+          starting.checkInstallation = () => current.change;
+          starting.getSuccessorLaunchAsync = launcher;
+          starting.write(FLAG, JSON.stringify({ node: process.versions.node, packageManager: 'npm' }));
+          fs.utimesSync(path.join(starting.folder, FLAG), OLD_TIME, OLD_TIME);
+          configure?.(starting);
+        })
+      );
+    const started: DaemonGraphTestFixture = captured.value;
+    fixture = started;
+    listener = captured.listener;
+    await started.buildSuccessfullyAsync();
+    return started;
+  }
+
+  function file(name: string): string {
+    return path.join(fixture!.folder, name);
+  }
+
+  // The launcher's context holds the request's environment, which is the whole process environment, and jest prints a
+  // mock's arguments when an assertion about its calls fails. Tests count the calls instead, so that a failure prints
+  // only numbers.
+  function launchCount(): number {
+    return launcher.mock.calls.length;
+  }
+
+  function rewriteFlag(): void {
+    const content: Buffer = fs.readFileSync(file(FLAG));
+    fs.rmSync(file(FLAG));
+    fs.writeFileSync(file(FLAG), content);
+  }
+
+  async function expectKeptAsync(
+    exchange: ITerminalExchange,
+    commandName: string = 'install'
+  ): Promise<void> {
+    const started: DaemonGraphTestFixture = fixture!;
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult' });
+    const { exitCode } = exchange.terminal.payload as IDaemonCommandResult;
+    expect(exitCode).not.toBe(0);
+    expect(exchange.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(workerSpawns).toBe(1);
+    // The session is still current: a request that doesn't load the graph again is served on it. It is admitted only
+    // once the mutation's request has ended, so the daemon has decided by then.
+    expect((await started.graphAsync('status')).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    expect(keptLines(started.logs)).toEqual([keptLine(commandName, exitCode)]);
+    await started.buildSuccessfullyAsync();
+    expect(started.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+    expect(launchCount()).toBe(0);
+    expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
+    expect(await isSettledAsync(started.host.closed)).toBe(false);
+  }
+
+  async function expectRestartAsync(
+    exchange: ITerminalExchange,
+    { earlierLogCount = 0, explained = true }: IExpectRestartOptions = {}
+  ): Promise<void> {
+    const started: DaemonGraphTestFixture = fixture!;
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult' });
+    expect(exchange.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(workerSpawns).toBe(1);
+    const explanation: string = `Mutation completed, but successor startup is unavailable: ${NO_SUCCESSOR}`;
+    if (explained) expect(outputText(exchange)).toContain(explanation);
+    else expect(outputText(exchange)).not.toContain(explanation);
+    expect(await getRestartOutcomeAsync(started.host.restartCompleted)).toEqual({
+      error: expect.objectContaining({ message: NO_SUCCESSOR })
+    });
+    expect(launcher).toHaveBeenCalledTimes(1);
+    await started.host.closed;
+    expect(keptLines(started.logs.slice(earlierLogCount))).toEqual([]);
+  }
+
+  it('keeps the daemon when install fails on common/scripts, and restarts after an install that succeeds', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const exchange: ITerminalExchange = await started.runAsync(['install']);
+    expect(outputText(exchange)).toContain('common/scripts');
+    await expectKeptAsync(exchange);
+
+    // --help runs the real worker, which changes nothing and exits 0. An install that succeeds still restarts.
+    workerSpawns = 0;
+    const earlierLogCount: number = started.logs.length;
+    await expectRestartAsync(await started.runAsync(['install', '--help']), { earlierLogCount });
+  });
+
+  it('keeps the daemon when update fails, as install does', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    // An unknown parameter fails before update writes anything, even common/scripts.
+    await expectKeptAsync(await started.runAsync(['update', '--no-such-parameter']), 'update');
+  });
+
+  it('keeps the daemon for each of two failed installs, the second queued behind the first', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const exchanges: ITerminalExchange[] = await Promise.all([
+      started.runAsync(['install']),
+      started.runAsync(['install'])
+    ]);
+    for (const { terminal } of exchanges) {
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 1 } });
+      expect(terminal.payload).not.toHaveProperty('retryAfterRestart');
+    }
+    expect(workerSpawns).toBe(2);
+    await started.buildSuccessfullyAsync();
+    expect(keptLines(started.logs)).toEqual([keptLine('install', 1), keptLine('install', 1)]);
+    expect(started.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+    expect(launchCount()).toBe(0);
+    expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
+  });
+
+  it('keeps the daemon when install finds the Rush lock held', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const lock: LockFile | undefined = tryAcquireNativeLock(file('common/temp'));
+    expect(lock).toBeDefined();
+    let exchange: ITerminalExchange;
+    try {
+      exchange = await started.runAsync(['install']);
+    } finally {
+      lock?.release();
+    }
+    expect(outputText(exchange)).toContain('Another Rush command is already running in this repository.');
+    await expectKeptAsync(exchange);
+  });
+
+  it('restarts when the failed install wrote the flag again with the same content', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    onWorkerSpawn = rewriteFlag;
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts when the failed install deleted the flag', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    onWorkerSpawn = () => fs.rmSync(file(FLAG));
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts when the workspace has a hotlink, which an install deletes before the flag', async () => {
+    const started: DaemonGraphTestFixture = await startAsync((starting: DaemonGraphTestFixture) => {
+      starting.write(
+        HOTLINK_STATE,
+        JSON.stringify({
+          fileVersion: 0,
+          linksBySubspace: {
+            default: [{ linkedPackagePath: starting.folder, linkedPackageName: 'x', linkType: 'LinkPackage' }]
+          }
+        })
+      );
+    });
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('keeps the daemon when the hotlink state records no link', async () => {
+    const started: DaemonGraphTestFixture = await startAsync((starting: DaemonGraphTestFixture) => {
+      starting.write(HOTLINK_STATE, JSON.stringify({ fileVersion: 0, linksBySubspace: {} }));
+    });
+    await expectKeptAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts when the workspace had no flag before the install', async () => {
+    const started: DaemonGraphTestFixture = await startAsync((starting: DaemonGraphTestFixture) => {
+      fs.rmSync(path.join(starting.folder, FLAG));
+    });
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts after an install that succeeds', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    await expectRestartAsync(await started.runAsync(['install', '--help']));
+  });
+
+  it('restarts when a process-bound installation file changed during the failed install', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    onWorkerSpawn = () =>
+      fs.writeFileSync(
+        file('common/config/rush/npm-shrinkwrap.json'),
+        '{"lockfileVersion":3,"packages":{"x":{}}}'
+      );
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it("exits without a successor when the daemon's installation changed during the failed install", async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const folder: string = file('installation');
+    onWorkerSpawn = () => {
+      current.change ??= { change: 'replaced', folder };
+    };
+    const exchange: ITerminalExchange = await started.runAsync(['install']);
+    expect(workerSpawns).toBe(1);
+    expect(outputText(exchange)).toContain(
+      `The daemon's installation at ${folder} was replaced, so the daemon exits after this command without ` +
+        'starting a new one; the next command starts one.'
+    );
+    expect(launchCount()).toBe(0);
+    await expect(started.host.restartCompleted).resolves.toBeUndefined();
+    expect(keptLines(started.logs)).toEqual([]);
+  });
+
+  it('keeps the daemon when the result of a failed install could not be delivered', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    // The result is lost, as it is when the client's connection fails while the worker runs.
+    jest
+      .spyOn(DaemonWireRequestClient.prototype, 'writeResultAsync')
+      .mockRejectedValueOnce(new Error('The connection to the client failed.'));
+    const { terminal } = await started.runAsync(['install']);
+    expect(terminal.kind).toBe('requestRejected');
+    expect(workerSpawns).toBe(1);
+    await started.buildSuccessfullyAsync();
+    expect(keptLines(started.logs)).toEqual([keptLine('install', 1)]);
+    expect(launchCount()).toBe(0);
+    expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
+  });
+
+  it('restarts when the flag changed after the worker exited, before its processes were joined', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const captureAsync: typeof installationState.captureNativeMutationInstallationStateAsync =
+      installationState.captureNativeMutationInstallationStateAsync;
+    let captures: number = 0;
+    jest
+      .spyOn(installationState, 'captureNativeMutationInstallationStateAsync')
+      .mockImplementation(async (...args: Parameters<typeof captureAsync>) => {
+        const state: installationState.INativeMutationInstallationState | undefined = await captureAsync(
+          ...args
+        );
+        // The first capture is before the worker starts and the second as it exits. A process that the worker started,
+        // which the daemon ends only after that, then writes the flag again with the same content, which the input
+        // fingerprint doesn't see.
+        if (++captures === 2) rewriteFlag();
+        return state;
+      });
+    await expectRestartAsync(await started.runAsync(['install']), { explained: false });
+    expect(captures).toBe(3);
+  });
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'restarts when the processes of the failed install could not be joined',
+    async () => {
+      const started: DaemonGraphTestFixture = await startAsync();
+      const waitAsync: typeof linuxProcessGroupExit.waitForLinuxProcessGroupExitAsync =
+        linuxProcessGroupExit.waitForLinuxProcessGroupExitAsync;
+      let joins: number = 0;
+      jest
+        .spyOn(linuxProcessGroupExit, 'waitForLinuxProcessGroupExitAsync')
+        .mockImplementation(async (...args: Parameters<typeof waitAsync>) => {
+          // The group really exits, but the daemon can't tell, so the worker's processes may still be running.
+          await waitAsync(...args);
+          joins++;
+          throw new Error(JOIN_FAILURE);
+        });
+      const exchange: ITerminalExchange = await started.runAsync(['install']);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { outcome: 'failure', errorMessage: expect.stringContaining(JOIN_FAILURE) }
+      });
+      expect(joins).toBe(1);
+      expect(workerSpawns).toBe(1);
+      // As after any mutation whose worker was not joined, the daemon keeps its ownership of the workspace.
+      expect(await getRestartOutcomeAsync(started.host.restartCompleted)).toEqual({
+        error: expect.any(WorkspaceRequestResourceCleanupError)
+      });
+      expect(launcher).toHaveBeenCalledTimes(1);
+      expect(keptLines(started.logs)).toEqual([]);
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts b/libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts
new file mode 100644
index 00000000000..ca7ab8a3fb9
--- /dev/null
+++ b/libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import type { Readable } from 'node:stream';
+
+import { FIXTURE_SCRIPT_DEADLINE_MS, withScriptDeadline } from './DaemonGraphTestFixture';
+
+jest.setTimeout(30_000);
+
+interface IScriptExit {
+  readonly exitCode: number | undefined;
+  readonly signal: string | undefined;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly elapsedMs: number;
+}
+
+function runScriptAsync(script: string): Promise<IScriptExit> {
+  const start: number = Date.now();
+  return new Promise((resolve, reject) => {
+    const child: childProcess.ChildProcessByStdio<null, Readable, Readable> = childProcess.spawn(
+      process.execPath,
+      ['-e', script],
+      { stdio: ['ignore', 'pipe', 'pipe'] }
+    );
+    let stdout: string = '';
+    let stderr: string = '';
+    child.stdout.setEncoding('utf8').on('data', (text: string) => (stdout += text));
+    child.stderr.setEncoding('utf8').on('data', (text: string) => (stderr += text));
+    child.on('error', reject);
+    child.on('close', (code, signal) =>
+      resolve({
+        exitCode: code ?? undefined,
+        signal: signal ?? undefined,
+        stdout,
+        stderr,
+        elapsedMs: Date.now() - start
+      })
+    );
+  });
+}
+
+describe(withScriptDeadline.name, () => {
+  it('ends a script that its test never released, with exit code 1 and one stderr line', async () => {
+    // Without the deadline, the script's own backstop would end it with exit code 7 after 10 s.
+    const result: IScriptExit = await runScriptAsync(
+      withScriptDeadline('setInterval(()=>{},20);setTimeout(()=>process.exit(7),10_000);', 300)
+    );
+    expect(result).toMatchObject({
+      exitCode: 1,
+      signal: undefined,
+      stdout: '',
+      stderr: 'fixture script: its test did not release it within 300 ms\n'
+    });
+    expect(result.elapsedMs).toBeGreaterThanOrEqual(300);
+  });
+
+  it('lets a script that its test released exit as soon as it finishes', async () => {
+    const result: IScriptExit = await runScriptAsync(
+      withScriptDeadline("setTimeout(()=>console.log('released'),50);", 20_000)
+    );
+    expect(result).toMatchObject({ exitCode: 0, signal: undefined, stdout: 'released\n', stderr: '' });
+    expect(result.elapsedMs).toBeLessThan(10_000);
+  });
+
+  it('outlasts the 60 s timeout of the tests that use it, by default', () => {
+    expect(FIXTURE_SCRIPT_DEADLINE_MS).toBeGreaterThan(60_000);
+    expect(withScriptDeadline('wait();')).toMatch(
+      new RegExp(`,${FIXTURE_SCRIPT_DEADLINE_MS}\\)\\.unref\\(\\);wait\\(\\);$`)
+    );
+  });
+
+  it('escapes characters that can leave a JavaScript string literal', () => {
+    expect(withScriptDeadline('wait();', 1234)).toContain(
+      '"fixture script: its test did not release it within 1234 ms"'
+    );
+  });
+
+  it('rejects a deadline that is not a positive whole number of milliseconds', () => {
+    for (const deadlineMs of [0, -1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+      expect(() => withScriptDeadline('wait();', deadlineMs)).toThrow(RangeError);
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
new file mode 100644
index 00000000000..3f58530c389
--- /dev/null
+++ b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
@@ -0,0 +1,425 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
+
+interface IStartedCapture {
+  readonly index: number;
+  readonly startTimeMs: number;
+  readonly resolve: (value: string) => void;
+  readonly reject: (error: Error) => void;
+}
+
+/** A clock that moves only when the test says so. */
+class ManualClock {
+  public nowMs: number = 0;
+  public readonly now = (): number => this.nowMs;
+}
+
+/** Captures that start in order and settle only when the test says so. */
+class ControlledCaptures {
+  public readonly started: IStartedCapture[] = [];
+  readonly #clock: ManualClock | undefined;
+
+  public constructor(clock?: ManualClock) {
+    this.#clock = clock;
+  }
+
+  public readonly captureAsync = (): Promise<string> => {
+    return new Promise<string>((resolve, reject) => {
+      const startTimeMs: number = this.#clock?.nowMs ?? Number.NaN;
+      this.started.push({ index: this.started.length, startTimeMs, resolve, reject });
+    });
+  };
+}
+
+async function flushAsync(): Promise<void> {
+  await new Promise((resolve) => setImmediate(resolve));
+}
+
+describe(FreshCaptureCoalescer.name, () => {
+  it('starts a new capture for a caller without notBeforeMs once the previous capture settled', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    expect(captures.started).toHaveLength(1);
+    captures.started[0].resolve('first');
+    await expect(first).resolves.toBe('first');
+
+    const second: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('second');
+    await expect(second).resolves.toBe('second');
+  });
+
+  it('gives every caller that arrives during a capture one shared capture that starts after it settles', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const joiners: Promise<string>[] = [1, 2, 3].map(() =>
+      coalescer.captureAsync(scope, 'key', captures.captureAsync)
+    );
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+
+    captures.started[0].resolve('before the joiners asked');
+    await expect(first).resolves.toBe('before the joiners asked');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+
+    captures.started[1].resolve('after the joiners asked');
+    await expect(Promise.all(joiners)).resolves.toEqual([
+      'after the joiners asked',
+      'after the joiners asked',
+      'after the joiners asked'
+    ]);
+    expect(captures.started).toHaveLength(2);
+  });
+
+  it('never gives a caller a capture that started before the caller asked', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+    const results: Promise<[number, string]>[] = [];
+    const ask = (): void => {
+      const startedBeforeAsking: number = captures.started.length;
+      results.push(
+        coalescer
+          .captureAsync(scope, 'key', captures.captureAsync)
+          .then((value: string): [number, string] => [startedBeforeAsking, value])
+      );
+    };
+
+    ask(); // starts capture 0
+    ask(); // waits for capture 1
+    captures.started[0].resolve('0');
+    await flushAsync();
+    ask(); // capture 1 is running, so this waits for capture 2
+    ask();
+    captures.started[1].resolve('1');
+    await flushAsync();
+    captures.started[2].resolve('2');
+    await flushAsync();
+    ask(); // nothing is running, so this starts capture 3
+    captures.started[3].resolve('3');
+
+    const settled: [number, string][] = await Promise.all(results);
+    expect(settled).toEqual([
+      [0, '0'],
+      [1, '1'],
+      [2, '2'],
+      [2, '2'],
+      [3, '3']
+    ]);
+    for (const [startedBeforeAsking, value] of settled) {
+      expect(Number(value)).toBeGreaterThanOrEqual(startedBeforeAsking);
+    }
+  });
+
+  it('rejects the callers of a failed capture and still runs the next capture for callers that arrived during it', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const failed: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const joiner: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    captures.started[0].reject(new Error('a configuration file is being rewritten'));
+    await expect(failed).rejects.toThrow('a configuration file is being rewritten');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('rewritten');
+    await expect(joiner).resolves.toBe('rewritten');
+  });
+
+  it('returns a rejected promise when the capture function throws synchronously', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const result: Promise<string> = coalescer.captureAsync(scope, 'key', () => {
+      throw new Error('cannot start');
+    });
+    await expect(result).rejects.toThrow('cannot start');
+    await expect(coalescer.captureAsync(scope, 'key', async () => 'started')).resolves.toBe('started');
+  });
+
+  it('shares a running capture with callers whose notBeforeMs is at or before the time it started', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    clock.nowMs = 20;
+    const receivedWhenItStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      10
+    );
+    const receivedBeforeItStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      5
+    );
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+
+    captures.started[0].resolve('started at 10');
+    await expect(Promise.all([first, receivedWhenItStarted, receivedBeforeItStarted])).resolves.toEqual([
+      'started at 10',
+      'started at 10',
+      'started at 10'
+    ]);
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+  });
+
+  it('makes callers whose notBeforeMs is after the running capture started wait for the next capture', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    clock.nowMs = 11;
+    const receivedLater: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 11);
+    const strict: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('started at 11');
+    await expect(Promise.all([receivedLater, strict])).resolves.toEqual(['started at 11', 'started at 11']);
+  });
+
+  it('records when a next capture starts, not when it was queued', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    clock.nowMs = 12;
+    const queued: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    // The running capture started too early for this caller, so it shares the next capture that is already queued.
+    const queuedWithReceipt: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 12);
+    clock.nowMs = 30;
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+
+    const receivedBeforeNextStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      25
+    );
+    const receivedAfterNextStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      31
+    );
+    captures.started[1].resolve('started at 30');
+    await expect(Promise.all([queued, queuedWithReceipt, receivedBeforeNextStarted])).resolves.toEqual([
+      'started at 30',
+      'started at 30',
+      'started at 30'
+    ]);
+    await flushAsync();
+    expect(captures.started).toHaveLength(3);
+    captures.started[2].resolve('started after 31');
+    await expect(receivedAfterNextStarted).resolves.toBe('started after 31');
+  });
+
+  it('rejects a caller that shared a running capture that failed, as if it had asked before it started', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const failed: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const shared: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].reject(new Error('a configuration file is being rewritten'));
+    await expect(failed).rejects.toThrow('a configuration file is being rewritten');
+    await expect(shared).rejects.toThrow('a configuration file is being rewritten');
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+  });
+
+  it('gives a caller the latest capture that succeeded if it started at or after the caller\'s notBeforeMs', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+
+    // Callers received before the capture started that ask only after it settled, as they do when it held the
+    // event loop from start to end.
+    clock.nowMs = 20;
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 10)).resolves.toBe('started at 10');
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 5)).resolves.toBe('started at 10');
+    expect(captures.started).toHaveLength(1);
+
+    const receivedAfterItStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      11
+    );
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('started at 20');
+    await expect(receivedAfterItStarted).resolves.toBe('started at 20');
+
+    // A capture that started later replaces the retained one.
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 11)).resolves.toBe('started at 20');
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 5)).resolves.toBe('started at 20');
+    expect(captures.started).toHaveLength(2);
+  });
+
+  it('never gives a caller without notBeforeMs a capture that has settled', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+
+    clock.nowMs = 20;
+    const strict: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('started at 20');
+    await expect(strict).resolves.toBe('started at 20');
+  });
+
+  it('gives a caller the retained capture while a later one runs, and never retains a capture that failed', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+
+    clock.nowMs = 20;
+    const failed: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    // A caller received before the retained capture started doesn't wait for the running one.
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 5)).resolves.toBe('started at 10');
+    captures.started[1].reject(new Error('a configuration file is being rewritten'));
+    await expect(failed).rejects.toThrow('a configuration file is being rewritten');
+
+    // The failed capture started at 20, but a caller received at 15 must not receive its failure.
+    clock.nowMs = 30;
+    const receivedAfterTheRetainedOneStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      15
+    );
+    expect(captures.started).toHaveLength(3);
+    captures.started[2].resolve('started at 30');
+    await expect(receivedAfterTheRetainedOneStarted).resolves.toBe('started at 30');
+  });
+
+  it('retains the capture that started last when overlapping captures succeed in the opposite order', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({
+      now: () => (clock.nowMs += 10)
+    });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures(clock);
+
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const queued: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    // A caller that asks as soon as the first capture settles starts a capture before the queued one starts.
+    const asksOnSettle: Promise<string> = first.then(() =>
+      coalescer.captureAsync(scope, 'key', captures.captureAsync)
+    );
+    captures.started[0].resolve('first');
+    await flushAsync();
+    expect(captures.started).toHaveLength(3);
+
+    const [earlier, later] = captures.started.slice(1).sort((a, b) => a.startTimeMs - b.startTimeMs);
+    expect(earlier.startTimeMs).toBeLessThan(later.startTimeMs);
+    later.resolve(`started at ${later.startTimeMs}`);
+    await flushAsync();
+    earlier.resolve(`started at ${earlier.startTimeMs}`);
+    const results: string[] = await Promise.all([queued, asksOnSettle]);
+    expect(results.sort()).toEqual([`started at ${earlier.startTimeMs}`, `started at ${later.startTimeMs}`]);
+
+    await expect(
+      coalescer.captureAsync(scope, 'key', captures.captureAsync, later.startTimeMs)
+    ).resolves.toBe(`started at ${later.startTimeMs}`);
+    expect(captures.started).toHaveLength(3);
+  });
+
+  it('compares notBeforeMs with performance.now() by default', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const receivedTimeMs: number = performance.now();
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const shared: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, receivedTimeMs);
+    const receivedLater: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      performance.now() + 60_000
+    );
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+    captures.started[0].resolve('first');
+    await expect(Promise.all([first, shared])).resolves.toEqual(['first', 'first']);
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('second');
+    await expect(receivedLater).resolves.toBe('second');
+  });
+
+  it('never shares a capture between different scopes or keys', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const firstScope: object = {};
+    const secondScope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const results: Promise<string>[] = [
+      coalescer.captureAsync(firstScope, 'a', captures.captureAsync),
+      coalescer.captureAsync(firstScope, 'b', captures.captureAsync),
+      coalescer.captureAsync(secondScope, 'a', captures.captureAsync)
+    ];
+    expect(captures.started).toHaveLength(3);
+    for (const capture of captures.started) capture.resolve(String(capture.index));
+    await expect(Promise.all(results)).resolves.toEqual(['0', '1', '2']);
+
+    // Retained captures are not shared across scopes or keys either.
+    const retained: Promise<string>[] = [
+      coalescer.captureAsync(firstScope, 'c', captures.captureAsync, 0),
+      coalescer.captureAsync(secondScope, 'b', captures.captureAsync, 0)
+    ];
+    expect(captures.started).toHaveLength(5);
+    for (const capture of captures.started.slice(3)) capture.resolve(String(capture.index));
+    await expect(Promise.all(retained)).resolves.toEqual(['3', '4']);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts b/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
index 4fe768425a1..6a4a6f1f823 100644
--- a/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
+++ b/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
@@ -12,6 +12,7 @@ import type {
   IDaemonSetRawModeMessage,
   IDaemonTerminalPolicyResult
 } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transport';
 
 import { DaemonRequiresInProcessError } from '../DaemonTerminalPolicy';
 import type {
@@ -374,6 +375,67 @@ describe(GlobalCommandRequestRouter.name, () => {
     expect(request.environment.get('CHILD_CONTEXT')).toBe('request');
   });
 
+  describe('the marker of the processes that the daemon starts', () => {
+    const HOST_MARKER: string = '/tmp/rushd-test/key.pid.json.groups-4242';
+    const REQUEST_MARKER: string = '/tmp/rushd-test/outer.pid.json.groups-5151';
+    const originalMarker: string | undefined = process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+    afterEach(() => {
+      if (originalMarker === undefined) delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      else process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = originalMarker;
+    });
+
+    // Runs a child of a request that carries another daemon's marker, and returns the child's marker.
+    async function readChildMarkerAsync(
+      hostMarker: string | undefined,
+      options: IGlobalCommandSpawnOptions
+    ): Promise<string | null> {
+      if (hostMarker === undefined) delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      else process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = hostMarker;
+      const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(
+        new TestWorkspaceSession(TEST_REPO_ROOT)
+      );
+      const client: TestGlobalCommandClient = new TestGlobalCommandClient();
+      const requestEnvironment: NodeJS.ProcessEnv = { [DAEMON_OPERATION_GROUPS_ENV_VAR]: REQUEST_MARKER };
+      await router.executeAsync(
+        router.resolveRequest(createRequestOptions('marker', FIRST_CWD, requestEnvironment, 80)),
+        async (context: IGlobalCommandExecutionContext): Promise<IGlobalCommandExecutionResult> => {
+          const child = context.spawnChild(
+            process.execPath,
+            [
+              '-e',
+              `process.stdout.write(JSON.stringify(process.env.${DAEMON_OPERATION_GROUPS_ENV_VAR} ?? null))`
+            ],
+            options
+          );
+          await new Promise<void>((resolve, reject) => {
+            child.once('error', reject);
+            child.once('close', () => resolve());
+          });
+          return { exitCode: 0 };
+        },
+        client
+      );
+      return JSON.parse(
+        client.chunks
+          .filter(({ stream }) => stream === 'stdout')
+          .map(({ text }) => text)
+          .join('')
+      );
+    }
+
+    it.each<[string, IGlobalCommandSpawnOptions]>([
+      ['the request environment', {}],
+      ['an overlay that sets it', { environmentOverlay: { [DAEMON_OPERATION_GROUPS_ENV_VAR]: 'overlay' } }],
+      [
+        'a complete environment that sets it',
+        { environment: { [DAEMON_OPERATION_GROUPS_ENV_VAR]: 'complete' } }
+      ]
+    ])("gives a child of %s the daemon's own marker, or none", async (name, options) => {
+      await expect(readChildMarkerAsync(HOST_MARKER, options)).resolves.toBe(HOST_MARKER);
+      await expect(readChildMarkerAsync(undefined, options)).resolves.toBeNull();
+    });
+  });
+
   (process.platform === 'win32' ? it.skip : it)(
     'cleans a completed child process group before forgetting it',
     async () => {
diff --git a/libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts b/libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts
new file mode 100644
index 00000000000..f7ef107a927
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IRequestLease } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import type { WorkspaceSession } from '../WorkspaceSession';
+import {
+  DaemonRequestWireClient,
+  createDeferred,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+import { createFixtureAsync, runAsync, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('native production daemon engine with a client that is still connecting', () => {
+  it('waits under its native lease for a client that is still connecting, whose request then joins the batch', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const leaseRequested: IDeferred<void> = createDeferred();
+    const grantLease: IDeferred<void> = createDeferred();
+    const secondAdmitted: IDeferred<void> = createDeferred();
+    let secondClient: DaemonRequestWireClient | undefined;
+    let first: Promise<ITerminalExchange> | undefined;
+    let second: Promise<ITerminalExchange> | undefined;
+    try {
+      await runAsync(fixture, 'initialize', ['build', '--only', 'c']);
+      await fixture.session.quiesceWarmSetAsync();
+      const graph: IOperationGraph = fixture.session.operationGraph!;
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(graph, 'scheduleIterationAsync');
+      const acquireExecutionLeaseAsync: WorkspaceSession['acquireExecutionLeaseAsync'] =
+        fixture.session.acquireExecutionLeaseAsync.bind(fixture.session);
+      jest.spyOn(fixture.session, 'acquireExecutionLeaseAsync').mockImplementationOnce(async () => {
+        leaseRequested.resolve();
+        await grantLease.promise;
+        return await acquireExecutionLeaseAsync();
+      });
+      const reconcileAsync: WorkspaceSession['reconcileInvalidationsAsync'] =
+        fixture.session.reconcileInvalidationsAsync.bind(fixture.session);
+      jest.spyOn(fixture.session, 'reconcileInvalidationsAsync').mockImplementationOnce(async () => {
+        // Like a slower reconcile, this one lets the second request reach the router before it ends.
+        await secondAdmitted.promise;
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        return await reconcileAsync();
+      });
+      const routeAsync: PhasedRequestRouter['executeAsync'] = PhasedRequestRouter.prototype.executeAsync;
+      let routedRequests: number = 0;
+      jest.spyOn(PhasedRequestRouter.prototype, 'executeAsync').mockImplementation(async function (
+        this: PhasedRequestRouter,
+        ...args: Parameters<PhasedRequestRouter['executeAsync']>
+      ) {
+        routedRequests++;
+        return await routeAsync.apply(this, args);
+      });
+      const admitAsync: RequestAdmissionController['acquireAsync'] =
+        RequestAdmissionController.prototype.acquireAsync;
+      jest.spyOn(RequestAdmissionController.prototype, 'acquireAsync').mockImplementation(async function (
+        this: RequestAdmissionController,
+        ...args: Parameters<RequestAdmissionController['acquireAsync']>
+      ) {
+        const lease: IRequestLease = await admitAsync.apply(this, args);
+        if (routedRequests === 2) secondAdmitted.resolve();
+        return lease;
+      });
+      first = runAsync(fixture, 'dependency', ['build', '--to', 'a']);
+      await leaseRequested.promise;
+      // The second client connects while the daemon is busy, and takes a while before its handshake.
+      secondClient = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
+      await new Promise<void>((resolve) => setTimeout(resolve, 150));
+      await secondClient.handshakeAsync();
+      grantLease.resolve();
+      for (let turn: number = 0; turn < 20; turn++) {
+        await new Promise<void>((resolve) => setImmediate(resolve));
+      }
+      second = runAsync({ ...fixture, client: secondClient }, 'consumer', ['build', '--to', 'b']);
+      const results: ITerminalExchange[] = await Promise.all([first, second]);
+      for (const result of results)
+        expect(result.terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0 }
+        });
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      grantLease.resolve();
+      secondAdmitted.resolve();
+      await first;
+      await second;
+      jest.restoreAllMocks();
+      await secondClient?.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts b/libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts
new file mode 100644
index 00000000000..91c9d9b8c87
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DeferredCacheEntryWrites } from '@microsoft/rush-lib/lib/logic/buildCache/DeferredCacheEntryWrites';
+import {
+  DaemonFrameType,
+  decodeDaemonEventFrame,
+  decodeDaemonLogChunk,
+  type IDaemonEventEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+// Each test runs several builds, which can take longer than Jest's default 5 seconds on a busy machine.
+jest.setTimeout(30_000);
+
+const SEALED: RegExp =
+  /Sealed \d+ output files? \(0\.0 MB\) in \d+ ms; writing the build cache entry in the background\./;
+const NOT_CLONED: RegExp =
+  /Unable to clone the output files \([A-Z]+\), so the build cache entry is written now\./;
+const REPORT: RegExp =
+  /Build cache entries written in the background since the previous command: 1 queued, (0 written \(0\.0 MB\), 0 failed; 1 pending|1 written \(0\.0 MB\), 0 failed; 0 pending)\./;
+const WRITTEN: string = 'Successfully set cache entry';
+
+/** The text of a request's output, from its operations' logs and from its own terminal. */
+function requestOutput(exchange: ITerminalExchange): string {
+  let text: string = '';
+  for (const frame of exchange.frames) {
+    if (frame.kind === DaemonFrameType.event) {
+      const event: IDaemonEventEnvelope = decodeDaemonEventFrame(frame.payload);
+      if (event.type === 'activityChanged') {
+        text += (event.payload as { text?: string }).text ?? '';
+      }
+    } else if (frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr) {
+      text += Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString();
+    }
+  }
+  return text;
+}
+
+// Whether the file system of the folder can clone files, as the background writes need
+function canCloneFiles(folderPath: string): boolean {
+  const sourcePath: string = path.join(folderPath, 'clone-probe');
+  fs.writeFileSync(sourcePath, 'probe');
+  try {
+    fs.copyFileSync(sourcePath, `${sourcePath}-clone`, fs.constants.COPYFILE_FICLONE_FORCE);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    fs.rmSync(sourcePath, { force: true });
+    fs.rmSync(`${sourcePath}-clone`, { force: true });
+  }
+}
+
+describe('build cache entries of daemon builds', () => {
+  it('are written in the background with the deferCacheWrites setting', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', { deferCacheWrites: true });
+    try {
+      const cloned: boolean = canCloneFiles(path.join(fixture.repoRoot, 'common/temp'));
+      const initial: ITerminalExchange = await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+      expect(initial.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      // Without clones, the entry is written before the operation completes, as without the setting.
+      const output: string = requestOutput(initial);
+      expect(output).toMatch(cloned ? SEALED : NOT_CLONED);
+      expect(output.includes(WRITTEN)).toBe(!cloned);
+      expect(REPORT.test(output)).toBe(cloned);
+      await DeferredCacheEntryWrites.instance.waitForIdleAsync();
+
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), 'two');
+      await runAsync(fixture, 'changed', ['build', '--only', 'a']);
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), 'one');
+      expect((await runAsync(fixture, 'cached', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, operationResults: [{ status: 'FROM CACHE' }] }
+      });
+      expect(runs(fixture)).toEqual(['a:one:', 'a:two:']);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'utf8')).toBe('one');
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('are written before their operations complete without the setting', async () => {
+    const fixture: IFixture = await createFixtureAsync(true);
+    try {
+      const initial: ITerminalExchange = await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+      expect(initial.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const output: string = requestOutput(initial);
+      expect(output).toContain(WRITTEN);
+      expect(output).not.toMatch(/Sealed|Unable to clone|in the background/);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts b/libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts
new file mode 100644
index 00000000000..b736503c780
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import {
+  OperationStatus,
+  type IOperationExecutionResult,
+  type IOperationGraph,
+  type Operation
+} from '@microsoft/rush-lib';
+
+import type { IWorkspaceInvalidationPeek } from '../WorkspaceEngineComponentFactory';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('peeking at the invalidations of a native engine for its executing iteration', () => {
+  it('maps the outputs that changed, except those of dispatched operations, and leaves them to the next build', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toHaveLength(3);
+      const graph: IOperationGraph = fixture.session.operationGraph!;
+      const getOperation = (name: string): Operation =>
+        Array.from(graph.operations).find(
+          (operation: Operation) => operation.associatedProject.packageName === name
+        )!;
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/a/lib'), { recursive: true });
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/c/lib'), { recursive: true });
+      // An iteration that executes a may be writing its outputs.
+      const executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> = new Map([
+        [getOperation('a'), { enabled: true, status: OperationStatus.Executing } as IOperationExecutionResult]
+      ]);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.session.peekInvalidationsAsync({
+        executingIterationRecords
+      });
+      expect(peek?.invalidatedOperations).toEqual(new Set([getOperation('c')]));
+      peek!.discard();
+      expect((await runAsync(fixture, 'deleted', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3).sort()).toEqual(['a:one:', 'c:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('offers no peek for an engine that rebuilds, which runs every operation of each request', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      expect((await runAsync(fixture, 'rebuild', ['rebuild', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+
+      await expect(
+        fixture.session.peekInvalidationsAsync({ executingIterationRecords: new Map() })
+      ).resolves.toBeUndefined();
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts b/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
index 324916efbe5..3d32cef2e81 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
@@ -14,11 +14,22 @@ export interface INativeCommandResult {
   readonly stderr: string;
 }
 
+export interface INativeCommand {
+  /** Undefined when the process could not be started, and `result` rejects. */
+  readonly pid: number | undefined;
+  readonly result: Promise<INativeCommandResult>;
+}
+
 /** Runs an actual native Rush action in its own process, not as the daemon's execution engine. */
 export function runNativeCommandAsync(
   repoRoot: string,
   argv: ReadonlyArray<string>
 ): Promise<INativeCommandResult> {
+  return startNativeCommand(repoRoot, argv).result;
+}
+
+/** Starts an actual native Rush action in its own process, as {@link runNativeCommandAsync} does. */
+export function startNativeCommand(repoRoot: string, argv: ReadonlyArray<string>): INativeCommand {
   const parserPath: string = require.resolve('@microsoft/rush-lib/lib/cli/RushCommandLineParser');
   const script: string = `
     const { RushCommandLineParser } = require(${JSON.stringify(parserPath)});
@@ -40,10 +51,11 @@ export function runNativeCommandAsync(
   child.stderr!.on('data', (data: Buffer) => {
     stderr += data.toString();
   });
-  return new Promise((resolve, reject) => {
+  const result: Promise<INativeCommandResult> = new Promise((resolve, reject) => {
     child.once('error', reject);
     child.once('close', (exitCode) => resolve({ exitCode: exitCode ?? undefined, stdout, stderr }));
   });
+  return { pid: child.pid, result };
 }
 
 export interface INativeScriptGate extends AsyncDisposable {
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
new file mode 100644
index 00000000000..b63e7d1e0a9
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -0,0 +1,439 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+import { Rush, RushUserConfiguration, type ITelemetryData } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonLogChunk,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+import type { LockFile } from '@rushstack/node-core-library';
+
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import { RushDaemonHost } from '../RushDaemonHost';
+import { WorkspaceSession } from '../WorkspaceSession';
+import { removeTestFolderAsync } from './TestProcessExit';
+import { trackTestDaemonHostAsync } from './TestDaemonHostCleanup';
+import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import type {
+  IDaemonRequestResolver,
+  IResolveDaemonRequestOptions,
+  ResolvedDaemonRequest
+} from '../DaemonRequestDispatcher';
+import {
+  isRushxInvocation,
+  wrapWorkspaceResolverLifecycle,
+  type IWorkspaceResolverLifecycle
+} from '../WorkspaceResolverLifecycle';
+import {
+  DaemonRequestWireClient,
+  createWireEnvelope,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+
+const RUSH_VERSION: string = Rush.version;
+
+export interface IFixture extends AsyncDisposable {
+  readonly repoRoot: string;
+  readonly host: RushDaemonHost;
+  readonly session: WorkspaceSession;
+  readonly client: DaemonRequestWireClient;
+}
+
+export interface IFixtureOptions {
+  readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
+  readonly onSessionCreated?: (session: WorkspaceSession) => void;
+  readonly resolver?: IDaemonRequestResolver;
+  /** Adds the `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
+  readonly incrementalScript?: boolean;
+  /** Sets `daemon.incrementalBuilds` in rush.json. */
+  readonly incrementalBuilds?: boolean;
+  /** Adds the phased `test` (incremental) and `retest` commands, with a `_phase:test`, and a global `hello`. */
+  readonly customCommands?: boolean;
+  /** Adds a preRushBuild event hook, which only build and rebuild run. */
+  readonly buildEventHook?: boolean;
+  /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
+  readonly pnpm?: boolean;
+  readonly telemetryEnabled?: boolean;
+  /** Sets `daemon.compatiblePlugins` in rush.json. */
+  readonly compatiblePlugins?: ReadonlyArray<string>;
+  /** Sets `daemon.deferCacheWrites` in rush.json. */
+  readonly deferCacheWrites?: boolean;
+}
+
+/** Records the admission class of every phased request that a production resolver, or its replacement, resolves. */
+export class ClassRecordingResolver extends ProductionDaemonRequestResolver {
+  readonly #classes: string[];
+
+  public constructor(
+    classes: string[],
+    options?: ConstructorParameters<typeof ProductionDaemonRequestResolver>[0]
+  ) {
+    super(options);
+    this.#classes = classes;
+  }
+
+  public override createForSession(
+    preparationLock?: LockFile,
+    validateGraphInputsAsync?: () => Promise<void>
+  ): ProductionDaemonRequestResolver {
+    return new ClassRecordingResolver(this.#classes, { preparationLock, validateGraphInputsAsync });
+  }
+
+  public override async resolveRequestAsync(
+    options: IResolveDaemonRequestOptions
+  ): Promise<ResolvedDaemonRequest> {
+    const resolved: ResolvedDaemonRequest = await super.resolveRequestAsync(options);
+    if (resolved.kind === 'phased') {
+      this.#classes.push(`${resolved.request.commandName}:${resolved.exclusivityClass}`);
+    }
+    return resolved;
+  }
+}
+
+export class DecoratedTestResolver implements IDaemonRequestResolver {
+  public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
+  private readonly _inner: IDaemonRequestResolver;
+  private readonly _events: string[];
+  private readonly _id: number;
+  private _disposed: boolean = false;
+
+  public constructor(inner: IDaemonRequestResolver, events: string[]) {
+    this._inner = inner;
+    this._events = events;
+    this._id = events.filter((event) => event.startsWith('created')).length;
+    events.push(`created:${this._id}`);
+    this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
+      inner,
+      (replacement) => new DecoratedTestResolver(replacement, events)
+    );
+  }
+
+  public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
+    if (this._disposed) throw new Error('A disposed resolver was invoked.');
+    if (isRushxInvocation(options.envelope)) {
+      this._events.push(`isolated:${this._id}`);
+      throw new Error('Explicit isolated invocation reached the decorated resolver.');
+    }
+    return await this._inner.resolveRequestAsync(options);
+  }
+
+  public async [Symbol.asyncDispose](): Promise<void> {
+    if (this._disposed) throw new Error('A resolver was disposed twice.');
+    this._disposed = true;
+    this._events.push(`disposed:${this._id}`);
+    await this._inner[Symbol.asyncDispose]?.();
+  }
+}
+
+/** Creates a Git repository with the projects a, b and c (b depends on a), and a daemon host that serves it. */
+export async function createFixtureAsync(
+  cache: boolean = false,
+  configurationKind: 'direct' | 'rig' | 'inherited' = 'direct',
+  options: IFixtureOptions = {}
+): Promise<IFixture> {
+  const repoRoot: string = fs.mkdtempSync(
+    path.join(fs.realpathSync.native(os.tmpdir()), 'rushd-native-engine-')
+  );
+  const cacheNamespace: string = path.basename(repoRoot);
+  const userConfiguration: RushUserConfiguration = await RushUserConfiguration.initializeAsync();
+  const cacheFolder: string = path.join(
+    userConfiguration.buildCacheFolder ?? path.join(repoRoot, 'common/temp/build-cache'),
+    cacheNamespace
+  );
+  const write: (name: string, text: string) => void = (name, text) => {
+    const filename: string = path.join(repoRoot, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, text);
+  };
+  write(
+    'rush.json',
+    JSON.stringify({
+      rushVersion: RUSH_VERSION,
+      ...(options.pnpm ? { pnpmVersion: '9.15.9' } : { npmVersion: '10.0.0' }),
+      // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
+      daemon: {
+        warmMemoryBudgetMB: 100_000,
+        ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds }),
+        ...(options.compatiblePlugins === undefined ? {} : { compatiblePlugins: options.compatiblePlugins }),
+        ...(options.deferCacheWrites === undefined ? {} : { deferCacheWrites: options.deferCacheWrites })
+      },
+      ...(options.buildEventHook ? { eventHooks: { preRushBuild: ['node -e ""'] } } : {}),
+      ...(options.telemetryEnabled ? { telemetryEnabled: true } : {}),
+      projectFolderMinDepth: 2,
+      projectFolderMaxDepth: 2,
+      projects: ['a', 'b', 'c'].map((name) => ({
+        packageName: name,
+        projectFolder: `projects/${name}`
+      }))
+    })
+  );
+  write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\n**/lib/\n**/node_modules/\nruns.txt\n');
+  write('common/temp/last-link.flag', '{}');
+  if (options.pnpm) {
+    write('common/config/rush/pnpm-lock.yaml', "lockfileVersion: '9.0'\n");
+  } else {
+    write('common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
+  }
+  write(
+    'common/config/rush/command-line.json',
+    JSON.stringify({
+      phases: [
+        { name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } },
+        ...(options.customCommands
+          ? [{ name: '_phase:test', dependencies: { self: ['_phase:compile'] } }]
+          : [])
+      ],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        },
+        ...(options.customCommands
+          ? [
+              {
+                commandKind: 'phased',
+                name: 'test',
+                summary: 'Builds and tests',
+                phases: ['_phase:compile', '_phase:test'],
+                incremental: true,
+                enableParallelism: true
+              },
+              {
+                commandKind: 'phased',
+                name: 'retest',
+                summary: 'Rebuilds and tests',
+                phases: ['_phase:compile', '_phase:test'],
+                incremental: false,
+                enableParallelism: true
+              },
+              {
+                commandKind: 'global',
+                name: 'hello',
+                summary: 'A global command',
+                shellCommand: 'node -e ""'
+              }
+            ]
+          : [])
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'Production build',
+          associatedCommands: ['build'],
+          associatedPhases: ['_phase:compile']
+        }
+      ]
+    })
+  );
+  if (cache) {
+    write(
+      'common/config/rush/build-cache.json',
+      JSON.stringify({
+        buildCacheEnabled: true,
+        cacheProvider: 'local-only',
+        cacheEntryNamePattern: `${cacheNamespace}/[hash]`
+      })
+    );
+  }
+  for (const name of ['a', 'b', 'c']) {
+    write(
+      `projects/${name}/package.json`,
+      JSON.stringify({
+        name,
+        version: '1.0.0',
+        scripts: {
+          '_phase:compile': 'node build.cjs',
+          ...(options.incrementalScript
+            ? { '_phase:compile:incremental': 'node build.cjs --incremental' }
+            : {}),
+          ...(options.customCommands ? { '_phase:test': 'node test.cjs' } : {})
+        },
+        dependencies: name === 'b' ? { a: '1.0.0' } : {}
+      })
+    );
+    write(
+      `projects/${name}/config/rush-project.json`,
+      JSON.stringify({
+        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+      })
+    );
+    write(`projects/${name}/input.txt`, 'one');
+    if (options.pnpm) write(`projects/${name}/.rush/temp/shrinkwrap-deps.json`, '{}');
+    write(
+      `projects/${name}/test.cjs`,
+      `require('node:fs').appendFileSync('../../runs.txt', 'test-${name}\\n');\n`
+    );
+    write(
+      `projects/${name}/build.cjs`,
+      `
+const fs = require('node:fs');
+const path = require('node:path');
+const name = require('./package.json').name;
+const input = fs.readFileSync(fs.existsSync('src/input.txt') ? 'src/input.txt' : 'input.txt', 'utf8');
+(async () => {
+const gateFile = path.resolve('../../common/temp/gate-' + name + '.json');
+if (fs.existsSync(gateFile)) {
+  const { port } = JSON.parse(fs.readFileSync(gateFile, 'utf8'));
+  await new Promise((resolve, reject) => {
+    const socket = require('node:net').connect(port, '127.0.0.1');
+    socket.once('error', reject);
+    socket.once('data', () => { socket.end(); resolve(); });
+  });
+}
+fs.appendFileSync('../../runs.txt', name + ':' + input + ':' + process.argv.slice(2).join(' ') + '\\n');
+const environmentFile = path.resolve('../../common/temp/operation-environment.txt');
+if (fs.existsSync(environmentFile)) {
+  const { COPILOT_AGENT_SESSION_ID = null, RUSH_INVOKED_FOLDER = null } = process.env;
+  fs.appendFileSync(environmentFile, JSON.stringify([name, COPILOT_AGENT_SESSION_ID, RUSH_INVOKED_FOLDER]) + '\\n');
+}
+fs.mkdirSync('lib', { recursive: true });
+fs.writeFileSync('lib/output.txt', input);
+console.log('built-' + name + '-' + input);
+if (input === 'warning') console.error('warning-' + name);
+if (input === 'failure') process.exitCode = 7;
+})().catch((error) => { console.error(error); process.exitCode = 1; });
+`
+    );
+  }
+  if (configurationKind === 'rig') {
+    fs.rmSync(path.join(repoRoot, 'projects/a/config/rush-project.json'));
+    write('projects/a/config/rig.json', '{"rigPackageName":"fixture-rig"}');
+    write('projects/a/node_modules/fixture-rig/package.json', '{"name":"fixture-rig","version":"1.0.0"}');
+    write(
+      'projects/a/node_modules/fixture-rig/profiles/default/config/rush-project.json',
+      JSON.stringify({
+        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+      })
+    );
+  } else if (configurationKind === 'inherited') {
+    write(
+      'common/temp/inherited-rush-project.json',
+      JSON.stringify({
+        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+      })
+    );
+    write(
+      'projects/a/config/rush-project.json',
+      JSON.stringify({
+        extends: '../../../common/temp/inherited-rush-project.json',
+        incrementalBuildIgnoredGlobs: ['ignored.txt']
+      })
+    );
+  }
+  execFileSync('git', ['init', '--quiet'], { cwd: repoRoot });
+  execFileSync('git', ['config', '--local', 'core.autocrlf', 'false'], { cwd: repoRoot });
+  execFileSync('git', ['add', '.'], { cwd: repoRoot });
+  execFileSync(
+    'git',
+    [
+      // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+      '-c',
+      'maintenance.auto=false',
+      '-c',
+      'user.name=Engine Test',
+      '-c',
+      'user.email=engine@example.invalid',
+      'commit',
+      '--quiet',
+      '-m',
+      'fixture'
+    ],
+    { cwd: repoRoot }
+  );
+  let session: WorkspaceSession | undefined;
+  let host: RushDaemonHost | undefined;
+  try {
+    host = await RushDaemonHost.startAsync({
+      repoRoot,
+      rushVersion: RUSH_VERSION,
+      daemonVersion: 'native-engine-test',
+      requestResolver: options.resolver ?? new ProductionDaemonRequestResolver(),
+      getSuccessorLaunchAsync: options.getSuccessorLaunchAsync,
+      createWorkspaceSessionAsync: async (sessionOptions) => {
+        session = await WorkspaceSession.createAsync(sessionOptions);
+        options.onSessionCreated?.(session);
+        return session;
+      }
+    });
+    await trackTestDaemonHostAsync(host);
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    const runningHost: RushDaemonHost = host;
+    return {
+      repoRoot,
+      host,
+      get session(): WorkspaceSession {
+        return session!;
+      },
+      client,
+      [Symbol.asyncDispose]: async () => {
+        await client.closeAsync().finally(() => runningHost.closeAsync());
+        if (cache) await removeTestFolderAsync(cacheFolder, true);
+        await removeTestFolderAsync(repoRoot, true);
+      }
+    };
+  } catch (error) {
+    await host?.closeAsync();
+    if (cache) await removeTestFolderAsync(cacheFolder, true);
+    await removeTestFolderAsync(repoRoot, true);
+    throw error;
+  }
+}
+
+export async function runAsync(
+  fixture: IFixture,
+  requestId: string,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope> = {}
+): Promise<ITerminalExchange> {
+  const environment: Record<string, string> = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined) environment[name] = value;
+  }
+  await fixture.client.sendControlAsync({
+    kind: 'requestStart',
+    payload: createWireEnvelope(requestId, argv[0], fixture.repoRoot, {
+      argv,
+      environment,
+      commandOrigin: 'built-in',
+      ...overrides
+    })
+  });
+  return await fixture.client.readTerminalAsync(requestId);
+}
+
+export function runs(fixture: IFixture): string[] {
+  const filename: string = path.join(fixture.repoRoot, 'runs.txt');
+  return fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8').trim().split('\n') : [];
+}
+
+export function logText(exchange: ITerminalExchange): string {
+  return exchange.frames
+    .filter((frame) => frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr)
+    .map((frame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
+    .join('');
+}
+
+export function requestEnvironment(): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+  );
+}
+
+export function readTelemetryEntries(repoRoot: string): ITelemetryData[] {
+  const folder: string = path.join(repoRoot, 'common/temp/telemetry');
+  return fs
+    .readdirSync(folder)
+    .sort()
+    .flatMap((name: string) => JSON.parse(fs.readFileSync(path.join(folder, name), 'utf8')));
+}
diff --git a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
new file mode 100644
index 00000000000..ccba970a326
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
@@ -0,0 +1,651 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IDaemonNativeLockHolder,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import { AdmissionProgress, RequestAdmissionController } from '../WorkspaceRequestAdmission';
+
+const HOLDER: IDaemonNativeLockHolder = { pid: 4242, command: 'rush install' };
+const POLL_MS: number = 250;
+
+interface ITestLock {
+  released: boolean;
+  release(): void;
+}
+
+interface IAcquisition {
+  settled: boolean;
+  lock?: ITestLock;
+  error?: unknown;
+}
+
+/** Stands in for native Rush's repository lock, and for the process that holds it. */
+class NativeLockProbe {
+  public attempts: number = 0;
+  public readonly lock: ITestLock = {
+    released: false,
+    release(): void {
+      this.released = true;
+    }
+  };
+  #free: boolean = false;
+  #holder: IDaemonNativeLockHolder = HOLDER;
+
+  public readonly tryAcquire = (): ITestLock | undefined => {
+    this.attempts++;
+    return this.#free ? this.lock : undefined;
+  };
+
+  public readonly findHolder = (): IDaemonNativeLockHolder => this.#holder;
+
+  /** Another Rush process holds the lock, and `holder` is what can be found out about it. */
+  public hold(holder: IDaemonNativeLockHolder = HOLDER): void {
+    this.#free = false;
+    this.#holder = holder;
+  }
+
+  /** The Rush process that held the lock exits. */
+  public free(): void {
+    this.#free = true;
+  }
+}
+
+interface ITestController {
+  readonly controller: RequestAdmissionController;
+  readonly messages: IDaemonRequestQueuePositionMessage[];
+}
+
+function createController(
+  admission: IDaemonRequestAdmissionOptions | undefined,
+  abortSignal: AbortSignal = new AbortController().signal,
+  writeQueuePositionAsync?: (message: IDaemonRequestQueuePositionMessage) => Promise<void>
+): ITestController {
+  const messages: IDaemonRequestQueuePositionMessage[] = [];
+  const controller: RequestAdmissionController = new RequestAdmissionController({
+    admission,
+    client: {
+      abortSignal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync:
+        writeQueuePositionAsync ??
+        (async (message: IDaemonRequestQueuePositionMessage) => {
+          messages.push(message);
+        })
+    },
+    requestId: 'request'
+  });
+  return { controller, messages };
+}
+
+function track(promise: Promise<ITestLock>): IAcquisition {
+  const acquisition: IAcquisition = { settled: false };
+  promise.then(
+    (lock: ITestLock) => {
+      acquisition.settled = true;
+      acquisition.lock = lock;
+    },
+    (error: unknown) => {
+      acquisition.settled = true;
+      acquisition.error = error;
+    }
+  );
+  return acquisition;
+}
+
+function waitMessage(nativeLockHolder: IDaemonNativeLockHolder): IDaemonRequestQueuePositionMessage {
+  return { kind: 'queuePosition', payload: { position: 1, requestId: 'request', nativeLockHolder } };
+}
+
+function positionMessage(
+  position: number,
+  nativeLockHolder?: IDaemonNativeLockHolder
+): IDaemonRequestQueuePositionMessage {
+  return {
+    kind: 'queuePosition',
+    payload: { position, requestId: 'request', ...(nativeLockHolder && { nativeLockHolder }) }
+  };
+}
+
+interface IAdmission {
+  settled: boolean;
+  lease?: IRequestLease;
+  error?: unknown;
+}
+
+function trackAdmission(promise: Promise<IRequestLease | undefined>): IAdmission {
+  const admission: IAdmission = { settled: false };
+  promise.then(
+    (lease: IRequestLease | undefined) => {
+      admission.settled = true;
+      admission.lease = lease;
+    },
+    (error: unknown) => {
+      admission.settled = true;
+      admission.error = error;
+    }
+  );
+  return admission;
+}
+
+describe(`${RequestAdmissionController.name} and native Rush's repository lock`, () => {
+  let probe: NativeLockProbe;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    probe = new NativeLockProbe();
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('takes the lock at once when no other Rush process holds it', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 1000 });
+    probe.free();
+    await expect(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)).resolves.toBe(
+      probe.lock
+    );
+    expect(probe.attempts).toBe(1);
+    expect(messages).toEqual([]);
+    expect(controller.remainingAdmission?.waitTimeoutMs).toBe(1000);
+  });
+
+  it('waits for another Rush process to release the lock, and tells the client which process holds it', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 5000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(messages).toEqual([waitMessage(HOLDER)]);
+    await jest.advanceTimersByTimeAsync(4 * POLL_MS);
+    expect(acquisition.settled).toBe(false);
+    expect(probe.attempts).toBe(5);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(acquisition).toEqual({ settled: true, lock: probe.lock });
+    expect(probe.attempts).toBe(6);
+    expect(messages).toEqual([waitMessage(HOLDER)]);
+    // The wait counts against the request's wait timeout, like waiting for another request does.
+    expect(controller.remainingAdmission?.waitTimeoutMs).toBe(5000 - 5 * POLL_MS);
+  });
+
+  it('fails when its wait timeout runs out, naming the process that holds the lock', async () => {
+    const { controller } = createController({ waitTimeoutMs: 1000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(999);
+    expect(acquisition.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(acquisition.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 1000ms wait timeout while waiting for another Rush process ' +
+        "(PID 4242: rush install) to release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+    });
+    // It tried once more at the end of its wait.
+    expect(probe.attempts).toBe(5);
+    expect(probe.lock.released).toBe(false);
+    expect(controller.remainingAdmission?.waitTimeoutMs).toBe(0);
+  });
+
+  it('fails at once for a zero wait timeout, naming the process that holds the lock', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 0 });
+    await expect(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)).rejects.toMatchObject(
+      {
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message:
+          'The request cannot be admitted immediately because another Rush process (PID 4242: rush install) ' +
+          "holds this repository's lock. Use --wait-timeout <seconds> to wait for it."
+      }
+    );
+    expect(probe.attempts).toBe(1);
+    // A request that does not wait does not say that it waits.
+    expect(messages).toEqual([]);
+  });
+
+  it('fails at once with --no-wait, naming the process that holds the lock', async () => {
+    const { controller, messages } = createController({ noWait: true });
+    await expect(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)).rejects.toMatchObject(
+      {
+        code: RequestSchedulerErrorCode.NoWait,
+        message:
+          'The request cannot be admitted immediately because another Rush process (PID 4242: rush install) ' +
+          "holds this repository's lock, and --no-wait was specified."
+      }
+    );
+    expect(probe.attempts).toBe(1);
+    expect(messages).toEqual([]);
+  });
+
+  it('names the timeout that the client asked for when an earlier wait spent part of it', async () => {
+    const { controller: earlier } = createController({ waitTimeoutMs: 1000 });
+    const first: IAcquisition = track(earlier.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder));
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(first.lock).toBe(probe.lock);
+    probe.hold();
+    const { controller: later } = createController(earlier.remainingAdmission);
+    const second: IAcquisition = track(later.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder));
+    await jest.advanceTimersByTimeAsync(499);
+    expect(second.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(second.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message: expect.stringContaining(
+        'not admitted within its 1000ms wait timeout while waiting for another'
+      )
+    });
+  });
+
+  it('stops waiting as soon as the request is aborted, and does not try the lock again', async () => {
+    const abortController: AbortController = new AbortController();
+    const { controller } = createController({ waitTimeoutMs: 5000 }, abortController.signal);
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS + 50);
+    const attempts: number = probe.attempts;
+    abortController.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(acquisition.error).toMatchObject({ code: RequestSchedulerErrorCode.Aborted });
+    probe.free();
+    await jest.advanceTimersByTimeAsync(10 * POLL_MS);
+    expect(probe.attempts).toBe(attempts);
+    expect(probe.lock.released).toBe(false);
+  });
+
+  it('waits without a limit when the request has no wait timeout', async () => {
+    const { controller } = createController(undefined);
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(60_000);
+    expect(acquisition.settled).toBe(false);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(acquisition.lock).toBe(probe.lock);
+  });
+
+  it('tells the client again only when another process holds the lock, and never forgets a known holder', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 5000 });
+    track(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder));
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    // The holder released the lock, and no live process holds it at the moment.
+    probe.hold({});
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.hold({ pid: 5151 });
+    await jest.advanceTimersByTimeAsync(2 * POLL_MS);
+    expect(messages).toEqual([waitMessage(HOLDER), waitMessage({ pid: 5151 })]);
+  });
+
+  it('keeps the command of a holder that exits, since it holds the lock until it is reaped', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 1000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    // Its command can no longer be read.
+    probe.hold({ pid: HOLDER.pid });
+    await jest.advanceTimersByTimeAsync(1000 - POLL_MS);
+    expect({ messages, error: acquisition.error }).toMatchObject({
+      messages: [waitMessage(HOLDER)],
+      error: {
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message: expect.stringContaining(
+          "another Rush process (PID 4242: rush install) to release this repository's"
+        )
+      }
+    });
+  });
+
+  it('tells the client the command of the process that holds the lock once the command can be read', async () => {
+    // At first its command cannot be read.
+    probe.hold({ pid: HOLDER.pid });
+    const { controller, messages } = createController({ waitTimeoutMs: 1000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.hold();
+    await jest.advanceTimersByTimeAsync(1000 - POLL_MS);
+    expect({ messages, error: acquisition.error }).toMatchObject({
+      messages: [waitMessage({ pid: HOLDER.pid }), waitMessage(HOLDER)],
+      error: {
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message: expect.stringContaining(
+          "another Rush process (PID 4242: rush install) to release this repository's"
+        )
+      }
+    });
+  });
+
+  it('names another Rush process when it cannot tell which process holds the lock', async () => {
+    probe.hold({});
+    const { controller, messages } = createController({ waitTimeoutMs: POLL_MS });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(messages).toEqual([waitMessage({})]);
+    expect(acquisition.error).toMatchObject({
+      message:
+        'The request was not admitted within its 250ms wait timeout while waiting for another Rush process ' +
+        "to release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+    });
+  });
+
+  it('releases the lock that it took when the client could not be told about the wait', async () => {
+    let rejectWrite: (error: Error) => void = () => undefined;
+    const { controller } = createController(
+      { waitTimeoutMs: 5000 },
+      undefined,
+      () =>
+        new Promise<void>((resolve, reject) => {
+          rejectWrite = reject;
+        })
+    );
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(probe.attempts).toBe(2);
+    expect(acquisition.settled).toBe(false);
+    const writeError: Error = new Error('The client disconnected.');
+    rejectWrite(writeError);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(acquisition.error).toBe(writeError);
+    expect(probe.lock.released).toBe(true);
+  });
+});
+
+describe(`${RequestAdmissionController.name} behind a graph transition that waits for the lock`, () => {
+  let probe: NativeLockProbe;
+  let scheduler: RequestScheduler;
+  let ownerLease: IRequestLease;
+  let transition: AdmissionProgress;
+
+  beforeEach(async () => {
+    jest.useFakeTimers();
+    probe = new NativeLockProbe();
+    scheduler = new RequestScheduler();
+    ownerLease = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive });
+    transition = new AdmissionProgress();
+  });
+
+  afterEach(() => {
+    ownerLease.release();
+    jest.useRealTimers();
+  });
+
+  /** The owner of the transition, which holds the gate, waits for the lock. */
+  function waitForLock(owner: ITestController): IAcquisition {
+    return track(owner.controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder, transition));
+  }
+
+  it('tells the requests that wait behind it which process it waits for, until it takes the lock', async () => {
+    const owner: ITestController = createController(undefined);
+    const first: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const second: ITestController = createController(undefined);
+    const firstAdmission: IAdmission = trackAdmission(
+      first.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const secondAdmission: IAdmission = trackAdmission(
+      second.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(first.messages).toEqual([positionMessage(1), positionMessage(1)]);
+    expect(second.messages).toEqual([positionMessage(2)]);
+
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(owner.messages).toEqual([waitMessage(HOLDER)]);
+    expect(transition.nativeLockHolder).toEqual(HOLDER);
+    expect(first.messages.slice(2)).toEqual([positionMessage(1, HOLDER)]);
+    expect(second.messages.slice(1)).toEqual([positionMessage(2, HOLDER)]);
+
+    // Another process takes the lock before the reload does.
+    await jest.advanceTimersByTimeAsync(2 * POLL_MS);
+    probe.hold({ pid: 5151 });
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(first.messages.slice(3)).toEqual([positionMessage(1, { pid: 5151 })]);
+    expect(second.messages.slice(2)).toEqual([positionMessage(2, { pid: 5151 })]);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock).toEqual({ settled: true, lock: probe.lock });
+    expect(transition.nativeLockHolder).toBeUndefined();
+    // They still wait behind the transition, but no longer for another process.
+    expect(first.messages.slice(4)).toEqual([positionMessage(1)]);
+    expect(second.messages.slice(3)).toEqual([positionMessage(2)]);
+    expect(owner.messages).toEqual([waitMessage(HOLDER), waitMessage({ pid: 5151 })]);
+    expect(firstAdmission.settled).toBe(false);
+    expect(secondAdmission.settled).toBe(false);
+
+    const messageCounts: number[] = [first.messages.length, second.messages.length];
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(firstAdmission.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect(secondAdmission.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect([first.messages.length, second.messages.length]).toEqual(messageCounts);
+
+    // A later wait for the lock, by the owner of the next transition, is nothing to the requests admitted already.
+    probe.hold({ pid: 6161 });
+    const nextLock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(transition.nativeLockHolder).toEqual({ pid: 6161 });
+    expect([first.messages.length, second.messages.length]).toEqual(messageCounts);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(nextLock.lock).toBe(probe.lock);
+    firstAdmission.lease?.release();
+    secondAdmission.lease?.release();
+    for (const { controller } of [owner, first, second]) controller.dispose();
+  });
+
+  it('names the process to a request that starts waiting behind it while it waits for the lock', async () => {
+    const owner: ITestController = createController(undefined);
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const lateAdmission: IAdmission = trackAdmission(
+      late.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([positionMessage(1, HOLDER)]);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock.lock).toBe(probe.lock);
+    expect(late.messages).toEqual([positionMessage(1, HOLDER), positionMessage(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(lateAdmission.lease).toBeDefined();
+    lateAdmission.lease?.release();
+    owner.controller.dispose();
+    late.controller.dispose();
+  });
+
+  it('names the process in the timeout of a request that waits behind it', async () => {
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    // The owner loads the graph first, which does not count against the follower's timeout.
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(900);
+    transition.setActive(false);
+    waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(1999);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 2000ms wait timeout while waiting for another request's load " +
+        'or reload of the workspace graph, which waits for another Rush process (PID 4242: rush install) to ' +
+        "release this repository's lock; 0.9s spent while that request loaded the graph did not count. " +
+        'Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the process in a later timeout once it has taken the lock', async () => {
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(4 * POLL_MS);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock.lock).toBe(probe.lock);
+    await jest.advanceTimersByTimeAsync(2000 - 5 * POLL_MS - 1);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 2000ms wait timeout while waiting for another request's load " +
+        'or reload of the workspace graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER), positionMessage(1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('stops naming the process to the requests behind it when its own wait for the lock fails', async () => {
+    const owner: ITestController = createController({ waitTimeoutMs: 1000 });
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const followerAdmission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER)]);
+
+    await jest.advanceTimersByTimeAsync(1000);
+    expect(lock.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    expect(transition.nativeLockHolder).toBeUndefined();
+    // It still waits behind the transition, but no longer for another process.
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER), positionMessage(1)]);
+
+    // Nor is a request that starts waiting later told of the process.
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const lateAdmission: IAdmission = trackAdmission(
+      late.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([positionMessage(2)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(followerAdmission.lease).toBeDefined();
+    expect(lateAdmission.lease).toBeDefined();
+    followerAdmission.lease?.release();
+    lateAdmission.lease?.release();
+    for (const { controller } of [owner, follower, late]) controller.dispose();
+  });
+
+  it('tells the requests behind it nothing when its wait for the lock fails before it names the process', async () => {
+    const owner: ITestController = createController({ waitTimeoutMs: 0 });
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const followerAdmission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([positionMessage(1)]);
+
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(lock.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    expect(transition.nativeLockHolder).toBeUndefined();
+    expect(follower.messages).toEqual([positionMessage(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(followerAdmission.lease).toBeDefined();
+    followerAdmission.lease?.release();
+    for (const { controller } of [owner, follower]) controller.dispose();
+  });
+
+  it('keeps naming a known holder to the requests behind it while it cannot identify the holder', async () => {
+    const owner: ITestController = createController(undefined);
+    const script: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const stopWaiting: AbortController = new AbortController();
+    const scriptAdmission: IAdmission = trackAdmission(
+      script.controller.acquireBehindTransitionAsync(scheduler, transition, false, stopWaiting.signal)
+    );
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const followerAdmission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([positionMessage(2), positionMessage(2, HOLDER)]);
+
+    // The holder exits: first its command can no longer be read, and then no live process holds the lock.
+    probe.hold({ pid: HOLDER.pid });
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.hold({});
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(transition.nativeLockHolder).toEqual(HOLDER);
+    expect(follower.messages).toEqual([positionMessage(2), positionMessage(2, HOLDER)]);
+
+    // The request ahead stops waiting. The follower's new position still names the known holder.
+    stopWaiting.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(scriptAdmission).toEqual({ settled: true, lease: undefined });
+    expect(follower.messages).toEqual([
+      positionMessage(2),
+      positionMessage(2, HOLDER),
+      positionMessage(1, HOLDER)
+    ]);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock.lock).toBe(probe.lock);
+    expect(owner.messages).toEqual([waitMessage(HOLDER)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(followerAdmission.lease).toBeDefined();
+    followerAdmission.lease?.release();
+    for (const { controller } of [owner, script, follower]) controller.dispose();
+  });
+
+  it('does not name the process to a script that stopped waiting to pass it', async () => {
+    const owner: ITestController = createController(undefined);
+    const script: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const stopWaiting: AbortController = new AbortController();
+    const admission: IAdmission = trackAdmission(
+      script.controller.acquireBehindTransitionAsync(scheduler, transition, false, stopWaiting.signal)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(script.messages).toEqual([positionMessage(1)]);
+
+    // As the lifecycle does: the passage opens, and then the owner waits for the lock in the same turn.
+    stopWaiting.abort();
+    waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission).toEqual({ settled: true, lease: undefined });
+    expect(owner.messages).toEqual([waitMessage(HOLDER)]);
+    expect(script.messages).toEqual([positionMessage(1)]);
+    owner.controller.dispose();
+    script.controller.dispose();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
index c64a429c1ba..ea6360e3d19 100644
--- a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
+++ b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
@@ -131,6 +131,7 @@ jest.setTimeout(30_000);
       expect(fixture.runs()).toEqual([]);
 
       const marker: string = path.join(fixture.folder, 'unexpected-starter');
+      // The retained owner is alive, so a deadline error here would mean that the client skipped its owner check.
       await expect(
         connectOrStartDaemonAsync({
           paths: fixture.host.paths,
@@ -143,7 +144,7 @@ jest.setTimeout(30_000);
             environment: fixture.environment
           }
         })
-      ).rejects.toThrow(/still exists|deadline/);
+      ).rejects.toThrow(`did not answer at ${fixture.host.paths.socketPath}`);
       expect(fs.existsSync(marker)).toBe(false);
       expect(readDaemonLockfile(fixture.host.paths.lockfilePath)).toEqual(originalOwner);
       expect(
diff --git a/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts b/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
new file mode 100644
index 00000000000..ce83fedecc3
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
@@ -0,0 +1,173 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { RushConfiguration } from '@microsoft/rush-lib';
+
+import {
+  captureNativeMutationInstallationStateAsync,
+  type INativeMutationInstallationState,
+  isInstallationUnchangedByMutation
+} from '../NativeMutationInstallationState';
+
+const OLD_TIME: Date = new Date('2000-01-01T00:00:00Z');
+const LINK: object = { linkedPackagePath: '/linked', linkedPackageName: 'linked', linkType: 'LinkPackage' };
+
+describe('the installation state around a native mutation', () => {
+  let folder: string;
+  let subspaceFolders: string[];
+  let hotlinkStatePath: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-mutation-state-'));
+    subspaceFolders = [path.join(folder, 'default'), path.join(folder, 'other')];
+    hotlinkStatePath = path.join(folder, 'rush-hotlink-state.json');
+    for (const subspaceFolder of subspaceFolders) {
+      fs.mkdirSync(subspaceFolder);
+      writeFlag(subspaceFolder);
+    }
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function flagPath(subspaceFolder: string): string {
+    return path.join(subspaceFolder, 'last-install.flag');
+  }
+
+  /** Writes a flag and dates it far back, so that a flag written again later never has the same times. */
+  function writeFlag(subspaceFolder: string): void {
+    fs.writeFileSync(flagPath(subspaceFolder), '{"node":"20.0.0","packageManager":"pnpm"}');
+    fs.utimesSync(flagPath(subspaceFolder), OLD_TIME, OLD_TIME);
+  }
+
+  function writeHotlinkState(state: unknown): void {
+    fs.writeFileSync(hotlinkStatePath, JSON.stringify(state));
+  }
+
+  async function captureAsync(): Promise<INativeMutationInstallationState | undefined> {
+    const rushConfiguration: Partial<RushConfiguration> = {
+      commonTempFolder: folder,
+      subspaces: subspaceFolders.map((subspaceFolder: string) => ({
+        getSubspaceTempFolderPath: () => subspaceFolder
+      })) as unknown as RushConfiguration['subspaces']
+    };
+    return await captureNativeMutationInstallationStateAsync(rushConfiguration as RushConfiguration);
+  }
+
+  async function isUnchangedAfterAsync(change: () => void): Promise<boolean> {
+    const before: INativeMutationInstallationState | undefined = await captureAsync();
+    change();
+    const after: INativeMutationInstallationState | undefined = await captureAsync();
+    expect(before).toBeDefined();
+    expect(after).toBeDefined();
+    return isInstallationUnchangedByMutation(before!, after!);
+  }
+
+  it('is unchanged when no flag was touched', async () => {
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(true);
+  });
+
+  it('is unchanged when a flag was only read', async () => {
+    expect(await isUnchangedAfterAsync(() => fs.readFileSync(flagPath(subspaceFolders[1])))).toBe(true);
+  });
+
+  it('is changed when a flag was written again with the same content', async () => {
+    const content: Buffer = fs.readFileSync(flagPath(subspaceFolders[1]));
+    expect(
+      await isUnchangedAfterAsync(() => {
+        fs.rmSync(flagPath(subspaceFolders[1]));
+        fs.writeFileSync(flagPath(subspaceFolders[1]), content);
+      })
+    ).toBe(false);
+  });
+
+  it('is changed when a flag was written again in place with the same content', async () => {
+    const flag: string = flagPath(subspaceFolders[1]);
+    const content: Buffer = fs.readFileSync(flag);
+    const inode: bigint = fs.statSync(flag, { bigint: true }).ino;
+    expect(await isUnchangedAfterAsync(() => fs.writeFileSync(flag, content))).toBe(false);
+    // Rush writes the flag in place, so only the times tell the two writes apart.
+    expect(fs.statSync(flag, { bigint: true }).ino).toBe(inode);
+  });
+
+  it('is changed when a flag was deleted', async () => {
+    expect(await isUnchangedAfterAsync(() => fs.rmSync(flagPath(subspaceFolders[0])))).toBe(false);
+  });
+
+  it('is changed when a flag was missing before, even if it is still missing', async () => {
+    fs.rmSync(flagPath(subspaceFolders[1]));
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(false);
+  });
+
+  it('is changed when the subspaces are different', async () => {
+    const before: INativeMutationInstallationState | undefined = await captureAsync();
+    subspaceFolders = subspaceFolders.slice(1);
+    const after: INativeMutationInstallationState | undefined = await captureAsync();
+    expect(isInstallationUnchangedByMutation(before!, after!)).toBe(false);
+  });
+
+  it.each([
+    ['records no subspace', { fileVersion: 0, linksBySubspace: {} }],
+    ['records no link in any subspace', { fileVersion: 0, linksBySubspace: { default: [], other: [] } }]
+  ])('is unchanged when the hotlink state %s', async (description: string, state: unknown) => {
+    writeHotlinkState(state);
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(true);
+  });
+
+  it.each([
+    ['records a link', { fileVersion: 0, linksBySubspace: { default: [], other: [LINK] } }],
+    ['has another file version', { fileVersion: 1, linksBySubspace: {} }],
+    ['has no linksBySubspace', { fileVersion: 0 }],
+    [
+      'lists a subspace in something other than an array',
+      { fileVersion: 0, linksBySubspace: { default: {} } }
+    ],
+    ['is not an object', 0],
+    ['is null', null]
+  ])('is changed when the hotlink state %s', async (description: string, state: unknown) => {
+    writeHotlinkState(state);
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(false);
+  });
+
+  it('is changed when the hotlink state is not JSON', async () => {
+    fs.writeFileSync(hotlinkStatePath, '{');
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(false);
+  });
+
+  it('is changed when a hotlink was added during the mutation', async () => {
+    expect(
+      await isUnchangedAfterAsync(() =>
+        writeHotlinkState({ fileVersion: 0, linksBySubspace: { default: [LINK] } })
+      )
+    ).toBe(false);
+  });
+
+  it('is changed when the hotlinks were removed during the mutation', async () => {
+    writeHotlinkState({ fileVersion: 0, linksBySubspace: { default: [LINK] } });
+    expect(
+      await isUnchangedAfterAsync(() => writeHotlinkState({ fileVersion: 0, linksBySubspace: {} }))
+    ).toBe(false);
+  });
+
+  it('cannot be captured, and does not throw, when a file that exists cannot be read', async () => {
+    fs.mkdirSync(hotlinkStatePath);
+    expect(await captureAsync()).toBeUndefined();
+  });
+
+  it('cannot be captured, and does not throw, when the configuration cannot list its subspaces', async () => {
+    const rushConfiguration: Partial<RushConfiguration> = {
+      commonTempFolder: folder,
+      get subspaces(): RushConfiguration['subspaces'] {
+        throw new Error('The subspaces cannot be loaded.');
+      }
+    };
+    expect(
+      await captureNativeMutationInstallationStateAsync(rushConfiguration as RushConfiguration)
+    ).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts b/libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts
new file mode 100644
index 00000000000..c96953c1e7b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { createNativeScriptGateAsync, type INativeScriptGate } from './NativeEngineTestCommands';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('native production daemon engine', () => {
+  it.each<[string, (libPath: string) => void]>([
+    ['adds an output file', (libPath) => fs.writeFileSync(path.join(libPath, 'race.txt'), 'race')],
+    [
+      'edits an output file in place',
+      (libPath) => fs.writeFileSync(path.join(libPath, 'output.txt'), 'edited in place')
+    ]
+  ])(
+    're-runs an operation after a change that %s once it ran, while its consumer still ran',
+    async (description: string, change: (libPath: string) => void) => {
+      const fixture: IFixture = await createFixtureAsync();
+      const gate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'b');
+      let initial: Promise<ITerminalExchange> | undefined;
+      try {
+        initial = runAsync(fixture, 'initial', ['build', '--to', 'b']);
+        await Promise.race([
+          gate.entered,
+          initial.then((exchange: ITerminalExchange) => {
+            throw new Error(`b did not enter its script gate: ${JSON.stringify(exchange.terminal)}`);
+          })
+        ]);
+        // Rush reported the result of a before b started, so the result of a does not include this change.
+        change(path.join(fixture.repoRoot, 'projects/a/lib'));
+        await gate.releaseAsync();
+        expect((await initial).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+
+        expect((await runAsync(fixture, 'changed', ['build', '--only', 'a'])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: true }
+        });
+        expect(runs(fixture).slice(2)).toEqual(['a:one:']);
+        expect((await runAsync(fixture, 'unchanged', ['build', '--only', 'a'])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: false }
+        });
+        expect(runs(fixture)).toHaveLength(3);
+      } finally {
+        await gate.releaseAsync();
+        await initial?.catch(() => undefined);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts b/libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts
new file mode 100644
index 00000000000..0daceb163ce
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { PhasedCommandEngineBusyError } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+
+import { isNativeLockHeldByThisProcess, tryAcquireNativeLock } from '../NativeRepositoryLock';
+
+// One test starts a second process, which can take longer than Jest's default 5 seconds on a busy machine.
+jest.setTimeout(30_000);
+
+// On Windows, the lock file does not name its process, so this process cannot tell that it holds the lock.
+const unixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/native-repository-lock');
+
+function createLockFolder(name: string): string {
+  const folder: string = path.join(TEST_FOLDER, name);
+  fs.rmSync(folder, { recursive: true, force: true });
+  fs.mkdirSync(folder, { recursive: true });
+  return folder;
+}
+
+/** Starts another process, which holds Rush's repository lock in `folder` until its stdin ends. */
+async function holdInAnotherProcessAsync(folder: string): Promise<ChildProcess> {
+  const script: string = [
+    `const { LockFile } = require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))});`,
+    `const lock = LockFile.tryAcquire(${JSON.stringify(folder)}, 'rush');`,
+    "process.stdout.write(lock ? 'held' : 'busy');",
+    'process.stdin.resume();',
+    "process.stdin.on('end', () => { lock?.release(); process.exit(0); });"
+  ].join('\n');
+  const holder: ChildProcess = spawn(process.execPath, ['-e', script], {
+    stdio: ['pipe', 'pipe', 'inherit']
+  });
+  const [output] = await once(holder.stdout!, 'data');
+  expect(String(output)).toBe('held');
+  return holder;
+}
+
+async function stopAsync(holder: ChildProcess): Promise<void> {
+  const closed: Promise<unknown[]> = once(holder, 'close');
+  holder.stdin!.end();
+  await closed;
+}
+
+describe(tryAcquireNativeLock.name, () => {
+  it('takes the lock when no Rush process holds it', () => {
+    const folder: string = createLockFolder('free');
+    const lock: LockFile | undefined = tryAcquireNativeLock(folder);
+    expect(lock).toBeInstanceOf(LockFile);
+    lock?.release();
+  });
+
+  it('takes nothing while another Rush process holds the lock, so that the request can wait for it', async () => {
+    const folder: string = createLockFolder('another-process');
+    const holder: ChildProcess = await holdInAnotherProcessAsync(folder);
+    try {
+      expect(tryAcquireNativeLock(folder)).toBeUndefined();
+      expect(isNativeLockHeldByThisProcess(folder)).toBe(false);
+    } finally {
+      await stopAsync(holder);
+    }
+    const lock: LockFile | undefined = tryAcquireNativeLock(folder);
+    expect(lock).toBeInstanceOf(LockFile);
+    lock?.release();
+  });
+
+  unixIt('fails at once when this process holds the lock already, since waiting for it would not end', () => {
+    const folder: string = createLockFolder('this-process');
+    const lock: LockFile | undefined = tryAcquireNativeLock(folder);
+    expect(lock).toBeInstanceOf(LockFile);
+    try {
+      expect(isNativeLockHeldByThisProcess(folder)).toBe(true);
+      expect(() => tryAcquireNativeLock(folder)).toThrow(PhasedCommandEngineBusyError);
+    } finally {
+      lock?.release();
+    }
+    expect(isNativeLockHeldByThisProcess(folder)).toBe(false);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
new file mode 100644
index 00000000000..ae086249c68
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
@@ -0,0 +1,670 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  Operation,
+  OperationGraphHooks,
+  OperationStatus,
+  type IConfigurableOperation,
+  type IInputsSnapshot,
+  type IOperationExecutionResult,
+  type IOperationGraphIterationOptions,
+  type IOperationRunnerContext,
+  type IOperationSettings,
+  type IPhase,
+  type IOperationGraph,
+  type RushConfigurationProject
+} from '@microsoft/rush-lib';
+
+import { OperationOutputFingerprints } from '../OperationOutputFingerprints';
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import { OutputFolderDigester, type IBackgroundOutputFolderDigests } from '../OutputFolderDigestPool';
+import { createDeferred, type IDeferred } from './DaemonRequestWireTestUtilities';
+
+const PHASE: IPhase = { name: '_phase:build', logFilenameIdentifier: '_phase_build' } as IPhase;
+
+interface IReconciliation {
+  readonly inputsSnapshot: IInputsSnapshot;
+}
+
+interface ITestResult {
+  readonly name: string;
+  readonly status: OperationStatus;
+  /** Defaults to true. */
+  readonly enabled?: boolean;
+}
+
+function getNames(operations: ReadonlyArray<Operation>): string[] {
+  return operations.map((operation: Operation) => operation.associatedProject.packageName);
+}
+
+function getProjectNames(folderSets: ReadonlyArray<IOutputFolderSet>): string {
+  return folderSets.map(({ projectFolder }: IOutputFolderSet) => path.basename(projectFolder)).join(',');
+}
+
+function createInputsSnapshot(): IInputsSnapshot {
+  return {} as IInputsSnapshot;
+}
+
+/** Digests on the calling thread and logs each call. `start` walks at once, as if the workers were quick. */
+class RecordingDigester extends OutputFolderDigester {
+  public readonly calls: string[] = [];
+
+  public constructor() {
+    super({ threadCount: 0 });
+  }
+
+  public override digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+    this.calls.push(`digest ${getProjectNames(folderSets)}`);
+    return super.digest(folderSets);
+  }
+
+  public override start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests {
+    this.calls.push(`start ${getProjectNames(folderSets)}`);
+    const digests: IOutputFolderDigest[] = folderSets.map((folderSet: IOutputFolderSet) =>
+      digestOutputFolders(folderSet)
+    );
+    return {
+      finish: () => {
+        this.calls.push('finish');
+        return digests;
+      },
+      cancel: () => {
+        this.calls.push('cancel');
+      }
+    };
+  }
+
+  public takeCalls(): string[] {
+    return this.calls.splice(0);
+  }
+}
+
+/** A graph whose operations have a `lib` output folder with the given number of files. */
+class TestGraph {
+  public readonly abortController: AbortController = new AbortController();
+  public readonly hooks: OperationGraphHooks = new OperationGraphHooks();
+  public readonly resultByOperation: Map<Operation, IOperationExecutionResult> = new Map();
+  public readonly fingerprints: OperationOutputFingerprints;
+  readonly #operations: Map<string, Operation> = new Map();
+  readonly #root: string;
+
+  public constructor(root: string, fileCounts: Record<string, number>, digester: OutputFolderDigester) {
+    this.#root = root;
+    // As if an earlier build wrote the outputs: a file that a test adds must change the modification time of its
+    // folder, which it doesn't within the same tick of the file system's clock (up to 16 ms on Windows).
+    const outputsTime: number = Date.now() / 1000 - 3600;
+    for (const [name, fileCount] of Object.entries(fileCounts)) {
+      for (let fileIndex: number = 0; fileIndex < fileCount; fileIndex++) {
+        this.addFile(name, `lib/file-${fileIndex}.js`);
+      }
+      const projectFolder: string = path.join(root, name);
+      fs.utimesSync(path.join(projectFolder, 'lib'), outputsTime, outputsTime);
+      const project: RushConfigurationProject = {
+        packageName: name,
+        projectFolder,
+        projectRushTempFolder: path.join(projectFolder, 'temp')
+      } as RushConfigurationProject;
+      const settings: IOperationSettings = { operationName: PHASE.name, outputFolderNames: ['lib'] };
+      this.#operations.set(
+        name,
+        new Operation({ phase: PHASE, project, settings, logFilenameIdentifier: `${name}_build` })
+      );
+    }
+    this.fingerprints = new OperationOutputFingerprints(this as unknown as IOperationGraph, digester);
+  }
+
+  public getOperation(name: string): Operation {
+    const operation: Operation | undefined = this.#operations.get(name);
+    if (!operation) {
+      throw new Error(`No operation ${name}`);
+    }
+    return operation;
+  }
+
+  public getLegacySkipStatePath(name: string): string {
+    return path.join(this.#root, name, 'temp', `package-deps_${name}_build.json`);
+  }
+
+  public addFile(name: string, relativePath: string): void {
+    const filePath: string = path.join(this.#root, name, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, relativePath);
+  }
+
+  /** Runs the operations successfully, which records the fingerprints of their outputs. */
+  public async runAsync(...names: string[]): Promise<void> {
+    await this.executeAsync(names.map((name: string) => ({ name, status: OperationStatus.Success })));
+  }
+
+  /**
+   * Reports each result as Rush does: the `afterExecuteOperationAsync` taps run before Rush retains the result, and
+   * Rush retains a skipped result only for an enabled operation. `beforeIterationEnds` runs after the last result.
+   */
+  public async executeAsync(
+    results: ReadonlyArray<ITestResult>,
+    beforeIterationEnds?: () => void
+  ): Promise<void> {
+    const records: Map<Operation, IOperationExecutionResult> = new Map();
+    for (const { name, status, enabled = true } of results) {
+      const operation: Operation = this.getOperation(name);
+      const record: IOperationRunnerContext & IOperationExecutionResult = {
+        operation,
+        status,
+        enabled
+      } as IOperationRunnerContext & IOperationExecutionResult;
+      await this.hooks.afterExecuteOperationAsync.promise(record);
+      if (enabled || status !== OperationStatus.Skipped) {
+        this.resultByOperation.set(operation, record);
+      }
+      records.set(operation, record);
+    }
+    beforeIterationEnds?.();
+    await this.hooks.afterExecuteIterationAsync.promise(OperationStatus.Success, records, {});
+  }
+
+  public async reconcileAsync(inputsSnapshot: IInputsSnapshot, whileReconciling?: () => void): Promise<void> {
+    await this.fingerprints.walkWhileReconcilingAsync(async (): Promise<IReconciliation> => {
+      whileReconciling?.();
+      return { inputsSnapshot };
+    });
+  }
+
+  /**
+   * Configures an iteration in which Rush would skip every operation but the given ones, and returns the
+   * operations that are enabled.
+   */
+  public configure(
+    inputsSnapshot: IInputsSnapshot | undefined,
+    enabledByRush: ReadonlyArray<string> = []
+  ): string[] {
+    return this.#plan({ inputsSnapshot }, enabledByRush);
+  }
+
+  /**
+   * Plans the executing iteration again for another request's work, with the given operations started, and returns
+   * the operations that are enabled. Then the graph accepts the plan, or refuses it.
+   */
+  public extend(
+    inputsSnapshot: IInputsSnapshot,
+    startedNames: ReadonlyArray<string>,
+    accepted: boolean
+  ): string[] {
+    const context: IOperationGraphIterationOptions = {
+      inputsSnapshot,
+      startedOperations: new Set(startedNames.map((name: string) => this.getOperation(name)))
+    };
+    const enabledNames: string[] = this.#plan(context, []);
+    if (accepted) {
+      this.hooks.extendIteration.call(new Map(), context);
+    }
+    return enabledNames;
+  }
+
+  #plan(context: IOperationGraphIterationOptions, enabledByRush: ReadonlyArray<string>): string[] {
+    const states: Map<Operation, IConfigurableOperation> = new Map();
+    for (const [name, operation] of this.#operations) {
+      states.set(operation, { enabled: enabledByRush.includes(name) } as IConfigurableOperation);
+    }
+    this.hooks.configureIteration.call(states, this.resultByOperation, context);
+    return [...states]
+      .filter(([, { enabled }]: [Operation, IConfigurableOperation]) => enabled)
+      .map(([operation]: [Operation, IConfigurableOperation]) => operation.associatedProject.packageName);
+  }
+}
+
+describe(OperationOutputFingerprints.name, () => {
+  let root: string;
+  let digester: RecordingDigester;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-fingerprints-'));
+    digester = new RecordingDigester();
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  async function createGraphAsync(): Promise<TestGraph> {
+    const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4 }, digester);
+    await graph.runAsync('a', 'b', 'c');
+    expect(digester.takeCalls()).toEqual(['digest a', 'digest b', 'digest c']);
+    return graph;
+  }
+
+  describe('walks while the inputs are reconciled', () => {
+    it('uses the digests of that walk for an iteration with the same inputs snapshot', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const first: IInputsSnapshot = createInputsSnapshot();
+      // The walk ran before this change, so the check misses it, as the inputs snapshot can.
+      await graph.reconcileAsync(first, () => graph.addFile('b', 'lib/new.js'));
+      expect(graph.configure(first)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+
+      // The operation keeps its recorded fingerprint, so the next request finds the change.
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual(['b']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+    });
+
+    it.each<[string, IInputsSnapshot | undefined, IInputsSnapshot | undefined]>([
+      ['another inputs snapshot', createInputsSnapshot(), createInputsSnapshot()],
+      ['no inputs snapshot', createInputsSnapshot(), undefined],
+      ['no inputs snapshot from the reconciliation', undefined, undefined]
+    ])(
+      'walks again for an iteration with %s',
+      async (
+        description: string,
+        reconciled: IInputsSnapshot | undefined,
+        iteration: IInputsSnapshot | undefined
+      ) => {
+        const graph: TestGraph = await createGraphAsync();
+        await graph.reconcileAsync(reconciled as IInputsSnapshot, () => graph.addFile('b', 'lib/new.js'));
+        expect(graph.configure(iteration)).toEqual(['b']);
+        expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel', 'digest c,b,a']);
+      }
+    );
+
+    it('cancels the walk if the reconciliation fails', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      await expect(
+        graph.fingerprints.walkWhileReconcilingAsync(async (): Promise<IReconciliation> => {
+          throw new Error('The reconciliation failed');
+        })
+      ).rejects.toThrow('The reconciliation failed');
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel']);
+      expect(graph.configure(createInputsSnapshot())).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['digest c,b,a']);
+    });
+
+    it('cancels the walk of a reconciliation that a later one replaced', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const earlier: IDeferred<IReconciliation> = createDeferred();
+      const earlierReconciliation: Promise<IReconciliation> = graph.fingerprints.walkWhileReconcilingAsync(
+        () => earlier.promise
+      );
+      const later: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(later);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel', 'start c,b,a']);
+
+      earlier.resolve({ inputsSnapshot: createInputsSnapshot() });
+      await earlierReconciliation;
+      expect(graph.configure(later)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['finish']);
+    });
+
+    it('cancels the walk when the graph is closed, and starts none after that', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const reconciliation: IDeferred<IReconciliation> = createDeferred();
+      const reconciliationPromise: Promise<IReconciliation> = graph.fingerprints.walkWhileReconcilingAsync(
+        () => reconciliation.promise
+      );
+      graph.abortController.abort();
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel']);
+
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      reconciliation.resolve({ inputsSnapshot });
+      await reconciliationPromise;
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['digest c,b,a']);
+
+      await graph.reconcileAsync(createInputsSnapshot());
+      expect(digester.takeCalls()).toEqual([]);
+    });
+
+    it('walks the output folders that the last iteration walked, and others when they are checked', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, digester);
+      await graph.runAsync('a', 'b', 'c', 'd');
+      expect(digester.takeCalls()).toEqual(['digest a', 'digest b', 'digest c', 'digest d']);
+      const select = (...names: string[]): void => {
+        for (const name of ['a', 'b', 'c', 'd']) {
+          graph.getOperation(name).enabled = names.includes(name);
+        }
+      };
+
+      select('a', 'b', 'c');
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      expect(graph.configure(first)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,c,b,a', 'finish']);
+
+      select('a', 'd');
+      graph.addFile('d', 'lib/new.js');
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual(['d']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish', 'digest d']);
+
+      // The walk covers none of the checks.
+      select('b');
+      const third: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(third);
+      expect(graph.configure(third)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,a', 'cancel', 'digest b']);
+    });
+
+    it('walks only operations that keep a recorded fingerprint and a retained result', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      fs.rmSync(path.join(root, 'b', 'lib'), { recursive: true });
+      expect(
+        graph.fingerprints
+          .getOperationsWithChangedOutputs()
+          .map((operation: Operation) => operation.associatedProject.packageName)
+      ).toEqual(['b']);
+      graph.resultByOperation.set(graph.getOperation('c'), {
+        status: OperationStatus.Failure
+      } as IOperationExecutionResult);
+
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start a', 'finish']);
+    });
+
+    it('walks the output folders of operations that ran', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      // Rush runs c, so c is not checked.
+      expect(graph.configure(first, ['c'])).toEqual(['c']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+      await graph.runAsync('c');
+      expect(digester.takeCalls()).toEqual(['digest c']);
+
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+    });
+
+    it('does not use the digest of other output folders', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      graph.addFile('b', 'dist/bundle.js');
+      graph.getOperation('b').settings?.outputFolderNames?.push('dist');
+      graph.addFile('c', 'dist/bundle.js');
+      graph.getOperation('c').settings?.outputFolderNames?.splice(0, 1, 'dist');
+      expect(graph.configure(inputsSnapshot)).toEqual(['b', 'c']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish', 'digest c,b']);
+    });
+
+    it('does not start without a pool', async () => {
+      const serialDigester: OutputFolderDigester = new OutputFolderDigester({ threadCount: 0 });
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, serialDigester);
+      await graph.runAsync('a', 'b');
+      graph.addFile('a', 'lib/new.js');
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.configure(inputsSnapshot)).toEqual(['a']);
+    });
+
+    it('finds changes made before the reconciliation with a pool', async () => {
+      const poolDigester: OutputFolderDigester = new OutputFolderDigester({
+        threadCount: 2,
+        poolStartThresholdMs: -1
+      });
+      try {
+        const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, poolDigester);
+        await graph.runAsync('a', 'b', 'c', 'd');
+        expect(poolDigester.isParallel).toBe(true);
+
+        graph.addFile('b', 'lib/new.js');
+        graph.addFile('d', 'lib/nested/new.js');
+        const first: IInputsSnapshot = createInputsSnapshot();
+        await graph.reconcileAsync(first);
+        expect(graph.configure(first)).toEqual(['b', 'd']);
+
+        await graph.runAsync('b', 'd');
+        const second: IInputsSnapshot = createInputsSnapshot();
+        await graph.reconcileAsync(second);
+        expect(graph.configure(second)).toEqual([]);
+      } finally {
+        poolDigester.dispose();
+      }
+    });
+  });
+
+  describe('records the outputs of each operation when Rush reports its result', () => {
+    it('finds a change to an output folder that was made before the iteration ended', async () => {
+      const graph: TestGraph = new TestGraph(root, { c: 1, d: 2 }, digester);
+      await graph.executeAsync(
+        [
+          { name: 'd', status: OperationStatus.Success },
+          { name: 'c', status: OperationStatus.Success }
+        ],
+        () => graph.addFile('d', 'lib/race.js')
+      );
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['d']);
+      expect(digester.takeCalls()).toEqual(['digest d', 'digest c']);
+    });
+
+    it('finds an output file that was edited in place before the iteration ended', async () => {
+      const graph: TestGraph = new TestGraph(root, { c: 1, d: 2 }, digester);
+      await graph.executeAsync(
+        [
+          { name: 'd', status: OperationStatus.Success },
+          { name: 'c', status: OperationStatus.Success }
+        ],
+        () => fs.appendFileSync(path.join(root, 'd', 'lib', 'file-0.js'), ' edited')
+      );
+      // The output folder itself did not change.
+      expect(graph.fingerprints.getOperationsWithChangedOutputs()).toEqual([]);
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      expect(graph.configure(first)).toEqual(['d']);
+
+      await graph.runAsync('d');
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual([]);
+    });
+
+    it('records restored and up-to-date results, but not failed ones', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4 }, digester);
+      await graph.runAsync('a', 'b', 'c');
+      digester.takeCalls();
+      await graph.executeAsync(
+        [
+          { name: 'a', status: OperationStatus.FromCache },
+          { name: 'b', status: OperationStatus.Skipped },
+          { name: 'c', status: OperationStatus.Failure }
+        ],
+        () => {
+          for (const name of ['a', 'b', 'c']) {
+            graph.addFile(name, 'lib/race.js');
+          }
+        }
+      );
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['a', 'b']);
+      expect(digester.takeCalls()).toEqual(['digest a', 'digest b']);
+    });
+
+    it("records a result after Rush's own taps, which use stages up to 1, with the status that they leave", async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, digester);
+      // A tap of Rush can still change the status of a result, e.g. to one that the graph does not skip.
+      graph.hooks.afterExecuteOperationAsync.tap(
+        { name: 'LastRushTap', stage: 1 },
+        (record: IOperationRunnerContext & IOperationExecutionResult) => {
+          const name: string = record.operation.associatedProject.packageName;
+          digester.calls.push(`tap ${name}`);
+          if (name === 'a') {
+            record.status = OperationStatus.SuccessWithWarning;
+          }
+        }
+      );
+      await graph.runAsync('a', 'b');
+      expect(digester.takeCalls()).toEqual(['tap a', 'tap b', 'digest b']);
+    });
+
+    it('keeps the fingerprint of an operation that was skipped while it was disabled', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, digester);
+      await graph.runAsync('a', 'b');
+      digester.takeCalls();
+      await graph.executeAsync([{ name: 'b', status: OperationStatus.Skipped, enabled: false }]);
+      expect(digester.takeCalls()).toEqual([]);
+      fs.appendFileSync(path.join(root, 'b', 'lib', 'file-0.js'), ' edited');
+      expect(graph.configure(undefined)).toEqual(['b']);
+    });
+
+    it('records a retained result when the iteration ends if Rush did not report it', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1 }, digester);
+      const operation: Operation = graph.getOperation('a');
+      const record: IOperationExecutionResult = {
+        operation,
+        status: OperationStatus.Success,
+        enabled: true
+      } as IOperationExecutionResult;
+      graph.resultByOperation.set(operation, record);
+      await graph.hooks.afterExecuteIterationAsync.promise(
+        OperationStatus.Success,
+        new Map([[operation, record]]),
+        {}
+      );
+      expect(digester.takeCalls()).toEqual(['digest a']);
+      graph.addFile('a', 'lib/new.js');
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['a']);
+    });
+  });
+
+  describe('for an iteration that is executing', () => {
+    function createIterationRecords(
+      graph: TestGraph,
+      records: Record<string, Pick<IOperationExecutionResult, 'enabled' | 'status'>>
+    ): Map<Operation, IOperationExecutionResult> {
+      return new Map(
+        Object.entries(records).map(([name, record]) => [
+          graph.getOperation(name),
+          record as IOperationExecutionResult
+        ])
+      );
+    }
+
+    it('reports changed outputs of operations that it neither dispatched nor runs, and keeps their fingerprints', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 1, c: 1, d: 1, e: 1 }, digester);
+      await graph.runAsync('a', 'b', 'c', 'd', 'e');
+      for (const name of ['a', 'b', 'c', 'd', 'e']) {
+        graph.addFile(name, 'temp/package-deps_' + name + '_build.json');
+        fs.rmSync(path.join(root, name, 'lib'), { recursive: true });
+      }
+      const iterationRecords: Map<Operation, IOperationExecutionResult> = createIterationRecords(graph, {
+        // Skipped in the iteration, and not dispatched yet
+        a: { enabled: false, status: OperationStatus.Waiting },
+        b: { enabled: false, status: OperationStatus.Ready },
+        // Runs in the iteration
+        c: { enabled: true, status: OperationStatus.Waiting },
+        // Dispatched
+        d: { enabled: false, status: OperationStatus.Skipped }
+      });
+
+      expect(getNames(graph.fingerprints.peekOperationsWithChangedOutputs(iterationRecords))).toEqual([
+        'a',
+        'b',
+        'e'
+      ]);
+      expect(
+        ['a', 'b', 'c', 'd', 'e'].filter((name: string) => fs.existsSync(graph.getLegacySkipStatePath(name)))
+      ).toEqual(['c', 'd']);
+      expect(getNames(graph.fingerprints.peekOperationsWithChangedOutputs(new Map()))).toEqual([
+        'a',
+        'b',
+        'c',
+        'd',
+        'e'
+      ]);
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual([
+        'a',
+        'b',
+        'c',
+        'd',
+        'e'
+      ]);
+      expect(graph.fingerprints.getOperationsWithChangedOutputs()).toEqual([]);
+    });
+
+    it('reports only operations with a retained result, and keeps the fingerprints of the others', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      fs.rmSync(path.join(root, 'b', 'lib'), { recursive: true });
+      const failed: IOperationExecutionResult = {
+        status: OperationStatus.Failure
+      } as IOperationExecutionResult;
+      const original: IOperationExecutionResult = graph.resultByOperation.get(graph.getOperation('b'))!;
+      graph.resultByOperation.set(graph.getOperation('b'), failed);
+
+      expect(graph.fingerprints.peekOperationsWithChangedOutputs(new Map())).toEqual([]);
+
+      graph.resultByOperation.set(graph.getOperation('b'), original);
+      expect(getNames(graph.fingerprints.peekOperationsWithChangedOutputs(new Map()))).toEqual(['b']);
+    });
+
+    it('does not check the operations that it started when it is planned again', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+
+      graph.addFile('a', 'lib/new.js');
+      graph.addFile('c', 'lib/new.js');
+      expect(graph.extend(inputsSnapshot, ['a', 'b'], true)).toEqual(['c']);
+      expect(digester.takeCalls()).toEqual(['digest c']);
+
+      // The next reconciliation still walks the output folders that the first plan checked
+      const next: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(next);
+      expect(graph.configure(next)).toEqual(['a', 'c']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+    });
+
+    it('lets the next reconciliation walk the output folders that a plan walked only if the graph accepts the plan', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, digester);
+      await graph.runAsync('a', 'b', 'c', 'd');
+      expect(digester.takeCalls()).toEqual(['digest a', 'digest b', 'digest c', 'digest d']);
+      const select = (...names: string[]): void => {
+        for (const name of ['a', 'b', 'c', 'd']) {
+          graph.getOperation(name).enabled = names.includes(name);
+        }
+      };
+      select('a');
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      expect(graph.configure(first)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,c,b,a', 'finish']);
+
+      select('a', 'd');
+      expect(graph.extend(createInputsSnapshot(), ['a'], false)).toEqual([]);
+      // The graph accepts another plan
+      graph.hooks.extendIteration.call(new Map(), { startedOperations: new Set() });
+      expect(digester.takeCalls()).toEqual(['digest d']);
+      select('a');
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start a', 'finish']);
+
+      select('a', 'd');
+      expect(graph.extend(createInputsSnapshot(), ['a'], true)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['digest d']);
+      select('a');
+      const third: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(third);
+      expect(graph.configure(third)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,a', 'finish']);
+    });
+
+    it('leaves the walk of a reconciliation to the iteration that uses its inputs snapshot', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.extend(createInputsSnapshot(), ['a', 'b'], true)).toEqual([]);
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'digest c', 'finish']);
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts
new file mode 100644
index 00000000000..79a96f677b8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import type { IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+
+import { OperationOutputFingerprints } from '../OperationOutputFingerprints';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(60_000);
+
+async function buildToBAsync(fixture: IFixture, requestId: string): Promise<IDaemonPhasedRequestResult> {
+  const { terminal } = await runAsync(fixture, requestId, ['build', '--to', 'b']);
+  expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+  return (terminal as { payload: IDaemonPhasedRequestResult }).payload;
+}
+
+describe(OperationOutputFingerprints.name, () => {
+  const canRevokeReadAccess: boolean = process.platform !== 'win32' && process.getuid?.() !== 0;
+  (canRevokeReadAccess ? it : it.skip)(
+    're-runs a warm operation on every request while its declared outputs cannot be read',
+    async () => {
+      const fixture: IFixture = await createFixtureAsync();
+      const libPath: string = path.join(fixture.repoRoot, 'projects/a/lib');
+      const unreadablePath: string = path.join(libPath, 'unreadable');
+      try {
+        await buildToBAsync(fixture, 'initial');
+        expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+        const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+
+        // Adding the folder changes the output folder, so the reconciliation re-runs a.
+        fs.mkdirSync(unreadablePath);
+        fs.chmodSync(unreadablePath, 0);
+        expect(await buildToBAsync(fixture, 'added')).toMatchObject({ scheduled: true });
+        expect(runs(fixture).slice(2)).toEqual(['a:one:']);
+
+        // The output folder is unchanged from here on, so only the content check re-runs a.
+        const { ino, mtimeMs } = fs.statSync(libPath);
+        expect(await buildToBAsync(fixture, 'unreadable')).toMatchObject({ scheduled: true });
+        expect(runs(fixture).slice(3)).toEqual(['a:one:']);
+        fs.chmodSync(unreadablePath, 0o755);
+        expect(await buildToBAsync(fixture, 'readable')).toMatchObject({ scheduled: true });
+        expect(runs(fixture).slice(4)).toEqual(['a:one:']);
+        expect(fs.statSync(libPath)).toMatchObject({ ino, mtimeMs });
+
+        expect(await buildToBAsync(fixture, 'unchanged')).toMatchObject({ scheduled: false });
+        expect(runs(fixture)).toHaveLength(5);
+        expect(fixture.session.operationGraph).toBe(graph);
+      } finally {
+        if (fs.existsSync(unreadablePath)) fs.chmodSync(unreadablePath, 0o755);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigest.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigest.test.ts
new file mode 100644
index 00000000000..8e33bedd44b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigest.test.ts
@@ -0,0 +1,120 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { digestOutputFolders, type IOutputFolderDigest } from '../OutputFolderDigest';
+
+describe(digestOutputFolders.name, () => {
+  let projectFolder: string;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-folder-digest-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  function writeFile(relativePath: string, text: string): void {
+    fs.mkdirSync(path.dirname(path.join(projectFolder, relativePath)), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, relativePath), text);
+  }
+
+  function symlinkDirectory(targetPath: string, linkPath: string): void {
+    fs.symlinkSync(targetPath, linkPath, process.platform === 'win32' ? 'junction' : 'dir');
+  }
+
+  /** The line of an entry that is not a folder. */
+  function entryLine(relativePath: string): string {
+    const stats: fs.Stats = fs.lstatSync(path.join(projectFolder, relativePath));
+    const kind: string = stats.isSymbolicLink() ? 'link' : 'file';
+    return `${relativePath}\0${kind}\0${stats.size}\0${stats.mtimeMs}\0${stats.ino}\n`;
+  }
+
+  it('hashes one line per entry, in code unit order and depth first', () => {
+    writeFile('lib/a.js', 'a');
+    writeFile('lib/Z.js', 'upper case sorts first');
+    writeFile('lib/b/c.js', 'c');
+    fs.mkdirSync(path.join(projectFolder, 'lib/b/d'));
+    writeFile('lib/e.js', 'e, after a folder');
+    fs.symlinkSync('a.js', path.join(projectFolder, 'lib/f.link'));
+    writeFile('lib/g/h.js', 'h');
+    writeFile('lib/g/\u00fc.js', 'non-ASCII');
+    writeFile('lib.d.ts', 'a file named as an output folder');
+
+    const lines: string[] = [
+      `lib\0folder\0${fs.statSync(path.join(projectFolder, 'lib')).ino}\n`,
+      entryLine('lib/Z.js'),
+      entryLine('lib/a.js'),
+      'lib/b\0folder\n',
+      entryLine('lib/b/c.js'),
+      'lib/b/d\0folder\n',
+      entryLine('lib/e.js'),
+      entryLine('lib/f.link'),
+      'lib/g\0folder\n',
+      entryLine('lib/g/h.js'),
+      entryLine('lib/g/\u00fc.js'),
+      entryLine('lib.d.ts'),
+      'missing\0missing\n'
+    ];
+    expect(digestOutputFolders({ projectFolder, folderNames: ['lib', 'lib.d.ts', 'missing'] })).toEqual({
+      digest: createHash('sha1').update(lines.join('')).digest('hex'),
+      entryCount: 10
+    });
+  });
+
+  it('records links without following them', () => {
+    writeFile('lib/a.js', 'a');
+    fs.symlinkSync('does-not-exist', path.join(projectFolder, 'lib/dangling'));
+    const lines: string[] = [
+      `lib\0folder\0${fs.statSync(path.join(projectFolder, 'lib')).ino}\n`,
+      entryLine('lib/a.js'),
+      entryLine('lib/dangling')
+    ];
+    expect(lines[2]).toMatch(/^lib\/dangling\0link\0/);
+    expect(digestOutputFolders({ projectFolder, folderNames: ['lib'] })).toEqual({
+      digest: createHash('sha1').update(lines.join('')).digest('hex'),
+      entryCount: 2
+    });
+  });
+
+  it('follows a declared output folder link', () => {
+    writeFile('real-lib/a.js', 'a');
+    symlinkDirectory(path.join(projectFolder, 'real-lib'), path.join(projectFolder, 'lib'));
+    const lines: string[] = [
+      `lib\0folder\0${fs.statSync(path.join(projectFolder, 'lib')).ino}\n`,
+      entryLine('lib/a.js')
+    ];
+    const before: IOutputFolderDigest = digestOutputFolders({ projectFolder, folderNames: ['lib'] });
+
+    expect(before).toEqual({
+      digest: createHash('sha1').update(lines.join('')).digest('hex'),
+      entryCount: 1
+    });
+
+    fs.rmSync(path.join(projectFolder, 'real-lib/a.js'));
+    expect(digestOutputFolders({ projectFolder, folderNames: ['lib'] }).digest).not.toBe(before.digest);
+  });
+
+  (process.platform === 'win32' || os.userInfo().uid === 0 ? it.skip : it)(
+    'has no digest if a folder cannot be read',
+    () => {
+      writeFile('lib/a.js', 'a');
+      const unreadable: string = path.join(projectFolder, 'lib/unreadable');
+      fs.mkdirSync(unreadable);
+      fs.chmodSync(unreadable, 0);
+      try {
+        expect(digestOutputFolders({ projectFolder, folderNames: ['lib'] })).toEqual({
+          digest: undefined,
+          entryCount: 2
+        });
+      } finally {
+        fs.chmodSync(unreadable, 0o755);
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts
new file mode 100644
index 00000000000..36e25ebab9e
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+
+/** A whole second, so the modification time that a test sets reads back exactly. */
+const MODIFIED_TIME: Date = new Date('2026-01-01T00:00:00.000Z');
+
+describe(digestOutputFolders.name, () => {
+  let projectFolder: string;
+  let nestedFolder: string;
+  let filePath: string;
+  let folderSet: IOutputFolderSet;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-entries-'));
+    nestedFolder = path.join(projectFolder, 'lib', 'nested');
+    filePath = path.join(nestedFolder, 'output.js');
+    fs.mkdirSync(nestedFolder, { recursive: true });
+    fs.writeFileSync(filePath, 'one');
+    fs.utimesSync(filePath, MODIFIED_TIME, MODIFIED_TIME);
+    folderSet = { projectFolder, folderNames: ['lib'] };
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  it('changes when only the size of a nested file changes', () => {
+    const { ino, mtimeMs } = fs.statSync(filePath);
+    const before: string | undefined = digestOutputFolders(folderSet).digest;
+    fs.appendFileSync(filePath, ' more');
+    fs.utimesSync(filePath, MODIFIED_TIME, MODIFIED_TIME);
+    expect(fs.statSync(filePath)).toMatchObject({ ino, mtimeMs });
+    expect(digestOutputFolders(folderSet).digest).not.toBe(before);
+  });
+
+  it('changes when a nested file is replaced by one with the same size and modification time', () => {
+    // Outside the output folder, so the listing is the same before and after the rename.
+    const replacementPath: string = path.join(projectFolder, 'replacement.js');
+    fs.writeFileSync(replacementPath, 'one');
+    fs.utimesSync(replacementPath, MODIFIED_TIME, MODIFIED_TIME);
+    const { ino, size, mtimeMs } = fs.statSync(filePath);
+    const before: string | undefined = digestOutputFolders(folderSet).digest;
+    fs.renameSync(replacementPath, filePath);
+    const replaced: fs.Stats = fs.statSync(filePath);
+    expect(replaced).toMatchObject({ size, mtimeMs });
+    expect(replaced.ino).not.toBe(ino);
+    expect(digestOutputFolders(folderSet).digest).not.toBe(before);
+  });
+
+  const canRevokeReadAccess: boolean = process.platform !== 'win32' && process.getuid?.() !== 0;
+  (canRevokeReadAccess ? it : it.skip)('has no digest while a nested folder cannot be read', () => {
+    const readable: IOutputFolderDigest = digestOutputFolders(folderSet);
+    expect(readable.digest).toEqual(expect.any(String));
+    fs.chmodSync(nestedFolder, 0);
+    try {
+      expect(digestOutputFolders(folderSet).digest).toBeUndefined();
+    } finally {
+      fs.chmodSync(nestedFolder, 0o755);
+    }
+    expect(digestOutputFolders(folderSet)).toEqual(readable);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
new file mode 100644
index 00000000000..c579135d158
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
@@ -0,0 +1,511 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import {
+  OutputFolderDigestPool,
+  OutputFolderDigester,
+  WORKER_MAX_YOUNG_GENERATION_SIZE_MB,
+  type IBackgroundOutputFolderDigests
+} from '../OutputFolderDigestPool';
+
+const PROJECT_COUNT: number = 12;
+
+function createProjects(root: string): IOutputFolderSet[] {
+  const folderSets: IOutputFolderSet[] = [];
+  for (let projectIndex: number = 0; projectIndex < PROJECT_COUNT; projectIndex++) {
+    const projectFolder: string = path.join(root, `project-${projectIndex}`);
+    for (let fileIndex: number = 0; fileIndex <= projectIndex; fileIndex++) {
+      const folderPath: string = path.join(projectFolder, 'lib', `folder-${fileIndex % 3}`, 'nested');
+      fs.mkdirSync(folderPath, { recursive: true });
+      fs.writeFileSync(path.join(folderPath, `file-${fileIndex}.js`), `// ${projectIndex}:${fileIndex}\n`);
+    }
+    fs.mkdirSync(path.join(projectFolder, 'dist'), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'bundle.js'), 'bundle\n');
+    fs.symlinkSync('bundle.js', path.join(projectFolder, 'dist', 'link.js'));
+    fs.writeFileSync(path.join(projectFolder, 'lib.d.ts'), 'export {};\n');
+    folderSets.push({ projectFolder, folderNames: ['lib', 'dist', 'lib.d.ts', 'missing'] });
+  }
+  return folderSets;
+}
+
+function digestOnCallingThread(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+  return folderSets.map((folderSet: IOutputFolderSet) => digestOutputFolders(folderSet));
+}
+
+interface ITestWorkerOptions {
+  /** How long the worker waits before it claims the folder sets of a job. */
+  readonly claimDelayMs?: number;
+  /** Written once the worker has claimed every folder set of a job. */
+  readonly claimedMarkerPath?: string;
+  /** How long the worker waits after it claimed the folder sets of a job, before it digests them. */
+  readonly digestDelayMs?: number;
+  /** Whether the worker publishes digests at all. */
+  readonly publish?: boolean;
+}
+
+/** Writes a worker script that claims every folder set of a job at once, and digests them afterwards. */
+function writeTestWorker(
+  scriptPath: string,
+  { claimDelayMs = 0, claimedMarkerPath, digestDelayMs = 0, publish = true }: ITestWorkerOptions
+): string {
+  fs.writeFileSync(
+    scriptPath,
+    [
+      "const fs = require('node:fs');",
+      "const { parentPort, workerData } = require('node:worker_threads');",
+      `const { digestOutputFolders } = require(${JSON.stringify(require.resolve('../OutputFolderDigest'))});`,
+      'const delay = new Int32Array(new SharedArrayBuffer(4));',
+      'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+      `  Atomics.wait(delay, 0, 0, ${claimDelayMs});`,
+      '  const claimed = [];',
+      '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+      '    claimed.push(index);',
+      '  }',
+      claimedMarkerPath ? `  fs.writeFileSync(${JSON.stringify(claimedMarkerPath)}, '');` : '',
+      `  Atomics.wait(delay, 0, 0, ${digestDelayMs});`,
+      publish ? '' : '  return;',
+      '  for (const index of claimed) {',
+      '    workerData.resultPort.postMessage([jobId, index, digestOutputFolders(folderSets[index])]);',
+      '  }',
+      '  Atomics.add(state, 1, claimed.length);',
+      '  Atomics.notify(state, 1);',
+      '});'
+    ].join('\n')
+  );
+  return scriptPath;
+}
+
+function waitForFile(filePath: string): void {
+  const sleep: Int32Array = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  const deadlineMs: number = performance.now() + 10000;
+  while (!fs.existsSync(filePath)) {
+    if (performance.now() > deadlineMs) {
+      throw new Error(`${filePath} was not written`);
+    }
+    Atomics.wait(sleep, 0, 0, 10);
+  }
+}
+
+function withoutDigests(count: number): undefined[] {
+  return new Array(count).fill(undefined);
+}
+
+describe(OutputFolderDigestPool.name, () => {
+  let root: string;
+  let folderSets: IOutputFolderSet[];
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-digest-'));
+    folderSets = createProjects(root);
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('returns the digests of the calling thread when only workers claim folder sets', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 3,
+      claimOnCallingThread: false
+    });
+    try {
+      const expected: IOutputFolderDigest[] = digestOnCallingThread(folderSets);
+      expect(new Set(expected.map(({ digest }: IOutputFolderDigest) => digest)).size).toBe(PROJECT_COUNT);
+      expect(expected[PROJECT_COUNT - 1].entryCount).toBeGreaterThan(expected[0].entryCount);
+      expect(pool.digest(folderSets)).toEqual(expected);
+
+      // Same size and identity, later modification time, nested three levels down.
+      const editedFile: string = path.join(folderSets[5].projectFolder, 'lib', 'folder-2', 'nested', 'file-2.js');
+      const { size, ino, mtimeMs } = fs.statSync(editedFile);
+      fs.writeFileSync(editedFile, '// 5:X\n');
+      fs.utimesSync(editedFile, new Date(), new Date(mtimeMs + 5000));
+      expect(fs.statSync(editedFile)).toMatchObject({ size, ino });
+
+      const edited: IOutputFolderDigest[] = pool.digest(folderSets);
+      expect(edited).toEqual(digestOnCallingThread(folderSets));
+      expect(
+        edited.flatMap(({ digest }: IOutputFolderDigest, index: number) =>
+          digest === expected[index].digest ? [] : [index]
+        )
+      ).toEqual([5]);
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('shares folder sets between the calling thread and the workers', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({ threadCount: 2 });
+    try {
+      for (let attempt: number = 0; attempt < 3; attempt++) {
+        expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      }
+      expect(pool.digest([])).toEqual([]);
+      expect(pool.digest(folderSets.slice(0, 1))).toEqual(digestOnCallingThread(folderSets.slice(0, 1)));
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it("uses the results that workers publish for the caller's job only", () => {
+    // Publishes marked digests late, then digests with the same indexes for an earlier job.
+    const markingWorkerPath: string = path.join(root, 'marking-worker.js');
+    fs.writeFileSync(
+      markingWorkerPath,
+      [
+        "const { parentPort, workerData } = require('node:worker_threads');",
+        `const { digestOutputFolders } = require(${JSON.stringify(require.resolve('../OutputFolderDigest'))});`,
+        'const delay = new Int32Array(new SharedArrayBuffer(4));',
+        'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+        '  Atomics.wait(delay, 0, 0, 100);',
+        '  const claimed = [];',
+        '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+        '    const { digest, entryCount } = digestOutputFolders(folderSets[index]);',
+        '    workerData.resultPort.postMessage([jobId, index, { digest: `worker:${digest}`, entryCount }]);',
+        '    claimed.push(index);',
+        '  }',
+        '  for (const index of claimed) {',
+        "    workerData.resultPort.postMessage([jobId - 1, index, { digest: 'earlier job', entryCount: 0 }]);",
+        '  }',
+        '  Atomics.add(state, 1, claimed.length);',
+        '  Atomics.notify(state, 1);',
+        '});'
+      ].join('\n')
+    );
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 2,
+      workerScriptPath: markingWorkerPath,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(
+        digestOnCallingThread(folderSets).map(({ digest, entryCount }: IOutputFolderDigest) => ({
+          digest: `worker:${digest}`,
+          entryCount
+        }))
+      );
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('digests folder sets that stalled workers claimed on the calling thread', () => {
+    // Claims every folder set and never publishes a result.
+    const stalledWorkerPath: string = path.join(root, 'stalled-worker.js');
+    fs.writeFileSync(
+      stalledWorkerPath,
+      [
+        "const { parentPort } = require('node:worker_threads');",
+        'parentPort.on("message", ({ folderSets, state }) => {',
+        '  while (Atomics.add(state, 0, 1) < folderSets.length) {}',
+        '});'
+      ].join('\n')
+    );
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 1,
+      workerScriptPath: stalledWorkerPath,
+      stallTimeoutMs: 200,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(pool.stalled).toBe(true);
+      // Later digests don't wait for the workers again.
+      const startTimeMs: number = performance.now();
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(performance.now() - startTimeMs).toBeLessThan(200);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  describe('start', () => {
+    it('digests folder sets on the workers while the caller runs other jobs', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 2,
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        // Each worker serves jobs in order, so this job ends only after every earlier folder set was claimed,
+        // and it reads the digests that the workers published for the earlier job too.
+        expect(pool.digest(folderSets.slice(0, 2))).toEqual(digestOnCallingThread(folderSets.slice(0, 2)));
+        const digests: ReadonlyArray<IOutputFolderDigest | undefined> = background.finish();
+        expect(digests).toEqual(digestOnCallingThread(folderSets));
+        expect(background.finish()).toBe(digests);
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('has no digests for folder sets that no worker claimed', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'late-worker.js'), { claimDelayMs: 2000 }),
+        claimOnCallingThread: false
+      });
+      try {
+        const startTimeMs: number = performance.now();
+        expect([...pool.start(folderSets).finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(performance.now() - startTimeMs).toBeLessThan(1000);
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('waits for the folder sets that workers claimed', () => {
+      const claimedMarkerPath: string = path.join(root, 'claimed');
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'slow-worker.js'), {
+          claimedMarkerPath,
+          digestDelayMs: 300
+        }),
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        waitForFile(claimedMarkerPath);
+        expect(background.finish()).toEqual(digestOnCallingThread(folderSets));
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('drops the digests of a cancelled job', () => {
+      const claimedMarkerPath: string = path.join(root, 'claimed');
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'slow-worker.js'), {
+          claimedMarkerPath,
+          digestDelayMs: 1000
+        }),
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        waitForFile(claimedMarkerPath);
+        background.cancel();
+        const startTimeMs: number = performance.now();
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(performance.now() - startTimeMs).toBeLessThan(500);
+
+        // The worker publishes the cancelled digests before it serves this job, which reads and drops them.
+        expect(pool.digest(folderSets.slice(0, 2))).toEqual(digestOnCallingThread(folderSets.slice(0, 2)));
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('stops the pool if the workers stall', () => {
+      const claimedMarkerPath: string = path.join(root, 'claimed');
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'stalled-worker.js'), {
+          claimedMarkerPath,
+          publish: false
+        }),
+        stallTimeoutMs: 200,
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        waitForFile(claimedMarkerPath);
+        const dispose: jest.SpyInstance = jest.spyOn(pool, 'dispose');
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(pool.stalled).toBe(true);
+        expect(dispose).toHaveBeenCalled();
+
+        const startTimeMs: number = performance.now();
+        expect([...pool.start(folderSets).finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+        expect(performance.now() - startTimeMs).toBeLessThan(200);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('does not wait for a job that started before the pool stalled', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'stalled-worker.js'), { publish: false }),
+        stallTimeoutMs: 200,
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        // The worker claims the folder sets of both jobs and publishes nothing.
+        expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+        expect(pool.stalled).toBe(true);
+        const startTimeMs: number = performance.now();
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(performance.now() - startTimeMs).toBeLessThan(100);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('has nothing to digest without folder sets or after the pool was disposed', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({ threadCount: 1 });
+      try {
+        expect(pool.start([]).finish()).toEqual([]);
+      } finally {
+        pool.dispose();
+      }
+      const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+      expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+      background.cancel();
+    });
+  });
+
+  it('limits the young generation of each worker', () => {
+    // Publishes the worker's own young generation limit as the digest of every folder set it claims.
+    const limitsWorkerPath: string = path.join(root, 'limits-worker.js');
+    fs.writeFileSync(
+      limitsWorkerPath,
+      [
+        "const { parentPort, resourceLimits, workerData } = require('node:worker_threads');",
+        'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+        '  let count = 0;',
+        '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+        '    const digest = `young:${resourceLimits.maxYoungGenerationSizeMb}`;',
+        '    workerData.resultPort.postMessage([jobId, index, { digest, entryCount: 0 }]);',
+        '    count++;',
+        '  }',
+        '  Atomics.add(state, 1, count);',
+        '  Atomics.notify(state, 1);',
+        '});'
+      ].join('\n')
+    );
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 2,
+      workerScriptPath: limitsWorkerPath,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(new Set(pool.digest(folderSets).map(({ digest }: IOutputFolderDigest) => digest))).toEqual(
+        new Set([`young:${WORKER_MAX_YOUNG_GENERATION_SIZE_MB}`])
+      );
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+});
+
+describe(OutputFolderDigester.name, () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-digester-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('starts a pool only after a digest on the calling thread takes longer than the threshold', () => {
+    const folderSets: IOutputFolderSet[] = createProjects(root);
+    const serial: OutputFolderDigester = new OutputFolderDigester({ threadCount: 2 });
+    expect(serial.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    expect(serial.isParallel).toBe(false);
+
+    const parallel: OutputFolderDigester = new OutputFolderDigester({ threadCount: 2, poolStartThresholdMs: -1 });
+    try {
+      expect(parallel.digest(folderSets.slice(0, 1))).toEqual(digestOnCallingThread(folderSets.slice(0, 1)));
+      expect(parallel.isParallel).toBe(false);
+      expect(parallel.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(parallel.isParallel).toBe(true);
+      expect(parallel.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    } finally {
+      parallel.dispose();
+    }
+    expect(parallel.isParallel).toBe(false);
+    expect(parallel.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+
+    const disabled: OutputFolderDigester = new OutputFolderDigester({ threadCount: 0, poolStartThresholdMs: -1 });
+    expect(disabled.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    expect(disabled.isParallel).toBe(false);
+  });
+
+  it('starts a pool after digests of several folder sets that a caller made one at a time took longer together', () => {
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: 2,
+      poolStartThresholdMs: 50
+    });
+    try {
+      digester.recordCallingThreadDigests(1, 51);
+      expect(digester.isParallel).toBe(false);
+      digester.recordCallingThreadDigests(2, 50);
+      expect(digester.isParallel).toBe(false);
+      digester.recordCallingThreadDigests(2, 51);
+      expect(digester.isParallel).toBe(true);
+    } finally {
+      digester.dispose();
+    }
+
+    const disabled: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: 0,
+      poolStartThresholdMs: -1
+    });
+    disabled.recordCallingThreadDigests(2, 51);
+    expect(disabled.isParallel).toBe(false);
+  });
+
+  it('starts background digests only while its pool runs', () => {
+    const folderSets: IOutputFolderSet[] = createProjects(root);
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: 2,
+      poolStartThresholdMs: -1
+    });
+    try {
+      expect(digester.start(folderSets)).toBeUndefined();
+      digester.digest(folderSets);
+      expect(digester.isParallel).toBe(true);
+      const background: IBackgroundOutputFolderDigests | undefined = digester.start(folderSets);
+      expect(background).toBeDefined();
+      const expected: IOutputFolderDigest[] = digestOnCallingThread(folderSets);
+      // Folder sets that no worker claimed yet have no digest.
+      (background?.finish() ?? []).forEach((digest: IOutputFolderDigest | undefined, index: number) => {
+        expect(digest).toEqual(digest && expected[index]);
+      });
+    } finally {
+      digester.dispose();
+    }
+    expect(digester.start(folderSets)).toBeUndefined();
+  });
+
+  it('does not keep the process alive', () => {
+    const folderSets: IOutputFolderSet[] = createProjects(root);
+    const script: string = [
+      `const { OutputFolderDigester } = require(${JSON.stringify(require.resolve('../OutputFolderDigestPool'))});`,
+      'const folderSets = JSON.parse(process.argv[1]);',
+      'const digester = new OutputFolderDigester({ threadCount: 2, poolStartThresholdMs: -1 });',
+      'digester.digest(folderSets);',
+      'const digests = digester.digest(folderSets);',
+      'process.stdout.write(JSON.stringify({ isParallel: digester.isParallel, digests }));'
+    ].join('\n');
+    const result: SpawnSyncReturns<string> = spawnSync(
+      process.execPath,
+      ['-e', script, JSON.stringify(folderSets)],
+      { encoding: 'utf8', timeout: 10000 }
+    );
+    expect(result).toMatchObject({ status: 0, signal: null, stderr: '' });
+    expect(JSON.parse(result.stdout)).toEqual({
+      isParallel: true,
+      digests: digestOnCallingThread(folderSets)
+    });
+  }, 20000);
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
new file mode 100644
index 00000000000..dc377ccb247
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
@@ -0,0 +1,297 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('node:worker_threads', () => {
+  const actual: typeof import('node:worker_threads') = jest.requireActual('node:worker_threads');
+  return {
+    ...actual,
+    Worker: jest.fn((...args: ConstructorParameters<typeof actual.Worker>) => new actual.Worker(...args))
+  };
+});
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { Worker } from 'node:worker_threads';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import {
+  OutputFolderDigestPool,
+  OutputFolderDigester,
+  type IBackgroundOutputFolderDigests
+} from '../OutputFolderDigestPool';
+
+const THREAD_COUNT: number = 2;
+const IDLE_TIMEOUT_MS: number = 1000;
+// The pool's own default, pinned here rather than imported so that a change to it fails a test.
+const DEFAULT_IDLE_TIMEOUT_MS: number = 30_000;
+
+const actualWorkerThreads: typeof import('node:worker_threads') = jest.requireActual('node:worker_threads');
+const workerMock: jest.MockInstance<Worker, ConstructorParameters<typeof Worker>> = jest.mocked(Worker);
+
+function digestOnCallingThread(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+  return folderSets.map((folderSet: IOutputFolderSet) => digestOutputFolders(folderSet));
+}
+
+function waitForFile(filePath: string): void {
+  const sleep: Int32Array = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  const deadlineMs: number = performance.now() + 10000;
+  while (!fs.existsSync(filePath)) {
+    if (performance.now() > deadlineMs) {
+      throw new Error(`${filePath} was not written`);
+    }
+    Atomics.wait(sleep, 0, 0, 10);
+  }
+}
+
+/**
+ * Writes a worker script that waits for the file `claim` before it claims every folder set of a job, then writes
+ * `claimed`, waits for `publish` before it publishes their digests, and writes `published` after it counted them.
+ */
+function writeGatedWorker(root: string): string {
+  const scriptPath: string = path.join(root, 'gated-worker.js');
+  fs.writeFileSync(
+    scriptPath,
+    [
+      "const fs = require('node:fs');",
+      "const path = require('node:path');",
+      "const { parentPort, workerData } = require('node:worker_threads');",
+      `const { digestOutputFolders } = require(${JSON.stringify(require.resolve('../OutputFolderDigest'))});`,
+      `const root = ${JSON.stringify(root)};`,
+      'const sleep = new Int32Array(new SharedArrayBuffer(4));',
+      'const waitFor = (name) => {',
+      '  while (!fs.existsSync(path.join(root, name))) Atomics.wait(sleep, 0, 0, 5);',
+      '};',
+      'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+      "  waitFor('claim');",
+      '  const claimed = [];',
+      '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+      '    claimed.push(index);',
+      '  }',
+      "  fs.writeFileSync(path.join(root, 'claimed'), '');",
+      "  waitFor('publish');",
+      '  for (const index of claimed) {',
+      '    workerData.resultPort.postMessage([jobId, index, digestOutputFolders(folderSets[index])]);',
+      '  }',
+      '  Atomics.add(state, 1, claimed.length);',
+      '  Atomics.notify(state, 1);',
+      "  fs.writeFileSync(path.join(root, 'published'), '');",
+      '});'
+    ].join('\n')
+  );
+  return scriptPath;
+}
+
+let root: string;
+let folderSets: IOutputFolderSet[];
+let terminate: jest.SpyInstance<Promise<number>, []>;
+
+beforeEach(() => {
+  root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-idle-'));
+  folderSets = ['a', 'b', 'c'].map((name: string) => {
+    const projectFolder: string = path.join(root, name);
+    fs.mkdirSync(path.join(projectFolder, 'lib'), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, 'lib', 'output.js'), name);
+    return { projectFolder, folderNames: ['lib'] };
+  });
+  terminate = jest.spyOn(actualWorkerThreads.Worker.prototype, 'terminate');
+  jest.useFakeTimers({ doNotFake: ['nextTick', 'performance', 'setImmediate'] });
+});
+
+afterEach(() => {
+  jest.useRealTimers();
+  terminate.mockRestore();
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+describe(OutputFolderDigestPool.name, () => {
+  it('stops its workers once no job was posted for the idle timeout, and starts new ones for the next job', async () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      const expected: IOutputFolderDigest[] = digestOnCallingThread(folderSets);
+      for (let request: number = 0; request < 3; request++) {
+        jest.advanceTimersByTime(IDLE_TIMEOUT_MS - 1);
+        expect(pool.digest(folderSets)).toEqual(expected);
+      }
+      expect(terminate).not.toHaveBeenCalled();
+
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+      const idleWorkers: Worker[] = [...terminate.mock.contexts];
+      await Promise.all(terminate.mock.results.map(({ value }: jest.MockResult<Promise<number>>) => value));
+      expect(idleWorkers.map(({ threadId }: Worker) => threadId)).toEqual([-1, -1]);
+      expect(pool.stalled).toBe(false);
+
+      // The calling thread claims no folder sets, so new workers digest this job.
+      expect(pool.digest(folderSets)).toEqual(expected);
+      expect(pool.stalled).toBe(false);
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+    } finally {
+      pool.dispose();
+    }
+    expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+  });
+
+  it('keeps workers that have folder sets of a started job to claim or publish, and the digests they published', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 1,
+      workerScriptPath: writeGatedWorker(root),
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).not.toHaveBeenCalled();
+
+      fs.writeFileSync(path.join(root, 'claim'), '');
+      waitForFile(path.join(root, 'claimed'));
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).not.toHaveBeenCalled();
+
+      fs.writeFileSync(path.join(root, 'publish'), '');
+      waitForFile(path.join(root, 'published'));
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(1);
+
+      expect(background.finish()).toEqual(digestOnCallingThread(folderSets));
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('does not keep workers for a cancelled job', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 1,
+      workerScriptPath: writeGatedWorker(root),
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+      background.cancel();
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(1);
+      expect([...background.finish()]).toEqual([undefined, undefined, undefined]);
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('stops the pool if new workers cannot start', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+
+      workerMock
+        .mockImplementationOnce(
+          (...args: ConstructorParameters<typeof Worker>) => new actualWorkerThreads.Worker(...args)
+        )
+        .mockImplementationOnce(() => {
+          throw new Error('No more threads');
+        });
+      expect([...pool.start(folderSets).finish()]).toEqual([undefined, undefined, undefined]);
+      expect(pool.stalled).toBe(true);
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+      // The worker that did start stopped with the pool.
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT + 1);
+
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('stops its workers 30 s after the last job when no idle timeout is given', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      jest.advanceTimersByTime(DEFAULT_IDLE_TIMEOUT_MS - 1);
+      expect(terminate).not.toHaveBeenCalled();
+
+      jest.advanceTimersByTime(1);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('clears its idle timer when disposed', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(jest.getTimerCount()).toBe(1);
+    } finally {
+      pool.dispose();
+    }
+    // A pending timer would keep the disposed pool reachable until it fires.
+    expect(jest.getTimerCount()).toBe(0);
+    expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+  });
+});
+
+describe(OutputFolderDigester.name, () => {
+  it("passes the idle timeout to its pool, which stays parallel after the pool's workers stop", () => {
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: THREAD_COUNT,
+      poolStartThresholdMs: -1,
+      idleTimeoutMs: IDLE_TIMEOUT_MS
+    });
+    try {
+      digester.recordCallingThreadDigests(2, 0);
+      expect(digester.isParallel).toBe(true);
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+      expect(digester.isParallel).toBe(true);
+
+      const background: IBackgroundOutputFolderDigests | undefined = digester.start(folderSets);
+      expect(background).toBeDefined();
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+      background?.cancel();
+      expect(digester.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    } finally {
+      digester.dispose();
+    }
+    expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+  });
+
+  // getSharedOutputFolderDigester() passes no options, so this is the idle timeout that the daemon runs with.
+  it("leaves the idle timeout to its pool when none is given, so the pool's workers stop after 30 s", () => {
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: THREAD_COUNT,
+      poolStartThresholdMs: -1
+    });
+    try {
+      digester.recordCallingThreadDigests(2, 0);
+      expect(digester.isParallel).toBe(true);
+      jest.advanceTimersByTime(DEFAULT_IDLE_TIMEOUT_MS - 1);
+      expect(terminate).not.toHaveBeenCalled();
+
+      jest.advanceTimersByTime(1);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+    } finally {
+      digester.dispose();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts
new file mode 100644
index 00000000000..a67d947d237
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts
@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { Worker } from 'node:worker_threads';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import { OutputFolderDigestPool } from '../OutputFolderDigestPool';
+
+const THREAD_COUNT: number = 2;
+
+describe(OutputFolderDigestPool.name, () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-stall-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('stops its workers when they stall', async () => {
+    const folderSets: IOutputFolderSet[] = ['a', 'b', 'c'].map((name: string) => {
+      const projectFolder: string = path.join(root, name);
+      fs.mkdirSync(path.join(projectFolder, 'lib'), { recursive: true });
+      fs.writeFileSync(path.join(projectFolder, 'lib', 'output.js'), name);
+      return { projectFolder, folderNames: ['lib'] };
+    });
+    // Claims every folder set and never publishes a result.
+    const stalledWorkerPath: string = path.join(root, 'stalled-worker.js');
+    fs.writeFileSync(
+      stalledWorkerPath,
+      [
+        "const { parentPort } = require('node:worker_threads');",
+        'parentPort.on("message", ({ folderSets, state }) => {',
+        '  while (Atomics.add(state, 0, 1) < folderSets.length) {}',
+        '});'
+      ].join('\n')
+    );
+    const terminate: jest.SpyInstance<Promise<number>, []> = jest.spyOn(Worker.prototype, 'terminate');
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      workerScriptPath: stalledWorkerPath,
+      stallTimeoutMs: 200,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(
+        folderSets.map((folderSet: IOutputFolderSet): IOutputFolderDigest => digestOutputFolders(folderSet))
+      );
+      expect(pool.stalled).toBe(true);
+      // The digest itself stopped each worker once, and each worker's thread exits.
+      const stoppedWorkers: Worker[] = terminate.mock.contexts;
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+      expect(new Set(stoppedWorkers).size).toBe(THREAD_COUNT);
+      await Promise.all(terminate.mock.results.map(({ value }: jest.MockResult<Promise<number>>) => value));
+      expect(stoppedWorkers.map(({ threadId }: Worker) => threadId)).toEqual([-1, -1]);
+    } finally {
+      pool.dispose();
+      terminate.mockRestore();
+    }
+  }, 20_000);
+});
diff --git a/libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts b/libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts
new file mode 100644
index 00000000000..eb601224167
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts
@@ -0,0 +1,208 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import {
+  CobuildConfiguration,
+  PhasedCommandEngine,
+  ProjectChangeAnalyzer,
+  type GetInputsSnapshotAsyncFn,
+  type IPhasedCommandEngine
+} from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+
+const STEP_PREFIX: string = 'rush:phasedScriptAction:';
+
+/** The steps that the native preparation measures for the fixture's `build`, in their order. */
+const STEPS: ReadonlyArray<string> = [
+  'checkInstallFlag',
+  'doBeforeTask',
+  'applyStandardPlugins',
+  'configureBuildCache',
+  'getSelectedProjects',
+  'applySituationalPlugins',
+  'loadProjectConfigurations',
+  'createOperations',
+  'analyzeRepoState',
+  'executionManager'
+];
+
+/**
+ * Each step after which the preparation checks its signal, with the number of times that the cobuild configuration
+ * is cleaned up once the signal aborts as the step ends. The build cache step loads that configuration.
+ */
+const CHECKED_STEPS: ReadonlyArray<[string, number]> = [
+  ['checkInstallFlag', 0],
+  ['applyStandardPlugins', 0],
+  ['configureBuildCache', 1],
+  ['applySituationalPlugins', 1],
+  ['loadProjectConfigurations', 1],
+  ['createOperations', 1],
+  ['analyzeRepoState', 1],
+  ['executionManager', 1]
+];
+
+interface IPreparation {
+  readonly command: PhasedCommandEngine;
+  readonly controller: AbortController;
+  readonly reason: Error;
+  /** The folder of the repository lock. */
+  readonly lockFolder: string;
+  /** The steps measured so far. */
+  readonly steps: string[];
+  readonly destroyLockProvider: jest.Mock<Promise<void>, []>;
+}
+
+/** Parses `build`, recording each step and aborting the preparation's signal as `abortAfter` ends. */
+async function parseAsync(fixture: DaemonGraphTestFixture, abortAfter?: string): Promise<IPreparation> {
+  const configuration = fixture.session.rushConfiguration;
+  const controller: AbortController = new AbortController();
+  const reason: Error = new Error('The background preparation was cancelled.');
+  const steps: string[] = [];
+  const measure: typeof performance.measure = performance.measure;
+  jest.spyOn(performance, 'measure').mockImplementation(function (
+    this: typeof performance,
+    ...args: Parameters<typeof performance.measure>
+  ): ReturnType<typeof performance.measure> {
+    const entry: ReturnType<typeof performance.measure> = measure.apply(this, args);
+    const [name] = args;
+    if (name.startsWith(STEP_PREFIX)) {
+      const step: string = name.slice(STEP_PREFIX.length);
+      steps.push(step);
+      if (step === abortAfter) {
+        controller.abort(reason);
+      }
+    }
+    return entry;
+  });
+  // A cobuild configuration whose feature is off, so that its cleanup can be observed.
+  const destroyLockProvider: jest.Mock<Promise<void>, []> = jest.fn(async () => {});
+  jest.spyOn(CobuildConfiguration, 'tryLoadAsync').mockResolvedValue({
+    cobuildFeatureEnabled: false,
+    createLockProviderAsync: async () => {},
+    destroyLockProviderAsync: destroyLockProvider
+  } as unknown as CobuildConfiguration);
+  const command: PhasedCommandEngine = await PhasedCommandEngine.parseAsync({
+    argv: ['build', '--parallelism', '3'],
+    cwd: configuration.rushJsonFolder,
+    rushConfiguration: configuration,
+    terminalProvider: new NoOpTerminalProvider()
+  });
+  return {
+    command,
+    controller,
+    reason,
+    lockFolder: configuration.commonTempFolder,
+    steps,
+    destroyLockProvider
+  };
+}
+
+function expectLockFree(lockFolder: string): void {
+  const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, 'rush');
+  expect(lock).toBeInstanceOf(LockFile);
+  lock?.release();
+}
+
+async function withFixtureAsync(test: (fixture: DaemonGraphTestFixture) => Promise<void>): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    await test(fixture);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+describe('PhasedCommandEngine.createEngineAsync with an abort signal', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('creates the engine through every step when the signal does not abort', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, lockFolder, steps, destroyLockProvider } = await parseAsync(fixture);
+      const engine: IPhasedCommandEngine = await command.createEngineAsync(undefined, controller.signal);
+      try {
+        expect(steps).toEqual(STEPS);
+        expect(destroyLockProvider).not.toHaveBeenCalled();
+        expectLockFree(lockFolder);
+      } finally {
+        await engine[Symbol.asyncDispose]();
+      }
+      expect(destroyLockProvider).toHaveBeenCalledTimes(1);
+    }));
+
+  it.each(CHECKED_STEPS)(
+    'stops before the next step once the signal aborts as %s ends, and releases the lock it took',
+    (abortAfter: string, cleanups: number) =>
+      withFixtureAsync(async (fixture) => {
+        const { command, controller, reason, lockFolder, steps, destroyLockProvider } = await parseAsync(
+          fixture,
+          abortAfter
+        );
+        await expect(command.createEngineAsync(undefined, controller.signal)).rejects.toBe(reason);
+        expect(steps).toEqual(STEPS.slice(0, STEPS.indexOf(abortAfter) + 1));
+        expect(destroyLockProvider).toHaveBeenCalledTimes(cleanups);
+        expectLockFree(lockFolder);
+      })
+  );
+
+  it('still takes the inputs snapshot if the signal aborts while the snapshot provider is created', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, reason, lockFolder, steps } = await parseAsync(fixture);
+      const createProviderAsync: ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync'] =
+        ProjectChangeAnalyzer.prototype._tryGetSnapshotProviderAsync;
+      const snapshots: jest.Mock<void, []> = jest.fn();
+      jest
+        .spyOn(ProjectChangeAnalyzer.prototype, '_tryGetSnapshotProviderAsync')
+        .mockImplementation(async function (
+          this: ProjectChangeAnalyzer,
+          ...args: Parameters<ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync']>
+        ): Promise<GetInputsSnapshotAsyncFn | undefined> {
+          const getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined =
+            await createProviderAsync.apply(this, args);
+          controller.abort(reason);
+          return (
+            getInputsSnapshotAsync &&
+            (() => {
+              snapshots();
+              return getInputsSnapshotAsync();
+            })
+          );
+        });
+      await expect(command.createEngineAsync(undefined, controller.signal)).rejects.toBe(reason);
+      expect(snapshots).toHaveBeenCalledTimes(1);
+      expect(steps).toEqual(STEPS.slice(0, STEPS.indexOf('analyzeRepoState') + 1));
+      expectLockFree(lockFolder);
+    }));
+
+  it('runs no step when the signal has already aborted, and the command can still create its engine', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, reason, lockFolder, steps } = await parseAsync(fixture);
+      controller.abort(reason);
+      await expect(command.createEngineAsync(undefined, controller.signal)).rejects.toBe(reason);
+      expect(steps).toEqual([]);
+      expectLockFree(lockFolder);
+      const engine: IPhasedCommandEngine = await command.createEngineAsync();
+      await engine[Symbol.asyncDispose]();
+      expect(steps).toEqual(STEPS);
+    }));
+
+  it('keeps holding a borrowed lock once the signal aborts', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, reason, lockFolder } = await parseAsync(fixture, 'configureBuildCache');
+      const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, 'rush');
+      if (!lock) throw new Error('Expected the free repository lock.');
+      try {
+        await expect(command.createEngineAsync(lock, controller.signal)).rejects.toBe(reason);
+        expect(lock.isReleased).toBe(false);
+        expect(fs.existsSync(lock.filePath)).toBe(true);
+      } finally {
+        lock.release();
+      }
+    }));
+});
diff --git a/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
new file mode 100644
index 00000000000..c9f1a5abc5b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
@@ -0,0 +1,245 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationExecutionResult, Operation } from '@microsoft/rush-lib';
+import { OperationStatus } from '@microsoft/rush-lib';
+
+import { PhasedIterationDemand } from '../PhasedIterationDemand';
+
+interface ITestRecord {
+  enabled: boolean;
+  readonly operation: Operation;
+  status: OperationStatus;
+}
+
+function createRecord(name: string, enabled: boolean = true): ITestRecord {
+  return { enabled, operation: { name } as unknown as Operation, status: OperationStatus.Waiting };
+}
+
+function asResult(record: ITestRecord): IOperationExecutionResult {
+  return record as unknown as IOperationExecutionResult;
+}
+
+interface ITestDemand {
+  readonly abandonedCount: () => number;
+  readonly demand: PhasedIterationDemand;
+  readonly schedule: (...records: ReadonlyArray<ITestRecord>) => void;
+  readonly setStatus: (record: ITestRecord, status: OperationStatus) => void;
+}
+
+function createDemand(): ITestDemand {
+  let abandonedCount: number = 0;
+  const demand: PhasedIterationDemand = new PhasedIterationDemand(() => abandonedCount++);
+  return {
+    abandonedCount: () => abandonedCount,
+    demand,
+    schedule: (...records: ReadonlyArray<ITestRecord>) => demand.onIterationScheduled(records.map(asResult)),
+    setStatus: (record: ITestRecord, status: OperationStatus) => {
+      record.status = status;
+      demand.onOperationStatusChanged(asResult(record));
+    }
+  };
+}
+
+describe(PhasedIterationDemand.name, () => {
+  it('is restricted once armed, and a later restriction can add operations that a joining client needs', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const running: ITestRecord = createRecord('running');
+    const joining: ITestRecord = createRecord('joining', false);
+    running.status = OperationStatus.Executing;
+    schedule(needed, running, joining);
+    expect(demand.restricted).toBe(false);
+
+    demand.restrictTo([needed.operation]);
+    expect(demand.restricted).toBe(true);
+    // The client that joins enables its operation, and the batch restricts the demand again
+    joining.enabled = true;
+    demand.restrictTo([needed.operation, joining.operation]);
+    setStatus(needed, OperationStatus.Success);
+
+    expect(joining.enabled).toBe(true);
+    expect(abandonedCount()).toBe(0);
+    setStatus(joining, OperationStatus.Success);
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('never reports an iteration abandoned until it is armed', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const other: ITestRecord = createRecord('other');
+    schedule(needed, other);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(0);
+    expect(demand.abandoned).toBe(false);
+    expect(other.enabled).toBe(true);
+  });
+
+  it('reports abandonment once, when the needed work finishes before enabled unneeded work', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const running: ITestRecord = createRecord('running');
+    const waiting: ITestRecord = createRecord('waiting');
+    schedule(needed, running, waiting);
+    setStatus(running, OperationStatus.Executing);
+    demand.restrictTo([needed.operation]);
+    setStatus(needed, OperationStatus.Executing);
+    expect(abandonedCount()).toBe(0);
+    expect([running.enabled, waiting.enabled]).toEqual([true, false]);
+
+    setStatus(needed, OperationStatus.Success);
+    expect(abandonedCount()).toBe(1);
+    expect(demand.abandoned).toBe(true);
+
+    setStatus(running, OperationStatus.Aborted);
+    setStatus(waiting, OperationStatus.Aborted);
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('does not report abandonment when unneeded work finishes first', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const other: ITestRecord = createRecord('other');
+    schedule(needed, other);
+    setStatus(other, OperationStatus.Executing);
+    demand.restrictTo([needed.operation]);
+
+    setStatus(other, OperationStatus.Success);
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(0);
+  });
+
+  it('ignores unfinished records that are disabled, since they run nothing', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    schedule(needed, createRecord('disabled', false));
+    demand.restrictTo([needed.operation]);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(0);
+  });
+
+  it('counts only the first terminal status of an iteration record', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const first: ITestRecord = createRecord('first');
+    const second: ITestRecord = createRecord('second');
+    const unneeded: ITestRecord = createRecord('unneeded');
+    schedule(first, second, unneeded);
+    setStatus(unneeded, OperationStatus.Executing);
+    demand.restrictTo([first.operation, second.operation]);
+
+    setStatus(first, OperationStatus.Success);
+    // For example, a failing cache write after the operation succeeded.
+    setStatus(first, OperationStatus.Failure);
+    // A record outside the iteration, such as a retained result that is invalidated, is ignored.
+    demand.onOperationStatusChanged(asResult({ ...second, status: OperationStatus.Success }));
+    expect(abandonedCount()).toBe(0);
+
+    setStatus(second, OperationStatus.Blocked);
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('reports abandonment at once when it is armed after the needed work finished', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const unneeded: ITestRecord = createRecord('unneeded');
+    schedule(needed, unneeded);
+    setStatus(needed, OperationStatus.FromCache);
+    setStatus(unneeded, OperationStatus.Executing);
+    expect(abandonedCount()).toBe(0);
+
+    demand.restrictTo([needed.operation]);
+
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('narrows to the remaining clients when another client leaves', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const small: ITestRecord = createRecord('small');
+    const large: ITestRecord = createRecord('large');
+    const departed: ITestRecord = createRecord('departed');
+    schedule(small, large, departed);
+    setStatus(departed, OperationStatus.Executing);
+    demand.restrictTo([small.operation, large.operation]);
+    setStatus(small, OperationStatus.Success);
+    expect(abandonedCount()).toBe(0);
+    expect(large.enabled).toBe(true);
+
+    demand.restrictTo([small.operation]);
+
+    expect(large.enabled).toBe(false);
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('applies an arming that precedes scheduling, and withholds the unneeded work when it is scheduled', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const unneeded: ITestRecord = createRecord('unneeded');
+    unneeded.status = OperationStatus.Ready;
+    demand.restrictTo([needed.operation]);
+
+    schedule(needed, unneeded);
+
+    expect([needed.enabled, unneeded.enabled]).toEqual([true, false]);
+    setStatus(needed, OperationStatus.Success);
+    expect(abandonedCount()).toBe(0);
+  });
+
+  it('treats records that are already terminal when the iteration is scheduled as finished', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const alreadyFinished: ITestRecord = createRecord('already-finished');
+    alreadyFinished.status = OperationStatus.Success;
+    const running: ITestRecord = createRecord('running');
+    schedule(needed, alreadyFinished, running);
+    setStatus(running, OperationStatus.Executing);
+    demand.restrictTo([needed.operation, alreadyFinished.operation]);
+    expect(abandonedCount()).toBe(0);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('withholds only the unneeded work that the graph has not handed to an execution slot', () => {
+    const { demand, schedule, setStatus } = createDemand();
+    const neededWaiting: ITestRecord = createRecord('needed-waiting');
+    const neededReady: ITestRecord = createRecord('needed-ready');
+    const waiting: ITestRecord = createRecord('waiting');
+    const ready: ITestRecord = createRecord('ready');
+    const queued: ITestRecord = createRecord('queued');
+    const executing: ITestRecord = createRecord('executing');
+    schedule(neededWaiting, neededReady, waiting, ready, queued, executing);
+    setStatus(neededReady, OperationStatus.Ready);
+    setStatus(ready, OperationStatus.Ready);
+    setStatus(queued, OperationStatus.Queued);
+    setStatus(executing, OperationStatus.Executing);
+
+    demand.restrictTo([neededWaiting.operation, neededReady.operation]);
+
+    expect(
+      [neededWaiting, neededReady, waiting, ready, queued, executing].map((record) => record.enabled)
+    ).toEqual([true, true, false, false, true, true]);
+  });
+
+  it('does not report abandonment when all unneeded work was withheld', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const unneeded: ITestRecord = createRecord('unneeded');
+    schedule(needed, unneeded);
+    setStatus(needed, OperationStatus.Executing);
+    demand.restrictTo([needed.operation]);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(unneeded.enabled).toBe(false);
+    expect(abandonedCount()).toBe(0);
+    // The withheld record finishes as skipped when the graph dispatches it.
+    setStatus(unneeded, OperationStatus.Skipped);
+    expect(abandonedCount()).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index 1cde7c35a6e..b43316f0ee3 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -10,7 +10,12 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import { RUSHD_OPERATION_HEADER, RUSHD_OPERATION_STREAM_CLOSED } from '@rushstack/rush-daemon-protocol';
 import { OperationStatus } from '@microsoft/rush-lib';
-import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type {
+  IInputsSnapshot,
+  IOperationRunnerContext,
+  IPhasedCommandEngineRequestSettings,
+  IRushConfigurationProjectForSnapshot
+} from '@microsoft/rush-lib';
 
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import {
@@ -20,10 +25,14 @@ import {
   createRoutingFixture
 } from './PhasedRequestRouterTestUtilities';
 import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import { TEST_REPO_ROOT } from './TestWorkspaceSession';
 
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
 const OPERATION_C: string = 'project-c (_phase:test)';
+const SESSION_VARIABLE: string = 'COPILOT_AGENT_SESSION_ID';
+
+type TestOperationAction = (terminal: ITerminal, context: IOperationRunnerContext) => Promise<void>;
 
 interface IDeferred {
   readonly promise: Promise<void>;
@@ -57,9 +66,9 @@ function createRequest(
 }
 
 function createFixture(options?: {
-  readonly actionAAsync?: (terminal: ITerminal) => Promise<void>;
-  readonly actionBAsync?: (terminal: ITerminal) => Promise<void>;
-  readonly actionCAsync?: (terminal: ITerminal) => Promise<void>;
+  readonly actionAAsync?: TestOperationAction;
+  readonly actionBAsync?: TestOperationAction;
+  readonly actionCAsync?: TestOperationAction;
   readonly statusA?: OperationStatus;
 }): ITestRoutingFixture {
   return createRoutingFixture(
@@ -83,6 +92,30 @@ function getResultOperationIds(result: IDaemonPhasedRequestResult): ReadonlyArra
   return result.operationResults.map(({ operationId }) => operationId);
 }
 
+/** One input file of project-c: the version on disk, and the version that the latest reconcile read. */
+class TestWorkspaceInput {
+  #diskVersion: number = 0;
+  #snapshotVersion: number | undefined;
+
+  public edit(): void {
+    this.#diskVersion++;
+  }
+
+  public read(): void {
+    this.#snapshotVersion = this.#diskVersion;
+  }
+
+  public describe(): string {
+    return `snapshot=${this.#snapshotVersion} disk=${this.#diskVersion}`;
+  }
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
 interface IExecutionLeaseTracker {
   readonly events: string[];
 }
@@ -150,12 +183,24 @@ describe('shared phased request batching', () => {
     const scheduleSpy: jest.SpyInstance = jest
       .spyOn(graph, 'scheduleIterationAsync')
       .mockImplementation((...args: Parameters<typeof graph.scheduleIterationAsync>) => {
-        scheduledSettings.push({ parallelism: graph.parallelism, quietMode: graph.quietMode });
+        scheduledSettings.push({
+          parallelism: graph.parallelism,
+          quietMode: graph.quietMode,
+          isIncrementalBuildAllowed: args[0].isIncrementalBuildAllowed as boolean
+        });
         return originalScheduleAsync(...args);
       });
     const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
-    const defaultSettings: IPhasedCommandEngineRequestSettings = { parallelism: 4, quietMode: true };
-    const verboseSerialSettings: IPhasedCommandEngineRequestSettings = { parallelism: 1, quietMode: false };
+    const defaultSettings: IPhasedCommandEngineRequestSettings = {
+      parallelism: 4,
+      quietMode: true,
+      isIncrementalBuildAllowed: true
+    };
+    const verboseSerialSettings: IPhasedCommandEngineRequestSettings = {
+      parallelism: 1,
+      quietMode: false,
+      isIncrementalBuildAllowed: false
+    };
 
     const [first, second] = await Promise.all([
       router.executeAsync(
@@ -197,6 +242,373 @@ describe('shared phased request batching', () => {
     expect(getResultOperationIds(consumer)).toEqual([OPERATION_A, OPERATION_B]);
   });
 
+  it('gives each operation of a shared iteration the environment of the first request that selected it', async () => {
+    const sessions: Map<string, string | undefined> = new Map();
+    const record =
+      (operationId: string): TestOperationAction =>
+      async (terminal: ITerminal, context: IOperationRunnerContext): Promise<void> => {
+        sessions.set(operationId, context.environment?.[SESSION_VARIABLE]);
+      };
+    const fixture: ITestRoutingFixture = createFixture({
+      actionAAsync: record(OPERATION_A),
+      actionBAsync: record(OPERATION_B),
+      actionCAsync: record(OPERATION_C)
+    });
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const withSession = (request: IDaemonPhasedRequest, session?: string): IDaemonPhasedRequest => ({
+      ...request,
+      environment: session === undefined ? {} : { [SESSION_VARIABLE]: session }
+    });
+    const daemonSession: string | undefined = process.env[SESSION_VARIABLE];
+    process.env[SESSION_VARIABLE] = 'daemon';
+    try {
+      await Promise.all([
+        router.executeAsync(
+          withSession(createRequest('a', OPERATION_A), 'session-A'),
+          new TestPhasedRequestClient('one')
+        ),
+        // Project B depends on project A, which the first request already selected.
+        router.executeAsync(
+          withSession(createRequest('b', OPERATION_B), 'session-B'),
+          new TestPhasedRequestClient('two')
+        ),
+        router.executeAsync(
+          withSession(createRequest('c', OPERATION_C)),
+          new TestPhasedRequestClient('three')
+        )
+      ]);
+    } finally {
+      if (daemonSession === undefined) delete process.env[SESSION_VARIABLE];
+      else process.env[SESSION_VARIABLE] = daemonSession;
+    }
+
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_A, 'session-A'],
+        [OPERATION_B, 'session-B'],
+        [OPERATION_C, undefined]
+      ])
+    );
+  });
+
+  it('gives each operation the request id of the request whose environment it gets', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const iterations: string[][] = [];
+    fixture.graph.hooks.beforeExecuteIterationAsync.tap('test plugin', (records, options) => {
+      const lines: string[] = [];
+      for (const operation of records.keys()) {
+        const session: string | undefined = options.getOperationEnvironment?.(operation)[SESSION_VARIABLE];
+        lines.push(`${operation.name}: ${options.getOperationRequestId?.(operation)} ${session}`);
+      }
+      iterations.push(lines.sort());
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const withSession = (request: IDaemonPhasedRequest, session: string): IDaemonPhasedRequest => ({
+      ...request,
+      environment: { [SESSION_VARIABLE]: session }
+    });
+
+    await Promise.all([
+      router.executeAsync(
+        withSession(createRequest('x', OPERATION_A, OPERATION_C), 'session-X'),
+        new TestPhasedRequestClient('x')
+      ),
+      router.executeAsync(
+        withSession(createRequest('y', OPERATION_B), 'session-Y'),
+        new TestPhasedRequestClient('y')
+      )
+    ]);
+    await router.executeAsync(
+      withSession(createRequest('z', OPERATION_A), 'session-Z'),
+      new TestPhasedRequestClient('z')
+    );
+
+    // An operation that no participant selected gets the first participant's environment and request id.
+    expect(iterations).toEqual([
+      [`${OPERATION_A}: x session-X`, `${OPERATION_B}: y session-Y`, `${OPERATION_C}: x session-X`],
+      [`${OPERATION_A}: z session-Z`, `${OPERATION_B}: z session-Z`, `${OPERATION_C}: z session-Z`]
+    ]);
+  });
+
+  describe('with a plugin that changes process.env in beforeExecuteIterationAsync', () => {
+    const ADDED_VARIABLE: string = 'RUSHD_TEST_ADDED';
+    const CHANGED_VARIABLE: string = 'RUSHD_TEST_CHANGED';
+    const REMOVED_VARIABLE: string = 'RUSHD_TEST_REMOVED';
+    const NAMES: ReadonlyArray<string> = [
+      SESSION_VARIABLE,
+      ADDED_VARIABLE,
+      CHANGED_VARIABLE,
+      REMOVED_VARIABLE
+    ];
+    let savedValues: ReadonlyArray<string | undefined> = [];
+
+    beforeEach(() => {
+      savedValues = NAMES.map((name: string) => process.env[name]);
+      process.env[SESSION_VARIABLE] = 'daemon';
+      delete process.env[ADDED_VARIABLE];
+      process.env[CHANGED_VARIABLE] = 'original';
+      process.env[REMOVED_VARIABLE] = 'original';
+    });
+
+    afterEach(() => {
+      NAMES.forEach((name: string, index: number) => {
+        const value: string | undefined = savedValues[index];
+        if (value === undefined) delete process.env[name];
+        else process.env[name] = value;
+      });
+    });
+
+    function createFixtureWithPlugin(options?: Parameters<typeof createFixture>[0]): ITestRoutingFixture {
+      const fixture: ITestRoutingFixture = createFixture(options);
+      let iteration: number = 0;
+      fixture.graph.hooks.beforeExecuteIterationAsync.tap('test plugin', () => {
+        iteration++;
+        process.env[ADDED_VARIABLE] = `added-${iteration}`;
+        process.env[CHANGED_VARIABLE] = `changed-${iteration}`;
+        delete process.env[REMOVED_VARIABLE];
+      });
+      return fixture;
+    }
+
+    function withSession(request: IDaemonPhasedRequest, session: string): IDaemonPhasedRequest {
+      return { ...request, environment: { [SESSION_VARIABLE]: session } };
+    }
+
+    function recordEnvironment(seen: string[], operationId: string): TestOperationAction {
+      return async (terminal: ITerminal, context: IOperationRunnerContext): Promise<void> => {
+        const values: string[] = NAMES.map((name: string) => context.environment?.[name] ?? '<unset>');
+        seen.push(`${operationId}: ${values.join(' ')}`);
+      };
+    }
+
+    it("starts each operation from what the same iteration's hook set, changed and deleted, with its requester's session", async () => {
+      const seen: string[] = [];
+      const fixture: ITestRoutingFixture = createFixtureWithPlugin({
+        actionAAsync: recordEnvironment(seen, OPERATION_A),
+        actionCAsync: recordEnvironment(seen, OPERATION_C)
+      });
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(
+          withSession(createRequest('a', OPERATION_A), 'session-A'),
+          new TestPhasedRequestClient('a')
+        ),
+        router.executeAsync(
+          withSession(createRequest('c', OPERATION_C), 'session-C'),
+          new TestPhasedRequestClient('c')
+        )
+      ]);
+      await router.executeAsync(
+        withSession(createRequest('a-again', OPERATION_A), 'session-A-again'),
+        new TestPhasedRequestClient('a-again')
+      );
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(2);
+      expect([...seen].sort()).toEqual([
+        `${OPERATION_A}: session-A added-1 changed-1 <unset>`,
+        `${OPERATION_A}: session-A-again added-2 changed-2 <unset>`,
+        `${OPERATION_C}: session-C added-1 changed-1 <unset>`
+      ]);
+    });
+
+    it('hashes from one copy of each requester environment while scheduling and starts from a copy taken after the hook', async () => {
+      const hashedEnvironments: Map<
+        IRushConfigurationProjectForSnapshot,
+        Readonly<Record<string, string | undefined>> | undefined
+      > = new Map();
+      const seen: string[] = [];
+      const fixture: ITestRoutingFixture = createFixtureWithPlugin({
+        actionAAsync: recordEnvironment(seen, OPERATION_A),
+        actionBAsync: recordEnvironment(seen, OPERATION_B),
+        actionCAsync: recordEnvironment(seen, OPERATION_C)
+      });
+      const inputsSnapshot: IInputsSnapshot = {
+        getOperationOwnStateHash: (
+          project: IRushConfigurationProjectForSnapshot,
+          operationName?: string,
+          environment?: Readonly<Record<string, string | undefined>>
+        ): string => {
+          hashedEnvironments.set(project, environment);
+          return 'hash';
+        },
+        getTrackedFileHashesForOperation: () => new Map(),
+        hasUncommittedChanges: false,
+        hashes: new Map(),
+        rootDirectory: TEST_REPO_ROOT
+      };
+      Object.assign(fixture.session, { inputsSnapshot });
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(
+          withSession(createRequest('x', OPERATION_A, OPERATION_C), 'session-X'),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          withSession(createRequest('y', OPERATION_B), 'session-Y'),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+
+      const [hashedA, hashedB, hashedC] = [OPERATION_A, OPERATION_B, OPERATION_C].map((operationId: string) =>
+        hashedEnvironments.get(fixture.operations.get(operationId)!.associatedProject)
+      );
+      expect(hashedA?.[SESSION_VARIABLE]).toBe('session-X');
+      expect(hashedB?.[SESSION_VARIABLE]).toBe('session-Y');
+      // The same object. Each is a whole environment, so a failure prints only a boolean.
+      expect(hashedC === hashedA).toBe(true);
+      expect(hashedA?.[CHANGED_VARIABLE]).toBe('original');
+      expect([...seen].sort()).toEqual([
+        `${OPERATION_A}: session-X added-1 changed-1 <unset>`,
+        `${OPERATION_B}: session-Y added-1 changed-1 <unset>`,
+        `${OPERATION_C}: session-X added-1 changed-1 <unset>`
+      ]);
+    });
+  });
+
+  describe('with an operation that hashes a variable that does not select a daemon', () => {
+    const TERMINAL_VARIABLE: string = 'WT_SESSION';
+    const HOST_VARIABLE: string = 'RUSHD_TEST_HOST_VARIABLE';
+
+    interface IHashedVariableFixture {
+      readonly fixture: ITestRoutingFixture;
+      readonly router: PhasedRequestRouter;
+      readonly runs: ReadonlyArray<string | undefined>;
+      readonly scheduleSpy: jest.SpyInstance;
+    }
+
+    function createHashedVariableFixture(
+      dependsOnEnvVars: string[],
+      actionCAsync?: TestOperationAction
+    ): IHashedVariableFixture {
+      const runs: (string | undefined)[] = [];
+      const fixture: ITestRoutingFixture = createFixture({
+        actionAAsync: async (terminal: ITerminal, context: IOperationRunnerContext): Promise<void> => {
+          runs.push(context.environment?.[TERMINAL_VARIABLE]);
+        },
+        actionCAsync
+      });
+      fixture.operations.get(OPERATION_A)!.settings = { operationName: '_phase:test', dependsOnEnvVars };
+      return {
+        fixture,
+        router: new PhasedRequestRouter(fixture.session),
+        runs,
+        scheduleSpy: jest.spyOn(fixture.graph, 'scheduleIterationAsync')
+      };
+    }
+
+    function createRequestWithEnvironment(
+      requestId: string,
+      environment: Record<string, string>,
+      operationId: string
+    ): IDaemonPhasedRequest {
+      return { ...createRequest(requestId, operationId), environment };
+    }
+
+    it('schedules separate iterations for queued requests that disagree on its value', async () => {
+      const occupierStarted: IDeferred = createDeferred();
+      const releaseOccupier: IDeferred = createDeferred();
+      const { fixture, router, runs, scheduleSpy } = createHashedVariableFixture(
+        [TERMINAL_VARIABLE],
+        async (): Promise<void> => {
+          occupierStarted.resolve();
+          await releaseOccupier.promise;
+        }
+      );
+      const occupier: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        createRequest('occupier', OPERATION_C),
+        new TestPhasedRequestClient('occupier')
+      );
+      await occupierStarted.promise;
+      const results: Promise<IDaemonPhasedRequestResult[]> = Promise.all([
+        router.executeAsync(
+          createRequestWithEnvironment('x', { [TERMINAL_VARIABLE]: 'wt-X' }, OPERATION_A),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          createRequestWithEnvironment('y', { [TERMINAL_VARIABLE]: 'wt-Y' }, OPERATION_A),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+      releaseOccupier.resolve();
+      await occupier;
+      const [x, y] = await results;
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(3);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(2);
+      expect(runs).toEqual(['wt-X', 'wt-Y']);
+      expect(x).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(y).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(getResultOperationIds(x)).toEqual([OPERATION_A]);
+      expect(getResultOperationIds(y)).toEqual([OPERATION_A]);
+    });
+
+    it('shares one iteration for requests that agree on its value', async () => {
+      const { fixture, router, runs, scheduleSpy } = createHashedVariableFixture([TERMINAL_VARIABLE]);
+
+      await Promise.all([
+        router.executeAsync(
+          createRequestWithEnvironment(
+            'x',
+            { [TERMINAL_VARIABLE]: 'wt-X', [SESSION_VARIABLE]: 'session-X' },
+            OPERATION_A
+          ),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          createRequestWithEnvironment(
+            'y',
+            { [TERMINAL_VARIABLE]: 'wt-X', [SESSION_VARIABLE]: 'session-Y' },
+            OPERATION_A
+          ),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(runs).toEqual(['wt-X']);
+    });
+
+    it('shares one iteration for an unset value and an empty one, which operations hash alike', async () => {
+      const { fixture, router, runs, scheduleSpy } = createHashedVariableFixture([TERMINAL_VARIABLE]);
+
+      await Promise.all([
+        router.executeAsync(createRequest('unset', OPERATION_A), new TestPhasedRequestClient('unset')),
+        router.executeAsync(
+          createRequestWithEnvironment('empty', { [TERMINAL_VARIABLE]: '' }, OPERATION_A),
+          new TestPhasedRequestClient('empty')
+        )
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(runs).toEqual([undefined]);
+    });
+
+    it('keeps sharing one iteration when requests differ only in a variable that operations take from the daemon', async () => {
+      const { fixture, router, scheduleSpy } = createHashedVariableFixture([HOST_VARIABLE]);
+
+      await Promise.all([
+        router.executeAsync(
+          createRequestWithEnvironment('x', { [HOST_VARIABLE]: 'x' }, OPERATION_A),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          createRequestWithEnvironment('y', { [HOST_VARIABLE]: 'y' }, OPERATION_A),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    });
+  });
+
   it('shares one iteration for disjoint selections while isolating streams, events, and results', async () => {
     const fixture: ITestRoutingFixture = createFixture({
       actionAAsync: async (terminal: ITerminal): Promise<void> => terminal.writeLine('only-a'),
@@ -225,6 +637,121 @@ describe('shared phased request batching', () => {
     ]);
   });
 
+  it.each([false, true])(
+    'announces a shared iteration to each client with only its own operations (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const fixture: ITestRoutingFixture = createFixture();
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const settings: IPhasedCommandEngineRequestSettings = {
+        parallelism: 4,
+        quietMode,
+        isIncrementalBuildAllowed: true
+      };
+      const clientB: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(createRequest('b', OPERATION_B), clientB, false, undefined, settings),
+        router.executeAsync(createRequest('c', OPERATION_C), clientC, false, undefined, settings)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(getIterationAnnouncement(clientB)).toEqual([
+        ...(quietMode ? [] : ['Selected 2 operations:', `  ${OPERATION_A}`, `  ${OPERATION_B}`, '']),
+        'Executing a maximum of 2 simultaneous processes...'
+      ]);
+      expect(getIterationAnnouncement(clientC)).toEqual([
+        ...(quietMode ? [] : ['Selected 1 operation:', `  ${OPERATION_C}`, '']),
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+    }
+  );
+
+  it.each([false, true])(
+    'announces an operation that two clients of a shared iteration both select to each of them (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const fixture: ITestRoutingFixture = createFixture();
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const settings: IPhasedCommandEngineRequestSettings = {
+        parallelism: 4,
+        quietMode,
+        isIncrementalBuildAllowed: true
+      };
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientB: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(createRequest('a', OPERATION_A), clientA, false, undefined, settings),
+        router.executeAsync(createRequest('b', OPERATION_B), clientB, false, undefined, settings)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(getIterationAnnouncement(clientA)).toEqual([
+        ...(quietMode ? [] : ['Selected 1 operation:', `  ${OPERATION_A}`, '']),
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+      expect(getIterationAnnouncement(clientB)).toEqual([
+        ...(quietMode ? [] : ['Selected 2 operations:', `  ${OPERATION_A}`, `  ${OPERATION_B}`, '']),
+        'Executing a maximum of 2 simultaneous processes...'
+      ]);
+      expect(getHeaderData(clientA)).toEqual([
+        { completedOperations: 1, operationId: OPERATION_A, totalOperations: 1 }
+      ]);
+      expect(getHeaderData(clientB)).toEqual([
+        { completedOperations: 1, operationId: OPERATION_A, totalOperations: 2 },
+        { completedOperations: 2, operationId: OPERATION_B, totalOperations: 2 }
+      ]);
+    }
+  );
+
+  it.each([false, true])(
+    'does not announce a shared iteration to a client that has nothing to run in it, as when it is alone (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const fixture: ITestRoutingFixture = createFixture();
+      let upToDate: boolean = false;
+      fixture.graph.hooks.configureIteration.tap('project-a is up to date', (records) => {
+        for (const record of records.values()) {
+          if (upToDate && record.operation.name === OPERATION_A) {
+            record.enabled = false;
+          }
+        }
+      });
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const settings: IPhasedCommandEngineRequestSettings = {
+        parallelism: 4,
+        quietMode,
+        isIncrementalBuildAllowed: true
+      };
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(
+        createRequest('first', OPERATION_A),
+        new TestPhasedRequestClient('zero'),
+        false,
+        undefined,
+        settings
+      );
+      upToDate = true;
+
+      await Promise.all([
+        router.executeAsync(createRequest('a', OPERATION_A), clientA, false, undefined, settings),
+        router.executeAsync(createRequest('c', OPERATION_C), clientC, false, undefined, settings)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(2);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(getIterationAnnouncement(clientA)).toEqual([]);
+      expect(getIterationAnnouncement(clientC)).toEqual([
+        ...(quietMode ? [] : ['Selected 1 operation:', `  ${OPERATION_C}`, '']),
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+    }
+  );
+
   it('publishes a coalesced client result as soon as its own closure settles', async () => {
     const releaseB: IDeferred = createDeferred();
     const fixture: ITestRoutingFixture = createFixture({
@@ -422,12 +949,14 @@ describe('shared phased request batching', () => {
     const abortCallCountBeforeCancellation: number = abortSpy.mock.calls.length;
 
     cancelledClient.abortController.abort();
+    // The continuing client still needs its running operation, so the cancellation itself aborts nothing. Once that
+    // operation finishes, work that only the cancelled client needed may be aborted (PhasedRequestCancellation.test).
+    expect(abortSpy).toHaveBeenCalledTimes(abortCallCountBeforeCancellation);
     releaseOperation.resolve();
     const [cancelledResult, continuingResult] = await Promise.all([cancelled, continuing]);
 
     expect(cancelledResult).toMatchObject({ aborted: true, outcome: 'aborted' });
     expect(continuingResult).toMatchObject({ exitCode: 0, outcome: 'success' });
-    expect(abortSpy).toHaveBeenCalledTimes(abortCallCountBeforeCancellation);
     expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
   });
 
@@ -582,6 +1111,208 @@ describe('shared phased request batching', () => {
     expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
   });
 
+  it('puts a compatible request received during the reconcile into a later batch that reconciles again', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    const inputRead: IDeferred = createDeferred();
+    const finishFirstReconcile: IDeferred = createDeferred();
+    let reconcileCount: number = 0;
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      reconcileCount++;
+      events.push('reconcile:start');
+      input.read();
+      if (reconcileCount === 1) {
+        inputRead.resolve();
+        // The reconcile has read project-c's input and is still reading the rest of the workspace.
+        await finishFirstReconcile.promise;
+      }
+      events.push('reconcile:end');
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first = router.executeAsync(
+      createRequest('first', OPERATION_A),
+      new TestPhasedRequestClient('one')
+    );
+    await inputRead.promise;
+
+    // Another client changes project-c's input, then submits a compatible build that needs it.
+    input.edit();
+    events.push('edit');
+    const second = router.executeAsync(
+      createRequest('second', OPERATION_C),
+      new TestPhasedRequestClient('two')
+    );
+    await settleAsync();
+    finishFirstReconcile.resolve();
+
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    // Joining the first batch would run project-c on the inputs read before its change ("snapshot=0 disk=1").
+    expect(events).toEqual([
+      'reconcile:start',
+      'edit',
+      'reconcile:end',
+      'reconcile:start',
+      'reconcile:end',
+      'run:C snapshot=1 disk=1'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('lets a compatible request that is pending before the reconcile join the batch and see its change', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    const leaseRequested: IDeferred = createDeferred();
+    const grantLease: IDeferred = createDeferred();
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      leaseRequested.resolve();
+      await grantLease.promise;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      events.push('reconcile');
+      input.read();
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first = router.executeAsync(
+      createRequest('first', OPERATION_A),
+      new TestPhasedRequestClient('one')
+    );
+    await leaseRequested.promise;
+
+    input.edit();
+    events.push('edit');
+    const second = router.executeAsync(
+      createRequest('second', OPERATION_C),
+      new TestPhasedRequestClient('two')
+    );
+    await settleAsync();
+    grantLease.resolve();
+
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(events).toEqual(['edit', 'reconcile', 'run:C snapshot=1 disk=1']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('lets a request received before the reconcile began join the batch when it reaches the router during it', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    const reconcileStarted: IDeferred = createDeferred();
+    const finishReconcile: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      events.push('reconcile:start');
+      input.read();
+      reconcileStarted.resolve();
+      await finishReconcile.promise;
+      events.push('reconcile:end');
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+    // The second client changes project-c's input and the daemon receives its request, which then waits (for
+    // example behind a graph load) and reaches the router only while the first batch reconciles.
+    input.edit();
+    events.push('edit');
+    const secondReceivedTimeMs: number = performance.now();
+    const first = router.executeAsync(
+      createRequest('first', OPERATION_A),
+      new TestPhasedRequestClient('one')
+    );
+    await reconcileStarted.promise;
+    const second = router.executeAsync(
+      createRequest('second', OPERATION_C),
+      new TestPhasedRequestClient('two'),
+      false,
+      undefined,
+      undefined,
+      undefined,
+      secondReceivedTimeMs
+    );
+    await settleAsync();
+    finishReconcile.resolve();
+
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(events).toEqual(['edit', 'reconcile:start', 'reconcile:end', 'run:C snapshot=1 disk=1']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits for connecting clients before the reconcile, so that a request one sends meanwhile joins the batch', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      events.push('reconcile');
+      input.read();
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    let second: Promise<IDaemonPhasedRequestResult> | undefined;
+    const waitForConnectingClientsAsync: jest.Mock<Promise<void>, []> = jest.fn(async (): Promise<void> => {
+      // A client that connected while the daemon was busy changes project-c's input, then sends a compatible build.
+      events.push('wait');
+      input.edit();
+      second = router.executeAsync(
+        createRequest('second', OPERATION_C),
+        new TestPhasedRequestClient('two'),
+        false,
+        undefined,
+        undefined,
+        undefined,
+        performance.now()
+      );
+      await settleAsync();
+    });
+    const firstClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    firstClient.waitForConnectingClientsAsync = waitForConnectingClientsAsync;
+
+    expect(await router.executeAsync(createRequest('first', OPERATION_A), firstClient)).toMatchObject({
+      exitCode: 0,
+      outcome: 'success'
+    });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(events).toEqual(['wait', 'reconcile', 'run:C snapshot=1 disk=1']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(waitForConnectingClientsAsync).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not wait for connecting clients before a batch that no other request can join', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const waitForConnectingClientsAsync: jest.Mock<Promise<void>, []> = jest.fn(
+      async (): Promise<void> => undefined
+    );
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    client.waitForConnectingClientsAsync = waitForConnectingClientsAsync;
+
+    expect(
+      await router.executeAsync({ ...createRequest('list', OPERATION_A), commandName: 'list' }, client)
+    ).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(waitForConnectingClientsAsync).not.toHaveBeenCalled();
+  });
+
   it('lets a late shared build wait past a default timeout while a compatible batch executes', async () => {
     const operationStarted: IDeferred = createDeferred();
     const releaseOperation: IDeferred = createDeferred();
@@ -794,6 +1525,25 @@ describe('shared phased request batching', () => {
   });
 });
 
+/** The activity lines that announced an iteration to a client, from the `Selected` listing through the `Executing` line. */
+function getIterationAnnouncement(client: TestPhasedRequestClient): ReadonlyArray<string> {
+  const texts: string[] = client.writes.flatMap(({ event }) =>
+    event?.type === 'activityChanged' && event.scope === undefined
+      ? [(event.payload as { text: string }).text]
+      : []
+  );
+  const executingIndexes: number[] = texts.flatMap((text: string, index: number) =>
+    text.startsWith('Executing a maximum of ') ? [index] : []
+  );
+  if (executingIndexes.length === 0) {
+    expect(texts.some((text: string) => text.startsWith('Selected '))).toBe(false);
+    return [];
+  }
+  expect(executingIndexes).toHaveLength(1);
+  const selectedIndex: number = texts.findIndex((text: string) => text.startsWith('Selected '));
+  return texts.slice(selectedIndex === -1 ? executingIndexes[0] : selectedIndex, executingIndexes[0] + 1);
+}
+
 function getWrittenOperationIds(client: TestPhasedRequestClient): ReadonlySet<string> {
   const operationIdSet: Set<string> = new Set();
   for (const write of client.writes) {
diff --git a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
index 7642e99cb4b..41fe02d5801 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
@@ -16,7 +16,27 @@ import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
 
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_D: string = 'project-d (_phase:test)';
 const PROMPT_CANCELLATION_MS: number = 1000;
+const TIMED_OUT: 'timed out' = 'timed out';
+
+async function raceWithTimeoutAsync<T>(
+  promise: Promise<T>,
+  timeoutMs: number
+): Promise<T | typeof TIMED_OUT> {
+  let timer: NodeJS.Timeout | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<typeof TIMED_OUT>((resolve) => {
+        timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 function createRequest(requestId: string, operationId: string): IDaemonPhasedRequest {
   return {
@@ -36,8 +56,11 @@ interface IHangingOperation {
   readonly release: () => void;
 }
 
-/** An operation that only finishes when released, or when its hard-abort signal fires (like a killed process). */
-function createHangingOperation(): {
+/**
+ * An operation that only finishes when released, or when its hard-abort signal fires (like a killed process), unless
+ * it ignores that signal.
+ */
+function createHangingOperation(ignoresTermination: boolean = false): {
   hanging: IHangingOperation;
   actionAsync: (terminal: ITerminal, context: IOperationRunnerContext) => Promise<OperationStatus | void>;
 } {
@@ -63,8 +86,8 @@ function createHangingOperation(): {
     const aborted: Promise<void> = new Promise<void>((resolve) =>
       abortSignal.addEventListener('abort', () => resolve(), { once: true })
     );
-    await Promise.race([aborted, released]);
-    if (abortSignal.aborted) {
+    await (ignoresTermination ? released : Promise.race([aborted, released]));
+    if (abortSignal.aborted && !ignoresTermination) {
       onTerminated();
       return OperationStatus.Aborted;
     }
@@ -85,6 +108,66 @@ function createFixture(
   );
 }
 
+interface IUpstreamFixFixture {
+  readonly fixture: ITestRoutingFixture;
+  readonly hanging: IHangingOperation;
+  /** Changes A, which then runs until it is released, or terminated unless it ignores that. C stays up to date. */
+  readonly changeA: () => void;
+}
+
+/**
+ * B and D depend on A, and D also depends on C. B fails until A is changed, like a downstream error that is fixed
+ * in the upstream project. After `changeA()`, the warm graph skips C as unchanged.
+ */
+function createUpstreamFixFixture(ignoresTermination: boolean = false): IUpstreamFixFixture {
+  const { hanging, actionAsync: hangingActionAsync } = createHangingOperation(ignoresTermination);
+  let changed: boolean = false;
+  const fixture: ITestRoutingFixture = createRoutingFixture(
+    new Map([
+      [
+        OPERATION_A,
+        new TestOperationRunner(OPERATION_A, OperationStatus.Success, async (terminal, context) =>
+          changed ? await hangingActionAsync(terminal, context) : undefined
+        )
+      ],
+      [
+        OPERATION_B,
+        new TestOperationRunner(OPERATION_B, OperationStatus.Success, async () =>
+          changed ? undefined : OperationStatus.Failure
+        )
+      ],
+      [OPERATION_C, new TestOperationRunner(OPERATION_C)],
+      [OPERATION_D, new TestOperationRunner(OPERATION_D)]
+    ]),
+    [
+      [OPERATION_B, OPERATION_A],
+      [OPERATION_D, OPERATION_A],
+      [OPERATION_D, OPERATION_C]
+    ],
+    { supportsTerminateRunning: true }
+  );
+  // A and C start together, so C is skipped while A runs.
+  fixture.graph.parallelism = 2;
+  fixture.graph.hooks.configureIteration.tap('unchanged C', (records) => {
+    for (const record of records.values()) {
+      if (changed && record.operation.name === OPERATION_C) {
+        record.enabled = false;
+      }
+    }
+  });
+  const changeA = (): void => {
+    changed = true;
+    fixture.session.operationGraph.invalidateOperations([fixture.operations.get(OPERATION_A)!], 'changed');
+  };
+  return { fixture, hanging, changeA };
+}
+
+function getStatuses(result: IDaemonPhasedRequestResult): Record<string, string> {
+  return Object.fromEntries(
+    result.operationResults.map(({ operationId, status }) => [operationId, status] as const)
+  );
+}
+
 describe('phased request client cancellation', () => {
   it('terminates running operations when the last client cancels and releases the graph promptly', async () => {
     const { hanging, actionAsync } = createHangingOperation();
@@ -151,11 +234,54 @@ describe('phased request client cancellation', () => {
     const { hanging, actionAsync } = createHangingOperation();
     const fixture: ITestRoutingFixture = createFixture(actionAsync);
     const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    let onLeaseRequested: () => void = () => undefined;
+    const leaseRequested: Promise<void> = new Promise<void>((resolve) => (onLeaseRequested = resolve));
+    let grantLease: () => void = () => undefined;
+    const leaseGranted: Promise<void> = new Promise<void>((resolve) => (grantLease = resolve));
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      onLeaseRequested();
+      await leaseGranted;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_A),
+      cancelledClient
+    );
+    await leaseRequested;
+    // Accepted while the batch waits for its execution lease, so it joins before the batch reconciles.
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    // Let the continuing request finish preparation and enter the pending queue.
+    for (let tick: number = 0; tick < 20; tick++) {
+      await new Promise<void>((resolve) => setImmediate(resolve));
+    }
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    grantLease();
+    await hanging.started;
+    expect(hanging.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+    hanging.release();
+    expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+  });
+
+  it('keeps a request received during the reconcile out of the batch when its only participant cancels', async () => {
+    const { hanging, actionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createFixture(actionAsync);
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
     let onReconciling: () => void = () => undefined;
     const reconciling: Promise<void> = new Promise<void>((resolve) => (onReconciling = resolve));
     let releaseReconcile: () => void = () => undefined;
     const reconcileReleased: Promise<void> = new Promise<void>((resolve) => (releaseReconcile = resolve));
+    let reconciles: number = 0;
     fixture.session.onReconcileAsync = async () => {
+      reconciles++;
       onReconciling();
       await reconcileReleased;
     };
@@ -166,24 +292,327 @@ describe('phased request client cancellation', () => {
       cancelledClient
     );
     await reconciling;
-    // Accepted while the batch is still being prepared, so it joins once preparation finishes.
+    // Received after the reconcile started, so it waits for the next batch, which reconciles again.
     const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
       createRequest('continuing', OPERATION_A),
       new TestPhasedRequestClient('two')
     );
-    // Let the continuing request finish preparation and enter the pending queue.
     for (let tick: number = 0; tick < 20; tick++) {
       await new Promise<void>((resolve) => setImmediate(resolve));
     }
 
     cancelledClient.abortController.abort();
+    // The cancelled client is the batch's last participant, so its result still follows the batch's reconcile.
+    expect(await raceWithTimeoutAsync(cancelled, 100)).toBe(TIMED_OUT);
+    releaseReconcile();
     expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
 
-    releaseReconcile();
     await hanging.started;
+    expect(reconciles).toBe(2);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
     expect(hanging.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
-    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
     hanging.release();
     expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
   });
+
+  it('never starts work that only a cancelled client needed once the remaining client has its operations', async () => {
+    const { hanging: shared, actionAsync: sharedActionAsync } = createHangingOperation();
+    const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();
+    // The cancelled client needs A, then B, then C. The remaining client needs only A.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, sharedActionAsync)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Success, orphanActionAsync)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ]),
+      [
+        [OPERATION_B, OPERATION_A],
+        [OPERATION_C, OPERATION_B]
+      ],
+      { supportsTerminateRunning: true }
+    );
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_C),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    await shared.started;
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+    // The remaining client still needs the running shared operation.
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+
+    const releasedAt: number = Date.now();
+    shared.release();
+    const result: IDaemonPhasedRequestResult | typeof TIMED_OUT = await raceWithTimeoutAsync(
+      continuing,
+      PROMPT_CANCELLATION_MS
+    );
+    // Lets an iteration that started the abandoned work finish, so a failure below is reported cleanly.
+    orphan.release();
+
+    expect(result).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(Date.now() - releasedAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success })
+    ]);
+    // The abandoned operations had not started, so they finished as skipped and nothing had to be aborted.
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(0);
+    // The remaining client's result stays warm; the abandoned operations are not retained.
+    expect(new Set([...fixture.graph.resultByOperation.keys()].map(({ name }) => name))).toEqual(
+      new Set([OPERATION_A])
+    );
+  });
+
+  it('never starts work that only a cancelled client needed while the remaining client still needs its own', async () => {
+    const { hanging: shared, actionAsync: sharedActionAsync } = createHangingOperation();
+    const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();
+    // The cancelled client needs A, C and D. The remaining client needs A and B. Once A finishes, the queue hands C to
+    // the only slot before B: C comes later in the graph's order and, through D, has the longer critical path.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, sharedActionAsync)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C, OperationStatus.Success, orphanActionAsync)],
+        [OPERATION_D, new TestOperationRunner(OPERATION_D)]
+      ]),
+      [
+        [OPERATION_B, OPERATION_A],
+        [OPERATION_C, OPERATION_A],
+        [OPERATION_D, OPERATION_C]
+      ],
+      { supportsTerminateRunning: true }
+    );
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_D),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_B),
+      new TestPhasedRequestClient('two')
+    );
+    await shared.started;
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    const releasedAt: number = Date.now();
+    shared.release();
+    const result: IDaemonPhasedRequestResult | typeof TIMED_OUT = await raceWithTimeoutAsync(
+      continuing,
+      PROMPT_CANCELLATION_MS
+    );
+    // Lets an iteration that started the abandoned work finish, so a failure below is reported cleanly.
+    orphan.release();
+
+    expect(result).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(Date.now() - releasedAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Success })
+    ]);
+    expect(
+      [OPERATION_A, OPERATION_B, OPERATION_C, OPERATION_D].map((id: string) => fixture.runners.get(id)?.runCount)
+    ).toEqual([1, 1, 0, 0]);
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+    // The skipped operations are not retained, so the next request that selects them runs them.
+    expect(new Set([...fixture.graph.resultByOperation.keys()].map(({ name }) => name))).toEqual(
+      new Set([OPERATION_A, OPERATION_B])
+    );
+    const next: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('next', OPERATION_D),
+      new TestPhasedRequestClient('three')
+    );
+    expect(next).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect([OPERATION_C, OPERATION_D].map((id: string) => fixture.runners.get(id)?.runCount)).toEqual([1, 1]);
+  });
+
+  it('terminates running work that only a cancelled client needed once the remaining client has its operations', async () => {
+    const { hanging: remaining, actionAsync: remainingActionAsync } = createHangingOperation();
+    const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, remainingActionAsync)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Success, orphanActionAsync)]
+      ]),
+      [],
+      { supportsTerminateRunning: true }
+    );
+    fixture.graph.parallelism = 2;
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_B),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    await Promise.all([remaining.started, orphan.started]);
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+    // While the remaining client's operation runs, the iteration is left alone.
+    expect(orphan.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
+
+    const releasedAt: number = Date.now();
+    remaining.release();
+    const result: IDaemonPhasedRequestResult | typeof TIMED_OUT = await raceWithTimeoutAsync(
+      continuing,
+      PROMPT_CANCELLATION_MS
+    );
+    orphan.release();
+
+    expect(result).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(Date.now() - releasedAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success })
+    ]);
+    expect(orphan.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([true]);
+    await orphan.terminated;
+  });
+
+  function createUpstreamFixRequest(requestId: string): IDaemonPhasedRequest {
+    return {
+      ...createRequest(requestId, OPERATION_B),
+      operationSelection: [
+        { enabledState: true, operationId: OPERATION_B },
+        { enabledState: true, operationId: OPERATION_D }
+      ]
+    };
+  }
+
+  it('reports operations that a cancel kept from starting as aborted, not with the results of an earlier request', async () => {
+    const { fixture, hanging, changeA } = createUpstreamFixFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first: IDaemonPhasedRequestResult = await router.executeAsync(
+      createUpstreamFixRequest('first'),
+      new TestPhasedRequestClient('one')
+    );
+    expect(getStatuses(first)).toEqual({
+      [OPERATION_A]: OperationStatus.Success,
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Success,
+      [OPERATION_D]: OperationStatus.Success
+    });
+
+    // The fix goes into A, and the build is cancelled while A runs, before B and D can start.
+    changeA();
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      client
+    );
+    await hanging.started;
+    client.abortController.abort();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+
+    await hanging.terminated;
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Aborted,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Skipped,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(result.operationResults.every(({ errorMessage }) => errorMessage === undefined)).toBe(true);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+    expect(fixture.runners.get(OPERATION_D)?.runCount).toBe(1);
+  });
+
+  it('reports an operation that finished in the iteration of a cancelled request with that result', async () => {
+    // A ignores termination, so it finishes after the cancel, and its result is this request's.
+    const { fixture, hanging, changeA } = createUpstreamFixFixture(true);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    await router.executeAsync(createUpstreamFixRequest('first'), new TestPhasedRequestClient('one'));
+
+    changeA();
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      client
+    );
+    await hanging.started;
+    client.abortController.abort();
+    hanging.release();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Success,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Skipped,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+  });
+
+  it('reports operations that a detached cancelling client never saw start as aborted, not with earlier results', async () => {
+    const { fixture, hanging, changeA } = createUpstreamFixFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    await router.executeAsync(createUpstreamFixRequest('first'), new TestPhasedRequestClient('one'));
+
+    changeA();
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('three')
+    );
+    await hanging.started;
+    cancelledClient.abortController.abort();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+    hanging.release();
+
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Aborted,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Skipped,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(getStatuses(await continuing)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+  });
+
+  it('reports every operation as aborted when the cancel comes while the iteration is being scheduled', async () => {
+    const { fixture, changeA } = createUpstreamFixFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    await router.executeAsync(createUpstreamFixRequest('first'), new TestPhasedRequestClient('one'));
+
+    changeA();
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    fixture.graph.hooks.configureIteration.tap('cancel while scheduling', () => {
+      client.abortController.abort();
+    });
+    const result: IDaemonPhasedRequestResult = await router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      client
+    );
+
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Aborted,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Aborted,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
 });
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
new file mode 100644
index 00000000000..be741a7b17a
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -0,0 +1,967 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IDaemonContinuingOperations,
+  IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
+  IDaemonRequestQueuePositionMessage,
+  IDaemonWorkspaceStatus
+} from '@rushstack/rush-daemon-protocol';
+import { type IOperationRunnerContext, OperationStatus } from '@microsoft/rush-lib';
+import type { ITerminal } from '@rushstack/terminal';
+
+import { PhasedRequestRouter, describeContinuingOperations } from '../PhasedRequestRouter';
+import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
+import type { IWorkspaceSession } from '../WorkspaceSession';
+import type { WorkspaceSessionProvider } from '../WorkspaceSessionProvider';
+import { getWorkspaceStatus } from '../WorkspaceStatus';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_D: string = 'project-d (_phase:test)';
+/** A consumes B and C, so A is the only target of a request that selects A. */
+const A_CONSUMES_B_AND_C: ReadonlyArray<readonly [string, string]> = [
+  [OPERATION_A, OPERATION_B],
+  [OPERATION_A, OPERATION_C]
+];
+
+interface IDeferred {
+  readonly promise: Promise<void>;
+  readonly resolve: () => void;
+}
+
+function createDeferred(): IDeferred {
+  let resolvePromise: (() => void) | undefined;
+  const promise: Promise<void> = new Promise((resolve) => {
+    resolvePromise = resolve;
+  });
+  return { promise, resolve: () => resolvePromise?.() };
+}
+
+function createRequest(
+  requestId: string,
+  returnEarlyOnFailure: boolean,
+  ...selectedOperationIds: ReadonlyArray<string>
+): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: selectedOperationIds.map((operationId: string) => ({
+      enabledState: true,
+      operationId
+    })),
+    requestId,
+    ...(returnEarlyOnFailure ? { returnEarlyOnFailure } : {})
+  };
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+interface IEarlyFailureFixture {
+  readonly events: string[];
+  readonly fixture: ITestRoutingFixture;
+  /** Lets C, which is slow, finish. */
+  readonly releaseC: () => void;
+  readonly router: PhasedRequestRouter;
+  readonly startedC: Promise<void>;
+}
+
+/** Runs nothing that the user sees, like a phase that the project does not define. */
+class SilentTestOperationRunner extends TestOperationRunner {
+  public override readonly silent: boolean = true;
+}
+
+/**
+ * B fails and C is slow. Unless `failBeforeCStarts` is set, B fails only once C runs, so C is executing when B's
+ * failure decides a request's result. If `silentC` is set, C is silent. If `terminable` is set, the graph can
+ * terminate running operations, and C stops with `Aborted` when it does, as a runner that kills its process does.
+ * If `dependencies` names D, D succeeds as soon as it runs. If `bFailsWhen` is given, B fails only once it resolves.
+ */
+function createEarlyFailureFixture(
+  dependencies: ReadonlyArray<readonly [string, string]> = A_CONSUMES_B_AND_C,
+  failBeforeCStarts: boolean = false,
+  silentC: boolean = false,
+  terminable: boolean = false,
+  bFailsWhen?: Promise<void>
+): IEarlyFailureFixture {
+  const startedC: IDeferred = createDeferred();
+  const releaseC: IDeferred = createDeferred();
+  const events: string[] = [];
+  const runners: Map<string, TestOperationRunner> = new Map([
+    [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+    [
+      OPERATION_B,
+      new TestOperationRunner(OPERATION_B, OperationStatus.Failure, async (): Promise<void> => {
+        if (!failBeforeCStarts) {
+          await startedC.promise;
+        }
+        if (bFailsWhen) {
+          await bFailsWhen;
+        }
+      })
+    ],
+    [
+      OPERATION_C,
+      new (silentC ? SilentTestOperationRunner : TestOperationRunner)(
+        OPERATION_C,
+        OperationStatus.Success,
+        async (
+          terminal: ITerminal,
+          { abortSignal }: IOperationRunnerContext
+        ): Promise<void | OperationStatus> => {
+          startedC.resolve();
+          const terminated: Promise<OperationStatus> = new Promise((resolve) => {
+            abortSignal?.addEventListener('abort', () => resolve(OperationStatus.Aborted), { once: true });
+          });
+          return await Promise.race([releaseC.promise, terminated]);
+        }
+      )
+    ]
+  ]);
+  if (dependencies.some((pair: readonly [string, string]) => pair.includes(OPERATION_D))) {
+    runners.set(OPERATION_D, new TestOperationRunner(OPERATION_D));
+  }
+  const fixture: ITestRoutingFixture = createRoutingFixture(runners, dependencies, {
+    parallelism: 2,
+    supportsTerminateRunning: terminable
+  });
+  fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+    events.push('acquired');
+    return {
+      [Symbol.asyncDispose]: async (): Promise<void> => {
+        events.push('released');
+      }
+    };
+  };
+  return {
+    events,
+    fixture,
+    releaseC: releaseC.resolve,
+    router: new PhasedRequestRouter(fixture.session),
+    startedC: startedC.promise
+  };
+}
+
+interface ITrackedClient {
+  readonly client: TestPhasedRequestClient;
+  /** Resolves when the client's result was written, with the graph status at that moment. */
+  readonly written: Promise<OperationStatus>;
+}
+
+function trackClient(label: string, { events, fixture }: IEarlyFailureFixture): ITrackedClient {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient(label);
+  let onWritten: (status: OperationStatus) => void = () => undefined;
+  const written: Promise<OperationStatus> = new Promise((resolve) => {
+    onWritten = resolve;
+  });
+  client.onWriteAsync = async (write: ITestClientWrite): Promise<void> => {
+    if (write.result) {
+      events.push(`wrote:${label}`);
+      onWritten(fixture.graph.status);
+    }
+  };
+  return { client, written };
+}
+
+function trackResult(
+  resultPromise: Promise<IDaemonPhasedRequestResult>,
+  label: string,
+  events: string[]
+): Promise<IDaemonPhasedRequestResult> {
+  return resultPromise.then((result: IDaemonPhasedRequestResult) => {
+    events.push(`result:${label}`);
+    return result;
+  });
+}
+
+/** Counts the aborts that the router requested; every iteration's start also calls the spy without options. */
+function countTerminatingAborts(abortSpy: jest.SpyInstance): number {
+  return abortSpy.mock.calls.filter(
+    ([options]: ReadonlyArray<{ terminateRunning?: boolean } | undefined>) =>
+      options?.terminateRunning === true
+  ).length;
+}
+
+function getRetainedStatus({ graph }: ITestRoutingFixture, operationId: string): OperationStatus | undefined {
+  return [...graph.resultByOperation.values()].find(({ operation }) => operation.name === operationId)
+    ?.status;
+}
+
+function getWrittenResults(client: TestPhasedRequestClient): ReadonlyArray<IDaemonPhasedRequestResult> {
+  return client.writes.flatMap(({ result }: ITestClientWrite) => (result ? [result] : []));
+}
+
+function getQueuePositions(
+  client: TestPhasedRequestClient
+): ReadonlyArray<IDaemonRequestQueuePositionMessage['payload']> {
+  return client.writes.flatMap(({ queuePosition }: ITestClientWrite) =>
+    queuePosition ? [queuePosition.payload] : []
+  );
+}
+
+/** Resolves once the client's result was written. */
+function whenResultWritten(client: TestPhasedRequestClient): Promise<void> {
+  return new Promise((resolve) => {
+    client.onWriteAsync = async (write: ITestClientWrite): Promise<void> => {
+      if (write.result) {
+        resolve();
+      }
+    };
+  });
+}
+
+/** The workspace status that `daemon status` reports while `session` is the installed workspace session. */
+function getSessionStatus(session: IWorkspaceSession): IDaemonWorkspaceStatus {
+  const provider: Partial<WorkspaceSessionProvider> = {
+    currentGenerationToken: 'generation-token',
+    currentSession: session,
+    generation: 1
+  };
+  return getWorkspaceStatus(provider as WorkspaceSessionProvider);
+}
+
+/** Records the telemetry reports of a request, and when each was logged. */
+function recordTelemetry(
+  label: string,
+  events: string[],
+  reports: IPhasedRequestTelemetryReport[]
+): IPhasedRequestTelemetrySink {
+  return {
+    logRequest: (report: IPhasedRequestTelemetryReport): void => {
+      events.push(`logged:${label}`);
+      reports.push(report);
+    }
+  };
+}
+
+function getRecordedStatuses(report: IPhasedRequestTelemetryReport): Record<string, OperationStatus> {
+  const statuses: Record<string, OperationStatus> = {};
+  for (const [operation, record] of report.records) {
+    statuses[operation.name] = record.status;
+  }
+  return statuses;
+}
+
+interface IOrdinaryCase {
+  readonly commandName: string;
+  readonly dependencies: ReadonlyArray<readonly [string, string]>;
+  readonly failBeforeCStarts: boolean;
+  readonly name: string;
+  readonly selection: ReadonlyArray<string>;
+  readonly silentC?: boolean;
+}
+
+/** Requests that ask to return early on failure, but whose failed result can only be written at the end. */
+const ORDINARY_CASES: ReadonlyArray<IOrdinaryCase> = [
+  {
+    commandName: 'build',
+    dependencies: [[OPERATION_A, OPERATION_B]],
+    failBeforeCStarts: false,
+    name: 'a target is still running',
+    selection: [OPERATION_A, OPERATION_C]
+  },
+  {
+    commandName: 'build',
+    dependencies: [[OPERATION_A, OPERATION_B]],
+    failBeforeCStarts: true,
+    name: 'nothing else is unfinished',
+    selection: [OPERATION_A]
+  },
+  {
+    commandName: 'rebuild',
+    dependencies: A_CONSUMES_B_AND_C,
+    failBeforeCStarts: false,
+    name: 'the request is not a shared build',
+    selection: [OPERATION_A]
+  },
+  {
+    // An early result would not list C, so it could not say that C continues.
+    commandName: 'build',
+    dependencies: A_CONSUMES_B_AND_C,
+    failBeforeCStarts: false,
+    name: 'only a silent operation is unfinished',
+    selection: [OPERATION_A],
+    silentC: true
+  }
+];
+
+describe('phased requests that return early on failure', () => {
+  it('writes a failed result once no unfinished operation can change it, and keeps independent work running', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const { events, fixture, router } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+      'agent',
+      events
+    );
+
+    expect(await agent.written).toBe(OperationStatus.Executing);
+    await settleAsync();
+    // The request stays active, holding its admission and the execution lease, until C finishes.
+    expect(events).toEqual(['acquired', 'wrote:agent']);
+    const [early] = getWrittenResults(agent.client);
+    expect(early).toMatchObject({ aborted: false, exitCode: 1, outcome: 'failure', scheduled: true });
+    expect(early.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Blocked }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Failure }),
+      expect.objectContaining({ operationId: OPERATION_C, status: OperationStatus.Executing })
+    ]);
+
+    setup.releaseC();
+    expect(await resultPromise).toBe(early);
+    expect(events).toEqual(['acquired', 'wrote:agent', 'released', 'result:agent']);
+    expect(getWrittenResults(agent.client)).toHaveLength(1);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+    // A later build can use it, e.g. from the build cache.
+    expect(getRetainedStatus(fixture, OPERATION_C)).toBe(OperationStatus.Success);
+  });
+
+  it('keeps the ordinary contract for a request that did not ask to return early', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const tracked: ITrackedClient = trackClient('human', setup);
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      setup.router.executeAsync(createRequest('human', false, OPERATION_A), tracked.client),
+      'human',
+      setup.events
+    );
+
+    await setup.startedC;
+    await settleAsync();
+    expect(setup.events).toEqual(['acquired']);
+    setup.releaseC();
+    const result: IDaemonPhasedRequestResult = await resultPromise;
+
+    expect(setup.events).toEqual(['acquired', 'released', 'wrote:human', 'result:human']);
+    expect(result.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Blocked }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Failure }),
+      expect.objectContaining({ operationId: OPERATION_C, status: OperationStatus.Success })
+    ]);
+  });
+
+  it.each(ORDINARY_CASES)(
+    'writes the result after the iteration when $name',
+    async ({ commandName, dependencies, failBeforeCStarts, selection, silentC }: IOrdinaryCase) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture(dependencies, failBeforeCStarts, silentC);
+      const tracked: ITrackedClient = trackClient('agent', setup);
+      const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+        setup.router.executeAsync(
+          { ...createRequest('agent', true, ...selection), commandName },
+          tracked.client
+        ),
+        'agent',
+        setup.events
+      );
+
+      if (!failBeforeCStarts) {
+        await setup.startedC;
+        await settleAsync();
+        expect(setup.events).toEqual(['acquired']);
+      }
+      setup.releaseC();
+      const result: IDaemonPhasedRequestResult = await resultPromise;
+
+      expect(setup.events).toEqual(['acquired', 'released', 'wrote:agent', 'result:agent']);
+      expect(result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+    }
+  );
+
+  it('keeps work that it shares with a participant that cancels after the early result', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const { events, fixture, router } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const departing: TestPhasedRequestClient = new TestPhasedRequestClient('departing');
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+      'agent',
+      events
+    );
+    const departingPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('departing', false, OPERATION_C),
+      departing
+    );
+    await agent.written;
+    departing.abortController.abort();
+
+    expect(await departingPromise).toMatchObject({ aborted: true, outcome: 'aborted' });
+    setup.releaseC();
+    await agentPromise;
+
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+    expect(getRetainedStatus(fixture, OPERATION_C)).toBe(OperationStatus.Success);
+  });
+
+  it('lets a later build wait for the work that continues instead of stopping it', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const { events, fixture, router } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+      'agent',
+      events
+    );
+    await agent.written;
+    await settleAsync();
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('later', false, OPERATION_C), new TestPhasedRequestClient('later')),
+      'later',
+      events
+    );
+    await settleAsync();
+
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    expect(events).toEqual(['acquired', 'wrote:agent']);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+    setup.releaseC();
+    expect(await laterPromise).toMatchObject({ exitCode: 0, outcome: 'success' });
+    await agentPromise;
+
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    expect(getRetainedStatus(fixture, OPERATION_C)).toBe(OperationStatus.Success);
+
+    // The later build ran its own iteration only after the one that continued had ended.
+    expect(events.slice(0, 3)).toEqual(['acquired', 'wrote:agent', 'released']);
+    expect(events.indexOf('result:agent')).toBeLessThan(events.indexOf('result:later'));
+    expect(events.filter((event: string) => event === 'acquired')).toHaveLength(2);
+  });
+
+  it.each(['rebuild', 'list'])(
+    'lets a %s request that cannot run alongside the work that continues stop it',
+    async (commandName: string) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+      const { events, fixture, router } = setup;
+      const agent: ITrackedClient = trackClient('agent', setup);
+      const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+
+      const agentPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+        router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+        'agent',
+        events
+      );
+      await agent.written;
+      await settleAsync();
+      const otherPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+        router.executeAsync(
+          { ...createRequest(commandName, false, OPERATION_C), commandName },
+          new TestPhasedRequestClient(commandName)
+        ),
+        commandName,
+        events
+      );
+      await settleAsync();
+
+      expect(countTerminatingAborts(abortSpy)).toBe(1);
+      setup.releaseC();
+      await Promise.all([agentPromise, otherPromise]);
+
+      expect(events.indexOf('result:agent')).toBeLessThan(events.indexOf(`result:${commandName}`));
+      expect(getWrittenResults(agent.client)).toHaveLength(1);
+    }
+  );
+
+  it('stops the work that continues when the request is aborted after its result', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const abortSpy: jest.SpyInstance = jest.spyOn(setup.fixture.graph, 'abortCurrentIterationAsync');
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await agent.written;
+    await settleAsync();
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    agent.client.abortController.abort();
+
+    expect(countTerminatingAborts(abortSpy)).toBe(1);
+    setup.releaseC();
+    const result: IDaemonPhasedRequestResult = await resultPromise;
+    expect(result).toBe(getWrittenResults(agent.client)[0]);
+    expect(getWrittenResults(agent.client)).toHaveLength(1);
+  });
+
+  it("logs a request that returned early once the work that continues settled, with that work's final status", async () => {
+    // A consumes B and D, and D consumes C, so D starts only after the request has its result.
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture([
+      [OPERATION_A, OPERATION_B],
+      [OPERATION_A, OPERATION_D],
+      [OPERATION_D, OPERATION_C]
+    ]);
+    const { events } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const reports: IPhasedRequestTelemetryReport[] = [];
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client,
+        false,
+        undefined,
+        undefined,
+        recordTelemetry('agent', events, reports)
+      ),
+      'agent',
+      events
+    );
+    await agent.written;
+    await settleAsync();
+    // C and D still run for this request, so its entry waits for them.
+    expect(events).toEqual(['acquired', 'wrote:agent']);
+    const [early] = getWrittenResults(agent.client);
+    expect(early.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Blocked }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Failure }),
+      expect.objectContaining({ operationId: OPERATION_C, status: OperationStatus.Executing }),
+      expect.objectContaining({ operationId: OPERATION_D, status: OperationStatus.Waiting })
+    ]);
+
+    setup.releaseC();
+    expect(await resultPromise).toBe(early);
+    expect(events).toEqual(['acquired', 'wrote:agent', 'released', 'logged:agent', 'result:agent']);
+    expect(reports).toHaveLength(1);
+    const [report] = reports;
+    // The entry describes the result that the client received while C and D still ran.
+    expect(report.result).toBe(early);
+    expect(report).toMatchObject({ countRetained: 0, earlyResult: true, scheduled: true });
+    expect(getRecordedStatuses(report)).toEqual({
+      [OPERATION_A]: OperationStatus.Blocked,
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Success,
+      [OPERATION_D]: OperationStatus.Success
+    });
+    for (const [operation, record] of report.records) {
+      if (operation.name === OPERATION_C || operation.name === OPERATION_D) {
+        expect(record.stopwatch.endTime).toBeGreaterThan(report.resultTimeMs);
+      }
+    }
+    // The measures are taken at the result too, when the iteration had not ended yet.
+    expect(report.measures).toContainEqual({
+      name: 'rush:daemon:executeIteration',
+      startTimeMs: expect.any(Number),
+      endTimeMs: report.resultTimeMs
+    });
+  });
+
+  it('logs the work that continues as aborted when the request is aborted after its result and stops it', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(A_CONSUMES_B_AND_C, false, false, true);
+    const { events } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const reports: IPhasedRequestTelemetryReport[] = [];
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client,
+        false,
+        undefined,
+        undefined,
+        recordTelemetry('agent', events, reports)
+      ),
+      'agent',
+      events
+    );
+    await agent.written;
+    await settleAsync();
+    // The daemon stops C, which nobody waits for any more.
+    agent.client.abortController.abort();
+    await resultPromise;
+
+    expect(events).toEqual(['acquired', 'wrote:agent', 'released', 'logged:agent', 'result:agent']);
+    expect(reports).toHaveLength(1);
+    expect(reports[0].earlyResult).toBe(true);
+    expect(getRecordedStatuses(reports[0])).toEqual({
+      [OPERATION_A]: OperationStatus.Blocked,
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Aborted
+    });
+  });
+
+  it('rejects a flag that is not a boolean', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    await expect(
+      setup.router.executeAsync(
+        { ...createRequest('agent', false, OPERATION_A), returnEarlyOnFailure: 'yes' as unknown as boolean },
+        new TestPhasedRequestClient('agent')
+      )
+    ).rejects.toThrow('Phased request returnEarlyOnFailure must be a boolean value.');
+  });
+});
+
+describe('the operations that continue after an early result', () => {
+  const continuingC: IDaemonContinuingOperations = { count: 1, names: [OPERATION_C] };
+
+  it('are named to a later build that waits only for them', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await agent.written;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('later', false, OPERATION_C),
+      later
+    );
+    await settleAsync();
+
+    expect(getQueuePositions(later)).toEqual([
+      { position: 1, requestId: 'later', continuingOperations: continuingC }
+    ]);
+    setup.releaseC();
+    await Promise.all([agentPromise, laterPromise]);
+    expect(getQueuePositions(later)).toHaveLength(1);
+  });
+
+  it.each(['rebuild', 'list'])(
+    'are named as stopping to a %s request that cannot run alongside them',
+    async (commandName: string) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+      const agent: ITrackedClient = trackClient('agent', setup);
+      const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client
+      );
+      await agent.written;
+      await settleAsync();
+      const other: TestPhasedRequestClient = new TestPhasedRequestClient(commandName);
+      const otherPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        { ...createRequest(commandName, false, OPERATION_C), commandName },
+        other
+      );
+      await settleAsync();
+
+      expect(getQueuePositions(other)).toEqual([
+        { position: 1, requestId: commandName, continuingOperations: { ...continuingC, stopping: true } }
+      ]);
+      setup.releaseC();
+      await Promise.all([agentPromise, otherPromise]);
+      expect(getQueuePositions(other)).toHaveLength(1);
+    }
+  );
+
+  it('are named again to a build that already waited when the failed build returned early', async () => {
+    const failB: IDeferred = createDeferred();
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+      A_CONSUMES_B_AND_C,
+      false,
+      false,
+      false,
+      failB.promise
+    );
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await setup.startedC;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('later', false, OPERATION_C),
+      later
+    );
+    await settleAsync();
+    // The failed build still waits for its result, so the later build waits for another request.
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }]);
+
+    failB.resolve();
+    await agent.written;
+    await settleAsync();
+    expect(getQueuePositions(later)).toEqual([
+      { position: 1, requestId: 'later' },
+      { position: 1, requestId: 'later', continuingOperations: continuingC }
+    ]);
+    setup.releaseC();
+    await Promise.all([agentPromise, laterPromise]);
+    expect(getQueuePositions(later)).toHaveLength(2);
+  });
+
+  it.each(['rebuild', 'list'])(
+    'are named as stopping to a %s request that already waited when the failed build returned early',
+    async (commandName: string) => {
+      const failB: IDeferred = createDeferred();
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+        A_CONSUMES_B_AND_C,
+        false,
+        false,
+        false,
+        failB.promise
+      );
+      const agent: ITrackedClient = trackClient('agent', setup);
+      const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client
+      );
+      await setup.startedC;
+      await settleAsync();
+      const other: TestPhasedRequestClient = new TestPhasedRequestClient(commandName);
+      const otherPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        { ...createRequest(commandName, false, OPERATION_C), commandName },
+        other
+      );
+      await settleAsync();
+      // The failed build still waits for its result, so the request waits for another request.
+      expect(getQueuePositions(other)).toEqual([{ position: 1, requestId: commandName }]);
+
+      failB.resolve();
+      await agent.written;
+      await settleAsync();
+      expect(getQueuePositions(other)).toEqual([
+        { position: 1, requestId: commandName },
+        { position: 1, requestId: commandName, continuingOperations: { ...continuingC, stopping: true } }
+      ]);
+      setup.releaseC();
+      await agentPromise;
+      const otherResult: IDaemonPhasedRequestResult = await otherPromise;
+      expect(otherResult.exitCode).toBe(0);
+      expect(getQueuePositions(other)).toHaveLength(2);
+    }
+  );
+
+  it('are named to a waiting build once the last participant that waited for its result leaves', async () => {
+    const failB: IDeferred = createDeferred();
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+      A_CONSUMES_B_AND_C,
+      false,
+      false,
+      false,
+      failB.promise
+    );
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const departing: TestPhasedRequestClient = new TestPhasedRequestClient('departing');
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    const departingPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('departing', false, OPERATION_C),
+      departing
+    );
+    await setup.startedC;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('later', false, OPERATION_C),
+      later
+    );
+    await settleAsync();
+    failB.resolve();
+    await agent.written;
+    await settleAsync();
+    // The departing participant still waits for C, so the later build still waits for another request.
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }]);
+
+    departing.abortController.abort();
+    await departingPromise;
+    await settleAsync();
+    expect(getQueuePositions(later)).toEqual([
+      { position: 1, requestId: 'later' },
+      { position: 1, requestId: 'later', continuingOperations: continuingC }
+    ]);
+    setup.releaseC();
+    await Promise.all([agentPromise, laterPromise]);
+  });
+
+  it('are in the workspace status only while no request waits for the iteration', async () => {
+    const failB: IDeferred = createDeferred();
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+      A_CONSUMES_B_AND_C,
+      false,
+      false,
+      false,
+      failB.promise
+    );
+    const { session } = setup.fixture;
+    expect(describeContinuingOperations(session)).toBeUndefined();
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await setup.startedC;
+    await settleAsync();
+    expect(getSessionStatus(session).continuingOperations).toBeUndefined();
+
+    failB.resolve();
+    await agent.written;
+    await settleAsync();
+    expect(getSessionStatus(session)).toMatchObject({ continuingOperations: continuingC });
+
+    setup.releaseC();
+    await agentPromise;
+    expect(getSessionStatus(session).continuingOperations).toBeUndefined();
+  });
+
+  it('are counted across the requests that left them running, and the first three are named in name order', async () => {
+    const release: IDeferred = createDeferred();
+    const [operationA1, operationA2, operationV, operationW, operationX, operationY, operationZ] = [
+      'a1',
+      'a2',
+      'v',
+      'w',
+      'x',
+      'y',
+      'z'
+    ].map((name: string) => `project-${name} (_phase:test)`);
+    const slow = (): Promise<void> => release.promise;
+    const runners: Map<string, TestOperationRunner> = new Map([
+      [operationA1, new TestOperationRunner(operationA1)],
+      [operationA2, new TestOperationRunner(operationA2)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Failure)],
+      [operationV, new SilentTestOperationRunner(operationV, OperationStatus.Success, slow)],
+      ...[operationW, operationX, operationY, operationZ].map(
+        (name: string): [string, TestOperationRunner] => [
+          name,
+          new TestOperationRunner(name, OperationStatus.Success, slow)
+        ]
+      )
+    ]);
+    // The first build leaves V, X and Z running, and the second W and Y; V is silent.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      runners,
+      [
+        ...[OPERATION_B, operationV, operationX, operationZ].map(
+          (name: string): readonly [string, string] => [operationA1, name]
+        ),
+        ...[OPERATION_B, operationW, operationY].map((name: string): readonly [string, string] => [
+          operationA2,
+          name
+        ])
+      ],
+      { parallelism: runners.size }
+    );
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first: TestPhasedRequestClient = new TestPhasedRequestClient('first');
+    const second: TestPhasedRequestClient = new TestPhasedRequestClient('second');
+    const written: Promise<void[]> = Promise.all([whenResultWritten(first), whenResultWritten(second)]);
+    const resultPromises: Promise<IDaemonPhasedRequestResult>[] = [
+      router.executeAsync(createRequest('first', true, operationA1), first),
+      router.executeAsync(createRequest('second', true, operationA2), second)
+    ];
+    await written;
+    await settleAsync();
+
+    expect(describeContinuingOperations(fixture.session)).toEqual({
+      count: 4,
+      names: [operationW, operationX, operationY]
+    });
+    release.resolve();
+    await Promise.all(resultPromises);
+    expect(describeContinuingOperations(fixture.session)).toBeUndefined();
+  });
+
+  it('are named again, without the ones that ended, each time their number gets smaller', async () => {
+    const [operationE, operationF, operationU, operationX, operationY] = ['e', 'f', 'u', 'x', 'y'].map(
+      (name: string) => `project-${name} (_phase:test)`
+    );
+    const [startedU, startedX, startedY, releaseU, releaseX, releaseY] = [1, 2, 3, 4, 5, 6].map(() =>
+      createDeferred()
+    );
+    const ended: string[] = [];
+    const slow = (name: string, started: IDeferred, release: IDeferred): TestOperationRunner =>
+      new TestOperationRunner(name, OperationStatus.Success, async (): Promise<void> => {
+        started.resolve();
+        await release.promise;
+        ended.push(name);
+      });
+    const runners: Map<string, TestOperationRunner> = new Map([
+      [operationE, new TestOperationRunner(operationE)],
+      [operationF, new TestOperationRunner(operationF)],
+      [
+        OPERATION_B,
+        new TestOperationRunner(OPERATION_B, OperationStatus.Failure, async (): Promise<void> => {
+          await Promise.all([startedU.promise, startedX.promise, startedY.promise]);
+        })
+      ],
+      [operationU, slow(operationU, startedU, releaseU)],
+      [operationX, slow(operationX, startedX, releaseX)],
+      [operationY, slow(operationY, startedY, releaseY)]
+    ]);
+    // The failed build leaves X and Y running. U runs only for the request that leaves, and F waits for U.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      runners,
+      [
+        [operationE, OPERATION_B],
+        [operationE, operationX],
+        [operationE, operationY],
+        [operationF, operationU]
+      ],
+      { parallelism: runners.size }
+    );
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const agent: TestPhasedRequestClient = new TestPhasedRequestClient('agent');
+    const departing: TestPhasedRequestClient = new TestPhasedRequestClient('departing');
+    const agentWritten: Promise<void> = whenResultWritten(agent);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('agent', true, operationE),
+      agent
+    );
+    const departingPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('departing', false, operationF),
+      departing
+    );
+    await agentWritten;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('later', false, operationX),
+      later
+    );
+    await settleAsync();
+    departing.abortController.abort();
+    await departingPromise;
+    await settleAsync();
+    const bothRun: IDaemonRequestQueuePositionMessage['payload'] = {
+      position: 1,
+      requestId: 'later',
+      continuingOperations: { count: 2, names: [operationX, operationY] }
+    };
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun]);
+
+    // U ends, but the failed build didn't leave it running, so the later build waits for the same operations.
+    releaseU.resolve();
+    await settleAsync();
+    expect(ended).toEqual([operationU]);
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun]);
+
+    releaseX.resolve();
+    await settleAsync();
+    const yRuns: IDaemonRequestQueuePositionMessage['payload'] = {
+      position: 1,
+      requestId: 'later',
+      continuingOperations: { count: 1, names: [operationY] }
+    };
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun, yRuns]);
+    expect(getSessionStatus(fixture.session)).toMatchObject({ continuingOperations: { count: 1 } });
+
+    // Once the last one ends, the iteration ends, and the later build runs without another position.
+    releaseY.resolve();
+    await Promise.all([agentPromise, laterPromise]);
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun, yRuns]);
+    expect(getSessionStatus(fixture.session).continuingOperations).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
index e5422427b6f..84c34a0bab8 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
@@ -1,9 +1,13 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IOperationExecutionResult, _IOperationGraphEventSink } from '@microsoft/rush-lib';
+import {
+  type IOperationExecutionResult,
+  OperationStatus,
+  type _IOperationGraphEventSink
+} from '@microsoft/rush-lib';
 
-import { PhasedRequestEventMultiplexer } from '../PhasedRequestEventMultiplexer';
+import { type IRequestEventSink, PhasedRequestEventMultiplexer } from '../PhasedRequestEventMultiplexer';
 
 describe(PhasedRequestEventMultiplexer.name, () => {
   it('forwards stream closure before completion to workspace and request sinks', () => {
@@ -33,4 +37,218 @@ describe(PhasedRequestEventMultiplexer.name, () => {
       'request-completed'
     ]);
   });
+
+  describe('when an iteration starts', () => {
+    const records: IOperationExecutionResult[] = [
+      { operation: { name: 'beta' }, silent: false },
+      { operation: { name: 'alpha' }, silent: false },
+      { operation: { name: 'quiet' }, silent: true }
+    ] as unknown as IOperationExecutionResult[];
+
+    function createRequestSink(
+      announcements: unknown[]
+    ): _IOperationGraphEventSink & { onIterationScheduled(): void } {
+      return {
+        onIterationScheduled: () => {},
+        onIterationStarting: (...args: unknown[]) => announcements.push(args)
+      };
+    }
+
+    it('lets each sink that announces it do so, and announces all operations as activity to any other sink', () => {
+      const workspaceActivity: string[] = [];
+      const requestActivity: string[] = [];
+      const announcements: unknown[] = [];
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer({
+        onActivity: (text: string) => workspaceActivity.push(text)
+      });
+      multiplexer.subscribe(createRequestSink(announcements));
+      multiplexer.subscribe({ onIterationScheduled: () => {} });
+      multiplexer.subscribe({
+        onIterationScheduled: () => {},
+        onActivity: (text: string) => requestActivity.push(text)
+      });
+
+      multiplexer.onIterationStarting(records, 4, false);
+
+      const allOperationsAnnouncement: string[] = [
+        'Selected 2 operations:',
+        '  alpha',
+        '  beta',
+        '',
+        'Executing a maximum of 2 simultaneous processes...'
+      ];
+      expect(workspaceActivity).toEqual(allOperationsAnnouncement);
+      expect(requestActivity).toEqual(allOperationsAnnouncement);
+      expect(announcements).toEqual([[records, 4, false]]);
+    });
+
+    it('forwards it to a workspace sink that announces iterations itself', () => {
+      const workspaceActivity: string[] = [];
+      const workspaceAnnouncements: unknown[] = [];
+      const announcements: unknown[] = [];
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer({
+        onActivity: (text: string) => workspaceActivity.push(text),
+        onIterationStarting: (...args: unknown[]) => workspaceAnnouncements.push(args)
+      });
+      multiplexer.subscribe(createRequestSink(announcements));
+
+      multiplexer.onIterationStarting(records, 1, true);
+
+      expect(workspaceActivity).toEqual([]);
+      expect(workspaceAnnouncements).toEqual([[records, 1, true]]);
+      expect(announcements).toEqual([[records, 1, true]]);
+    });
+  });
+
+  describe('when a request sink subscribes to the executing iteration', () => {
+    function createRecord(
+      name: string,
+      status: OperationStatus,
+      dependencyCount: number = 0,
+      silent: boolean = false
+    ): IOperationExecutionResult {
+      return {
+        iterationId: 7,
+        operation: { name, dependencies: new Set(Array.from({ length: dependencyCount }, () => ({}))) },
+        silent,
+        status
+      } as unknown as IOperationExecutionResult;
+    }
+
+    function createRecordingSink(events: unknown[][]): IRequestEventSink {
+      return {
+        onIterationScheduled: (scheduled: Iterable<IOperationExecutionResult>) =>
+          events.push(['scheduled', Array.from(scheduled, (record) => record.operation.name)]),
+        onOperationRegistered: (operationId: string, silent: boolean, record, iterationId: number) =>
+          events.push(['registered', operationId, silent, record?.status, iterationId]),
+        onIterationStarting: (records, parallelism: number, quietMode: boolean) =>
+          events.push(['starting', parallelism, quietMode]),
+        onOperationStatusChanged: (record: IOperationExecutionResult, previousStatus: OperationStatus) =>
+          events.push(['status', record.operation.name, previousStatus, record.status])
+      };
+    }
+
+    it('throws if no iteration was scheduled', () => {
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+
+      expect(() => multiplexer.subscribeToCurrentIteration(createRecordingSink([]))).toThrow(
+        'No iteration was scheduled.'
+      );
+    });
+
+    it('replays the iteration, its start and each changed status, then forwards its events', () => {
+      const ready: IOperationExecutionResult = createRecord('ready', OperationStatus.Ready);
+      const waiting: IOperationExecutionResult = createRecord('waiting', OperationStatus.Waiting, 1);
+      const executing: IOperationExecutionResult = createRecord('executing', OperationStatus.Executing);
+      const unblocked: IOperationExecutionResult = createRecord('unblocked', OperationStatus.Ready, 2);
+      const done: IOperationExecutionResult = createRecord('done', OperationStatus.Success, 1, true);
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      multiplexer.onIterationScheduled([ready, waiting, executing, unblocked, done]);
+      multiplexer.onIterationStarting([ready, waiting, executing, unblocked, done], 3, true);
+      const events: unknown[][] = [];
+
+      multiplexer.subscribeToCurrentIteration(createRecordingSink(events));
+      multiplexer.onOperationStatusChanged(waiting, OperationStatus.Ready);
+
+      expect(events).toEqual([
+        ['scheduled', ['ready', 'waiting', 'executing', 'unblocked', 'done']],
+        ['registered', 'ready', false, OperationStatus.Ready, 7],
+        ['registered', 'waiting', false, OperationStatus.Waiting, 7],
+        ['registered', 'executing', false, OperationStatus.Executing, 7],
+        ['registered', 'unblocked', false, OperationStatus.Ready, 7],
+        ['registered', 'done', true, OperationStatus.Success, 7],
+        ['starting', 3, true],
+        ['status', 'executing', OperationStatus.Ready, OperationStatus.Executing],
+        ['status', 'unblocked', OperationStatus.Waiting, OperationStatus.Ready],
+        ['status', 'done', OperationStatus.Waiting, OperationStatus.Success],
+        ['status', 'waiting', OperationStatus.Ready, OperationStatus.Waiting]
+      ]);
+    });
+
+    it('does not announce an iteration that has not started', () => {
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      multiplexer.onIterationStarting([], 1, false);
+      multiplexer.onIterationScheduled([createRecord('ready', OperationStatus.Ready)]);
+      const events: unknown[][] = [];
+
+      multiplexer.subscribeToCurrentIteration(createRecordingSink(events));
+
+      expect(events).toEqual([
+        ['scheduled', ['ready']],
+        ['registered', 'ready', false, OperationStatus.Ready, 7]
+      ]);
+    });
+
+    it('announces the start as activity to a sink that does not announce iterations itself', () => {
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      const records: IOperationExecutionResult[] = [createRecord('alpha', OperationStatus.Ready)];
+      multiplexer.onIterationScheduled(records);
+      multiplexer.onIterationStarting(records, 2, false);
+      const activity: string[] = [];
+
+      multiplexer.subscribeToCurrentIteration({
+        onIterationScheduled: () => {},
+        onActivity: (text: string) => activity.push(text)
+      });
+
+      expect(activity).toEqual([
+        'Selected 1 operation:',
+        '  alpha',
+        '',
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+    });
+
+    it('returns a function that unsubscribes the sink', () => {
+      const record: IOperationExecutionResult = createRecord('ready', OperationStatus.Ready);
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      multiplexer.onIterationScheduled([record]);
+      const events: unknown[][] = [];
+
+      multiplexer.subscribeToCurrentIteration(createRecordingSink(events))();
+      multiplexer.onOperationStatusChanged(record, OperationStatus.Ready);
+
+      expect(events).toHaveLength(2);
+    });
+  });
+
+  describe(PhasedRequestEventMultiplexer.prototype.runForIterationRecords.name, () => {
+    it("forwards only the iteration's status changes to request sinks while the callback runs", () => {
+      const scheduled: IOperationExecutionResult = {
+        operation: { name: 'scheduled' }
+      } as IOperationExecutionResult;
+      const retained: IOperationExecutionResult = {
+        operation: { name: 'retained' }
+      } as IOperationExecutionResult;
+      const workspaceEvents: string[] = [];
+      const requestEvents: string[] = [];
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer({
+        onOperationStatusChanged: (record: IOperationExecutionResult) =>
+          workspaceEvents.push(record.operation.name)
+      });
+      multiplexer.subscribe({
+        onIterationScheduled: () => {},
+        onOperationStatusChanged: (record: IOperationExecutionResult) =>
+          requestEvents.push(record.operation.name)
+      });
+      multiplexer.onIterationScheduled([scheduled]);
+
+      const value: number = multiplexer.runForIterationRecords(() => {
+        multiplexer.onOperationStatusChanged(retained, OperationStatus.Success);
+        multiplexer.onOperationStatusChanged(scheduled, OperationStatus.Ready);
+        return 5;
+      });
+      expect(() =>
+        multiplexer.runForIterationRecords(() => {
+          multiplexer.onOperationStatusChanged(retained, OperationStatus.Success);
+          throw new Error('refused');
+        })
+      ).toThrow('refused');
+      multiplexer.onOperationStatusChanged(retained, OperationStatus.Success);
+
+      expect(value).toBe(5);
+      expect(workspaceEvents).toEqual(['retained', 'scheduled', 'retained', 'retained']);
+      expect(requestEvents).toEqual(['scheduled', 'retained']);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
index bb2bcb191d7..ac049354902 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
@@ -1,8 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type {
+  IDaemonEventEnvelope,
+  IDaemonOperationStatusChangedPayload
+} from '@rushstack/rush-daemon-protocol';
 import { OperationStatus, type IOperationExecutionResult } from '@microsoft/rush-lib';
+import {
+  type ICommandExecution,
+  setCommandExecution
+} from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
 
 import { PhasedRequestEventSink } from '../PhasedRequestEventSink';
 import { TestPhasedRequestClient } from './PhasedRequestRouterTestUtilities';
@@ -40,10 +47,7 @@ it('forwards unscoped and active activity while filtering other operation activi
     { stream: 'stdout', text: 'request summary' },
     { stream: 'stdout', text: 'active detail' }
   ]);
-  expect(activities.map(({ scope }) => scope)).toEqual([
-    undefined,
-    { operationId: ACTIVE_OPERATION }
-  ]);
+  expect(activities.map(({ scope }) => scope)).toEqual([undefined, { operationId: ACTIVE_OPERATION }]);
   expect(activities.every(({ required }) => required)).toBe(true);
 });
 
@@ -51,6 +55,17 @@ function createRecord(operationId: string, status: OperationStatus): IOperationE
   return { operation: { name: operationId }, silent: false, status } as unknown as IOperationExecutionResult;
 }
 
+function createCompletionRecord(
+  operationId: string,
+  status: OperationStatus,
+  isOperationCompleted: boolean
+): IOperationExecutionResult {
+  return {
+    ...createRecord(operationId, status),
+    isOperationCompleted
+  } as unknown as IOperationExecutionResult;
+}
+
 function createSettlingSink(onSettled: () => void): PhasedRequestEventSink {
   const client: TestPhasedRequestClient = new TestPhasedRequestClient();
   return new PhasedRequestEventSink({
@@ -93,4 +108,346 @@ it('does not report settlement when an active operation was aborted', () => {
   sink.onOperationCompleted(createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Success));
 
   expect(onSettled).not.toHaveBeenCalled();
-});
\ No newline at end of file
+});
+it('points at the full log of failed operations and operations with warnings, and only those', async () => {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const sink: PhasedRequestEventSink = createSink(client);
+  const logFilePaths = { text: '/repo/project-a/rush-logs/project-a._phase_test.log' };
+  for (const status of [
+    OperationStatus.Executing,
+    OperationStatus.Failure,
+    OperationStatus.SuccessWithWarning,
+    OperationStatus.Success
+  ]) {
+    const record: IOperationExecutionResult = {
+      ...createRecord(ACTIVE_OPERATION, status),
+      logFilePaths
+    } as unknown as IOperationExecutionResult;
+    sink.onOperationStatusChanged(record, OperationStatus.Ready);
+  }
+
+  await sink.flushAsync();
+
+  const payloads: unknown[] = client.writes
+    .map(({ event }) => event)
+    .filter((event) => event?.type === 'operationStatusChanged')
+    .map((event) => event?.payload);
+  expect(payloads).toEqual([
+    { operationId: ACTIVE_OPERATION, previousStatus: 'READY', status: 'EXECUTING' },
+    {
+      operationId: ACTIVE_OPERATION,
+      previousStatus: 'READY',
+      status: 'FAILURE',
+      logFilePath: logFilePaths.text
+    },
+    {
+      operationId: ACTIVE_OPERATION,
+      previousStatus: 'READY',
+      status: 'SUCCESS WITH WARNINGS',
+      logFilePath: logFilePaths.text
+    },
+    { operationId: ACTIVE_OPERATION, previousStatus: 'READY', status: 'SUCCESS' }
+  ]);
+});
+
+it('says which command failed or reported warnings, for an operation that has an incremental command', async () => {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const sink: PhasedRequestEventSink = createSink(client);
+  const incremental: ICommandExecution = { kind: 'incremental', hasIncrementalCommand: true };
+  const cases: ReadonlyArray<[OperationStatus, ICommandExecution | undefined]> = [
+    [OperationStatus.Failure, incremental],
+    [OperationStatus.SuccessWithWarning, incremental],
+    [OperationStatus.Failure, { kind: 'initial', hasIncrementalCommand: true }],
+    // The runner has no incremental command, so the initial command is the only one.
+    [OperationStatus.Failure, { kind: 'initial', hasIncrementalCommand: false }],
+    // No command ran, or the runner does not report its command.
+    [OperationStatus.Failure, undefined],
+    [OperationStatus.Success, incremental],
+    [OperationStatus.Executing, incremental]
+  ];
+  for (const [status, execution] of cases) {
+    const record: IOperationExecutionResult = createRecord(ACTIVE_OPERATION, status);
+    if (execution) {
+      setCommandExecution(record, execution);
+    }
+    sink.onOperationStatusChanged(record, OperationStatus.Ready);
+  }
+
+  await sink.flushAsync();
+
+  const payloads: IDaemonOperationStatusChangedPayload[] = client.writes
+    .map(({ event }) => event)
+    .filter((event) => event?.type === 'operationStatusChanged')
+    .map((event) => event?.payload as IDaemonOperationStatusChangedPayload);
+  expect(payloads.map(({ status, commandKind }) => [status, commandKind])).toEqual([
+    ['FAILURE', 'incremental'],
+    ['SUCCESS WITH WARNINGS', 'incremental'],
+    ['FAILURE', 'initial'],
+    ['FAILURE', undefined],
+    ['FAILURE', undefined],
+    ['SUCCESS', undefined],
+    ['EXECUTING', undefined]
+  ]);
+  expect(payloads.filter((payload) => Object.keys(payload).includes('commandKind'))).toHaveLength(3);
+});
+
+const TARGET_OPERATION: string = 'project-a (_phase:test)';
+const FAILED_OPERATION: string = 'project-b (_phase:test)';
+const RUNNING_OPERATION: string = 'project-c (_phase:test)';
+const QUEUED_OPERATION: string = 'project-d (_phase:test)';
+
+function createEarlyFailureSink(onSettled: (unfinishedOperations: number) => void): PhasedRequestEventSink {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  return new PhasedRequestEventSink({
+    activeOperationIds: new Set([TARGET_OPERATION, FAILED_OPERATION, RUNNING_OPERATION, QUEUED_OPERATION]),
+    client,
+    getNextSequence: () => client.getNextEventSequence(),
+    onWriteFailure: () => undefined,
+    rushVersion: '5.178.1',
+    earlyFailure: { targetOperationIds: new Set([TARGET_OPERATION]), onSettled }
+  });
+}
+
+function setStatus(record: IOperationExecutionResult, status: OperationStatus): void {
+  (record as { status: OperationStatus }).status = status;
+}
+
+/** Schedules the records, then fails FAILED_OPERATION, which blocks the target while RUNNING_OPERATION runs. */
+function failWhileRunning(
+  sink: PhasedRequestEventSink,
+  queued: IOperationExecutionResult,
+  beforeFailure?: () => void
+): void {
+  const target: IOperationExecutionResult = createRecord(TARGET_OPERATION, OperationStatus.Waiting);
+  const failed: IOperationExecutionResult = createRecord(FAILED_OPERATION, OperationStatus.Executing);
+  sink.onIterationScheduled([
+    target,
+    failed,
+    createRecord(RUNNING_OPERATION, OperationStatus.Executing),
+    queued
+  ]);
+  beforeFailure?.();
+  setStatus(failed, OperationStatus.Failure);
+  sink.onOperationStatusChanged(failed, OperationStatus.Executing);
+  // Blocked operations complete only when the iteration ends.
+  setStatus(target, OperationStatus.Blocked);
+  sink.onOperationCompleted(failed);
+}
+
+describe('the early failure offer', () => {
+  it('counts the unfinished operations that are not silent', () => {
+    const onSettled: jest.Mock = jest.fn();
+    // Like a phase that the project does not define: the result does not list it while it is unfinished.
+    const silent: IOperationExecutionResult = {
+      ...createRecord(QUEUED_OPERATION, OperationStatus.Ready),
+      silent: true
+    } as IOperationExecutionResult;
+
+    failWhileRunning(createEarlyFailureSink(onSettled), silent);
+
+    expect(onSettled.mock.calls).toEqual([[1]]);
+  });
+
+  it('offers a failed result again when asked to, once it was offered and until the sink settles', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createEarlyFailureSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(TARGET_OPERATION, OperationStatus.Blocked),
+      createRecord(FAILED_OPERATION, OperationStatus.Failure),
+      createRecord(RUNNING_OPERATION, OperationStatus.Executing),
+      createRecord(QUEUED_OPERATION, OperationStatus.Success)
+    ]);
+    sink.reofferEarlyFailure();
+    expect(onSettled).not.toHaveBeenCalled();
+
+    sink.settleIfIdle();
+    sink.reofferEarlyFailure();
+    expect(onSettled.mock.calls).toEqual([[1], [1]]);
+
+    sink.onOperationCompleted(createRecord(RUNNING_OPERATION, OperationStatus.Success));
+    sink.reofferEarlyFailure();
+    expect(onSettled.mock.calls).toEqual([[1], [1]]);
+    expect(sink.activeOperationsSettled).toBe(true);
+  });
+
+  it('offers nothing once one of its operations was aborted, even before that operation completed', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const queued: IOperationExecutionResult = createRecord(QUEUED_OPERATION, OperationStatus.Ready);
+
+    // An aborted iteration marks the queued operations that it skips as aborted at once, but they complete only
+    // when the iteration ends, after the operations that were already running.
+    failWhileRunning(createEarlyFailureSink(onSettled), queued, () =>
+      setStatus(queued, OperationStatus.Aborted)
+    );
+
+    expect(onSettled).not.toHaveBeenCalled();
+  });
+});
+
+describe('a sink that subscribes to an iteration that is already executing', () => {
+  it('settles at once when none of its operations is unfinished, and says it settled', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(ACTIVE_OPERATION, OperationStatus.Success),
+      createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.FromCache),
+      createRecord(OTHER_OPERATION, OperationStatus.Executing)
+    ]);
+    expect(sink.activeOperationsSettled).toBe(false);
+
+    sink.settleIfIdle();
+    sink.settleIfIdle();
+    sink.onOperationCompleted(createRecord(ACTIVE_OPERATION, OperationStatus.Success));
+
+    expect(onSettled).toHaveBeenCalledTimes(1);
+    expect(sink.activeOperationsSettled).toBe(true);
+    sink.onIterationScheduled([createRecord(ACTIVE_OPERATION, OperationStatus.Waiting)]);
+    expect(sink.activeOperationsSettled).toBe(false);
+  });
+
+  it('waits for its unfinished operations to complete', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(ACTIVE_OPERATION, OperationStatus.Success),
+      createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Executing)
+    ]);
+
+    sink.settleIfIdle();
+    expect(onSettled).not.toHaveBeenCalled();
+    expect(sink.activeOperationsSettled).toBe(false);
+    sink.onOperationCompleted(createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Success));
+
+    expect(onSettled).toHaveBeenCalledTimes(1);
+    expect(sink.activeOperationsSettled).toBe(true);
+  });
+
+  it('waits for terminal statuses to emit completion before settling', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createCompletionRecord(ACTIVE_OPERATION, OperationStatus.Success, false),
+      createCompletionRecord(SECOND_ACTIVE_OPERATION, OperationStatus.SuccessWithWarning, true)
+    ]);
+
+    sink.settleIfIdle();
+    expect(onSettled).not.toHaveBeenCalled();
+    expect(sink.activeOperationsSettled).toBe(false);
+    sink.onOperationCompleted(createRecord(ACTIVE_OPERATION, OperationStatus.SuccessWithWarning));
+
+    expect(onSettled).toHaveBeenCalledTimes(1);
+    expect(sink.activeOperationsSettled).toBe(true);
+  });
+
+  it('leaves the result of an aborted iteration to the batch', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(ACTIVE_OPERATION, OperationStatus.Success),
+      createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Aborted)
+    ]);
+
+    sink.settleIfIdle();
+
+    expect(onSettled).not.toHaveBeenCalled();
+    expect(sink.activeOperationsSettled).toBe(false);
+  });
+
+  it('offers a failed result once its targets are finished', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createEarlyFailureSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(TARGET_OPERATION, OperationStatus.Blocked),
+      createRecord(FAILED_OPERATION, OperationStatus.Failure),
+      createRecord(RUNNING_OPERATION, OperationStatus.Executing),
+      createRecord(QUEUED_OPERATION, OperationStatus.Success)
+    ]);
+
+    sink.settleIfIdle();
+
+    expect(onSettled.mock.calls).toEqual([[1]]);
+    expect(sink.activeOperationsSettled).toBe(false);
+  });
+});
+
+describe('the iteration announcement', () => {
+  async function getActivityTextsAsync(
+    client: TestPhasedRequestClient,
+    sink: PhasedRequestEventSink
+  ): Promise<string[]> {
+    await sink.flushAsync();
+    return client.writes.flatMap(({ event }) =>
+      event?.type === 'activityChanged' ? [(event.payload as { text: string }).text] : []
+    );
+  }
+
+  function createAnnouncingSink(client: TestPhasedRequestClient): PhasedRequestEventSink {
+    return new PhasedRequestEventSink({
+      activeOperationIds: new Set([ACTIVE_OPERATION, SECOND_ACTIVE_OPERATION]),
+      client,
+      getNextSequence: () => client.getNextEventSequence(),
+      onWriteFailure: () => undefined,
+      rushVersion: '5.178.1'
+    });
+  }
+
+  it("lists only the client's own operations that are not silent, and caps the processes at their count", async () => {
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+    const sink: PhasedRequestEventSink = createAnnouncingSink(client);
+
+    sink.onIterationStarting(
+      [
+        createRecord(OTHER_OPERATION, OperationStatus.Ready),
+        createRecord(ACTIVE_OPERATION, OperationStatus.Ready),
+        { ...createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Ready), silent: true }
+      ] as IOperationExecutionResult[],
+      8,
+      false
+    );
+
+    expect(await getActivityTextsAsync(client, sink)).toEqual([
+      'Selected 1 operation:',
+      `  ${ACTIVE_OPERATION}`,
+      '',
+      'Executing a maximum of 1 simultaneous processes...'
+    ]);
+  });
+
+  it('caps the processes at the parallelism and omits the listing in quiet mode', async () => {
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+    const sink: PhasedRequestEventSink = createAnnouncingSink(client);
+
+    sink.onIterationStarting(
+      [
+        createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Ready),
+        createRecord(OTHER_OPERATION, OperationStatus.Ready),
+        createRecord(ACTIVE_OPERATION, OperationStatus.Ready)
+      ],
+      1,
+      true
+    );
+
+    expect(await getActivityTextsAsync(client, sink)).toEqual([
+      'Executing a maximum of 1 simultaneous processes...'
+    ]);
+  });
+
+  it.each([false, true])(
+    'announces nothing when the client has nothing to run in the iteration (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const sink: PhasedRequestEventSink = createAnnouncingSink(client);
+
+      sink.onIterationStarting(
+        [
+          createRecord(OTHER_OPERATION, OperationStatus.Ready),
+          { ...createRecord(ACTIVE_OPERATION, OperationStatus.Ready), silent: true }
+        ] as IOperationExecutionResult[],
+        8,
+        quietMode
+      );
+
+      expect(await getActivityTextsAsync(client, sink)).toEqual([]);
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts b/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
new file mode 100644
index 00000000000..4e6bba8b29b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
@@ -0,0 +1,629 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IOperationExecutionResult, IOperationGraphRequestResult } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonEventFrame,
+  decodeDaemonLogChunk,
+  type IDaemonEventEnvelope,
+  type IDaemonPhasedOperationSelection,
+  type IDaemonPhasedRequest,
+  type IDaemonPhasedRequestResult
+} from '@rushstack/rush-daemon-protocol';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture,
+  type ITestClientWrite,
+  type ITestRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+
+jest.setTimeout(30_000);
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_D: string = 'project-d (_phase:test)';
+const BUILD_DURATION_LINE: RegExp = /^rush build \(\d+\.\d\d seconds\)$/m;
+
+interface IRecordedRequest {
+  readonly commandName: string;
+  readonly environment: Readonly<Record<string, string | undefined>>;
+  readonly requestId: string | undefined;
+  readonly results: ReadonlyMap<string, IOperationExecutionResult>;
+  readonly status: OperationStatus;
+}
+
+function createRequest(
+  requestId: string,
+  commandName: string,
+  operationIds: ReadonlyArray<string>,
+  environment: Record<string, string> = {}
+): IDaemonPhasedRequest {
+  return {
+    commandName,
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment,
+    operationSelection: operationIds.map(
+      (operationId: string): IDaemonPhasedOperationSelection => ({ enabledState: true, operationId })
+    ),
+    requestId
+  };
+}
+
+function createFixture(): ITestRoutingFixture {
+  return createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+      [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+    ]),
+    [[OPERATION_B, OPERATION_A]]
+  );
+}
+
+/** Records each request that reaches the hook, and writes `hook-<requestId>` to the request's terminal. */
+function recordRequests(
+  fixture: ITestRoutingFixture,
+  onRequest?: (request: IOperationGraphRequestResult) => void
+): IRecordedRequest[] {
+  const requests: IRecordedRequest[] = [];
+  fixture.session.operationGraph.hooks.afterExecuteRequestAsync.tapPromise(
+    'test',
+    async (request: IOperationGraphRequestResult): Promise<void> => {
+      requests.push({
+        commandName: request.commandName,
+        environment: request.environment,
+        requestId: request.requestId,
+        results: new Map(
+          Array.from(request.operationResults, ([operation, result]) => [operation.name, result])
+        ),
+        status: request.status
+      });
+      request.terminal.writeLine(`hook-${request.requestId}`);
+      onRequest?.(request);
+    }
+  );
+  return requests;
+}
+
+function getRequest(requests: ReadonlyArray<IRecordedRequest>, requestId: string): IRecordedRequest {
+  const request: IRecordedRequest | undefined = requests.find((r) => r.requestId === requestId);
+  if (!request) {
+    throw new Error(`The hook did not receive request "${requestId}".`);
+  }
+  return request;
+}
+
+function getActivity(client: TestPhasedRequestClient, stream: 'stdout' | 'stderr'): string {
+  let text: string = '';
+  for (const { event } of client.writes) {
+    const payload: { stream?: string; text?: string } | undefined =
+      event?.type === 'activityChanged' ? (event.payload as { stream?: string; text?: string }) : undefined;
+    if (payload?.stream === stream) {
+      text += payload.text;
+    }
+  }
+  return text;
+}
+
+interface IActivity {
+  readonly severity?: string;
+  readonly stream?: string;
+  readonly text?: string;
+}
+
+/** The request's activity events, in the order that its client received them. */
+function getActivities(client: TestPhasedRequestClient): IActivity[] {
+  const activities: IActivity[] = [];
+  for (const { event } of client.writes) {
+    if (event?.type === 'activityChanged') {
+      const { severity, stream, text } = event.payload as IActivity;
+      activities.push({ severity, stream, text });
+    }
+  }
+  return activities;
+}
+
+/** Expects the hook's line to follow the status tables and to precede the duration line. */
+function expectHookOutputBetween(
+  stdout: string,
+  statusBanner: string,
+  hookLine: string,
+  durationLine: RegExp
+): void {
+  const bannerIndex: number = stdout.indexOf(statusBanner);
+  const hookIndex: number = stdout.indexOf(`${hookLine}\n`);
+  expect(bannerIndex).toBeGreaterThanOrEqual(0);
+  expect(hookIndex).toBeGreaterThan(bannerIndex);
+  expect(stdout.search(durationLine)).toBeGreaterThan(hookIndex);
+}
+
+describe('afterExecuteRequestAsync in the phased request router', () => {
+  it("invokes the hook once for each coalesced request, with that request's own results and environment", async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const [resultA, resultC] = await Promise.all([
+        router.executeAsync(createRequest('a', 'build', [OPERATION_A], { ORIGIN: 'client-a' }), clientA),
+        router.executeAsync(createRequest('c', 'build', [OPERATION_C], { ORIGIN: 'client-c' }), clientC)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(resultA).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(resultC).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(requests).toHaveLength(2);
+
+      const requestA: IRecordedRequest = getRequest(requests, 'a');
+      expect(requestA).toMatchObject({ commandName: 'build', status: OperationStatus.Success });
+      expect(requestA.environment).toEqual({ ORIGIN: 'client-a' });
+      expect(Array.from(requestA.results.keys())).toEqual([OPERATION_A]);
+      expect(requestA.results.get(OPERATION_A)?.status).toBe(OperationStatus.Success);
+
+      const requestC: IRecordedRequest = getRequest(requests, 'c');
+      expect(requestC).toMatchObject({ commandName: 'build', status: OperationStatus.Success });
+      expect(requestC.environment).toEqual({ ORIGIN: 'client-c' });
+      expect(Array.from(requestC.results.keys())).toEqual([OPERATION_C]);
+      expect(requestC.results.get(OPERATION_C)?.status).toBe(OperationStatus.Success);
+
+      // Each request's terminal writes only into that request's output, between its summary and duration line.
+      const stdoutA: string = getActivity(clientA, 'stdout');
+      const stdoutC: string = getActivity(clientC, 'stdout');
+      expect(stdoutA).not.toContain('hook-c');
+      expect(stdoutC).not.toContain('hook-a');
+      expectHookOutputBetween(stdoutA, '==[ SUCCESS: 1 operation ]==', 'hook-a', BUILD_DURATION_LINE);
+      expectHookOutputBetween(stdoutC, '==[ SUCCESS: 1 operation ]==', 'hook-c', BUILD_DURATION_LINE);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it("passes each request's own command name", async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(createRequest('a', 'build', [OPERATION_A]), new TestPhasedRequestClient());
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result = await router.executeAsync(createRequest('c', 'test', [OPERATION_C]), client);
+
+      expect(result).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(requests.map(({ commandName, requestId }) => ({ commandName, requestId }))).toEqual([
+        { commandName: 'build', requestId: 'a' },
+        { commandName: 'test', requestId: 'c' }
+      ]);
+      expectHookOutputBetween(
+        getActivity(client, 'stdout'),
+        '==[ SUCCESS: 1 operation ]==',
+        'hook-c',
+        /^rush test \(\d+\.\d\d seconds\)$/m
+      );
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('invokes the hook with Skipped results for a warm request that needs no iteration', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(createRequest('cold', 'build', [OPERATION_B]), new TestPhasedRequestClient());
+      let iterations: number = 0;
+      fixture.session.operationGraph.hooks.afterExecuteIterationAsync.tap(
+        'test',
+        (status: OperationStatus) => {
+          iterations++;
+          return status;
+        }
+      );
+      // Simulate the incremental plugin disabling every operation whose inputs did not change.
+      fixture.graph.hooks.configureIteration.tap('test', (records) => {
+        for (const record of records.values()) {
+          record.enabled = false;
+        }
+      });
+      const requests: IRecordedRequest[] = recordRequests(fixture);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+
+      const result = await router.executeAsync(createRequest('warm', 'build', [OPERATION_B]), client);
+
+      expect(result).toMatchObject({ exitCode: 0, scheduled: false });
+      expect(iterations).toBe(0);
+      expect(requests).toHaveLength(1);
+      const warm: IRecordedRequest = getRequest(requests, 'warm');
+      expect(warm.status).toBe(OperationStatus.Success);
+      expect(Array.from(warm.results.keys())).toEqual([OPERATION_A, OPERATION_B]);
+      for (const upToDate of warm.results.values()) {
+        expect(upToDate).toMatchObject({
+          error: undefined,
+          logFilePaths: undefined,
+          silent: false,
+          status: OperationStatus.Skipped
+        });
+        expect(upToDate.stopwatch).toMatchObject({ duration: 0, endTime: undefined, startTime: undefined });
+        expect(upToDate.problemCollector.problems.size).toBe(0);
+      }
+      // The results that other requests and the next iteration read are unchanged.
+      const graphStatuses: Map<string, OperationStatus> = new Map(
+        Array.from(fixture.session.operationGraph.resultByOperation, ([operation, graphResult]) => [
+          operation.name,
+          graphResult.status
+        ])
+      );
+      expect(graphStatuses.get(OPERATION_A)).toBe(OperationStatus.Success);
+      expect(graphStatuses.get(OPERATION_B)).toBe(OperationStatus.Success);
+      expectHookOutputBetween(
+        getActivity(client, 'stdout'),
+        '==[ SKIPPED: 2 operations ]==',
+        'hook-warm',
+        BUILD_DURATION_LINE
+      );
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('fails only the request whose tap throws', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const requests: IRecordedRequest[] = recordRequests(fixture, (request: IOperationGraphRequestResult) => {
+      if (request.requestId === 'a') {
+        throw new Error('summary-write-failed');
+      }
+    });
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const [resultA, resultC] = await Promise.all([
+        router.executeAsync(createRequest('a', 'build', [OPERATION_A]), clientA),
+        router.executeAsync(createRequest('c', 'build', [OPERATION_C]), clientC)
+      ]);
+
+      expect(requests.map(({ requestId }) => requestId).sort()).toEqual(['a', 'c']);
+      expect(resultA).toMatchObject({
+        errorMessage: expect.stringContaining('summary-write-failed'),
+        exitCode: 1,
+        outcome: 'failure'
+      });
+      expect(getActivity(clientA, 'stderr')).toMatch(/^rush build - Errors! \(\d+\.\d\d seconds\)$/m);
+      expect(getActivity(clientA, 'stdout')).not.toMatch(BUILD_DURATION_LINE);
+      expect(resultC).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(getActivity(clientC, 'stdout')).toMatch(BUILD_DURATION_LINE);
+      expect(getActivity(clientC, 'stderr')).not.toContain('Errors!');
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it("keeps the severity of a tap's warnings and errors, which the summary's own lines do not have", async () => {
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Failure)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ]),
+      [[OPERATION_B, OPERATION_A]]
+    );
+    recordRequests(fixture, (request: IOperationGraphRequestResult) => {
+      request.terminal.writeWarningLine('hook-warning');
+      request.terminal.writeErrorLine('hook-error');
+      request.terminal.writeLine('hook-after');
+    });
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result: IDaemonPhasedRequestResult = await router.executeAsync(
+        createRequest('a', 'build', [OPERATION_A]),
+        client
+      );
+
+      expect(result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      const activities: IActivity[] = getActivities(client);
+      // Agent output shows only activity with a severity.
+      expect(activities.filter(({ severity }) => severity !== undefined)).toEqual([
+        { severity: 'warning', stream: 'stderr', text: 'hook-warning\n' },
+        { severity: 'error', stream: 'stderr', text: 'hook-error\n' }
+      ]);
+      const texts: string[] = activities.map(({ text }) => text ?? '');
+      const failedIndex: number = texts.findIndex((text: string) => text.includes('Operations failed.'));
+      const warningIndex: number = texts.indexOf('hook-warning\n');
+      const durationIndex: number = texts.findIndex((text: string) => BUILD_DURATION_LINE.test(text));
+      expect(activities[failedIndex]?.stream).toBe('stderr');
+      expect(warningIndex).toBeGreaterThan(failedIndex);
+      expect(durationIndex).toBeGreaterThan(warningIndex);
+      expect(texts.indexOf('hook-after\n')).toBeGreaterThan(texts.indexOf('hook-error\n'));
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports the warning of a tap that then throws with its severity, before the errors line', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    recordRequests(fixture, (request: IOperationGraphRequestResult) => {
+      request.terminal.writeWarningLine('hook-warning');
+      throw new Error('summary-write-failed');
+    });
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result: IDaemonPhasedRequestResult = await router.executeAsync(
+        createRequest('a', 'build', [OPERATION_A]),
+        client
+      );
+
+      expect(result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      const activities: IActivity[] = getActivities(client);
+      const warningIndex: number = activities.findIndex(({ text }) => text === 'hook-warning\n');
+      const errorsIndex: number = activities.findIndex(({ text }) =>
+        text?.startsWith('rush build - Errors!')
+      );
+      expect(activities[warningIndex]).toEqual({
+        severity: 'warning',
+        stream: 'stderr',
+        text: 'hook-warning\n'
+      });
+      expect(errorsIndex).toBeGreaterThan(warningIndex);
+      expect(activities[errorsIndex]).toEqual({
+        stream: 'stderr',
+        text: expect.stringMatching(/^rush build - Errors! \(\d+\.\d\d seconds\)\n$/)
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('invokes the hook once for a request that returns early, with only the results that are final', async () => {
+    let startC: () => void = () => undefined;
+    const startedC: Promise<void> = new Promise((resolve) => {
+      startC = resolve;
+    });
+    let releaseC: () => void = () => undefined;
+    const releasedC: Promise<void> = new Promise((resolve) => {
+      releaseC = resolve;
+    });
+    let buildsOfB: number = 0;
+    let buildsOfC: number = 0;
+    // A consumes B and D, and D consumes C. In the second build, B fails once C runs, so C runs and D waits.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+        [
+          OPERATION_B,
+          new TestOperationRunner(
+            OPERATION_B,
+            OperationStatus.Success,
+            async (): Promise<OperationStatus> => {
+              if (++buildsOfB === 1) {
+                return OperationStatus.Success;
+              }
+              await startedC;
+              return OperationStatus.Failure;
+            }
+          )
+        ],
+        [
+          OPERATION_C,
+          new TestOperationRunner(OPERATION_C, OperationStatus.Success, async (): Promise<void> => {
+            if (++buildsOfC > 1) {
+              startC();
+              await releasedC;
+            }
+          })
+        ],
+        [OPERATION_D, new TestOperationRunner(OPERATION_D)]
+      ]),
+      [
+        [OPERATION_A, OPERATION_B],
+        [OPERATION_A, OPERATION_D],
+        [OPERATION_D, OPERATION_C]
+      ],
+      { parallelism: 2 }
+    );
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      // The first build leaves a successful result for every operation, which the second build runs again.
+      await expect(
+        router.executeAsync(createRequest('cold', 'build', [OPERATION_A]), new TestPhasedRequestClient())
+      ).resolves.toMatchObject({ exitCode: 0 });
+      const requests: IRecordedRequest[] = recordRequests(fixture);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      let onWritten: () => void = () => undefined;
+      const written: Promise<void> = new Promise((resolve) => {
+        onWritten = resolve;
+      });
+      client.onWriteAsync = async (write: ITestClientWrite): Promise<void> => {
+        if (write.result) {
+          onWritten();
+        }
+      };
+      const resultPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        { ...createRequest('early', 'build', [OPERATION_A]), returnEarlyOnFailure: true },
+        client
+      );
+      await written;
+
+      expect(requests).toHaveLength(1);
+      const early: IRecordedRequest = getRequest(requests, 'early');
+      expect(early.status).toBe(OperationStatus.Failure);
+      // C still runs and D has not started, so neither has a result to report yet.
+      expect(
+        Object.fromEntries(Array.from(early.results, ([name, result]) => [name, result.status]))
+      ).toEqual({
+        [OPERATION_A]: OperationStatus.Blocked,
+        [OPERATION_B]: OperationStatus.Failure
+      });
+      // The summary that the client prints lists the same operations.
+      const stdout: string = getActivity(client, 'stdout');
+      expect(stdout).not.toContain('SKIPPED');
+      expectHookOutputBetween(stdout, '==[ BLOCKED: 1 operation ]==', 'hook-early', BUILD_DURATION_LINE);
+
+      releaseC();
+      await expect(resultPromise).resolves.toMatchObject({ exitCode: 1 });
+      expect(requests).toHaveLength(1);
+    } finally {
+      releaseC();
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('does not invoke the hook for a request whose iteration failed', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    fixture.session.operationGraph.hooks.beforeExecuteIterationAsync.tapPromise(
+      'test',
+      async (): Promise<undefined> => {
+        throw new Error('iteration-failed');
+      }
+    );
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result = await new PhasedRequestRouter(fixture.session).executeAsync(
+        createRequest('broken', 'build', [OPERATION_A]),
+        client
+      );
+
+      expect(result).toMatchObject({
+        errorMessage: expect.stringContaining('iteration-failed'),
+        exitCode: 1
+      });
+      expect(requests).toEqual([]);
+      expect(getActivity(client, 'stderr')).toMatch(/^rush build - Errors! \(\d+\.\d\d seconds\)$/m);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('does not invoke the hook for a request that its client cancels', async () => {
+    let markStarted: () => void = () => undefined;
+    const started: Promise<void> = new Promise((resolve) => {
+      markStarted = resolve;
+    });
+    let release: () => void = () => undefined;
+    const released: Promise<void> = new Promise((resolve) => {
+      release = resolve;
+    });
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [
+          OPERATION_A,
+          new TestOperationRunner(OPERATION_A, OperationStatus.Success, async (): Promise<void> => {
+            markStarted();
+            await released;
+          })
+        ]
+      ])
+    );
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const resultPromise: Promise<IDaemonPhasedRequestResult> = new PhasedRequestRouter(
+        fixture.session
+      ).executeAsync(createRequest('cancelled', 'build', [OPERATION_A]), client);
+      await started;
+      client.abortController.abort();
+      release();
+
+      await expect(resultPromise).resolves.toMatchObject({ exitCode: 1, outcome: 'aborted' });
+      expect(requests.map(({ requestId }) => requestId)).toEqual([]);
+    } finally {
+      release();
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
+
+function getProjectStatuses(request: IOperationGraphRequestResult): Record<string, OperationStatus> {
+  return Object.fromEntries(
+    Array.from(request.operationResults, ([operation, result]) => [
+      operation.associatedProject.packageName,
+      result.status
+    ])
+  );
+}
+
+/** The text that a request's terminal wrote, whether it arrived as activity events or as log chunks. */
+function getRequestOutput(exchange: ITerminalExchange): string {
+  let text: string = '';
+  for (const frame of exchange.frames) {
+    if (frame.kind === DaemonFrameType.event) {
+      const event: IDaemonEventEnvelope = decodeDaemonEventFrame(frame.payload);
+      if (event.type === 'activityChanged') {
+        text += (event.payload as { text?: string }).text ?? '';
+      }
+    } else if (frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr) {
+      text += Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString();
+    }
+  }
+  return text;
+}
+
+describe('afterExecuteRequestAsync on a native engine', () => {
+  it('invokes the hook once for each request, including a warm request that needs no iteration', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      expect((await runAsync(fixture, 'cold', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      const requests: IOperationGraphRequestResult[] = [];
+      fixture.session.operationGraph!.hooks.afterExecuteRequestAsync.tapPromise(
+        'test',
+        async (request: IOperationGraphRequestResult): Promise<void> => {
+          requests.push(request);
+          request.terminal.writeLine(`hook-${request.requestId}-${request.status}`);
+        }
+      );
+
+      const warm: ITerminalExchange = await runAsync(fixture, 'warm', ['build']);
+      expect(warm.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/c/input.txt'), 'two');
+      const changed: ITerminalExchange = await runAsync(fixture, 'changed', ['build']);
+      expect(changed.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+
+      expect([...runs(fixture)].sort()).toEqual(['a:one:', 'b:one:', 'c:one:', 'c:two:']);
+      // The engine does not also invoke the hook from its iteration, which would report the changed request twice.
+      expect(
+        requests.map(({ commandName, requestId, status }) => ({ commandName, requestId, status }))
+      ).toEqual([
+        { commandName: 'build', requestId: 'warm', status: OperationStatus.Success },
+        { commandName: 'build', requestId: 'changed', status: OperationStatus.Success }
+      ]);
+      expect(getProjectStatuses(requests[0])).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Skipped
+      });
+      expect(getProjectStatuses(requests[1])).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+      expect(getRequestOutput(warm)).toContain('hook-warm-SUCCESS\n');
+      expect(getRequestOutput(changed)).toContain('hook-changed-SUCCESS\n');
+      expect(getRequestOutput(changed)).not.toContain('hook-warm');
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
new file mode 100644
index 00000000000..de3ab8d907b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
@@ -0,0 +1,1695 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import type {
+  IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
+  IDaemonRequestAdmissionOptions
+} from '@rushstack/rush-daemon-protocol';
+import { OperationStatus, RushConfiguration } from '@microsoft/rush-lib';
+import type {
+  IInputsSnapshot,
+  IOperationGraphIterationOptions,
+  IPhasedCommandEngineRequestSettings,
+  Operation
+} from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
+import { RequestExclusivityClass } from '../RequestScheduler';
+import type { IRequestLease, RequestScheduler } from '../RequestScheduler';
+import type {
+  IPeekWorkspaceInvalidationsOptions,
+  IWorkspaceInvalidationPeek
+} from '../WorkspaceEngineComponentFactory';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import { TEST_REPO_ROOT } from './TestWorkspaceSession';
+
+const JOIN_VARIABLE: string = 'RUSH_DAEMON_JOIN_RUNNING_BATCH';
+const COBUILD_VARIABLE: string = 'RUSH_COBUILD_CONTEXT_ID';
+/** A variable that a request's environment passes to the operations that are attributed to it. */
+const SESSION_VARIABLE: string = 'COPILOT_AGENT_SESSION_ID';
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_IDS: ReadonlyArray<string> = [OPERATION_A, OPERATION_B, OPERATION_C];
+
+function restoreVariable(name: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+}
+
+/**
+ * Loads the test repository's configuration as a daemon started with `value` as the value of the join variable
+ * loads it, so that the checks of the Rush environment and of the daemon configuration apply to the variable.
+ */
+function loadConfiguration(value: string): RushConfiguration {
+  const previousValue: string | undefined = process.env[JOIN_VARIABLE];
+  process.env[JOIN_VARIABLE] = value;
+  try {
+    return RushConfiguration.loadFromConfigurationFile(path.join(TEST_REPO_ROOT, 'rush.json'));
+  } finally {
+    restoreVariable(JOIN_VARIABLE, previousValue);
+  }
+}
+
+const JOIN_CONFIGURATION: RushConfiguration = loadConfiguration('1');
+const NO_JOIN_CONFIGURATION: RushConfiguration = loadConfiguration('0');
+
+interface IDeferred<T = void> {
+  readonly promise: Promise<T>;
+  readonly resolve: (value: T) => void;
+}
+
+function createDeferred<T = void>(): IDeferred<T> {
+  let resolvePromise: ((value: T) => void) | undefined;
+  const promise: Promise<T> = new Promise<T>((resolve) => {
+    resolvePromise = resolve;
+  });
+  return { promise, resolve: (value: T) => resolvePromise?.(value) };
+}
+
+/** Controls one operation's runner: the runner reports its start and, if blocked, waits until it is released. */
+interface IOperationGate {
+  readonly blocked: boolean;
+  readonly released: IDeferred;
+  readonly started: IDeferred;
+}
+
+interface ITestPeek extends IWorkspaceInvalidationPeek {
+  readonly commit: jest.Mock;
+  readonly discard: jest.Mock;
+}
+
+/** The messages that the router logged about requests that tried to join an executing iteration. */
+const joinLog: string[] = [];
+let stderrSpy: jest.SpyInstance | undefined;
+let previousJoinValue: string | undefined;
+let previousCobuildValue: string | undefined;
+
+interface IJoinFixture {
+  readonly fixture: ITestRoutingFixture;
+  readonly gates: ReadonlyMap<string, IOperationGate>;
+  readonly inputsSnapshot: IInputsSnapshot;
+  readonly peekCalls: IPeekWorkspaceInvalidationsOptions[];
+  readonly peeks: ITestPeek[];
+  readonly router: PhasedRequestRouter;
+  readonly scheduleSpy: jest.SpyInstance;
+  /** The value of `SESSION_VARIABLE` in the environment in which each operation last ran. */
+  readonly sessions: ReadonlyMap<string, string | undefined>;
+  /** Replaces the default peek, which reports no invalidations. */
+  peekAsync: (() => Promise<IWorkspaceInvalidationPeek | undefined>) | undefined;
+}
+
+interface IJoinFixtureOptions {
+  /** Pairs of a consumer and its dependency. */
+  readonly dependencies?: ReadonlyArray<readonly [string, string]>;
+  readonly failedOperationIds?: ReadonlyArray<string>;
+  /** Whether the daemon configuration of the session enables `joinRunningBatch`; true by default. */
+  readonly joinRunningBatch?: boolean;
+}
+
+function createJoinFixture(
+  blockedOperationIds: ReadonlyArray<string> = [],
+  { dependencies = [], failedOperationIds = [], joinRunningBatch = true }: IJoinFixtureOptions = {}
+): IJoinFixture {
+  const gates: Map<string, IOperationGate> = new Map();
+  const runners: Map<string, TestOperationRunner> = new Map();
+  const sessions: Map<string, string | undefined> = new Map();
+  for (const operationId of OPERATION_IDS) {
+    const gate: IOperationGate = {
+      blocked: blockedOperationIds.includes(operationId),
+      released: createDeferred(),
+      started: createDeferred()
+    };
+    gates.set(operationId, gate);
+    runners.set(
+      operationId,
+      new TestOperationRunner(
+        operationId,
+        failedOperationIds.includes(operationId) ? OperationStatus.Failure : OperationStatus.Success,
+        async (terminal, context): Promise<void> => {
+          sessions.set(operationId, context.environment?.[SESSION_VARIABLE]);
+          gate.started.resolve();
+          if (gate.blocked) {
+            await gate.released.promise;
+          }
+        }
+      )
+    );
+  }
+  const fixture: ITestRoutingFixture = createRoutingFixture(runners, dependencies, { parallelism: 3 });
+  const inputsSnapshot: IInputsSnapshot = {
+    getOperationOwnStateHash: () => 'hash',
+    getTrackedFileHashesForOperation: () => new Map(),
+    hasUncommittedChanges: false,
+    hashes: new Map(),
+    rootDirectory: TEST_REPO_ROOT
+  };
+  const peeks: ITestPeek[] = [];
+  const peekCalls: IPeekWorkspaceInvalidationsOptions[] = [];
+  const joinFixture: IJoinFixture = {
+    fixture,
+    gates,
+    inputsSnapshot,
+    peekCalls,
+    peeks,
+    router: new PhasedRequestRouter(fixture.session),
+    scheduleSpy: jest.spyOn(fixture.graph, 'scheduleIterationAsync'),
+    sessions,
+    peekAsync: undefined
+  };
+  Object.assign(fixture.session, {
+    inputsSnapshot,
+    rushConfiguration: joinRunningBatch ? JOIN_CONFIGURATION : NO_JOIN_CONFIGURATION,
+    peekInvalidationsAsync: async (
+      options: IPeekWorkspaceInvalidationsOptions
+    ): Promise<IWorkspaceInvalidationPeek | undefined> => {
+      peekCalls.push(options);
+      if (joinFixture.peekAsync) {
+        return await joinFixture.peekAsync();
+      }
+      return createTestPeek(joinFixture);
+    }
+  });
+  return joinFixture;
+}
+
+function createTestPeek(joinFixture: IJoinFixture, invalidated: Iterable<Operation> = []): ITestPeek {
+  const peek: ITestPeek = {
+    inputsSnapshot: joinFixture.inputsSnapshot,
+    invalidatedOperations: new Set(invalidated),
+    invalidationReason: 'test-inputs-changed',
+    commit: jest.fn(),
+    discard: jest.fn()
+  };
+  joinFixture.peeks.push(peek);
+  return peek;
+}
+
+function createRequest(
+  requestId: string,
+  operationIds: ReadonlyArray<string>,
+  admission?: IDaemonRequestAdmissionOptions
+): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: operationIds.map((operationId: string) => ({ enabledState: true, operationId })),
+    requestId,
+    ...(admission ? { admission } : {})
+  };
+}
+
+function withSession(request: IDaemonPhasedRequest, session: string): IDaemonPhasedRequest {
+  return { ...request, environment: { [SESSION_VARIABLE]: session } };
+}
+
+function getOperationStatuses(result: IDaemonPhasedRequestResult): Record<string, string> {
+  return Object.fromEntries(result.operationResults.map(({ operationId, status }) => [operationId, status]));
+}
+
+/** Records when a result arrived, relative to the other events of a test. */
+function track(
+  resultPromise: Promise<IDaemonPhasedRequestResult>,
+  label: string,
+  events: string[]
+): Promise<IDaemonPhasedRequestResult> {
+  return resultPromise.then((result: IDaemonPhasedRequestResult) => {
+    events.push(`result:${label}`);
+    return result;
+  });
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+async function waitForAsync(condition: () => boolean): Promise<void> {
+  for (let turn: number = 0; turn < 200; turn++) {
+    if (condition()) {
+      return;
+    }
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+  throw new Error('The condition was not met.');
+}
+
+function collectTelemetry(reports: IPhasedRequestTelemetryReport[]): IPhasedRequestTelemetrySink {
+  return { logRequest: (report: IPhasedRequestTelemetryReport) => reports.push(report) };
+}
+
+beforeEach(() => {
+  previousJoinValue = process.env[JOIN_VARIABLE];
+  previousCobuildValue = process.env[COBUILD_VARIABLE];
+  // Only the daemon configuration that the session loaded enables joining.
+  delete process.env[JOIN_VARIABLE];
+  delete process.env[COBUILD_VARIABLE];
+  joinLog.length = 0;
+  const write: typeof process.stderr.write = process.stderr.write.bind(process.stderr);
+  stderrSpy = jest.spyOn(process.stderr, 'write').mockImplementation(((chunk: unknown, ...rest: never[]) => {
+    const text: string = String(chunk);
+    if (text.includes('the executing iteration')) {
+      joinLog.push(
+        text
+          .replace(/^\S+ /, '')
+          .replace(/ after \d+ ms/, '')
+          .trimEnd()
+      );
+      return true;
+    }
+    return write(chunk as string, ...rest);
+  }) as typeof process.stderr.write);
+});
+
+afterEach(() => {
+  stderrSpy?.mockRestore();
+  restoreVariable(JOIN_VARIABLE, previousJoinValue);
+  restoreVariable(COBUILD_VARIABLE, previousCobuildValue);
+});
+
+describe('a request that arrives while a compatible batch executes', () => {
+  it('joins the executing iteration and gets its result while the batch still runs', async () => {
+    const { fixture, gates, peekCalls, peeks, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    const firstResult: IDaemonPhasedRequestResult = await first;
+
+    expect(events).toEqual(['C released', 'result:first']);
+    expect(joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(joined)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+    expect(firstResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(firstResult)).toEqual({ [OPERATION_C]: OperationStatus.Success });
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect((scheduleSpy.mock.calls[0][0] as IOperationGraphIterationOptions).holdUnneededOperations).toBe(
+      true
+    );
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+    expect(peekCalls).toHaveLength(1);
+    expect(peekCalls[0].executingIterationRecords.has(fixture.operations.get(OPERATION_C)!)).toBe(true);
+    expect(peeks[0].commit).toHaveBeenCalledTimes(1);
+    expect(peeks[0].discard).not.toHaveBeenCalled();
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('loads the join setting of a daemon started with the variable', () => {
+    expect(JOIN_CONFIGURATION.daemon.joinRunningBatch).toBe(true);
+    expect(NO_JOIN_CONFIGURATION.daemon.joinRunningBatch).toBe(false);
+  });
+
+  it('waits for the iteration to end as before when the daemon configuration does not enable joining', async () => {
+    // The variable in the daemon's environment at request time does not matter; its configuration does.
+    process.env[JOIN_VARIABLE] = '1';
+    const { fixture, gates, peekCalls, router, scheduleSpy } = createJoinFixture([OPERATION_C], {
+      joinRunningBatch: false
+    });
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('late', [OPERATION_A]), new TestPhasedRequestClient('late')),
+      'late',
+      events
+    );
+    await settleAsync();
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    const [firstResult, lateResult] = await Promise.all([first, late]);
+
+    expect(events).toEqual(['C released', 'result:first', 'result:late']);
+    expect(firstResult.outcome).toBe('success');
+    expect(lateResult.outcome).toBe('success');
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(scheduleSpy.mock.calls[0][0]).not.toHaveProperty('holdUnneededOperations');
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([]);
+  });
+
+  it('gives a participant whose operations are done its result when a request joins', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C, OPERATION_A]);
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const peekReleased: IDeferred = createDeferred();
+    const peekStarted: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('joined', [OPERATION_A]), new TestPhasedRequestClient('joined')),
+      'joined',
+      events
+    );
+    await peekStarted.promise;
+    // The first request's operations finish while the join reads the inputs, which keeps the iteration running.
+    gates.get(OPERATION_C)!.released.resolve();
+    await settleAsync();
+    events.push('peek released');
+    peekReleased.resolve();
+    await gates.get(OPERATION_A)!.started.promise;
+    await settleAsync();
+    events.push('A released');
+    gates.get(OPERATION_A)!.released.resolve();
+    const [firstResult, joinedResult] = await Promise.all([first, joined]);
+
+    expect(events).toEqual(['peek released', 'result:first', 'A released', 'result:joined']);
+    expect(firstResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(firstResult)).toEqual({ [OPERATION_C]: OperationStatus.Success });
+    expect(joinedResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('gives a failed participant its result when a request joins', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_B, OPERATION_A], {
+      dependencies: [[OPERATION_C, OPERATION_B]],
+      failedOperationIds: [OPERATION_B]
+    });
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const peekReleased: IDeferred = createDeferred();
+    const peekStarted: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        { ...createRequest('first', [OPERATION_C]), returnEarlyOnFailure: true },
+        new TestPhasedRequestClient('first')
+      ),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_B)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('joined', [OPERATION_A]), new TestPhasedRequestClient('joined')),
+      'joined',
+      events
+    );
+    await peekStarted.promise;
+    // The failure blocks the first request's target, and its blocked operation completes only when the iteration
+    // ends, so its failed result waits for another participant.
+    gates.get(OPERATION_B)!.released.resolve();
+    await settleAsync();
+    events.push('peek released');
+    peekReleased.resolve();
+    await gates.get(OPERATION_A)!.started.promise;
+    await settleAsync();
+    events.push('A released');
+    gates.get(OPERATION_A)!.released.resolve();
+    const [firstResult, joinedResult] = await Promise.all([first, joined]);
+
+    expect(events).toEqual(['peek released', 'result:first', 'A released', 'result:joined']);
+    expect(firstResult).toMatchObject({ outcome: 'failure' });
+    expect(getOperationStatuses(firstResult)).toEqual({
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Blocked
+    });
+    expect(joinedResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+  });
+
+  it('gives a request whose operations already ran in the iteration its result at once', async () => {
+    const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        createRequest('first', [OPERATION_A, OPERATION_C]),
+        new TestPhasedRequestClient('first')
+      ),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    await waitForAsync(() => fixture.runners.get(OPERATION_A)!.runCount === 1);
+    await settleAsync();
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    await first;
+
+    expect(events).toEqual(['C released', 'result:first']);
+    expect(joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(joined)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it.each<[string, IDaemonRequestAdmissionOptions | undefined]>([
+    ['without admission options', undefined],
+    ['with the default wait timeout', { waitTimeoutMs: 30_000, waitTimeoutIsDefault: true }],
+    ['with an explicit wait timeout', { waitTimeoutMs: 60_000 }]
+  ])('waits for the iteration to start before it joins, %s', async (title, admission) => {
+    const { gates, router, scheduleSpy, fixture } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    // Received after the reconcile started, so it cannot join the batch before it executes.
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A], admission),
+      new TestPhasedRequestClient('joined')
+    );
+    await settleAsync();
+    reconcileReleased.resolve();
+
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('takes part in the batch telemetry as a request that joined', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C]);
+    const firstReports: IPhasedRequestTelemetryReport[] = [];
+    const joinedReports: IPhasedRequestTelemetryReport[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first'),
+      false,
+      undefined,
+      undefined,
+      collectTelemetry(firstReports)
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      undefined,
+      undefined,
+      collectTelemetry(joinedReports)
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+    await first;
+
+    expect(joinedReports).toHaveLength(1);
+    const [joinedReport] = joinedReports;
+    expect(joinedReport).toMatchObject({
+      batchSize: 2,
+      earlyResult: true,
+      joinedIteration: true,
+      scheduled: true
+    });
+    expect(joinedReport.measures.map(({ name }) => name)).toEqual([
+      'rush:daemon:admission',
+      'rush:daemon:queueWait',
+      'rush:daemon:joinRunningIteration',
+      'rush:daemon:reconcileInvalidations',
+      'rush:daemon:applySelections',
+      'rush:daemon:scheduleIteration',
+      'rush:daemon:executeIteration'
+    ]);
+    const joinMeasure = joinedReport.measures[2];
+    expect(joinedReport.executionStartTimeMs).toBe(joinMeasure.startTimeMs);
+    expect(joinedReport.iterationStartTimeMs).toBeGreaterThanOrEqual(joinMeasure.startTimeMs);
+    expect(joinedReport.iterationStartTimeMs).toBeLessThanOrEqual(joinMeasure.endTimeMs);
+    expect(firstReports).toHaveLength(1);
+    expect(firstReports[0]).toMatchObject({ batchSize: 2, earlyResult: false });
+    expect(firstReports[0]).not.toHaveProperty('joinedIteration');
+    expect(firstReports[0].measures.map(({ name }) => name)).not.toContain(
+      'rush:daemon:joinRunningIteration'
+    );
+  });
+
+  it('ends the execution measure of a request that joined when the iteration ends', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C], {
+      dependencies: [[OPERATION_A, OPERATION_C]]
+    });
+    const joinedReports: IPhasedRequestTelemetryReport[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      undefined,
+      undefined,
+      collectTelemetry(joinedReports)
+    );
+    await waitForAsync(() => joinLog.length === 1);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    // Its work was the last that the iteration ran, so its result waited for the iteration to end.
+    expect(joinedReports).toHaveLength(1);
+    const [joinedReport] = joinedReports;
+    expect(joinedReport).toMatchObject({ earlyResult: false, joinedIteration: true });
+    const executeMeasure = joinedReport.measures.find(({ name }) => name === 'rush:daemon:executeIteration');
+    expect(executeMeasure!.endTimeMs).toBeLessThan(joinedReport.resultTimeMs);
+  });
+
+  it('keeps work that it needs from being withheld after another participant left', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C, OPERATION_A]);
+    const leaving: TestPhasedRequestClient = new TestPhasedRequestClient('leaving');
+    const staying: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('staying', [OPERATION_C]),
+      new TestPhasedRequestClient('staying')
+    );
+    const left: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('leaving', [OPERATION_C]),
+      leaving
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    leaving.abortController.abort();
+    expect(await left).toMatchObject({ aborted: true });
+
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    await gates.get(OPERATION_A)!.started.promise;
+    // The work of the request that joined is still running when the last operation that the batch needed ends.
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await staying).outcome).toBe('success');
+    gates.get(OPERATION_A)!.released.resolve();
+
+    const joinedResult: IDaemonPhasedRequestResult = await joined;
+    expect(joinedResult).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(joinedResult)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+  });
+
+  it('answers a request that joined and then cancelled while the batch runs on', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C, OPERATION_A]);
+    const joinedClient: TestPhasedRequestClient = new TestPhasedRequestClient('joined');
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      joinedClient
+    );
+    await gates.get(OPERATION_A)!.started.promise;
+    joinedClient.abortController.abort();
+
+    expect(await joined).toMatchObject({ aborted: true });
+    // The operation that the request started runs on, as another participant still needs the iteration.
+    gates.get(OPERATION_A)!.released.resolve();
+    await settleAsync();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect(await first).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('fails only the request that joined when its execution cannot start', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const getEnabledStates = (): Operation['enabled'][] =>
+      OPERATION_IDS.map((operationId: string) => fixture.operations.get(operationId)!.enabled);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const enabledStates: Operation['enabled'][] = getEnabledStates();
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      () => {
+        throw new Error('The workspace generation changed.');
+      }
+    );
+    expect(getEnabledStates()).toEqual(enabledStates);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(joined).toMatchObject({
+      errorMessage: 'The workspace generation changed.',
+      exitCode: 1,
+      scheduled: false
+    });
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    // None of its work was added to the iteration.
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    expect(joinLog).toEqual([
+      'Request joined did not join the executing iteration: its execution could not start: The workspace generation changed.'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('starts a request that joins only once the iteration takes its work', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    const events: string[] = [];
+    const { graph } = fixture;
+    const tryExtendCurrentIteration: typeof graph.tryExtendCurrentIteration =
+      graph.tryExtendCurrentIteration.bind(graph);
+    jest.spyOn(graph, 'tryExtendCurrentIteration').mockImplementation((options) => {
+      events.push('extend');
+      const extension: ReturnType<typeof tryExtendCurrentIteration> = tryExtendCurrentIteration(options);
+      events.push(`extended: ${extension.extended}`);
+      return extension;
+    });
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first'),
+      false,
+      () => {
+        events.push('first starts');
+      }
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joinedClient: TestPhasedRequestClient = new TestPhasedRequestClient('joined');
+    joinedClient.onWriteAsync = async ({ requestStarted }: { readonly requestStarted?: boolean }) => {
+      if (requestStarted) {
+        events.push('joined request started');
+      }
+    };
+
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      joinedClient,
+      false,
+      () => {
+        events.push('joined starts');
+      }
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+    expect(events).toEqual([
+      'first starts',
+      'extend',
+      'joined request started',
+      'joined starts',
+      'extended: true'
+    ]);
+    expect((await joined).outcome).toBe('success');
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(events).toHaveLength(5);
+  });
+
+  it('fails only the request that joined when its inputs cannot be committed, and withholds its work', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
+      dependencies: [[OPERATION_A, OPERATION_C]]
+    });
+    const { fixture, gates, router } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      peek.commit.mockImplementation(() => {
+        throw new Error('The inputs could not be committed.');
+      });
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(joined).toMatchObject({
+      errorMessage: 'The inputs could not be committed.',
+      exitCode: 1,
+      scheduled: false
+    });
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    // Its work waited for C, and no participant needs it.
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+  });
+
+  it('runs the work of a request that failed after it joined in the environment of a later request', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
+      dependencies: [[OPERATION_A, OPERATION_C]]
+    });
+    const { gates, router, sessions } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      if (joinFixture.peeks.length === 1) {
+        peek.commit.mockImplementation(() => {
+          throw new Error('The inputs could not be committed.');
+        });
+      }
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const failed: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('failed', [OPERATION_A]), 'session-failed'),
+      new TestPhasedRequestClient('failed')
+    );
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('late', [OPERATION_A]), 'session-late'),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length === 2);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(failed).toMatchObject({ errorMessage: 'The inputs could not be committed.', exitCode: 1 });
+    expect(await late).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request failed joined the executing iteration.',
+      'Request late joined the executing iteration.'
+    ]);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-late']
+      ])
+    );
+  });
+
+  it('runs the work that a request dispatched before it failed in the environment of that request', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, sessions } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      peek.commit.mockImplementation(() => {
+        throw new Error('The inputs could not be committed.');
+      });
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const failed: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('failed', [OPERATION_A]), 'session-failed'),
+      new TestPhasedRequestClient('failed')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(failed).toMatchObject({ errorMessage: 'The inputs could not be committed.', exitCode: 1 });
+    expect((await first).outcome).toBe('success');
+    // A free slot took its work as the iteration was extended.
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-failed']
+      ])
+    );
+  });
+
+  it('keeps the environment of the work of another request that joined when a request fails after it joined', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
+      dependencies: [
+        [OPERATION_A, OPERATION_C],
+        [OPERATION_B, OPERATION_C]
+      ]
+    });
+    const { fixture, gates, router, sessions } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      if (joinFixture.peeks.length === 2) {
+        peek.commit.mockImplementation(() => {
+          throw new Error('The inputs could not be committed.');
+        });
+      }
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('joined', [OPERATION_A]), 'session-joined'),
+      new TestPhasedRequestClient('joined')
+    );
+    await waitForAsync(() => joinLog.length === 1);
+    const failed: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('failed', [OPERATION_B]), 'session-failed'),
+      new TestPhasedRequestClient('failed')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(failed).toMatchObject({ errorMessage: 'The inputs could not be committed.', exitCode: 1 });
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-joined']
+      ])
+    );
+  });
+
+  it('keeps the iteration from ending while it reads the inputs', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const peekStarted: IDeferred = createDeferred();
+    const peekReleased: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    await peekStarted.promise;
+    // The last operation that the batch needs ends while the inputs are read.
+    gates.get(OPERATION_C)!.released.resolve();
+    await settleAsync();
+    peekReleased.resolve();
+
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('lets requests that arrive together join one at a time', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const events: string[] = [];
+    joinFixture.peekAsync = async () => {
+      const index: number = joinFixture.peeks.length + 1;
+      events.push(`peek ${index}`);
+      // Gives a request that joins at the same time every chance to read the inputs meanwhile.
+      await settleAsync();
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      peek.commit.mockImplementation(() => {
+        events.push(`commit ${index}`);
+      });
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joinedResults: IDaemonPhasedRequestResult[] = await Promise.all([
+      router.executeAsync(createRequest('joined-a', [OPERATION_A]), new TestPhasedRequestClient('joined-a')),
+      router.executeAsync(createRequest('joined-b', [OPERATION_B]), new TestPhasedRequestClient('joined-b'))
+    ]);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(joinedResults.map(getOperationStatuses)).toEqual([
+      { [OPERATION_A]: OperationStatus.Success },
+      { [OPERATION_B]: OperationStatus.Success }
+    ]);
+    expect((await first).outcome).toBe('success');
+    expect(events).toEqual(['peek 1', 'commit 1', 'peek 2', 'commit 2']);
+    expect(joinLog).toEqual([
+      'Request joined-a joined the executing iteration.',
+      'Request joined-b joined the executing iteration.'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+  });
+
+  it('does not wait behind another request that is joining when the request does not wait', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { gates, router, scheduleSpy } = joinFixture;
+    const peekReleased: IDeferred = createDeferred();
+    const peekStarted: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joining: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joining', [OPERATION_A]),
+      new TestPhasedRequestClient('joining')
+    );
+    await peekStarted.promise;
+
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_B], { noWait: true }),
+      new TestPhasedRequestClient('late')
+    );
+    peekReleased.resolve();
+    expect(await joining).toMatchObject({ exitCode: 0, outcome: 'success' });
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(late).toMatchObject({ admissionErrorCode: 'no-wait', scheduled: false });
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: an earlier request is still joining, and the request limits its wait',
+      'Request joining joined the executing iteration.'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('runs its work in its own environment, not in that of a request that could not join', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, sessions } = joinFixture;
+    // The inputs of C changed before the first request that tries to join, and not since.
+    joinFixture.peekAsync = async () =>
+      createTestPeek(
+        joinFixture,
+        joinFixture.peeks.length === 0 ? [fixture.operations.get(OPERATION_C)!] : []
+      );
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    // It needs C, which started before its inputs changed, and it does not wait for the graph.
+    const refused: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('refused', [OPERATION_A, OPERATION_C], { noWait: true }), 'session-refused'),
+      new TestPhasedRequestClient('refused')
+    );
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('joined', [OPERATION_A]), 'session-joined'),
+      new TestPhasedRequestClient('joined')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(refused).toMatchObject({ admissionErrorCode: 'no-wait', scheduled: false });
+    expect(joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      `Request refused did not join the executing iteration: "${OPERATION_C}" started before its inputs or outputs changed.`,
+      'Request joined joined the executing iteration.'
+    ]);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-joined']
+      ])
+    );
+  });
+});
+
+describe('a request that cannot join the executing iteration', () => {
+  async function expectToWaitForTheIterationAsync(
+    joinFixture: IJoinFixture,
+    late: IDaemonPhasedRequest,
+    lateClient: TestPhasedRequestClient = new TestPhasedRequestClient('late'),
+    lateSettings?: IPhasedCommandEngineRequestSettings,
+    lateExclusivityClass?: RequestExclusivityClass
+  ): Promise<IDaemonPhasedRequestResult> {
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const lateResult: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        late,
+        lateClient,
+        false,
+        undefined,
+        lateSettings,
+        undefined,
+        undefined,
+        lateExclusivityClass
+      ),
+      'late',
+      events
+    );
+    await settleAsync();
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    await first;
+    const result: IDaemonPhasedRequestResult = await lateResult;
+    expect(events).toEqual(['C released', 'result:first', 'result:late']);
+    return result;
+  }
+
+  it('waits for the iteration to end if its request settings differ', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A]),
+      undefined,
+      { parallelism: 1, quietMode: false, isIncrementalBuildAllowed: true }
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(joinFixture.peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([]);
+  });
+
+  it('waits for the iteration to end if it is exclusive, even if its admission let it in', async () => {
+    // Workspace admission holds an exclusive request until the requests of the batch finish, so nothing else here
+    // reaches the joiner's own check. Admit this request at once, as if admission had not held it.
+    const acquireAsync: RequestAdmissionController['acquireAsync'] =
+      RequestAdmissionController.prototype.acquireAsync;
+    const admissionSpy: jest.SpyInstance = jest
+      .spyOn(RequestAdmissionController.prototype, 'acquireAsync')
+      .mockImplementation(function (
+        this: RequestAdmissionController,
+        scheduler: RequestScheduler,
+        exclusivityClass: RequestExclusivityClass,
+        waitingFor?: string
+      ): Promise<IRequestLease> {
+        return exclusivityClass === RequestExclusivityClass.Exclusive
+          ? Promise.resolve({ exclusivityClass, release: () => undefined })
+          : acquireAsync.call(this, scheduler, exclusivityClass, waitingFor);
+      });
+    try {
+      const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+      const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+        joinFixture,
+        createRequest('late', [OPERATION_A]),
+        undefined,
+        undefined,
+        RequestExclusivityClass.Exclusive
+      );
+
+      expect(result.outcome).toBe('success');
+      expect(admissionSpy).toHaveBeenCalledWith(
+        expect.anything(),
+        RequestExclusivityClass.Exclusive,
+        undefined,
+        expect.any(Function)
+      );
+      expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+      expect(joinFixture.peekCalls).toHaveLength(0);
+      expect(joinLog).toEqual([]);
+    } finally {
+      admissionSpy.mockRestore();
+    }
+  });
+
+  it('waits for the iteration to end if the changed inputs cannot be added to it', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    joinFixture.peekAsync = async () => undefined;
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A])
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the changed inputs cannot be added to an executing iteration'
+    ]);
+  });
+
+  it('waits for the iteration to end if reading the inputs fails', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    joinFixture.peekAsync = async () => {
+      throw new Error('The inputs could not be read.');
+    };
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A])
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: reading the inputs failed: The inputs could not be read.'
+    ]);
+  });
+
+  it('waits for the iteration to end if another request waits for the graph', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const waiting: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        createRequest('waiting', [OPERATION_B]),
+        new TestPhasedRequestClient('waiting'),
+        false,
+        undefined,
+        { parallelism: 1, quietMode: false, isIncrementalBuildAllowed: true }
+      ),
+      'waiting',
+      events
+    );
+    await settleAsync();
+    const late: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('late', [OPERATION_A]), new TestPhasedRequestClient('late')),
+      'late',
+      events
+    );
+    await settleAsync();
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    const results: IDaemonPhasedRequestResult[] = await Promise.all([first, waiting, late]);
+
+    expect(results.map(({ outcome }) => outcome)).toEqual(['success', 'success', 'success']);
+    expect(events).toEqual(['C released', 'result:first', 'result:waiting', 'result:late']);
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(3);
+    expect(joinFixture.peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: another request waits for the graph'
+    ]);
+  });
+
+  it('restores the graph and discards the inputs if the iteration cannot take its work', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    joinFixture.peekAsync = async () => createTestPeek(joinFixture, [fixture.operations.get(OPERATION_C)!]);
+    const getEnabledStates = (): Operation['enabled'][] =>
+      OPERATION_IDS.map((operationId: string) => fixture.operations.get(operationId)!.enabled);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const enabledStates: Operation['enabled'][] = getEnabledStates();
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A, OPERATION_C]),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      `Request late did not join the executing iteration: "${OPERATION_C}" started before its inputs or outputs changed.`
+    ]);
+    expect(getEnabledStates()).toEqual(enabledStates);
+    expect(joinFixture.peeks).toHaveLength(1);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('starts a request that the iteration cannot take only when the batch that runs it starts', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    joinFixture.peekAsync = async () => createTestPeek(joinFixture, [fixture.operations.get(OPERATION_C)!]);
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first'),
+      false,
+      () => {
+        events.push('first starts');
+      }
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const lateClient: TestPhasedRequestClient = new TestPhasedRequestClient('late');
+    lateClient.onWriteAsync = async ({ requestStarted }: { readonly requestStarted?: boolean }) => {
+      if (requestStarted) {
+        events.push('late request started');
+      }
+    };
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A, OPERATION_C]),
+      lateClient,
+      false,
+      () => {
+        events.push('late starts');
+      }
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      `Request late did not join the executing iteration: "${OPERATION_C}" started before its inputs or outputs changed.`
+    ]);
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    // Its client is not told that it started while it waits, so a daemon that exits then leaves it to be sent again.
+    expect(events).toEqual(['first starts', 'C released', 'late request started', 'late starts']);
+  });
+
+  it('restores the graph and discards the inputs if extending the iteration fails', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    jest.spyOn(fixture.graph, 'tryExtendCurrentIteration').mockImplementation(() => {
+      throw new Error('A plugin failed.');
+    });
+    const getEnabledStates = (): Operation['enabled'][] =>
+      OPERATION_IDS.map((operationId: string) => fixture.operations.get(operationId)!.enabled);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const enabledStates: Operation['enabled'][] = getEnabledStates();
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: extending the iteration failed: A plugin failed.'
+    ]);
+    expect(getEnabledStates()).toEqual(enabledStates);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not wait for the iteration to start if its admission does not wait', async () => {
+    const { fixture, gates, router } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_A], { noWait: true }),
+      new TestPhasedRequestClient('late')
+    );
+    expect(late).toMatchObject({ admissionErrorCode: 'no-wait', scheduled: false });
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration has not started, and the request limits its wait'
+    ]);
+    reconcileReleased.resolve();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+  });
+
+  it('does not join if it was cancelled while the inputs were read', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    const peekStarted: IDeferred = createDeferred();
+    const peekReleased: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const lateClient: TestPhasedRequestClient = new TestPhasedRequestClient('late');
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      lateClient
+    );
+    await peekStarted.promise;
+    lateClient.abortController.abort();
+    peekReleased.resolve();
+
+    expect(await late).toMatchObject({ aborted: true });
+    expect(joinLog).toEqual(['Request late did not join the executing iteration: the request was cancelled']);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits for the iteration to start only within its wait timeout, which that wait spends', async () => {
+    const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+
+    // The wait for the iteration to start spends the whole timeout, so the request does not wait for it to end.
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_A], { waitTimeoutMs: 50 }),
+      new TestPhasedRequestClient('late')
+    );
+    expect(late).toMatchObject({ admissionErrorCode: 'wait-timeout', outcome: 'failure' });
+    expect(joinLog).toEqual([
+      "Request late did not join the executing iteration: the iteration did not start within the request's wait timeout"
+    ]);
+    reconcileReleased.resolve();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+  });
+
+  it('waits for the iteration to start within its own wait timeout while an earlier request waits too', async () => {
+    const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    await settleAsync();
+
+    // It does not wait for the earlier request to join before its own wait for the iteration to start ends.
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_B], { waitTimeoutMs: 50 }),
+      new TestPhasedRequestClient('late')
+    );
+    expect(late).toMatchObject({ admissionErrorCode: 'wait-timeout', outcome: 'failure' });
+    reconcileReleased.resolve();
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      "Request late did not join the executing iteration: the iteration did not start within the request's wait timeout",
+      'Request joined joined the executing iteration.'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+  });
+
+  it('waits for the next iteration if the iteration ends before it starts', async () => {
+    const { fixture, router, scheduleSpy } = createJoinFixture();
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+      throw new Error('The inputs could not be reconciled.');
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await settleAsync();
+    reconcileReleased.resolve();
+
+    await expect(first).rejects.toThrow('The inputs could not be reconciled.');
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration ended before it started'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits for the iteration to end if no participant needs it', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C]);
+    const firstClient: TestPhasedRequestClient = new TestPhasedRequestClient('first');
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      firstClient
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    firstClient.abortController.abort();
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: no participant needs the iteration'
+    ]);
+    gates.get(OPERATION_C)!.released.resolve();
+    expect(await first).toMatchObject({ aborted: true });
+    expect((await late).outcome).toBe('success');
+  });
+
+  it('waits for the next iteration if the iteration ended while the inputs were read', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { gates, router, scheduleSpy } = joinFixture;
+    const peekStarted: IDeferred = createDeferred();
+    const peekReleased: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const firstClient: TestPhasedRequestClient = new TestPhasedRequestClient('first');
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      firstClient
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await peekStarted.promise;
+    // The only participant cancels, which ends the iteration once its running operation ends.
+    firstClient.abortController.abort();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect(await first).toMatchObject({ aborted: true });
+    peekReleased.resolve();
+
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual(['Request late did not join the executing iteration: the iteration ended']);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('waits for the iteration to end if the iteration holds no operations', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    jest.spyOn(joinFixture.fixture.graph, 'retainHeldOperations').mockReturnValue(undefined);
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A])
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinFixture.peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration holds no operations'
+    ]);
+  });
+
+  it('waits for the iteration to end if a request that an earlier batch left waiting waits for the graph', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C, OPERATION_B]);
+    const { gates, router, scheduleSpy } = joinFixture;
+    const otherSettings: IPhasedCommandEngineRequestSettings = {
+      parallelism: 1,
+      quietMode: false,
+      isIncrementalBuildAllowed: true
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const other: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('other', [OPERATION_B]),
+      new TestPhasedRequestClient('other'),
+      false,
+      undefined,
+      otherSettings
+    );
+    await settleAsync();
+    const waiting: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('waiting', [OPERATION_A]),
+      new TestPhasedRequestClient('waiting')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+    // The next batch takes the request with the other settings, and leaves the waiting request waiting.
+    gates.get(OPERATION_C)!.released.resolve();
+    await gates.get(OPERATION_B)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late'),
+      false,
+      undefined,
+      otherSettings
+    );
+    await waitForAsync(() => joinLog.length > 1);
+    gates.get(OPERATION_B)!.released.resolve();
+
+    const results: IDaemonPhasedRequestResult[] = await Promise.all([first, other, waiting, late]);
+    expect(results.map(({ outcome }) => outcome)).toEqual(['success', 'success', 'success', 'success']);
+    expect(joinLog).toEqual([
+      'Request waiting did not join the executing iteration: another request waits for the graph',
+      'Request late did not join the executing iteration: another request waits for the graph'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(4);
+  });
+
+  it('does not try to join an iteration that ended while its batch finishes', async () => {
+    const { fixture, router, scheduleSpy } = createJoinFixture();
+    const leaseReleasing: IDeferred = createDeferred();
+    const leaseReleased: IDeferred = createDeferred();
+    fixture.session.acquireExecutionLeaseAsync = async () => ({
+      [Symbol.asyncDispose]: async () => {
+        leaseReleasing.resolve();
+        await leaseReleased.promise;
+      }
+    });
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await leaseReleasing.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await settleAsync();
+    leaseReleased.resolve();
+
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual([]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe('the iteration of a batch that requests cannot join', () => {
+  interface ICannotJoinCase {
+    readonly title: string;
+    readonly exclusivityClass?: RequestExclusivityClass;
+    readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+    readonly setup?: (joinFixture: IJoinFixture) => void;
+  }
+
+  it.each<ICannotJoinCase>([
+    {
+      title: 'in a cobuild',
+      setup: () => {
+        process.env[COBUILD_VARIABLE] = 'test-cobuild';
+      }
+    },
+    { title: 'for an exclusive request', exclusivityClass: RequestExclusivityClass.Exclusive },
+    {
+      title: 'for a request that runs every operation',
+      requestSettings: { parallelism: 3, quietMode: false, isIncrementalBuildAllowed: false }
+    },
+    {
+      title: 'if the graph cannot add work to an executing iteration',
+      setup: ({ fixture }) => {
+        Object.defineProperty(fixture.graph, 'tryExtendCurrentIteration', { value: undefined });
+      }
+    },
+    {
+      title: 'if the graph cannot hold operations',
+      setup: ({ fixture }) => {
+        Object.defineProperty(fixture.graph, 'retainHeldOperations', { value: undefined });
+      }
+    },
+    {
+      title: 'if the workspace session cannot read the inputs for an executing iteration',
+      setup: ({ fixture }) => {
+        Object.assign(fixture.session, { peekInvalidationsAsync: undefined });
+      }
+    }
+  ])('is scheduled as before $title', async ({ exclusivityClass, requestSettings, setup }) => {
+    const joinFixture: IJoinFixture = createJoinFixture();
+    setup?.(joinFixture);
+    const result: IDaemonPhasedRequestResult = await joinFixture.router.executeAsync(
+      createRequest('only', [OPERATION_C]),
+      new TestPhasedRequestClient('only'),
+      false,
+      undefined,
+      requestSettings,
+      undefined,
+      undefined,
+      exclusivityClass
+    );
+
+    expect(result).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(joinFixture.scheduleSpy.mock.calls[0][0]).not.toHaveProperty('holdUnneededOperations');
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts b/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts
index 86c2cf3cd69..fdd03fbb1ab 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts
@@ -141,6 +141,32 @@ describe(PhasedRequestRouter.name, () => {
     expect(scheduleSpy).not.toHaveBeenCalled();
   });
 
+  it('rejects a request whose plugin names differ from the warm engine before scheduling', async () => {
+    const fixture: ITestRoutingFixture = createThreeOperationFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const pluginName: string = TEST_ENGINE_SHAPE.pluginNames[0];
+
+    for (const pluginNames of [
+      ['other-plugin'],
+      [],
+      [pluginName, 'other-plugin'],
+      [pluginName, pluginName]
+    ]) {
+      await expect(
+        router.executeAsync(
+          {
+            ...createRequest([select(OPERATION_A)]),
+            engineShape: { phaseNames: TEST_ENGINE_SHAPE.phaseNames, pluginNames }
+          },
+          client
+        )
+      ).rejects.toThrow('The phased request plugin shape does not match the warm workspace engine.');
+    }
+    expect(scheduleSpy).not.toHaveBeenCalled();
+  });
+
   it('accepts both enabled states declared by the protocol', async () => {
     const trueFixture: ITestRoutingFixture = createThreeOperationFixture();
     await new PhasedRequestRouter(trueFixture.session).executeAsync(
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts b/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
new file mode 100644
index 00000000000..061ac1b1287
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
@@ -0,0 +1,305 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type {
+  IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+import { PhasedCommandEngineBusyError, type RushConfiguration } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const LOCK_RELEASED: string = "to release this repository's lock";
+const LOCK_FOLDERS: string = path.resolve(__dirname, '../../temp/test/router-native-lock');
+// On Windows, the lock file does not name its process, so the daemon cannot tell that it holds the lock itself.
+const unixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+
+/** Stands in for the execution lease, which holds native Rush's repository lock, while another Rush process holds it. */
+class ExecutionLeaseProbe {
+  public attempts: number = 0;
+  public acquisitions: number = 0;
+  #held: boolean = true;
+
+  public constructor(fixture: ITestRoutingFixture) {
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      this.attempts++;
+      if (this.#held) throw new PhasedCommandEngineBusyError();
+      this.acquisitions++;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+  }
+
+  /** The Rush process that held the lock exits. */
+  public free(): void {
+    this.#held = false;
+  }
+}
+
+function createFixture(): ITestRoutingFixture {
+  return createRoutingFixture(new Map([[OPERATION_A, new TestOperationRunner(OPERATION_A)]]));
+}
+
+/** Gives the fixture a common temp folder of its own, which is where native Rush's repository lock lives. */
+function useLockFolder(fixture: ITestRoutingFixture, name: string): string {
+  const folder: string = path.join(LOCK_FOLDERS, name);
+  fs.rmSync(folder, { recursive: true, force: true });
+  fs.mkdirSync(folder, { recursive: true });
+  const rushConfiguration: RushConfiguration = Object.create(fixture.session.rushConfiguration, {
+    commonTempFolder: { value: folder }
+  });
+  Object.defineProperty(fixture.session, 'rushConfiguration', { value: rushConfiguration });
+  return folder;
+}
+
+function createRequest(requestId: string, admission: IDaemonRequestAdmissionOptions): IDaemonPhasedRequest {
+  return {
+    admission,
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: [{ enabledState: true, operationId: OPERATION_A }],
+    requestId
+  };
+}
+
+function getQueuePositions(client: TestPhasedRequestClient): IDaemonRequestQueuePositionMessage[] {
+  return client.writes.flatMap(({ queuePosition }: ITestClientWrite) =>
+    queuePosition ? [queuePosition] : []
+  );
+}
+
+function waitMessage(requestId: string): IDaemonRequestQueuePositionMessage {
+  return {
+    kind: 'queuePosition',
+    payload: { position: 1, requestId, nativeLockHolder: expect.any(Object) }
+  };
+}
+
+async function waitUntilAsync(condition: () => boolean): Promise<void> {
+  while (!condition()) await new Promise<void>((resolve) => setTimeout(resolve, 10));
+}
+
+/** Runs what is due on jest's fake clock, without moving it, until `condition` holds. */
+async function settleUntilAsync(condition: () => boolean): Promise<void> {
+  for (let turn: number = 0; !condition(); turn++) {
+    if (turn === 100) throw new Error('The condition does not hold without moving the fake clock.');
+    await jest.advanceTimersByTimeAsync(0);
+  }
+}
+
+/** Returns a function that says whether `promise` has settled. */
+function trackSettled(promise: Promise<unknown>): () => boolean {
+  let settled: boolean = false;
+  const settle = (): void => {
+    settled = true;
+  };
+  promise.then(settle, settle);
+  return () => settled;
+}
+
+describe(`${PhasedRequestRouter.name} and native Rush's repository lock`, () => {
+  it('waits for another Rush process to release the lock, tells the client, and then runs the request', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const result: Promise<IDaemonPhasedRequestResult> = new PhasedRequestRouter(fixture.session).executeAsync(
+      createRequest('waiting', { waitTimeoutMs: 30_000 }),
+      client
+    );
+    await waitUntilAsync(() => probe.attempts >= 3);
+    expect(getQueuePositions(client)).toEqual([waitMessage('waiting')]);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+
+    probe.free();
+    await expect(result).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(probe.acquisitions).toBe(1);
+    expect(getQueuePositions(client)).toEqual([waitMessage('waiting')]);
+  });
+
+  it('fails a request whose wait timeout runs out, while the rest of its batch waits on', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const short: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('short', { waitTimeoutMs: 300 }),
+      new TestPhasedRequestClient('one')
+    );
+    const long: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('long', { waitTimeoutMs: 30_000 }),
+      new TestPhasedRequestClient('two')
+    );
+    await expect(short).resolves.toMatchObject({
+      admissionErrorCode: 'wait-timeout',
+      exitCode: 1,
+      errorMessage: expect.stringMatching(
+        new RegExp(
+          `^The request was not admitted within its 300ms wait timeout while waiting for .* ${LOCK_RELEASED}`
+        )
+      )
+    });
+    const attempts: number = probe.attempts;
+    await waitUntilAsync(() => probe.attempts > attempts);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+
+    probe.free();
+    await expect(long).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('tries the lock again for the batch when the first of its wait timeouts runs out', async () => {
+    jest.useFakeTimers();
+    try {
+      const fixture: ITestRoutingFixture = createFixture();
+      const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const longClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const short: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        createRequest('short', { waitTimeoutMs: 100 }),
+        new TestPhasedRequestClient('one')
+      );
+      const long: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        createRequest('long', { waitTimeoutMs: 30_000 }),
+        longClient
+      );
+      const isShortSettled: () => boolean = trackSettled(short);
+      const isLongSettled: () => boolean = trackSettled(long);
+      // Both requests wait in one batch, which has tried the lock once. The long request would try it again in
+      // 250ms, but the wait timeout of the short one runs out in 100ms.
+      await settleUntilAsync(() => getQueuePositions(longClient).length > 0);
+      expect(probe.attempts).toBe(1);
+
+      await jest.advanceTimersByTimeAsync(99);
+      expect(probe.attempts).toBe(1);
+      await jest.advanceTimersByTimeAsync(1);
+      await settleUntilAsync(isShortSettled);
+      expect(probe.attempts).toBe(2);
+      await expect(short).resolves.toMatchObject({ admissionErrorCode: 'wait-timeout', exitCode: 1 });
+
+      probe.free();
+      await jest.advanceTimersByTimeAsync(250);
+      await settleUntilAsync(isLongSettled);
+      await expect(long).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(probe.attempts).toBe(3);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('tells a request that joins the waiting batch about the wait, and runs both requests together', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', { waitTimeoutMs: 30_000 }),
+      new TestPhasedRequestClient('one')
+    );
+    await waitUntilAsync(() => probe.attempts >= 2);
+    const joiningClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const joining: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joining', { waitTimeoutMs: 30_000 }),
+      joiningClient
+    );
+    await waitUntilAsync(() => getQueuePositions(joiningClient).length > 0);
+    expect(getQueuePositions(joiningClient)).toEqual([waitMessage('joining')]);
+
+    probe.free();
+    await expect(first).resolves.toMatchObject({ exitCode: 0 });
+    await expect(joining).resolves.toMatchObject({ exitCode: 0 });
+    expect(probe.acquisitions).toBe(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('answers a request that is cancelled while it waits, never runs it, and stops trying the lock', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const result: Promise<IDaemonPhasedRequestResult> = new PhasedRequestRouter(fixture.session).executeAsync(
+      createRequest('cancelled', { waitTimeoutMs: 30_000 }),
+      client
+    );
+    await waitUntilAsync(() => probe.attempts >= 2);
+    client.abortController.abort();
+    await expect(result).resolves.toMatchObject({
+      aborted: true,
+      admissionErrorCode: 'aborted',
+      outcome: 'aborted'
+    });
+    const attempts: number = probe.attempts;
+    probe.free();
+    await new Promise<void>((resolve) => setTimeout(resolve, 600));
+    expect(probe.attempts).toBe(attempts);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+  });
+
+  it('answers a request that leaves the waiting batch only once, while the rest of the batch waits on', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const leavingClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const stayingClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    let allowResult!: () => void;
+    const resultAllowed: Promise<void> = new Promise<void>((resolve) => (allowResult = resolve));
+    // The client takes its result slowly, so the batch tries the lock again before the client has it.
+    leavingClient.onWriteAsync = async ({ result }: ITestClientWrite): Promise<void> => {
+      if (result) await resultAllowed;
+    };
+    const leaving: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('leaving', { waitTimeoutMs: 30_000 }),
+      leavingClient
+    );
+    const staying: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('staying', { waitTimeoutMs: 30_000 }),
+      stayingClient
+    );
+    await waitUntilAsync(() => getQueuePositions(stayingClient).length > 0);
+    leavingClient.abortController.abort();
+    const attempts: number = probe.attempts;
+    await waitUntilAsync(() => probe.attempts >= attempts + 2);
+    allowResult();
+    await expect(leaving).resolves.toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    probe.free();
+    await expect(staying).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(leavingClient.writes.filter(({ result }: ITestClientWrite) => result)).toHaveLength(1);
+    expect(getQueuePositions(leavingClient)).toEqual([waitMessage('leaving')]);
+  });
+
+  unixIt('fails at once when the daemon holds the lock itself, as waiting would not end', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const lockFolder: string = useLockFolder(fixture, 'daemon-holds-lock');
+    const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, 'rush');
+    expect(lock).toBeDefined();
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      await expect(
+        new PhasedRequestRouter(fixture.session).executeAsync(
+          createRequest('in-process', { waitTimeoutMs: 2_000 }),
+          client
+        )
+      ).rejects.toBeInstanceOf(PhasedCommandEngineBusyError);
+      expect(probe.attempts).toBe(1);
+      expect(getQueuePositions(client)).toEqual([]);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    } finally {
+      lock?.release();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts b/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
index 58a52c478d3..e26cc205d7d 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
@@ -29,11 +29,9 @@ import type {
   IWorkspaceEngineShape,
   IWorkspaceInvalidationReconciliation
 } from '../WorkspaceEngineComponentFactory';
-import type {
-  IWorkspaceSession,
-  IWorkspaceSessionMetadata
-} from '../WorkspaceSession';
+import type { IWorkspaceSession, IWorkspaceSessionMetadata } from '../WorkspaceSession';
 import { WorkspaceInvalidationTracker } from '../WorkspaceInvalidationTracker';
+import type { IWorkspaceWarmSetStatus } from '../WorkspaceWarmSet';
 import { TEST_RUSH_CONFIGURATION, TEST_REPO_ROOT } from './TestWorkspaceSession';
 
 export const TEST_ENGINE_SHAPE: IWorkspaceEngineShape = {
@@ -55,6 +53,7 @@ export interface ITestClientWrite {
   readonly event?: IDaemonEventEnvelope;
   readonly operationId?: string;
   readonly queuePosition?: IDaemonRequestQueuePositionMessage;
+  readonly requestStarted?: boolean;
   readonly result?: IDaemonPhasedRequestResult;
   readonly stream?: 'stdout' | 'stderr';
   readonly text?: string;
@@ -69,6 +68,8 @@ export class TestPhasedRequestClient implements IPhasedRequestClient {
   public interactiveInputSink: IInteractiveRequestInputSink | undefined;
   public interactiveSession: IInteractiveRequestSession | undefined;
   public onWriteAsync: ((write: ITestClientWrite) => Promise<void>) | undefined;
+  /** What the router awaits for the daemon's connecting clients before it reconciles this client's batch. */
+  public waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
   readonly #sequenceState: { next: number };
 
   public constructor(sessionIdOrSequenceState: string | { next: number } = 'test-session') {
@@ -123,6 +124,12 @@ export class TestPhasedRequestClient implements IPhasedRequestClient {
     this.writes.push(write);
   }
 
+  public async writeRequestStartedAsync(): Promise<void> {
+    const write: ITestClientWrite = { requestStarted: true };
+    await this.onWriteAsync?.(write);
+    this.writes.push(write);
+  }
+
   public writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void> {
     this.policies.push(result);
     return Promise.resolve();
@@ -195,6 +202,7 @@ export class TestRoutingWorkspaceSession implements IWorkspaceSession {
   public readonly rushConfiguration: RushConfiguration = TEST_RUSH_CONFIGURATION;
   public readonly rushSession: RushSession | undefined = undefined;
   public readonly operationGraph: IOperationGraph;
+  public warmSetStatus: IWorkspaceWarmSetStatus | undefined;
   public onReconcileAsync: (() => Promise<void>) | undefined;
   public acquireExecutionLeaseAsync: (() => Promise<AsyncDisposable | undefined>) | undefined;
 
@@ -202,9 +210,7 @@ export class TestRoutingWorkspaceSession implements IWorkspaceSession {
     this.operationGraph = operationGraph;
   }
 
-  public async reconcileInvalidationsAsync(): Promise<
-    IWorkspaceInvalidationReconciliation | undefined
-  > {
+  public async reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined> {
     await this.onReconcileAsync?.();
     return undefined;
   }
@@ -253,6 +259,8 @@ export function createRoutingFixture(
     allowOversubscription: true,
     debugMode: false,
     destinations: [new MockWritable()],
+    // Tests set the parallelism that they need, so the number of cores of the machine must not cap it.
+    maxParallelism: 32,
     parallelism: 1,
     pauseNextIteration: false,
     quietMode: false,
diff --git a/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts b/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
new file mode 100644
index 00000000000..5d14e7d6900
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPhasedEngineShape } from '@rushstack/rush-daemon-protocol';
+
+import { validateEngineShape } from '../PhasedRequestSelection';
+import type { IWorkspaceEngineShape } from '../WorkspaceEngineComponentFactory';
+
+const WARM_ENGINE_SHAPE: IWorkspaceEngineShape = {
+  phaseNames: ['_phase:build', '_phase:test'],
+  pluginNames: ['plugin-a', 'plugin-b']
+};
+
+describe(validateEngineShape.name, () => {
+  it('accepts the warm engine names in any order', () => {
+    expect(() =>
+      validateEngineShape(
+        { phaseNames: ['_phase:test', '_phase:build'], pluginNames: ['plugin-b', 'plugin-a'] },
+        WARM_ENGINE_SHAPE
+      )
+    ).not.toThrow();
+  });
+
+  it('accepts an empty plugin list when the warm engine has no plugins', () => {
+    const warmShape: IWorkspaceEngineShape = { phaseNames: ['_phase:build'], pluginNames: [] };
+    expect(() =>
+      validateEngineShape({ phaseNames: ['_phase:build'], pluginNames: [] }, warmShape)
+    ).not.toThrow();
+  });
+
+  it.each<[string, IDaemonPhasedEngineShape]>([
+    ['phase', { phaseNames: ['_phase:build', '_phase:build'], pluginNames: WARM_ENGINE_SHAPE.pluginNames }],
+    ['plugin', { phaseNames: WARM_ENGINE_SHAPE.phaseNames, pluginNames: ['plugin-a', 'plugin-a'] }]
+  ])(
+    'rejects a %s list that repeats one warm name in place of another',
+    (kind: string, requestShape: IDaemonPhasedEngineShape) => {
+      expect(() => validateEngineShape(requestShape, WARM_ENGINE_SHAPE)).toThrow(
+        `The phased request ${kind} shape does not match the warm workspace engine.`
+      );
+    }
+  );
+
+  it.each<[string, IDaemonPhasedEngineShape]>([
+    ['phase', { phaseNames: ['_phase:build', '_phase:lint'], pluginNames: WARM_ENGINE_SHAPE.pluginNames }],
+    ['plugin', { phaseNames: WARM_ENGINE_SHAPE.phaseNames, pluginNames: ['plugin-a', 'plugin-c'] }]
+  ])(
+    'rejects a %s list that has an unknown name in place of a warm one',
+    (kind: string, requestShape: IDaemonPhasedEngineShape) => {
+      expect(() => validateEngineShape(requestShape, WARM_ENGINE_SHAPE)).toThrow(
+        `The phased request ${kind} shape does not match the warm workspace engine.`
+      );
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
new file mode 100644
index 00000000000..8198c1ed1fa
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
@@ -0,0 +1,634 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPhasedRequest } from '@rushstack/rush-daemon-protocol';
+import {
+  OperationStatus,
+  type IOperationExecutionResult,
+  type IPhasedCommandEngineTelemetryOptions,
+  type IPhasedCommandEngineTelemetryRecord,
+  type ITelemetryData,
+  type Operation
+} from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import {
+  collectPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryMeasure,
+  type IPhasedRequestTelemetryReport,
+  type IPhasedRequestTelemetrySink
+} from '../PhasedRequestTelemetry';
+import {
+  createDaemonRequestTelemetryData,
+  createDaemonRequestTelemetrySink,
+  type IDaemonRequestTelemetryContext
+} from '../DaemonRequestTelemetry';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+
+const DAEMON_MEASURES: ReadonlyArray<string> = [
+  'rush:daemon:admission',
+  'rush:daemon:queueWait',
+  'rush:daemon:acquireExecutionLease',
+  'rush:daemon:awaitConnectingClients',
+  'rush:daemon:reconcileInvalidations',
+  'rush:daemon:applySelections',
+  'rush:daemon:scheduleIteration',
+  'rush:daemon:executeIteration'
+];
+
+function createRequest(requestId: string, ...operationIds: ReadonlyArray<string>): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: operationIds.map((operationId: string) => ({ enabledState: true, operationId })),
+    requestId
+  };
+}
+
+function createFixture(statusesA: ReadonlyArray<OperationStatus> = []): ITestRoutingFixture {
+  const pendingStatusesA: OperationStatus[] = [...statusesA];
+  return createRoutingFixture(
+    new Map([
+      [
+        OPERATION_A,
+        new TestOperationRunner(OPERATION_A, OperationStatus.Success, async () => pendingStatusesA.shift())
+      ],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B)]
+    ]),
+    [[OPERATION_B, OPERATION_A]]
+  );
+}
+
+class RecordingTelemetrySink implements IPhasedRequestTelemetrySink {
+  public readonly reports: IPhasedRequestTelemetryReport[] = [];
+  public readonly resultsWrittenBeforeReport: boolean[] = [];
+  readonly #client: TestPhasedRequestClient;
+
+  public constructor(client: TestPhasedRequestClient) {
+    this.#client = client;
+  }
+
+  public logRequest(report: IPhasedRequestTelemetryReport): void {
+    this.resultsWrittenBeforeReport.push(this.#client.writes.some(({ result }) => result !== undefined));
+    this.reports.push(report);
+  }
+}
+
+function getStatuses(report: IPhasedRequestTelemetryReport): Record<string, OperationStatus> {
+  const statuses: Record<string, OperationStatus> = {};
+  for (const [operation, record] of report.records) {
+    statuses[operation.name] = record.status;
+  }
+  return statuses;
+}
+
+async function executeAsync(
+  router: PhasedRequestRouter,
+  request: IDaemonPhasedRequest
+): Promise<RecordingTelemetrySink> {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient(request.requestId);
+  const sink: RecordingTelemetrySink = new RecordingTelemetrySink(client);
+  await router.executeAsync(request, client, false, undefined, undefined, sink);
+  return sink;
+}
+
+describe('phased request telemetry', () => {
+  it('reports each coalesced request once, with its own selection, after its result is written', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const [dependency, consumer] = await Promise.all([
+        executeAsync(router, createRequest('dependency', OPERATION_A)),
+        executeAsync(router, createRequest('consumer', OPERATION_B))
+      ]);
+
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      for (const sink of [dependency, consumer]) {
+        expect(sink.reports).toHaveLength(1);
+        expect(sink.resultsWrittenBeforeReport).toEqual([true]);
+        const [report] = sink.reports;
+        expect(report).toMatchObject({ batchSize: 2, scheduled: true, countRetained: 0 });
+        expect(report.result).toMatchObject({ exitCode: 0, outcome: 'success' });
+        expect(report.measures.map(({ name }) => name)).toEqual(DAEMON_MEASURES);
+        for (const { startTimeMs, endTimeMs } of report.measures) {
+          expect(endTimeMs).toBeGreaterThanOrEqual(startTimeMs);
+        }
+        expect(report.receivedTimeMs).toBeLessThanOrEqual(report.executionStartTimeMs);
+        expect(report.executionStartTimeMs).toBeLessThanOrEqual(report.iterationStartTimeMs!);
+        expect(report.iterationStartTimeMs!).toBeLessThanOrEqual(report.resultTimeMs);
+      }
+      expect(dependency.reports[0].request.requestId).toBe('dependency');
+      expect(getStatuses(dependency.reports[0])).toEqual({ [OPERATION_A]: OperationStatus.Success });
+      expect(getStatuses(consumer.reports[0])).toEqual({
+        [OPERATION_A]: OperationStatus.Success,
+        [OPERATION_B]: OperationStatus.Success
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('writes the results of a batch before it logs any of their entries', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    // An execution lease, as the warm engine has, makes the batch's requests produce their results together.
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => ({
+      [Symbol.asyncDispose]: async (): Promise<void> => undefined
+    });
+    // The batch finds its operations up to date, so none of its requests gets an early result.
+    let iteration: number = 0;
+    fixture.graph.hooks.configureIteration.tap('warm no-op', (records, previousResults) => {
+      if (iteration++ === 0) {
+        return;
+      }
+      for (const record of records.values()) {
+        if (previousResults.has(record.operation)) {
+          record.enabled = false;
+        }
+      }
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const events: string[] = [];
+    const reports: IPhasedRequestTelemetryReport[] = [];
+    let firstLogTimeMs: number | undefined;
+    async function executeRecordedAsync(requestId: string, ...operationIds: string[]): Promise<void> {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient(requestId);
+      client.onWriteAsync = async ({ result }: ITestClientWrite): Promise<void> => {
+        if (result) {
+          events.push(`write ${requestId}`);
+        }
+      };
+      await router.executeAsync(
+        createRequest(requestId, ...operationIds),
+        client,
+        false,
+        undefined,
+        undefined,
+        {
+          logRequest: (report: IPhasedRequestTelemetryReport) => {
+            firstLogTimeMs ??= performance.now();
+            events.push(`log ${requestId}`);
+            reports.push(report);
+          }
+        }
+      );
+    }
+    try {
+      await executeAsync(router, createRequest('initial', OPERATION_B));
+      await Promise.all([
+        executeRecordedAsync('first', OPERATION_A),
+        executeRecordedAsync('second', OPERATION_B),
+        executeRecordedAsync('third', OPERATION_A, OPERATION_B)
+      ]);
+
+      expect(reports.map(({ batchSize, earlyResult }) => ({ batchSize, earlyResult }))).toEqual([
+        { batchSize: 3, earlyResult: false },
+        { batchSize: 3, earlyResult: false },
+        { batchSize: 3, earlyResult: false }
+      ]);
+      // Logging an entry takes milliseconds in the daemon, so no client waits for its batch-mates' entries...
+      expect(events.slice(0, 3).sort()).toEqual(['write first', 'write second', 'write third']);
+      expect(events.slice(3).sort()).toEqual(['log first', 'log second', 'log third']);
+      // ...and no entry's timing includes the logging of the entries before it.
+      for (const { resultTimeMs } of reports) {
+        expect(resultTimeMs).toBeLessThanOrEqual(firstLogTimeMs!);
+      }
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports a request once when its result cannot be written', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient('departed');
+      client.onWriteAsync = async ({ result }: ITestClientWrite): Promise<void> => {
+        if (result) {
+          throw new Error('The client left.');
+        }
+      };
+      const sink: RecordingTelemetrySink = new RecordingTelemetrySink(client);
+      await expect(
+        router.executeAsync(createRequest('departed', OPERATION_A), client, false, undefined, undefined, sink)
+      ).rejects.toThrow('The client left.');
+
+      expect(sink.reports).toHaveLength(1);
+      expect(sink.reports[0].result).toMatchObject({ exitCode: 0, outcome: 'success' });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports every request of an iteration before the next queued iteration starts', async () => {
+    const OPERATION_C: string = 'project-c (_phase:test)';
+    let resolveStarted: () => void = () => undefined;
+    let resolveRelease: () => void = () => undefined;
+    const consumerStarted: Promise<void> = new Promise((resolve) => (resolveStarted = resolve));
+    const releaseConsumer: Promise<void> = new Promise((resolve) => (resolveRelease = resolve));
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+        [
+          OPERATION_B,
+          new TestOperationRunner(OPERATION_B, OperationStatus.Success, async () => {
+            resolveStarted();
+            await releaseConsumer;
+          })
+        ],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ]),
+      [[OPERATION_B, OPERATION_A]]
+    );
+    // Like a telemetry plugin that starts a new session for each iteration and reads it in beforeLog.
+    let iteration: number = 0;
+    const events: string[] = [];
+    fixture.graph.hooks.beforeExecuteIterationAsync.tap('iteration session', () => {
+      events.push(`iteration ${++iteration}`);
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    async function executeRecordedAsync(requestId: string, operationId: string): Promise<void> {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient(requestId);
+      // A slow reader spreads each request's final flush, which precedes its report, over several event loop turns.
+      client.onWriteAsync = async (): Promise<void> => {
+        await new Promise<void>((resolve) => setImmediate(resolve));
+      };
+      await router.executeAsync(createRequest(requestId, operationId), client, false, undefined, undefined, {
+        logRequest: ({ batchSize, earlyResult }: IPhasedRequestTelemetryReport) => {
+          events.push(
+            `log ${requestId} in iteration ${iteration} (batch ${batchSize}, early ${earlyResult})`
+          );
+        }
+      });
+    }
+    try {
+      const firstBatch: Promise<unknown> = Promise.all([
+        executeRecordedAsync('dependency', OPERATION_A),
+        executeRecordedAsync('consumer', OPERATION_B)
+      ]);
+      await consumerStarted;
+      const queued: Promise<void> = executeRecordedAsync('queued', OPERATION_C);
+      await new Promise<void>((resolve) => setTimeout(resolve, 20));
+      expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(0);
+      resolveRelease();
+      await Promise.all([firstBatch, queued]);
+
+      expect(events).toEqual([
+        'iteration 1',
+        'log dependency in iteration 1 (batch 2, early true)',
+        'log consumer in iteration 1 (batch 2, early false)',
+        'iteration 2',
+        'log queued in iteration 2 (batch 1, early false)'
+      ]);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('measures the wait for connecting clients between the execution lease and the reconcile', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('waiting');
+    client.waitForConnectingClientsAsync = () => new Promise<void>((resolve) => setTimeout(resolve, 20));
+    const sink: RecordingTelemetrySink = new RecordingTelemetrySink(client);
+    try {
+      await router.executeAsync(
+        createRequest('waiting', OPERATION_A),
+        client,
+        false,
+        undefined,
+        undefined,
+        sink
+      );
+
+      const measures: Map<string, IPhasedRequestTelemetryMeasure> = new Map(
+        sink.reports[0].measures.map((measure: IPhasedRequestTelemetryMeasure) => [measure.name, measure])
+      );
+      const lease: IPhasedRequestTelemetryMeasure = measures.get('rush:daemon:acquireExecutionLease')!;
+      const wait: IPhasedRequestTelemetryMeasure = measures.get('rush:daemon:awaitConnectingClients')!;
+      const reconcile: IPhasedRequestTelemetryMeasure = measures.get('rush:daemon:reconcileInvalidations')!;
+      expect(wait.startTimeMs).toBe(lease.endTimeMs);
+      expect(wait.endTimeMs - wait.startTimeMs).toBeGreaterThanOrEqual(10);
+      expect(reconcile.startTimeMs).toBe(wait.endTimeMs);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports the operations of a request with no work as retained and skipped', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    let iteration: number = 0;
+    fixture.graph.hooks.configureIteration.tap('warm no-op', (records, previousResults) => {
+      if (iteration++ === 0) {
+        return;
+      }
+      for (const record of records.values()) {
+        if (previousResults.has(record.operation)) {
+          record.enabled = false;
+        }
+      }
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      await executeAsync(router, createRequest('initial', OPERATION_B));
+      const sink: RecordingTelemetrySink = await executeAsync(router, createRequest('repeat', OPERATION_B));
+
+      expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+      expect(sink.reports).toHaveLength(1);
+      const [report] = sink.reports;
+      expect(report).toMatchObject({ batchSize: 1, scheduled: false, countRetained: 2 });
+      expect(report.result).toMatchObject({ exitCode: 0, scheduled: false });
+      expect(report.iterationStartTimeMs).toBeUndefined();
+      expect(getStatuses(report)).toEqual({
+        [OPERATION_A]: OperationStatus.Skipped,
+        [OPERATION_B]: OperationStatus.Skipped
+      });
+      for (const record of report.records.values()) {
+        expect(record.stopwatch).toEqual({
+          startTime: report.executionStartTimeMs,
+          endTime: report.executionStartTimeMs
+        });
+      }
+      expect(report.measures.map(({ name }) => name)).not.toContain('rush:daemon:executeIteration');
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports a failed request and a later passing request separately', async () => {
+    const fixture: ITestRoutingFixture = createFixture([OperationStatus.Failure]);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const failed: RecordingTelemetrySink = await executeAsync(router, createRequest('failed', OPERATION_B));
+      const passed: RecordingTelemetrySink = await executeAsync(router, createRequest('passed', OPERATION_B));
+
+      expect(failed.reports[0].result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      expect(getStatuses(failed.reports[0])).toEqual({
+        [OPERATION_A]: OperationStatus.Failure,
+        [OPERATION_B]: OperationStatus.Blocked
+      });
+      expect(passed.reports[0].result).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(getStatuses(passed.reports[0])).toEqual({
+        [OPERATION_A]: OperationStatus.Success,
+        [OPERATION_B]: OperationStatus.Success
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('does not report a request rejected before execution, and ignores sink errors', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const rejectedSink: jest.Mocked<IPhasedRequestTelemetrySink> = { logRequest: jest.fn() };
+      await expect(
+        router.executeAsync(
+          createRequest('rejected', 'missing (_phase:test)'),
+          new TestPhasedRequestClient(),
+          false,
+          undefined,
+          undefined,
+          rejectedSink
+        )
+      ).rejects.toThrow();
+      expect(rejectedSink.logRequest).not.toHaveBeenCalled();
+
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      await expect(
+        router.executeAsync(createRequest('accepted', OPERATION_A), client, false, undefined, undefined, {
+          logRequest: () => {
+            throw new Error('telemetry failure');
+          }
+        })
+      ).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(client.writes.some(({ result }) => result?.exitCode === 0)).toBe(true);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
+
+describe(collectPhasedRequestTelemetryRecords.name, () => {
+  it('keeps the times that an unfinished operation had when the records were taken', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const operation: Operation = fixture.operations.get(OPERATION_A)!;
+      const stopwatch: { startTime: number | undefined; endTime: number | undefined } = {
+        startTime: 1,
+        endTime: undefined
+      };
+      const executionResult: IOperationExecutionResult = {
+        operation,
+        silent: false,
+        status: OperationStatus.Executing,
+        stopwatch
+      } as unknown as IOperationExecutionResult;
+      const { records } = collectPhasedRequestTelemetryRecords({
+        activeOperations: [operation],
+        graph: fixture.session.operationGraph,
+        observations: { getObservedResult: () => ({ executionResult }) },
+        upToDateTimeMs: 0
+      });
+      // The router logs the records once it wrote the result, and the operation may finish in between.
+      stopwatch.endTime = 2;
+
+      expect(records.get(operation)).toEqual({
+        status: OperationStatus.Aborted,
+        silent: false,
+        stopwatch: { startTime: 1, endTime: undefined },
+        nonCachedDurationMs: undefined
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
+
+describe(createDaemonRequestTelemetryData.name, () => {
+  // Other suites' graph iterations record native measures in the same process-wide timeline.
+  beforeEach(() => performance.clearMeasures());
+  afterEach(() => performance.clearMeasures());
+
+  function createContext(
+    overrides: Partial<IDaemonRequestTelemetryContext> = {}
+  ): IDaemonRequestTelemetryContext & { readonly calls: IPhasedCommandEngineTelemetryOptions[] } {
+    const fixture: ITestRoutingFixture = createFixture();
+    const calls: IPhasedCommandEngineTelemetryOptions[] = [];
+    return {
+      calls,
+      command: {
+        createTelemetryData: (options: IPhasedCommandEngineTelemetryOptions): ITelemetryData => {
+          calls.push(options);
+          return { name: 'build', durationInSeconds: options.durationInSeconds, result: 'Succeeded' };
+        }
+      },
+      logTelemetry: jest.fn(),
+      workspaceSession: fixture.session,
+      lifecycleInfo: { receivedTimeMs: 100, preparedTimeMs: 150, reloadTier: 1 },
+      resolveStartTimeMs: 150,
+      resolveEndTimeMs: 200,
+      engineCreation: undefined,
+      getRequestIndex: () => 4,
+      ...overrides
+    };
+  }
+
+  function createReport(
+    overrides: Partial<IPhasedRequestTelemetryReport> = {}
+  ): IPhasedRequestTelemetryReport {
+    const records: Map<Operation, IPhasedCommandEngineTelemetryRecord> = new Map();
+    return {
+      request: {
+        ...createRequest('request', OPERATION_A),
+        environment: { COPILOT_AGENT_SESSION_ID: 'agent-1', RUSHD_TELEMETRY_TAG: 'tag-1' }
+      },
+      result: {
+        aborted: false,
+        exitCode: 0,
+        operationResults: [],
+        outcome: 'success',
+        scheduled: true
+      } as unknown as IPhasedRequestTelemetryReport['result'],
+      records,
+      countRetained: 0,
+      batchSize: 2,
+      scheduled: true,
+      earlyResult: false,
+      receivedTimeMs: 210,
+      executionStartTimeMs: 250,
+      iterationStartTimeMs: 300,
+      resultTimeMs: 1300,
+      measures: [{ name: 'rush:daemon:queueWait', startTimeMs: 220, endTimeMs: 250 }],
+      ...overrides
+    };
+  }
+
+  it('measures the iteration as a native command does and adds the daemon fields', () => {
+    const context: ReturnType<typeof createContext> = createContext();
+    createDaemonRequestTelemetryData(context, createReport());
+
+    const [options] = context.calls;
+    expect(options).toMatchObject({ succeeded: true, durationInSeconds: 1, timeOriginMs: 100 });
+    expect(options.extraData).toMatchObject({
+      daemon: true,
+      daemonPid: process.pid,
+      requestId: 'request',
+      reloadTier: 1,
+      requestIndex: 4,
+      batchSize: 2,
+      queueWaitSeconds: 0.03,
+      graphWasInitialized: true,
+      scheduled: true,
+      earlyResult: false,
+      countRetained: 0,
+      exitCode: 0,
+      outcome: 'success',
+      durationBasis: 'iteration',
+      bootDurationSeconds: 0.2,
+      totalDurationSeconds: 1.2,
+      agentSessionId: 'agent-1',
+      telemetryTag: 'tag-1'
+    });
+    expect(options.extraData).not.toHaveProperty('joinedIteration');
+    expect(typeof options.extraData?.daemonVersion).toBe('string');
+    expect(options.extraData?.generationToken).toHaveLength(8);
+    expect(
+      options.performanceEntries?.map(({ name, startTime, duration }) => [name, startTime, duration])
+    ).toEqual([
+      ['rush:daemon:prepareWorkspace', 100, 50],
+      ['rush:daemon:resolve', 150, 50],
+      ['rush:daemon:queueWait', 220, 30]
+    ]);
+  });
+
+  it('says that a request joined an iteration that was already executing', () => {
+    const context: ReturnType<typeof createContext> = createContext();
+    createDaemonRequestTelemetryData(context, createReport({ joinedIteration: true }));
+
+    expect(context.calls[0].extraData).toMatchObject({ joinedIteration: true });
+  });
+
+  it('attributes engine creation and its native measures to the request that created the engine', () => {
+    performance.measure('rush:test:beforeEngine', { start: 110, end: 115 });
+    performance.measure('rush:test:createEngine', { start: 160, end: 170 });
+    performance.measure('rush:executionManager:test', { start: 400, end: 900 });
+    performance.measure('rush:executionManager:afterResult', { start: 400, end: 1400 });
+    const context: ReturnType<typeof createContext> = createContext({
+      engineCreation: { startTimeMs: 155, endTimeMs: 180 }
+    });
+    createDaemonRequestTelemetryData(context, createReport());
+
+    const [options] = context.calls;
+    expect(options.extraData).toMatchObject({ graphWasInitialized: false });
+    expect(options.performanceEntries?.map(({ name }) => name)).toEqual([
+      'rush:daemon:prepareWorkspace',
+      'rush:daemon:createEngine',
+      'rush:daemon:resolve',
+      'rush:daemon:queueWait',
+      'rush:test:createEngine',
+      'rush:executionManager:test'
+    ]);
+  });
+
+  it('measures a request that needed no iteration from when its batch began handling it', () => {
+    const context: ReturnType<typeof createContext> = createContext({ lifecycleInfo: undefined });
+    createDaemonRequestTelemetryData(
+      context,
+      createReport({
+        scheduled: false,
+        iterationStartTimeMs: undefined,
+        resultTimeMs: 350,
+        result: { exitCode: 1, outcome: 'failure' } as unknown as IPhasedRequestTelemetryReport['result']
+      })
+    );
+
+    const [options] = context.calls;
+    expect(options).toMatchObject({ succeeded: false, durationInSeconds: 0.1, timeOriginMs: 150 });
+    expect(options.extraData).toMatchObject({ durationBasis: 'batch', exitCode: 1, outcome: 'failure' });
+    expect(options.extraData).not.toHaveProperty('reloadTier');
+    expect(options.performanceEntries?.map(({ name }) => name)).toEqual([
+      'rush:daemon:resolve',
+      'rush:daemon:queueWait'
+    ]);
+  });
+
+  it('runs beforeLog taps only for entries that an iteration served', () => {
+    const logTelemetry: jest.Mock = jest.fn();
+    const sink: IPhasedRequestTelemetrySink = createDaemonRequestTelemetrySink(
+      createContext({ logTelemetry })
+    );
+    sink.logRequest(createReport());
+    sink.logRequest(createReport({ scheduled: false, iterationStartTimeMs: undefined }));
+
+    expect(logTelemetry.mock.calls.map(([, options]) => options)).toEqual([
+      { servedByIteration: true },
+      { servedByIteration: false }
+    ]);
+  });
+
+  it('logs through the engine and reports a logging failure without throwing', () => {
+    const context: ReturnType<typeof createContext> = createContext({
+      logTelemetry: () => {
+        throw new Error('disk full');
+      }
+    });
+    const stderrSpy: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    try {
+      expect(() => createDaemonRequestTelemetrySink(context).logRequest(createReport())).not.toThrow();
+      expect(stderrSpy).toHaveBeenCalledWith(expect.stringContaining('disk full'));
+    } finally {
+      stderrSpy.mockRestore();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
new file mode 100644
index 00000000000..914f3b40b73
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
@@ -0,0 +1,183 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { type IRequestLease, RequestExclusivityClass } from '../RequestScheduler';
+import { getWorkspaceRequestScheduler } from '../WorkspaceRequestAdmission';
+import {
+  ClassRecordingResolver,
+  createFixtureAsync,
+  requestEnvironment,
+  runAsync,
+  runs,
+  type IFixture
+} from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('native production daemon engine', () => {
+  it('serves phased commands from command-line.json on a shared graph with their own admission class', async () => {
+    const classes: string[] = [];
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', {
+      customCommands: true,
+      resolver: new ClassRecordingResolver(classes)
+    });
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    try {
+      expect((await runAsync(fixture, 'test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 0,
+          scheduled: true,
+          operationResults: [
+            { operationId: 'a (compile)', status: 'SUCCESS' },
+            { operationId: 'a (test)', status: 'SUCCESS' }
+          ]
+        }
+      });
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(testGraph?.operations.size).toBe(6);
+      expect((await runAsync(fixture, 'warm-test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a']);
+
+      // Like rebuild, retest runs every selected operation on every request, here on the engine of test.
+      for (const id of ['retest-one', 'retest-two']) {
+        expect((await runAsync(fixture, id, ['retest', '--only', 'a'], custom)).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: true }
+        });
+      }
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a', 'a:one:', 'test-a', 'a:one:', 'test-a']);
+
+      // Clients mark only build and rebuild as built-in commands.
+      expect((await runAsync(fixture, 'built-in-test', ['test', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'invalidRequest' }
+      });
+      // A generation reload also resolves its first request once to bind the engine.
+      expect(new Set(classes)).toEqual(new Set(['test:SHARED-BUILD', 'retest:EXCLUSIVE']));
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('rejects other commands before reading inputs and serves custom commands despite build event hooks', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', {
+      customCommands: true,
+      buildEventHook: true
+    });
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    try {
+      expect((await runAsync(fixture, 'hooked-build', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: expect.stringContaining('event-hook') }
+      });
+      expect((await runAsync(fixture, 'test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      // A served command would reload the graph for this change; a command that cannot be served must not.
+      const filename: string = path.join(fixture.repoRoot, 'projects/a/package.json');
+      const json: { scripts: Record<string, string> } = JSON.parse(fs.readFileSync(filename, 'utf8'));
+      json.scripts['_phase:compile'] = 'node build.cjs --changed';
+      fs.writeFileSync(filename, JSON.stringify(json));
+      expect((await runAsync(fixture, 'global', ['hello'], custom)).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: expect.stringContaining('is not a phased command') }
+      });
+      expect((await runAsync(fixture, 'list', ['list'], custom)).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: '"list" is a built-in command that is not phased.' }
+      });
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect((await runAsync(fixture, 'changed', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(fixture.session.operationGraph).not.toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a', 'a:one:--changed', 'test-a']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('admits a custom command to the workspace with the class of its command', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { customCommands: true });
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    const noWait: Partial<IDaemonRequestEnvelope> = { ...custom, admission: { noWait: true } };
+    try {
+      expect((await runAsync(fixture, 'test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      const sharedBuild: IRequestLease = await getWorkspaceRequestScheduler(fixture.session).acquireAsync({
+        exclusivityClass: RequestExclusivityClass.SharedBuild
+      });
+      try {
+        // test is incremental, so it shares admission with builds. retest is not, so it waits for them.
+        expect((await runAsync(fixture, 'shared', ['test', '--only', 'a'], noWait)).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: false }
+        });
+        expect(
+          (await runAsync(fixture, 'exclusive', ['retest', '--only', 'a'], noWait)).terminal
+        ).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'no-wait' }
+        });
+      } finally {
+        sharedBuild.release();
+      }
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('rejects a global command before its environment can restart the daemon, but not a phased command', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { customCommands: true });
+    // A variable that is part of the workspace fingerprint environment.
+    const environment: Record<string, string> = {
+      ...requestEnvironment(),
+      RUSHD_CUSTOM_COMMAND_TEST: 'changed'
+    };
+    const restartRequired: Record<string, unknown> = {
+      kind: 'requestRejected',
+      payload: {
+        code: 'routingFailed',
+        message: expect.stringContaining('A new daemon process is required (environment)')
+      }
+    };
+    try {
+      expect(
+        (await runAsync(fixture, 'global', ['hello'], { commandOrigin: 'custom', environment })).terminal
+      ).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: expect.stringContaining('is not a phased command') }
+      });
+      // A phased command with this environment needs a new daemon process, like build, which this host cannot
+      // launch.
+      expect(
+        (await runAsync(fixture, 'test', ['test', '--only', 'a'], { commandOrigin: 'custom', environment }))
+          .terminal
+      ).toMatchObject(restartRequired);
+      expect(
+        (await runAsync(fixture, 'build', ['build', '--only', 'a'], { environment })).terminal
+      ).toMatchObject(restartRequired);
+      expect(runs(fixture)).toEqual([]);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
index 3425fd4dc93..990f1368b4d 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
@@ -1,20 +1,209 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { PhasedCommandEngine } from '@microsoft/rush-lib';
+import * as path from 'node:path';
 
+import {
+  PhasedCommandEngine,
+  workspaceFingerprintIgnoredEnvironmentVariables,
+  workspaceRequestScopedEnvironmentVariables
+} from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transport';
+
+import { DaemonRequestEnvironmentError, type IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IWorkspaceSession } from '../WorkspaceSession';
-import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+import { createWireEnvelope, hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 
 describe('ProductionDaemonRequestResolver environment identity', () => {
-  it('ignores insertion order for distinct environment names with identical locale collation', async () => {
-    const names: string[] = ['RUSHD_TEST_\u00e9', 'RUSHD_TEST_e\u0301'];
-    const original: (string | undefined)[] = names.map((name) => process.env[name]);
-    const parse = jest.spyOn(PhasedCommandEngine, 'parseAsync').mockResolvedValue({
+  const ADDED_NAME: string = 'RUSHD_TEST_PLUGIN_ADDED';
+  const STARTUP_NAME: string = 'RUSHD_TEST_STARTUP';
+  let parse: jest.SpyInstance;
+  beforeEach(() => {
+    parse = jest.spyOn(PhasedCommandEngine, 'parseAsync').mockResolvedValue({
       commandName: 'build',
       parameterIdentity: 'parameters'
     } as PhasedCommandEngine);
+  });
+  afterEach(() => {
+    parse.mockRestore();
+    delete process.env[ADDED_NAME];
+    delete process.env[STARTUP_NAME];
+  });
+
+  // A parse's options hold the request's environment, which is the whole process environment, and jest prints a
+  // mock's arguments when an assertion about its calls fails. Tests count the calls instead, so that a failure prints
+  // only numbers.
+  function parseCount(): number {
+    return parse.mock.calls.length;
+  }
+
+  function getEnvironment(): Record<string, string> {
+    return Object.fromEntries(
+      Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+    );
+  }
+  function createOptions(environment: Record<string, string>): IResolveDaemonRequestOptions {
+    return {
+      abortSignal: new AbortController().signal,
+      envelope: createWireEnvelope('identity', 'build', process.cwd(), {
+        commandOrigin: 'built-in',
+        environment
+      }),
+      workspaceSession: { rushConfiguration: {} } as IWorkspaceSession
+    };
+  }
+
+  it('ignores names that the daemon process added after startup, as a plugin does', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const startupEnvironment: Record<string, string> = getEnvironment();
+    // A plugin that records its iteration id in process.env, in every iteration.
+    process.env[ADDED_NAME] = 'iteration-1';
+    await expect(
+      resolver.getCommandParameterIdentityAsync(createOptions(startupEnvironment))
+    ).resolves.toBe('parameters');
+    process.env[ADDED_NAME] = 'iteration-2';
+    await expect(
+      resolver.getCommandParameterIdentityAsync(createOptions(startupEnvironment))
+    ).resolves.toBe('parameters');
+    // A client that sets the added name is still a different environment.
+    await expect(
+      resolver.getCommandParameterIdentityAsync(createOptions({ ...startupEnvironment, [ADDED_NAME]: 'x' }))
+    ).rejects.toThrow('differs from the daemon startup environment');
+  });
+
+  it('still rejects a live change to, or removal of, a startup name, and names it', async () => {
+    process.env[STARTUP_NAME] = 'startup';
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
+    const message: string = `The daemon's own environment changed after it started (${STARTUP_NAME})`;
+    process.env[STARTUP_NAME] = 'changed';
+    await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toThrow(message);
+    delete process.env[STARTUP_NAME];
+    await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toThrow(message);
+    process.env[STARTUP_NAME] = 'startup';
+    await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+  });
+
+  it('keeps serving with a startup PATH that repeats an entry, and still names a changed PATH', async () => {
+    const originalPath: string | undefined = process.env.PATH;
+    const repeatedEntry: string = path.resolve('/rushd-test-repeated-path-entry');
+    const otherEntries: string[] = originalPath === undefined ? [] : [originalPath];
+    try {
+      process.env.PATH = [repeatedEntry, repeatedEntry, ...otherEntries].join(path.delimiter);
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      // Only the repeated entry differs, so the fingerprint is the same.
+      process.env.PATH = [repeatedEntry, ...otherEntries].join(path.delimiter);
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      process.env.PATH = otherEntries.join(path.delimiter);
+      await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toThrow(
+        "The daemon's own environment changed after it started (PATH)"
+      );
+    } finally {
+      if (originalPath === undefined) delete process.env.PATH;
+      else process.env.PATH = originalPath;
+    }
+  });
+
+  it('keeps serving while the daemon sets, changes or clears the marker of the processes that it starts', async () => {
+    const originalMarker: string | undefined = process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+    try {
+      process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = '/tmp/rushd-test/key.pid.json.groups-1';
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const startupEnvironment: Record<string, string> = getEnvironment();
+      const options: IResolveDaemonRequestOptions = createOptions(startupEnvironment);
+      process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = '/tmp/rushd-test/key.pid.json.groups-2';
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      // A client that an operation of another daemon runs has that daemon's marker.
+      const outerMarker: string = '/tmp/rushd-test/outer.pid.json.groups-3';
+      await expect(
+        resolver.getCommandParameterIdentityAsync(
+          createOptions({ ...startupEnvironment, [DAEMON_OPERATION_GROUPS_ENV_VAR]: outerMarker })
+        )
+      ).resolves.toBe('parameters');
+    } finally {
+      if (originalMarker === undefined) delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      else process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = originalMarker;
+    }
+  });
+
+  it("names the transport's marker in rush-lib's ignored and request-scoped variables", () => {
+    expect(workspaceFingerprintIgnoredEnvironmentVariables.has(DAEMON_OPERATION_GROUPS_ENV_VAR)).toBe(true);
+    expect(workspaceRequestScopedEnvironmentVariables.has(DAEMON_OPERATION_GROUPS_ENV_VAR)).toBe(true);
+  });
+
+  it('parses a request whose environment differs before it rejects the request for its environment', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions({ ...getEnvironment(), [ADDED_NAME]: 'x' });
+    // A lifecycle restarts the daemon for this error, so it must mean that the command line is phased.
+    const rejection: Promise<string> = resolver.getCommandParameterIdentityAsync(options);
+    await expect(rejection).rejects.toBeInstanceOf(DaemonRequestEnvironmentError);
+    await expect(rejection).rejects.toMatchObject({
+      code: 'unsupported',
+      message: expect.stringContaining('differs from the daemon startup environment')
+    });
+    expect(parse).toHaveBeenCalledTimes(1);
+    parse.mockRejectedValueOnce(new Error('"hello" is not a phased command.'));
+    await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toMatchObject({
+      name: 'DaemonRequestDispatchError',
+      code: 'unsupported',
+      message: expect.stringContaining('is not a phased command')
+    });
+    // Resolving checks the environment first, and has no parse of the rejected identity check to use.
+    await expect(hideResolvedValueAsync(resolver.resolveRequestAsync(options))).rejects.toBeInstanceOf(
+      DaemonRequestEnvironmentError
+    );
+    expect(parse).toHaveBeenCalledTimes(2);
+  });
+
+  it('rejects a command that it never serves before it parses or checks the environment', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const environment: Record<string, string> = { ...getEnvironment(), [ADDED_NAME]: 'x' };
+    const requests: [IDaemonRequestEnvelope, string][] = [
+      [
+        createWireEnvelope('rushx', 'build', process.cwd(), { environment, invocationKind: 'rushx' }),
+        'A rushx script is not a phased command request.'
+      ],
+      [
+        createWireEnvelope('list', 'list', process.cwd(), { environment }),
+        '"list" is a built-in command that is not phased.'
+      ]
+    ];
+    for (const [envelope, message] of requests) {
+      const options: IResolveDaemonRequestOptions = {
+        abortSignal: new AbortController().signal,
+        envelope,
+        workspaceSession: { rushConfiguration: {} } as IWorkspaceSession
+      };
+      // Not the environment error, for which a lifecycle would restart the daemon.
+      await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toMatchObject({
+        code: 'unsupported',
+        message
+      });
+      await expect(hideResolvedValueAsync(resolver.resolveRequestAsync(options))).rejects.toMatchObject({
+        code: 'unsupported',
+        message
+      });
+    }
+    expect(parseCount()).toBe(0);
+  });
+
+  it('keeps the startup environment for a replacement session', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
+    process.env[ADDED_NAME] = 'iteration-1';
+    const replacement: ProductionDaemonRequestResolver = resolver.createForSession();
+    await expect(replacement.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+  });
+
+  it('ignores insertion order for distinct environment names with identical locale collation', async () => {
+    const names: string[] = ['RUSHD_TEST_\u00e9', 'RUSHD_TEST_e\u0301'];
+    const original: (string | undefined)[] = names.map((name) => process.env[name]);
     try {
       process.env[names[0]] = 'composed';
       process.env[names[1]] = 'decomposed';
@@ -38,7 +227,6 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
         'differs from the daemon startup environment'
       );
     } finally {
-      parse.mockRestore();
       names.forEach((name, index) => {
         if (original[index] === undefined) delete process.env[name];
         else process.env[name] = original[index];
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
new file mode 100644
index 00000000000..35421bb5d6f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
@@ -0,0 +1,290 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import { formatNativeLockHolder } from '@rushstack/rush-client-core';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonNativeLockHolder,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  createNativeScriptGateAsync,
+  startNativeCommand,
+  type INativeCommand,
+  type INativeScriptGate
+} from './NativeEngineTestCommands';
+import {
+  createWireEnvelope,
+  DaemonRequestWireClient,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+import {
+  createFixtureAsync,
+  requestEnvironment,
+  runAsync,
+  runs,
+  type IFixture
+} from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+interface IGatedNativeCommand {
+  readonly native: INativeCommand;
+  readonly gate: INativeScriptGate;
+}
+
+describe('native production daemon engine, while a native Rush action holds the repository lock', () => {
+  it('waits at preparation and at iteration time, naming the action, and then runs', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const commands: IGatedNativeCommand[] = [];
+    try {
+      const first: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(first);
+      await sendRequestAsync(fixture, 'busy-initialization', ['build', '--only', 'b']);
+      expect(await readNativeLockHolderAsync(fixture.client, 'busy-initialization')).toEqual(
+        getExpectedHolder(first.native)
+      );
+      expect(fixture.session.operationGraph).toBeUndefined();
+      await first.gate.releaseAsync();
+      expect(await first.native.result).toMatchObject({ exitCode: 0 });
+      expect((await fixture.client.readTerminalAsync('busy-initialization')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(graph).toBeDefined();
+
+      const second: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(second);
+      await sendRequestAsync(fixture, 'busy-iteration', ['build', '--only', 'b']);
+      expect(await readNativeLockHolderAsync(fixture.client, 'busy-iteration')).toEqual(
+        getExpectedHolder(second.native)
+      );
+      await second.gate.releaseAsync();
+      expect(await second.native.result).toMatchObject({ exitCode: 0 });
+      expect((await fixture.client.readTerminalAsync('busy-iteration')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      // The request waited to run an iteration of the graph that it had loaded, not to load a new one. The native
+      // rebuild of a left b up to date.
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'a:one:']);
+    } finally {
+      await releaseAllAsync(commands);
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('fails at once or on timeout, naming the action, when a request may not wait for the lock', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const commands: IGatedNativeCommand[] = [];
+    try {
+      const first: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(first);
+      await expectAdmissionFailuresAsync(fixture, 'initialization', first.native);
+      expect(fixture.session.operationGraph).toBeUndefined();
+      await first.gate.releaseAsync();
+      expect(await first.native.result).toMatchObject({ exitCode: 0 });
+      expect((await runAsync(fixture, 'retry', ['build', '--only', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+
+      const second: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(second);
+      await expectAdmissionFailuresAsync(fixture, 'iteration', second.native);
+      await second.gate.releaseAsync();
+      expect(await second.native.result).toMatchObject({ exitCode: 0 });
+      expect((await runAsync(fixture, 'retry-iteration', ['build', '--only', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'a:one:']);
+    } finally {
+      await releaseAllAsync(commands);
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('has requests behind the graph load spend their wait timeouts while the load waits for the lock', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const commands: IGatedNativeCommand[] = [];
+    let behind: DaemonRequestWireClient | undefined;
+    try {
+      const first: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(first);
+      await sendRequestAsync(fixture, 'loading', ['build', '--only', 'b']);
+      await readNativeLockHolderAsync(fixture.client, 'loading');
+
+      // Waiting for another Rush process is contention, not progress that pauses the followers' wait timeouts. The
+      // followers wait for that process too, and are told which it is.
+      behind = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
+      await behind.handshakeAsync();
+      await behind.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('behind', 'build', fixture.repoRoot, {
+          admission: { waitTimeoutMs: 1000 },
+          argv: ['build', '--only', 'b'],
+          environment: requestEnvironment(),
+          commandOrigin: 'built-in'
+        })
+      });
+      const nativeLockHolder: IDaemonNativeLockHolder = getExpectedHolder(first.native);
+      const exchange: ITerminalExchange = await behind.readTerminalAsync('behind');
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage:
+            "The request was not admitted within its 1000ms wait timeout while waiting for another request's load " +
+            `or reload of the workspace graph, which waits for ${formatNativeLockHolder(nativeLockHolder)} to ` +
+            "release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+        }
+      });
+      expect(getQueuePositionPayloads(exchange)).toEqual([
+        { position: 1, requestId: 'behind', nativeLockHolder }
+      ]);
+
+      await first.gate.releaseAsync();
+      expect(await first.native.result).toMatchObject({ exitCode: 0 });
+      expect((await fixture.client.readTerminalAsync('loading')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+    } finally {
+      await behind?.closeAsync();
+      await releaseAllAsync(commands);
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
+
+/** Starts a native rebuild of project `a` that holds Rush's repository lock until its gate is released. */
+async function startGatedNativeRebuildAsync(repoRoot: string): Promise<IGatedNativeCommand> {
+  const gate: INativeScriptGate = await createNativeScriptGateAsync(repoRoot, 'a');
+  const native: INativeCommand = startNativeCommand(repoRoot, [
+    'rebuild',
+    '--only',
+    'a',
+    '--parallelism',
+    '3'
+  ]);
+  try {
+    await Promise.race([
+      gate.entered,
+      native.result.then((result) => {
+        throw new Error(`Native action did not enter its script gate: ${JSON.stringify(result)}`);
+      })
+    ]);
+  } catch (error) {
+    await releaseAllAsync([{ native, gate }]);
+    throw error;
+  }
+  return { native, gate };
+}
+
+async function releaseAllAsync(commands: ReadonlyArray<IGatedNativeCommand>): Promise<void> {
+  for (const { native, gate } of commands) {
+    await gate.releaseAsync();
+    await native.result.catch(() => undefined);
+  }
+}
+
+/** Only Linux can tell which process holds the lock. The command line of `node -e` names no program. */
+function getExpectedHolder(native: INativeCommand): IDaemonNativeLockHolder {
+  return process.platform === 'linux' ? { pid: native.pid } : {};
+}
+
+async function expectAdmissionFailuresAsync(
+  fixture: IFixture,
+  stage: string,
+  native: INativeCommand
+): Promise<void> {
+  const holder: string = formatNativeLockHolder(getExpectedHolder(native));
+  const argv: string[] = ['build', '--only', 'b'];
+  expect(
+    (await runAsync(fixture, `${stage}-zero`, argv, { admission: { waitTimeoutMs: 0 } })).terminal
+  ).toMatchObject({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      admissionErrorCode: 'wait-timeout',
+      errorMessage:
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock. ` +
+        'Use --wait-timeout <seconds> to wait for it.'
+    }
+  });
+  expect(
+    (await runAsync(fixture, `${stage}-no-wait`, argv, { admission: { noWait: true } })).terminal
+  ).toMatchObject({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      admissionErrorCode: 'no-wait',
+      errorMessage:
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock, and ` +
+        '--no-wait was specified.'
+    }
+  });
+  expect(
+    (await runAsync(fixture, `${stage}-timeout`, argv, { admission: { waitTimeoutMs: 300 } })).terminal
+  ).toMatchObject({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      admissionErrorCode: 'wait-timeout',
+      errorMessage:
+        `The request was not admitted within its 300ms wait timeout while waiting for ${holder} to release ` +
+        "this repository's lock. Use --wait-timeout <seconds> to wait longer."
+    }
+  });
+}
+
+async function sendRequestAsync(fixture: IFixture, requestId: string, argv: string[]): Promise<void> {
+  await fixture.client.sendControlAsync({
+    kind: 'requestStart',
+    payload: createWireEnvelope(requestId, argv[0], fixture.repoRoot, {
+      argv,
+      environment: requestEnvironment(),
+      commandOrigin: 'built-in'
+    })
+  });
+}
+
+function getQueuePositionPayloads(
+  exchange: ITerminalExchange
+): IDaemonRequestQueuePositionMessage['payload'][] {
+  return exchange.frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .flatMap((message: DaemonControlMessage) => (message.kind === 'queuePosition' ? [message.payload] : []));
+}
+
+/** Reads frames until the daemon says that the request waits for native Rush's repository lock. */
+async function readNativeLockHolderAsync(
+  client: DaemonRequestWireClient,
+  requestId: string
+): Promise<IDaemonNativeLockHolder> {
+  for (;;) {
+    const frame: IDaemonFrame = await client.readFrameAsync();
+    if (frame.kind !== DaemonFrameType.controlJson) continue;
+    const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+    if (message.kind === 'queuePosition' && message.payload.requestId === requestId) {
+      if (message.payload.nativeLockHolder) return message.payload.nativeLockHolder;
+    } else if (
+      (message.kind === 'requestResult' || message.kind === 'requestRejected') &&
+      message.payload.requestId === requestId
+    ) {
+      throw new Error(`The request ended without waiting for the lock: ${JSON.stringify(message)}`);
+    }
+  }
+}
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
new file mode 100644
index 00000000000..191a5893c9b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
@@ -0,0 +1,260 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+import * as v8 from 'node:v8';
+import * as vm from 'node:vm';
+
+import { PhasedCommandEngine, type IParsePhasedCommandOptions } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import type { IWorkspaceSession } from '../WorkspaceSession';
+import { createWireEnvelope, hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
+
+function createSession(): IWorkspaceSession {
+  // The native engine is already bound, so that a resolution only parses and selects operations.
+  return {
+    rushConfiguration: {},
+    rushSession: {},
+    operationGraph: {},
+    engineShape: {},
+    initializeEngineAsync: async () => undefined
+  } as unknown as IWorkspaceSession;
+}
+
+function createOptions(
+  workspaceSession: IWorkspaceSession,
+  abortController: AbortController = new AbortController()
+): IResolveDaemonRequestOptions {
+  return {
+    abortSignal: abortController.signal,
+    envelope: createWireEnvelope('request', 'build', process.cwd(), {
+      commandOrigin: 'built-in',
+      environment: Object.fromEntries(
+        Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+      )
+    }),
+    workspaceSession
+  };
+}
+
+/** Checks the identity of a request, which is unreachable when this returns. */
+async function checkIdentityAsync(
+  resolver: ProductionDaemonRequestResolver,
+  session: IWorkspaceSession
+): Promise<void> {
+  await resolver.getCommandParameterIdentityAsync(createOptions(session));
+}
+
+/**
+ * Returns V8's garbage collection function. Unless the process already exposes `gc`, `--expose-gc` is turned off
+ * again once one context has it, because every context that is created while it is on gets a `gc` global: that
+ * includes the one that jest creates for the next test file in this worker.
+ */
+function getGarbageCollection(): () => void {
+  const exposed: unknown = (globalThis as { gc?: unknown }).gc;
+  if (typeof exposed === 'function') {
+    return exposed as () => void;
+  }
+  v8.setFlagsFromString('--expose-gc');
+  try {
+    return vm.runInNewContext('gc');
+  } finally {
+    v8.setFlagsFromString('--no-expose-gc');
+  }
+}
+
+/** The workspace lifecycle resolves a request with a copy of the envelope of its identity check. */
+function dispatched(options: IResolveDaemonRequestOptions): IResolveDaemonRequestOptions {
+  return { ...options, envelope: { ...options.envelope, admission: { waitTimeoutMs: 1000 } } };
+}
+
+describe('ProductionDaemonRequestResolver command line parsing', () => {
+  let parses: number;
+  let parameterIdentity: string;
+  let selectionError: Error | undefined;
+  let commands: WeakRef<PhasedCommandEngine>[];
+  let parse: jest.SpyInstance;
+
+  beforeEach(() => {
+    parses = 0;
+    parameterIdentity = 'parameters';
+    selectionError = undefined;
+    commands = [];
+    parse = jest
+      .spyOn(PhasedCommandEngine, 'parseAsync')
+      .mockImplementation(async ({ terminalProvider }: IParsePhasedCommandOptions) => {
+        terminalProvider.write(`Warning from parse ${++parses}\n`, TerminalProviderSeverity.warning);
+        const command: PhasedCommandEngine = {
+          commandName: 'build',
+          parameterIdentity,
+          requestSettings: {},
+          unmatchedCompatiblePluginNames: [],
+          // The engine of any parse can serve any other parse.
+          getEngineSharingBlocker: () => undefined,
+          selectOperationsAsync: async () => {
+            if (selectionError) throw selectionError;
+            return new Map();
+          }
+        } as unknown as PhasedCommandEngine;
+        commands.push(new WeakRef(command));
+        return command;
+      });
+  });
+
+  afterEach(() => {
+    parse.mockRestore();
+  });
+
+  it('resolves a request with the parse of its identity check', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+    await expect(resolver.resolveRequestAsync(dispatched(options))).resolves.toMatchObject({
+      kind: 'phased',
+      request: { requestId: 'request' }
+    });
+    expect(parses).toBe(1);
+  });
+
+  it('resolves a request that the bound engine serves with the parse of its identity check', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const session: IWorkspaceSession = createSession();
+    await resolver.resolveRequestAsync(createOptions(session));
+    // The identity check answers with the identity of the bound engine, which can serve this parse.
+    parameterIdentity = 'other parameters';
+    const options: IResolveDaemonRequestOptions = createOptions(session);
+    await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+    await expect(resolver.resolveRequestAsync(dispatched(options))).resolves.toMatchObject({
+      kind: 'phased',
+      request: { requestId: 'request' }
+    });
+    expect(parses).toBe(2);
+  });
+
+  it.each<[string, Partial<IDaemonRequestEnvelope>]>([
+    // build and rebuild are both built-in, so here only the name does not match the parse.
+    ['name', { commandName: 'rebuild' }],
+    ['origin', { commandOrigin: 'custom' }]
+  ])(
+    'checks the command %s of a request that it resolves with the parse of its identity check',
+    async (name, change) => {
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const options: IResolveDaemonRequestOptions = createOptions(createSession());
+      await resolver.getCommandParameterIdentityAsync(options);
+      await expect(
+        hideResolvedValueAsync(
+          resolver.resolveRequestAsync({ ...options, envelope: { ...options.envelope, ...change } })
+        )
+      ).rejects.toMatchObject({
+        code: 'invalidRequest',
+        message: 'The command name or origin does not match the native parsed argv.'
+      });
+      expect(parses).toBe(1);
+    }
+  );
+
+  it('reports the diagnostics of the parse that it reused with a selection error', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const session: IWorkspaceSession = createSession();
+    await resolver.resolveRequestAsync(createOptions(session));
+    const options: IResolveDaemonRequestOptions = createOptions(session);
+    await resolver.getCommandParameterIdentityAsync(options);
+    selectionError = new Error('The project name "nope" does not exist.');
+    await expect(
+      hideResolvedValueAsync(resolver.resolveRequestAsync(dispatched(options)))
+    ).rejects.toMatchObject({
+      code: 'invalidRequest',
+      message: 'The project name "nope" does not exist.\nWarning from parse 2'
+    });
+    expect(parses).toBe(2);
+  });
+
+  it.each<[string, (envelope: IDaemonRequestEnvelope) => Partial<IDaemonRequestEnvelope>]>([
+    ['another request', () => ({ requestId: 'another' })],
+    ['another argv', ({ argv }) => ({ argv: [...argv] })],
+    ['another working folder', ({ cwd }) => ({ cwd: path.dirname(cwd) })],
+    ['another environment', ({ environment }) => ({ environment: { ...environment } })]
+  ])('parses again to resolve %s', async (name, change) => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.resolveRequestAsync({
+      ...options,
+      envelope: { ...options.envelope, ...change(options.envelope) }
+    });
+    expect(parses).toBe(2);
+  });
+
+  it('parses again to resolve a request for another session, or with another resolver', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.resolveRequestAsync({ ...options, workspaceSession: createSession() });
+    expect(parses).toBe(2);
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.createForSession().resolveRequestAsync(dispatched(options));
+    expect(parses).toBe(4);
+  });
+
+  it('uses the parse of an identity check for only one resolution', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.resolveRequestAsync(dispatched(options));
+    await resolver.resolveRequestAsync(dispatched(options));
+    expect(parses).toBe(2);
+  });
+
+  it('rejects a request that was cancelled after its identity check', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const abortController: AbortController = new AbortController();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession(), abortController);
+    await resolver.getCommandParameterIdentityAsync(options);
+    abortController.abort();
+    await expect(
+      hideResolvedValueAsync(resolver.resolveRequestAsync(dispatched(options)))
+    ).rejects.toMatchObject({
+      code: 'routingFailed',
+      message: 'The request was cancelled before engine initialization.'
+    });
+    expect(parses).toBe(1);
+  });
+
+  it('rejects a request if the daemon environment changed after its identity check', async () => {
+    // A name that a plugin adds to the daemon's environment is not a change, so this changes a startup name.
+    process.env.RUSHD_TEST_REQUEST_PARSE = 'startup';
+    try {
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const options: IResolveDaemonRequestOptions = createOptions(createSession());
+      await resolver.getCommandParameterIdentityAsync(options);
+      process.env.RUSHD_TEST_REQUEST_PARSE = 'changed';
+      await expect(
+        hideResolvedValueAsync(resolver.resolveRequestAsync(dispatched(options)))
+      ).rejects.toMatchObject({
+        code: 'unsupported',
+        message: expect.stringContaining(
+          "The daemon's own environment changed after it started (RUSHD_TEST_REQUEST_PARSE)"
+        )
+      });
+      expect(parses).toBe(1);
+    } finally {
+      delete process.env.RUSHD_TEST_REQUEST_PARSE;
+    }
+  });
+
+  it('keeps the parse of an identity check only as long as its request', async () => {
+    const collectGarbage: () => void = getGarbageCollection();
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    await checkIdentityAsync(resolver, createSession());
+    parse.mockClear();
+    // A WeakRef keeps its target until the current job ends.
+    await new Promise((resolve) => setImmediate(resolve));
+    collectGarbage();
+    expect(commands).toHaveLength(1);
+    expect(commands[0].deref()).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index bdf16347449..4de725b10de 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -8,46 +8,35 @@ import { execFileSync } from 'node:child_process';
 
 import {
   PhasedCommandEngine,
-  Rush,
   RushProjectConfiguration,
-  RushUserConfiguration,
   type IOperationGraph,
+  type IPhasedCommandEngine,
+  type ITelemetryData,
   type Operation,
-  type OperationEnabledState,
   type RushConfigurationProject
 } from '@microsoft/rush-lib';
+import type { LockFile } from '@rushstack/node-core-library';
 import {
   DaemonFrameType,
   decodeDaemonEventFrame,
-  decodeDaemonLogChunk,
-  type IDaemonPhasedRequestResult,
-  type IDaemonRequestEnvelope
+  type IDaemonPhasedRequestResult
 } from '@rushstack/rush-daemon-protocol';
 import { NoOpTerminalProvider, Terminal, TerminalProviderSeverity } from '@rushstack/terminal';
 import { StandardScriptUpdater } from '@microsoft/rush-lib/lib/logic/StandardScriptUpdater';
 import { RushConfiguration as InternalRushConfiguration } from '@microsoft/rush-lib/lib/api/RushConfiguration';
 
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
-import { RushDaemonHost } from '../RushDaemonHost';
-import { WorkspaceSession } from '../WorkspaceSession';
+import type { WorkspaceSession } from '../WorkspaceSession';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
-import { removeTestFolderAsync } from './TestProcessExit';
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 import { EngineTerminalProvider } from '../EngineTerminalProvider';
 import { DaemonShutdownError } from '../DaemonShutdownError';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import type {
-  GetWorkspaceSuccessorLaunchAsync,
-  IWorkspaceProcessRestartResult
-} from '../WorkspaceProcessRestart';
+import type { IWorkspaceProcessRestartResult } from '../WorkspaceProcessRestart';
 import type { IResolveDaemonRequestOptions, ResolvedDaemonRequest } from '../DaemonRequestDispatcher';
-import type { IDaemonRequestResolver } from '../DaemonRequestDispatcher';
-import {
-  isRushxInvocation,
-  wrapWorkspaceResolverLifecycle,
-  type IWorkspaceResolverLifecycle
-} from '../WorkspaceResolverLifecycle';
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IRequestLease } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import { TestPhasedRequestClient } from './PhasedRequestRouterTestUtilities';
 import {
   createNativeScriptGateAsync,
@@ -62,293 +51,63 @@ import {
   type IDeferred,
   type ITerminalExchange
 } from './DaemonRequestWireTestUtilities';
+import {
+  createFixtureAsync,
+  DecoratedTestResolver,
+  logText,
+  readTelemetryEntries,
+  requestEnvironment,
+  runAsync,
+  runs,
+  type IFixture
+} from './NativeEngineTestFixture';
 
-const RUSH_VERSION: string = Rush.version;
 jest.setTimeout(30_000);
 
-interface IFixture extends AsyncDisposable {
-  readonly repoRoot: string;
-  readonly host: RushDaemonHost;
-  readonly session: WorkspaceSession;
-  readonly client: DaemonRequestWireClient;
-}
-
-interface IFixtureOptions {
-  readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
-  readonly onSessionCreated?: (session: WorkspaceSession) => void;
-  readonly resolver?: IDaemonRequestResolver;
-}
-
-class DecoratedTestResolver implements IDaemonRequestResolver {
-  public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
-  private readonly _inner: IDaemonRequestResolver;
-  private readonly _events: string[];
-  private readonly _id: number;
-  private _disposed: boolean = false;
-
-  public constructor(inner: IDaemonRequestResolver, events: string[]) {
-    this._inner = inner;
-    this._events = events;
-    this._id = events.filter((event) => event.startsWith('created')).length;
-    events.push(`created:${this._id}`);
-    this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
-      inner,
-      (replacement) => new DecoratedTestResolver(replacement, events)
-    );
-  }
-
-  public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
-    if (this._disposed) throw new Error('A disposed resolver was invoked.');
-    if (isRushxInvocation(options.envelope)) {
-      this._events.push(`isolated:${this._id}`);
-      throw new Error('Explicit isolated invocation reached the decorated resolver.');
-    }
-    return await this._inner.resolveRequestAsync(options);
-  }
-
-  public async [Symbol.asyncDispose](): Promise<void> {
-    if (this._disposed) throw new Error('A resolver was disposed twice.');
-    this._disposed = true;
-    this._events.push(`disposed:${this._id}`);
-    await this._inner[Symbol.asyncDispose]?.();
-  }
-}
-
-async function createFixtureAsync(
-  cache: boolean = false,
-  configurationKind: 'direct' | 'rig' | 'inherited' = 'direct',
-  options: IFixtureOptions = {}
-): Promise<IFixture> {
-  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-native-engine-'));
-  const cacheNamespace: string = path.basename(repoRoot);
-  const userConfiguration: RushUserConfiguration = await RushUserConfiguration.initializeAsync();
-  const cacheFolder: string = path.join(
-    userConfiguration.buildCacheFolder ?? path.join(repoRoot, 'common/temp/build-cache'),
-    cacheNamespace
-  );
-  const write: (name: string, text: string) => void = (name, text) => {
-    const filename: string = path.join(repoRoot, name);
-    fs.mkdirSync(path.dirname(filename), { recursive: true });
-    fs.writeFileSync(filename, text);
-  };
-  write(
-    'rush.json',
-    JSON.stringify({
-      rushVersion: RUSH_VERSION,
-      npmVersion: '10.0.0',
-      // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
-      daemon: { warmMemoryBudgetMB: 100_000 },
-      projectFolderMinDepth: 2,
-      projectFolderMaxDepth: 2,
-      projects: ['a', 'b', 'c'].map((name) => ({
-        packageName: name,
-        projectFolder: `projects/${name}`
-      }))
-    })
-  );
-  write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\n**/lib/\n**/node_modules/\nruns.txt\n');
-  write('common/temp/last-link.flag', '{}');
-  write('common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
-  write(
-    'common/config/rush/command-line.json',
-    JSON.stringify({
-      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
-      commands: [
-        {
-          commandKind: 'phased',
-          name: 'build',
-          phases: ['_phase:compile'],
-          incremental: true,
-          enableParallelism: true
-        }
-      ],
-      parameters: [
-        {
-          parameterKind: 'flag',
-          longName: '--production',
-          description: 'Production build',
-          associatedCommands: ['build'],
-          associatedPhases: ['_phase:compile']
-        }
-      ]
-    })
-  );
-  if (cache) {
-    write(
-      'common/config/rush/build-cache.json',
-      JSON.stringify({
-        buildCacheEnabled: true,
-        cacheProvider: 'local-only',
-        cacheEntryNamePattern: `${cacheNamespace}/[hash]`
-      })
-    );
-  }
-  for (const name of ['a', 'b', 'c']) {
-    write(
-      `projects/${name}/package.json`,
-      JSON.stringify({
-        name,
-        version: '1.0.0',
-        scripts: { '_phase:compile': 'node build.cjs' },
-        dependencies: name === 'b' ? { a: '1.0.0' } : {}
-      })
-    );
-    write(
-      `projects/${name}/config/rush-project.json`,
-      JSON.stringify({
-        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
-      })
-    );
-    write(`projects/${name}/input.txt`, 'one');
-    write(
-      `projects/${name}/build.cjs`,
-      `
-const fs = require('node:fs');
-const path = require('node:path');
-const name = require('./package.json').name;
-const input = fs.readFileSync('input.txt', 'utf8');
-(async () => {
-const gateFile = path.resolve('../../common/temp/gate-' + name + '.json');
-if (fs.existsSync(gateFile)) {
-  const { port } = JSON.parse(fs.readFileSync(gateFile, 'utf8'));
-  await new Promise((resolve, reject) => {
-    const socket = require('node:net').connect(port, '127.0.0.1');
-    socket.once('error', reject);
-    socket.once('data', () => { socket.end(); resolve(); });
-  });
-}
-fs.appendFileSync('../../runs.txt', name + ':' + input + ':' + process.argv.slice(2).join(' ') + '\\n');
-fs.mkdirSync('lib', { recursive: true });
-fs.writeFileSync('lib/output.txt', input);
-console.log('built-' + name + '-' + input);
-if (input === 'warning') console.error('warning-' + name);
-if (input === 'failure') process.exitCode = 7;
-})().catch((error) => { console.error(error); process.exitCode = 1; });
-`
-    );
-  }
-  if (configurationKind === 'rig') {
-    fs.rmSync(path.join(repoRoot, 'projects/a/config/rush-project.json'));
-    write('projects/a/config/rig.json', '{"rigPackageName":"fixture-rig"}');
-    write('projects/a/node_modules/fixture-rig/package.json', '{"name":"fixture-rig","version":"1.0.0"}');
-    write(
-      'projects/a/node_modules/fixture-rig/profiles/default/config/rush-project.json',
-      JSON.stringify({
-        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
-      })
-    );
-  } else if (configurationKind === 'inherited') {
-    write(
-      'common/temp/inherited-rush-project.json',
-      JSON.stringify({
-        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
-      })
-    );
-    write(
-      'projects/a/config/rush-project.json',
-      JSON.stringify({
-        extends: '../../../common/temp/inherited-rush-project.json',
-        incrementalBuildIgnoredGlobs: ['ignored.txt']
-      })
-    );
-  }
-  execFileSync('git', ['init', '--quiet'], { cwd: repoRoot });
-  execFileSync('git', ['config', '--local', 'core.autocrlf', 'false'], { cwd: repoRoot });
-  execFileSync('git', ['add', '.'], { cwd: repoRoot });
-  execFileSync(
-    'git',
-    [
-      '-c',
-      'user.name=Engine Test',
-      '-c',
-      'user.email=engine@example.invalid',
-      'commit',
-      '--quiet',
-      '-m',
-      'fixture'
-    ],
-    { cwd: repoRoot }
-  );
-  let session: WorkspaceSession | undefined;
-  let host: RushDaemonHost | undefined;
-  try {
-    host = await RushDaemonHost.startAsync({
-      repoRoot,
-      rushVersion: RUSH_VERSION,
-      daemonVersion: 'native-engine-test',
-      requestResolver: options.resolver ?? new ProductionDaemonRequestResolver(),
-      getSuccessorLaunchAsync: options.getSuccessorLaunchAsync,
-      createWorkspaceSessionAsync: async (sessionOptions) => {
-        session = await WorkspaceSession.createAsync(sessionOptions);
-        options.onSessionCreated?.(session);
-        return session;
-      }
-    });
-    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
-    await client.handshakeAsync();
-    const runningHost: RushDaemonHost = host;
-    return {
-      repoRoot,
-      host,
-      get session(): WorkspaceSession {
-        return session!;
-      },
-      client,
-      [Symbol.asyncDispose]: async () => {
-        await client.closeAsync().finally(() => runningHost.closeAsync());
-        if (cache) await removeTestFolderAsync(cacheFolder, true);
-        await removeTestFolderAsync(repoRoot, true);
+describe('native production daemon engine', () => {
+  it("runs each request's operations with its requester's session and invocation folder", async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const recordFile: string = path.join(fixture.repoRoot, 'common/temp/operation-environment.txt');
+    const projectFolder: string = path.join(fixture.repoRoot, 'projects/a');
+    const daemonSession: string | undefined = process.env.COPILOT_AGENT_SESSION_ID;
+    // This in-process host's own value stands in for the session that started the daemon.
+    process.env.COPILOT_AGENT_SESSION_ID = 'daemon-starter';
+    try {
+      fs.writeFileSync(recordFile, '');
+      const requests: ReadonlyArray<readonly [string, string | undefined, string]> = [
+        ['first-a', 'session-A', fixture.repoRoot],
+        ['then-b', 'session-B', projectFolder],
+        ['again-a', 'session-A', fixture.repoRoot],
+        ['unset', undefined, fixture.repoRoot]
+      ];
+      for (const [requestId, session, cwd] of requests) {
+        const environment: Record<string, string> = requestEnvironment();
+        delete environment.COPILOT_AGENT_SESSION_ID;
+        if (session !== undefined) environment.COPILOT_AGENT_SESSION_ID = session;
+        const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['rebuild', '--only', 'a'], {
+          cwd,
+          environment
+        });
+        expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
       }
-    };
-  } catch (error) {
-    await host?.closeAsync();
-    if (cache) await removeTestFolderAsync(cacheFolder, true);
-    await removeTestFolderAsync(repoRoot, true);
-    throw error;
-  }
-}
-
-async function runAsync(
-  fixture: IFixture,
-  requestId: string,
-  argv: string[],
-  overrides: Partial<IDaemonRequestEnvelope> = {}
-): Promise<ITerminalExchange> {
-  const environment: Record<string, string> = {};
-  for (const [name, value] of Object.entries(process.env)) {
-    if (value !== undefined) environment[name] = value;
-  }
-  await fixture.client.sendControlAsync({
-    kind: 'requestStart',
-    payload: createWireEnvelope(requestId, argv[0], fixture.repoRoot, {
-      argv,
-      environment,
-      commandOrigin: 'built-in',
-      ...overrides
-    })
+      const records: unknown[] = fs
+        .readFileSync(recordFile, 'utf8')
+        .trim()
+        .split('\n')
+        .map((line: string) => JSON.parse(line));
+      expect(records).toEqual([
+        ['a', 'session-A', fixture.repoRoot],
+        ['a', 'session-B', projectFolder],
+        ['a', 'session-A', fixture.repoRoot],
+        ['a', null, fixture.repoRoot]
+      ]);
+    } finally {
+      if (daemonSession === undefined) delete process.env.COPILOT_AGENT_SESSION_ID;
+      else process.env.COPILOT_AGENT_SESSION_ID = daemonSession;
+      await fixture[Symbol.asyncDispose]();
+    }
   });
-  return await fixture.client.readTerminalAsync(requestId);
-}
-
-function runs(fixture: IFixture): string[] {
-  const filename: string = path.join(fixture.repoRoot, 'runs.txt');
-  return fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8').trim().split('\n') : [];
-}
-
-function logText(exchange: ITerminalExchange): string {
-  return exchange.frames
-    .filter((frame) => frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr)
-    .map((frame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
-    .join('');
-}
-
-function requestEnvironment(): Record<string, string> {
-  return Object.fromEntries(
-    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
-  );
-}
 
-describe('native production daemon engine', () => {
   it('preserves resolver decoration and isolated invocation routing across native generation reloads', async () => {
     const events: string[] = [];
     const fixture: IFixture = await createFixtureAsync(false, 'direct', {
@@ -398,6 +157,60 @@ describe('native production daemon engine', () => {
     expect(events.at(-1)).toBe('disposed:2');
   });
 
+  it('rejects an unknown project with only the error line and keeps the graph it loaded for later requests', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      const rejection: { kind: string; payload: { code: string; message: string } } = {
+        kind: 'requestRejected',
+        payload: {
+          code: 'invalidRequest',
+          message: 'The project name "nope" passed to "--to" does not exist in rush.json.'
+        }
+      };
+      expect((await runAsync(fixture, 'cold', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      const session: WorkspaceSession = fixture.session;
+      const graph: IOperationGraph | undefined = session.operationGraph;
+      expect(graph).toBeDefined();
+      expect((await runAsync(fixture, 'again', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      expect((await runAsync(fixture, 'valid', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect(fixture.session).toBe(session);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('gives the error as the reason for an invalid selection, before a warning that the parse wrote', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', {
+      compatiblePlugins: ['no-such-plugin']
+    });
+    // The binding request also writes the warning to the daemon's own stderr, which is the launcher log.
+    const stderr: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    try {
+      const rejection: { kind: string; payload: { code: string; message: string } } = {
+        kind: 'requestRejected',
+        payload: {
+          code: 'invalidRequest',
+          message:
+            'The project name "nope" passed to "--to" does not exist in rush.json.\n' +
+            `The daemon's compatible plugin list (rush.json "daemon.compatiblePlugins" or ` +
+            'RUSH_DAEMON_COMPATIBLE_PLUGINS) names plugins that are not configured in rush-plugins.json: ' +
+            `"no-such-plugin". Check that each entry is the plugin's "pluginName".`
+        }
+      };
+      expect((await runAsync(fixture, 'cold', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      expect((await runAsync(fixture, 'warm', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      expect(runs(fixture)).toEqual([]);
+    } finally {
+      stderr.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('keeps tier0 session and graph identity for unchanged content, including metadata touches', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
@@ -418,6 +231,48 @@ describe('native production daemon engine', () => {
     }
   });
 
+  it('parses the command line of a warm request once, for its identity check and its resolution', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const parse: jest.SpyInstance = jest.spyOn(PhasedCommandEngine, 'parseAsync');
+    try {
+      await runAsync(fixture, 'cold-parse', ['build', '--only', 'a']);
+      parse.mockClear();
+      expect((await runAsync(fixture, 'warm-parse', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(parse).toHaveBeenCalledTimes(1);
+    } finally {
+      parse.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('serves client output and request-scoped settings in the same generation instead of restarting', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial-settings', ['build', '--only', 'a']);
+      const session: WorkspaceSession = fixture.session;
+      const graph: IOperationGraph | undefined = session.operationGraph;
+      const environment: Record<string, string> = {
+        ...requestEnvironment(),
+        RUSH_PARALLELISM: process.env.RUSH_PARALLELISM === '1' ? '2' : '1',
+        RUSHD_OUTPUT: process.env.RUSHD_OUTPUT === 'legacy' ? 'agent' : 'legacy',
+        COPILOT_AGENT_SESSION_ID: 'another-agent-session'
+      };
+      expect(
+        (await runAsync(fixture, 'request-scoped-settings', ['build', '--only', 'a'], { environment }))
+          .terminal
+      ).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0, scheduled: false } });
+      expect(fixture.session).toBe(session);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(readDaemonLockfile(fixture.host.paths.lockfilePath)?.pid).toBe(process.pid);
+      expect(runs(fixture)).toEqual(['a:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('keeps the selected native SDK handoff instead of restarting for a foreign client engine path', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
@@ -438,6 +293,48 @@ describe('native production daemon engine', () => {
     }
   });
 
+  it('keeps its own linked spelling of the native SDK handoff', async () => {
+    // A deployed daemon spells rush-lib through its own node_modules link, so plugins can resolve it by name.
+    const originalRushLibPath: string | undefined = process.env._RUSH_LIB_PATH;
+    const linkRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-sdk-link-'));
+    const rushLibFolder: string = path.dirname(require.resolve('@microsoft/rush-lib/package.json'));
+    const rushLibLink: string = path.join(linkRoot, 'node_modules', '@microsoft', 'rush-lib');
+    fs.mkdirSync(path.dirname(rushLibLink), { recursive: true });
+    fs.symlinkSync(rushLibFolder, rushLibLink, 'junction');
+    const linkedEntryPoint: string = path.join(
+      rushLibLink,
+      path.relative(rushLibFolder, require.resolve('@microsoft/rush-lib'))
+    );
+    process.env._RUSH_LIB_PATH = linkedEntryPoint;
+    try {
+      const fixture: IFixture = await createFixtureAsync();
+      try {
+        expect((await runAsync(fixture, 'linked-sdk', ['build', '--only', 'a'])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0 }
+        });
+        const environment: Record<string, string> = {
+          ...requestEnvironment(),
+          _RUSH_LIB_PATH: path.join(fixture.repoRoot, 'foreign-client-engine.js')
+        };
+        expect(
+          (await runAsync(fixture, 'foreign-linked-sdk', ['build', '--only', 'a'], { environment })).terminal
+        ).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0, scheduled: false } });
+        expect(process.env._RUSH_LIB_PATH).toBe(linkedEntryPoint);
+        expect(runs(fixture)).toEqual(['a:one:']);
+      } finally {
+        await fixture[Symbol.asyncDispose]();
+      }
+    } finally {
+      if (originalRushLibPath === undefined) {
+        delete process.env._RUSH_LIB_PATH;
+      } else {
+        process.env._RUSH_LIB_PATH = originalRushLibPath;
+      }
+      fs.rmSync(linkRoot, { recursive: true, force: true });
+    }
+  });
+
   it('replaces configuration and command shape in-process without using a disposed generation', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
@@ -462,12 +359,12 @@ describe('native production daemon engine', () => {
       expect(fixture.host.workspaceGeneration).toBeGreaterThan(firstGeneration);
       expect(readDaemonLockfile(fixture.host.paths.lockfilePath)?.pid).toBe(process.pid);
       const second: WorkspaceSession = fixture.session;
-      expect((await runAsync(fixture, 'shape', ['rebuild', '--only', 'a'])).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
+      // A rebuild would share the engine of build, so change a parameter of the compile phase instead.
+      const shape: ITerminalExchange = await runAsync(fixture, 'shape', ['build', '-o', 'a', '--production']);
+      expect(shape.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
       expect(fixture.session).not.toBe(second);
-      expect(runs(fixture)).toEqual(['a:one:', 'a:one:--new-definition', 'a:one:--new-definition']);
+      const production: string = 'a:one:--new-definition --production';
+      expect(runs(fixture)).toEqual(['a:one:', 'a:one:--new-definition', production]);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
@@ -598,7 +495,7 @@ describe('native production daemon engine', () => {
       const oldGraph: IOperationGraph = fixture.session.operationGraph!;
       const environment: Record<string, string> = {
         ...requestEnvironment(),
-        RUSH_PARALLELISM: process.env.RUSH_PARALLELISM === '1' ? '2' : '1'
+        RUSHSTACK_DAEMON_TEST_HARD_INPUT: 'changed'
       };
       expect(
         (await runAsync(fixture, 'hard', ['build', '--only', 'a'], { environment })).terminal
@@ -774,64 +671,13 @@ process.exit(23);
     }
   });
 
-  it('refuses native lock contention at preparation and at iteration time, and accepts a later explicit retry', async () => {
-    const fixture: IFixture = await createFixtureAsync();
-    const gate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
-    let native: Promise<INativeCommandResult> | undefined;
-    try {
-      native = runNativeCommandAsync(fixture.repoRoot, ['rebuild', '--only', 'a', '--parallelism', '3']);
-      await Promise.race([
-        gate.entered,
-        native.then((result) => {
-          throw new Error(`Native action did not enter its script gate: ${JSON.stringify(result)}`);
-        })
-      ]);
-      expect(
-        (await runAsync(fixture, 'busy-initialization', ['build', '--only', 'b'])).terminal
-      ).toMatchObject({
-        kind: 'requestRejected',
-        payload: { message: expect.stringContaining('Another Rush command') }
-      });
-      expect(fixture.session.operationGraph).toBeUndefined();
-      await gate.releaseAsync();
-      expect(await native).toMatchObject({ exitCode: 0 });
-      expect((await runAsync(fixture, 'retry', ['build', '--only', 'b'])).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
-      const secondGate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
-      try {
-        native = runNativeCommandAsync(fixture.repoRoot, ['rebuild', '--only', 'a', '--parallelism', '3']);
-        await Promise.race([
-          secondGate.entered,
-          native.then((result) => {
-            throw new Error(`Native action did not enter its script gate: ${JSON.stringify(result)}`);
-          })
-        ]);
-        expect((await runAsync(fixture, 'busy-iteration', ['build', '--only', 'b'])).terminal).toMatchObject({
-          kind: 'requestRejected',
-          payload: { message: expect.stringContaining('Another Rush command') }
-        });
-      } finally {
-        await secondGate.releaseAsync();
-        await native;
-      }
-      expect((await runAsync(fixture, 'retry-iteration', ['build', '--only', 'b'])).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
-    } finally {
-      await gate.releaseAsync();
-      await native;
-      await fixture[Symbol.asyncDispose]();
-    }
-  });
-
   it('uses one native lease for a merged batch and excludes native actions throughout reconciliation and execution', async () => {
     const fixture: IFixture = await createFixtureAsync();
+    const leaseRequested: IDeferred<void> = createDeferred();
+    const grantLease: IDeferred<void> = createDeferred();
     const reconcileEntered: IDeferred<void> = createDeferred();
     const releaseReconciliation: IDeferred<void> = createDeferred();
-    const secondSelection: IDeferred<void> = createDeferred();
+    const secondAdmitted: IDeferred<void> = createDeferred();
     let secondClient: DaemonRequestWireClient | undefined;
     let gate: INativeScriptGate | undefined;
     let first: Promise<ITerminalExchange> | undefined;
@@ -842,7 +688,15 @@ process.exit(23);
       await fixture.session.quiesceWarmSetAsync();
       const graph: IOperationGraph = fixture.session.operationGraph!;
       const scheduleSpy: jest.SpyInstance = jest.spyOn(graph, 'scheduleIterationAsync');
-      const leaseSpy: jest.SpyInstance = jest.spyOn(fixture.session, 'acquireExecutionLeaseAsync');
+      const acquireExecutionLeaseAsync: WorkspaceSession['acquireExecutionLeaseAsync'] =
+        fixture.session.acquireExecutionLeaseAsync.bind(fixture.session);
+      const leaseSpy: jest.SpyInstance = jest
+        .spyOn(fixture.session, 'acquireExecutionLeaseAsync')
+        .mockImplementationOnce(async () => {
+          leaseRequested.resolve();
+          await grantLease.promise;
+          return await acquireExecutionLeaseAsync();
+        });
       const reconcileAsync: WorkspaceSession['reconcileInvalidationsAsync'] =
         fixture.session.reconcileInvalidationsAsync.bind(fixture.session);
       jest.spyOn(fixture.session, 'reconcileInvalidationsAsync').mockImplementationOnce(async () => {
@@ -850,28 +704,38 @@ process.exit(23);
         await releaseReconciliation.promise;
         return await reconcileAsync();
       });
-      const selectAsync: PhasedCommandEngine['selectOperationsAsync'] =
-        PhasedCommandEngine.prototype.selectOperationsAsync;
-      let selections: number = 0;
-      jest.spyOn(PhasedCommandEngine.prototype, 'selectOperationsAsync').mockImplementation(async function (
-        this: PhasedCommandEngine,
-        selectedGraph: IOperationGraph
+      const routeAsync: PhasedRequestRouter['executeAsync'] = PhasedRequestRouter.prototype.executeAsync;
+      let routedRequests: number = 0;
+      jest.spyOn(PhasedRequestRouter.prototype, 'executeAsync').mockImplementation(async function (
+        this: PhasedRequestRouter,
+        ...args: Parameters<PhasedRequestRouter['executeAsync']>
       ) {
-        const selection: ReadonlyMap<Operation, OperationEnabledState> = await selectAsync.call(
-          this,
-          selectedGraph
-        );
-        if (++selections === 2) secondSelection.resolve();
-        return selection;
+        routedRequests++;
+        return await routeAsync.apply(this, args);
+      });
+      const admitAsync: RequestAdmissionController['acquireAsync'] =
+        RequestAdmissionController.prototype.acquireAsync;
+      jest.spyOn(RequestAdmissionController.prototype, 'acquireAsync').mockImplementation(async function (
+        this: RequestAdmissionController,
+        ...args: Parameters<RequestAdmissionController['acquireAsync']>
+      ) {
+        const lease: IRequestLease = await admitAsync.apply(this, args);
+        // The router admits each request once, after the workspace lifecycle has, and then enqueues it.
+        if (routedRequests === 2) secondAdmitted.resolve();
+        return lease;
       });
       gate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
       secondClient = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
       await secondClient.handshakeAsync();
       first = runAsync(fixture, 'dependency', ['build', '--to', 'a']);
-      await reconcileEntered.promise;
+      await leaseRequested.promise;
+      // Accepted while the batch waits for its native lease, so it joins before the batch reconciles.
       second = runAsync({ ...fixture, client: secondClient }, 'consumer', ['build', '--to', 'b']);
-      await secondSelection.promise;
+      await secondAdmitted.promise;
+      // After admission, the router enqueues the request without awaiting.
       await new Promise<void>((resolve) => setImmediate(resolve));
+      grantLease.resolve();
+      await reconcileEntered.promise;
       expect(await runNativeCommandAsync(fixture.repoRoot, ['rebuild', '--only', 'c'])).toMatchObject({
         exitCode: 1,
         stdout: expect.stringContaining('Another Rush command')
@@ -900,6 +764,7 @@ process.exit(23);
       expect(scheduleSpy).toHaveBeenCalledTimes(1);
       expect(runs(fixture)).toEqual(['c:one:', 'a:one:', 'b:one:']);
     } finally {
+      grantLease.resolve();
       releaseReconciliation.resolve();
       await gate?.releaseAsync();
       await first;
@@ -1188,7 +1053,11 @@ process.exit(23);
       expect(runs(fixture).at(-1)).toBe('c:one:');
       expect(fixture.session.operationGraph).toBe(graph);
       expect(process.cwd()).toBe(originalCwd);
-      expect(process.env).toEqual(originalEnvironment);
+      // Only the names, so that a failure doesn't print the values of the whole process environment.
+      const changedNames: string[] = [
+        ...new Set([...Object.keys(originalEnvironment), ...Object.keys(process.env)])
+      ].filter((name: string) => process.env[name] !== originalEnvironment[name]);
+      expect(changedNames).toEqual([]);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
@@ -1330,6 +1199,86 @@ process.exit(23);
     }
   });
 
+  it('runs the initial script for every warm build request, as native rush build does, if incremental builds are off', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', {
+      incrementalScript: true,
+      incrementalBuilds: false
+    });
+    // With incremental builds on, an edit of this source file runs the incremental script (see the next test).
+    const inputPath: string = path.join(fixture.repoRoot, 'projects/a/src/input.txt');
+    try {
+      fs.mkdirSync(path.dirname(inputPath), { recursive: true });
+      for (const [requestId, input] of [
+        ['initial-script-1', 'one'],
+        ['initial-script-2', 'two'],
+        ['initial-script-3', 'three']
+      ]) {
+        fs.writeFileSync(inputPath, input);
+        const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'a']);
+        expect(exchange.terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status: 'SUCCESS' }] }
+        });
+        expect(logText(exchange)).toContain('Invoking (initial): node build.cjs');
+        expect(logText(exchange)).not.toContain('Not using the incremental command');
+      }
+      // A watch-only incremental script can keep outputs of deleted inputs, and its output would be cached
+      // under the key of the initial script that native Rush runs.
+      expect(runs(fixture)).toEqual(['a:one:', 'a:two:', 'a:three:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('runs the incremental script for an edit of a built file, and never caches its result', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', { incrementalScript: true });
+    const inputPath: string = path.join(fixture.repoRoot, 'projects/a/src/input.txt');
+    const buildAsync = async (requestId: string, input: string, status: string): Promise<string> => {
+      fs.mkdirSync(path.dirname(inputPath), { recursive: true });
+      fs.writeFileSync(inputPath, input);
+      const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'a']);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status }] }
+      });
+      return logText(exchange);
+    };
+    try {
+      expect(await buildAsync('incremental-1', 'one', 'SUCCESS')).toContain(
+        'Invoking (initial): node build.cjs'
+      );
+      const incremental: string = await buildAsync('incremental-2', 'two', 'SUCCESS');
+      expect(incremental).toContain('Invoking (incremental): node build.cjs --incremental');
+      expect(incremental).toContain(
+        'This operation ran its incremental command; not writing a build cache entry.'
+      );
+      await buildAsync('incremental-3', 'three', 'SUCCESS');
+      // The result of the incremental script was not cached, so it runs again.
+      await buildAsync('incremental-4', 'two', 'SUCCESS');
+      // The result of the initial script was cached.
+      await buildAsync('incremental-5', 'one', 'FROM CACHE');
+      // The incremental script never runs on top of outputs restored from the build cache.
+      expect(await buildAsync('incremental-6', 'three', 'SUCCESS')).toContain(
+        'Not using the incremental command because its outputs were not built by a successful run of its own' +
+          ' command in this process.'
+      );
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), 'root');
+      expect(await buildAsync('incremental-7', 'three', 'SUCCESS')).toContain(
+        'Not using the incremental command because a configuration file changed ("projects/a/input.txt").'
+      );
+      expect(runs(fixture)).toEqual([
+        'a:one:',
+        'a:two:--incremental',
+        'a:three:--incremental',
+        'a:two:--incremental',
+        'a:three:',
+        'a:three:'
+      ]);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('re-runs only the operation whose declared outputs were deleted after a warm build', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
@@ -1368,6 +1317,55 @@ process.exit(23);
     }
   });
 
+  it('reuses results that legacy skip detection found up to date until their declared outputs are deleted', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toHaveLength(3);
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      // Reload the configuration without changing the inputs of any operation, so the new graph has no results.
+      const commandLineFile: string = path.join(fixture.repoRoot, 'common/config/rush/command-line.json');
+      const commandLine: { commands: object[] } = JSON.parse(fs.readFileSync(commandLineFile, 'utf8'));
+      commandLine.commands.push({
+        commandKind: 'global',
+        name: 'unrelated',
+        summary: 'Unrelated',
+        shellCommand: 'node --version'
+      });
+      fs.writeFileSync(commandLineFile, JSON.stringify(commandLine));
+      const reloaded: ITerminalExchange = await runAsync(fixture, 'reloaded', ['build']);
+      expect(reloaded.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 0,
+          scheduled: true,
+          operationResults: [
+            { operationId: 'a (compile)', status: 'SKIPPED' },
+            { operationId: 'b (compile)', status: 'SKIPPED' },
+            { operationId: 'c (compile)', status: 'SKIPPED' }
+          ]
+        }
+      });
+      expect(fixture.session.operationGraph).not.toBe(graph);
+
+      // The skipped results are current, so they are not checked again.
+      expect((await runAsync(fixture, 'warm', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/c/lib'), { recursive: true });
+      expect((await runAsync(fixture, 'deleted', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3)).toEqual(['c:one:']);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/c/lib/output.txt'), 'utf8')).toBe('one');
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('restores deleted outputs of a warm operation from the native build cache', async () => {
     const fixture: IFixture = await createFixtureAsync(true);
     try {
@@ -1390,6 +1388,99 @@ process.exit(23);
     }
   });
 
+  it('re-runs a selected warm operation whose nested outputs were edited in place or deleted', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toEqual(expect.arrayContaining(['a:one:', 'b:one:', 'c:one:']));
+      const libPath: string = path.join(fixture.repoRoot, 'projects/a/lib');
+      const outputPath: string = path.join(libPath, 'output.txt');
+      const { ino, mtimeMs: libModifiedMs } = fs.statSync(outputPath);
+      const libFolderModifiedMs: number = fs.statSync(libPath).mtimeMs;
+      fs.writeFileSync(outputPath, 'edited in place');
+      // Neither the output folder nor the file identity changes, so the per-folder check cannot see this.
+      expect(fs.statSync(outputPath).ino).toBe(ino);
+      expect(fs.statSync(outputPath).mtimeMs).not.toBe(libModifiedMs);
+      expect(fs.statSync(libPath).mtimeMs).toBe(libFolderModifiedMs);
+      expect((await runAsync(fixture, 'unrelated', ['build', '--only', 'c'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect((await runAsync(fixture, 'edited', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3)).toEqual(['a:one:']);
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('one');
+
+      fs.mkdirSync(path.join(libPath, 'nested'));
+      fs.writeFileSync(path.join(libPath, 'nested/stale.txt'), 'stale');
+      expect((await runAsync(fixture, 'added', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(4)).toEqual(['a:one:']);
+      const addedFolderModifiedMs: number = fs.statSync(libPath).mtimeMs;
+      fs.rmSync(path.join(libPath, 'nested/stale.txt'));
+      expect(fs.statSync(libPath).mtimeMs).toBe(addedFolderModifiedMs);
+      expect((await runAsync(fixture, 'deleted', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(5)).toEqual(['a:one:']);
+      expect((await runAsync(fixture, 'unchanged', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(runs(fixture)).toHaveLength(6);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('restores an output edited in place from the build cache before a consumer embeds it', async () => {
+    const fixture: IFixture = await createFixtureAsync(true);
+    try {
+      // Like a bundler, b's output embeds a's output.
+      fs.writeFileSync(
+        path.join(fixture.repoRoot, 'projects/b/build.cjs'),
+        `
+const fs = require('node:fs');
+const input = fs.readFileSync('input.txt', 'utf8');
+fs.appendFileSync('../../runs.txt', 'b:' + input + ':\\n');
+fs.mkdirSync('lib', { recursive: true });
+fs.writeFileSync('lib/output.txt', input + '+' + fs.readFileSync('../a/lib/output.txt', 'utf8'));
+`
+      );
+      await runAsync(fixture, 'initial', ['build', '--to', 'b']);
+      const outputPath: string = path.join(fixture.repoRoot, 'projects/b/lib/output.txt');
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('one+one');
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'edited in place');
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/b/input.txt'), 'two');
+      const edited: ITerminalExchange = await runAsync(fixture, 'edited', ['build', '--to', 'b']);
+      expect(edited.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { operationResults } = (edited.terminal as { payload: IDaemonPhasedRequestResult }).payload;
+      expect(operationResults).toEqual([
+        expect.objectContaining({ operationId: 'a (compile)', status: 'FROM CACHE' }),
+        expect.objectContaining({ operationId: 'b (compile)', status: 'SUCCESS' })
+      ]);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'utf8')).toBe('one');
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('two+one');
+      // The consumer's new cache entry holds the restored output, not the edited one.
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/b/lib'), { recursive: true });
+      const restored: ITerminalExchange = await runAsync(fixture, 'restored', ['build', '--to', 'b']);
+      expect((restored.terminal as { payload: IDaemonPhasedRequestResult }).payload.operationResults).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ operationId: 'b (compile)', status: 'FROM CACHE' })
+        ])
+      );
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('two+one');
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'b:two:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('reconciles changes made without a connected client and preserves an empty native selection', async () => {
     const fixture: IFixture = await createFixtureAsync();
     let reconnected: DaemonRequestWireClient | undefined;
@@ -1460,16 +1551,116 @@ process.exit(23);
 
   it('rejects invalid inherited project configuration before creating a graph or running scripts', async () => {
     const fixture: IFixture = await createFixtureAsync();
+    const stderrWrite: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
     try {
       fs.writeFileSync(
         path.join(fixture.repoRoot, 'projects/a/config/rush-project.json'),
         '{"extends":"./unowned.json"}'
       );
       expect((await runAsync(fixture, 'unsupported', ['build'])).terminal).toMatchObject({
-        kind: 'requestRejected'
+        kind: 'requestRejected',
+        // In-process Rush reports the error natively if the request selects the project.
+        payload: {
+          code: 'unsupported',
+          message: expect.stringMatching(/^The daemon could not load the configuration of project "a": /)
+        }
       });
+      expect(stderrWrite).toHaveBeenCalledWith(
+        expect.stringMatching(/^Warning: Rush could not load the configuration of project "a": /)
+      );
       expect(fixture.session.operationGraph).toBeUndefined();
       expect(runs(fixture)).toEqual([]);
+    } finally {
+      stderrWrite.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('hands requests to in-process Rush while a project that a filtered install skipped has no rig package', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'rig');
+    const rigFolder: string = path.join(fixture.repoRoot, 'projects/a/node_modules/fixture-rig');
+    const installedRigFolder: string = `${rigFolder}-installed`;
+    const stderr: string[] = [];
+    const stderrWrite: jest.SpyInstance = jest
+      .spyOn(process.stderr, 'write')
+      .mockImplementation((chunk: string | Uint8Array) => stderr.push(chunk.toString()) > 0);
+    const expectFallbackAsync = async (requestId: string): Promise<void> => {
+      stderr.length = 0;
+      const rejected: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'c']);
+      expect(rejected.terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: {
+          code: 'unsupported',
+          message:
+            `The daemon could not load the configuration of project "a": Cannot find module ` +
+            `'fixture-rig/package.json' from '${path.join(fixture.repoRoot, 'projects/a')}' ` +
+            '(the daemon loads every project, so it needs a full "rush install")'
+        }
+      });
+      expect(stderr.join('')).toContain(
+        `Warning: Rush could not load the configuration of project "a": Cannot find module 'fixture-rig/package.json'`
+      );
+    };
+    try {
+      fs.renameSync(rigFolder, installedRigFolder);
+      await expectFallbackAsync('unbound');
+      expect(fixture.session.operationGraph).toBeUndefined();
+
+      fs.renameSync(installedRigFolder, rigFolder);
+      const installed: ITerminalExchange = await runAsync(fixture, 'installed', ['build', '--only', 'c']);
+      expect(installed.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+
+      // Removing an installed package changes no watched file, but the next request must not reuse the graph.
+      fs.renameSync(rigFolder, installedRigFolder);
+      await expectFallbackAsync('uninstalled');
+      fs.renameSync(installedRigFolder, rigFolder);
+      const reinstalled: ITerminalExchange = await runAsync(fixture, 'reinstalled', ['build', '--only', 'c']);
+      expect(reinstalled.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(runs(fixture)).toEqual(['c:one:']);
+    } finally {
+      stderrWrite.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('rejects a missing project dependency file with the native instruction as the last line', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { pnpm: true });
+    // As Rush builds the path: the project's temp folder, then a slash and the file name
+    const dependencyFile: string = `${path.join(fixture.repoRoot, 'projects/c/.rush/temp')}/shrinkwrap-deps.json`;
+    const instruction: string =
+      `A project dependency file (${dependencyFile}) is missing. ` +
+      'You may need to run "rush install" or "rush update".';
+    const expectRejectedAsync = async (requestId: string): Promise<void> => {
+      const { terminal } = await runAsync(fixture, requestId, ['build', '--only', 'a']);
+      expect(terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'routingFailed' } });
+      const { message } = (terminal as { payload: { message: string } }).payload;
+      expect(message.split('\n').pop()).toBe(instruction);
+    };
+    try {
+      fs.rmSync(dependencyFile);
+      await expectRejectedAsync('cold');
+      expect(fixture.session.operationGraph).toBeUndefined();
+
+      fs.writeFileSync(dependencyFile, '{}');
+      const initial: ITerminalExchange = await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+      expect(initial.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      fs.rmSync(dependencyFile);
+      await expectRejectedAsync('warm');
+
+      fs.writeFileSync(dependencyFile, '{}');
+      const restored: ITerminalExchange = await runAsync(fixture, 'restored', ['build', '--only', 'a']);
+      expect(restored.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+
+      // A project added before "rush install" has no dependency file, so in-process Rush cannot hash the repo
+      // state either. Its missing rig package must not hide that instruction.
+      fs.rmSync(dependencyFile);
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/c/config/rush-project.json'));
+      fs.writeFileSync(
+        path.join(fixture.repoRoot, 'projects/c/config/rig.json'),
+        '{"rigPackageName":"uninstalled-rig"}'
+      );
+      await expectRejectedAsync('added');
+      expect(runs(fixture)).toEqual(['a:one:']);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
@@ -1513,7 +1704,7 @@ process.exit(23);
           kind: 'requestRejected',
           payload: {
             message: expect.stringMatching(
-              /Permission denied[\s\S]*Rush could not capture the next workspace inputs snapshot\./
+              /^Rush could not capture the next workspace inputs snapshot\.\n[\s\S]*Permission denied/
             )
           }
         });
@@ -1560,4 +1751,179 @@ process.exit(23);
       await fixture[Symbol.asyncDispose]();
     }
   });
+
+  it('logs one native telemetry entry for each build request served by the warm engine', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
+    try {
+      const beforeLogIndexes: unknown[] = [];
+      const beforeLogRequestIndexes: unknown[] = [];
+      for (const [requestId, argv] of [
+        ['initial', ['build', '--only', 'a']],
+        ['repeat', ['build', '--only', 'a']],
+        ['consumer', ['build', '--to', 'b']]
+      ] as const) {
+        expect((await runAsync(fixture, requestId, [...argv])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0 }
+        });
+        if (requestId === 'initial') {
+          const { hooks } = fixture.session.operationGraph!;
+          hooks.beforeLog.tap('test', (data: ITelemetryData) => {
+            beforeLogIndexes.push(data.extraData?.requestIndex);
+          });
+          // Like a plugin that flags every entry that it is active, such as fstrace.
+          hooks.beforeLogRequest.tap('test', (data: ITelemetryData) => {
+            beforeLogRequestIndexes.push(data.extraData?.requestIndex);
+            data.extraData!.pluginActive = true;
+          });
+        }
+      }
+      const entries: ITelemetryData[] = readTelemetryEntries(fixture.repoRoot);
+
+      expect(entries).toHaveLength(3);
+      expect(entries.map(({ name, result }) => [name, result])).toEqual([
+        ['build', 'Succeeded'],
+        ['build', 'Succeeded'],
+        ['build', 'Succeeded']
+      ]);
+      expect(entries[0].extraData).toMatchObject({
+        daemon: true,
+        requestIndex: 1,
+        graphWasInitialized: false,
+        scheduled: true,
+        durationBasis: 'iteration',
+        isInitial: true,
+        isWatch: false,
+        command_only: 'true',
+        '--only': 'a',
+        countAll: 1,
+        countSuccess: 1
+      });
+      expect(entries[1].extraData).toMatchObject({
+        requestIndex: 2,
+        graphWasInitialized: true,
+        scheduled: false,
+        durationBasis: 'batch',
+        countAll: 1,
+        countSkipped: 1,
+        countRetained: 1
+      });
+      expect(entries[2].extraData).toMatchObject({
+        requestIndex: 3,
+        scheduled: true,
+        command_only: 'false',
+        command_to: 'true',
+        '--to': 'b',
+        countAll: 2,
+        countSuccess: 1,
+        countSkipped: 1,
+        countRetained: 1
+      });
+      for (const entry of entries) {
+        const totalSeconds: number = entry.extraData!.totalDurationSeconds as number;
+        const requestMs: number = totalSeconds * 1000;
+        expect(entry.durationInSeconds).toBeLessThanOrEqual(totalSeconds);
+        expect(entry.extraData!.bootDurationSeconds).toBeLessThanOrEqual(totalSeconds);
+        for (const { startTimestampMs, endTimestampMs } of Object.values(entry.operationResults!)) {
+          expect(startTimestampMs).toBeGreaterThanOrEqual(0);
+          expect(endTimestampMs).toBeLessThanOrEqual(requestMs);
+        }
+        expect(entry.performanceEntries?.map(({ name }) => name)).toContain('rush:daemon:resolve');
+      }
+      // The repeated request needed no iteration, so iteration-scoped beforeLog taps do not see its entry.
+      expect(beforeLogIndexes).toEqual([3]);
+      // beforeLogRequest taps see every entry, and what they add is logged.
+      expect(beforeLogRequestIndexes).toEqual([2, 3]);
+      expect(entries.map(({ extraData }) => extraData!.pluginActive)).toEqual([undefined, true, true]);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it("keeps serving when a request sets, changes or unsets its telemetry tag, and logs each request's own tag", async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
+    try {
+      const tags: ReadonlyArray<readonly [string, string | undefined]> = [
+        ['untagged', undefined],
+        ['tagged', 'nightly-7'],
+        ['retagged', 'nightly-8'],
+        ['untagged-again', undefined]
+      ];
+      let session: WorkspaceSession | undefined;
+      let graph: IOperationGraph | undefined;
+      for (const [requestId, tag] of tags) {
+        const environment: Record<string, string> = requestEnvironment();
+        delete environment.RUSHD_TELEMETRY_TAG;
+        if (tag !== undefined) environment.RUSHD_TELEMETRY_TAG = tag;
+        expect(
+          (await runAsync(fixture, requestId, ['build', '--only', 'a'], { environment })).terminal
+        ).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        session ??= fixture.session;
+        graph ??= fixture.session.operationGraph;
+        expect(fixture.session).toBe(session);
+        expect(fixture.session.operationGraph).toBe(graph);
+        expect(readDaemonLockfile(fixture.host.paths.lockfilePath)?.pid).toBe(process.pid);
+      }
+
+      const entries: ITelemetryData[] = readTelemetryEntries(fixture.repoRoot);
+      expect(
+        entries.map(({ extraData }) => [
+          extraData?.requestId,
+          extraData?.requestIndex,
+          extraData?.graphWasInitialized,
+          extraData?.telemetryTag
+        ])
+      ).toEqual([
+        ['untagged', 1, false, undefined],
+        ['tagged', 2, true, 'nightly-7'],
+        ['retagged', 3, true, 'nightly-8'],
+        ['untagged-again', 4, true, undefined]
+      ]);
+      expect(runs(fixture)).toEqual(['a:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('releases the lockfile within seconds when a flushTelemetry tap never settles', async () => {
+    const stalledUploads: string[] = [];
+    const createEngineAsync = PhasedCommandEngine.prototype.createEngineAsync;
+    const createEngineSpy: jest.SpyInstance = jest
+      .spyOn(PhasedCommandEngine.prototype, 'createEngineAsync')
+      .mockImplementation(async function (
+        this: PhasedCommandEngine,
+        lock?: LockFile
+      ): Promise<IPhasedCommandEngine> {
+        const engine: IPhasedCommandEngine = await createEngineAsync.call(this, lock);
+        // Like an upload to a server that accepts the connection and never answers.
+        engine.rushSession.hooks.flushTelemetry.tapPromise('StalledUpload', (data) => {
+          stalledUploads.push(...data.map(({ name }) => name));
+          return new Promise<void>(() => undefined);
+        });
+        return engine;
+      });
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
+    try {
+      expect((await runAsync(fixture, 'initial', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect(stalledUploads).toEqual(['build']);
+
+      const startMs: number = Date.now();
+      await fixture.host.closeAsync();
+      const elapsedMs: number = Date.now() - startMs;
+
+      // The engine gives the upload 2 seconds, then the host releases its lockfile and socket, well before a
+      // waiting client gives up on the handoff and falls back to in-process Rush.
+      expect(elapsedMs).toBeGreaterThanOrEqual(1900);
+      expect(elapsedMs).toBeLessThan(8000);
+      expect(readDaemonLockfile(fixture.host.paths.lockfilePath)).toBeUndefined();
+      expect(fs.existsSync(fixture.host.paths.socketPath)).toBe(false);
+    } finally {
+      createEngineSpy.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
 });
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts
new file mode 100644
index 00000000000..a2f8b7f9956
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts
@@ -0,0 +1,73 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRushCommandOrigin, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import { BUILT_IN_RUSH_COMMAND_CLASSIFICATION } from '../RushCommandRequestPolicy';
+import {
+  wrapWorkspaceResolverLifecycle,
+  type IWorkspaceResolverLifecycle
+} from '../WorkspaceResolverLifecycle';
+import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+
+const ORIGINS: DaemonRushCommandOrigin[] = ['built-in', 'custom'];
+
+function createEnvelope(
+  commandName: string,
+  overrides: Partial<IDaemonRequestEnvelope> = {}
+): IDaemonRequestEnvelope {
+  return createWireEnvelope(`request-${commandName}`, commandName, '/repo', overrides);
+}
+
+describe(ProductionDaemonRequestResolver.prototype.getUnsupportedCommandError.name, () => {
+  const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver({
+    startupEnvironment: {}
+  });
+
+  it('rejects every built-in command except build and rebuild, whatever its origin', () => {
+    const names: string[] = Object.keys(BUILT_IN_RUSH_COMMAND_CLASSIFICATION);
+    for (const commandOrigin of ORIGINS) {
+      const rejected: string[] = names.filter(
+        (name) => resolver.getUnsupportedCommandError(createEnvelope(name, { commandOrigin })) !== undefined
+      );
+      expect(rejected).toEqual(names.filter((name) => name !== 'build' && name !== 'rebuild'));
+    }
+    // rush-client sends every command other than build, rebuild, install and update as a custom command.
+    expect(resolver.getUnsupportedCommandError(createEnvelope('list'))).toMatchObject({
+      code: 'unsupported',
+      message: '"list" is a built-in command that is not phased.'
+    });
+  });
+
+  it('never rejects a custom command, since only its parse can tell whether the resolver serves it', () => {
+    for (const commandOrigin of ORIGINS) {
+      for (const name of ['test', 'hello', 'build:watch']) {
+        expect(resolver.getUnsupportedCommandError(createEnvelope(name, { commandOrigin }))).toBeUndefined();
+      }
+    }
+  });
+
+  it('rejects a rushx script, even one named like a phased command', () => {
+    for (const name of ['build', 'test']) {
+      expect(
+        resolver.getUnsupportedCommandError(createEnvelope(name, { invocationKind: 'rushx' }))
+      ).toMatchObject({
+        code: 'unsupported',
+        message: 'A rushx script is not a phased command request.'
+      });
+    }
+  });
+
+  it('is forwarded by a resolver decorator', () => {
+    const lifecycle: IWorkspaceResolverLifecycle | undefined = wrapWorkspaceResolverLifecycle(
+      resolver,
+      (inner) => inner
+    );
+    expect(lifecycle?.getUnsupportedCommandError?.(createEnvelope('list'))).toMatchObject({
+      code: 'unsupported',
+      message: '"list" is a built-in command that is not phased.'
+    });
+    expect(lifecycle?.getUnsupportedCommandError?.(createEnvelope('test'))).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts b/libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts
new file mode 100644
index 00000000000..71f482c516a
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts
@@ -0,0 +1,50 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { constants, PerformanceObserver, type PerformanceEntry } from 'node:perf_hooks';
+import * as vm from 'node:vm';
+
+import { getReducingGarbageCollection } from '../ReducingGarbageCollection';
+
+interface IGarbageCollectionDetail {
+  readonly kind: number;
+}
+
+async function countMajorCollectionsAsync(action: () => void): Promise<number> {
+  const entries: PerformanceEntry[] = [];
+  const observer: PerformanceObserver = new PerformanceObserver((list) => entries.push(...list.getEntries()));
+  observer.observe({ entryTypes: ['gc'] });
+  try {
+    action();
+    // Node.js reports collections to observers asynchronously.
+    await new Promise<void>((resolve) => setTimeout(resolve, 100));
+  } finally {
+    observer.disconnect();
+  }
+  return entries.filter(
+    (entry: PerformanceEntry) =>
+      (entry.detail as IGarbageCollectionDetail | undefined)?.kind === constants.NODE_PERFORMANCE_GC_MAJOR
+  ).length;
+}
+
+// From V8 12 (Node.js 22) on, `gc` can run the memory-reducing collection.
+const HAS_REDUCING_COLLECTION: boolean = Number.parseInt(process.versions.v8, 10) >= 12;
+
+describe(getReducingGarbageCollection.name, () => {
+  it('runs a full collection', async () => {
+    const collect: () => void = getReducingGarbageCollection();
+    expect(await countMajorCollectionsAsync(collect)).toBeGreaterThanOrEqual(1);
+  });
+
+  (HAS_REDUCING_COLLECTION ? it : it.skip)('runs full collections until nothing more is freed', async () => {
+    const collect: () => void = getReducingGarbageCollection();
+    // A regular full collection runs once; the memory-reducing one repeats at least once more.
+    expect(await countMajorCollectionsAsync(collect)).toBeGreaterThanOrEqual(2);
+  });
+
+  it('does not expose gc to scripts', () => {
+    getReducingGarbageCollection()();
+    expect((globalThis as { gc?: unknown }).gc).toBeUndefined();
+    expect(vm.runInNewContext('typeof gc')).toBe('undefined');
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts b/libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts
new file mode 100644
index 00000000000..47a56ab84f0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts
@@ -0,0 +1,12 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { removeSecretEnvironmentVariables } from './SecretEnvironmentVariables';
+
+// Jest runs this file before each test file loads ("setupFiles" in config/jest.config.json). Many tests copy the
+// process environment into a request, a fixture or a launcher's context, and a failed assertion can print such a
+// copy. Deleting the variables that can hold a secret keeps their values out of that output.
+//
+// This changes only the process.env that jest gives the test file. A child process that a test starts without an
+// `env` option still inherits the environment of the jest worker.
+removeSecretEnvironmentVariables(process.env);
diff --git a/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts b/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts
index fb0f0e31fec..48206eda810 100644
--- a/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts
+++ b/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts
@@ -21,11 +21,14 @@ import {
 } from '../GlobalCommandRequestRouter';
 import type {
   GlobalCommandExecutor,
-  IGlobalCommandExecutionResult
+  IGlobalCommandExecutionResult,
+  IGlobalCommandRequestResult
 } from '../GlobalCommandRequestRouter';
 import type { IInteractiveRequestSession } from '../InteractiveRequestInputRouter';
 import { InteractiveRequestInputRouter } from '../InteractiveRequestInputRouter';
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import { type IRequestLease, RequestExclusivityClass, RequestScheduler } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -262,6 +265,60 @@ describe('request admission integration', () => {
     jest.useRealTimers();
   });
 
+  it('names the configured wait timeout when a global command times out on a remaining budget', async () => {
+    jest.useFakeTimers();
+    const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(
+      new TestWorkspaceSession(TEST_REPO_ROOT)
+    );
+    const release: { readonly promise: Promise<void>; readonly resolve: () => void } = createDeferred();
+    const activeStarted: { readonly promise: Promise<void>; readonly resolve: () => void } = createDeferred();
+    const active: Promise<IGlobalCommandRequestResult> = router.executeAsync(
+      createRequest(router, 'active', 'custom-active'),
+      createBlockingExecutor(activeStarted.resolve, release.promise),
+      new AdmissionClient()
+    );
+    await activeStarted.promise;
+    // The workspace lifecycle spends part of the client's budget waiting at its gate, then hands the remainder to the
+    // router.
+    const lifecycle: RequestAdmissionController = new RequestAdmissionController({
+      admission: { waitTimeoutMs: 100 },
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'timeout'
+    });
+    try {
+      const gate: RequestScheduler = new RequestScheduler();
+      const gateHolder: IRequestLease = await gate.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive
+      });
+      const gateLease: Promise<IRequestLease> = lifecycle.acquireAsync(gate, RequestExclusivityClass.SharedBuild);
+      await jest.advanceTimersByTimeAsync(40);
+      gateHolder.release();
+      (await gateLease).release();
+      const executor: jest.Mock<Promise<IGlobalCommandExecutionResult>, []> = jest.fn(async () => ({
+        exitCode: 0
+      }));
+      const timeoutPromise: Promise<IGlobalCommandRequestResult> = router.executeAsync(
+        createRequest(router, 'timeout', 'list', lifecycle.remainingAdmission),
+        executor,
+        new AdmissionClient()
+      );
+      await jest.advanceTimersByTimeAsync(60);
+
+      await expect(timeoutPromise).resolves.toMatchObject({
+        admissionErrorCode: 'wait-timeout',
+        errorMessage:
+          'The request was not admitted within its 100ms wait timeout while waiting for workspace admission. ' +
+          'Use --wait-timeout <seconds> to wait longer.'
+      });
+      expect(executor).not.toHaveBeenCalled();
+    } finally {
+      lifecycle.dispose();
+      release.resolve();
+      await active;
+      jest.useRealTimers();
+    }
+  });
+
   it('cancels queued work on a progress write failure without leaking admission', async () => {
     const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(
       new TestWorkspaceSession(TEST_REPO_ROOT)
diff --git a/libraries/rush-daemon/src/test/RequestScheduler.test.ts b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
index e927b1f9a3b..80738d0342b 100644
--- a/libraries/rush-daemon/src/test/RequestScheduler.test.ts
+++ b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
@@ -193,6 +193,32 @@ describe(RequestScheduler.name, () => {
     second.release();
   });
 
+  it('reports every queued request its position again on request, without admitting any', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const active: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    const firstPositions: number[] = [];
+    const secondPositions: number[] = [];
+    const firstPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead,
+      onQueuePositionChanged: (position) => firstPositions.push(position)
+    });
+    const secondPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead,
+      onQueuePositionChanged: (position) => secondPositions.push(position)
+    });
+
+    scheduler.notifyQueuePositions();
+    expect(firstPositions).toEqual([1, 1, 1]);
+    expect(secondPositions).toEqual([2, 2]);
+    expect(scheduler.queuedRequestCount).toBe(2);
+
+    active.release();
+    (await firstPromise).release();
+    (await secondPromise).release();
+  });
+
   it('continues scheduling when a queue position callback throws', async () => {
     const scheduler: RequestScheduler = new RequestScheduler();
     const active: IRequestLease = await scheduler.acquireAsync({
@@ -257,3 +283,448 @@ describe(RequestScheduler.name, () => {
     expect(scheduler.activeRequestCount).toBe(0);
   });
 });
+
+describe('admission ahead of the queue', () => {
+  it('admits a compatible request ahead of a queued writer that waits for a request admitted in order', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const writerPositions: number[] = [];
+    let writerAdmitted: boolean = false;
+    const writerPromise: Promise<IRequestLease> = scheduler
+      .acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive,
+        onQueuePositionChanged: (position) => writerPositions.push(position)
+      })
+      .then((lease) => {
+        writerAdmitted = true;
+        return lease;
+      });
+
+    const script: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+    expect(scheduler.activeRequestCount).toBe(2);
+    expect(scheduler.queuedRequestCount).toBe(1);
+    expect(writerPositions).toEqual([1]);
+
+    // The writer now waits for the script too, but no longer than for the build.
+    build.release();
+    await Promise.resolve();
+    expect(writerAdmitted).toBe(false);
+    script.release();
+    const writer: IRequestLease = await writerPromise;
+    expect(writerAdmitted).toBe(true);
+    writer.release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('forgets a request that it admitted ahead of the queue once that request is released', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    for (let round: number = 0; round < 2; round++) {
+      const build: IRequestLease = await scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.SharedBuild
+      });
+      const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive
+      });
+      const script: IRequestLease = await scheduler.acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        noWait: true
+      });
+      script.release();
+      build.release();
+      (await writerPromise).release();
+    }
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('queues a request in order once every active request was admitted ahead of the queue', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const admissionOrder: string[] = [];
+    const writerPromise: Promise<IRequestLease> = scheduler
+      .acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive })
+      .then((lease) => {
+        admissionOrder.push('writer');
+        return lease;
+      });
+    const first: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+    build.release();
+
+    // Otherwise a stream of such requests could keep the writer waiting indefinitely.
+    await expect(
+      scheduler.acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        noWait: true
+      })
+    ).rejects.toMatchObject({ code: RequestSchedulerErrorCode.NoWait });
+    const secondPositions: number[] = [];
+    const secondPromise: Promise<IRequestLease> = scheduler
+      .acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        onQueuePositionChanged: (position) => secondPositions.push(position)
+      })
+      .then((lease) => {
+        admissionOrder.push('second');
+        return lease;
+      });
+    expect(secondPositions).toEqual([2]);
+
+    first.release();
+    const writer: IRequestLease = await writerPromise;
+    await Promise.resolve();
+    expect(admissionOrder).toEqual(['writer']);
+    writer.release();
+    const second: IRequestLease = await secondPromise;
+    expect(admissionOrder).toEqual(['writer', 'second']);
+    second.release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it.each([
+    ['an exclusive request', RequestExclusivityClass.Exclusive],
+    ['a request of another shared class', RequestExclusivityClass.SharedRead]
+  ])('does not admit a request ahead of the queue while %s is active', async (activeName, activeClass) => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const active: IRequestLease = await scheduler.acquireAsync({ exclusivityClass: activeClass });
+    const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+
+    await expect(
+      scheduler.acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        noWait: true
+      })
+    ).rejects.toMatchObject({ code: RequestSchedulerErrorCode.NoWait });
+
+    active.release();
+    (await writerPromise).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('counts a request that it admitted from the queue as admitted in order', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const exclusive: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    const buildPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    exclusive.release();
+    const build: IRequestLease = await buildPromise;
+    const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+
+    const script: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+
+    script.release();
+    build.release();
+    (await writerPromise).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('admits a request that asks to pass the queue in order when nothing is queued', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const script: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    // It was admitted in order, so a later request may pass a writer that waits for it.
+    const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    const later: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+
+    script.release();
+    later.release();
+    (await writerPromise).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+});
+
+describe('preemptible leases', () => {
+  it('preempts a marked lease once a request that it blocks waits, and only once', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    // A request of the same shared class is admitted alongside it.
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    expect(onPreempted).not.toHaveBeenCalled();
+
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    const read: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead
+    });
+    leftover.release();
+    build.release();
+    expect(scheduler.queuedRequestCount).toBe(2);
+    running.release();
+    (await exclusive).release();
+    (await read).release();
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('preempts at once when a blocked request already waits', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const read: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead
+    });
+    const onPreempted: jest.Mock = jest.fn(() => leftover.release());
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    (await read).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('forgets the mark when the lease is released and rejects marking an inactive lease', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const lease: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(lease, onPreempted);
+    lease.release();
+
+    const other: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    other.release();
+    (await exclusive).release();
+
+    expect(onPreempted).not.toHaveBeenCalled();
+    expect(() => scheduler.markLeasePreemptible(lease, onPreempted)).toThrow(
+      'Only an active lease from this scheduler can be marked preemptible.'
+    );
+    expect(() => new RequestScheduler().markLeasePreemptible(other, onPreempted)).toThrow();
+  });
+
+  it('reports a failing preemption callback as a warning and keeps scheduling', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const warningSpy: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => {});
+    try {
+      const lease: IRequestLease = await scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.SharedBuild
+      });
+      scheduler.markLeasePreemptible(lease, () => {
+        throw new Error('preemption failed');
+      });
+      const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive
+      });
+
+      expect(warningSpy).toHaveBeenCalledWith(expect.objectContaining({ message: 'preemption failed' }), {
+        code: 'RUSH_DAEMON_LEASE_PREEMPTION_CALLBACK_ERROR'
+      });
+      lease.release();
+      (await exclusive).release();
+      expect(scheduler.activeRequestCount).toBe(0);
+    } finally {
+      warningSpy.mockRestore();
+    }
+  });
+
+  it('preempts marked leases on request and resolves once they are released', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+    const released: string[] = [];
+
+    void scheduler.preemptLeasesAsync().then(() => released.push('first'));
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    // A later caller also waits for the lease that is stopping, without preempting it again.
+    void scheduler.preemptLeasesAsync().then(() => released.push('second'));
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    expect(scheduler.queuedRequestCount).toBe(0);
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(released).toEqual([]);
+
+    leftover.release();
+    await new Promise((resolve) => setImmediate(resolve));
+    expect(released).toEqual(['first', 'second']);
+    // The lease that is not preemptible stays active, and with no preemptible lease the call resolves at once.
+    expect(scheduler.activeRequestCount).toBe(1);
+    await expect(scheduler.preemptLeasesAsync()).resolves.toBeUndefined();
+    running.release();
+  });
+
+  it('waits for a lease whose preemption callback releases it at once', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    scheduler.markLeasePreemptible(leftover, () => leftover.release());
+
+    await scheduler.preemptLeasesAsync();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('tells whether every active lease is preemptible or preempted, before it preempts them', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+    expect(scheduler.activeLeasesArePreemptible).toBe(true);
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    running.release();
+    expect(scheduler.activeLeasesArePreemptible).toBe(true);
+
+    // A request that cannot be admitted alongside the lease is told its position before the lease is preempted.
+    const reports: [number, boolean, number][] = [];
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: (position: number) =>
+        reports.push([position, scheduler.activeLeasesArePreemptible, onPreempted.mock.calls.length])
+    });
+    expect(reports).toEqual([[1, true, 0]]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    // While the preempted lease stops, the request waits only for it.
+    expect(scheduler.activeLeasesArePreemptible).toBe(true);
+    leftover.release();
+    const admitted: IRequestLease = await exclusive;
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    admitted.release();
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+  });
+
+  it('reports its position again to the first queued request before it preempts the leases that it waits for', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    const reports: [string, number, boolean, number][] = [];
+    const recordPosition =
+      (name: string): ((position: number) => void) =>
+      (position: number): void => {
+        reports.push([name, position, scheduler.activeLeasesArePreemptible, onPreempted.mock.calls.length]);
+      };
+    // Both requests queue while the lease still does work that its client waits for.
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: recordPosition('exclusive')
+    });
+    const read: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead,
+      onQueuePositionChanged: recordPosition('read')
+    });
+    reports.length = 0;
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    // Only the first request's report can change: it is told before the lease is preempted, and the second is not.
+    expect(reports).toEqual([['exclusive', 1, true, 0]]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    leftover.release();
+    (await exclusive).release();
+    (await read).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('does not report positions again when a lease becomes preemptible while another active lease is not', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const positions: number[] = [];
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: (position: number) => positions.push(position)
+    });
+    const onPreempted: jest.Mock = jest.fn();
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    // The request still waits for the lease that is not preemptible, so its report cannot change.
+    expect(positions).toEqual([1]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    leftover.release();
+    running.release();
+    (await exclusive).release();
+    expect(positions).toEqual([1]);
+  });
+
+  it('neither reports nor preempts when a lease becomes preemptible with nothing queued', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    expect(onPreempted).not.toHaveBeenCalled();
+    // A request that queues later is told its position once, and only then is the lease preempted for it.
+    const reports: [number, number][] = [];
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: (position: number) => reports.push([position, onPreempted.mock.calls.length])
+    });
+    expect(reports).toEqual([[1, 0]]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    leftover.release();
+    (await exclusive).release();
+    expect(reports).toEqual([[1, 0]]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
new file mode 100644
index 00000000000..e122bba3b48
--- /dev/null
+++ b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
@@ -0,0 +1,462 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type {
+  DaemonRestartReason,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerError,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import {
+  WorkspaceRestartArbiter,
+  type IWorkspaceRestartTicket,
+  type IWorkspaceRestartTicketOptions,
+  type IWorkspaceRestartWaitResult
+} from '../WorkspaceRestartArbiter';
+
+const INSTALLATION_REMOVED: DaemonRestartReason = {
+  kind: 'installationChanged',
+  change: 'removed',
+  folder: '/old/daemon'
+};
+const LOCKFILE_CHANGED: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+
+type QueuePosition = IDaemonRequestQueuePositionMessage['payload'];
+
+interface IDrainTest {
+  readonly admission: RequestAdmissionController;
+  readonly arbiter: WorkspaceRestartArbiter;
+  readonly serving: IWorkspaceRestartTicket;
+  readonly ticket: IWorkspaceRestartTicket;
+}
+
+function createCandidate(
+  options: IDaemonRequestAdmissionOptions,
+  abortSignal: AbortSignal = new AbortController().signal
+): RequestAdmissionController {
+  return new RequestAdmissionController({
+    admission: options,
+    client: { abortSignal },
+    requestId: 'restart-candidate'
+  });
+}
+
+/** A request whose client supports request admission and records its queue positions. */
+function createReportingAdmission(
+  options: IDaemonRequestAdmissionOptions,
+  requestId: string,
+  positions: QueuePosition[]
+): RequestAdmissionController {
+  return new RequestAdmissionController({
+    admission: options,
+    client: {
+      abortSignal: new AbortController().signal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+        positions.push(message.payload);
+      }
+    },
+    requestId
+  });
+}
+
+/** A restart candidate with the given admission options, and one other request that the daemon is serving. */
+function createDrainTest(
+  options: IDaemonRequestAdmissionOptions,
+  servingOptions?: IWorkspaceRestartTicketOptions
+): IDrainTest {
+  const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+  const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
+  const ticket: IWorkspaceRestartTicket = arbiter.enter();
+  return { admission: createCandidate(options), arbiter, serving, ticket };
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  void promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await new Promise((resolve) => setImmediate(resolve));
+  return settled;
+}
+
+describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
+  it('waits past a client-default timeout, and the wait does not count against it', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({
+      waitTimeoutMs: 50,
+      waitTimeoutIsDefault: true
+    });
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    await delayAsync(250);
+    expect(await isSettledAsync(draining)).toBe(false);
+    arbiter.leave(serving);
+    expect(await draining).toBe(true);
+    // The later admission steps keep what was left of the default when the drain began.
+    expect(admission.remainingAdmission).toMatchObject({ waitTimeoutIsDefault: true });
+    expect(admission.remainingAdmission?.waitTimeoutMs).toBeGreaterThan(0);
+    arbiter.leave(ticket);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('still applies a client-default timeout while it waits for a rushx script, and says why', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest(
+      { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
+      { runsScript: true }
+    );
+    const error: unknown = await admission
+      .waitForRestartDrainAsync(arbiter, ticket)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).toContain(
+      'including a rushx script that may not exit until it is stopped'
+    );
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('applies a client-default timeout to requests that arrive during the drain, once earlier ones finish', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({
+      waitTimeoutMs: 50,
+      waitTimeoutIsDefault: true
+    });
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    const late: IWorkspaceRestartTicket = arbiter.enter();
+    await delayAsync(150);
+    expect(await isSettledAsync(draining)).toBe(false);
+    arbiter.leave(serving);
+    const error: unknown = await draining.catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    arbiter.leave(ticket);
+    arbiter.leave(late);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('applies an explicit timeout to the drain, and suggests only --wait-timeout', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 50 });
+    const error: unknown = await admission
+      .waitForRestartDrainAsync(arbiter, ticket)
+      .catch((caught: unknown) => caught);
+    expect(error).toBeInstanceOf(RequestSchedulerError);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    // Setting the environment variable instead would itself restart the daemon.
+    expect((error as Error).message).toContain('--wait-timeout <seconds>');
+    expect((error as Error).message).not.toContain('RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS');
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('spends an explicit timeout while it waits for the drain, but not on the work around that wait', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 10_000 });
+    // Such as capturing the request's inputs before the wait, and planning the restart after it.
+    await delayAsync(1_000);
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    await delayAsync(300);
+    arbiter.leave(serving);
+    await draining;
+    await delayAsync(1_000);
+    const remainingMs: number | undefined = admission.remainingAdmission?.waitTimeoutMs;
+    expect(remainingMs).toBeLessThanOrEqual(9_710);
+    expect(remainingMs).toBeGreaterThan(8_700);
+    arbiter.leave(ticket);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('ends the drain once a recheck finds that the restart is no longer needed, and spends the time waited', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 10_000 });
+    const answers: boolean[] = [true, false];
+    let calls: number = 0;
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket, undefined, {
+      intervalMs: 100,
+      stillNeedsRestartAsync: async () => answers[calls++]
+    });
+    // The other request is still being served.
+    expect(await draining).toBe(false);
+    expect(calls).toBe(2);
+    const remainingMs: number | undefined = admission.remainingAdmission?.waitTimeoutMs;
+    expect(remainingMs).toBeLessThanOrEqual(9_810);
+    expect(remainingMs).toBeGreaterThan(9_000);
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('applies no-wait to the drain', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ noWait: true });
+    const error: unknown = await admission
+      .waitForRestartDrainAsync(arbiter, ticket)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('names a restart reason in its queue positions and its admission errors', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const serving: IWorkspaceRestartTicket = arbiter.enter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const restartReason: DaemonRestartReason = INSTALLATION_REMOVED;
+    const positions: QueuePosition[] = [];
+    const createAdmission = (options: IDaemonRequestAdmissionOptions): RequestAdmissionController =>
+      createReportingAdmission(options, 'restart-candidate', positions);
+
+    const notWaiting: RequestAdmissionController = createAdmission({ noWait: true });
+    const noWaitError: unknown = await notWaiting
+      .waitForRestartDrainAsync(arbiter, ticket, restartReason)
+      .catch((caught: unknown) => caught);
+    expect((noWaitError as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    expect((noWaitError as Error).message).toBe(
+      'The daemon is still serving other requests, which finish before it restarts because its installation at ' +
+        '/old/daemon was removed; the request did not wait for a restart.'
+    );
+    notWaiting.dispose();
+
+    const waiting: RequestAdmissionController = createAdmission({ waitTimeoutMs: 50 });
+    const timeoutError: unknown = await waiting
+      .waitForRestartDrainAsync(arbiter, ticket, restartReason)
+      .catch((caught: unknown) => caught);
+    expect((timeoutError as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((timeoutError as Error).message).toBe(
+      'The request was not admitted before the daemon could restart because its installation at /old/daemon was ' +
+        'removed. The restart waits for the requests that the daemon is serving to finish. Use --wait-timeout ' +
+        '<seconds> to wait longer.'
+    );
+    expect(positions).toEqual([{ position: 1, requestId: 'restart-candidate', restartReason }]);
+    waiting.dispose();
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('says in its queue positions how many of the requests that it waits for run a rushx script', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+    const build: IWorkspaceRestartTicket = arbiter.enter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const positions: QueuePosition[] = [];
+    const admission: RequestAdmissionController = createReportingAdmission(
+      {},
+      'restart-candidate',
+      positions
+    );
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket, LOCKFILE_CHANGED);
+    arbiter.leave(script);
+    arbiter.leave(build);
+    expect(await draining).toBe(true);
+    await delayAsync(0);
+    expect(positions).toEqual([
+      { position: 2, requestId: 'restart-candidate', restartReason: LOCKFILE_CHANGED, scriptCount: 1 },
+      { position: 1, requestId: 'restart-candidate', restartReason: LOCKFILE_CHANGED }
+    ]);
+    arbiter.leave(ticket);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+});
+
+describe('RequestAdmissionController.acquireBeforeRestartAsync', () => {
+  let scheduler: RequestScheduler;
+  // After the drain, only requests that it does not track, such as observers that are winding down, can still
+  // hold the workspace.
+  let untracked: IRequestLease;
+
+  beforeEach(async () => {
+    scheduler = new RequestScheduler();
+    untracked = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild });
+  });
+
+  it('waits behind requests that the drain does not track, then admits the request exclusively', async () => {
+    const admission: RequestAdmissionController = createCandidate({
+      waitTimeoutMs: 5000,
+      waitTimeoutIsDefault: true
+    });
+    const acquiring: Promise<IRequestLease> = admission.acquireBeforeRestartAsync(
+      scheduler,
+      INSTALLATION_REMOVED
+    );
+    await delayAsync(50);
+    expect(await isSettledAsync(acquiring)).toBe(false);
+    untracked.release();
+    const lease: IRequestLease = await acquiring;
+    expect(lease.exclusivityClass).toBe(RequestExclusivityClass.Exclusive);
+    lease.release();
+    admission.dispose();
+  });
+
+  it('still applies a client-default timeout to that wait, and names the restart reason', async () => {
+    const abortController: AbortController = new AbortController();
+    const admission: RequestAdmissionController = createCandidate(
+      { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
+      abortController.signal
+    );
+    const acquiring: Promise<unknown> = admission
+      .acquireBeforeRestartAsync(scheduler, INSTALLATION_REMOVED)
+      .catch((caught: unknown) => caught);
+    // A wait without a deadline fails here rather than at the test timeout.
+    const error: unknown = await Promise.race([acquiring, delayAsync(1000, 'still waiting')]);
+    abortController.abort();
+    await acquiring;
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).toBe(
+      'The request was not admitted within its 50ms wait timeout while waiting for the running requests to ' +
+        'finish before the daemon restarts because its installation at /old/daemon was removed. Use ' +
+        '--wait-timeout <seconds> to wait longer.'
+    );
+    untracked.release();
+    admission.dispose();
+  });
+});
+
+interface IPendingRestartTest {
+  readonly admission: RequestAdmissionController;
+  readonly arbiter: WorkspaceRestartArbiter;
+  readonly candidate: IWorkspaceRestartTicket;
+  readonly draining: Promise<IWorkspaceRestartWaitResult>;
+  readonly positions: QueuePosition[];
+  readonly script: IWorkspaceRestartTicket;
+  readonly serving: IWorkspaceRestartTicket;
+}
+
+/**
+ * A rushx script with the given admission options, which arrives while a restart candidate, which gives the
+ * restart reason if any, drains one request.
+ */
+function createPendingRestartTest(
+  options: IDaemonRequestAdmissionOptions,
+  servingOptions?: IWorkspaceRestartTicketOptions,
+  restartReason?: DaemonRestartReason
+): IPendingRestartTest {
+  const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+  const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
+  const candidate: IWorkspaceRestartTicket = arbiter.enter();
+  const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+    abortSignal: new AbortController().signal,
+    noWait: undefined,
+    waitTimeoutMs: undefined,
+    restartReason
+  });
+  const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+  const positions: QueuePosition[] = [];
+  const admission: RequestAdmissionController = createReportingAdmission(options, 'rushx-script', positions);
+  return { admission, arbiter, candidate, draining, positions, script, serving };
+}
+
+async function finishPendingRestartTestAsync(test: IPendingRestartTest): Promise<void> {
+  test.arbiter.leave(test.serving);
+  test.arbiter.leave(test.script);
+  await test.draining;
+  test.arbiter.leave(test.candidate);
+  test.admission.dispose();
+  expect(test.arbiter.servingCount).toBe(0);
+}
+
+describe('RequestAdmissionController.waitForPendingRestartAsync', () => {
+  it('waits past a client-default timeout while the restart drains an earlier build, and reports a position', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({
+      waitTimeoutMs: 50,
+      waitTimeoutIsDefault: true
+    });
+    const waiting: Promise<void> = test.admission.waitForPendingRestartAsync(test.arbiter, test.script);
+    await delayAsync(250);
+    expect(await isSettledAsync(waiting)).toBe(false);
+    test.arbiter.leave(test.serving);
+    await test.draining;
+    test.arbiter.leave(test.candidate);
+    await waiting;
+    // The build and the candidate, then the candidate alone. The candidate gave no reason for its restart.
+    expect(test.positions).toEqual([
+      { position: 2, requestId: 'rushx-script' },
+      { position: 1, requestId: 'rushx-script' }
+    ]);
+    // The script is then told to run on the successor, which gets its default again.
+    expect(test.admission.remainingAdmission?.waitTimeoutMs).toBeGreaterThan(0);
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('says in its queue positions why the daemon restarts for another request, and how many scripts it waits for', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({}, { runsScript: true }, LOCKFILE_CHANGED);
+    const waiting: Promise<void> = test.admission.waitForPendingRestartAsync(test.arbiter, test.script);
+    test.arbiter.leave(test.serving);
+    await test.draining;
+    test.arbiter.leave(test.candidate);
+    await waiting;
+    await delayAsync(0);
+    expect(test.positions).toEqual([
+      {
+        position: 2,
+        requestId: 'rushx-script',
+        restartReason: LOCKFILE_CHANGED,
+        scriptCount: 1,
+        restartsForAnotherRequest: true
+      },
+      {
+        position: 1,
+        requestId: 'rushx-script',
+        restartReason: LOCKFILE_CHANGED,
+        restartsForAnotherRequest: true
+      }
+    ]);
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('applies a client-default timeout while a rushx script is served, and says why', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest(
+      { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
+      { runsScript: true }
+    );
+    const error: unknown = await test.admission
+      .waitForPendingRestartAsync(test.arbiter, test.script)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).toContain(
+      'A script waits for a pending restart so that the restart does not wait for the script'
+    );
+    expect((error as Error).message).toContain(
+      'including a rushx script that may not exit until it is stopped'
+    );
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('applies an explicit timeout while the restart drains an earlier build', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({ waitTimeoutMs: 50 });
+    const error: unknown = await test.admission
+      .waitForPendingRestartAsync(test.arbiter, test.script)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).not.toContain('including a rushx script');
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('applies no-wait at once', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({ noWait: true });
+    const error: unknown = await test.admission
+      .waitForPendingRestartAsync(test.arbiter, test.script)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    expect(test.positions).toEqual([]);
+    await finishPendingRestartTestAsync(test);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts b/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts
index b6e17440519..6b45f12422b 100644
--- a/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts
+++ b/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts
@@ -9,6 +9,7 @@ import { RushCommandLineParser } from '@microsoft/rush-lib/lib/cli/RushCommandLi
 
 import {
   BUILT_IN_RUSH_COMMAND_CLASSIFICATION,
+  classifyPhasedRushCommand,
   classifyRushCommand
 } from '../RushCommandRequestPolicy';
 import { RequestExclusivityClass } from '../RequestScheduler';
@@ -57,3 +58,23 @@ describe(classifyRushCommand.name, () => {
     );
   });
 });
+
+describe(classifyPhasedRushCommand.name, () => {
+  it('shares build admission only for incremental phased commands from command-line.json', () => {
+    expect(
+      classifyPhasedRushCommand({ commandName: 'test', commandOrigin: 'custom', isIncremental: true })
+    ).toBe(RequestExclusivityClass.SharedBuild);
+    expect(
+      classifyPhasedRushCommand({ commandName: 'retest', commandOrigin: 'custom', isIncremental: false })
+    ).toBe(RequestExclusivityClass.Exclusive);
+    expect(
+      classifyPhasedRushCommand({ commandName: 'build', commandOrigin: 'built-in', isIncremental: true })
+    ).toBe(RequestExclusivityClass.SharedBuild);
+    expect(
+      classifyPhasedRushCommand({ commandName: 'rebuild', commandOrigin: 'built-in', isIncremental: false })
+    ).toBe(RequestExclusivityClass.Exclusive);
+    expect(classifyPhasedRushCommand({ commandName: 'test', isIncremental: true })).toBe(
+      RequestExclusivityClass.Exclusive
+    );
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts b/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
index 4fab1f44a46..4d0408c169b 100644
--- a/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
+++ b/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
@@ -10,12 +10,14 @@ import { tmpdir } from 'node:os';
 import { Rush } from '@microsoft/rush-lib';
 
 import {
+  ignoreClosedReader,
   launchRushDaemonAsync,
   resolveRushDaemonWorkspace,
   type IRushDaemonWorkspace
 } from '../RushDaemonCommandLine';
-import { serveRushDaemonAsync } from '../serveRushDaemon';
+import { serveRushDaemonAsync, type IRushDaemonServeOptions } from '../serveRushDaemon';
 import { RushDaemonRequestResolver } from '../RushDaemonRequestResolver';
+import type { RushDaemonHost } from '../RushDaemonHost';
 
 describe(resolveRushDaemonWorkspace.name, () => {
   let tempFolder: string;
@@ -70,4 +72,34 @@ describe(resolveRushDaemonWorkspace.name, () => {
       })
     );
   });
+
+  it('writes the time and the process ID on the ready line', async () => {
+    await writeFile(path.join(tempFolder, 'rush.json'), JSON.stringify({ rushVersion: Rush.version }));
+    await launchRushDaemonAsync(tempFolder);
+    const options: IRushDaemonServeOptions = jest.mocked(serveRushDaemonAsync).mock.calls.at(-1)![0];
+    const write: jest.SpyInstance = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    try {
+      await options.onReady!({ paths: { socketPath: '/tmp/rushd-test.sock' } } as RushDaemonHost);
+      const isoTime: string = '\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z';
+      expect(write.mock.calls).toEqual([
+        [
+          expect.stringMatching(
+            new RegExp(`^${isoTime} rushd ready at /tmp/rushd-test\\.sock \\(PID ${process.pid}\\)\\n$`)
+          )
+        ]
+      ]);
+    } finally {
+      write.mockRestore();
+    }
+  });
+});
+
+describe(ignoreClosedReader.name, () => {
+  it('ignores the EPIPE of an output whose reader has gone, and throws any other error', () => {
+    const closedReader: NodeJS.ErrnoException = Object.assign(new Error('write EPIPE'), { code: 'EPIPE' });
+    const otherError: NodeJS.ErrnoException = Object.assign(new Error('write EIO'), { code: 'EIO' });
+
+    expect(() => ignoreClosedReader(closedReader)).not.toThrow();
+    expect(() => ignoreClosedReader(otherError)).toThrow(otherError);
+  });
 });
diff --git a/libraries/rush-daemon/src/test/RushEnvironmentValidation.test.ts b/libraries/rush-daemon/src/test/RushEnvironmentValidation.test.ts
index 6ce7300ad49..44fb5389d13 100644
--- a/libraries/rush-daemon/src/test/RushEnvironmentValidation.test.ts
+++ b/libraries/rush-daemon/src/test/RushEnvironmentValidation.test.ts
@@ -19,9 +19,7 @@ describe(validateRequestRushEnvironment.name, () => {
   });
 
   it('rejects an invalid boolean with the native message', () => {
-    expect(() =>
-      validateRequestRushEnvironment({ RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD: 'yes' })
-    ).toThrow(
+    expect(() => validateRequestRushEnvironment({ RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD: 'yes' })).toThrow(
       'Invalid value "yes" for the environment variable RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD. Valid choices are 0 or 1.'
     );
   });
@@ -47,4 +45,4 @@ describe(validateRequestRushEnvironment.name, () => {
       })
     ).toThrow('are mutually exclusive');
   });
-});
\ No newline at end of file
+});
diff --git a/libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts b/libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts
new file mode 100644
index 00000000000..6a0a3b9d11b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts
@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { getRushLibPathHandoff } from '../RushLibPathHandoff';
+
+describe(getRushLibPathHandoff.name, () => {
+  let folder: string;
+  let entryPoint: string;
+  let linkedEntryPoint: string;
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-lib-path-')));
+    const rushLibFolder: string = path.join(folder, 'libraries', 'rush-lib');
+    fs.mkdirSync(path.join(rushLibFolder, 'lib-commonjs'), { recursive: true });
+    entryPoint = path.join(rushLibFolder, 'lib-commonjs', 'index.js');
+    fs.writeFileSync(entryPoint, '');
+    const rushLibLink: string = path.join(folder, 'daemon', 'node_modules', '@microsoft', 'rush-lib');
+    fs.mkdirSync(path.dirname(rushLibLink), { recursive: true });
+    fs.symlinkSync(rushLibFolder, rushLibLink, 'junction');
+    linkedEntryPoint = path.join(rushLibLink, 'lib-commonjs', 'index.js');
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('uses the entry point when nothing is set', () => {
+    expect(getRushLibPathHandoff(entryPoint, undefined)).toBe(entryPoint);
+  });
+
+  it('keeps a linked spelling of the same entry point', () => {
+    expect(getRushLibPathHandoff(entryPoint, linkedEntryPoint)).toBe(linkedEntryPoint);
+  });
+
+  it('replaces a different or missing engine', () => {
+    const otherEntryPoint: string = path.join(folder, 'other', 'index.js');
+    fs.mkdirSync(path.dirname(otherEntryPoint), { recursive: true });
+    fs.writeFileSync(otherEntryPoint, '');
+
+    expect(getRushLibPathHandoff(entryPoint, otherEntryPoint)).toBe(entryPoint);
+    expect(getRushLibPathHandoff(entryPoint, path.join(folder, 'missing.js'))).toBe(entryPoint);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts
new file mode 100644
index 00000000000..543c5205a13
--- /dev/null
+++ b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts
@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  removeSecretEnvironmentVariables,
+  SECRET_ENVIRONMENT_VARIABLE_NAME
+} from './SecretEnvironmentVariables';
+
+describe(removeSecretEnvironmentVariables.name, () => {
+  it('deletes the variables whose names can hold a secret and keeps the others', () => {
+    const environment: NodeJS.ProcessEnv = Object.fromEntries([
+      ['NPM_TOKEN', 'fake-1'],
+      ['node_auth_token', 'fake-2'],
+      ['APP_SECRET', 'fake-3'],
+      ['DB_PASSWORD', 'fake-4'],
+      ['AZURE_CREDENTIALS', 'fake-5'],
+      ['npm_config__auth', 'fake-6'],
+      ['PATH', '/usr/bin'],
+      ['RUSHD_ENV_MARKER', 'kept']
+    ]);
+
+    expect(removeSecretEnvironmentVariables(environment)).toEqual([
+      'NPM_TOKEN',
+      'node_auth_token',
+      'APP_SECRET',
+      'DB_PASSWORD',
+      'AZURE_CREDENTIALS',
+      'npm_config__auth'
+    ]);
+    expect(environment).toEqual({ PATH: '/usr/bin', RUSHD_ENV_MARKER: 'kept' });
+  });
+
+  it('has run on process.env before this test file loaded', () => {
+    const names: string[] = Object.keys(process.env).filter((name: string) =>
+      SECRET_ENVIRONMENT_VARIABLE_NAME.test(name)
+    );
+    expect(names).toEqual([]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts
new file mode 100644
index 00000000000..0ff516681de
--- /dev/null
+++ b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Matches the name of an environment variable that can hold a secret, such as `NPM_TOKEN` or `npm_config__auth`.
+ * It also matches names such as `GIT_AUTHOR_NAME`, which the test fixtures don't need: they pass the commit author
+ * to Git on the command line.
+ */
+export const SECRET_ENVIRONMENT_VARIABLE_NAME: RegExp = /TOKEN|SECRET|PASSWORD|CREDENTIAL|_AUTH/i;
+
+/**
+ * Deletes each variable whose name matches {@link SECRET_ENVIRONMENT_VARIABLE_NAME}, and returns the deleted names.
+ */
+export function removeSecretEnvironmentVariables(environment: NodeJS.ProcessEnv): string[] {
+  const names: string[] = Object.keys(environment).filter((name: string) =>
+    SECRET_ENVIRONMENT_VARIABLE_NAME.test(name)
+  );
+  for (const name of names) {
+    delete environment[name];
+  }
+  return names;
+}
diff --git a/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
new file mode 100644
index 00000000000..bd2d4da5d62
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
@@ -0,0 +1,510 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+
+import { formatNativeLockHolder } from '@rushstack/rush-client-core';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonNativeLockHolder,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import type {
+  IDaemonRequestResolver,
+  IResolveDaemonRequestOptions,
+  ResolvedDaemonRequest
+} from '../DaemonRequestDispatcher';
+import type { WorkspaceSession } from '../WorkspaceSession';
+import {
+  isRushxInvocation,
+  wrapWorkspaceResolverLifecycle,
+  type IWorkspaceResolverLifecycle
+} from '../WorkspaceResolverLifecycle';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import {
+  createDeferred,
+  type DaemonRequestWireClient,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+/** Longer than any wait in these tests, so that only the reload's own progress ends it. */
+const RELOAD_WAIT_TIMEOUT_MS: number = 40_000;
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+/** Project a's `quick` script appends `quick` to runs.txt and exits. */
+function createFixtureAsync(
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created) => {
+    created.servesRushx = true;
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: { '_phase:compile': 'node build.cjs', quick: 'node quick.cjs' }
+      })
+    );
+    created.write('a/quick.cjs', "require('node:fs').appendFileSync('../runs.txt','quick\\n');");
+    configure?.(created);
+  });
+}
+
+function countScriptRuns(fixture: DaemonGraphTestFixture): number {
+  return fixture.runs().filter((line: string) => line === 'quick').length;
+}
+
+function getScriptEnvelope(
+  fixture: DaemonGraphTestFixture,
+  waitTimeoutMs: number
+): Partial<IDaemonRequestEnvelope> {
+  return {
+    commandOrigin: 'custom',
+    invocationKind: 'rushx',
+    cwd: path.join(fixture.folder, 'a'),
+    admission: { waitTimeoutMs }
+  };
+}
+
+let configurationChanges: number = 0;
+
+/** Changes project c's configuration, so that the next build reloads the graph. */
+function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
+  const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+  const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  fs.writeFileSync(
+    packageJsonPath,
+    JSON.stringify({ ...packageJson, description: `changed ${++configurationChanges}` })
+  );
+}
+
+/** Writes rush.json's default `projectFolderMaxDepth` into it, which changes the file but not the workspace. */
+function changeRushJson(fixture: DaemonGraphTestFixture): void {
+  const rushJsonPath: string = path.join(fixture.folder, 'rush.json');
+  const rushJson: Record<string, unknown> = JSON.parse(fs.readFileSync(rushJsonPath, 'utf8'));
+  fs.writeFileSync(rushJsonPath, JSON.stringify({ ...rushJson, projectFolderMaxDepth: 2 }));
+}
+
+interface ILockHolder {
+  readonly pid: number;
+  releaseAsync(): Promise<void>;
+}
+
+/** Holds native Rush's repository lock in another process, as `rush install` would, until it is released. */
+async function holdRepositoryLockAsync(fixture: DaemonGraphTestFixture): Promise<ILockHolder> {
+  const script: string = [
+    `const { LockFile } = require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))});`,
+    `const lock = LockFile.tryAcquire(${JSON.stringify(path.join(fixture.folder, 'common/temp'))}, 'rush');`,
+    "process.stdout.write(lock ? 'held' : 'busy');",
+    'process.stdin.resume();',
+    "process.stdin.on('end', () => { lock?.release(); process.exit(0); });"
+  ].join('\n');
+  const child: ChildProcess = spawn(process.execPath, ['-e', script], { stdio: ['pipe', 'pipe', 'inherit'] });
+  const releaseAsync = async (): Promise<void> => {
+    if (child.exitCode !== null || child.signalCode !== null) return;
+    const closed: Promise<unknown[]> = once(child, 'close');
+    child.stdin!.end();
+    await closed;
+  };
+  try {
+    const [output] = await once(child.stdout!, 'data');
+    expect(String(output)).toBe('held');
+  } catch (error) {
+    await releaseAsync();
+    throw error;
+  }
+  return { pid: child.pid!, releaseAsync };
+}
+
+interface IStreamedRequest {
+  readonly exchange: Promise<ITerminalExchange>;
+  /** The payloads of the queue positions that the daemon has reported so far. */
+  readonly positionPayloads: ReadonlyArray<IDaemonRequestQueuePositionMessage['payload']>;
+  readonly settled: () => boolean;
+}
+
+/** Starts a request, recording its queue positions as they arrive. */
+async function startRequestAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope>
+): Promise<IStreamedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const payload: IDaemonRequestEnvelope = fixture.envelope(argv, overrides);
+  await client.sendControlAsync({ kind: 'requestStart', payload });
+  const positionPayloads: IDaemonRequestQueuePositionMessage['payload'][] = [];
+  let settled: boolean = false;
+  const readAsync = async (): Promise<ITerminalExchange> => {
+    const frames: IDaemonFrame[] = [];
+    try {
+      for (;;) {
+        const frame: IDaemonFrame = await client.readFrameAsync();
+        frames.push(frame);
+        if (frame.kind !== DaemonFrameType.controlJson) continue;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'queuePosition') positionPayloads.push(message.payload);
+        if (message.kind === 'requestResult' && message.payload.requestId === payload.requestId) {
+          return { frames, terminal: message };
+        }
+      }
+    } finally {
+      settled = true;
+      await client.closeAsync();
+    }
+  };
+  const exchange: Promise<ITerminalExchange> = readAsync();
+  // A failed expectation leaves the exchange unread until the fixture closes the connection.
+  exchange.catch(() => undefined);
+  return { exchange, positionPayloads, settled: () => settled };
+}
+
+/** Changes the configuration and starts a build that reloads the graph for it. */
+async function startReloadAsync(fixture: DaemonGraphTestFixture): Promise<IStreamedRequest> {
+  changeProjectConfiguration(fixture);
+  return await startRequestAsync(fixture, BUILD_A, { admission: { waitTimeoutMs: RELOAD_WAIT_TIMEOUT_MS } });
+}
+
+/** What the daemon says about `holder`. Only Linux can tell which process holds the lock. */
+function getExpectedHolder(holder: ILockHolder): IDaemonNativeLockHolder {
+  return process.platform === 'linux' ? { pid: holder.pid } : {};
+}
+
+async function waitForLockWaitAsync(reload: IStreamedRequest, holder: ILockHolder): Promise<void> {
+  const expected: IDaemonNativeLockHolder = getExpectedHolder(holder);
+  await waitForAsync(
+    () =>
+      reload.settled() ||
+      reload.positionPayloads.some((p) => isDeepStrictEqual(p.nativeLockHolder, expected)),
+    'the reload to wait for the repository lock'
+  );
+  expect(reload.settled()).toBe(false);
+}
+
+interface IHold {
+  readonly reached: Promise<void>;
+  release(): void;
+}
+
+/** Holds the next time that the reload of the current generation quiesces its warm set, as it does before the lock. */
+function holdQuiesce(fixture: DaemonGraphTestFixture): IHold {
+  const session: WorkspaceSession = fixture.session;
+  const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+  const reached: IDeferred<void> = createDeferred<void>();
+  const released: IDeferred<void> = createDeferred<void>();
+  jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementationOnce(async () => {
+    reached.resolve();
+    await released.promise;
+    await quiesceAsync();
+  });
+  return { reached: reached.promise, release: () => released.resolve() };
+}
+
+/** Holds the next rushx request that a {@link HeldScriptResolver} resolves, until the test releases it. */
+class ScriptResolutionHold {
+  #next: { readonly reached: IDeferred<void>; readonly released: IDeferred<void> } | undefined;
+
+  public arm(): IHold {
+    const next: { readonly reached: IDeferred<void>; readonly released: IDeferred<void> } = {
+      reached: createDeferred<void>(),
+      released: createDeferred<void>()
+    };
+    this.#next = next;
+    return { reached: next.reached.promise, release: () => next.released.resolve() };
+  }
+
+  public async waitAsync(): Promise<void> {
+    const next: { readonly reached: IDeferred<void>; readonly released: IDeferred<void> } | undefined =
+      this.#next;
+    this.#next = undefined;
+    if (!next) return;
+    next.reached.resolve();
+    await next.released.promise;
+  }
+}
+
+class HeldScriptResolver implements IDaemonRequestResolver {
+  public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
+  readonly #resolver: IDaemonRequestResolver;
+  readonly #hold: ScriptResolutionHold;
+
+  public constructor(resolver: IDaemonRequestResolver, hold: ScriptResolutionHold) {
+    this.#resolver = resolver;
+    this.#hold = hold;
+    this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
+      resolver,
+      (replacement: IDaemonRequestResolver) => new HeldScriptResolver(replacement, hold)
+    );
+  }
+
+  public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
+    if (isRushxInvocation(options.envelope)) await this.#hold.waitAsync();
+    return await this.#resolver.resolveRequestAsync(options);
+  }
+
+  public async [Symbol.asyncDispose](): Promise<void> {
+    await this.#resolver[Symbol.asyncDispose]?.();
+  }
+}
+
+describe('a served rushx script while a reload waits for another Rush process', () => {
+  it('starts at once on the current generation while the reload waits for the lock, but not while it loads', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    let loading: IHold | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+
+      // The script used to wait behind the reload until its own wait timeout ended, and never ran.
+      expectSuccess(await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000)));
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(reload.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      await holder.releaseAsync();
+      expectSuccess(await reload.exchange);
+      const reloadedGeneration: number = fixture.host.workspaceGeneration;
+      expect(reloadedGeneration).toBeGreaterThan(generation);
+
+      // A reload that is loading the graph, and not waiting for another process, still holds the script.
+      loading = holdQuiesce(fixture);
+      const nextReload: IStreamedRequest = await startReloadAsync(fixture);
+      await loading.reached;
+      const script: IStreamedRequest = await startRequestAsync(
+        fixture,
+        ['quick'],
+        getScriptEnvelope(fixture, 2000)
+      );
+      await delayAsync(1000);
+      expect(script.settled()).toBe(false);
+      expect(countScriptRuns(fixture)).toBe(1);
+      loading.release();
+      expectSuccess(await nextReload.exchange);
+      expectSuccess(await script.exchange);
+      expect(countScriptRuns(fixture)).toBe(2);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(reloadedGeneration);
+    } finally {
+      // A failed expectation must not leave the reload held, or disposing the fixture would wait for it.
+      loading?.release();
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a script that waits behind the reload pass once the reload waits for the lock', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    let loading: IHold | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      loading = holdQuiesce(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await loading.reached;
+      const script: IStreamedRequest = await startRequestAsync(
+        fixture,
+        ['quick'],
+        getScriptEnvelope(fixture, 2000)
+      );
+      await waitForAsync(() => script.positionPayloads.length > 0, 'the script to wait behind the reload');
+
+      loading.release();
+      await waitForLockWaitAsync(reload, holder);
+      expectSuccess(await script.exchange);
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(reload.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+      // It passed the reload as soon as the reload began to wait, so it was never told to wait for the holder.
+      expect(script.positionPayloads.filter((p) => p.nativeLockHolder !== undefined)).toEqual([]);
+
+      await holder.releaseAsync();
+      expectSuccess(await reload.exchange);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      loading?.release();
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('replaces the generation only after each script that passed the reload has started', async () => {
+    const resolution: ScriptResolutionHold = new ScriptResolutionHold();
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync((created) => {
+      created.wrapResolver = (resolver: IDaemonRequestResolver) =>
+        new HeldScriptResolver(resolver, resolution);
+    });
+    let holder: ILockHolder | undefined;
+    let resolving: IHold | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+
+      resolving = resolution.arm();
+      let resolvingReached: boolean = false;
+      void resolving.reached.then(() => {
+        resolvingReached = true;
+      });
+      const script: IStreamedRequest = await startRequestAsync(
+        fixture,
+        ['quick'],
+        getScriptEnvelope(fixture, 5000)
+      );
+      await waitForAsync(() => resolvingReached || script.settled(), 'the script to pass the reload');
+      expect(script.settled()).toBe(false);
+      await holder.releaseAsync();
+      // The reload tries the lock every 250 ms. Once it has it, it waits for the script that is still resolving.
+      await delayAsync(1000);
+      expect(reload.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      resolving.release();
+      expectSuccess(await script.exchange);
+      expectSuccess(await reload.exchange);
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      resolving?.release();
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('starts at once while the first build of a new daemon waits for the lock', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    try {
+      holder = await holdRepositoryLockAsync(fixture);
+      // The first build loads the graph through the same reload, so the script resolves on the session it created.
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: RELOAD_WAIT_TIMEOUT_MS }
+      });
+      await waitForLockWaitAsync(build, holder);
+      const generation: number = fixture.host.workspaceGeneration;
+
+      expectSuccess(await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000)));
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(build.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      await holder.releaseAsync();
+      expectSuccess(await build.exchange);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('replaces the generation after a script that passed the reload is handed back before it starts', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+
+      // After an edit to rush.json, the resolver hands the script back, and the client runs it in-process.
+      changeRushJson(fixture);
+      const { terminal } = await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000));
+      expect(terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+      expect(countScriptRuns(fixture)).toBe(0);
+      expect(reload.settled()).toBe(false);
+
+      // The script never started, so the reload would wait for it forever if its pass outlived the request.
+      await holder.releaseAsync();
+      await waitForAsync(() => reload.settled(), 'the reload to finish');
+      expectSuccess(await reload.exchange);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
+
+describe('a served build that waits behind a reload that waits for another Rush process', () => {
+  it('is told which process the reload waits for, and its wait timeout names that process', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+      const nativeLockHolder: IDaemonNativeLockHolder = getExpectedHolder(holder);
+
+      // Its client used to be told only its position, and its timeout named only the reload.
+      const short: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 2000 }
+      });
+      expect((await short.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage:
+            "The request was not admitted within its 2000ms wait timeout while waiting for another request's " +
+            `load or reload of the workspace graph, which waits for ${formatNativeLockHolder(nativeLockHolder)} ` +
+            "to release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+        }
+      });
+      expect(short.positionPayloads).toEqual([
+        { position: 1, requestId: expect.any(String), nativeLockHolder }
+      ]);
+
+      const long: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: RELOAD_WAIT_TIMEOUT_MS }
+      });
+      await waitForAsync(() => long.positionPayloads.length > 0, 'the build to wait behind the reload');
+      await holder.releaseAsync();
+      expectSuccess(await reload.exchange);
+      expectSuccess(await long.exchange);
+      // Once the reload has the lock, the build still waits for the reload, but not for another process.
+      expect(long.positionPayloads).toEqual([
+        { position: 1, requestId: expect.any(String), nativeLockHolder },
+        { position: 1, requestId: expect.any(String) }
+      ]);
+    } finally {
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts b/libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts
new file mode 100644
index 00000000000..a23d11b2413
--- /dev/null
+++ b/libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonRequestDispatchError } from '../DaemonRequestDispatcher';
+import {
+  addStoppedContinuingOperations,
+  formatStoppedContinuingOperations
+} from '../StoppedContinuingOperations';
+
+describe(formatStoppedContinuingOperations.name, () => {
+  it('names one operation in the singular', () => {
+    expect(formatStoppedContinuingOperations({ count: 1, names: ['c (compile)'] })).toBe(
+      'rushd stopped 1 operation left running by an earlier failed command (c (compile)), so that this command ' +
+        'can run in-process.'
+    );
+  });
+
+  it('names the operations in the given order, and counts the ones that it does not name', () => {
+    expect(formatStoppedContinuingOperations({ count: 2, names: ['S1', 'S2'] })).toBe(
+      'rushd stopped 2 operations left running by an earlier failed command (S1, S2), so that this command can ' +
+        'run in-process.'
+    );
+    expect(formatStoppedContinuingOperations({ count: 5, names: ['S1', 'S10', 'S2'] })).toBe(
+      'rushd stopped 5 operations left running by an earlier failed command (S1, S10, S2 +2 more), so that this ' +
+        'command can run in-process.'
+    );
+  });
+
+  it('leaves the names out if there are none', () => {
+    expect(formatStoppedContinuingOperations({ count: 2, names: [] })).toBe(
+      'rushd stopped 2 operations left running by an earlier failed command, so that this command can run ' +
+        'in-process.'
+    );
+  });
+});
+
+describe(addStoppedContinuingOperations.name, () => {
+  const stopped: string = formatStoppedContinuingOperations({ count: 1, names: ['c (compile)'] });
+
+  it('adds the line after the first line of the rejection, which the client prints as its fallback line', () => {
+    const rejection: DaemonRequestDispatchError = new DaemonRequestDispatchError(
+      'unsupported',
+      'The command is not phased.\nwarning: first\nwarning: second'
+    );
+    const added: DaemonRequestDispatchError = addStoppedContinuingOperations(rejection, {
+      count: 1,
+      names: ['c (compile)']
+    });
+    expect(added.message).toBe(`The command is not phased.\n${stopped}\nwarning: first\nwarning: second`);
+    expect(added.code).toBe('unsupported');
+    expect(added.cause).toBe(rejection);
+    expect(rejection.message).toBe('The command is not phased.\nwarning: first\nwarning: second');
+  });
+
+  it('adds the line after the first line that is not blank', () => {
+    const rejection: DaemonRequestDispatchError = new DaemonRequestDispatchError(
+      'unsupported',
+      '\n  \nThe command is not phased.'
+    );
+    expect(addStoppedContinuingOperations(rejection, { count: 1, names: ['c (compile)'] }).message).toBe(
+      `\n  \nThe command is not phased.\n${stopped}`
+    );
+  });
+});
diff --git a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
index 3e2b0046724..76e77f0e11d 100644
--- a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
+++ b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
@@ -23,6 +23,7 @@ import {
 } from '@rushstack/rush-daemon-transport';
 
 import { createDeferred, type IDeferred } from './DaemonRequestWireTestUtilities';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
@@ -82,6 +83,7 @@ export class MutationGate implements AsyncDisposable {
 /** Real offline PNPM installation plus standalone native daemon processes, owned entirely by one test. */
 export class SuccessfulMutationFixture implements AsyncDisposable {
   public readonly folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-successful-mutation-'));
+  public readonly runtimeBase: string = createDaemonTestRuntimeBase();
   public readonly repoRoot: string = path.join(this.folder, 'repo');
   public readonly controlFolder: string = path.join(this.folder, 'control');
   public readonly environment: Readonly<Record<string, string>>;
@@ -97,14 +99,13 @@ export class SuccessfulMutationFixture implements AsyncDisposable {
     const home: string = path.join(this.folder, 'home');
     fs.mkdirSync(home, { recursive: true });
     fs.mkdirSync(this.controlFolder, { recursive: true });
-    fs.mkdirSync(path.join(this.folder, 'runtime'), { recursive: true, mode: 0o700 });
     fs.writeFileSync(path.join(home, '.npmrc'), '');
     fs.writeFileSync(path.join(home, 'global.npmrc'), '');
     const environment: NodeJS.ProcessEnv = {
       ...process.env,
       HOME: home,
       USERPROFILE: home,
-      XDG_RUNTIME_DIR: path.join(this.folder, 'runtime'),
+      RUSHD_RUNTIME_DIR: this.runtimeBase,
       RUSH_GLOBAL_FOLDER: path.join(this.folder, 'rush-global'),
       RUSH_PNPM_STORE_PATH: path.join(this.folder, 'store'),
       RUSH_TEMP_FOLDER: undefined,
@@ -288,6 +289,9 @@ if (fs.existsSync(controlFile)) {
     execFileSync(
       'git',
       [
+        // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+        '-c',
+        'maintenance.auto=false',
         '-c',
         'user.name=Mutation Test',
         '-c',
@@ -450,12 +454,15 @@ if (fs.existsSync(controlFile)) {
         }
       }
     } finally {
-      if (errors.length === 0) await removeTestFolderAsync(this.folder, true);
+      if (errors.length === 0) {
+        await removeTestFolderAsync(this.folder, true);
+        await removeTestFolderAsync(this.runtimeBase, true);
+      }
     }
     if (errors.length > 0) {
       throw new AggregateError(
         errors,
-        `Failed to clean up native mutation fixtures; retained ${this.folder}.`
+        `Failed to clean up native mutation fixtures; retained ${this.folder} and ${this.runtimeBase}.`
       );
     }
   }
diff --git a/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts b/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts
index 9bd6cd151a2..6e458339465 100644
--- a/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts
+++ b/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts
@@ -4,6 +4,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { Rush } from '@microsoft/rush-lib';
 import { DaemonClient } from '@rushstack/rush-client-core';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
@@ -132,7 +133,12 @@ describe('successful native install/update', () => {
         } finally {
           await ready.closeAsync();
         }
-        expect(await fixture.waitForInitialExitAsync()).toMatchObject({ exitCode: 0 });
+        const initialExit: ISuccessfulMutationOutput = await fixture.waitForInitialExitAsync();
+        expect(initialExit).toMatchObject({ exitCode: 0 });
+        expect(initialExit.stderr.match(/shutting down: .*/g)).toEqual([
+          `shutting down: restarting for Rush ${Rush.version} after "rush install" or "rush update"`
+        ]);
+        expect(initialExit.stderr).toContain(`rushd (PID ${initialPid}) shutting down: `);
         expect(fs.readFileSync(path.join(fixture.controlFolder, 'events.txt'), 'utf8')).toBe(
           `postinstall:${commandName}\nresult-received\nold-resources-disposed\nsuccessor-process-started\n`
         );
diff --git a/libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts b/libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts
new file mode 100644
index 00000000000..e7d917b761d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts
@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { RushConfiguration } from '@microsoft/rush-lib';
+
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+/** Creates an empty Rush repository in the folder, and returns its common/temp folder. */
+export function createTemporaryRepo(repoRoot: string): string {
+  const commonTempFolder: string = path.join(repoRoot, 'common', 'temp');
+  fs.mkdirSync(path.join(repoRoot, 'common', 'config', 'rush'), { recursive: true });
+  fs.mkdirSync(commonTempFolder, { recursive: true });
+  fs.writeFileSync(
+    path.join(repoRoot, 'rush.json'),
+    JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '8.14.0', projects: [] })
+  );
+  return commonTempFolder;
+}
+
+/** A workspace in a repository of its own, from {@link createTemporaryRepo}, whose lock a test can hold. */
+export class TemporaryRepoWorkspaceSession extends TestWorkspaceSession {
+  public override readonly rushConfiguration: RushConfiguration;
+
+  public constructor(repoRoot: string) {
+    super(repoRoot);
+    this.rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(repoRoot, 'rush.json'));
+  }
+}
diff --git a/libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts b/libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts
new file mode 100644
index 00000000000..da6e427d9d1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { RushDaemonHost } from '../RushDaemonHost';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+/** Longer than a host's close, a successor's startup (15 s by default) and the successor's stop (15 s) together. */
+const STOP_TIMEOUT_MS: number = 60_000;
+
+const hosts: Set<RushDaemonHost> = new Set();
+let fileEnded: boolean = false;
+
+/**
+ * Closes `host` once the running test ends, and stops any successor daemon that the host started.
+ *
+ * @remarks
+ * A test that times out never reaches its own `finally`. Jest goes on to the next test while that test keeps running,
+ * so its host can still start a real successor, which would run for its whole idle timeout (900 s) with its socket,
+ * lockfile and log in the shared runtime directory. Jest does run `afterEach` after a timed-out test: that closes the
+ * host, waits for a restart that it began, and stops the successor. A host that starts after its test file's last
+ * hook is closed at once, and this rejects.
+ */
+export async function trackTestDaemonHostAsync(host: RushDaemonHost): Promise<void> {
+  if (!fileEnded) {
+    hosts.add(host);
+    return;
+  }
+  await stopHostAsync(host);
+  throw new Error('A daemon host started after its test file ended, so it was closed.');
+}
+
+async function stopHostAsync(host: RushDaemonHost): Promise<void> {
+  // The test reports its own close and restart failures; this only makes sure that nothing keeps running.
+  await host.closeAsync().catch(() => undefined);
+  await host.restartCompleted.catch(() => undefined);
+  await stopSuccessorAsync(host.paths);
+}
+
+async function stopTrackedHostsAsync(): Promise<void> {
+  const stopping: Promise<void>[] = Array.from(hosts, stopHostAsync);
+  hosts.clear();
+  const failures: unknown[] = (await Promise.allSettled(stopping)).flatMap((result) =>
+    result.status === 'rejected' ? [result.reason] : []
+  );
+  if (failures.length > 0) {
+    throw new AggregateError(failures, 'Failed to stop the daemons that a test left running.');
+  }
+}
+
+afterEach(stopTrackedHostsAsync, STOP_TIMEOUT_MS);
+
+afterAll(async () => {
+  fileEnded = true;
+  await stopTrackedHostsAsync();
+}, STOP_TIMEOUT_MS);
diff --git a/libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts b/libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts
new file mode 100644
index 00000000000..1da6066f210
--- /dev/null
+++ b/libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts
@@ -0,0 +1,418 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  DaemonRestartReason,
+  IDaemonNativeLockHolder,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import {
+  AdmissionProgress,
+  RequestAdmissionController,
+  ServedScriptScheduler
+} from '../WorkspaceRequestAdmission';
+
+type QueuePosition = IDaemonRequestQueuePositionMessage['payload'];
+
+const RESTART_REASON: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const NATIVE_INSTALL: DaemonRestartReason = { kind: 'nativeMutation', commandName: 'install' };
+const HOLDER: IDaemonNativeLockHolder = { pid: 4242, command: 'rush install' };
+
+interface ITestController {
+  readonly controller: RequestAdmissionController;
+  readonly messages: QueuePosition[];
+}
+
+function createController(admission: IDaemonRequestAdmissionOptions | undefined): ITestController {
+  const messages: QueuePosition[] = [];
+  const controller: RequestAdmissionController = new RequestAdmissionController({
+    admission,
+    client: {
+      abortSignal: new AbortController().signal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+        messages.push(message.payload);
+      }
+    },
+    requestId: 'request'
+  });
+  return { controller, messages };
+}
+
+/** A plain queue position, or one that names the process that holds native Rush's repository lock. */
+function position(queued: number, nativeLockHolder?: IDaemonNativeLockHolder): QueuePosition {
+  return { position: queued, requestId: 'request', ...(nativeLockHolder && { nativeLockHolder }) };
+}
+
+/**
+ * The position of a request that waits behind a transition whose owner waits for `scriptCount` scripts: the scripts,
+ * the owner and the requests queued ahead of it are all ahead of it.
+ */
+function behind(
+  queued: number,
+  scriptCount: number,
+  restartReason: DaemonRestartReason = RESTART_REASON
+): QueuePosition {
+  return {
+    position: scriptCount + queued,
+    requestId: 'request',
+    restartReason,
+    scriptCount,
+    restartsForAnotherRequest: true
+  };
+}
+
+/** The owner's own position while it waits for `scriptCount` scripts: only the scripts are ahead of it. */
+function waitingFor(scriptCount: number, restartReason?: DaemonRestartReason): QueuePosition {
+  return {
+    position: scriptCount,
+    requestId: 'request',
+    ...(restartReason && { restartReason }),
+    scriptCount
+  };
+}
+
+interface IOutcome<T> {
+  settled: boolean;
+  value?: T;
+  error?: unknown;
+}
+
+function track<T>(promise: Promise<T>): IOutcome<T> {
+  const outcome: IOutcome<T> = { settled: false };
+  promise.then(
+    (value: T) => {
+      outcome.settled = true;
+      outcome.value = value;
+    },
+    (error: unknown) => {
+      outcome.settled = true;
+      outcome.error = error;
+    }
+  );
+  return outcome;
+}
+
+describe(`${RequestAdmissionController.name} behind a graph transition that waits for rushx scripts`, () => {
+  let scheduler: RequestScheduler;
+  let ownerLease: IRequestLease;
+  let transition: AdmissionProgress;
+  let scripts: ServedScriptScheduler;
+
+  beforeEach(async () => {
+    jest.useFakeTimers();
+    scheduler = new RequestScheduler();
+    ownerLease = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive });
+    transition = new AdmissionProgress();
+    scripts = new ServedScriptScheduler();
+  });
+
+  afterEach(() => {
+    ownerLease.release();
+    jest.useRealTimers();
+  });
+
+  async function startScriptsAsync(count: number): Promise<IRequestLease[]> {
+    const leases: IRequestLease[] = [];
+    for (let i: number = 0; i < count; i++) {
+      leases.push(await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild }));
+    }
+    return leases;
+  }
+
+  function waitBehind(
+    follower: ITestController,
+    stopWaiting?: AbortSignal
+  ): IOutcome<IRequestLease | undefined> {
+    const { controller } = follower;
+    const admission: Promise<IRequestLease | undefined> = stopWaiting
+      ? controller.acquireBehindTransitionAsync(scheduler, transition, false, stopWaiting)
+      : controller.acquireBehindTransitionAsync(scheduler, transition);
+    return track(admission);
+  }
+
+  /**
+   * The owner of the transition, which holds the gate, waits for the scripts, as the lifecycle has it do: before a
+   * restart for `restartReason`, or, without one, before it runs a native install, which the requests behind it are
+   * told of instead.
+   */
+  function waitForScripts(owner: ITestController, restartReason?: DaemonRestartReason): IOutcome<void> {
+    return track(
+      owner.controller.waitForServedScriptsAsync(scripts, restartReason, {
+        progress: transition,
+        restartReason: restartReason ?? NATIVE_INSTALL
+      })
+    );
+  }
+
+  it('tells the requests that wait behind it how many scripts it waits for, and why, until they exit', async () => {
+    const [firstScript, secondScript]: IRequestLease[] = await startScriptsAsync(2);
+    const owner: ITestController = createController(undefined);
+    const first: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const second: ITestController = createController(undefined);
+    const firstAdmission: IOutcome<IRequestLease | undefined> = waitBehind(first);
+    const secondAdmission: IOutcome<IRequestLease | undefined> = waitBehind(second);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(first.messages).toEqual([position(1), position(1)]);
+    expect(second.messages).toEqual([position(2)]);
+
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(owner.messages).toEqual([waitingFor(2, RESTART_REASON)]);
+    expect(transition.scriptWait).toEqual({ scriptCount: 2, restartReason: RESTART_REASON });
+    expect(first.messages.slice(2)).toEqual([behind(1, 2)]);
+    expect(second.messages.slice(1)).toEqual([behind(2, 2)]);
+
+    secondScript.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(owner.messages.slice(1)).toEqual([waitingFor(1, RESTART_REASON)]);
+    expect(first.messages.slice(3)).toEqual([behind(1, 1)]);
+    expect(second.messages.slice(2)).toEqual([behind(2, 1)]);
+
+    firstScript.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait).toEqual({ settled: true, value: undefined });
+    expect(transition.scriptWait).toBeUndefined();
+    // They still wait behind the transition, but no longer for scripts. The owner reports no script count of 0.
+    expect(first.messages.slice(4)).toEqual([position(1)]);
+    expect(second.messages.slice(3)).toEqual([position(2)]);
+    expect(owner.messages).toHaveLength(2);
+    expect(firstAdmission.settled || secondAdmission.settled).toBe(false);
+
+    const messageCounts: number[] = [first.messages.length, second.messages.length];
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(firstAdmission.value?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect(secondAdmission.value?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect([first.messages.length, second.messages.length]).toEqual(messageCounts);
+    firstAdmission.value?.release();
+    secondAdmission.value?.release();
+    for (const { controller } of [owner, first, second]) controller.dispose();
+  });
+
+  it('names the scripts to a request that starts waiting behind it while it waits for them', async () => {
+    const [script]: IRequestLease[] = await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(late);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([behind(1, 1)]);
+
+    script.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    expect(late.messages).toEqual([behind(1, 1), position(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission.value).toBeDefined();
+    admission.value?.release();
+    owner.controller.dispose();
+    late.controller.dispose();
+  });
+
+  it('tells the requests behind it nothing new when no script runs', async () => {
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    expect(transition.scriptWait).toBeUndefined();
+    expect(owner.messages).toEqual([]);
+    expect(follower.messages).toEqual([position(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    admission.value?.release();
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('names the scripts and the restart in the timeout of a request that waits behind it', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    // The owner loads the graph first, which does not count against the follower's timeout.
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(900);
+    transition.setActive(false);
+    waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(1999);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 2000ms wait timeout while waiting for another request that waits ' +
+        'for 1 rushx script that this daemon runs to exit before it restarts the daemon because ' +
+        'common/config/rush/pnpm-lock.yaml changed; 0.9s spent while that request loaded the graph did not count. ' +
+        'Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([position(1), behind(1, 1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('names the scripts and the native install in the timeout of a request that waits behind it', async () => {
+    await startScriptsAsync(2);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 500 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    // A native install has no restart reason of its own: it runs once the scripts exit, and then restarts the daemon.
+    waitForScripts(owner);
+    await jest.advanceTimersByTimeAsync(499);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 500ms wait timeout while waiting for another request that waits ' +
+        'for 2 rushx scripts that this daemon runs to exit before it restarts the daemon because it runs rush ' +
+        'install. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(owner.messages).toEqual([waitingFor(2)]);
+    expect(follower.messages).toEqual([position(1), behind(1, 2, NATIVE_INSTALL)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the scripts in a later timeout once they have exited', async () => {
+    const [script]: IRequestLease[] = await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(1000);
+    script.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    await jest.advanceTimersByTimeAsync(999);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 2000ms wait timeout while waiting for another request's load " +
+        'or reload of the workspace graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([position(1), behind(1, 1), position(1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('stops naming the scripts to the requests behind it when it stops waiting for them before they exit', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController({ waitTimeoutMs: 500 });
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(499);
+    expect(wait.settled).toBe(false);
+    expect(follower.messages).toEqual([position(1), behind(1, 1)]);
+
+    await jest.advanceTimersByTimeAsync(1);
+    expect(wait.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    expect(transition.scriptWait).toBeUndefined();
+    expect(follower.messages.slice(2)).toEqual([position(1)]);
+    // The lifecycle keeps one progress for all of its transitions, so a wait that outlived the owner's would be named
+    // to the requests that wait behind the next one.
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const lateAdmission: IOutcome<IRequestLease | undefined> = waitBehind(late);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([position(2)]);
+
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission.value).toBeDefined();
+    expect(lateAdmission.value).toBeDefined();
+    admission.value?.release();
+    lateAdmission.value?.release();
+    for (const { controller } of [owner, follower, late]) controller.dispose();
+  });
+
+  it('names the scripts rather than a process that holds the lock while both are published', async () => {
+    const [script]: IRequestLease[] = await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    // The lifecycle never publishes both, since the owner waits for the lock only while it reloads.
+    transition.setNativeLockHolder(HOLDER);
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([position(1, HOLDER)]);
+
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages.slice(1)).toEqual([behind(1, 1)]);
+
+    script.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    expect(follower.messages.slice(2)).toEqual([position(1, HOLDER)]);
+    transition.setNativeLockHolder(undefined);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages.slice(3)).toEqual([position(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission.value).toBeDefined();
+    admission.value?.release();
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('names the scripts rather than a process that holds the lock in a timeout while both are published', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    transition.setNativeLockHolder(HOLDER);
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(2000);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 2000ms wait timeout while waiting for another request that waits ' +
+        'for 1 rushx script that this daemon runs to exit before it restarts the daemon because ' +
+        'common/config/rush/pnpm-lock.yaml changed. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([position(1, HOLDER), behind(1, 1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the scripts to a script that stopped waiting to pass it', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const passing: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const stopWaiting: AbortController = new AbortController();
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(passing, stopWaiting.signal);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(passing.messages).toEqual([position(1)]);
+
+    stopWaiting.abort();
+    waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission).toEqual({ settled: true, value: undefined });
+    expect(owner.messages).toEqual([waitingFor(1, RESTART_REASON)]);
+    expect(passing.messages).toEqual([position(1)]);
+    owner.controller.dispose();
+    passing.controller.dispose();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 34ea43c4ee8..3e1b3403694 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -7,6 +7,7 @@ import * as path from 'node:path';
 
 import { Rush } from '@microsoft/rush-lib';
 import { Utilities } from '@microsoft/rush-lib/lib/utilities/Utilities';
+import { PackageJsonLookup } from '@rushstack/node-core-library';
 import {
   connectOrStartDaemonAsync,
   requestDaemonShutdownAsync,
@@ -19,23 +20,29 @@ import {
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import type { IInstalledDaemonLauncher } from '../DaemonInstallation';
 import {
   selectDaemonLauncherAsync,
+  getDaemonVersionCacheFolder,
   getSelectedDaemonStartCommand,
   DaemonLauncherUnavailableError,
-  type IDaemonLauncherContext
+  type IDaemonLauncherContext,
+  type ISelectDaemonLauncherOptions
 } from '../VersionSelectedDaemonLauncher';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
+import { hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 describe('version-selected daemon launcher', () => {
   let repoRoot: string;
+  let runtimeBase: string;
   let context: IDaemonLauncherContext;
   let preserveFixture: boolean;
 
   beforeEach(() => {
     preserveFixture = false;
     repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'daemon-selection-'));
-    fs.mkdirSync(path.join(repoRoot, 'runtime'));
+    runtimeBase = createDaemonTestRuntimeBase();
     fs.writeFileSync(
       path.join(repoRoot, 'rush.json'),
       JSON.stringify({
@@ -56,16 +63,20 @@ describe('version-selected daemon launcher', () => {
         RUSH_GLOBAL_FOLDER: path.join(repoRoot, 'global'),
         RUSH_PREVIEW_VERSION: undefined,
         NPM_CONFIG_CACHE: path.join(repoRoot, 'npm-cache'),
-        XDG_RUNTIME_DIR: path.join(repoRoot, 'runtime'),
-        TMPDIR: path.join(repoRoot, 'runtime'),
-        TMP: path.join(repoRoot, 'runtime'),
-        TEMP: path.join(repoRoot, 'runtime')
+        RUSHD_RUNTIME_DIR: runtimeBase,
+        XDG_RUNTIME_DIR: runtimeBase,
+        TMPDIR: runtimeBase,
+        TMP: runtimeBase,
+        TEMP: runtimeBase
       }
     };
   });
 
   afterEach(async () => {
-    if (!preserveFixture) await removeTestFolderAsync(repoRoot);
+    if (!preserveFixture) {
+      await removeTestFolderAsync(repoRoot);
+      await removeTestFolderAsync(runtimeBase);
+    }
   });
 
   async function stopDaemonAsync(client: DaemonClient, paths: IDaemonPaths): Promise<void> {
@@ -90,25 +101,63 @@ describe('version-selected daemon launcher', () => {
     expect(process.env._RUSH_LIB_PATH).toBe(originalRushLibPath);
   });
 
+  it("starts the daemon without the starting client's request-scoped variables", () => {
+    const command = getSelectedDaemonStartCommand(path.join(repoRoot, 'package.json'), {
+      ...context,
+      environment: {
+        HOME: '/home/user',
+        RUSH_PARALLELISM: '48',
+        COPILOT_AGENT_SESSION_ID: 'session-1',
+        RUSHD_TELEMETRY_TAG: 'tag-1',
+        CLAUDE_CODE_SESSION_ID: 'claude-session-1',
+        CLAUDE_PID: '4242',
+        CLAUDE_CODE_MESSAGING_TOKEN: 'token-1',
+        TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+        RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+        RUSHD_OUTPUT: 'agent',
+        // The first client's session folders may disappear while the daemon lives on.
+        TMPDIR: '/tmp/session-1',
+        XDG_RUNTIME_DIR: '/run/user/1000',
+        CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-1',
+        CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-1.sock',
+        TEMP: '/tmp/temp-1',
+        RUSHD_RUNTIME_DIR: '/var/rushd',
+        UNSET: undefined
+      }
+    });
+    expect(command.environment).toEqual({
+      HOME: '/home/user',
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      RUSHD_OUTPUT: 'agent',
+      TEMP: '/tmp/temp-1',
+      RUSHD_RUNTIME_DIR: '/var/rushd'
+    });
+    expect(Object.isFrozen(command.environment)).toBe(true);
+  });
+
   it('never relabels the bundled engine as a different requested version', async () => {
     fs.writeFileSync(path.join(repoRoot, 'rush.json'), JSON.stringify({ rushVersion: '5.178.1' }));
     await expect(
-      selectDaemonLauncherAsync(
-        {
-          ...context,
-          rushVersion: '5.178.1'
-        },
-        { allowInstall: false }
+      hideResolvedValueAsync(
+        selectDaemonLauncherAsync(
+          {
+            ...context,
+            rushVersion: '5.178.1'
+          },
+          { allowInstall: false }
+        )
       )
     ).rejects.toThrow('Cannot launch selected Rush 5.178.1');
   });
 
   it('requires the requested version to match rush.json before installing anything', async () => {
     await expect(
-      selectDaemonLauncherAsync({
-        ...context,
-        rushVersion: '5.178.1'
-      })
+      hideResolvedValueAsync(
+        selectDaemonLauncherAsync({
+          ...context,
+          rushVersion: '5.178.1'
+        })
+      )
     ).rejects.toThrow('does not match rush.json');
     expect(fs.existsSync(path.join(repoRoot, 'global'))).toBe(false);
   });
@@ -151,7 +200,7 @@ describe('version-selected daemon launcher', () => {
         {
           platform: process.platform,
           env: context.environment,
-          tmpdir: path.join(repoRoot, 'runtime'),
+          tmpdir: runtimeBase,
           uid: process.getuid?.()
         },
         computeDaemonWorkspaceKey({
@@ -246,14 +295,521 @@ describe('version-selected daemon launcher', () => {
       expect(failure.installation!.rushVersion).not.toBe(Rush.version);
       expect(failure.installation!.protocolVersion.minor).toBeLessThan(DAEMON_PROTOCOL_VERSION.minor);
       expect(failure.installation!.rushLibEntryPoint.startsWith(path.join(repoRoot, 'global'))).toBe(true);
-      await expect(selectDaemonLauncherAsync(requested, { allowInstall: false })).rejects.toMatchObject({
+      await expect(
+        hideResolvedValueAsync(selectDaemonLauncherAsync(requested, { allowInstall: false }))
+      ).rejects.toMatchObject({
         installation: { rushVersion: '5.178.1', daemonVersion: '0.4.1' }
       });
     },
     240000
   );
 
+  describe('when no cached or published launcher can serve this client', () => {
+    const requestedVersion: string = '5.178.1';
+    const oldProtocol: { major: number; minor: number } = { major: 0, minor: 2 };
+    const dayMs: number = 24 * 60 * 60 * 1000;
+    const hourMs: number = 60 * 60 * 1000;
+    let registryFolder: string;
+    let cacheFolder: string;
+    let verdictPath: string;
+    let requested: IDaemonLauncherContext;
+
+    interface INpmCall {
+      readonly args: string[];
+      readonly pid: number;
+      readonly env: Record<string, string>;
+    }
+
+    interface IVerdictJson {
+      schemaVersion: number;
+      rushVersion: string;
+      client: string;
+      checkedAt: string;
+      expiresAt: string;
+      reason: string;
+      installation?: IInstalledDaemonLauncher;
+      incompatibleInstallations: { folderName: string; markerIdentity: string; installation: unknown }[];
+    }
+
+    function writeFakeDaemon(
+      root: string,
+      daemonVersion: string,
+      protocolVersion: { major: number; minor: number },
+      canLaunchRequests: boolean
+    ): void {
+      const files: Record<string, string> = {
+        '@rushstack/rush-daemon/package.json': JSON.stringify({
+          name: '@rushstack/rush-daemon',
+          version: daemonVersion,
+          main: 'index.js',
+          bin: { rushd: 'bin/rushd.js' }
+        }),
+        '@rushstack/rush-daemon/bin/rushd.js': '',
+        '@rushstack/rush-daemon/index.js': canLaunchRequests
+          ? 'for (const name of ["serveRushDaemonAsync", "ProductionDaemonRequestResolver", "RushDaemonRequestResolver"]) exports[name] = function () {};\n'
+          : '',
+        '@microsoft/rush-lib/package.json': JSON.stringify({
+          name: '@microsoft/rush-lib',
+          version: requestedVersion,
+          main: 'index.js'
+        }),
+        // Only an attestation loads this engine, so the log counts attestations.
+        '@microsoft/rush-lib/index.js':
+          `require('fs').appendFileSync(${JSON.stringify(path.join(registryFolder, 'probes.log'))}, 'probe\\n');\n` +
+          `exports.Rush = { version: ${JSON.stringify(requestedVersion)} };\n` +
+          (canLaunchRequests ? 'exports.resolveDaemonConfiguration = function () {};\n' : ''),
+        '@rushstack/rush-daemon-protocol/package.json': JSON.stringify({
+          name: '@rushstack/rush-daemon-protocol',
+          version: '0.0.0',
+          main: 'index.js'
+        }),
+        '@rushstack/rush-daemon-protocol/index.js': `exports.DAEMON_PROTOCOL_VERSION = ${JSON.stringify(protocolVersion)};\n`
+      };
+      for (const [file, content] of Object.entries(files)) {
+        const filePath: string = path.join(root, 'node_modules', file);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, content);
+      }
+    }
+
+    function writeCachedDaemon(
+      daemonVersion: string,
+      protocolVersion: { major: number; minor: number },
+      canLaunchRequests: boolean
+    ): void {
+      const folder: string = path.join(cacheFolder, `daemon-${daemonVersion}`);
+      writeFakeDaemon(folder, daemonVersion, protocolVersion, canLaunchRequests);
+      fs.writeFileSync(
+        path.join(folder, 'last-install.flag'),
+        JSON.stringify({ node: process.versions.node, daemonVersion })
+      );
+    }
+
+    function publish(versions: Record<string, string>): void {
+      fs.writeFileSync(
+        path.join(registryFolder, 'registry.json'),
+        JSON.stringify({
+          versions: Object.keys(versions),
+          packages: Object.fromEntries(
+            Object.entries(versions).map(([version, rushVersion]) => [
+              version,
+              {
+                name: '@rushstack/rush-daemon',
+                version,
+                dependencies: { '@microsoft/rush-lib': rushVersion },
+                bin: { rushd: 'bin/rushd.js' }
+              }
+            ])
+          )
+        })
+      );
+    }
+
+    function setRegistryMode(mode: 'answer' | 'fail' | 'hang'): void {
+      fs.writeFileSync(path.join(registryFolder, 'mode.txt'), mode);
+    }
+
+    function readNpmCalls(): INpmCall[] {
+      const log: string = path.join(registryFolder, 'calls.log');
+      return fs.existsSync(log)
+        ? fs
+            .readFileSync(log, 'utf8')
+            .split('\n')
+            .filter((line) => line)
+            .map((line) => JSON.parse(line))
+        : [];
+    }
+
+    function countProbes(): number {
+      const log: string = path.join(registryFolder, 'probes.log');
+      return fs.existsSync(log)
+        ? fs
+            .readFileSync(log, 'utf8')
+            .split('\n')
+            .filter((line) => line).length
+        : 0;
+    }
+
+    function readVerdict(): IVerdictJson {
+      return JSON.parse(fs.readFileSync(verdictPath, 'utf8'));
+    }
+
+    function describeNpmCalls(calls: INpmCall[]): string[] {
+      return calls.map((call) => call.args.filter((arg) => !arg.startsWith('--')).join(' '));
+    }
+
+    async function selectFailureAsync(
+      options?: ISelectDaemonLauncherOptions,
+      input: IDaemonLauncherContext = requested
+    ): Promise<DaemonLauncherUnavailableError> {
+      const failure: unknown = await selectDaemonLauncherAsync(input, options).then(
+        () => undefined,
+        (error: unknown) => error
+      );
+      if (!(failure instanceof DaemonLauncherUnavailableError)) {
+        throw new Error(`Expected DaemonLauncherUnavailableError, not ${String(failure)}`);
+      }
+      return failure;
+    }
+
+    function expectedRefusal(daemonVersion: string): string {
+      return (
+        `Cannot launch selected Rush ${requestedVersion}: Daemon ${daemonVersion} attests protocol ` +
+        `${oldProtocol.major}.${oldProtocol.minor}; this client requires ` +
+        `${DAEMON_PROTOCOL_VERSION.major}.${DAEMON_PROTOCOL_VERSION.minor} and default request-launch APIs. ` +
+        'Use native Rush instead.'
+      );
+    }
+
+    beforeEach(() => {
+      registryFolder = path.join(repoRoot, 'registry');
+      const binFolder: string = path.join(repoRoot, 'bin');
+      fs.mkdirSync(binFolder, { recursive: true });
+      fs.mkdirSync(registryFolder, { recursive: true });
+      const npmScript: string = path.join(binFolder, 'npm.js');
+      fs.writeFileSync(
+        npmScript,
+        `'use strict';
+const fs = require('fs');
+const path = require('path');
+const registry = process.env.FAKE_NPM_REGISTRY;
+const args = process.argv.slice(2);
+const env = {};
+for (const name of ['INIT_CWD', 'NPM_CONFIG_FAKE', 'RUSH_DAEMON_FAKE', '_RUSH_RECURSIVE_RUSHX_CALL', 'FAKE_PASS']) {
+  env[name] = process.env[name];
+}
+fs.appendFileSync(path.join(registry, 'calls.log'), JSON.stringify({ args, pid: process.pid, env }) + '\\n');
+const mode = fs.readFileSync(path.join(registry, 'mode.txt'), 'utf8');
+const data = JSON.parse(fs.readFileSync(path.join(registry, 'registry.json'), 'utf8'));
+if (args[0] === 'install') {
+  const version = JSON.parse(fs.readFileSync('package.json', 'utf8')).dependencies['@rushstack/rush-daemon'];
+  fs.cpSync(path.join(registry, 'packages', version), process.cwd(), { recursive: true });
+} else if (mode === 'fail') {
+  process.stderr.write('npm error code E503\\n');
+  process.exitCode = 1;
+} else if (mode === 'hang') {
+  // Like a registry that drops packets: npm neither answers nor exits.
+  fs.writeFileSync(path.join(registry, 'hung.pid'), String(process.pid));
+  setTimeout(() => {}, 120000);
+} else {
+  const at = args[1].lastIndexOf('@');
+  process.stdout.write(JSON.stringify(at > 0 ? data.packages[args[1].slice(at + 1)] : data.versions));
+}
+`
+      );
+      fs.writeFileSync(
+        path.join(binFolder, 'npm'),
+        `#!/bin/sh\n"${process.execPath}" "${npmScript}" "$@"\n`,
+        { mode: 0o755 }
+      );
+      fs.writeFileSync(path.join(binFolder, 'npm.cmd'), `@"${process.execPath}" "%~dp0npm.js" %*\r\n`);
+      setRegistryMode('answer');
+      publish({ '0.4.1': requestedVersion, '0.5.0': '5.179.0' });
+      writeFakeDaemon(path.join(registryFolder, 'packages', '0.4.1'), '0.4.1', oldProtocol, false);
+      fs.writeFileSync(
+        path.join(repoRoot, 'rush.json'),
+        JSON.stringify({ rushVersion: requestedVersion, pnpmVersion: '10.27.0', projects: [] })
+      );
+      requested = {
+        ...context,
+        rushVersion: requestedVersion,
+        environment: {
+          ...Object.fromEntries(
+            Object.entries(context.environment).filter(([name]) => !/^path$/i.test(name))
+          ),
+          PATH: [binFolder, process.env.PATH ?? process.env.Path].join(path.delimiter),
+          FAKE_NPM_REGISTRY: registryFolder
+        }
+      };
+      cacheFolder = getDaemonVersionCacheFolder(requested.environment);
+      verdictPath = path.join(cacheFolder, `unavailable-${requestedVersion}.json`);
+    });
+
+    it('records why no launcher is usable, and the next selection neither attests nor asks the registry', async () => {
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      expect(first.message).toBe(expectedRefusal('0.4.1'));
+      expect(first.installation).toMatchObject({ daemonVersion: '0.4.1', rushVersion: requestedVersion });
+      expect(describeNpmCalls(readNpmCalls())).toEqual([
+        'view @rushstack/rush-daemon versions',
+        'view @rushstack/rush-daemon@0.5.0',
+        'view @rushstack/rush-daemon@0.4.1',
+        'install'
+      ]);
+      expect(countProbes()).toBe(1);
+      const verdict: IVerdictJson = readVerdict();
+      expect(verdict.client).toBe(
+        `${PackageJsonLookup.loadOwnPackageJson(__dirname).version} protocol ` +
+          `${DAEMON_PROTOCOL_VERSION.major}.${DAEMON_PROTOCOL_VERSION.minor}`
+      );
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(dayMs);
+      expect(verdict.incompatibleInstallations.map((record) => record.folderName)).toEqual(['daemon-0.4.1']);
+
+      for (let attempt: number = 0; attempt < 2; attempt++) {
+        const again: DaemonLauncherUnavailableError = await selectFailureAsync();
+        expect(again.message).toBe(first.message);
+        expect(again.installation).toEqual(first.installation);
+      }
+      expect(readNpmCalls()).toHaveLength(4);
+      expect(countProbes()).toBe(1);
+      expect(readVerdict()).toEqual(verdict);
+    }, 60000);
+
+    it('records that no published release pins the engine', async () => {
+      publish({ '0.5.0': '5.179.0' });
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      expect(first.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: No published daemon release pins that exact Rush engine. Use native Rush instead.`
+      );
+      expect(first.installation).toBeUndefined();
+      expect(readNpmCalls()).toHaveLength(2);
+      const verdict: IVerdictJson = readVerdict();
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(dayMs);
+      expect(verdict.incompatibleInstallations).toEqual([]);
+
+      expect((await selectFailureAsync()).message).toBe(first.message);
+      expect(readNpmCalls()).toHaveLength(2);
+    }, 60000);
+
+    it('records no verdict when the installer fails, so the next selection asks the registry again', async () => {
+      // The registry lists 0.4.1 but cannot deliver it, so every npm install attempt fails.
+      fs.rmSync(path.join(registryFolder, 'packages', '0.4.1'), { recursive: true });
+      const lookup: string[] = [
+        'view @rushstack/rush-daemon versions',
+        'view @rushstack/rush-daemon@0.5.0',
+        'view @rushstack/rush-daemon@0.4.1'
+      ];
+      let callsBefore: number = 0;
+      for (let attempt: number = 0; attempt < 2; attempt++) {
+        const failure: unknown = await selectDaemonLauncherAsync(requested).then(
+          () => undefined,
+          (error: unknown) => error
+        );
+        expect(failure).toBeInstanceOf(Error);
+        expect(failure).not.toBeInstanceOf(DaemonLauncherUnavailableError);
+        // The installer's own report says why it failed.
+        expect((failure as Error).message).toBe(
+          'Installing @rushstack/rush-daemon@0.4.1 failed (1): Giving up after 3 attempts\n\nProcess exited with code 1'
+        );
+        expect(fs.existsSync(verdictPath)).toBe(false);
+        // Each selection asks the registry again. The installer decides how many times it tries.
+        const calls: string[] = describeNpmCalls(readNpmCalls()).slice(callsBefore);
+        expect(calls.slice(0, lookup.length)).toEqual(lookup);
+        expect(new Set(calls.slice(lookup.length))).toEqual(new Set(['install']));
+        callsBefore += calls.length;
+      }
+      expect(countProbes()).toBe(0);
+    }, 60000);
+
+    it('keeps a failed registry lookup for an hour', async () => {
+      setRegistryMode('fail');
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      expect(first.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: Registry lookup for @rushstack/rush-daemon failed: npm error code E503\n Use native Rush instead.`
+      );
+      const verdict: IVerdictJson = readVerdict();
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(hourMs);
+
+      setRegistryMode('answer');
+      expect((await selectFailureAsync()).message).toBe(first.message);
+      expect(readNpmCalls()).toHaveLength(1);
+    }, 60000);
+
+    it('ends a registry lookup at its deadline, then keeps that failure for an hour', async () => {
+      setRegistryMode('hang');
+      const started: number = Date.now();
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync({ registryTimeoutMs: 1000 });
+      expect(Date.now() - started).toBeLessThan(20000);
+      expect(first.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: Registry lookup for @rushstack/rush-daemon did not finish within 1 s. Use native Rush instead.`
+      );
+      const npmPid: number = Number(fs.readFileSync(path.join(registryFolder, 'hung.pid'), 'utf8'));
+      expect(readNpmCalls().map((call) => call.pid)).toEqual([npmPid]);
+      // The lookup ends npm's whole process tree but waits only for the process that it started, the npm shim,
+      // so npm itself can still be exiting. Left running, it would hang for two minutes.
+      await waitForTestProcessExitAsync(npmPid, 10000);
+      const verdict: IVerdictJson = readVerdict();
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(hourMs);
+
+      expect((await selectFailureAsync({ registryTimeoutMs: 1000 })).message).toBe(first.message);
+      expect(readNpmCalls()).toHaveLength(1);
+    }, 60000);
+
+    it('reports a missing npm as a failed registry lookup', async () => {
+      const emptyFolder: string = path.join(repoRoot, 'empty-bin');
+      fs.mkdirSync(emptyFolder);
+      const failure: DaemonLauncherUnavailableError = await selectFailureAsync(undefined, {
+        ...requested,
+        environment: { ...requested.environment, PATH: emptyFolder }
+      });
+      expect(failure.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: Registry lookup for @rushstack/rush-daemon failed: The executable file was not found: "npm" Use native Rush instead.`
+      );
+      expect(Date.parse(readVerdict().expiresAt) - Date.parse(readVerdict().checkedAt)).toBe(hourMs);
+    }, 60000);
+
+    it('gives npm the environment that Rush gives its commands', async () => {
+      await selectFailureAsync(undefined, {
+        ...requested,
+        environment: {
+          ...requested.environment,
+          INIT_CWD: repoRoot,
+          NPM_CONFIG_FAKE: 'dropped',
+          RUSH_DAEMON_FAKE: 'dropped',
+          FAKE_PASS: 'kept'
+        }
+      });
+      const views: INpmCall[] = readNpmCalls().filter((call) => call.args[0] === 'view');
+      expect(views).toHaveLength(3);
+      for (const call of views) {
+        expect(call.env).toEqual({ _RUSH_RECURSIVE_RUSHX_CALL: '1', FAKE_PASS: 'kept' });
+      }
+    }, 60000);
+
+    it.each<[string, (verdict: IVerdictJson) => IVerdictJson | string]>([
+      ['has expired', (verdict) => ({ ...verdict, expiresAt: new Date(Date.now() - 1000).toISOString() })],
+      [
+        'was reached at a later clock time',
+        (verdict) => ({
+          ...verdict,
+          checkedAt: new Date(Date.now() + hourMs).toISOString(),
+          expiresAt: new Date(Date.now() + 2 * hourMs).toISOString()
+        })
+      ],
+      ['belongs to another client', (verdict) => ({ ...verdict, client: `${verdict.client}-other` })],
+      ['belongs to another engine', (verdict) => ({ ...verdict, rushVersion: '5.179.0' })],
+      ['has another schema', (verdict) => ({ ...verdict, schemaVersion: verdict.schemaVersion + 1 })],
+      ['is not JSON', () => '{'],
+      ['gives no reason', (verdict) => JSON.stringify({ ...verdict, reason: undefined })],
+      [
+        'records a malformed attestation',
+        (verdict) => ({
+          ...verdict,
+          incompatibleInstallations: verdict.incompatibleInstallations.map((record) => ({
+            ...record,
+            installation: {}
+          }))
+        })
+      ],
+      [
+        'records a launcher that would serve this client',
+        (verdict) => ({
+          ...verdict,
+          incompatibleInstallations: verdict.incompatibleInstallations.map((record) => ({
+            ...record,
+            installation: {
+              ...(record.installation as IInstalledDaemonLauncher),
+              protocolVersion: DAEMON_PROTOCOL_VERSION,
+              canLaunchRequests: true
+            }
+          }))
+        })
+      ]
+    ])(
+      'checks again when the verdict %s',
+      async (name, change) => {
+        const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+        const changed: IVerdictJson | string = change(readVerdict());
+        fs.writeFileSync(verdictPath, typeof changed === 'string' ? changed : JSON.stringify(changed));
+        const probes: number = countProbes();
+
+        expect((await selectFailureAsync()).message).toBe(first.message);
+        expect(describeNpmCalls(readNpmCalls().slice(4))).toEqual([
+          'view @rushstack/rush-daemon versions',
+          'view @rushstack/rush-daemon@0.5.0',
+          'view @rushstack/rush-daemon@0.4.1'
+        ]);
+        expect(countProbes()).toBe(probes + 2);
+        const rewritten: IVerdictJson = readVerdict();
+        expect(Date.parse(rewritten.expiresAt) - Date.parse(rewritten.checkedAt)).toBe(dayMs);
+        expect(Date.parse(rewritten.checkedAt)).toBeLessThanOrEqual(Date.now());
+      },
+      60000
+    );
+
+    it.each<[string, () => void, number]>([
+      [
+        'an installation is reinstalled',
+        () => {
+          const marker: string = path.join(cacheFolder, 'daemon-0.4.1', 'last-install.flag');
+          const content: string = fs.readFileSync(marker, 'utf8');
+          fs.rmSync(marker);
+          fs.writeFileSync(marker, content);
+          fs.utimesSync(marker, new Date(2000, 0, 1), new Date(2000, 0, 1));
+        },
+        2
+      ],
+      ['another installation pins the engine', () => writeCachedDaemon('0.4.0', oldProtocol, false), 2],
+      [
+        'an installation is removed',
+        () => fs.rmSync(path.join(cacheFolder, 'daemon-0.4.1'), { recursive: true }),
+        1
+      ]
+    ])(
+      'checks again when %s',
+      async (name, change, newProbes) => {
+        const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+        change();
+        const probes: number = countProbes();
+        expect((await selectFailureAsync()).message).toBe(first.message);
+        // A changed installation is attested again rather than trusted from the verdict.
+        expect(countProbes()).toBe(probes + newProbes);
+        expect(describeNpmCalls(readNpmCalls().slice(4)).slice(0, 3)).toEqual([
+          'view @rushstack/rush-daemon versions',
+          'view @rushstack/rush-daemon@0.5.0',
+          'view @rushstack/rush-daemon@0.4.1'
+        ]);
+        const callsAfterRecheck: number = readNpmCalls().length;
+        expect((await selectFailureAsync()).message).toBe(first.message);
+        expect(readNpmCalls()).toHaveLength(callsAfterRecheck);
+      },
+      60000
+    );
+
+    it('still launches a usable installation that appears while a verdict stands', async () => {
+      await selectFailureAsync();
+      writeCachedDaemon('0.6.0', DAEMON_PROTOCOL_VERSION, true);
+      const selected = await selectDaemonLauncherAsync(requested);
+      expect(selected).toMatchObject({ daemonVersion: '0.6.0', rushVersion: requestedVersion });
+      expect(readNpmCalls()).toHaveLength(4);
+    }, 60000);
+
+    it('selects among cached installations as before when it may not install', async () => {
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      const probes: number = countProbes();
+      const cachedOnly: DaemonLauncherUnavailableError = await selectFailureAsync({ allowInstall: false });
+      expect(cachedOnly.message).toBe(first.message);
+      expect(cachedOnly.installation).toEqual(first.installation);
+      expect(countProbes()).toBe(probes + 1);
+
+      fs.rmSync(cacheFolder, { recursive: true });
+      expect((await selectFailureAsync({ allowInstall: false })).message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: No matching installed daemon launcher is available. Use native Rush instead.`
+      );
+      expect(fs.existsSync(verdictPath)).toBe(false);
+      expect(readNpmCalls()).toHaveLength(4);
+    }, 60000);
+
+    it('gives the cached outcome, not a verdict, when it may not install', async () => {
+      await selectFailureAsync();
+      fs.rmSync(verdictPath);
+      setRegistryMode('fail');
+      const failed: DaemonLauncherUnavailableError = await selectFailureAsync();
+      const verdict: IVerdictJson = readVerdict();
+      expect(verdict.reason).toBe(failed.reason);
+      expect(verdict.incompatibleInstallations.map((record) => record.folderName)).toEqual(['daemon-0.4.1']);
+      const probes: number = countProbes();
+
+      const cachedOnly: DaemonLauncherUnavailableError = await selectFailureAsync({ allowInstall: false });
+      expect(cachedOnly.message).toBe(expectedRefusal('0.4.1'));
+      expect(countProbes()).toBe(probes + 1);
+      expect(readNpmCalls()).toHaveLength(5);
+      expect(readVerdict()).toEqual(verdict);
+    }, 60000);
+  });
+
   it.each(['latest', '../escape', '^5.178.1'])('rejects non-exact Rush specifier %s', async (rushVersion) => {
-    await expect(selectDaemonLauncherAsync({ ...context, rushVersion })).rejects.toThrow('exact');
+    await expect(
+      hideResolvedValueAsync(selectDaemonLauncherAsync({ ...context, rushVersion }))
+    ).rejects.toThrow('exact');
   });
 });
diff --git a/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts b/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts
index df8609b0b68..41bdd6792a0 100644
--- a/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts
@@ -6,13 +6,14 @@ import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { PhasedCommandEngine, type IPhasedCommandEngine, type RushConfiguration } from '@microsoft/rush-lib';
-import type { IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPingPayload, IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
 import { NoOpTerminalProvider } from '@rushstack/terminal';
 
 import { WorkspaceWarmSet, type WorkspaceWarmSetConfiguration } from '../WorkspaceWarmSet';
 import { WorkspaceSession, type IWorkspaceSessionOptions } from '../WorkspaceSession';
 import { WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
 import type { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
 
 export const GENERATION_POLICY: WorkspaceWarmSetConfiguration = {
   watch: true,
@@ -42,15 +43,23 @@ export function getWarmSet(fixture: DaemonGraphTestFixture): WorkspaceWarmSet {
 export async function pongAsync(fixture: DaemonGraphTestFixture): Promise<IDaemonPongMessage['payload']> {
   const client = await fixture.connectAsync();
   try {
-    await client.sendControlAsync({ kind: 'ping', payload: {} });
-    const message = await client.readControlAsync();
-    if (message.kind !== 'pong') throw new Error('Expected a real daemon pong.');
-    return message.payload;
+    return await pingAsync(client);
   } finally {
     await client.closeAsync();
   }
 }
 
+/** Pings on a connection that has finished its handshake. The handshake sends its own ping, with no payload. */
+export async function pingAsync(
+  client: DaemonRequestWireClient,
+  payload: IDaemonPingPayload = {}
+): Promise<IDaemonPongMessage['payload']> {
+  await client.sendControlAsync({ kind: 'ping', payload });
+  const message = await client.readControlAsync();
+  if (message.kind !== 'pong') throw new Error('Expected a real daemon pong.');
+  return message.payload;
+}
+
 export async function createNativeEngineAsync(
   configuration: RushConfiguration
 ): Promise<IPhasedCommandEngine> {
diff --git a/libraries/rush-daemon/src/test/WindowsSubprocessConsoles.test.ts b/libraries/rush-daemon/src/test/WindowsSubprocessConsoles.test.ts
new file mode 100644
index 00000000000..d79a6f62ddb
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WindowsSubprocessConsoles.test.ts
@@ -0,0 +1,133 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import { promisify } from 'node:util';
+
+import { installWindowsHideDefault, withWindowsHideDefault } from '../WindowsSubprocessConsoles';
+
+describe('Windows subprocess console defaults', () => {
+  const callback = (): void => {};
+
+  it('adds windowsHide to every child_process call shape unless the caller chose a value', () => {
+    expect(withWindowsHideDefault(['git'], 1)).toEqual(['git', { windowsHide: true }]);
+    expect(withWindowsHideDefault(['git', ['status']], 2)).toEqual([
+      'git',
+      ['status'],
+      { windowsHide: true }
+    ]);
+    expect(withWindowsHideDefault(['git', ['status'], { cwd: '/repo' }], 2)).toEqual([
+      'git',
+      ['status'],
+      { cwd: '/repo', windowsHide: true }
+    ]);
+    expect(withWindowsHideDefault(['git', { stdio: 'pipe' }], 1)).toEqual([
+      'git',
+      { stdio: 'pipe', windowsHide: true }
+    ]);
+    expect(withWindowsHideDefault(['git', callback], 1)).toEqual(['git', { windowsHide: true }, callback]);
+    expect(withWindowsHideDefault(['git', ['status'], callback], 2)).toEqual([
+      'git',
+      ['status'],
+      { windowsHide: true },
+      callback
+    ]);
+    expect(withWindowsHideDefault(['git', ['status'], { windowsHide: false }], 2)).toEqual([
+      'git',
+      ['status'],
+      { windowsHide: false }
+    ]);
+    expect(withWindowsHideDefault(['git', ['status'], { windowsHide: undefined }], 2)).toEqual([
+      'git',
+      ['status'],
+      { windowsHide: true }
+    ]);
+  });
+
+  it('does not modify the caller options object', () => {
+    const options: childProcess.SpawnOptions = { cwd: '/repo' };
+    withWindowsHideDefault(['git', [], options], 2);
+    expect(options).toEqual({ cwd: '/repo' });
+  });
+
+  it('wraps each child_process function once, preserving results and argument positions', () => {
+    const calls: Array<[string, unknown[]]> = [];
+    const record =
+      (name: string): ((...args: unknown[]) => string) =>
+      (...args: unknown[]): string => {
+        calls.push([name, args]);
+        return name;
+      };
+    const target: Record<string, unknown> = {
+      spawn: record('spawn'),
+      spawnSync: record('spawnSync'),
+      execFile: record('execFile'),
+      execFileSync: record('execFileSync'),
+      fork: record('fork'),
+      exec: record('exec'),
+      execSync: record('execSync'),
+      unrelated: record('unrelated')
+    };
+    const unrelated: unknown = target.unrelated;
+    installWindowsHideDefault(target);
+    const spawn: unknown = target.spawn;
+    installWindowsHideDefault(target);
+    expect(target.spawn).toBe(spawn);
+    expect(target.unrelated).toBe(unrelated);
+
+    const call = (name: string, ...args: unknown[]): unknown =>
+      (target[name] as (...callArgs: unknown[]) => unknown)(...args);
+    expect(call('spawn', 'git', ['status'])).toBe('spawn');
+    call('spawnSync', 'git', { encoding: 'utf8' });
+    call('execFile', 'git', ['status'], callback);
+    call('execFileSync', 'git', ['status'], { windowsHide: false });
+    call('fork', './worker.js', ['--flag']);
+    call('exec', 'git status', callback);
+    call('execSync', 'git status');
+    call('unrelated', 'git');
+    expect(calls).toEqual([
+      ['spawn', ['git', ['status'], { windowsHide: true }]],
+      ['spawnSync', ['git', { encoding: 'utf8', windowsHide: true }]],
+      ['execFile', ['git', ['status'], { windowsHide: true }, callback]],
+      ['execFileSync', ['git', ['status'], { windowsHide: false }]],
+      ['fork', ['./worker.js', ['--flag'], { windowsHide: true }]],
+      ['exec', ['git status', { windowsHide: true }, callback]],
+      ['execSync', ['git status', { windowsHide: true }]],
+      ['unrelated', ['git']]
+    ]);
+  });
+
+  it('still runs real child processes through the wrapped functions', () => {
+    // A copy, so that this test does not change the child_process module shared with other tests.
+    const target: Record<string, unknown> = { ...childProcess };
+    installWindowsHideDefault(target);
+    const spawnSync: typeof childProcess.spawnSync = target.spawnSync as typeof childProcess.spawnSync;
+    const result: childProcess.SpawnSyncReturns<string> = spawnSync(
+      process.execPath,
+      ['-e', 'process.stdout.write("ok")'],
+      { encoding: 'utf8' }
+    );
+    expect(result.status).toBe(0);
+    expect(result.stdout).toBe('ok');
+  });
+
+  it('keeps promisified exec and execFile results shaped like Node results', async () => {
+    const target: Record<string, unknown> = { ...childProcess };
+    installWindowsHideDefault(target);
+    const exec: typeof childProcess.exec = target.exec as typeof childProcess.exec;
+    const execFile: typeof childProcess.execFile = target.execFile as typeof childProcess.execFile;
+
+    await expect(
+      promisify(exec)(`"${process.execPath}" -e "process.stdout.write('exec-out')"`)
+    ).resolves.toMatchObject({
+      stdout: 'exec-out',
+      stderr: ''
+    });
+    await expect(
+      promisify(execFile)(process.execPath, ['-e', "process.stdout.write('file-out')"])
+    ).resolves.toMatchObject({
+      stdout: 'file-out',
+      stderr: ''
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
new file mode 100644
index 00000000000..0173877b420
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -0,0 +1,726 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { OperationStatus, type IOperationGraph } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonInstallationChange,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage,
+  type IDaemonRequestRejectedMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
+import type { IOutputFolderSet } from '../OutputFolderDigest';
+import * as outputFolderDigestPool from '../OutputFolderDigestPool';
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import { RequestScheduler } from '../RequestScheduler';
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+/** What the daemon's check of its own installation reports; each test that sets it clears it again. */
+let installationChange: IDaemonInstallationChange | undefined;
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+
+interface IEarlyFailureFixtureOptions {
+  readonly holdsFailure?: boolean;
+  readonly restartable?: boolean;
+  readonly writesOutputs?: boolean;
+}
+
+/**
+ * b consumes a and c. a fails, and c holds its build open until the test removes the `hold` marker, so a build of b
+ * that returns early on failure leaves c running. With `writesOutputs`, c declares its git-ignored `lib` folder as
+ * output, and writes one file there when it starts and another when the test removes the marker. With
+ * `holdsFailure`, a fails only when the test removes the `hold-a` marker, so the build returns early only then.
+ */
+function createEarlyFailureFixtureAsync({
+  holdsFailure = false,
+  restartable = false,
+  writesOutputs = false
+}: IEarlyFailureFixtureOptions = {}): Promise<DaemonGraphTestFixture> {
+  const startOutputs: string = writesOutputs
+    ? "fs.mkdirSync('lib',{recursive:true});fs.writeFileSync('lib/started.js','');"
+    : '';
+  const finishOutputs: string = writesOutputs ? "fs.writeFileSync('lib/finished.js','');" : '';
+  const failA: string = "console.error('failed-a');process.exitCode=1;";
+  return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
+    if (restartable) {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    }
+    if (writesOutputs) {
+      fs.appendFileSync(path.join(created.folder, '.gitignore'), '**/lib/\n');
+      created.write(
+        'c/config/rush-project.json',
+        JSON.stringify({
+          operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+        })
+      );
+    }
+    created.write('hold', '');
+    if (holdsFailure) created.write('hold-a', '');
+    created.checkInstallation = () => installationChange;
+    created.write(
+      'b/package.json',
+      JSON.stringify({
+        name: 'b',
+        version: '1.0.0',
+        dependencies: { a: '1.0.0', c: '1.0.0' },
+        scripts: { '_phase:compile': 'node build.cjs' }
+      })
+    );
+    created.write(
+      'a/build.cjs',
+      holdsFailure
+        ? withScriptDeadline(
+            "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+              `const t=setInterval(()=>{if(!fs.existsSync('../hold-a')){clearInterval(t);${failA}}},20);`
+          )
+        : `require('node:fs').appendFileSync('../runs.txt','a\\n');${failA}`
+    );
+    created.write(
+      'c/build.cjs',
+      withScriptDeadline(
+        "const fs=require('node:fs');" +
+          startOutputs +
+          "fs.appendFileSync('../runs.txt','c\\n');" +
+          `const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);${finishOutputs}` +
+          "console.log('finished-c');}},20);"
+      )
+    );
+  });
+}
+
+function countRuns(fixture: DaemonGraphTestFixture, name: string): number {
+  return fixture.runs().filter((run: string) => run === name).length;
+}
+
+async function waitUntilAsync(condition: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!condition() && Date.now() < deadline) await delayAsync(20);
+}
+
+async function waitForRunsAsync(fixture: DaemonGraphTestFixture, name: string, count: number): Promise<void> {
+  await waitUntilAsync(() => countRuns(fixture, name) >= count);
+}
+
+/** Counts the stops that the daemon requested; every iteration's start also aborts, without options. */
+function countTerminatingAborts(abortSpy: jest.SpyInstance): number {
+  return abortSpy.mock.calls.filter(
+    ([options]: ReadonlyArray<{ terminateRunning?: boolean } | undefined>) =>
+      options?.terminateRunning === true
+  ).length;
+}
+
+/** Whether an in-process Rush command could take the Rush lock that the daemon holds while it executes. */
+function isNativeLockFree(fixture: DaemonGraphTestFixture): boolean {
+  const probe: LockFile | undefined = LockFile.tryAcquire(
+    fixture.session.rushConfiguration.commonTempFolder,
+    'rush'
+  );
+  probe?.release();
+  return probe !== undefined;
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await delayAsync(0);
+  return settled;
+}
+
+function queuePositions(
+  frames: ReadonlyArray<IDaemonFrame>
+): IDaemonRequestQueuePositionMessage['payload'][] {
+  return frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .filter((message: DaemonControlMessage) => message.kind === 'queuePosition')
+    .map((message: DaemonControlMessage) => (message as IDaemonRequestQueuePositionMessage).payload);
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<IDaemonFrame[]> {
+  const frames: IDaemonFrame[] = [];
+  while (queuePositions(frames).length === 0) frames.push(await client.readFrameAsync());
+  return frames;
+}
+
+async function returnEarlyAsync(fixture: DaemonGraphTestFixture): Promise<void> {
+  const early: ITerminalExchange = await fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
+  expect(early.terminal).toMatchObject({
+    kind: 'requestResult',
+    payload: { exitCode: 1, outcome: 'failure' }
+  });
+  // The client disconnected with its result, while c still runs.
+  await waitForRunsAsync(fixture, 'c', 1);
+  expect(countRuns(fixture, 'c')).toBe(1);
+  expect(countRuns(fixture, 'b')).toBe(0);
+}
+
+/**
+ * The daemon rejects this command before admission, as rush-client sends it: rush-client marks only build, rebuild,
+ * install and update as built-in commands, and the daemon finds a built-in command that is not phased by its name.
+ * Unlike `list`, it does not only read the workspace.
+ */
+const NOT_PHASED: string[] = ['install-autoinstaller', '--name', 'tools'];
+
+/** What a request that stops the held c is told while it waits; see `returnEarlyAsync`. */
+const STOPPING_C: object = { count: 1, names: ['c (compile)'], stopping: true };
+
+/** Changes project c's configuration, so that the next build reloads the graph. */
+function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
+  const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+  const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+}
+
+/** The line that the daemon adds to a rejection after it stopped the held c; see `returnEarlyAsync`. */
+const STOPPED_C: string =
+  'rushd stopped 1 operation left running by an earlier failed command (c (compile)), so that this command can ' +
+  'run in-process.';
+
+/** The message of the `unsupported` rejection that ends `exchange`. */
+function getUnsupportedMessage(exchange: ITerminalExchange | undefined): string {
+  expect(exchange?.terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+  return (exchange?.terminal as IDaemonRequestRejectedMessage).payload.message;
+}
+
+/**
+ * After a failed build returned early, sends `argv`, which the daemon rejects so that the client runs it in-process,
+ * and checks that the daemon stopped the work that continues before it sent the rejection, which says so.
+ */
+async function expectStopBeforeRejectionAsync(argv: string[]): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+  const hold: string = path.join(fixture.folder, 'hold');
+  try {
+    await returnEarlyAsync(fixture);
+
+    const message: string = getUnsupportedMessage(await fixture.runAsync(argv, { commandOrigin: 'custom' }));
+    // The held c was stopped before the rejection was sent, and the in-process command can take the Rush lock.
+    expect(fs.existsSync(hold)).toBe(true);
+    expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
+    expect(isNativeLockFree(fixture)).toBe(true);
+
+    // So a later build runs c again at once, instead of waiting for the held c.
+    const later: Promise<ITerminalExchange> = fixture.runAsync(['build', '--to', 'c', '--parallelism', '3']);
+    await waitForRunsAsync(fixture, 'c', 2);
+    expect(countRuns(fixture, 'c')).toBe(2);
+    fs.rmSync(hold);
+    expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+
+    // The rejection names the stopped c after its first line. Once nothing continues, the same command's rejection
+    // doesn't.
+    const [reason, ...details] = getUnsupportedMessage(
+      await fixture.runAsync(argv, { commandOrigin: 'custom' })
+    ).split('\n');
+    expect(message).toBe([reason, STOPPED_C, ...details].join('\n'));
+  } finally {
+    fs.rmSync(hold, { force: true });
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+/**
+ * After a failed build returned early, and while a later build waits for the work that continues, sends `argv`,
+ * which the daemon rejects so that the client would run it in-process. `changeInstallationWhenChecked` changes the
+ * installation while the daemon checks the command. Checks that the daemon answers with the restart instead, and
+ * leaves the work that continues running.
+ */
+async function expectRestartForRejectedCommandAsync(
+  argv: string[],
+  changeInstallationWhenChecked: (custom: IDaemonRequestEnvelope, change: IDaemonInstallationChange) => void
+): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+  const hold: string = path.join(fixture.folder, 'hold');
+  let later: DaemonRequestWireClient | undefined;
+  let rejected: DaemonRequestWireClient | undefined;
+  try {
+    await returnEarlyAsync(fixture);
+    // A later build waits for the held c, so the daemon serves it until that c finishes.
+    later = await fixture.connectAsync();
+    const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c', '--parallelism', '3']);
+    await later.sendControlAsync({ kind: 'requestStart', payload: build });
+    await readUntilQueuedAsync(later);
+
+    // The installation changes while the daemon rejects a command that the client would run in-process.
+    const change: IDaemonInstallationChange = {
+      change: 'replaced',
+      folder: path.join(fixture.folder, 'daemon')
+    };
+    const custom: IDaemonRequestEnvelope = fixture.envelope(argv, { commandOrigin: 'custom' });
+    changeInstallationWhenChecked(custom, change);
+    rejected = await fixture.connectAsync();
+    await rejected.sendControlAsync({ kind: 'requestStart', payload: custom });
+
+    // So the client restarts the daemon instead of running the command in-process, and the restart waits for
+    // the later build, which still waits for the held c.
+    const restartReason: object = { kind: 'installationChanged', ...change };
+    expect(queuePositions(await readUntilQueuedAsync(rejected))).toEqual([
+      expect.objectContaining({ position: 1, restartReason })
+    ]);
+    expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+    expect(countRuns(fixture, 'c')).toBe(1);
+
+    fs.rmSync(hold);
+    expect((await later.readTerminalAsync(build.requestId)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    expect((await rejected.readTerminalAsync(custom.requestId)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, retryAfterRestart: true, restartReason }
+    });
+    // The held c finished, and the later build found it done.
+    expect(countRuns(fixture, 'c')).toBe(1);
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+  } finally {
+    installationChange = undefined;
+    jest.restoreAllMocks();
+    fs.rmSync(hold, { force: true });
+    await later?.closeAsync();
+    await rejected?.closeAsync();
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+describe('a failed build that returns early', () => {
+  it('lets a rebuild stop the work that continues instead of waiting for it', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const rebuild: Promise<ITerminalExchange> = fixture.runAsync([
+        'rebuild',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      // The rebuild runs c again while the first c is still held, so it did not wait for that c to finish.
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      expect(fs.existsSync(hold)).toBe(true);
+
+      fs.rmSync(hold);
+      const { frames, terminal } = await rebuild;
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      // It was told that the daemon stopped the held c for it.
+      expect(queuePositions(frames)).toEqual([
+        expect.objectContaining({ position: 1, continuingOperations: STOPPING_C })
+      ]);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a build that reloads the graph stop the work that continues, and says so', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+      const generation: number = fixture.host.workspaceGeneration;
+
+      changeProjectConfiguration(fixture);
+      const reload: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      // The reloaded graph runs c again while the first c is still held, so the reload did not wait for that c.
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      expect(fs.existsSync(hold)).toBe(true);
+
+      fs.rmSync(hold);
+      const { frames, terminal } = await reload;
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      expect(queuePositions(frames)).toEqual([
+        expect.objectContaining({ position: 1, continuingOperations: STOPPING_C })
+      ]);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('names the work that continues as stopping to a build that reloads the graph and already waited when the failed build returned early', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ holdsFailure: true });
+    const hold: string = path.join(fixture.folder, 'hold');
+    const holdA: string = path.join(fixture.folder, 'hold-a');
+    let reload: DaemonRequestWireClient | undefined;
+    try {
+      const early: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
+      // a fails only when the test says so, so the build can't return early yet.
+      await waitForRunsAsync(fixture, 'a', 1);
+      await waitForRunsAsync(fixture, 'c', 1);
+      const generation: number = fixture.host.workspaceGeneration;
+
+      // So the reload waits for the build, and nothing is stopping yet.
+      changeProjectConfiguration(fixture);
+      reload = await fixture.connectAsync();
+      const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c', '--parallelism', '3']);
+      await reload.sendControlAsync({ kind: 'requestStart', payload: build });
+      const queued: IDaemonFrame[] = await readUntilQueuedAsync(reload);
+      expect(queuePositions(queued)).toEqual([{ position: 1, requestId: build.requestId }]);
+
+      fs.rmSync(holdA);
+      expect((await early).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure' }
+      });
+      // The reloaded graph runs c again while the first c is still held, so the reload did not wait for that c.
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      expect(fs.existsSync(hold)).toBe(true);
+
+      fs.rmSync(hold);
+      const { frames, terminal } = await reload.readTerminalAsync(build.requestId);
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      // It was told again once the build returned early, before the daemon stopped the held c for it.
+      expect(queuePositions([...queued, ...frames])).toEqual([
+        { position: 1, requestId: build.requestId },
+        { position: 1, requestId: build.requestId, continuingOperations: STOPPING_C }
+      ]);
+    } finally {
+      fs.rmSync(holdA, { force: true });
+      fs.rmSync(hold, { force: true });
+      await reload?.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a later build wait for the work that continues and find it done', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      await delayAsync(1000);
+      expect(await isSettledAsync(later)).toBe(false);
+      expect(countRuns(fixture, 'c')).toBe(1);
+
+      fs.rmSync(hold);
+      const { frames, terminal } = await later;
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(countRuns(fixture, 'c')).toBe(1);
+      // It was told that it waited for the held c, which the daemon did not stop.
+      expect(queuePositions(frames)).toEqual([
+        expect.objectContaining({ position: 1, continuingOperations: { count: 1, names: ['c (compile)'] } })
+      ]);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('walks the outputs of the work that continues only after that work ended, for a later build', async () => {
+    const digester: outputFolderDigestPool.OutputFolderDigester =
+      new outputFolderDigestPool.OutputFolderDigester({
+        threadCount: 2,
+        poolStartThresholdMs: -1
+      });
+    const sharedDigesterSpy: jest.SpyInstance = jest
+      .spyOn(outputFolderDigestPool, 'getSharedOutputFolderDigester')
+      .mockReturnValue(digester);
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ writesOutputs: true });
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      // Start the pool, so that each reconciliation walks the output folders on its workers.
+      digester.digest(
+        ['a', 'b'].map((name: string) => ({ projectFolder: fixture.folder, folderNames: [name] }))
+      );
+      expect(digester.isParallel).toBe(true);
+      const startSpy: jest.SpyInstance = jest.spyOn(digester, 'start');
+      fs.rmSync(hold);
+      expect((await fixture.runAsync(['build', '--to', 'c'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+
+      // An edit inside c's outputs makes the next build run c again, and c then holds its build open.
+      fixture.write('hold', '');
+      fixture.write('c/lib/started.js', 'edited');
+      const early: ITerminalExchange = await fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
+      expect(early.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure' }
+      });
+      await waitForRunsAsync(fixture, 'c', 2);
+      const { projectFolder } = fixture.session.rushConfiguration.getProjectByName('c')!;
+      const walkOfC: IOutputFolderSet[][] = [[{ projectFolder, folderNames: ['lib'] }]];
+      expect(startSpy.mock.calls).toEqual([walkOfC]);
+
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      await delayAsync(1000);
+      expect(await isSettledAsync(later)).toBe(false);
+      // The last iteration walked c's outputs, but nothing walks them again while c still writes them.
+      expect(startSpy.mock.calls).toEqual([walkOfC]);
+
+      fs.rmSync(hold);
+      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(startSpy.mock.calls).toEqual([walkOfC, walkOfC]);
+      // That walk found the outputs that c finished, so c did not run again.
+      expect(countRuns(fixture, 'c')).toBe(2);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+      sharedDigesterSpy.mockRestore();
+      digester.dispose();
+    }
+  });
+
+  it('stops the work that continues before it rejects a command that the client then runs in-process', async () => {
+    // The fixture's `test` is not a phased command, so the daemon rejects it at its parse, after admission.
+    await expectStopBeforeRejectionAsync(['test', '--to', 'c']);
+  });
+
+  it('stops the work that continues before it rejects a built-in command that is not phased, before admission', async () => {
+    await expectStopBeforeRejectionAsync(NOT_PHASED);
+  });
+
+  it('does not say that it stopped work that continues if it could not stop that work', async () => {
+    // As before the failed build's result drained: until then, nothing can preempt the build's lease.
+    jest.spyOn(RequestScheduler.prototype, 'markLeasePreemptible').mockImplementation(() => undefined);
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const custom: ITerminalExchange = await fixture.runAsync(['test', '--to', 'c'], {
+        commandOrigin: 'custom'
+      });
+      expect(getUnsupportedMessage(custom)).not.toContain('rushd stopped');
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(countRuns(fixture, 'c')).toBe(1);
+    } finally {
+      jest.restoreAllMocks();
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('answers a client that cancels while the work that continues is stopping, without waiting for it to stop', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let releaseStop: (() => void) | undefined;
+    try {
+      await returnEarlyAsync(fixture);
+      const graph: IOperationGraph = fixture.session.operationGraph!;
+      const abortCurrentIterationAsync: IOperationGraph['abortCurrentIterationAsync'] =
+        graph.abortCurrentIterationAsync.bind(graph);
+      // Stopping c takes until the test releases it.
+      const abortSpy: jest.SpyInstance = jest
+        .spyOn(graph, 'abortCurrentIterationAsync')
+        .mockImplementationOnce(
+          async (...args: Parameters<IOperationGraph['abortCurrentIterationAsync']>) => {
+            await new Promise<void>((resolve: () => void) => {
+              releaseStop = resolve;
+            });
+            return await abortCurrentIterationAsync(...args);
+          }
+        );
+      const client: DaemonRequestWireClient = await fixture.connectAsync();
+      try {
+        const custom: IDaemonRequestEnvelope = fixture.envelope(['test', '--to', 'c'], {
+          commandOrigin: 'custom'
+        });
+        await client.sendControlAsync({ kind: 'requestStart', payload: custom });
+        // Before it rejects `test`, the daemon stops c.
+        await waitUntilAsync(() => countTerminatingAborts(abortSpy) > 0);
+        expect(countTerminatingAborts(abortSpy)).toBe(1);
+        const answer: Promise<ITerminalExchange> = client.readTerminalAsync(custom.requestId);
+        expect(await Promise.race([answer, delayAsync(500).then(() => undefined)])).toBeUndefined();
+
+        // rush-client cancels on Ctrl+C, and gives up on the daemon if it does not answer within 5 seconds.
+        await client.sendControlAsync({ kind: 'requestCancel', payload: { requestId: custom.requestId } });
+        const cancelled: ITerminalExchange | undefined = await Promise.race([
+          answer,
+          delayAsync(3_000).then(() => undefined)
+        ]);
+        // c was not stopped yet when the client left, so the rejection doesn't say that it was.
+        expect(getUnsupportedMessage(cancelled)).not.toContain('rushd stopped');
+        // c is still stopping, so the client must not run `test` in-process now; rush-client reports a command
+        // that it cancelled as cancelled instead.
+        expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+        expect(isNativeLockFree(fixture)).toBe(false);
+      } finally {
+        await client.closeAsync();
+      }
+    } finally {
+      releaseStop?.();
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('leaves the work that continues running for a read-only command or a rushx script that it rejects', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      // As rush-client sends them: it marks every command that the daemon does not serve as a custom command.
+      const requests: [string[], Partial<IDaemonRequestEnvelope>][] = [
+        [['list'], { commandOrigin: 'custom' }],
+        [['start'], { commandOrigin: 'custom', invocationKind: 'rushx' }]
+      ];
+      for (const [argv, overrides] of requests) {
+        expect(getUnsupportedMessage(await fixture.runAsync(argv, overrides))).not.toContain('rushd stopped');
+      }
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(isNativeLockFree(fixture)).toBe(false);
+      expect(countRuns(fixture, 'c')).toBe(1);
+
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      fs.rmSync(hold);
+      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(countRuns(fixture, 'c')).toBe(1);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a restart for another environment proceed without waiting for the work that continues', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ restartable: true });
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      const before = await pongAsync(fixture);
+      await returnEarlyAsync(fixture);
+
+      const mismatched: Promise<ITerminalExchange> = fixture.runAsync(
+        ['build', '--to', 'c', '--parallelism', '3'],
+        {
+          environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+        }
+      );
+      const restart: ITerminalExchange | undefined = await Promise.race([
+        mismatched,
+        delayAsync(20_000).then(() => undefined)
+      ]);
+      expect(fs.existsSync(hold)).toBe(true);
+      expect(restart?.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      try {
+        await fixture.host.closeAsync();
+        await fixture.host.restartCompleted;
+      } finally {
+        await stopSuccessorAsync(fixture.host.paths);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  });
+
+  it('stops the work that continues before it answers with the restart for a changed installation', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+      const change: IDaemonInstallationChange = {
+        change: 'replaced',
+        folder: path.join(fixture.folder, 'daemon')
+      };
+      installationChange = change;
+
+      const { frames, terminal } = await fixture.runAsync(['build', '--to', 'c', '--parallelism', '3']);
+      const restartReason: object = { kind: 'installationChanged', ...change };
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true, restartReason }
+      });
+      // It waited only while the held c stopped, and it said why it waited.
+      expect(queuePositions(frames)).toEqual([expect.objectContaining({ position: 1, restartReason })]);
+      expect(fs.existsSync(hold)).toBe(true);
+      expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
+      expect(isNativeLockFree(fixture)).toBe(true);
+      await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    } finally {
+      installationChange = undefined;
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('answers a command that it rejects with the restart once the installation changed, and leaves the work that continues running', async () => {
+    // The daemon parses a custom command before it resolves the request, and rejects this one there.
+    await expectRestartForRejectedCommandAsync(['test', '--to', 'c'], (custom, change) => {
+      const getIdentityAsync: ProductionDaemonRequestResolver['getCommandParameterIdentityAsync'] =
+        ProductionDaemonRequestResolver.prototype.getCommandParameterIdentityAsync;
+      jest
+        .spyOn(ProductionDaemonRequestResolver.prototype, 'getCommandParameterIdentityAsync')
+        .mockImplementation(async function (
+          this: ProductionDaemonRequestResolver,
+          options: IResolveDaemonRequestOptions
+        ) {
+          if (options.envelope.requestId === custom.requestId) installationChange = change;
+          return await getIdentityAsync.call(this, options);
+        });
+    });
+  });
+
+  it('answers a built-in command that it rejects before admission with the restart once the installation changed, and leaves the work that continues running', async () => {
+    // The daemon rejects it before admission, since it never serves the command.
+    await expectRestartForRejectedCommandAsync(NOT_PHASED, (custom, change) => {
+      const getUnsupportedCommandError: ProductionDaemonRequestResolver['getUnsupportedCommandError'] =
+        ProductionDaemonRequestResolver.prototype.getUnsupportedCommandError;
+      jest
+        .spyOn(ProductionDaemonRequestResolver.prototype, 'getUnsupportedCommandError')
+        .mockImplementation(function (
+          this: ProductionDaemonRequestResolver,
+          envelope: IDaemonRequestEnvelope
+        ) {
+          if (envelope.requestId === custom.requestId) installationChange = change;
+          return getUnsupportedCommandError.call(this, envelope);
+        });
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
index fe98bba0bd4..c8355957538 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
@@ -21,8 +21,10 @@ import type {
   IClassifyWorkspaceInvalidationsOptions,
   ICreateWorkspaceEngineComponentsOptions,
   IMapWorkspaceInvalidationsOptions,
+  IWorkspaceEngineComponentFactoryOptions,
   IWorkspaceEngineComponents,
-  IWorkspaceEngineShape
+  IWorkspaceEngineShape,
+  IWorkspaceInvalidationPeek
 } from '../WorkspaceEngineComponentFactory';
 import { WorkspaceSession } from '../WorkspaceSession';
 import type { IWorkspaceInvalidationWatcher, IWorkspaceSessionComponents } from '../WorkspaceSession';
@@ -190,6 +192,36 @@ async function disposeComponentsAsync(components: IWorkspaceSessionComponents):
   await components[Symbol.asyncDispose]();
 }
 
+interface IDeferred<T> {
+  readonly promise: Promise<T>;
+  resolve(value: T): void;
+  reject(error: Error): void;
+}
+
+function createDeferred<T>(): IDeferred<T> {
+  let resolveDeferred!: (value: T) => void;
+  let rejectDeferred!: (error: Error) => void;
+  const promise: Promise<T> = new Promise<T>((resolve, reject) => {
+    resolveDeferred = resolve;
+    rejectDeferred = reject;
+  });
+  return { promise, resolve: resolveDeferred, reject: rejectDeferred };
+}
+
+// Lets every pending callback run, including those of timers
+function waitForTurnsAsync(): Promise<void> {
+  return new Promise((resolve: () => void) => setTimeout(resolve, 10));
+}
+
+function trackSettlement(promise: Promise<unknown>): { readonly isSettled: boolean } {
+  const state: { isSettled: boolean } = { isSettled: false };
+  const onSettled = (): void => {
+    state.isSettled = true;
+  };
+  void promise.then(onSettled, onSettled);
+  return state;
+}
+
 describe(WorkspaceEngineComponentFactory.name, () => {
   it('initializes exactly once through WorkspaceSession and reconciles startup conservatively', async () => {
     const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
@@ -730,4 +762,455 @@ describe(WorkspaceEngineComponentFactory.name, () => {
       })
     ).rejects.toThrow('is not declared in the workspace engine shape');
   });
+
+  describe('validation of the graph inputs', () => {
+    const CHANGED_PATH: string = 'libraries/a/src/index.ts';
+
+    async function createComponentsAsync(
+      engine: ITestEngine,
+      invalidations: WorkspaceInvalidationTracker,
+      options: Partial<IWorkspaceEngineComponentFactoryOptions>
+    ): Promise<IWorkspaceSessionComponents> {
+      const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
+        createEngineComponentsAsync: async () => engine.components,
+        mapInvalidationsToOperationsAsync: async () => [],
+        refreshInputsOnEveryRequest: true,
+        shape: {
+          phaseNames: [PHASE_NAME],
+          pluginNames: [PLUGIN_NAME]
+        },
+        ...options
+      });
+      return await factory.createAsync({ invalidations, rushConfiguration: TEST_RUSH_CONFIGURATION });
+    }
+
+    it('runs while the inputs snapshot is taken, if the inputs are refreshed on every request', async () => {
+      const events: string[] = [];
+      const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
+      const snapshot: IDeferred<IInputsSnapshot> = createDeferred();
+      const validation: IDeferred<void> = createDeferred();
+      const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, () => {
+        events.push('snapshot');
+        return snapshot.promise;
+      });
+      const components: IWorkspaceSessionComponents = await createComponentsAsync(
+        engine,
+        new WorkspaceInvalidationTracker(),
+        {
+          validateGraphInputsAsync: () => {
+            events.push('validation');
+            return validation.promise;
+          }
+        }
+      );
+
+      const reconciliationPromise: Promise<unknown> = getReconcileAsync(components)();
+      await waitForTurnsAsync();
+      expect(events).toEqual(['snapshot', 'validation']);
+      validation.resolve();
+      snapshot.resolve(nextSnapshot);
+      await expect(reconciliationPromise).resolves.toMatchObject({
+        inputsSnapshot: nextSnapshot,
+        isFullInvalidation: false
+      });
+      // The inputs are not read again after the checks.
+      expect(events).toEqual(['snapshot', 'validation']);
+      expect(components.inputsSnapshot).toBe(nextSnapshot);
+      await disposeComponentsAsync(components);
+    });
+
+    it('runs before the inputs snapshot is taken, if the inputs are not refreshed on every request', async () => {
+      const events: string[] = [];
+      const validation: IDeferred<void> = createDeferred();
+      const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, async () => {
+        events.push('snapshot');
+        return createInputsSnapshot('next');
+      });
+      const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+      invalidations.invalidate(CHANGED_PATH);
+      const components: IWorkspaceSessionComponents = await createComponentsAsync(engine, invalidations, {
+        refreshInputsOnEveryRequest: false,
+        validateGraphInputsAsync: () => {
+          events.push('validation');
+          return validation.promise;
+        }
+      });
+
+      const reconciliationPromise: Promise<unknown> = getReconcileAsync(components)();
+      await waitForTurnsAsync();
+      expect(events).toEqual(['validation']);
+      validation.resolve();
+      await reconciliationPromise;
+      expect(events).toEqual(['validation', 'snapshot']);
+      await disposeComponentsAsync(components);
+    });
+
+    it.each<[string, Partial<IWorkspaceEngineComponentFactoryOptions>]>([
+      [
+        'the graph inputs changed',
+        {
+          validateGraphInputsAsync: async (): Promise<void> => {
+            throw new WorkspaceEngineRecreationRequiredError();
+          }
+        }
+      ],
+      [
+        'a change requires a new engine',
+        {
+          isEngineRecreationRequiredAsync: async (): Promise<boolean> => true,
+          validateGraphInputsAsync: async (): Promise<void> => undefined
+        }
+      ]
+    ])(
+      'waits for the inputs snapshot if %s, and keeps the invalidations',
+      async (description: string, options: Partial<IWorkspaceEngineComponentFactoryOptions>) => {
+        const snapshot: IDeferred<IInputsSnapshot> = createDeferred();
+        const engine: ITestEngine = createTestEngine(
+          TEST_RUSH_CONFIGURATION.projects,
+          () => snapshot.promise
+        );
+        const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+        invalidations.invalidate(CHANGED_PATH);
+        const components: IWorkspaceSessionComponents = await createComponentsAsync(
+          engine,
+          invalidations,
+          options
+        );
+
+        const reconciliationPromise: Promise<unknown> = getReconcileAsync(components)();
+        const reconciliation: { readonly isSettled: boolean } = trackSettlement(reconciliationPromise);
+        await waitForTurnsAsync();
+        expect(reconciliation.isSettled).toBe(false);
+        snapshot.reject(new Error('The inputs snapshot failed'));
+        await expect(reconciliationPromise).rejects.toBeInstanceOf(WorkspaceEngineRecreationRequiredError);
+        expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+        expect(invalidations.getSnapshot().changedPaths).toEqual([CHANGED_PATH]);
+        await disposeComponentsAsync(components);
+      }
+    );
+
+    it('handles an inputs snapshot that fails while it runs', async () => {
+      const onUnhandledRejection: jest.Mock = jest.fn();
+      process.on('unhandledRejection', onUnhandledRejection);
+      try {
+        const error: Error = new Error('The inputs snapshot failed');
+        const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, () =>
+          Promise.reject(error)
+        );
+        const components: IWorkspaceSessionComponents = await createComponentsAsync(
+          engine,
+          new WorkspaceInvalidationTracker(),
+          { validateGraphInputsAsync: waitForTurnsAsync }
+        );
+
+        await expect(getReconcileAsync(components)()).rejects.toBe(error);
+        expect(onUnhandledRejection).not.toHaveBeenCalled();
+        await disposeComponentsAsync(components);
+      } finally {
+        process.off('unhandledRejection', onUnhandledRejection);
+      }
+    });
+
+    it('acknowledges only the invalidations that precede the inputs snapshot', async () => {
+      const laterPath: string = 'libraries/b/src/index.ts';
+      const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+      invalidations.invalidate(CHANGED_PATH);
+      const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, async () => {
+        // Git may read the file before this change
+        invalidations.invalidate(laterPath);
+        return createInputsSnapshot('next');
+      });
+      const mapInvalidationsToOperationsAsync: jest.Mock = jest.fn(async () => []);
+      const components: IWorkspaceSessionComponents = await createComponentsAsync(engine, invalidations, {
+        mapInvalidationsToOperationsAsync,
+        validateGraphInputsAsync: async () => undefined
+      });
+
+      await getReconcileAsync(components)();
+      expect(mapInvalidationsToOperationsAsync).toHaveBeenCalledTimes(1);
+      expect(mapInvalidationsToOperationsAsync.mock.calls[0][0].changedPaths).toEqual([CHANGED_PATH]);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([laterPath]);
+      await disposeComponentsAsync(components);
+    });
+  });
+
+  describe('peeking at the invalidations for an executing iteration', () => {
+    const CHANGED_PATH: string = 'libraries/a/src/index.ts';
+    const ITERATION_RECORDS: ReadonlyMap<Operation, IOperationExecutionResult> = new Map();
+
+    interface IPeekFixture {
+      readonly components: IWorkspaceSessionComponents;
+      readonly engine: ITestEngine;
+      readonly invalidateSpy: jest.SpyInstance;
+      readonly invalidations: WorkspaceInvalidationTracker;
+      readonly mapInvalidationsToOperationsAsync: jest.Mock<
+        Promise<Iterable<Operation>>,
+        [IMapWorkspaceInvalidationsOptions]
+      >;
+      readonly nextSnapshot: IInputsSnapshot;
+      peekAsync(): Promise<IWorkspaceInvalidationPeek | undefined>;
+    }
+
+    async function createPeekFixtureAsync(
+      options: Partial<IWorkspaceEngineComponentFactoryOptions> = {}
+    ): Promise<IPeekFixture> {
+      const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
+      const engine: ITestEngine = createTestEngine(
+        TEST_RUSH_CONFIGURATION.projects,
+        async () => nextSnapshot
+      );
+      const mapInvalidationsToOperationsAsync: IPeekFixture['mapInvalidationsToOperationsAsync'] = jest.fn(
+        async (mapOptions: IMapWorkspaceInvalidationsOptions) => {
+          void mapOptions;
+          return [engine.operations[0], engine.operations[0]];
+        }
+      );
+      const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+      const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
+        createEngineComponentsAsync: async () => engine.components,
+        mapInvalidationsToOperationsAsync,
+        refreshInputsOnEveryRequest: true,
+        shape: {
+          phaseNames: [PHASE_NAME],
+          pluginNames: [PLUGIN_NAME]
+        },
+        ...options
+      });
+      const components: IWorkspaceSessionComponents = await factory.createAsync({
+        invalidations,
+        rushConfiguration: TEST_RUSH_CONFIGURATION
+      });
+      return {
+        components,
+        engine,
+        invalidateSpy: jest.spyOn(engine.graph, 'invalidateOperations'),
+        invalidations,
+        mapInvalidationsToOperationsAsync,
+        nextSnapshot,
+        peekAsync: () => components.peekInvalidationsAsync!({ executingIterationRecords: ITERATION_RECORDS })
+      };
+    }
+
+    it('maps the retained paths without applying them, and applies them when committed', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      invalidations.invalidate(CHANGED_PATH);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+
+      expect(peek?.inputsSnapshot).toBe(fixture.nextSnapshot);
+      expect(peek?.invalidatedOperations).toEqual(new Set([engine.operations[0]]));
+      expect(peek?.invalidationReason).toBe('workspace-inputs-changed');
+      expect(fixture.mapInvalidationsToOperationsAsync).toHaveBeenCalledTimes(1);
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[0][0]).toMatchObject({
+        changedPaths: [CHANGED_PATH],
+        currentInputsSnapshot: engine.components.inputsSnapshot,
+        executingIterationRecords: ITERATION_RECORDS,
+        nextInputsSnapshot: fixture.nextSnapshot
+      });
+      expect(invalidateSpy).not.toHaveBeenCalled();
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([CHANGED_PATH]);
+
+      // Later reconciliations wait for the peek
+      const reconciliation: Promise<unknown> = getReconcileAsync(components)();
+      const reconciliationState: { readonly isSettled: boolean } = trackSettlement(reconciliation);
+      await waitForTurnsAsync();
+      expect(reconciliationState.isSettled).toBe(false);
+
+      peek!.commit();
+      expect(components.inputsSnapshot).toBe(fixture.nextSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([]);
+      expect(() => peek!.commit()).toThrow('already committed or discarded');
+      expect(() => peek!.discard()).toThrow('already committed or discarded');
+      await expect(reconciliation).resolves.toMatchObject({ invalidatedOperationCount: 1 });
+      // The reconciliation after the peek compares against the committed snapshot
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).toMatchObject({
+        changedPaths: [],
+        currentInputsSnapshot: fixture.nextSnapshot
+      });
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).not.toHaveProperty(
+        'executingIterationRecords'
+      );
+      await disposeComponentsAsync(components);
+    });
+
+    it('leaves the inputs snapshot and the invalidations unchanged when discarded', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      invalidations.invalidate(CHANGED_PATH);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+      peek!.discard();
+
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([CHANGED_PATH]);
+      await expect(getReconcileAsync(components)()).resolves.toMatchObject({
+        inputsSnapshot: fixture.nextSnapshot,
+        invalidatedOperationCount: 1
+      });
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).toMatchObject({
+        changedPaths: [CHANGED_PATH],
+        currentInputsSnapshot: engine.components.inputsSnapshot
+      });
+      expect(invalidateSpy).toHaveBeenCalledWith(new Set([engine.operations[0]]), 'workspace-inputs-changed');
+      await disposeComponentsAsync(components);
+    });
+
+    it('waits for an earlier reconciliation and maps against its inputs snapshot', async () => {
+      const firstSnapshot: IDeferred<IInputsSnapshot> = createDeferred();
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidations } = fixture;
+      const getInputsSnapshotAsync: jest.Mock = jest
+        .fn()
+        .mockReturnValueOnce(firstSnapshot.promise)
+        .mockResolvedValue(fixture.nextSnapshot);
+      Object.assign(engine.components, { getInputsSnapshotAsync });
+      invalidations.invalidate(CHANGED_PATH);
+
+      const reconciliation: Promise<unknown> = getReconcileAsync(components)();
+      const peekPromise: Promise<IWorkspaceInvalidationPeek | undefined> = fixture.peekAsync();
+      await waitForTurnsAsync();
+      expect(getInputsSnapshotAsync).toHaveBeenCalledTimes(1);
+      const reconciledSnapshot: IInputsSnapshot = createInputsSnapshot('reconciled');
+      firstSnapshot.resolve(reconciledSnapshot);
+      await reconciliation;
+      const peek: IWorkspaceInvalidationPeek | undefined = await peekPromise;
+
+      expect(getInputsSnapshotAsync).toHaveBeenCalledTimes(2);
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).toMatchObject({
+        changedPaths: [],
+        currentInputsSnapshot: reconciledSnapshot,
+        nextInputsSnapshot: fixture.nextSnapshot
+      });
+      peek!.discard();
+      await disposeComponentsAsync(components);
+    });
+
+    it('returns undefined for changes that invalidate every operation, and keeps them', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      invalidations.invalidateForInitialization();
+
+      await expect(fixture.peekAsync()).resolves.toBeUndefined();
+
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      expect(invalidateSpy).not.toHaveBeenCalled();
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      await expect(getReconcileAsync(components)()).resolves.toMatchObject({ isFullInvalidation: true });
+      expect(invalidateSpy).toHaveBeenCalledWith(undefined, 'workspace-inputs-changed');
+      await disposeComponentsAsync(components);
+    });
+
+    it('throws, keeping the invalidations, where a reconciliation throws', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      const changedPath: string = path.join(
+        TEST_RUSH_CONFIGURATION.projects[0].projectFolder,
+        'package.json'
+      );
+      invalidations.invalidate(changedPath);
+
+      await expect(fixture.peekAsync()).rejects.toBeInstanceOf(WorkspaceEngineRecreationRequiredError);
+
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      expect(invalidateSpy).not.toHaveBeenCalled();
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([changedPath]);
+      // The failed peek doesn't hold later reconciliations
+      await expect(getReconcileAsync(components)()).rejects.toBeInstanceOf(
+        WorkspaceEngineRecreationRequiredError
+      );
+      await disposeComponentsAsync(components);
+    });
+
+    it('rejects a peek once the engine is being disposed, without mapping the invalidations', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, invalidations } = fixture;
+      invalidations.invalidate(CHANGED_PATH);
+      const disposalPromise: Promise<void> = disposeComponentsAsync(components);
+
+      await expect(fixture.peekAsync()).rejects.toThrow('The workspace engine is being disposed.');
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      await disposalPromise;
+    });
+
+    it('does not read the inputs without changes, if the inputs are not refreshed on every request', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync({ refreshInputsOnEveryRequest: false });
+      const { components, engine, invalidations } = fixture;
+      const getInputsSnapshotAsync: jest.SpyInstance = jest.spyOn(
+        engine.components,
+        'getInputsSnapshotAsync'
+      );
+      await getReconcileAsync(components)();
+      expect(invalidations.getSnapshot().sequence).toBe(0);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+
+      expect(peek?.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(peek?.invalidatedOperations).toEqual(new Set());
+      expect(peek?.invalidationReason).toBe('workspace-inputs-changed');
+      expect(getInputsSnapshotAsync).not.toHaveBeenCalled();
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      peek!.commit();
+      invalidations.invalidate(CHANGED_PATH);
+      const nextPeek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+      expect(nextPeek?.inputsSnapshot).toBe(fixture.nextSnapshot);
+      expect(getInputsSnapshotAsync).toHaveBeenCalledTimes(1);
+      nextPeek!.commit();
+      expect(components.inputsSnapshot).toBe(fixture.nextSnapshot);
+      await disposeComponentsAsync(components);
+    });
+
+    it('makes the committed inputs snapshot the session inputs snapshot', async () => {
+      const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
+      let engine: ITestEngine | undefined;
+      const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
+        createEngineComponentsAsync: async (createOptions: ICreateWorkspaceEngineComponentsOptions) => {
+          engine = createTestEngine(createOptions.rushConfiguration.projects, async () => nextSnapshot);
+          return engine.components;
+        },
+        mapInvalidationsToOperationsAsync: async () => [engine!.operations[0]],
+        refreshInputsOnEveryRequest: true,
+        shape: {
+          phaseNames: [PHASE_NAME],
+          pluginNames: [PLUGIN_NAME]
+        }
+      });
+      const session: WorkspaceSession = await WorkspaceSession.createAsync({
+        createComponentsAsync: async (createOptions) => ({
+          ...(await factory.createAsync(createOptions)),
+          projectWatcher: {
+            [Symbol.asyncDispose]: () => Promise.resolve(),
+            startAsync: () => Promise.resolve()
+          }
+        }),
+        repoRoot: TEST_REPO_ROOT,
+        rushVersion: '5.178.1'
+      });
+      // The session invalidates every operation at startup
+      await expect(
+        session.peekInvalidationsAsync({ executingIterationRecords: ITERATION_RECORDS })
+      ).resolves.toBeUndefined();
+      const startupSnapshot: IInputsSnapshot = createInputsSnapshot('startup');
+      jest.spyOn(engine!.components, 'getInputsSnapshotAsync').mockResolvedValueOnce(startupSnapshot);
+      await session.reconcileInvalidationsAsync();
+      expect(session.inputsSnapshot).toBe(startupSnapshot);
+
+      session.invalidations.invalidate(CHANGED_PATH);
+      const discarded: IWorkspaceInvalidationPeek | undefined = await session.peekInvalidationsAsync({
+        executingIterationRecords: ITERATION_RECORDS
+      });
+      discarded!.discard();
+      expect(session.inputsSnapshot).toBe(startupSnapshot);
+      const committed: IWorkspaceInvalidationPeek | undefined = await session.peekInvalidationsAsync({
+        executingIterationRecords: ITERATION_RECORDS
+      });
+      expect(committed?.invalidatedOperations).toEqual(new Set([engine!.operations[0]]));
+      committed!.commit();
+      expect(session.inputsSnapshot).toBe(nextSnapshot);
+      expect(session.invalidations.getSnapshot().changedPaths).toEqual([]);
+      await session[Symbol.asyncDispose]();
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
new file mode 100644
index 00000000000..de58dc151e8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
@@ -0,0 +1,340 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IOperationGraph, ITelemetryData } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { readTelemetryEntries } from './NativeEngineTestFixture';
+
+jest.setTimeout(60_000);
+
+const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+
+/**
+ * build runs compile; test, retest and verify run compile and test. `--production` changes the compile commands, and
+ * `--update-snapshots` the test commands.
+ */
+function configureCommands(fixture: DaemonGraphTestFixture): void {
+  fixture.write(
+    'common/config/rush/command-line.json',
+    JSON.stringify({
+      phases: [
+        { name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } },
+        { name: '_phase:test', dependencies: { self: ['_phase:compile'] } }
+      ],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        },
+        {
+          commandKind: 'phased',
+          name: 'test',
+          summary: 'Builds and tests',
+          phases: ['_phase:compile', '_phase:test'],
+          incremental: true,
+          enableParallelism: true
+        },
+        {
+          commandKind: 'phased',
+          name: 'retest',
+          summary: 'Rebuilds and tests',
+          phases: ['_phase:compile', '_phase:test'],
+          incremental: false,
+          enableParallelism: true
+        },
+        {
+          commandKind: 'phased',
+          name: 'verify',
+          summary: 'Builds and tests, like test',
+          phases: ['_phase:compile', '_phase:test'],
+          incremental: true,
+          enableParallelism: true
+        }
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'Production build',
+          associatedCommands: ['build', 'test', 'retest', 'verify'],
+          associatedPhases: ['_phase:compile']
+        },
+        {
+          parameterKind: 'flag',
+          longName: '--update-snapshots',
+          description: 'Updates the snapshots of the tests',
+          associatedCommands: ['test', 'retest'],
+          associatedPhases: ['_phase:test']
+        }
+      ]
+    })
+  );
+  for (const name of ['a', 'b', 'c']) {
+    fixture.write(
+      `${name}/package.json`,
+      JSON.stringify({
+        name,
+        version: '1.0.0',
+        dependencies: name === 'b' ? { a: '1.0.0' } : {},
+        scripts: { '_phase:compile': 'node build.cjs', '_phase:test': 'node test.cjs' }
+      })
+    );
+    fixture.write(
+      `${name}/test.cjs`,
+      `require('node:fs').appendFileSync('../runs.txt', 'test-${name}\\n');\n`
+    );
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange, scheduled?: boolean): void {
+  expect(exchange.terminal).toMatchObject({
+    kind: 'requestResult',
+    payload: { exitCode: 0, ...(scheduled === undefined ? {} : { scheduled }) }
+  });
+}
+
+function expectUnsupported(exchange: ITerminalExchange, message: string): void {
+  expect(exchange.terminal).toMatchObject({
+    kind: 'requestRejected',
+    payload: { code: 'unsupported', message: expect.stringContaining(message) }
+  });
+}
+
+function enableTelemetry(fixture: DaemonGraphTestFixture): void {
+  const rushJson: object = JSON.parse(fs.readFileSync(path.join(fixture.folder, 'rush.json'), 'utf8'));
+  fixture.write('rush.json', JSON.stringify({ ...rushJson, telemetryEnabled: true }));
+}
+
+async function withFixtureAsync(
+  testAsync: (fixture: DaemonGraphTestFixture) => Promise<void>,
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync(
+    (created: DaemonGraphTestFixture) => {
+      configureCommands(created);
+      configure?.(created);
+    }
+  );
+  try {
+    await testAsync(fixture);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+describe('engine sharing between phased commands', () => {
+  it('switches to the engine of test once, and then serves build, retest and rebuild on it', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+
+      // The engine of build has no test operations, but an engine created by test can serve build.
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), true);
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const testGeneration: number = fixture.host.workspaceGeneration;
+      expect(testGraph).not.toBe(buildGraph);
+      expect(testGeneration).toBeGreaterThan(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'test-a']);
+
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      expectSuccess(await fixture.runAsync(['retest', '--only', 'a'], custom), true);
+      expectSuccess(await fixture.runAsync(['rebuild', '--only', 'c']), true);
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), false);
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(fixture.host.workspaceGeneration).toBe(testGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'test-a', 'a', 'test-a', 'c']);
+    }));
+
+  it('runs every selected operation of rebuild on the engine of build, and reloads an engine of rebuild for build', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['rebuild', '--to', 'b']), true);
+      const rebuildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const rebuildGeneration: number = fixture.host.workspaceGeneration;
+
+      // An engine created by a command that is not incremental serves only that command.
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(buildGraph).not.toBe(rebuildGraph);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(rebuildGeneration);
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+
+      const rebuild: ITerminalExchange = await fixture.runAsync(['rebuild', '--only', 'a']);
+      expect(rebuild.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status: 'SUCCESS' }] }
+      });
+      // Without a build cache, LegacySkipPlugin deletes the package-deps file of every operation of an iteration
+      // that allows no skipping, disabled ones included. But the engine retained b's result, which LegacySkipPlugin
+      // found up to date, and a ran again with the same state hash, so b stays verified and does not run. Rush
+      // in-process does not run it either: the graph of its `rebuild --only a` has no b.
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+      expect(fixture.host.workspaceGeneration).toBe(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'a']);
+    }));
+
+  it('rejects a custom command when neither its engine nor the current one could serve the other', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+
+      expectUnsupported(
+        await fixture.runAsync(['retest', '--only', 'a'], custom),
+        `The daemon's engine, created by "build", cannot serve "retest" because the graph of "build" does not ` +
+          `have every operation of the "_phase:test" phase, and an engine created by "retest" could not serve ` +
+          `"build" because "retest" is not incremental.`
+      );
+      expectUnsupported(
+        await fixture.runAsync(['test', '--only', 'a', '--production'], custom),
+        'could not serve "build" because the parameters of their phases differ ' +
+          '(only "test" sets --production for "_phase:compile").'
+      );
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+      expect(fixture.host.workspaceGeneration).toBe(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b']);
+
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), true);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'test-a']);
+    }));
+
+  /**
+   * Runs the custom command `first` and then `second`, which neither's engine can serve, and expects `message` for
+   * `second` without a reload.
+   */
+  async function expectUnsupportedWithoutReloadAsync(
+    first: string[],
+    second: string[],
+    message: string
+  ): Promise<void> {
+    await withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync([...first, '--only', 'a'], custom), true);
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const generation: number = fixture.host.workspaceGeneration;
+
+      expectUnsupported(await fixture.runAsync([...second, '--only', 'a'], custom), message);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+      expect(fixture.runs()).toEqual(['a', 'test-a']);
+    });
+  }
+
+  /** The reason why neither of two requests of test could serve the other, if only `setter` sets a parameter. */
+  function getSameCommandMessage(setter: string): string {
+    return (
+      `The daemon's engine, created by an earlier "test", cannot serve this "test", and an engine created by ` +
+      `this "test" could not serve the earlier one either, because the parameters of their phases differ ` +
+      `(only ${setter} sets --update-snapshots for "_phase:test").`
+    );
+  }
+
+  it('names the earlier request of a custom command that sets a parameter that this request does not', () =>
+    expectUnsupportedWithoutReloadAsync(
+      ['test', '--update-snapshots'],
+      ['test'],
+      getSameCommandMessage('the earlier "test"')
+    ));
+
+  it('names this request of a custom command when it sets a parameter that the earlier request did not', () =>
+    expectUnsupportedWithoutReloadAsync(
+      ['test'],
+      ['test', '--update-snapshots'],
+      getSameCommandMessage('this "test"')
+    ));
+
+  it('gives the reason once when neither of two custom commands could serve the other for the same reason', () =>
+    expectUnsupportedWithoutReloadAsync(
+      ['test', '--production'],
+      ['verify'],
+      `The daemon's engine, created by "test", cannot serve "verify", and an engine created by "verify" could ` +
+        `not serve "test" either, because the parameters of their phases differ ` +
+        `(only "test" sets --production for "_phase:compile").`
+    ));
+
+  it('shares no engine between commands while a plugin taps runAnyPhasedCommand', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+      fixture.session.rushSession!.hooks.runAnyPhasedCommand.tap('WorkspaceEngineSharing.test', () => {});
+
+      expectUnsupported(
+        await fixture.runAsync(['test', '--only', 'a'], custom),
+        'could not serve "build" because a plugin taps the runAnyPhasedCommand hook'
+      );
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+
+      // The same command still shares the engine.
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b', '--ignore-hooks']), false);
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+
+      // Built-in commands reload, as they did before engines were shared.
+      expectSuccess(await fixture.runAsync(['rebuild', '--only', 'a']), true);
+      expect(fixture.session.operationGraph).not.toBe(buildGraph);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'a']);
+    }));
+
+  it('selects the phase dependencies of each request on a shared engine', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['test', '--only', 'b'], custom), true);
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(fixture.runs()).toEqual(['b', 'test-b']);
+
+      // b was built without a, so it runs again once a has run.
+
+      const withDependencies: ITerminalExchange = await fixture.runAsync(
+        ['test', '--only', 'b', '--include-phase-deps'],
+        custom
+      );
+      expect(withDependencies.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 0,
+          operationResults: expect.arrayContaining([{ operationId: 'a (compile)', status: 'SUCCESS' }])
+        }
+      });
+      expectSuccess(await fixture.runAsync(['build', '--only', 'b', '--ignore-hooks']), false);
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(fixture.runs()).toEqual(['b', 'test-b', 'a', 'b', 'test-b']);
+    }));
+
+  it("logs the telemetry entry of each request that a shared engine serves under the request's own command", () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), true);
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']), true);
+      expectSuccess(await fixture.runAsync(['retest', '--only', 'a'], custom), true);
+      expectSuccess(await fixture.runAsync(['rebuild', '--only', 'c']), true);
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(fixture.runs()).toEqual(['a', 'test-a', 'b', 'a', 'test-a', 'c']);
+
+      const entries: ITelemetryData[] = readTelemetryEntries(fixture.folder);
+      expect(
+        entries.map(({ name, result, extraData, operationResults }) => [
+          name,
+          result,
+          extraData?.requestIndex,
+          Object.keys(operationResults ?? {}).sort()
+        ])
+      ).toEqual([
+        ['test', 'Succeeded', 1, ['a (compile)', 'a (test)']],
+        ['build', 'Succeeded', 2, ['a (compile)', 'b (compile)']],
+        ['retest', 'Succeeded', 3, ['a (compile)', 'a (test)']],
+        ['rebuild', 'Succeeded', 4, ['c (compile)']]
+      ]);
+      expect(entries[1].extraData).toMatchObject({ command_to: 'true', '--to': 'b', countSkipped: 1 });
+      expect(entries[2].extraData).toMatchObject({ command_only: 'true', '--only': 'a', countSuccess: 2 });
+    }, enableTelemetry));
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
new file mode 100644
index 00000000000..982b8ee2536
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
@@ -0,0 +1,193 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const BUILD_C: string[] = ['build', '--to', 'c', '--parallelism', '3'];
+
+interface IQueuedRequest {
+  readonly client: DaemonRequestWireClient;
+  readonly envelope: IDaemonRequestEnvelope;
+}
+
+function isQueuePosition(frame: IDaemonFrame): boolean {
+  return (
+    frame.kind === DaemonFrameType.controlJson &&
+    decodeDaemonControlMessage(frame.payload).kind === 'queuePosition'
+  );
+}
+
+/** Starts a request and returns once the daemon reports that it waits. */
+async function startQueuedAsync(
+  fixture: DaemonGraphTestFixture,
+  environment: Record<string, string>,
+  clients: DaemonRequestWireClient[]
+): Promise<IQueuedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  clients.push(client);
+  const envelope: IDaemonRequestEnvelope = fixture.envelope(BUILD_B, { environment });
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  while (!isQueuePosition(await client.readFrameAsync()));
+  return { client, envelope };
+}
+
+it('tells the request that restarts the daemon for its environment, and each request answered while that restart is pending, which variables differ', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => {
+    setDaemonPolicy(created, {});
+    created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    // Project c holds its build open until the test removes the marker.
+    created.write('hold', '');
+    created.write(
+      'c/build.cjs',
+      withScriptDeadline(
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+          "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      )
+    );
+  });
+  const clients: DaemonRequestWireClient[] = [];
+  try {
+    const before = await pongAsync(fixture);
+    const held: Promise<ITerminalExchange> = fixture.runAsync(BUILD_C);
+    const deadline: number = Date.now() + 30_000;
+    while (!fixture.runs().includes('c') && Date.now() < deadline) await delayAsync(20);
+    expect(fixture.runs()).toContain('c');
+
+    // Each request differs from the daemon in its own variable. Either one may restart the daemon; the other is
+    // answered while that restart is pending.
+    const requests: IQueuedRequest[] = [];
+    for (const [name, value] of [
+      ['RUSHD_RESTART_REASON_FIRST', 'first-value'],
+      ['RUSHD_RESTART_REASON_SECOND', 'second-value']
+    ]) {
+      requests.push(await startQueuedAsync(fixture, { ...fixture.environment, [name]: value }, clients));
+    }
+    fs.rmSync(path.join(fixture.folder, 'hold'));
+    expect((await held).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    const exchanges: ITerminalExchange[] = await Promise.all(
+      requests.map(({ client, envelope }: IQueuedRequest) => client.readTerminalAsync(envelope.requestId))
+    );
+
+    const restartLines: string[] = fixture.logs.filter((line: string) =>
+      line.startsWith('rushd: restarting for request ')
+    );
+    expect(restartLines).toHaveLength(1);
+    const restarter: number = requests.findIndex(({ envelope }: IQueuedRequest) =>
+      restartLines[0].includes(`request ${envelope.requestId},`)
+    );
+    expect(restarter).not.toBe(-1);
+    const variableName: string =
+      restarter === 0 ? 'RUSHD_RESTART_REASON_FIRST' : 'RUSHD_RESTART_REASON_SECOND';
+    expect(restartLines[0]).toBe(
+      `rushd: restarting for request ${requests[restarter].envelope.requestId}, whose environment differs ` +
+        `from this daemon's in ${variableName}`
+    );
+    // The request that was answered while the restart was pending learns the restart's reason, not its own.
+    for (const { terminal } of exchanges) {
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          retryAfterRestart: true,
+          restartReason: { kind: 'environmentChanged', variableNames: [variableName] }
+        }
+      });
+    }
+    expect(fixture.logs.join('\n')).not.toMatch(/first-value|second-value/);
+    const restarted = await fixture.host.restartCompleted;
+    expect(restarted?.pid).not.toBe(before.pid);
+    expect(fixture.runs()).toEqual(['c']);
+  } finally {
+    fs.rmSync(path.join(fixture.folder, 'hold'), { force: true });
+    await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted;
+    } finally {
+      await stopSuccessorAsync(fixture.host.paths);
+      await fixture[Symbol.asyncDispose]();
+    }
+  }
+});
+
+it('restarts the daemon for the environment of a phased custom command, but not for a global command', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => {
+    setDaemonPolicy(created, {});
+    created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: [
+          { commandKind: 'phased', name: 'build', phases: ['_phase:compile'], enableParallelism: true },
+          {
+            commandKind: 'phased',
+            name: 'test',
+            summary: 'Tests',
+            phases: ['_phase:compile'],
+            enableParallelism: true
+          },
+          { commandKind: 'global', name: 'hello', summary: 'A global command', shellCommand: 'node -e ""' }
+        ]
+      })
+    );
+  });
+  const custom: Partial<IDaemonRequestEnvelope> = {
+    commandOrigin: 'custom',
+    environment: { ...fixture.environment, RUSHD_CUSTOM_RESTART_REASON: 'custom-value' }
+  };
+  try {
+    const before = await pongAsync(fixture);
+    expect((await fixture.runAsync(['hello'], custom)).terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { code: 'unsupported', message: expect.stringContaining('is not a phased command') }
+    });
+    expect((await fixture.runAsync(['test', '--to', 'b'], custom)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        exitCode: 1,
+        retryAfterRestart: true,
+        restartReason: { kind: 'environmentChanged', variableNames: ['RUSHD_CUSTOM_RESTART_REASON'] }
+      }
+    });
+    expect(fixture.logs.filter((line: string) => line.startsWith('rushd: restarting for request '))).toEqual([
+      "rushd: restarting for request graph-2, whose environment differs from this daemon's in " +
+        'RUSHD_CUSTOM_RESTART_REASON'
+    ]);
+    const restarted = await fixture.host.restartCompleted;
+    expect(restarted?.pid).not.toBe(before.pid);
+    // The successor, which started with that environment, serves the request that the client retries.
+    expect((await fixture.runAsync(['test', '--to', 'b'], custom)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    expect((await pongAsync(fixture)).pid).toBe(restarted?.pid);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted;
+    } finally {
+      await stopSuccessorAsync(fixture.host.paths);
+      await fixture[Symbol.asyncDispose]();
+    }
+  }
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
new file mode 100644
index 00000000000..3b6fc4f6167
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
@@ -0,0 +1,338 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync),
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync)
+  };
+});
+
+import * as rushLib from '@microsoft/rush-lib';
+
+import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
+import { DaemonGraphTestFixture, responseSnapshot } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(60_000);
+
+type CaptureRequest = [scope: object, key: string, captureAsync: () => Promise<unknown>, notBeforeMs?: number];
+type BuildExchange = ReturnType<DaemonGraphTestFixture['buildAsync']>;
+
+interface IGate {
+  readonly promise: Promise<void>;
+  readonly release: () => void;
+}
+
+const WAIT_TIMEOUT_MS: number = 20_000;
+const actualRushLib: typeof rushLib = jest.requireActual('@microsoft/rush-lib');
+const workspaceCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
+  jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
+const projectCaptureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
+  jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+const originalCaptureAsync: FreshCaptureCoalescer<object, unknown>['captureAsync'] =
+  FreshCaptureCoalescer.prototype.captureAsync;
+
+function createGate(): IGate {
+  let release: () => void = () => {};
+  const promise: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+  return { promise, release: () => release() };
+}
+
+async function waitForAsync(description: string, condition: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + WAIT_TIMEOUT_MS;
+  while (!condition()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting until ${description}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+// The project configuration coalescer uses one key per workspace configuration.
+function isProjectRequest(request: unknown[]): boolean {
+  return request[1] === '';
+}
+
+function describeRequest(request: unknown[]): [string, string] {
+  return [isProjectRequest(request) ? 'project' : 'workspace', typeof request[3]];
+}
+
+function countRequests(requests: jest.SpyInstance, kind: 'workspace' | 'project'): number {
+  return requests.mock.calls.filter((request: unknown[]) => describeRequest(request)[0] === kind).length;
+}
+
+/**
+ * Makes the first `count` workspace input requests wait until all of them have arrived, and then makes them in
+ * one loop, as requests that were received together would if none of them was delayed on the way.
+ */
+function holdWorkspaceRequests(requests: jest.SpyInstance, count: number): void {
+  const waiting: (() => void)[] = [];
+  requests.mockImplementation(function (
+    this: FreshCaptureCoalescer<object, unknown>,
+    ...request: CaptureRequest
+  ): Promise<unknown> {
+    if (waiting.length === count || isProjectRequest(request)) return originalCaptureAsync.apply(this, request);
+    return new Promise((resolve) => {
+      waiting.push(() => resolve(originalCaptureAsync.apply(this, request)));
+      if (waiting.length === count) for (const start of waiting) start();
+    });
+  });
+}
+
+/**
+ * Makes the first `count` project configuration requests wait until all of them have arrived, and then makes them
+ * one at a time, each after the previous request's capture settled. A capture that awaits no I/O holds the event
+ * loop from start to end, so requests received together reach the coalescer in this order.
+ */
+function serializeProjectRequests(requests: jest.SpyInstance, count: number): void {
+  const waiting: (() => Promise<unknown>)[] = [];
+  requests.mockImplementation(function (
+    this: FreshCaptureCoalescer<object, unknown>,
+    ...request: CaptureRequest
+  ): Promise<unknown> {
+    if (waiting.length === count || !isProjectRequest(request)) return originalCaptureAsync.apply(this, request);
+    return new Promise((resolve, reject) => {
+      waiting.push(() => {
+        const result: Promise<unknown> = originalCaptureAsync.apply(this, request);
+        result.then(resolve, reject);
+        return result;
+      });
+      if (waiting.length === count) {
+        void (async () => {
+          for (const ask of waiting) await ask().catch(() => undefined);
+        })();
+      }
+    });
+  });
+}
+
+function gateNextCapture<TArgs extends unknown[], TResult>(
+  mock: jest.MockedFunction<(...args: TArgs) => Promise<TResult>>,
+  actual: (...args: TArgs) => Promise<TResult>
+): IGate {
+  const gate: IGate = createGate();
+  mock.mockImplementationOnce(async (...args: TArgs) => {
+    await gate.promise;
+    return await actual(...args);
+  });
+  return gate;
+}
+
+async function expectSuccessfulBuildsAsync(builds: BuildExchange[]): Promise<void> {
+  for (const exchange of await Promise.all(builds)) {
+    expect(exchange.terminal).toMatchObject({ payload: { exitCode: 0 } });
+  }
+}
+
+async function createWarmFixtureAsync(): Promise<DaemonGraphTestFixture> {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) =>
+    setDaemonPolicy(created, {})
+  );
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    return fixture;
+  } catch (error) {
+    await fixture[Symbol.asyncDispose]();
+    throw error;
+  }
+}
+
+describe('workspace input captures shared from the time a request was received', () => {
+  const gates: IGate[] = [];
+  let requests: jest.SpyInstance | undefined;
+  let fixture: DaemonGraphTestFixture | undefined;
+
+  function spyOnRequests(): jest.SpyInstance {
+    requests = jest.spyOn(FreshCaptureCoalescer.prototype, 'captureAsync');
+    return requests;
+  }
+
+  function gate(next: IGate): IGate {
+    gates.push(next);
+    return next;
+  }
+
+  afterEach(async () => {
+    for (const next of gates.splice(0)) next.release();
+    requests?.mockRestore();
+    requests = undefined;
+    const disposing: DaemonGraphTestFixture | undefined = fixture;
+    fixture = undefined;
+    try {
+      await disposing?.[Symbol.asyncDispose]();
+    } finally {
+      workspaceCaptureMock.mockReset();
+      workspaceCaptureMock.mockImplementation(actualRushLib.captureWorkspaceInputFingerprintAsync);
+      projectCaptureMock.mockReset();
+      projectCaptureMock.mockImplementation(actualRushLib.captureProjectConfigurationFingerprintAsync);
+    }
+  });
+
+  it('shares the first captures of warm builds that were all received before those captures started', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const generation: number = warm.host.workspaceGeneration;
+    const spy: jest.SpyInstance = spyOnRequests();
+    holdWorkspaceRequests(spy, 3);
+    workspaceCaptureMock.mockClear();
+    projectCaptureMock.mockClear();
+    const projectGate: IGate = gate(
+      gateNextCapture(projectCaptureMock, actualRushLib.captureProjectConfigurationFingerprintAsync)
+    );
+
+    const builds: BuildExchange[] = [warm.buildAsync(), warm.buildAsync(), warm.buildAsync()];
+    await waitForAsync(
+      'every build asked for a project configuration capture',
+      () => countRequests(spy, 'project') === 3
+    );
+    // A strict coalescer would start a second capture for the builds that reached it after the first one started.
+    expect(workspaceCaptureMock).toHaveBeenCalledTimes(1);
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+    projectGate.release();
+
+    await expectSuccessfulBuildsAsync(builds);
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+    expect(warm.host.workspaceGeneration).toBe(generation);
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+  });
+
+  it('gives warm builds the project configuration capture that started after they were received, even once it finished', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const generation: number = warm.host.workspaceGeneration;
+    const spy: jest.SpyInstance = spyOnRequests();
+    serializeProjectRequests(spy, 3);
+    projectCaptureMock.mockClear();
+
+    const builds: BuildExchange[] = [warm.buildAsync(), warm.buildAsync(), warm.buildAsync()];
+    await expectSuccessfulBuildsAsync(builds);
+    expect(countRequests(spy, 'project')).toBe(3);
+    // Each build asked after the previous capture had finished; all of them were received before it started.
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+    expect(warm.host.workspaceGeneration).toBe(generation);
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+  });
+
+  it('never shares a capture that started before a build was received', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const spy: jest.SpyInstance = spyOnRequests();
+    workspaceCaptureMock.mockClear();
+    projectCaptureMock.mockClear();
+    const workspaceGate: IGate = gate(
+      gateNextCapture(workspaceCaptureMock, actualRushLib.captureWorkspaceInputFingerprintAsync)
+    );
+    const projectGate: IGate = gate(
+      gateNextCapture(projectCaptureMock, actualRushLib.captureProjectConfigurationFingerprintAsync)
+    );
+
+    const first: BuildExchange = warm.buildAsync();
+    await waitForAsync('the first build is capturing', () => workspaceCaptureMock.mock.calls.length === 1);
+    const late: BuildExchange = warm.buildAsync();
+    await waitForAsync('the late build asked for a capture', () => countRequests(spy, 'workspace') === 2);
+    workspaceGate.release();
+    await waitForAsync(
+      'both builds asked for a project configuration capture',
+      () => countRequests(spy, 'project') === 2
+    );
+    // The late build was received after the first workspace capture started, so it waited for its own.
+    expect(workspaceCaptureMock).toHaveBeenCalledTimes(2);
+    projectGate.release();
+
+    await expectSuccessfulBuildsAsync([first, late]);
+    // It was received before the first project configuration capture started, so it shared that one.
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps the receipt time for builds that wait behind a transition', async () => {
+    fixture = await DaemonGraphTestFixture.createAsync((created) => setDaemonPolicy(created, {}));
+    const cold: DaemonGraphTestFixture = fixture;
+    const spy: jest.SpyInstance = spyOnRequests();
+    workspaceCaptureMock.mockClear();
+    const workspaceGate: IGate = gate(
+      gateNextCapture(workspaceCaptureMock, actualRushLib.captureWorkspaceInputFingerprintAsync)
+    );
+
+    const first: BuildExchange = cold.buildAsync();
+    await waitForAsync('the first build is capturing', () => workspaceCaptureMock.mock.calls.length === 1);
+    const waiters: BuildExchange[] = [cold.buildAsync(), cold.buildAsync()];
+    await waitForAsync('every build asked for a capture', () => countRequests(spy, 'workspace') === 3);
+    workspaceGate.release();
+    await expectSuccessfulBuildsAsync([first, ...waiters]);
+    expect(cold.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+
+    const byReceipt: Map<number, string[]> = new Map();
+    for (const request of spy.mock.calls as unknown[][]) {
+      const notBeforeMs: unknown = request[3];
+      if (typeof notBeforeMs !== 'number') continue;
+      byReceipt.set(notBeforeMs, [...(byReceipt.get(notBeforeMs) ?? []), describeRequest(request)[0]]);
+    }
+    // One build loads the graph. The others were admitted before it began, wait behind its transition, and then
+    // prepare again with the time at which they were received.
+    expect([...byReceipt.values()].sort((a: string[], b: string[]) => a.length - b.length)).toEqual([
+      ['workspace', 'project'],
+      ['workspace', 'project', 'workspace', 'project'],
+      ['workspace', 'project', 'workspace', 'project']
+    ]);
+  });
+
+  it('passes the receipt time only to the captures that decide whether a request can reuse the workspace', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const spy: jest.SpyInstance = spyOnRequests();
+
+    await warm.buildSuccessfullyAsync();
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    // The last capture validates the graph inputs before execution and must start after it was requested.
+    expect(spy.mock.calls.map(describeRequest)).toEqual([
+      ['workspace', 'number'],
+      ['project', 'number'],
+      ['workspace', 'undefined']
+    ]);
+
+    spy.mockClear();
+    setDaemonPolicy(warm, { warmSetMaxProjects: 19 });
+    await warm.buildSuccessfullyAsync();
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+    // A transition detects changes made while it runs, so every capture after the first one is strict.
+    const reload: [string, string][] = spy.mock.calls.map(describeRequest);
+    expect(reload[0]).toEqual(['workspace', 'number']);
+    expect(reload.slice(1).map(([, notBeforeMs]) => notBeforeMs)).toEqual(
+      reload.slice(1).map(() => 'undefined')
+    );
+    expect(reload).toContainEqual(['project', 'undefined']);
+
+    spy.mockClear();
+    responseSnapshot(await warm.graphAsync('invalidate', '--project', 'a'));
+    // Graph control checks the inputs of the generation it changes, so its captures are strict as well.
+    expect(spy.mock.calls.map(describeRequest)).toEqual([
+      ['workspace', 'undefined'],
+      ['project', 'undefined']
+    ]);
+  });
+
+  it('checks the project configurations again with a strict capture when a transition can reuse the workspace', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const generation: number = warm.host.workspaceGeneration;
+    const spy: jest.SpyInstance = spyOnRequests();
+    projectCaptureMock.mockClear();
+    // The project configurations changed before the build was received and changed back before its transition.
+    projectCaptureMock.mockImplementationOnce(async () => 'a project configuration that was changed back');
+
+    await warm.buildSuccessfullyAsync();
+    expect(warm.host.workspaceGeneration).toBe(generation);
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(projectCaptureMock).toHaveBeenCalledTimes(2);
+    expect(spy.mock.calls.map(describeRequest)).toEqual([
+      ['workspace', 'number'],
+      ['project', 'number'],
+      ['workspace', 'undefined'],
+      ['project', 'undefined'],
+      ['workspace', 'undefined']
+    ]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
new file mode 100644
index 00000000000..23bce5cc3db
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
@@ -0,0 +1,148 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync),
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync)
+  };
+});
+
+import * as rushLib from '@microsoft/rush-lib';
+
+import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(60_000);
+
+const WAIT_TIMEOUT_MS: number = 20_000;
+const captureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
+  jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+const inputCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
+  jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
+
+async function waitForAsync(description: string, condition: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + WAIT_TIMEOUT_MS;
+  while (!condition()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting until ${description}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+it('serves concurrent warm builds from one project configuration capture that started after they arrived', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) =>
+    setDaemonPolicy(created, {})
+  );
+  let release: () => void = () => {};
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    const generation: number = fixture.host.workspaceGeneration;
+
+    const requests: jest.SpyInstance = jest.spyOn(FreshCaptureCoalescer.prototype, 'captureAsync');
+    // The project configuration coalescer uses one key per workspace configuration.
+    const projectCaptureRequests = (): number =>
+      requests.mock.calls.filter(([, key]: unknown[]) => key === '').length;
+    captureMock.mockClear();
+    const gate: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+    const actual: typeof rushLib.captureProjectConfigurationFingerprintAsync = jest.requireActual<
+      typeof rushLib
+    >('@microsoft/rush-lib').captureProjectConfigurationFingerprintAsync;
+    captureMock.mockImplementationOnce(async (...args) => {
+      await gate;
+      return await actual(...args);
+    });
+
+    const first: ReturnType<DaemonGraphTestFixture['buildAsync']> = fixture.buildAsync();
+    await waitForAsync('the first build is capturing', () => captureMock.mock.calls.length === 1);
+    const joiners: ReturnType<DaemonGraphTestFixture['buildAsync']>[] = [
+      fixture.buildAsync(),
+      fixture.buildAsync(),
+      fixture.buildAsync()
+    ];
+    await waitForAsync(
+      'every build asked for a capture',
+      () => Math.max(projectCaptureRequests(), captureMock.mock.calls.length) === 4
+    );
+    expect(captureMock).toHaveBeenCalledTimes(1);
+    release();
+
+    for (const exchange of await Promise.all([first, ...joiners])) {
+      expect(exchange.terminal).toMatchObject({ payload: { exitCode: 0 } });
+    }
+    // The joiners arrived while the first capture was running, so they shared one that started after them.
+    expect(captureMock).toHaveBeenCalledTimes(2);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    requests.mockRestore();
+  } finally {
+    release();
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
+it('shares input fingerprint captures only between requests whose fingerprint environments are equal', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) =>
+    setDaemonPolicy(created, {})
+  );
+  let release: () => void = () => {};
+  const requests: jest.SpyInstance = jest.spyOn(FreshCaptureCoalescer.prototype, 'captureAsync');
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    const generation: number = fixture.host.workspaceGeneration;
+
+    // A variable that is part of the workspace fingerprint environment, unlike TERM and COLUMNS.
+    const variable: string = 'RUSHD_CAPTURE_SHARING_TEST';
+    const capturedValues = (): (string | undefined)[] =>
+      inputCaptureMock.mock.calls.map(([options]) => options.environment[variable]);
+    // The project configuration coalescer uses the empty key; input captures use environment keys.
+    const inputCaptureRequests = (): number =>
+      requests.mock.calls.filter(([, key]: unknown[]) => key !== '').length;
+    requests.mockClear();
+    inputCaptureMock.mockClear();
+    const gate: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+    const actual: typeof rushLib.captureWorkspaceInputFingerprintAsync = jest.requireActual<
+      typeof rushLib
+    >('@microsoft/rush-lib').captureWorkspaceInputFingerprintAsync;
+    inputCaptureMock.mockImplementationOnce(async (...args) => {
+      await gate;
+      return await actual(...args);
+    });
+
+    const first: ReturnType<DaemonGraphTestFixture['buildAsync']> = fixture.buildAsync();
+    await waitForAsync('the first build is capturing', () => inputCaptureMock.mock.calls.length === 1);
+    const argv: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+    const volatile: ReturnType<DaemonGraphTestFixture['runAsync']> = fixture.runAsync(argv, {
+      environment: { ...fixture.environment, TERM: 'dumb', COLUMNS: '91' }
+    });
+    const other: ReturnType<DaemonGraphTestFixture['runAsync']> = fixture.runAsync(argv, {
+      environment: { ...fixture.environment, [variable]: 'other' }
+    });
+    await waitForAsync('every build asked for an input capture', () => inputCaptureRequests() === 3);
+    // The request with another environment captured it at once. The request that differs only in volatile
+    // variables waits for the next capture that it can share.
+    expect(capturedValues()).toEqual([undefined, 'other']);
+    release();
+
+    const [firstResult, volatileResult, otherResult] = await Promise.all([first, volatile, other]);
+    expect(firstResult.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    expect(volatileResult.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    // Only the request with another environment needs a new daemon process, which this host cannot launch.
+    expect(otherResult.terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { message: expect.stringContaining('A new daemon process is required (environment)') }
+    });
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    requests.mockRestore();
+    release();
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts
new file mode 100644
index 00000000000..6718f3c8cf6
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts
@@ -0,0 +1,156 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IInputsSnapshot, IOperationGraph, Operation } from '@microsoft/rush-lib';
+
+import { WorkspaceEngineRecreationRequiredError } from '../WorkspaceEngineComponentFactory';
+import {
+  assertCompatibleInputs,
+  createInputsCompatibilityCheck,
+  getOperationsWithChangedInputs
+} from '../WorkspaceInputsComparison';
+
+const PHASE_NAME: string = '_phase:build';
+
+function createOperation(packageName: string): Operation {
+  return {
+    associatedPhase: { name: PHASE_NAME },
+    associatedProject: { packageName }
+  } as unknown as Operation;
+}
+
+function createInputsSnapshot(
+  hashes: ReadonlyMap<string, string>,
+  stateHashByPackageName: Readonly<Record<string, string>> = {}
+): IInputsSnapshot {
+  return {
+    getOperationOwnStateHash: jest.fn((project: unknown, phaseName?: string) => {
+      const { packageName } = project as { packageName: string };
+      return `${phaseName}:${stateHashByPackageName[packageName]}`;
+    }),
+    getTrackedFileHashesForOperation: () => hashes,
+    hasUncommittedChanges: false,
+    hashes,
+    rootDirectory: '/repo'
+  };
+}
+
+// Hashes that report whether they were read
+function createObservedHashes(entries: [string, string][]): Map<string, string> {
+  const hashes: Map<string, string> = new Map(entries);
+  jest.spyOn(hashes, 'keys');
+  jest.spyOn(hashes, 'get');
+  return hashes;
+}
+
+function wereRead(hashes: Map<string, string>): boolean {
+  return (hashes.keys as jest.Mock).mock.calls.length > 0 || (hashes.get as jest.Mock).mock.calls.length > 0;
+}
+
+const INITIAL_HASHES: [string, string][] = [
+  ['common/config/rush/experiments.json', 'experiments'],
+  ['a/package.json', 'a-package'],
+  ['a/src/index.ts', 'a-index'],
+  ['b/src/index.ts', 'b-index']
+];
+
+describe(getOperationsWithChangedInputs.name, () => {
+  const operationA: Operation = createOperation('a');
+  const operationB: Operation = createOperation('b');
+  const operationGraph: IOperationGraph = {
+    operations: new Set([operationA, operationB])
+  } as unknown as IOperationGraph;
+
+  it('returns the operations whose own state hashes differ', () => {
+    const hashes: Map<string, string> = new Map(INITIAL_HASHES);
+    expect(
+      getOperationsWithChangedInputs({
+        changedPaths: [],
+        currentInputsSnapshot: createInputsSnapshot(hashes, { a: '1', b: '2' }),
+        nextInputsSnapshot: createInputsSnapshot(hashes, { a: '1', b: '3' }),
+        operationGraph
+      })
+    ).toEqual([operationB]);
+  });
+
+  it('computes no hashes to compare a snapshot with itself', () => {
+    const snapshot: IInputsSnapshot = createInputsSnapshot(new Map(INITIAL_HASHES), { a: '1', b: '2' });
+    expect(
+      getOperationsWithChangedInputs({
+        changedPaths: ['a/src/index.ts'],
+        currentInputsSnapshot: snapshot,
+        nextInputsSnapshot: snapshot,
+        operationGraph
+      })
+    ).toEqual([]);
+    expect(snapshot.getOperationOwnStateHash).not.toHaveBeenCalled();
+  });
+});
+
+describe(assertCompatibleInputs.name, () => {
+  it('accepts snapshots that differ only in files that do not define the graph', () => {
+    const current: IInputsSnapshot = createInputsSnapshot(new Map(INITIAL_HASHES));
+    const next: IInputsSnapshot = createInputsSnapshot(
+      new Map([...INITIAL_HASHES, ['a/src/index.ts', 'a-index-2'], ['b/src/new.ts', 'b-new']])
+    );
+    expect(() => assertCompatibleInputs(current, next)).not.toThrow();
+  });
+
+  it.each([
+    ['a changed', ['a/package.json', 'a-package-2']],
+    ['an added', ['c/package.json', 'c-package']]
+  ])('requires a new engine for %s file that may define the graph', (name: string, entry: string[]) => {
+    const current: IInputsSnapshot = createInputsSnapshot(new Map(INITIAL_HASHES));
+    const next: IInputsSnapshot = createInputsSnapshot(
+      new Map([...INITIAL_HASHES, entry as [string, string]])
+    );
+    expect(() => assertCompatibleInputs(current, next)).toThrow(WorkspaceEngineRecreationRequiredError);
+    expect(() => assertCompatibleInputs(next, current)).toThrow(WorkspaceEngineRecreationRequiredError);
+  });
+
+  it('reads no hashes of snapshots that share them', () => {
+    const hashes: Map<string, string> = createObservedHashes(INITIAL_HASHES);
+    assertCompatibleInputs(createInputsSnapshot(hashes), createInputsSnapshot(hashes));
+    expect(wereRead(hashes)).toBe(false);
+  });
+});
+
+describe(createInputsCompatibilityCheck.name, () => {
+  it('compares each snapshot with the initial snapshot, unless it was the last compatible one', () => {
+    const initialHashes: Map<string, string> = createObservedHashes(INITIAL_HASHES);
+    const initialSnapshot: IInputsSnapshot = createInputsSnapshot(initialHashes);
+    const checkInputsCompatibility: (snapshot: IInputsSnapshot) => void =
+      createInputsCompatibilityCheck(initialSnapshot);
+
+    checkInputsCompatibility(initialSnapshot);
+    expect(wereRead(initialHashes)).toBe(false);
+
+    const compatibleHashes: Map<string, string> = createObservedHashes([
+      ...INITIAL_HASHES,
+      ['a/src/index.ts', 'a-index-2']
+    ]);
+    const compatibleSnapshot: IInputsSnapshot = createInputsSnapshot(compatibleHashes);
+    checkInputsCompatibility(compatibleSnapshot);
+    expect(wereRead(compatibleHashes)).toBe(true);
+
+    jest.clearAllMocks();
+    checkInputsCompatibility(compatibleSnapshot);
+    expect(wereRead(compatibleHashes)).toBe(false);
+
+    const incompatibleSnapshot: IInputsSnapshot = createInputsSnapshot(
+      new Map([...INITIAL_HASHES, ['a/package.json', 'a-package-2']])
+    );
+    expect(() => checkInputsCompatibility(incompatibleSnapshot)).toThrow(
+      WorkspaceEngineRecreationRequiredError
+    );
+    expect(() => checkInputsCompatibility(incompatibleSnapshot)).toThrow(
+      WorkspaceEngineRecreationRequiredError
+    );
+
+    // Only the last compatible snapshot is skipped
+    checkInputsCompatibility(initialSnapshot);
+    jest.clearAllMocks();
+    checkInputsCompatibility(compatibleSnapshot);
+    expect(wereRead(compatibleHashes)).toBe(true);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts b/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts
index 4c073c1e278..97feaf8444b 100644
--- a/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts
@@ -4,7 +4,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { DaemonClient, requestDaemonShutdownAsync } from '@rushstack/rush-client-core';
+import { DaemonClient, getDaemonLogFilePath, requestDaemonShutdownAsync } from '@rushstack/rush-client-core';
 import {
   readDaemonLockfile,
   type IDaemonLockfile,
@@ -12,10 +12,18 @@ import {
 } from '@rushstack/rush-daemon-transport';
 import { waitForTestProcessExitAsync } from './TestProcessExit';
 
-/** Waits on attested ownership removal, not an arbitrary sleep or mere connection close. */
+/**
+ * Stops the daemon that owns `paths` unless it is this process, then removes the log that the daemons for `paths`
+ * appended to. Waits on attested ownership removal, not an arbitrary sleep or mere connection close.
+ */
 export async function stopSuccessorAsync(paths: IDaemonPaths): Promise<void> {
   const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
-  if (!owner || owner.pid === process.pid) return;
+  if (owner && owner.pid !== process.pid) await stopOwnerAsync(paths, owner);
+  // Nothing else removes it. When the stop fails, it stays for diagnosis.
+  await fs.promises.rm(getDaemonLogFilePath(paths), { force: true });
+}
+
+async function stopOwnerAsync(paths: IDaemonPaths, owner: IDaemonLockfile): Promise<void> {
   const { pid: ownerPid, startedAt: ownerStartedAt } = owner;
   const client: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
   const removed: Promise<void> = new Promise((resolve, reject) => {
diff --git a/libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts b/libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts
new file mode 100644
index 00000000000..6f6cb6ff1c0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(30_000);
+
+// Engine code runs in the daemon process, and a Rush plugin may add its own names to process.env there.
+const ADDED_NAME: string = 'RUSHD_TEST_PLUGIN_ADDED';
+
+afterEach(() => {
+  delete process.env[ADDED_NAME];
+});
+
+it('keeps serving the warm generation after a plugin adds a name to process.env', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => setDaemonPolicy(created, {}));
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reuse);
+    const generation: number = fixture.host.workspaceGeneration;
+    const graph = fixture.session.operationGraph;
+    process.env[ADDED_NAME] = 'iteration-1';
+
+    expect((await fixture.graphAsync('invalidate', '--project', 'a')).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    process.env[ADDED_NAME] = 'iteration-2';
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reuse);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.session.operationGraph).toBe(graph);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
new file mode 100644
index 00000000000..6962ce26b49
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
@@ -0,0 +1,131 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync)
+  };
+});
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import * as rushLib from '@microsoft/rush-lib';
+
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import { createDeferred, type IDeferred, type ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+/** Longer than the wait timeout, so that a request whose capture counted would have none left. */
+const CAPTURE_MS: number = 2_500;
+const WAIT_TIMEOUT_MS: number = 2_000;
+const captureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
+  jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+async function createFixtureAsync(): Promise<DaemonGraphTestFixture> {
+  return await DaemonGraphTestFixture.createAsync((created) => {
+    created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
+    created.write(
+      'a/build.cjs',
+      withScriptDeadline(
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+          "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+      )
+    );
+  });
+}
+
+/** Makes the next project configuration capture, which a warm build runs before it is routed, take `CAPTURE_MS`. */
+function slowDownNextCapture(): IDeferred<void> {
+  const captured: IDeferred<void> = createDeferred<void>();
+  const actual: typeof rushLib.captureProjectConfigurationFingerprintAsync =
+    jest.requireActual<typeof rushLib>('@microsoft/rush-lib').captureProjectConfigurationFingerprintAsync;
+  captureMock.mockClear();
+  captureMock.mockImplementationOnce(async (...args) => {
+    await delayAsync(CAPTURE_MS);
+    try {
+      return await actual(...args);
+    } finally {
+      captured.resolve();
+    }
+  });
+  return captured;
+}
+
+describe('explicit wait timeouts and a request preparing to run', () => {
+  it('does not spend the timeout on capturing the request inputs, so the request can still wait', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    const releaseFile: string = path.join(fixture.folder, 'release-a');
+    try {
+      const long: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await waitForAsync(() => fixture.runs().includes('a'), 'the long build to start');
+
+      const captured: IDeferred<void> = slowDownNextCapture();
+      const behind: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A, {
+        admission: { waitTimeoutMs: WAIT_TIMEOUT_MS }
+      });
+      await captured.promise;
+      // The request now waits for the running build, which ends well within its timeout.
+      await delayAsync(200);
+      fs.writeFileSync(releaseFile, '');
+
+      expect((await long).terminal).toMatchObject({ payload: { exitCode: 0 } });
+      expect((await behind).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(captureMock).toHaveBeenCalledTimes(1);
+    } finally {
+      // A failed expectation must not leave the long build running, which would keep the fixture from shutting down.
+      fs.writeFileSync(releaseFile, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('still spends the timeout while the request waits after capturing its inputs', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    const releaseFile: string = path.join(fixture.folder, 'release-a');
+    try {
+      const long: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await waitForAsync(() => fixture.runs().includes('a'), 'the long build to start');
+
+      const captured: IDeferred<void> = slowDownNextCapture();
+      const startedAt: number = Date.now();
+      const behind: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A, {
+        admission: { waitTimeoutMs: WAIT_TIMEOUT_MS }
+      });
+      await captured.promise;
+      const timedOut: ITerminalExchange = await behind;
+      expect(Date.now() - startedAt).toBeGreaterThanOrEqual(CAPTURE_MS + WAIT_TIMEOUT_MS - 100);
+      expect(timedOut.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage:
+            `The request was not admitted within its ${WAIT_TIMEOUT_MS}ms wait timeout while waiting for the ` +
+            'running build of the workspace operation graph. Use --wait-timeout <seconds> to wait longer.'
+        }
+      });
+
+      fs.writeFileSync(releaseFile, '');
+      expect((await long).terminal).toMatchObject({ payload: { exitCode: 0 } });
+    } finally {
+      fs.writeFileSync(releaseFile, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
index 26fc5f204be..1b53ab7ddc9 100644
--- a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as path from 'node:path';
+
 import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
@@ -71,6 +73,18 @@ it('reuses the warm generation when only volatile per-shell environment variable
     const before = await pongAsync(fixture);
     const generation: number = fixture.host.workspaceGeneration;
     const graph = fixture.session.operationGraph;
+    // What Claude Code's Bash tool sets in every command it runs
+    const claudeCode: Record<string, string> = {
+      ...fixture.environment,
+      CLAUDECODE: '1',
+      CLAUDE_CODE_ENTRYPOINT: 'cli',
+      CLAUDE_CODE_CHILD_SESSION: '1',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-1',
+      CLAUDE_EFFORT: 'high',
+      CLAUDE_PID: '4242',
+      CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-1.sock',
+      CLAUDE_CODE_MESSAGING_TOKEN: 'token-1'
+    };
     for (const [label, environment] of Object.entries({
       same: fixture.environment,
       shell: {
@@ -81,7 +95,40 @@ it('reuses the warm generation when only volatile per-shell environment variable
         _: '/usr/bin/env'
       },
       terminal: { ...fixture.environment, TERM: 'dumb', COLUMNS: '91', WSL_INTEROP: '/run/WSL/1_interop' },
-      routing: { ...fixture.environment, RUSH_DAEMON: '1', RUSH_DAEMON_EXPERIMENTAL: '1' }
+      routing: { ...fixture.environment, RUSH_DAEMON: '1', RUSH_DAEMON_EXPERIMENTAL: '1' },
+      client: {
+        ...fixture.environment,
+        RUSHD_OUTPUT: 'legacy',
+        RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: '600',
+        RUSH_PARALLELISM: '2'
+      },
+      session: {
+        ...fixture.environment,
+        INVOCATION_ID: 'b0f1',
+        COPILOT_CLI: '1',
+        COPILOT_AGENT_SESSION_ID: 'another-session',
+        VSCODE_IPC_HOOK_CLI: '/run/vscode-ipc.sock'
+      },
+      telemetryTag: { ...fixture.environment, RUSHD_TELEMETRY_TAG: 'nightly-7' },
+      anotherTelemetryTag: { ...fixture.environment, RUSHD_TELEMETRY_TAG: 'nightly-8' },
+      claudeCode,
+      claudeEffort: { ...claudeCode, CLAUDE_EFFORT: 'max' },
+      anotherClaudeSession: {
+        ...claudeCode,
+        CLAUDE_CODE_SESSION_ID: 'claude-session-2',
+        CLAUDE_PID: '4343',
+        CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-2.sock',
+        CLAUDE_CODE_MESSAGING_TOKEN: 'token-2',
+        CLAUDE_CODE_BRIDGE_SESSION_ID: 'session_01bridge',
+        CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-2',
+        TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+        TRACESTATE: 'vendor=1'
+      },
+      humanAfterClaude: fixture.environment,
+      repeatedPath: {
+        ...fixture.environment,
+        PATH: [fixture.environment.PATH, fixture.environment.PATH].join(path.delimiter)
+      }
     })) {
       const result = await fixture.runAsync(['build', '--to', 'b', '--parallelism', '3'], { environment });
       expect(result.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
@@ -166,4 +213,4 @@ it('fails an invalid request-scoped Rush environment before planning a restart a
   } finally {
     await fixture[Symbol.asyncDispose]();
   }
-});
\ No newline at end of file
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
new file mode 100644
index 00000000000..dbcf7657d94
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -0,0 +1,610 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  type DaemonRestartReason,
+  type IDaemonContinuingOperations,
+  type IDaemonRequestAdmissionOptions,
+  type IDaemonRequestQueuePositionMessage,
+  MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import {
+  AdmissionProgress,
+  freezeDaemonRequestAdmissionOptions,
+  RequestAdmissionController,
+  ServedScriptScheduler
+} from '../WorkspaceRequestAdmission';
+
+const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100, waitTimeoutIsDefault: true };
+const EXPLICIT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100 };
+const BUDGETS: ReadonlyArray<{ kind: string; budget: IDaemonRequestAdmissionOptions }> = [
+  { kind: 'a default', budget: DEFAULT_BUDGET },
+  { kind: 'an explicit', budget: EXPLICIT_BUDGET }
+];
+
+interface IAcquisition {
+  settled: boolean;
+  lease?: IRequestLease;
+  error?: unknown;
+}
+
+function track(promise: Promise<IRequestLease>): IAcquisition {
+  const acquisition: IAcquisition = { settled: false };
+  promise.then(
+    (lease: IRequestLease) => {
+      acquisition.settled = true;
+      acquisition.lease = lease;
+    },
+    (error: unknown) => {
+      acquisition.settled = true;
+      acquisition.error = error;
+    }
+  );
+  return acquisition;
+}
+
+function createController(
+  admission: IDaemonRequestAdmissionOptions,
+  abortSignal: AbortSignal = new AbortController().signal
+): RequestAdmissionController {
+  return new RequestAdmissionController({ admission, client: { abortSignal }, requestId: 'request' });
+}
+
+/** Makes `controller` wait `waitMs` behind another request, on a scheduler of its own, and then be admitted. */
+async function waitBehindAnotherRequestAsync(
+  controller: RequestAdmissionController,
+  waitMs: number
+): Promise<void> {
+  const scheduler: RequestScheduler = new RequestScheduler();
+  const other: IRequestLease = await scheduler.acquireAsync({
+    exclusivityClass: RequestExclusivityClass.Exclusive
+  });
+  const waiting: IAcquisition = track(
+    controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild)
+  );
+  await jest.advanceTimersByTimeAsync(waitMs);
+  expect(waiting.settled).toBe(false);
+  other.release();
+  await jest.advanceTimersByTimeAsync(0);
+  expect(waiting.lease).toBeDefined();
+  waiting.lease?.release();
+}
+
+describe(RequestAdmissionController.name, () => {
+  let scheduler: RequestScheduler;
+  let owner: IRequestLease;
+  let transition: AdmissionProgress;
+
+  beforeEach(async () => {
+    jest.useFakeTimers();
+    scheduler = new RequestScheduler();
+    owner = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive });
+    transition = new AdmissionProgress();
+  });
+
+  afterEach(() => {
+    owner.release();
+    jest.useRealTimers();
+  });
+
+  it.each(BUDGETS)(
+    'does not spend $kind timeout while the transition it waits behind makes progress',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      transition.setActive(true);
+      const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+      await jest.advanceTimersByTimeAsync(999);
+      expect(waiting.settled).toBe(false);
+
+      scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+      transition.setActive(false);
+      await jest.advanceTimersByTimeAsync(0);
+      expect(waiting.settled).toBe(true);
+      expect(waiting.error).toBeUndefined();
+      expect(waiting.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+      waiting.lease?.release();
+      controller.dispose();
+    }
+  );
+
+  it.each(BUDGETS)(
+    'spends $kind timeout while the transition itself waits, and carries the rest across progress',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+      await jest.advanceTimersByTimeAsync(60);
+      transition.setActive(true);
+      await jest.advanceTimersByTimeAsync(900);
+      transition.setActive(false);
+      await jest.advanceTimersByTimeAsync(39);
+      expect(waiting.settled).toBe(false);
+
+      await jest.advanceTimersByTimeAsync(1);
+      expect(waiting.error).toMatchObject({
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message:
+          "The request was not admitted within its 100ms wait timeout while waiting for another request's load " +
+          'or reload of the workspace graph; 0.9s spent while that request loaded the graph did not count. ' +
+          'Use --wait-timeout <seconds> to wait longer.'
+      });
+      expect(scheduler.queuedRequestCount).toBe(0);
+      controller.dispose();
+    }
+  );
+
+  it.each(BUDGETS)(
+    'carries what is left of $kind timeout after it waits behind a transition to its later waits',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      const behind: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+      // The transition itself waits for 30ms, which the request spends, and then loads the graph.
+      await jest.advanceTimersByTimeAsync(30);
+      transition.setActive(true);
+      await jest.advanceTimersByTimeAsync(500);
+      scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+      transition.setActive(false);
+      await jest.advanceTimersByTimeAsync(0);
+      expect(behind.error).toBeUndefined();
+      behind.lease?.release();
+      expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 70 });
+      controller.dispose();
+    }
+  );
+
+  it('fails once the transition it waits behind has made progress for ten times its timeout', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(600);
+    // Time spent while the transition waits is budget, not paused time, so it does not advance the paused limit.
+    transition.setActive(false);
+    await jest.advanceTimersByTimeAsync(50);
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(399);
+    expect(waiting.settled).toBe(false);
+
+    await jest.advanceTimersByTimeAsync(1);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within 10 times its 100ms wait timeout because another request's load " +
+        'or reload of the workspace graph was still running after 1s. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it('limits the paused wait for the largest timeout to the timer range', async () => {
+    const client: AbortController = new AbortController();
+    const controller: RequestAdmissionController = createController(
+      { waitTimeoutMs: MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS },
+      client.signal
+    );
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    // A delay beyond the timer range would fire after 1ms.
+    await jest.advanceTimersByTimeAsync(10_000);
+    expect(waiting.settled).toBe(false);
+
+    client.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.Aborted });
+    controller.dispose();
+  });
+
+  it('fails at once behind a transition when the request does not wait', async () => {
+    const controller: RequestAdmissionController = createController({ noWait: true });
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.NoWait });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it('reports a zero timeout behind a transition as a plain timeout, not as the paused limit', async () => {
+    const controller: RequestAdmissionController = createController({ waitTimeoutMs: 0 });
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 0ms wait timeout while waiting for another request's load or " +
+        'reload of the workspace graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it('reports paused time that did not count when a later boundary times out', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    transition.setActive(true);
+    const behind: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(500);
+    scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+    transition.setActive(false);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(behind.error).toBeUndefined();
+    behind.lease?.release();
+    // A routing boundary receives a frozen copy of the remaining budget.
+    const remaining: IDaemonRequestAdmissionOptions | undefined = controller.remainingAdmission;
+    const boundary: RequestAdmissionController = new RequestAdmissionController({
+      admission: remaining && freezeDaemonRequestAdmissionOptions(remaining),
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'request'
+    });
+
+    const here: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.Exclusive));
+    const there: IAcquisition = track(boundary.acquireAsync(scheduler, RequestExclusivityClass.Exclusive));
+    await jest.advanceTimersByTimeAsync(99);
+    expect(here.settled || there.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    const error: { code: RequestSchedulerErrorCode; message: string } = {
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 100ms wait timeout while waiting for workspace admission; 0.5s ' +
+        'spent earlier while another request loaded the workspace graph did not count. ' +
+        'Use --wait-timeout <seconds> to wait longer.'
+    };
+    expect(here.error).toMatchObject(error);
+    expect(there.error).toMatchObject(error);
+    boundary.dispose();
+    controller.dispose();
+  });
+
+  it('reports cancellation behind a transition as an abort', async () => {
+    const client: AbortController = new AbortController();
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET, client.signal);
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    client.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.Aborted });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it.each(BUDGETS)(
+    'spends $kind timeout only while it waits, not on the work before and between its waits',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      // Such as capturing the request's inputs before its first wait.
+      await jest.advanceTimersByTimeAsync(10_000);
+      expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 100 });
+      await waitBehindAnotherRequestAsync(controller, 40);
+      // Such as loading the graph, routing and execution.
+      await jest.advanceTimersByTimeAsync(10_000);
+      expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 60 });
+
+      const waiting: IAcquisition = track(
+        controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild)
+      );
+      await jest.advanceTimersByTimeAsync(59);
+      expect(waiting.settled).toBe(false);
+      await jest.advanceTimersByTimeAsync(1);
+      expect(waiting.error).toMatchObject({
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message:
+          'The request was not admitted within its 100ms wait timeout while waiting for workspace admission. ' +
+          'Use --wait-timeout <seconds> to wait longer.'
+      });
+      controller.dispose();
+    }
+  );
+
+  it('does not spend a default timeout at the graph-execution gate, which it does not limit', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    const running: IAcquisition = track(
+      controller.acquireGraphExecutionAsync(scheduler, RequestExclusivityClass.SharedBuild)
+    );
+    await jest.advanceTimersByTimeAsync(10_000);
+    expect(running.settled).toBe(false);
+    owner.release();
+    await jest.advanceTimersByTimeAsync(0);
+    running.lease?.release();
+    expect(controller.remainingAdmission).toEqual({ ...DEFAULT_BUDGET, waitTimeoutMs: 100 });
+    controller.dispose();
+  });
+
+  it('spends an explicit timeout while it waits for progress of the running build', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    let makeProgress: (value: string) => void = () => undefined;
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>((resolve: (value: string) => void) => {
+        makeProgress = resolve;
+      })
+    );
+    await jest.advanceTimersByTimeAsync(40);
+    makeProgress('dispatched');
+    expect(await waiting).toBe('dispatched');
+    expect(controller.remainingAdmission).toEqual({ ...EXPLICIT_BUDGET, waitTimeoutMs: 60 });
+    controller.dispose();
+  });
+
+  it('stops waiting for progress of the running build once an explicit timeout is spent', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    let ended: boolean = false;
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>(() => undefined)
+    );
+    void waiting.then(() => {
+      ended = true;
+    });
+    await jest.advanceTimersByTimeAsync(99);
+    expect(ended).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(await waiting).toBeUndefined();
+    expect(controller.remainingAdmission).toEqual({ ...EXPLICIT_BUDGET, waitTimeoutMs: 0 });
+
+    // The graph-execution gate then has no time left to wait for the build either.
+    const running: IAcquisition = track(
+      controller.acquireGraphExecutionAsync(scheduler, RequestExclusivityClass.SharedBuild)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(running.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 100ms wait timeout while waiting for the running build of the ' +
+        'workspace operation graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    controller.dispose();
+  });
+
+  it('does not spend a default timeout while it waits for progress of the running build', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    let makeProgress: (value: string) => void = () => undefined;
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>((resolve: (value: string) => void) => {
+        makeProgress = resolve;
+      })
+    );
+    await jest.advanceTimersByTimeAsync(10_000);
+    makeProgress('dispatched');
+    expect(await waiting).toBe('dispatched');
+    expect(controller.remainingAdmission).toEqual({ ...DEFAULT_BUDGET, waitTimeoutMs: 100 });
+    controller.dispose();
+  });
+
+  it('stops waiting for progress of the running build when the request is cancelled', async () => {
+    const client: AbortController = new AbortController();
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET, client.signal);
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>(() => undefined)
+    );
+    const waitingError: Promise<void> = expect(waiting).rejects.toMatchObject({
+      code: RequestSchedulerErrorCode.Aborted
+    });
+
+    client.abort();
+    await jest.advanceTimersByTimeAsync(0);
+
+    await waitingError;
+    controller.dispose();
+  });
+
+  it('does not wait for progress of the running build when the request does not wait', async () => {
+    const controller: RequestAdmissionController = createController({ noWait: true });
+    expect(await controller.waitForGraphProgressAsync(new Promise<string>(() => undefined))).toBeUndefined();
+    controller.dispose();
+  });
+
+  it('names the configured timeout, not the remainder, when a later routing boundary times out', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    await waitBehindAnotherRequestAsync(controller, 23);
+    const remaining: IDaemonRequestAdmissionOptions | undefined = controller.remainingAdmission;
+    expect(remaining).toEqual({ ...EXPLICIT_BUDGET, waitTimeoutMs: 77 });
+    const boundary: RequestAdmissionController = new RequestAdmissionController({
+      admission: remaining,
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'request'
+    });
+    await waitBehindAnotherRequestAsync(boundary, 7);
+    // A boundary that hands its own remainder on again still names the client's timeout.
+    const nested: RequestAdmissionController = new RequestAdmissionController({
+      admission: boundary.remainingAdmission,
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'request'
+    });
+
+    const waiting: IAcquisition = track(
+      nested.acquireGraphExecutionAsync(scheduler, RequestExclusivityClass.SharedBuild)
+    );
+    await jest.advanceTimersByTimeAsync(69);
+    expect(waiting.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 100ms wait timeout while waiting for the running build of the ' +
+        'workspace operation graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    nested.dispose();
+    boundary.dispose();
+    controller.dispose();
+  });
+
+  it('reports no more running scripts to a request once its wait for them has ended', async () => {
+    const scripts: ServedScriptScheduler = new ServedScriptScheduler();
+    const [first, second, third]: IRequestLease[] = [
+      await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild }),
+      await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild }),
+      await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild })
+    ];
+    const restartReason: DaemonRestartReason = {
+      kind: 'workspaceInputsChanged',
+      installationFiles: ['common/config/rush/pnpm-lock.yaml']
+    };
+    const positions: IDaemonRequestQueuePositionMessage['payload'][] = [];
+    const controller: RequestAdmissionController = new RequestAdmissionController({
+      admission: EXPLICIT_BUDGET,
+      client: {
+        abortSignal: new AbortController().signal,
+        supportsRequestAdmission: true,
+        writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+          positions.push(message.payload);
+        }
+      },
+      requestId: 'request'
+    });
+    const waitingFor = (scriptCount: number): IDaemonRequestQueuePositionMessage['payload'] => ({
+      position: scriptCount,
+      requestId: 'request',
+      restartReason,
+      scriptCount
+    });
+
+    const waiting: Promise<void> = controller.waitForServedScriptsAsync(scripts, restartReason);
+    const ended: Promise<unknown> = waiting.catch((error: unknown) => error);
+    await jest.advanceTimersByTimeAsync(0);
+    third.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(positions).toEqual([waitingFor(3), waitingFor(2)]);
+
+    await jest.advanceTimersByTimeAsync(100);
+    expect(await ended).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    // A script that exits after the wait timed out, while another still runs, is not reported to the request.
+    second.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(positions).toEqual([waitingFor(3), waitingFor(2)]);
+    first.release();
+    controller.dispose();
+  });
+});
+
+describe('a request that stops the operations that finished requests left running', () => {
+  const CONTINUING: IDaemonContinuingOperations = { count: 2, names: ['a (build)', 'b (build)'] };
+  const STOPPING: IDaemonContinuingOperations = { ...CONTINUING, stopping: true };
+
+  interface IReportingController {
+    readonly controller: RequestAdmissionController;
+    readonly positions: IDaemonRequestQueuePositionMessage['payload'][];
+  }
+
+  function createReportingController(requestId: string): IReportingController {
+    const positions: IDaemonRequestQueuePositionMessage['payload'][] = [];
+    const controller: RequestAdmissionController = new RequestAdmissionController({
+      admission: {},
+      client: {
+        abortSignal: new AbortController().signal,
+        supportsRequestAdmission: true,
+        writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+          positions.push(message.payload);
+        }
+      },
+      requestId
+    });
+    return { controller, positions };
+  }
+
+  function acquireExclusiveAsync(
+    { controller }: IReportingController,
+    scheduler: RequestScheduler,
+    describeContinuingOperations: () => IDaemonContinuingOperations | undefined
+  ): Promise<IRequestLease> {
+    return controller.acquireAsync(
+      scheduler,
+      RequestExclusivityClass.Exclusive,
+      undefined,
+      describeContinuingOperations
+    );
+  }
+
+  it('names them as stopping while it waits first in the queue only for leases that are preemptible', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    // Like the work of a failed build that returned early, which is no longer described once it is stopped.
+    let continuing: IDaemonContinuingOperations | undefined = CONTINUING;
+    scheduler.markLeasePreemptible(leftover, () => (continuing = undefined));
+    const describeContinuing = (): IDaemonContinuingOperations | undefined => continuing;
+
+    const rebuild: IReportingController = createReportingController('rebuild');
+    const rebuildLease: Promise<IRequestLease> = acquireExclusiveAsync(
+      rebuild,
+      scheduler,
+      describeContinuing
+    );
+    expect(continuing).toBeUndefined();
+    // A later request queues while they stop, so the first one's position is reported again.
+    const later: IReportingController = createReportingController('later');
+    const laterLease: Promise<IRequestLease> = acquireExclusiveAsync(later, scheduler, describeContinuing);
+    leftover.release();
+    (await rebuildLease).release();
+    (await laterLease).release();
+
+    expect(rebuild.positions).toEqual([
+      { position: 1, requestId: 'rebuild', continuingOperations: STOPPING },
+      { position: 1, requestId: 'rebuild', continuingOperations: STOPPING }
+    ]);
+    // The later request waited for the first one, not only while the operations stopped.
+    expect(later.positions).toEqual([
+      { position: 2, requestId: 'later' },
+      { position: 1, requestId: 'later' }
+    ]);
+    rebuild.controller.dispose();
+    later.controller.dispose();
+  });
+
+  it('reports a plain position behind a lease that is not preemptible, or if no operation is named', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    scheduler.markLeasePreemptible(leftover, () => leftover.release());
+    const behindRunning: IReportingController = createReportingController('behind-running');
+    const behindRunningLease: Promise<IRequestLease> = acquireExclusiveAsync(
+      behindRunning,
+      scheduler,
+      () => CONTINUING
+    );
+    running.release();
+    (await behindRunningLease).release();
+    expect(behindRunning.positions).toEqual([{ position: 1, requestId: 'behind-running' }]);
+
+    const unnamed: IReportingController = createReportingController('unnamed');
+    const other: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    scheduler.markLeasePreemptible(other, () => other.release());
+    (await acquireExclusiveAsync(unnamed, scheduler, () => undefined)).release();
+    expect(unnamed.positions).toEqual([{ position: 1, requestId: 'unnamed' }]);
+    behindRunning.controller.dispose();
+    unnamed.controller.dispose();
+  });
+
+  it('names them as stopping to a request that already waited first when they were left running', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    // Nothing continues yet: the build's client still waits for its result.
+    let continuing: IDaemonContinuingOperations | undefined;
+    const rebuild: IReportingController = createReportingController('rebuild');
+    const rebuildLease: Promise<IRequestLease> = acquireExclusiveAsync(rebuild, scheduler, () => continuing);
+
+    // The build fails early: its result is out, and the operations that it leaves running stop for the rebuild.
+    continuing = CONTINUING;
+    scheduler.markLeasePreemptible(build, () => (continuing = undefined));
+    expect(continuing).toBeUndefined();
+    build.release();
+    (await rebuildLease).release();
+
+    expect(rebuild.positions).toEqual([
+      { position: 1, requestId: 'rebuild' },
+      { position: 1, requestId: 'rebuild', continuingOperations: STOPPING }
+    ]);
+    rebuild.controller.dispose();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
index 8ee10017396..ead56086280 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
@@ -1,8 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
 import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
-import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from '../WorkspaceRestartArbiter';
+import {
+  WorkspaceRestartArbiter,
+  type IWorkspaceRestartDrainOptions,
+  type IWorkspaceRestartRecheck,
+  type IWorkspaceRestartTicket,
+  type IWorkspaceRestartWaitReport,
+  type IWorkspaceRestartWaitResult
+} from '../WorkspaceRestartArbiter';
 
 const WAIT: { abortSignal: AbortSignal; noWait: undefined; waitTimeoutMs: undefined } = {
   abortSignal: new AbortController().signal,
@@ -10,6 +21,21 @@ const WAIT: { abortSignal: AbortSignal; noWait: undefined; waitTimeoutMs: undefi
   waitTimeoutMs: undefined
 };
 
+const LOCKFILE_CHANGED: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const ENVIRONMENT_CHANGED: DaemonRestartReason = {
+  kind: 'environmentChanged',
+  variableNames: ['NODE_OPTIONS', 'RUSH_BUILD_CACHE_ENABLED']
+};
+const VERSION_SELECTED: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  selectedRushVersion: '5.180.0'
+};
+
+type WaitReports = [number, IWorkspaceRestartWaitReport][];
+
 async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
   let settled: boolean = false;
   void promise.then(
@@ -20,6 +46,29 @@ async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
   return settled;
 }
 
+/** Answers each recheck from a list, repeating the last answer. An `Error` answer rejects. */
+class ScriptedRecheck implements IWorkspaceRestartRecheck {
+  public readonly intervalMs: number = 20;
+  public calls: number = 0;
+  readonly #answers: ReadonlyArray<boolean | Error>;
+
+  public constructor(answers: ReadonlyArray<boolean | Error>) {
+    this.#answers = answers;
+  }
+
+  public readonly stillNeedsRestartAsync: () => Promise<boolean> = async () => {
+    const answer: boolean | Error = this.#answers[Math.min(this.calls++, this.#answers.length - 1)];
+    if (answer instanceof Error) throw answer;
+    return answer;
+  };
+}
+
+function expectWaitTimeout(error: unknown): RequestSchedulerError {
+  expect(error).toBeInstanceOf(RequestSchedulerError);
+  expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+  return error as RequestSchedulerError;
+}
+
 describe(WorkspaceRestartArbiter.name, () => {
   it('proceeds immediately when no other request is being served', async () => {
     const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
@@ -35,8 +84,8 @@ describe(WorkspaceRestartArbiter.name, () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const first: IWorkspaceRestartTicket = arbiter.enter();
     const second: IWorkspaceRestartTicket = arbiter.enter();
-    const firstWait: Promise<void> = arbiter.waitForDrainAsync(first, WAIT);
-    const secondWait: Promise<void> = arbiter.waitForDrainAsync(second, WAIT);
+    const firstWait: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(first, WAIT);
+    const secondWait: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(second, WAIT);
     const late: IWorkspaceRestartTicket = arbiter.enter();
     arbiter.leave(serving);
     expect(await isSettledAsync(firstWait)).toBe(false);
@@ -58,7 +107,7 @@ describe(WorkspaceRestartArbiter.name, () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const ticket: IWorkspaceRestartTicket = arbiter.enter();
     const abort: AbortController = new AbortController();
-    const waiting: Promise<void> = arbiter.waitForDrainAsync(ticket, {
+    const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(ticket, {
       abortSignal: abort.signal,
       noWait: mode === 'no-wait' ? true : undefined,
       waitTimeoutMs: mode === 'timeout' ? 10 : undefined
@@ -72,4 +121,597 @@ describe(WorkspaceRestartArbiter.name, () => {
     arbiter.leave(serving);
     expect(arbiter.servingCount).toBe(0);
   });
-});
\ No newline at end of file
+
+  it('reports how many requests a restart candidate waits for, whenever that number changes', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const first: IWorkspaceRestartTicket = arbiter.enter();
+    const second: IWorkspaceRestartTicket = arbiter.enter();
+    const candidate: IWorkspaceRestartTicket = arbiter.enter();
+    const counts: number[] = [];
+    const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+      ...WAIT,
+      onServingCountChanged: (count: number) => counts.push(count)
+    });
+    expect(counts).toEqual([2]);
+    const late: IWorkspaceRestartTicket = arbiter.enter();
+    arbiter.leave(first);
+    arbiter.leave(second);
+    expect(counts).toEqual([2, 3, 2, 1]);
+    // Another restart candidate stops counting once it waits too; it then waits for the first candidate.
+    const other: IWorkspaceRestartTicket = arbiter.enter();
+    const otherCounts: number[] = [];
+    const otherWaiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(other, {
+      ...WAIT,
+      onServingCountChanged: (count: number) => otherCounts.push(count)
+    });
+    arbiter.leave(late);
+    await waiting;
+    expect(counts).toEqual([2, 3, 2, 1, 2, 1]);
+    expect(await isSettledAsync(otherWaiting)).toBe(false);
+    expect(otherCounts).toEqual([1]);
+    arbiter.leave(candidate);
+    await otherWaiting;
+    arbiter.leave(other);
+    expect(counts).toHaveLength(6);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('reports how many of the requests that a restart candidate waits for run a rushx script, and its reason', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+    const build: IWorkspaceRestartTicket = arbiter.enter();
+    const candidate: IWorkspaceRestartTicket = arbiter.enter();
+    const reports: WaitReports = [];
+    const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+      ...WAIT,
+      restartReason: LOCKFILE_CHANGED,
+      onServingCountChanged: (count: number, report: IWorkspaceRestartWaitReport) =>
+        reports.push([count, report])
+    });
+    arbiter.leave(script);
+    arbiter.leave(build);
+    await waiting;
+    expect(reports).toEqual([
+      [2, { scriptCount: 1, restartReason: LOCKFILE_CHANGED }],
+      [1, { scriptCount: 0, restartReason: LOCKFILE_CHANGED }]
+    ]);
+    arbiter.leave(candidate);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it.each([
+    [
+      'drain',
+      'no-wait',
+      LOCKFILE_CHANGED,
+      'The daemon is still serving other requests, which finish before it restarts because ' +
+        'common/config/rush/pnpm-lock.yaml changed; the request did not wait for a restart.'
+    ],
+    [
+      'drain',
+      'timeout',
+      ENVIRONMENT_CHANGED,
+      "The request was not admitted before the daemon could restart because this request's environment differs " +
+        "from the daemon's in NODE_OPTIONS and RUSH_BUILD_CACHE_ENABLED. The restart waits for the requests that " +
+        'the daemon is serving to finish. Use --wait-timeout <seconds> to wait longer.'
+    ],
+    [
+      'pending restart',
+      'no-wait',
+      ENVIRONMENT_CHANGED,
+      "Another request is waiting to restart the daemon because its environment differs from the daemon's in " +
+        'NODE_OPTIONS and RUSH_BUILD_CACHE_ENABLED; the rushx script did not wait for the restart.'
+    ],
+    [
+      'pending restart',
+      'timeout',
+      VERSION_SELECTED,
+      'The rushx script was not admitted before the daemon could restart for another request, because it selects ' +
+        'Rush 5.180.0. A script waits for a pending restart so that the restart does not wait for the script, and ' +
+        'the restart waits for the requests that the daemon is serving to finish. Use --wait-timeout <seconds> to ' +
+        'wait longer.'
+    ]
+  ])('names the restart reason when a %s wait fails with %s', async (wait, mode, restartReason, message) => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const build: IWorkspaceRestartTicket = arbiter.enter();
+    const candidate: IWorkspaceRestartTicket = arbiter.enter();
+    const options: IWorkspaceRestartDrainOptions = {
+      ...WAIT,
+      noWait: mode === 'no-wait' ? true : undefined,
+      waitTimeoutMs: mode === 'timeout' ? 10 : undefined
+    };
+    let error: unknown;
+    if (wait === 'drain') {
+      error = await arbiter
+        .waitForDrainAsync(candidate, { ...options, restartReason })
+        .catch((caught: unknown) => caught);
+    } else {
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+        ...WAIT,
+        restartReason
+      });
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      error = await arbiter.waitForPendingRestartAsync(script, options).catch((caught: unknown) => caught);
+      arbiter.leave(script);
+      arbiter.leave(build);
+      await draining;
+    }
+    expect((error as Error).message).toBe(message);
+    for (const ticket of [build, candidate]) arbiter.leave(ticket);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('reports no count for a candidate that does not wait', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const counts: number[] = [];
+    await arbiter.waitForDrainAsync(ticket, {
+      ...WAIT,
+      onServingCountChanged: (count: number) => counts.push(count)
+    });
+    const serving: IWorkspaceRestartTicket = arbiter.enter();
+    const noWait: IWorkspaceRestartTicket = arbiter.enter();
+    const error: unknown = await arbiter
+      .waitForDrainAsync(noWait, {
+        ...WAIT,
+        noWait: true,
+        onServingCountChanged: (count: number) => counts.push(count)
+      })
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    expect(counts).toEqual([]);
+    for (const served of [ticket, serving, noWait]) arbiter.leave(served);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  describe('with waivesTimeoutForServedWork', () => {
+    const WAIVED: IWorkspaceRestartDrainOptions = {
+      ...WAIT,
+      waitTimeoutMs: 50,
+      waivesTimeoutForServedWork: true
+    };
+
+    it('does not spend the timeout on requests served when the wait began, and returns that time', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      expect((await waiting).waivedMs).toBeGreaterThanOrEqual(140);
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout on requests that arrived after the wait began, once the earlier ones finish', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      const late: IWorkspaceRestartTicket = arbiter.enter();
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      const error: RequestSchedulerError = expectWaitTimeout(
+        await waiting.catch((caught: unknown) => caught)
+      );
+      expect(error.message).not.toContain('rushx');
+      expect(error.message).toMatch(
+        /to finish; \d+(\.\d)?s spent waiting for requests that were already running did not count\. Use --wait-timeout <seconds> to wait longer\.$/
+      );
+      for (const served of [candidate, late]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout on a rushx script, and says that the script may not exit', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const error: RequestSchedulerError = expectWaitTimeout(
+        await arbiter.waitForDrainAsync(candidate, WAIVED).catch((caught: unknown) => caught)
+      );
+      expect(error.message).toContain(
+        ', including a rushx script that may not exit until it is stopped. Stop the script, or use --wait-timeout'
+      );
+      for (const served of [candidate, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout while a rushx script is served, even next to an earlier build', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const outcome: Promise<unknown> = arbiter
+        .waitForDrainAsync(candidate, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(true);
+      expect(expectWaitTimeout(await outcome).message).toContain('including a rushx script');
+      for (const served of [candidate, earlier, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('stops spending the timeout when the rushx script exits while an earlier build is served', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      arbiter.leave(script);
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      expect((await waiting).waivedMs).toBeGreaterThanOrEqual(140);
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout once a rushx script arrives during the wait', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const outcome: Promise<unknown> = arbiter
+        .waitForDrainAsync(candidate, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(100);
+      expect(await isSettledAsync(outcome)).toBe(false);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(true);
+      expect(expectWaitTimeout(await outcome).message).toMatch(
+        /, including a rushx script that may not exit until it is stopped; \d+(\.\d)?s spent waiting for requests that were already running did not count\. Stop the script, or use --wait-timeout/
+      );
+      for (const served of [candidate, earlier, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('returns 0 when the timeout is not waived', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+        ...WAIT,
+        waitTimeoutMs: 5_000
+      });
+      await delayAsync(20);
+      arbiter.leave(earlier);
+      expect((await waiting).waivedMs).toBe(0);
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+  });
+
+  describe('for a rushx script while a restart is pending', () => {
+    const WAIVED: IWorkspaceRestartDrainOptions = {
+      ...WAIT,
+      waitTimeoutMs: 50,
+      waivesTimeoutForServedWork: true
+    };
+
+    it('reports a restart as pending from the start of its drain until the candidate leaves', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      expect(arbiter.hasPendingRestart(running)).toBe(false);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
+      expect(arbiter.hasPendingRestart(running)).toBe(true);
+      expect(arbiter.hasPendingRestart(candidate)).toBe(false);
+      arbiter.leave(running);
+      await draining;
+      // After its drain, the candidate still waits for #gate and plans the restart, so a new script must not start.
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      expect(arbiter.hasPendingRestart(script)).toBe(true);
+      arbiter.leave(candidate);
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('proceeds immediately when no restart is pending', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const counts: number[] = [];
+      const { waivedMs } = await arbiter.waitForPendingRestartAsync(script, {
+        ...WAIT,
+        noWait: true,
+        onServingCountChanged: (count: number) => counts.push(count)
+      });
+      expect(waivedMs).toBe(0);
+      expect(counts).toEqual([]);
+      expect(arbiter.servingCount).toBe(2);
+      for (const served of [script, serving]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('waits until the candidate leaves, and the drain does not wait for the waiting script', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const counts: number[] = [];
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, {
+        ...WAIT,
+        onServingCountChanged: (count: number) => counts.push(count)
+      });
+      // The script waits for the running script and for the candidate.
+      expect(counts).toEqual([2]);
+      arbiter.leave(running);
+      await draining;
+      expect(counts).toEqual([2, 1]);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(candidate);
+      expect((await waiting).waivedMs).toBe(0);
+      expect(arbiter.servingCount).toBe(1);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('tells the script why the daemon restarts, and again when another request then needs the restart', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const first: IWorkspaceRestartTicket = arbiter.enter();
+      await arbiter.waitForDrainAsync(first, { ...WAIT, restartReason: LOCKFILE_CHANGED });
+      const build: IWorkspaceRestartTicket = arbiter.enter();
+      const second: IWorkspaceRestartTicket = arbiter.enter();
+      const secondDrain: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(second, {
+        ...WAIT,
+        restartReason: ENVIRONMENT_CHANGED
+      });
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const reports: WaitReports = [];
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, {
+        ...WAIT,
+        onServingCountChanged: (count: number, report: IWorkspaceRestartWaitReport) =>
+          reports.push([count, report])
+      });
+      // The first candidate finds after its drain that it no longer needs the restart; it is still served.
+      arbiter.withdrawRestart(first);
+      arbiter.leave(first);
+      arbiter.leave(build);
+      await secondDrain;
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(second);
+      await waiting;
+      expect(reports).toEqual([
+        [3, { scriptCount: 0, restartReason: LOCKFILE_CHANGED }],
+        [3, { scriptCount: 0, restartReason: ENVIRONMENT_CHANGED }],
+        [2, { scriptCount: 0, restartReason: ENVIRONMENT_CHANGED }],
+        [1, { scriptCount: 0, restartReason: ENVIRONMENT_CHANGED }]
+      ]);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('waits for every pending restart', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const first: IWorkspaceRestartTicket = arbiter.enter();
+      const second: IWorkspaceRestartTicket = arbiter.enter();
+      const firstDrain: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(first, WAIT);
+      const secondDrain: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(second, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      arbiter.leave(running);
+      await firstDrain;
+      arbiter.leave(first);
+      await secondDrain;
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(second);
+      await waiting;
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it.each([
+      ['no-wait', RequestSchedulerErrorCode.NoWait, 'the rushx script did not wait for the restart.'],
+      [
+        'timeout',
+        RequestSchedulerErrorCode.WaitTimeout,
+        "The rushx script was not admitted before the daemon could restart for another request's environment. " +
+          'A script waits for a pending restart so that the restart does not wait for the script, and the ' +
+          'restart waits for the requests that the daemon is serving to finish, including a rushx script that ' +
+          'may not exit until it is stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
+      ],
+      ['abort', RequestSchedulerErrorCode.Aborted, 'The request was aborted before execution.']
+    ])(
+      'reports %s as an admission failure and counts the script as served again',
+      async (mode, code, text) => {
+        const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+        const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+        const candidate: IWorkspaceRestartTicket = arbiter.enter();
+        const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
+        const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+        const abort: AbortController = new AbortController();
+        const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, {
+          abortSignal: abort.signal,
+          noWait: mode === 'no-wait' ? true : undefined,
+          waitTimeoutMs: mode === 'timeout' ? 10 : undefined
+        });
+        if (mode === 'abort') abort.abort();
+        const error: unknown = await waiting.catch((caught: unknown) => caught);
+        expect(error).toBeInstanceOf(RequestSchedulerError);
+        expect((error as RequestSchedulerError).code).toBe(code);
+        expect((error as Error).message).toContain(text);
+        expect(arbiter.servingCount).toBe(2);
+        arbiter.leave(running);
+        expect(await isSettledAsync(draining)).toBe(false);
+        arbiter.leave(script);
+        await draining;
+        arbiter.leave(candidate);
+        expect(arbiter.servingCount).toBe(0);
+      }
+    );
+
+    it('with waivesTimeoutForServedWork, does not spend the timeout while an earlier build is served', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIVED);
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      await draining;
+      arbiter.leave(candidate);
+      expect((await waiting).waivedMs).toBeGreaterThanOrEqual(140);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('with waivesTimeoutForServedWork, spends the timeout once the drain ends, and names the waived time', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const outcome: Promise<unknown> = arbiter
+        .waitForPendingRestartAsync(script, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(false);
+      arbiter.leave(earlier);
+      await draining;
+      const error: RequestSchedulerError = expectWaitTimeout(await outcome);
+      expect(error.message).toMatch(/^The rushx script was not admitted before the daemon could restart/);
+      expect(error.message).toMatch(
+        /to finish; \d+(\.\d)?s spent waiting for requests that were already running did not count\. Use --wait-timeout <seconds> to wait longer\.$/
+      );
+      for (const served of [candidate, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('with waivesTimeoutForServedWork, spends the timeout while a rushx script is served', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const outcome: Promise<unknown> = arbiter
+        .waitForPendingRestartAsync(script, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(true);
+      expect(expectWaitTimeout(await outcome).message).toContain('including a rushx script');
+      for (const served of [running, earlier, script]) arbiter.leave(served);
+      await draining;
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+  });
+
+  describe('rechecks while a restart candidate drains', () => {
+    it('withdraws the restart once it is no longer needed, while other requests are served, and wakes scripts', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const recheck: ScriptedRecheck = new ScriptedRecheck([true, false]);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT, recheck);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      expect(arbiter.hasPendingRestart(script)).toBe(true);
+      expect(await draining).toEqual({ waivedMs: 0, restartWithdrawn: true });
+      expect(recheck.calls).toBe(2);
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      await waiting;
+      expect(arbiter.servingCount).toBe(3);
+      for (const served of [serving, candidate, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('keeps waiting while the restart is still needed, and stops rechecking once the drain ends', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const recheck: ScriptedRecheck = new ScriptedRecheck([true]);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT, recheck);
+      await delayAsync(150);
+      expect(await isSettledAsync(draining)).toBe(false);
+      expect(recheck.calls).toBeGreaterThanOrEqual(2);
+      arbiter.leave(serving);
+      expect(await draining).toEqual({ waivedMs: 0, restartWithdrawn: false });
+      const calls: number = recheck.calls;
+      await delayAsync(100);
+      expect(recheck.calls).toBe(calls);
+      // The restart stays pending until the candidate plans it and leaves.
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      expect(arbiter.hasPendingRestart(script)).toBe(true);
+      arbiter.leave(candidate);
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('counts a recheck that fails as still needing the restart, and tries again', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const recheck: ScriptedRecheck = new ScriptedRecheck([new Error('rush.json was being rewritten'), false]);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT, recheck);
+      expect(await draining).toEqual({ waivedMs: 0, restartWithdrawn: true });
+      expect(recheck.calls).toBe(2);
+      arbiter.leave(candidate);
+      arbiter.leave(serving);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it.each(['timeout', 'abort'])(
+      'still reports a %s while a recheck runs, and ignores the recheck once the wait has failed',
+      async (mode) => {
+        const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+        const serving: IWorkspaceRestartTicket = arbiter.enter();
+        const candidate: IWorkspaceRestartTicket = arbiter.enter();
+        let finishRecheck: ((stillNeeded: boolean) => void) | undefined;
+        const recheck: IWorkspaceRestartRecheck = {
+          intervalMs: 10,
+          stillNeedsRestartAsync: () =>
+            new Promise<boolean>((resolve) => {
+              finishRecheck = resolve;
+            })
+        };
+        const abort: AbortController = new AbortController();
+        const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(
+          candidate,
+          { ...WAIT, abortSignal: abort.signal, waitTimeoutMs: mode === 'timeout' ? 100 : undefined },
+          recheck
+        );
+        await delayAsync(50);
+        expect(finishRecheck).toBeDefined();
+        if (mode === 'abort') abort.abort();
+        const error: unknown = await waiting.catch((caught: unknown) => caught);
+        expect((error as RequestSchedulerError).code).toBe(
+          mode === 'timeout' ? RequestSchedulerErrorCode.WaitTimeout : RequestSchedulerErrorCode.Aborted
+        );
+        finishRecheck!(false);
+        await delayAsync(50);
+        // The request fails and leaves; until then, its restart is still pending.
+        const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+        expect(arbiter.hasPendingRestart(script)).toBe(true);
+        for (const served of [candidate, serving, script]) arbiter.leave(served);
+        expect(arbiter.servingCount).toBe(0);
+      }
+    );
+
+    it('lets a request that drained withdraw its restart, which wakes scripts that wait for it', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      expect(await arbiter.waitForDrainAsync(candidate, WAIT)).toEqual({ waivedMs: 0, restartWithdrawn: false });
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      // Only a restart candidate has a restart to withdraw.
+      arbiter.withdrawRestart(script);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.withdrawRestart(candidate);
+      expect(await waiting).toEqual({ waivedMs: 0, restartWithdrawn: false });
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      arbiter.leave(candidate);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
index 557c54ddc5b..9bd57768eae 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
@@ -5,16 +5,27 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import { Rush, WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import { DaemonFrameType, decodeDaemonControlMessage } from '@rushstack/rush-daemon-protocol';
+import type { DaemonControlMessage, IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 
 jest.setTimeout(60_000);
 
+function getQueuePositions(exchange: ITerminalExchange): number[] {
+  return exchange.frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .flatMap((message: DaemonControlMessage) =>
+      message.kind === 'queuePosition' ? [message.payload.position] : []
+    );
+}
+
 it('queues a mismatched-environment restart until matching queued and in-flight requests drain', async () => {
   const fixture = await DaemonGraphTestFixture.createAsync((created) => {
     setDaemonPolicy(created, {});
@@ -23,8 +34,10 @@ it('queues a mismatched-environment restart until matching queued and in-flight
     created.write('hold', '');
     created.write(
       'c/build.cjs',
-      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
-        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      withScriptDeadline(
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+          "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      )
     );
   });
   const order: string[] = [];
@@ -64,11 +77,20 @@ it('queues a mismatched-environment restart until matching queued and in-flight
       payload: { exitCode: 1, retryAfterRestart: true }
     });
     expect(order[order.length - 1]).toBe('mismatched');
+    // The client is told how many requests the restart waits for: 2 while both matching requests are open, then 1.
+    const positions: number[] = getQueuePositions(restart);
+    expect(positions).toContain(2);
+    expect(positions[positions.length - 1]).toBe(1);
 
     const restarted = await fixture.host.restartCompleted;
     expect(restarted?.pid).not.toBe(before.pid);
     expect((await pongAsync(fixture)).pid).toBe(restarted?.pid);
     expect(fixture.runs()).not.toContain('b');
+    // The shutdown line only: the daemon may log other lines about the restart before it.
+    expect(fixture.logs.filter((line: string) => line.includes(' shutting down: '))).toEqual([
+      `rushd (PID ${process.pid}) shutting down: restarting for Rush ${Rush.version}, ` +
+        'because a request needs a new process'
+    ]);
   } finally {
     fs.rmSync(path.join(fixture.folder, 'hold'), { force: true });
     try {
@@ -79,4 +101,4 @@ it('queues a mismatched-environment restart until matching queued and in-flight
       await fixture[Symbol.asyncDispose]();
     }
   }
-});
\ No newline at end of file
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
new file mode 100644
index 00000000000..60e433107c2
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -0,0 +1,1233 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync)
+  };
+});
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import {
+  captureWorkspaceInputFingerprintAsync,
+  type IWorkspaceInputFingerprint,
+  WorkspaceInputChangeTier,
+  WorkspaceRuntimeFingerprintCache
+} from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type DaemonRestartReason,
+  type IDaemonCommandResult,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import { DaemonGraphTestFixture, responseSnapshot, withScriptDeadline } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+const RELEASE_FILE: string = 'release-serve';
+const LATE_RELEASE_FILE: string = 'release-serve2';
+const inputCaptureMock: jest.MockedFunction<typeof captureWorkspaceInputFingerprintAsync> = jest.mocked(
+  captureWorkspaceInputFingerprintAsync
+);
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+/**
+ * Project a's `serve` and `serve2` scripts run, like dev servers, until the test creates their release files,
+ * `release-serve` and `release-serve2`.
+ */
+function createServingFixtureAsync(
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created) => {
+    created.servesRushx = true;
+    created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-*\n');
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: {
+          '_phase:compile': 'node build.cjs',
+          serve: 'node serve.cjs',
+          serve2: 'node serve.cjs serve2'
+        }
+      })
+    );
+    created.write(
+      'a/serve.cjs',
+      withScriptDeadline(
+        "const fs=require('node:fs');const n=process.argv[2]||'serve';fs.appendFileSync('../runs.txt',n+'-start\\n');" +
+          "const t=setInterval(()=>{if(fs.existsSync('../release-'+n)){clearInterval(t);" +
+          "fs.appendFileSync('../runs.txt',n+'-end\\n');}},20);"
+      )
+    );
+    configure?.(created);
+  });
+}
+
+interface IServedScript {
+  readonly exchange: Promise<ITerminalExchange>;
+  readonly settled: () => boolean;
+}
+
+async function serveAsync(
+  fixture: DaemonGraphTestFixture,
+  script: 'serve' | 'serve2' = 'serve'
+): Promise<IServedScript> {
+  let settled: boolean = false;
+  const exchange: Promise<ITerminalExchange> = fixture
+    .runAsync([script], {
+      commandOrigin: 'custom',
+      invocationKind: 'rushx',
+      cwd: path.join(fixture.folder, 'a')
+    })
+    .finally(() => {
+      settled = true;
+    });
+  await waitForAsync(
+    () => fixture.runs().includes(`${script}-start`) || settled,
+    'the served script to start'
+  );
+  expect(settled).toBe(false);
+  return { exchange, settled: () => settled };
+}
+
+interface IStreamedRequest {
+  readonly exchange: Promise<ITerminalExchange>;
+  readonly requestId: string;
+  /** The queue positions that the daemon has reported so far. */
+  readonly positions: ReadonlyArray<number>;
+  /** The payloads of those queue position messages. */
+  readonly positionPayloads: ReadonlyArray<IDaemonRequestQueuePositionMessage['payload']>;
+  readonly settled: () => boolean;
+}
+
+/** Starts a request, recording its queue positions as they arrive. */
+async function startRequestAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope>
+): Promise<IStreamedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const payload: IDaemonRequestEnvelope = fixture.envelope(argv, overrides);
+  await client.sendControlAsync({ kind: 'requestStart', payload });
+  const positions: number[] = [];
+  const positionPayloads: IDaemonRequestQueuePositionMessage['payload'][] = [];
+  let settled: boolean = false;
+  const readAsync = async (): Promise<ITerminalExchange> => {
+    const frames: IDaemonFrame[] = [];
+    try {
+      for (;;) {
+        const frame: IDaemonFrame = await client.readFrameAsync();
+        frames.push(frame);
+        if (frame.kind !== DaemonFrameType.controlJson) continue;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'queuePosition') {
+          positions.push(message.payload.position);
+          positionPayloads.push(message.payload);
+        }
+        if (message.kind === 'requestResult' && message.payload.requestId === payload.requestId) {
+          return { frames, terminal: message };
+        }
+      }
+    } finally {
+      settled = true;
+      await client.closeAsync();
+    }
+  };
+  const exchange: Promise<ITerminalExchange> = readAsync();
+  // A failed expectation leaves the exchange unread until the fixture closes the connection.
+  exchange.catch(() => undefined);
+  return { exchange, requestId: payload.requestId, positions, positionPayloads, settled: () => settled };
+}
+
+/**
+ * Changes an input that only a new daemon process picks up, as an install does, and returns a function that
+ * restores its content.
+ */
+function changeInstallation(fixture: DaemonGraphTestFixture): () => void {
+  const filePath: string = path.join(fixture.folder, 'common/config/rush/npm-shrinkwrap.json');
+  const original: string = fs.readFileSync(filePath, 'utf8');
+  fs.writeFileSync(filePath, `${original}\n`);
+  return () => fs.writeFileSync(filePath, original);
+}
+
+async function closeRestartingFixtureAsync(fixture: DaemonGraphTestFixture): Promise<void> {
+  try {
+    await fixture.host.closeAsync();
+    await fixture.host.restartCompleted;
+  } finally {
+    await stopSuccessorAsync(fixture.host.paths);
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
+  const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+  const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+}
+
+describe('workspace admission while a served rushx script runs', () => {
+  it('admits a reload-needing build at once and keeps the script running', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync();
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeProjectConfiguration(fixture);
+      // The reload used to wait for #gate until the script exited.
+      expectSuccess(await fixture.runAsync(BUILD_A, { admission: { waitTimeoutMs: 3000 } }));
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect(fixture.runs().slice(-1)).toEqual(['serve-end']);
+    } finally {
+      // A failed expectation must not leave the script running, which would keep the fixture from shutting down.
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('keeps a native install waiting for the script, which would end with this process', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The install is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const install: IStreamedRequest = await startRequestAsync(fixture, ['install'], {
+        admission: { waitTimeoutMs: 500 }
+      });
+      expect((await install.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage: expect.stringContaining(
+            'within its 500ms wait timeout while waiting for a rushx script that this daemon runs to exit.'
+          )
+        }
+      });
+      // The install runs once the script exits, and then restarts the daemon, so its client names no reason.
+      expect(install.positionPayloads).toEqual([
+        { position: 1, requestId: install.requestId, scriptCount: 1 }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect(fixture.runs().slice(-1)).toEqual(['serve-end']);
+      // The refused install left the workspace serving builds.
+      expectSuccess(await fixture.runAsync(BUILD_A));
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('restarts for a changed environment only after the script exits', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      let restartSettled: boolean = false;
+      const restart: Promise<ITerminalExchange> = fixture
+        .runAsync(BUILD_A, { environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' } })
+        .finally(() => {
+          restartSettled = true;
+        });
+      await delayAsync(1000);
+      // The script keeps its restart ticket after it releases #gate, so the restart still drains it.
+      expect(restartSettled).toBe(false);
+      expect(script.settled()).toBe(false);
+      expect(fixture.host.workspaceStatus.lastReloadTier).not.toBe(WorkspaceInputChangeTier.Restart);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect(fixture.runs().slice(-1)).toEqual(['serve-end']);
+      expect((await restart).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      try {
+        await fixture.host.closeAsync();
+        await fixture.host.restartCompleted;
+      } finally {
+        await stopSuccessorAsync(fixture.host.paths);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  });
+
+  it('has a script that arrives while a restart is pending run on the successor, without delaying the restart', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const restart: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+      });
+      await waitForAsync(
+        () => restart.positions.length > 0 || restart.settled(),
+        'the restart to wait for the served script'
+      );
+      const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
+        commandOrigin: 'custom',
+        invocationKind: 'rushx',
+        cwd: path.join(fixture.folder, 'a')
+      });
+      await waitForAsync(
+        () => late.positions.length > 0 || late.settled() || fixture.runs().includes('serve2-start'),
+        'the later script to wait for the restart'
+      );
+      // The later script used to start and keep the restart waiting until it exited.
+      expect(fixture.runs()).not.toContain('serve2-start');
+      // It waits for the served script and the restart.
+      expect(late.positions).toEqual([2]);
+      const restartReason: DaemonRestartReason = {
+        kind: 'environmentChanged',
+        variableNames: ['RUSHD_RELOAD_TIER_TEST']
+      };
+      await waitForAsync(
+        () => restart.positionPayloads.length >= 3 || restart.settled(),
+        'the restart to stop counting the later script'
+      );
+      expect(restart.positionPayloads).toEqual([
+        { position: 1, requestId: restart.requestId, restartReason, scriptCount: 1 },
+        // The later script counts until it finds that a restart is pending.
+        { position: 2, requestId: restart.requestId, restartReason, scriptCount: 2 },
+        { position: 1, requestId: restart.requestId, restartReason, scriptCount: 1 }
+      ]);
+      expect(late.positionPayloads).toEqual([
+        {
+          position: 2,
+          requestId: late.requestId,
+          restartReason,
+          scriptCount: 1,
+          restartsForAnotherRequest: true
+        }
+      ]);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      // The restart does not wait for the later script, which is told to run on the successor.
+      for (const exchange of await Promise.all([restart.exchange, late.exchange])) {
+        expect(exchange.terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, retryAfterRestart: true }
+        });
+      }
+      expect(late.positions).toEqual([2, 1]);
+      expect(late.positionPayloads[1]).toEqual({
+        position: 1,
+        requestId: late.requestId,
+        restartReason,
+        restartsForAnotherRequest: true
+      });
+      expect(fixture.runs()).not.toContain('serve2-start');
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      try {
+        await fixture.host.closeAsync();
+        await fixture.host.restartCompleted;
+      } finally {
+        await stopSuccessorAsync(fixture.host.paths);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  });
+});
+
+describe('a restart drain whose change is reverted', () => {
+  const SERVE2: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom', invocationKind: 'rushx' };
+
+  it('serves the request on this process, while the script that holds the drain still runs', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      // A transition would cancel the watcher, and a request that arrives when nothing needs one does not transition.
+      const watch: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'watch'], {});
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(
+        () => build.positions.length > 0 || build.settled(),
+        'the build to wait for the drain'
+      );
+      const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
+        ...SERVE2,
+        cwd: path.join(fixture.folder, 'a')
+      });
+      await waitForAsync(
+        () => late.positions.length > 0 || late.settled(),
+        'the script to wait for the restart'
+      );
+      // Several rechecks find that the change is still there.
+      await delayAsync(2500);
+      expect(build.settled()).toBe(false);
+      expect(fixture.runs()).not.toContain('serve2-start');
+
+      const revertedAt: number = Date.now();
+      revert();
+      // The build used to wait for the script to exit, which a dev server never does.
+      expectSuccess(await build.exchange);
+      expect(Date.now() - revertedAt).toBeLessThan(5000);
+      expect(script.settled()).toBe(false);
+      // The later script no longer waits for a restart either.
+      await waitForAsync(() => fixture.runs().includes('serve2-start'), 'the later script to start');
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+      expect(fixture.host.workspaceStatus.lastReloadTier).not.toBe(WorkspaceInputChangeTier.Restart);
+      expect(watch.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expectSuccess(await late.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('serves a graph control request on this process', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const pause: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'pause'], {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(
+        () => pause.positions.length > 0 || pause.settled(),
+        'the request to wait for the drain'
+      );
+      await delayAsync(1500);
+      expect(pause.settled()).toBe(false);
+      // Like a build, the request is told why it waits.
+      expect(pause.positionPayloads[0]).toEqual({
+        position: 1,
+        requestId: pause.requestId,
+        restartReason: {
+          kind: 'workspaceInputsChanged',
+          installationFiles: ['common/config/rush/npm-shrinkwrap.json']
+        },
+        scriptCount: 1
+      });
+
+      const revertedAt: number = Date.now();
+      revert();
+      expect(responseSnapshot(await pause.exchange)).toMatchObject({ pauseNextIteration: true });
+      expect(Date.now() - revertedAt).toBeLessThan(5000);
+      expect(script.settled()).toBe(false);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('still restarts after the drain when the change stays', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeInstallation(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(
+        () => build.positions.length > 0 || build.settled(),
+        'the build to wait for the drain'
+      );
+      await delayAsync(2500);
+      expect(build.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect((await build.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('does not keep scripts waiting when the request finds after its drain that it no longer needs the restart', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      // Project c builds until the test creates release-build.
+      created.write(
+        'c/build.cjs',
+        withScriptDeadline(
+          "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c-start\\n');" +
+            "const t=setInterval(()=>{if(fs.existsSync('../release-build')){clearInterval(t);" +
+            "fs.appendFileSync('../runs.txt','c-end\\n');}},20);"
+        )
+      );
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, ['build', '--to', 'c'], {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(
+        () => build.positions.length > 0 || build.settled(),
+        'the build to wait for the drain'
+      );
+      const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
+        ...SERVE2,
+        cwd: path.join(fixture.folder, 'a')
+      });
+      await waitForAsync(
+        () => late.positions.length > 0 || late.settled(),
+        'the script to wait for the restart'
+      );
+
+      // The drain ends as the script exits, so the build most likely finds the revert only after the drain.
+      revert();
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      await waitForAsync(() => fixture.runs().includes('c-start'), 'the build to start');
+      // The later script used to wait for the build to finish, since its restart stayed pending.
+      await waitForAsync(() => fixture.runs().includes('serve2-start'), 'the later script to start');
+      expect(fixture.runs()).not.toContain('c-end');
+
+      fixture.write('release-build', '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      expectSuccess(await build.exchange);
+      expectSuccess(await late.exchange);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      fixture.write('release-build', '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('shares one capture a second between the requests that wait for the drain', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const builds: IStreamedRequest[] = [];
+      // The requests arrive over about a second, so each one's checks would start at another time.
+      for (let i: number = 0; i < 16; i++) {
+        builds.push(await startRequestAsync(fixture, BUILD_A, { admission: { waitTimeoutMs: 20_000 } }));
+        await delayAsync(60);
+      }
+      await waitForAsync(
+        () => builds.every((build) => build.positions.length > 0 || build.settled()),
+        'every build to wait for the drain'
+      );
+      inputCaptureMock.mockClear();
+      await delayAsync(3000);
+      // Each waiting request used to capture its inputs once a second, 16 captures a second in all.
+      const captures: number = inputCaptureMock.mock.calls.length;
+      expect(captures).toBeGreaterThanOrEqual(2);
+      expect(captures).toBeLessThanOrEqual(5);
+      expect(builds.some((build) => build.settled())).toBe(false);
+
+      const revertedAt: number = Date.now();
+      revert();
+      for (const build of builds) {
+        expectSuccess(await build.exchange);
+      }
+      expect(Date.now() - revertedAt).toBeLessThan(10_000);
+      expect(script.settled()).toBe(false);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('does not check again for a request that needs the restart for its environment, so the others see their revert', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    const capturesOfChangedEnvironment: () => number = () =>
+      inputCaptureMock.mock.calls.filter(
+        ([options]) => options.environment.RUSHD_RELOAD_TIER_TEST === 'changed'
+      ).length;
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const changed: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' },
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => changed.positions.length > 0 || changed.settled(), 'the first build to wait');
+      // Each second, its check would start about 0.3 s before the second build's, which would then share it.
+      await delayAsync(300);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the second build to wait');
+      inputCaptureMock.mockClear();
+      await delayAsync(2500);
+      expect(capturesOfChangedEnvironment()).toBe(0);
+      expect(changed.settled()).toBe(false);
+      expect(build.settled()).toBe(false);
+
+      const revertedAt: number = Date.now();
+      revert();
+      expectSuccess(await build.exchange);
+      expect(Date.now() - revertedAt).toBeLessThan(5000);
+      // A request's environment does not change, so the first build still waits for the restart.
+      expect(changed.settled()).toBe(false);
+      expect(capturesOfChangedEnvironment()).toBe(0);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect((await changed.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+});
+
+describe('the reason for a restart that waits for a served rushx script', () => {
+  const actualCaptureAsync: typeof captureWorkspaceInputFingerprintAsync =
+    jest.requireActual<typeof import('@microsoft/rush-lib')>(
+      '@microsoft/rush-lib'
+    ).captureWorkspaceInputFingerprintAsync;
+
+  /** Makes every later capture of the workspace inputs report the given change. */
+  function changeCapturedInputs(change: Partial<IWorkspaceInputFingerprint>): void {
+    inputCaptureMock.mockImplementation(async (options) => ({
+      ...(await actualCaptureAsync(options)),
+      ...change
+    }));
+  }
+
+  let changedImplementationPaths: jest.SpyInstance<ReadonlyArray<string>, []> | undefined;
+
+  /** Makes every later capture find the given files of Rush or its plugins changed, in this order. */
+  function changeImplementationFiles(fixture: DaemonGraphTestFixture, files: ReadonlyArray<string>): void {
+    changeCapturedInputs({ runtimeHash: 'changed' });
+    changedImplementationPaths = jest
+      .spyOn(WorkspaceRuntimeFingerprintCache.prototype, 'changedPaths', 'get')
+      .mockReturnValue(files.map((file: string) => path.join(fixture.folder, file)));
+  }
+
+  afterEach(() => {
+    inputCaptureMock.mockImplementation(actualCaptureAsync);
+    changedImplementationPaths?.mockRestore();
+    changedImplementationPaths = undefined;
+  });
+
+  const PLUGIN_FILES: ReadonlyArray<string> = ['a', 'b', 'c', 'd'].map(
+    (name: string) => `common/autoinstallers/plugins/node_modules/rush-plugin/lib/${name}.js`
+  );
+
+  it('leaves the changed installation files out of the reason of an install that restarts for another reason', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The install is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      // An install is expected to change the installation, so only the changed code makes it restart first.
+      changeInstallation(fixture);
+      changeImplementationFiles(fixture, PLUGIN_FILES.slice(0, 1));
+      const install: IStreamedRequest = await startRequestAsync(fixture, ['install'], {
+        admission: { waitTimeoutMs: 1500 }
+      });
+      const { terminal } = await install.exchange;
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+        'The request was not admitted before the daemon could restart because the code of Rush or a Rush plugin ' +
+          `changed (${PLUGIN_FILES[0]}).`
+      );
+      expect(install.positionPayloads).toEqual([
+        {
+          position: 1,
+          requestId: install.requestId,
+          restartReason: { kind: 'workspaceInputsChanged', implementationFiles: PLUGIN_FILES.slice(0, 1) },
+          scriptCount: 1
+        }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      inputCaptureMock.mockImplementation(actualCaptureAsync);
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it.each<
+    [
+      string,
+      (fixture: DaemonGraphTestFixture) => Partial<IDaemonRequestEnvelope>,
+      DaemonRestartReason,
+      string
+    ]
+  >([
+    [
+      'a changed installation file',
+      (fixture: DaemonGraphTestFixture) => {
+        changeInstallation(fixture);
+        return {};
+      },
+      { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/npm-shrinkwrap.json'] },
+      'because common/config/rush/npm-shrinkwrap.json changed'
+    ],
+    [
+      'changed code of Rush or a Rush plugin',
+      () => {
+        changeCapturedInputs({ runtimeHash: 'changed' });
+        return {};
+      },
+      // The capture found no changed file, since the test only changed its hash.
+      { kind: 'workspaceInputsChanged', implementationFiles: [] },
+      'because the code of Rush or a Rush plugin changed'
+    ],
+    [
+      'at most 3 changed files of Rush or its plugins',
+      (fixture: DaemonGraphTestFixture) => {
+        changeImplementationFiles(fixture, PLUGIN_FILES);
+        return {};
+      },
+      { kind: 'workspaceInputsChanged', implementationFiles: PLUGIN_FILES.slice(0, 3) },
+      `because the code of Rush or a Rush plugin changed (${PLUGIN_FILES[0]}, ${PLUGIN_FILES[1]} and ` +
+        `${PLUGIN_FILES[2]})`
+    ],
+    [
+      'another Rush version',
+      () => {
+        changeCapturedInputs({ selectedRushVersion: '9.9.9' });
+        return {};
+      },
+      { kind: 'workspaceInputsChanged', selectedRushVersion: '9.9.9' },
+      'because this request selects Rush 9.9.9'
+    ],
+    [
+      'a changed environment',
+      (fixture: DaemonGraphTestFixture) => ({
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+      }),
+      { kind: 'environmentChanged', variableNames: ['RUSHD_RELOAD_TIER_TEST'] },
+      "because this request's environment differs from the daemon's in RUSHD_RELOAD_TIER_TEST"
+    ]
+  ])(
+    'names %s in the queue positions and the admission error of a build',
+    async (inputs, change, reason, cause) => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        // The build is never admitted, so no successor is launched.
+        created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+      });
+      try {
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+
+        const overrides: Partial<IDaemonRequestEnvelope> = change(fixture);
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          ...overrides,
+          admission: { waitTimeoutMs: 1500 }
+        });
+        const { terminal } = await build.exchange;
+        expect(terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+        });
+        expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+          `The request was not admitted before the daemon could restart ${cause}. The restart waits for the ` +
+            'requests that the daemon is serving to finish, including a rushx script that may not exit until it ' +
+            'is stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
+        );
+        expect(build.positionPayloads).toEqual([
+          { position: 1, requestId: build.requestId, restartReason: reason, scriptCount: 1 }
+        ]);
+        expect(script.settled()).toBe(false);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+      } finally {
+        inputCaptureMock.mockImplementation(actualCaptureAsync);
+        fixture.write(RELEASE_FILE, '');
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+
+  const INSTALLATION_FILE_CHANGED: DaemonRestartReason = {
+    kind: 'workspaceInputsChanged',
+    installationFiles: ['common/config/rush/npm-shrinkwrap.json']
+  };
+
+  /**
+   * Changes an installation file once the next capture of the workspace inputs has read them. A build that needs a
+   * reload then finds that it needs a restart only when it captures them again, while it holds the workspace
+   * exclusively, so that it waits for the served scripts there rather than in the restart drain.
+   */
+  function changeInstallationAfterNextCapture(fixture: DaemonGraphTestFixture): void {
+    changeProjectConfiguration(fixture);
+    inputCaptureMock.mockImplementationOnce(async (options) => {
+      const fingerprint: IWorkspaceInputFingerprint = await actualCaptureAsync(options);
+      changeInstallation(fixture);
+      return fingerprint;
+    });
+  }
+
+  it('names the restart in the queue positions and the admission error of a build that finds it late', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The build is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeInstallationAfterNextCapture(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 1500 }
+      });
+      const { terminal } = await build.exchange;
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+        'within its 1500ms wait timeout while waiting for a rushx script that this daemon runs to exit, before ' +
+          'the daemon restarts because common/config/rush/npm-shrinkwrap.json changed.'
+      );
+      expect(build.positionPayloads).toEqual([
+        { position: 1, requestId: build.requestId, restartReason: INSTALLATION_FILE_CHANGED, scriptCount: 1 }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('names the restart in the script wait of a graph control request as well', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The request is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    // The restart drain before this wait waits for every served script, so the request finds one only if the drain
+    // did not wait for it. Skipping the drain isolates the wait for the scripts.
+    const drain: jest.SpiedFunction<RequestAdmissionController['waitForRestartDrainAsync']> = jest
+      .spyOn(RequestAdmissionController.prototype, 'waitForRestartDrainAsync')
+      .mockResolvedValue(true);
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeInstallation(fixture);
+      const pause: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'pause'], {
+        admission: { waitTimeoutMs: 1500 }
+      });
+      const { terminal } = await pause.exchange;
+      expect(drain).toHaveBeenCalledTimes(1);
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+        'within its 1500ms wait timeout while waiting for a rushx script that this daemon runs to exit, before ' +
+          'the daemon restarts because common/config/rush/npm-shrinkwrap.json changed.'
+      );
+      expect(pause.positionPayloads).toEqual([
+        { position: 1, requestId: pause.requestId, restartReason: INSTALLATION_FILE_CHANGED, scriptCount: 1 }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      drain.mockRestore();
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('counts down the scripts that such a build waits for, and restarts once the last one exits', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+      const script2: IServedScript = await serveAsync(fixture, 'serve2');
+
+      changeInstallationAfterNextCapture(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      const waitingFor = (scriptCount: number): IDaemonRequestQueuePositionMessage['payload'] => ({
+        position: scriptCount,
+        requestId: build.requestId,
+        restartReason: INSTALLATION_FILE_CHANGED,
+        scriptCount
+      });
+      await waitForAsync(
+        () => build.positionPayloads.length > 0 || build.settled(),
+        'the build to wait for the scripts'
+      );
+      expect(build.positionPayloads).toEqual([waitingFor(2)]);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      await waitForAsync(
+        () => build.positionPayloads.length > 1 || build.settled(),
+        'the build to learn that a script exited'
+      );
+      expect(build.positionPayloads).toEqual([waitingFor(2), waitingFor(1)]);
+      expect(build.settled()).toBe(false);
+
+      fixture.write(LATE_RELEASE_FILE, '');
+      expectSuccess(await script2.exchange);
+      expect((await build.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      // The last script to exit admitted the build, which then waited for no script.
+      expect(build.positionPayloads).toEqual([waitingFor(2), waitingFor(1)]);
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  describe('a request queued behind a request that waits for the scripts', () => {
+    /**
+     * The queue position of the first request queued behind the owner of a transition, which waits for
+     * `scriptCount` scripts: the scripts and the owner are ahead of it.
+     */
+    function behind(
+      request: IStreamedRequest,
+      scriptCount: number,
+      restartReason: DaemonRestartReason = INSTALLATION_FILE_CHANGED
+    ): IDaemonRequestQueuePositionMessage['payload'] {
+      return {
+        position: scriptCount + 1,
+        requestId: request.requestId,
+        restartReason,
+        scriptCount,
+        restartsForAnotherRequest: true
+      };
+    }
+
+    async function waitForPositionsAsync(
+      request: IStreamedRequest,
+      count: number,
+      description: string
+    ): Promise<void> {
+      await waitForAsync(() => request.positionPayloads.length >= count || request.settled(), description);
+    }
+
+    it("serves a build with the daemon's environment while a build drains to restart for its own", async () => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        setDaemonPolicy(created, {});
+        created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      });
+      try {
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+
+        // A changed environment is found at the first capture, so the build waits for the script in the restart
+        // drain, before it owns a transition, and a request that matches this process is still served meanwhile.
+        const restart: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' },
+          admission: { waitTimeoutMs: 20_000 }
+        });
+        await waitForPositionsAsync(restart, 1, 'the build to drain for its restart');
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 500 }
+        });
+        expectSuccess(await build.exchange);
+        expect(build.positionPayloads).toEqual([]);
+        expect(restart.settled()).toBe(false);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+        expect((await restart.exchange).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, retryAfterRestart: true }
+        });
+      } finally {
+        fixture.write(RELEASE_FILE, '');
+        await closeRestartingFixtureAsync(fixture);
+      }
+    });
+
+    it('names the script and the restart to a build queued behind a build that finds the restart late', async () => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        // Neither build is admitted, so no successor is launched.
+        created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+      });
+      try {
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+
+        changeInstallationAfterNextCapture(fixture);
+        const owner: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 3000 }
+        });
+        await waitForPositionsAsync(owner, 1, 'the build to wait for the script');
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 500 }
+        });
+        const { terminal } = await build.exchange;
+        expect(terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+        });
+        expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+          'The request was not admitted within its 500ms wait timeout while waiting for another request that ' +
+            'waits for 1 rushx script that this daemon runs to exit before it restarts the daemon because ' +
+            'common/config/rush/npm-shrinkwrap.json changed. Use --wait-timeout <seconds> to wait longer.'
+        );
+        expect(build.positionPayloads).toEqual([behind(build, 1)]);
+
+        // The build that waits for the script is told what it was told before.
+        expect((await owner.exchange).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+        });
+        expect(owner.positionPayloads).toEqual([
+          {
+            position: 1,
+            requestId: owner.requestId,
+            restartReason: INSTALLATION_FILE_CHANGED,
+            scriptCount: 1
+          }
+        ]);
+        expect(script.settled()).toBe(false);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+      } finally {
+        fixture.write(RELEASE_FILE, '');
+        await fixture[Symbol.asyncDispose]();
+      }
+    });
+
+    it('counts down the scripts to a build queued behind such a build, and both retry after the restart', async () => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        setDaemonPolicy(created, {});
+        created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      });
+      try {
+        const before = await pongAsync(fixture);
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+        const script2: IServedScript = await serveAsync(fixture, 'serve2');
+
+        changeInstallationAfterNextCapture(fixture);
+        const owner: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 20_000 }
+        });
+        await waitForPositionsAsync(owner, 1, 'the build to wait for the scripts');
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 20_000 }
+        });
+        await waitForPositionsAsync(build, 1, 'the queued build to learn of the scripts');
+        expect(build.positionPayloads).toEqual([behind(build, 2)]);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+        await waitForPositionsAsync(build, 2, 'the queued build to learn that a script exited');
+        expect(build.positionPayloads).toEqual([behind(build, 2), behind(build, 1)]);
+        expect(build.settled()).toBe(false);
+
+        fixture.write(LATE_RELEASE_FILE, '');
+        expectSuccess(await script2.exchange);
+        for (const request of [owner, build]) {
+          expect((await request.exchange).terminal).toMatchObject({
+            kind: 'requestResult',
+            payload: { exitCode: 1, retryAfterRestart: true }
+          });
+        }
+        // Once the last script exited, the queued build waited only for the build ahead of it.
+        expect(build.positionPayloads).toEqual([
+          behind(build, 2),
+          behind(build, 1),
+          { position: 1, requestId: build.requestId }
+        ]);
+        const restarted = await fixture.host.restartCompleted;
+        expect(restarted?.pid).not.toBe(before.pid);
+      } finally {
+        fixture.write(RELEASE_FILE, '');
+        fixture.write(LATE_RELEASE_FILE, '');
+        await closeRestartingFixtureAsync(fixture);
+      }
+    });
+
+    it.each([{ commandName: 'install' }, { commandName: 'update' }])(
+      'names the script and the $commandName to a build queued behind a native $commandName',
+      async ({ commandName }) => {
+        const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+          // The mutation is never admitted, so no successor is launched.
+          created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+        });
+        try {
+          expectSuccess(await fixture.runAsync(BUILD_A));
+          const script: IServedScript = await serveAsync(fixture);
+
+          const mutation: IStreamedRequest = await startRequestAsync(fixture, [commandName], {
+            admission: { waitTimeoutMs: 3000 }
+          });
+          await waitForPositionsAsync(mutation, 1, `the ${commandName} to wait for the script`);
+          const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+            admission: { waitTimeoutMs: 500 }
+          });
+          const { terminal } = await build.exchange;
+          expect(terminal).toMatchObject({
+            kind: 'requestResult',
+            payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+          });
+          expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+            'The request was not admitted within its 500ms wait timeout while waiting for another request that ' +
+              'waits for 1 rushx script that this daemon runs to exit before it restarts the daemon because it ' +
+              `runs rush ${commandName}. Use --wait-timeout <seconds> to wait longer.`
+          );
+          expect(build.positionPayloads).toEqual([behind(build, 1, { kind: 'nativeMutation', commandName })]);
+
+          // The mutation is told what it was told before.
+          expect((await mutation.exchange).terminal).toMatchObject({
+            kind: 'requestResult',
+            payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+          });
+          expect(mutation.positionPayloads).toEqual([
+            { position: 1, requestId: mutation.requestId, scriptCount: 1 }
+          ]);
+          expect(script.settled()).toBe(false);
+
+          fixture.write(RELEASE_FILE, '');
+          expectSuccess(await script.exchange);
+          // The refused requests left the workspace serving builds.
+          expectSuccess(await fixture.runAsync(BUILD_A));
+        } finally {
+          fixture.write(RELEASE_FILE, '');
+          await fixture[Symbol.asyncDispose]();
+        }
+      }
+    );
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts
new file mode 100644
index 00000000000..455b8f19300
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts
@@ -0,0 +1,255 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+/**
+ * Composes its resolvers as the production host does, so it serves rushx scripts. c builds until the test removes
+ * the `hold` marker. Project a's `hello` script records that it ran, and exits.
+ */
+function createHeldFixtureAsync(
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
+    created.servesRushx = true;
+    created.write('hold', '');
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: { '_phase:compile': 'node build.cjs', hello: 'node hello.cjs' }
+      })
+    );
+    created.write('a/hello.cjs', "require('node:fs').appendFileSync('../runs.txt','hello\\n');");
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);"
+    );
+    configure?.(created);
+  });
+}
+
+async function waitForAsync(predicate: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate() && Date.now() < deadline) await delayAsync(20);
+}
+
+function isQueuePosition(frame: IDaemonFrame): boolean {
+  if (frame.kind !== DaemonFrameType.controlJson) return false;
+  const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+  return message.kind === 'queuePosition';
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<void> {
+  while (!isQueuePosition(await client.readFrameAsync()));
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await delayAsync(0);
+  return settled;
+}
+
+/** Runs a's `hello` script as rush-client sends it for `rushx hello`. */
+function runHelloAsync(
+  fixture: DaemonGraphTestFixture,
+  admission: IDaemonRequestEnvelope['admission']
+): Promise<ITerminalExchange> {
+  return fixture.runAsync(['hello'], helloOverrides(fixture, admission));
+}
+
+function helloOverrides(
+  fixture: DaemonGraphTestFixture,
+  admission: IDaemonRequestEnvelope['admission']
+): Partial<IDaemonRequestEnvelope> {
+  return { commandOrigin: 'custom', invocationKind: 'rushx', cwd: path.join(fixture.folder, 'a'), admission };
+}
+
+interface IHeldTransition {
+  /** The rebuild, which runs c until the test removes the `hold` marker. */
+  readonly running: Promise<ITerminalExchange>;
+  /** The request that owns the transition. It waits for the rebuild. */
+  readonly owner: Promise<ITerminalExchange>;
+  readonly client: DaemonRequestWireClient;
+}
+
+/**
+ * Starts the rebuild, then `argv`, and returns once `argv` waits behind the rebuild. `change` runs after the rebuild
+ * captured the workspace's inputs.
+ */
+async function holdTransitionAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  waitTimeoutMs: number,
+  change?: () => void
+): Promise<IHeldTransition> {
+  const running: Promise<ITerminalExchange> = fixture.runAsync(['rebuild', '--to', 'c']);
+  // A failed expectation leaves the rebuild and the owner unread until the test closes their connections.
+  running.catch(() => undefined);
+  await waitForAsync(() => fixture.runs().includes('c'));
+  change?.();
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const envelope: IDaemonRequestEnvelope = fixture.envelope(argv, { admission: { waitTimeoutMs } });
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  await readUntilQueuedAsync(client);
+  const owner: Promise<ITerminalExchange> = client.readTerminalAsync(envelope.requestId);
+  owner.catch(() => undefined);
+  return { running, owner, client };
+}
+
+describe('a served rushx script while a transition waits for a running build', () => {
+  it('starts at once, on the current generation, while a build waits to reload the graph', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      // The build reloads the graph, since the rebuild bound the engine, so it owns that transition while it waits.
+      transition = await holdTransitionAsync(fixture, ['build', '--to', 'c'], 60_000);
+      const { running, owner } = transition;
+      const generation: number = fixture.host.workspaceGeneration;
+
+      // A request that follows a transition is admitted one way with a wait timeout and another way without one.
+      for (const admission of [{ waitTimeoutMs: 5_000 }, { noWait: true }]) {
+        const { frames, terminal } = await runHelloAsync(fixture, admission);
+        expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        expect(frames.filter(isQueuePosition)).toEqual([]);
+      }
+      // Only scripts pass the build. A graph request that the current generation could answer at once, and a rebuild
+      // that could reuse it, wait behind the build.
+      for (const argv of [
+        ['daemon', 'graph', 'status'],
+        ['rebuild', '--to', 'c']
+      ]) {
+        expect((await fixture.runAsync(argv, { admission: { noWait: true } })).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'no-wait' }
+        });
+      }
+      // The rebuild and the build still wait for the marker.
+      expect(fixture.runs()).toEqual(['c', 'hello', 'hello']);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+      expect(await isSettledAsync(running)).toBe(false);
+      expect(await isSettledAsync(owner)).toBe(false);
+
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect((await owner).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.client.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('waits while the reload replaces the generation, and then starts on the new one', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    let script: DaemonRequestWireClient | undefined;
+    let releaseReload: () => void = () => undefined;
+    const reloadReleased: Promise<void> = new Promise((resolve) => (releaseReload = resolve));
+    try {
+      transition = await holdTransitionAsync(fixture, ['build', '--to', 'c'], 60_000);
+      const { running, owner } = transition;
+      const generation: number = fixture.host.workspaceGeneration;
+      let reloading: boolean = false;
+      fixture.beforeCreateSessionAsync = async () => {
+        reloading = true;
+        await reloadReleased;
+      };
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      await waitForAsync(() => reloading);
+      expect(reloading).toBe(true);
+
+      // The build holds the gate while it replaces the generation, so the script waits for it.
+      script = await fixture.connectAsync();
+      const hello: IDaemonRequestEnvelope = fixture.envelope(
+        ['hello'],
+        helloOverrides(fixture, { waitTimeoutMs: 5_000 })
+      );
+      await script.sendControlAsync({ kind: 'requestStart', payload: hello });
+      await readUntilQueuedAsync(script);
+      await delayAsync(200);
+      expect(fixture.runs()).not.toContain('hello');
+
+      releaseReload();
+      expect((await script.readTerminalAsync(hello.requestId)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect((await owner).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.runs()).toContain('hello');
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      releaseReload();
+      fs.rmSync(hold, { force: true });
+      await script?.closeAsync();
+      await transition?.client.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('still waits behind a native install that reloads the graph, since the script would end with this process', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync((created) => {
+      // The install is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      // A changed project configuration gives the install the tier of a build's reload.
+      transition = await holdTransitionAsync(fixture, ['install'], 3_000, () => {
+        const packageJsonPath: string = path.join(fixture.folder, 'b/package.json');
+        const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+      });
+      const { running, owner } = transition;
+
+      const { frames, terminal } = await runHelloAsync(fixture, { waitTimeoutMs: 500 });
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect(frames.filter(isQueuePosition)).not.toEqual([]);
+      expect(fixture.runs()).toEqual(['c']);
+
+      expect((await owner).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.runs()).not.toContain('hello');
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.client.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceSession.test.ts b/libraries/rush-daemon/src/test/WorkspaceSession.test.ts
index b060f27e9f1..f751a38ff6c 100644
--- a/libraries/rush-daemon/src/test/WorkspaceSession.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceSession.test.ts
@@ -211,7 +211,7 @@ describe(WorkspaceSession.name, () => {
     ]);
   });
 
-  it('rejects reconciliation as soon as disposal starts', async () => {
+  it('rejects reconciliation and peeks as soon as disposal starts', async () => {
     let finishWatcherDisposal: (() => void) | undefined;
     let watcherDisposalStarted: () => void = () => undefined;
     const watcherDisposal: Promise<void> = new Promise((resolve) => {
@@ -228,12 +228,16 @@ describe(WorkspaceSession.name, () => {
     const reconcileInvalidationsAsync: jest.Mock = jest.fn(() =>
       Promise.reject(new Error('Reconciliation must not start.'))
     );
+    const peekInvalidationsAsync: jest.Mock = jest.fn(() =>
+      Promise.reject(new Error('Peeking must not start.'))
+    );
     const session: WorkspaceSession = await WorkspaceSession.createAsync({
       repoRoot: TEST_REPO_ROOT,
       rushVersion: '5.178.0',
       createComponentsAsync: () =>
         Promise.resolve<IWorkspaceSessionComponents>({
           projectWatcher: watcher,
+          peekInvalidationsAsync,
           reconcileInvalidationsAsync,
           [Symbol.asyncDispose]: () => watcher[Symbol.asyncDispose]()
         })
@@ -244,6 +248,10 @@ describe(WorkspaceSession.name, () => {
       'workspace session is being disposed'
     );
     expect(reconcileInvalidationsAsync).not.toHaveBeenCalled();
+    await expect(session.peekInvalidationsAsync({ executingIterationRecords: new Map() })).rejects.toThrow(
+      'workspace session is being disposed'
+    );
+    expect(peekInvalidationsAsync).not.toHaveBeenCalled();
     await watcherDisposal;
     finishWatcherDisposal?.();
     await disposalPromise;
diff --git a/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
new file mode 100644
index 00000000000..2a8b6e30f6d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
@@ -0,0 +1,153 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import { createDeferred, type IDeferred, type ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 300, waitTimeoutIsDefault: true };
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+function expectWaitTimeout(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({
+    kind: 'requestResult',
+    payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+  });
+}
+
+describe('workspace admission behind a graph transition', () => {
+  it('admits builds that arrive while another build loads the graph without spending their wait timeout', async () => {
+    const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+    try {
+      const loadStarted: IDeferred<void> = createDeferred<void>();
+      const releaseLoad: IDeferred<void> = createDeferred<void>();
+      fixture.beforeCreateSessionAsync = async () => {
+        loadStarted.resolve();
+        await releaseLoad.promise;
+      };
+      const first: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B);
+      await loadStarted.promise;
+
+      const withDefaultBudget: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, {
+        admission: DEFAULT_BUDGET
+      });
+      // Raising the timeout must not make a build fail behind a load that the default timeout waits for.
+      const withExplicitBudget: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, {
+        admission: { waitTimeoutMs: 300 }
+      });
+      await delayAsync(600);
+
+      fixture.beforeCreateSessionAsync = undefined;
+      releaseLoad.resolve();
+      expectSuccess(await first);
+      expectSuccess(await withDefaultBudget);
+      expectSuccess(await withExplicitBudget);
+      expect(fixture.runs()).toEqual(['a', 'b']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('fails a build that has waited behind a graph load for ten times its wait timeout', async () => {
+    const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+    const loadStarted: IDeferred<void> = createDeferred<void>();
+    const releaseLoad: IDeferred<void> = createDeferred<void>();
+    try {
+      fixture.beforeCreateSessionAsync = async () => {
+        loadStarted.resolve();
+        await releaseLoad.promise;
+      };
+      const first: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B);
+      await loadStarted.promise;
+
+      const startedAt: number = Date.now();
+      const behindWedgedLoad: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+        admission: { waitTimeoutMs: 100 }
+      });
+      expect(Date.now() - startedAt).toBeGreaterThanOrEqual(900);
+      expectWaitTimeout(behindWedgedLoad);
+      expect(behindWedgedLoad.terminal).toMatchObject({
+        payload: {
+          errorMessage: expect.stringContaining(
+            "within 10 times its 100ms wait timeout because another request's load or reload of the workspace " +
+              'graph was still running'
+          )
+        }
+      });
+
+      fixture.beforeCreateSessionAsync = undefined;
+      releaseLoad.resolve();
+      expectSuccess(await first);
+    } finally {
+      // A failed expectation must not leave the load held, which would keep the fixture from shutting down.
+      releaseLoad.resolve();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('keeps a graph-gate waiter default budget for its reload after an input change', async () => {
+    const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
+      created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
+      created.write(
+        'a/build.cjs',
+        withScriptDeadline(
+          "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+            "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+        )
+      );
+    });
+    const releaseFile: string = path.join(fixture.folder, 'release-a');
+    try {
+      const long: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await waitForAsync(() => fixture.runs().includes('a'), 'the long build to start');
+
+      // Reuses the generation, then waits at the graph-execution gate, which a default budget does not limit.
+      const graphGateWaiter: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A, {
+        admission: DEFAULT_BUDGET
+      });
+      await delayAsync(500);
+      const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+      const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+      fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+
+      // Needs a reload, so it waits for exclusive admission until the long build ends.
+      const reload: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await delayAsync(500);
+      // A reload that cannot start is not progress, so a default budget behind it is still spent.
+      expectWaitTimeout(await fixture.runAsync(BUILD_A, { admission: DEFAULT_BUDGET }));
+
+      fs.writeFileSync(releaseFile, '');
+      expectSuccess(await long);
+      expectSuccess(await reload);
+      // The waiter's batch finds the changed input and re-enters admission behind the reload.
+      expectSuccess(await graphGateWaiter);
+    } finally {
+      // A failed expectation must not leave the long build running, which would keep the fixture from shutting down.
+      fs.writeFileSync(releaseFile, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts b/libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts
new file mode 100644
index 00000000000..942d07c8a9c
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts
@@ -0,0 +1,178 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+/**
+ * Composes its resolvers as the production host does. c builds until the test removes the `hold` marker. `test` is a
+ * phased command of command-line.json, as in rushstack.
+ */
+function createHeldFixtureAsync(): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
+    created.servesRushx = true;
+    created.write('hold', '');
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: ['build', 'test'].map((name: string) => ({
+          commandKind: 'phased',
+          name,
+          summary: name,
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        }))
+      })
+    );
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);"
+    );
+  });
+}
+
+async function waitForRunAsync(fixture: DaemonGraphTestFixture, name: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!fixture.runs().includes(name) && Date.now() < deadline) await delayAsync(20);
+}
+
+function isQueuePosition(frame: IDaemonFrame): boolean {
+  if (frame.kind !== DaemonFrameType.controlJson) return false;
+  const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+  return message.kind === 'queuePosition';
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<void> {
+  while (!isQueuePosition(await client.readFrameAsync()));
+}
+
+interface IHeldTransition {
+  /** The rebuild, which runs c until the test removes the `hold` marker. */
+  readonly running: Promise<ITerminalExchange>;
+  /** The build after the rebuild. It reloads the graph, so it owns that transition while it waits for the rebuild. */
+  readonly built: Promise<ITerminalExchange>;
+  readonly patient: DaemonRequestWireClient;
+}
+
+async function holdTransitionAsync(fixture: DaemonGraphTestFixture): Promise<IHeldTransition> {
+  const running: Promise<ITerminalExchange> = fixture.runAsync(['rebuild', '--to', 'c']);
+  await waitForRunAsync(fixture, 'c');
+  const patient: DaemonRequestWireClient = await fixture.connectAsync();
+  const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c'], {
+    admission: { waitTimeoutMs: 60_000 }
+  });
+  await patient.sendControlAsync({ kind: 'requestStart', payload: build });
+  await readUntilQueuedAsync(patient);
+  return { running, built: patient.readTerminalAsync(build.requestId), patient };
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await delayAsync(0);
+  return settled;
+}
+
+describe('a command that the daemon never serves', () => {
+  it('is rejected at once while a build waits behind the running build to reload the graph', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      transition = await holdTransitionAsync(fixture);
+      const { running, built } = transition;
+
+      // As rush-client sends them: it marks only build, rebuild, install and update as built-in commands. `list`
+      // only reads the workspace; `install-autoinstaller` would stop the work that finished requests continue, and
+      // there is none.
+      const answers: ITerminalExchange[] = await Promise.all(
+        [
+          ['list', '--to', 'c'],
+          ['install-autoinstaller', '--name', 'tools']
+        ].map((argv: string[]) =>
+          fixture.runAsync(argv, {
+            commandOrigin: 'custom',
+            admission: { waitTimeoutMs: 5_000 }
+          })
+        )
+      );
+      for (const { frames, terminal } of answers) {
+        expect(terminal).toMatchObject({
+          kind: 'requestRejected',
+          payload: {
+            code: 'unsupported',
+            message: expect.stringContaining('is a built-in command that is not phased')
+          }
+        });
+        expect(frames.filter(isQueuePosition)).toEqual([]);
+      }
+      // Neither waited for the rebuild or the build, and neither stopped the rebuild.
+      expect(await isSettledAsync(running)).toBe(false);
+      expect(await isSettledAsync(built)).toBe(false);
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(fixture.runs()).toEqual(['c']);
+
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect((await built).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.patient.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
+
+describe('a custom command', () => {
+  it('waits for admission while a build waits behind the running build to reload the graph, and is served', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      transition = await holdTransitionAsync(fixture);
+      const { running, built } = transition;
+
+      // Only its parse, after admission, can tell whether the daemon serves a custom command.
+      const tested: Promise<ITerminalExchange> = fixture.runAsync(['test', '--to', 'c'], {
+        commandOrigin: 'custom',
+        admission: { waitTimeoutMs: 60_000 }
+      });
+      await delayAsync(1_000);
+      expect(await isSettledAsync(tested)).toBe(false);
+      expect(await isSettledAsync(running)).toBe(false);
+      expect(await isSettledAsync(built)).toBe(false);
+
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect((await built).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { frames, terminal } = await tested;
+      expect(frames.filter(isQueuePosition)).not.toEqual([]);
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.patient.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts
index 092cf5cf943..101d318c729 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts
@@ -15,6 +15,7 @@ import {
   eventuallyAsync,
   GENERATION_POLICY,
   getWarmSet,
+  pingAsync,
   pongAsync,
   setDaemonPolicy
 } from './WarmGenerationTestUtilities';
@@ -67,6 +68,37 @@ describe('automatic warm generation ownership and pong accounting', () => {
     expect(fixture.host.workspaceStatus.generationToken).toBe(status.workspace?.generationToken);
   });
 
+  it('leaves the warm set out of a pong, without reading it, only when the ping asks it to', async () => {
+    setDaemonPolicy(fixture, { warmSetMaxProjects: 1, autoWarmByTelemetry: true });
+    await fixture.buildSuccessfullyAsync();
+    const warm = getWarmSet(fixture);
+    await eventuallyAsync(() => expect(warm.getStatus().retainedProjectNames).toHaveLength(1));
+    const client = await fixture.connectAsync();
+    try {
+      // The spy starts after the handshake, whose own ping reads the warm set.
+      const read = jest.spyOn(fixture.session, 'warmSetStatus', 'get');
+      const brief = await pingAsync(client, { omitWarmSet: true });
+      expect(read).not.toHaveBeenCalled();
+      expect(brief.workspace).toMatchObject({
+        generation: fixture.host.workspaceGeneration,
+        generationToken: getWorkspaceGenerationToken(fixture.session),
+        graphInitialized: true
+      });
+      expect(brief.workspace).not.toHaveProperty('warmSet');
+      for (const payload of [{}, { omitWarmSet: false }]) {
+        const full = await pingAsync(client, payload);
+        expect(full.workspace).toMatchObject({
+          ...brief.workspace,
+          warmSet: { maintenanceState: 'running' }
+        });
+        expect(full.workspace?.warmSet?.retainedProjectNames).toEqual(warm.getStatus().retainedProjectNames);
+      }
+      expect(read).toHaveBeenCalledTimes(2);
+    } finally {
+      await client.closeAsync();
+    }
+  });
+
   it('applies idle and memory knobs in the default host while reporting irreducible pressure honestly', async () => {
     setDaemonPolicy(fixture, { warmIdleTimeoutSeconds: 0.05 });
     await fixture.buildSuccessfullyAsync();
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts
index ef688c54dd6..a0e1a6f78ef 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts
@@ -269,6 +269,8 @@ describe('warm-set generation barriers', () => {
     });
     await session.initializeEngineAsync(async () => engine);
     try {
+      // Observation of a project that was never requested is released, so this pass takes the native lease.
+      watcher.watchProjects(['a']);
       await warm.maintainAsync();
       expect(warm.getStatus()).toMatchObject({
         maintenanceState: 'failed',
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index f4193dbd27d..1d2b0286421 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -6,9 +6,15 @@ import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 import { inspect } from 'node:util';
 
-import { OperationStatus, type IOperationExecutionResult } from '@microsoft/rush-lib';
+import {
+  OperationStatus,
+  type IOperationExecutionResult,
+  type IOperationGraphIterationOptions,
+  type Operation
+} from '@microsoft/rush-lib';
 import { OperationExecutionRecord } from '@microsoft/rush-lib/lib/logic/operations/OperationExecutionRecord';
 
+import * as DaemonResidentMemory from '../DaemonResidentMemory';
 import { RequestExclusivityClass } from '../RequestScheduler';
 import { getWorkspaceRequestScheduler } from '../WorkspaceRequestAdmission';
 import { WorkspaceWarmSet } from '../WorkspaceWarmSet';
@@ -102,6 +108,74 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(graph.resultByOperation.has(test!.operation('a'))).toBe(false);
   });
 
+  it('counts a project once per iteration when the executing iteration is planned again for more work', async () => {
+    const { warm, graph } = await startAsync();
+    const a: Operation = test!.operation('a');
+    const b: Operation = test!.operation('b');
+    const getFrequencies = (): Record<string, number> =>
+      Object.fromEntries(
+        warm.getStatus().projectRanks!.map(({ projectName, frequency }) => [projectName, frequency])
+      );
+    const plan = (): void => graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {});
+    const extend = (startedOperations: ReadonlySet<Operation>): void => {
+      const context: IOperationGraphIterationOptions = { startedOperations };
+      graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, context);
+      graph.hooks.extendIteration.call(new Map(), context);
+    };
+    expect(getFrequencies()).toEqual({ a: 1, b: 1 });
+
+    b.enabled = false;
+    plan();
+    expect(getFrequencies()).toEqual({ a: 2, b: 1 });
+    b.enabled = true;
+    extend(new Set([a]));
+    expect(getFrequencies()).toEqual({ a: 2, b: 2 });
+    extend(new Set([a, b]));
+    expect(getFrequencies()).toEqual({ a: 2, b: 2 });
+    plan();
+    expect(getFrequencies()).toEqual({ a: 3, b: 3 });
+  });
+
+  it('neither counts nor observes the projects of a plan of the executing iteration that the graph refuses', async () => {
+    const { warm, graph, watcher } = await startAsync();
+    const a: Operation = test!.operation('a');
+    const b: Operation = test!.operation('b');
+    const getRanks = (): Record<string, [number, number]> =>
+      Object.fromEntries(
+        warm
+          .getStatus()
+          .projectRanks!.map(({ projectName, frequency, lastUsed }) => [projectName, [frequency, lastUsed]])
+      );
+    b.enabled = false;
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {});
+    const ranks: Record<string, [number, number]> = getRanks();
+    const watchProjects: jest.SpyInstance = jest.spyOn(watcher, 'watchProjects');
+
+    b.enabled = true;
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {
+      startedOperations: new Set([a])
+    });
+    // The graph accepts another plan
+    graph.hooks.extendIteration.call(new Map(), { startedOperations: new Set([a]) });
+    expect(getRanks()).toEqual(ranks);
+    expect(watchProjects).not.toHaveBeenCalled();
+
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {});
+    expect(watchProjects).toHaveBeenCalledWith(['a', 'b']);
+    expect(getRanks().b[0]).toBe(ranks.b[0] + 1);
+  });
+
+  it('ignores a plan of the executing iteration that the graph accepts after the warm set was disposed', async () => {
+    const { warm, graph, watcher } = await startAsync();
+    const context: IOperationGraphIterationOptions = { startedOperations: new Set() };
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, context);
+    const watchProjects: jest.SpyInstance = jest.spyOn(watcher, 'watchProjects');
+    await warm[Symbol.asyncDispose]();
+
+    graph.hooks.extendIteration.call(new Map(), context);
+    expect(watchProjects).not.toHaveBeenCalled();
+  });
+
   it('does not count or evict resource-free retained results for the project cap, but still evicts resource holders', async () => {
     test = await WarmSetTestFixture.createAsync({ extraProjectCount: 40 });
     test.configuration = { ...GENEROUS_WARM_CONFIGURATION, watch: false, warmSetMaxProjects: 20 };
@@ -260,6 +334,62 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(fixture.runs()).toEqual(['a', 'b']);
   });
 
+  it("weighs the budget against the daemon's own resident memory from readResidentMemoryBytes", async () => {
+    const { warm } = await startAsync({ ipc: true });
+    const { configuration, measuredRunnerMemoryBytes } = warm.getStatus();
+    expect(measuredRunnerMemoryBytes).toBeGreaterThan(0);
+    // The budget's last byte that the daemon itself may use, next to the measured runners.
+    const lastByte: number = configuration.warmMemoryBudgetMB * 1024 * 1024 - measuredRunnerMemoryBytes;
+    const readResident: jest.SpyInstance = jest.spyOn(DaemonResidentMemory, 'readResidentMemoryBytes');
+    try {
+      readResident.mockReturnValue(lastByte - 1);
+      expect(warm.getStatus()).toMatchObject({
+        daemonResidentMemoryBytes: lastByte - 1,
+        measuredRunnerMemoryBytes,
+        overMemoryBudget: false
+      });
+      readResident.mockReturnValue(lastByte + 1);
+      expect(warm.getStatus()).toMatchObject({
+        daemonResidentMemoryBytes: lastByte + 1,
+        measuredRunnerMemoryBytes,
+        overMemoryBudget: true
+      });
+    } finally {
+      readResident.mockRestore();
+    }
+  });
+
+  it('keeps resource-free retained results under memory pressure and idle expiry, and warns once', async () => {
+    test = await WarmSetTestFixture.createAsync();
+    test.configuration = { ...GENEROUS_WARM_CONFIGURATION, watch: false };
+    const { fixture } = test;
+    await fixture.buildSuccessfullyAsync();
+    const { warm, graph, watcher } = test;
+    const records: Map<string, IOperationExecutionResult | undefined> = new Map(
+      ['a', 'b'].map((name) => [name, graph.resultByOperation.get(test!.operation(name))])
+    );
+    expect([...records.values()].every((record) => record !== undefined)).toBe(true);
+    const runs: string[] = fixture.runs();
+    test.update({ watch: false, warmMemoryBudgetMB: 0.01, warmIdleTimeoutSeconds: 0.01 });
+    await delayAsync(50);
+    for (let pass: number = 0; pass < 2; pass++) {
+      const status = await warm.maintainAsync();
+      expect(status).toMatchObject({ overMemoryBudget: true, overProjectLimit: false });
+      expect(status.deferredReason).toBeUndefined();
+      expect([...status.retainedProjectNames].sort()).toEqual(['a', 'b']);
+    }
+    for (const [name, record] of records) {
+      expect(graph.resultByOperation.get(test.operation(name))).toBe(record);
+    }
+    expect(watcher.watchedProjectNames.size).toBe(0);
+
+    // The retained results still make an unchanged build a warm no-op skip.
+    await fixture.buildSuccessfullyAsync();
+    await warm.maintainAsync();
+    expect(fixture.runs()).toEqual(runs);
+    expect(test.diagnostics.filter((error) => error.message.includes('Warm-set pressure'))).toHaveLength(1);
+  });
+
   it('reports missing child measurements and uses conservative LRU instead of inventing memory scores', async () => {
     const { fixture, warm } = await startAsync({ ipc: true });
     const missing = ['a', 'b'].map((name) => test!.operation(name).runner!);
@@ -362,6 +492,26 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(graph.resultByOperation.size).toBe(0);
   });
 
+  it('leaves the real repository lock to a native CLI command in a pass that has nothing to release', async () => {
+    const { fixture, warm, graph, watcher } = await startAsync();
+    const acquire = jest.spyOn(fixture.session, 'acquireExecutionLeaseAsync');
+    const gate = await createNativeScriptGateAsync(fixture.folder, 'c');
+    const native = runNativeCommandAsync(fixture.folder, ['build', '--only', 'c', '--parallelism', '3']);
+    try {
+      await gate.entered;
+      const status = await warm.maintainAsync();
+      expect(status.deferredReason).toBeUndefined();
+      expect(acquire).not.toHaveBeenCalled();
+      expect(graph.resultByOperation.size).toBe(2);
+      expect([...watcher.watchedProjectNames].sort()).toEqual(['a', 'b']);
+    } finally {
+      await gate.releaseAsync();
+      acquire.mockRestore();
+      await native;
+    }
+    expect((await native).exitCode).toBe(0);
+  });
+
   it('does not touch paused prepared records or native ownership until a plan has been discarded', async () => {
     const { fixture, warm, graph } = await startAsync();
     const admission = await getWorkspaceRequestScheduler(fixture.session).acquireAsync({
@@ -526,7 +676,8 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(nativeRecord.dependencies).toEqual(new Set());
     expect(nativeRecord.consumers).toEqual(new Set());
     expect(nativeRecord.eventSink).toBeUndefined();
-    expect(nativeRecord.environment).toBeUndefined();
+    // The record's environment is a whole environment, so a failure prints only a boolean.
+    expect(nativeRecord.environment === undefined).toBe(true);
     expect(nativeRecord.createChildProcessReporter()).toBeUndefined();
     expect(() => nativeRecord.collatedWriter).toThrow(
       'Cannot reopen the output of a detached execution record.'
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
new file mode 100644
index 00000000000..0a2cbda6e59
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
@@ -0,0 +1,401 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  OperationStatus,
+  type IOperationGraph,
+  type IOperationRunner,
+  type Operation
+} from '@microsoft/rush-lib';
+
+import type { RequestScheduler } from '../RequestScheduler';
+import type { WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
+import {
+  WorkspaceWarmSet,
+  type IWorkspaceWarmSetOptions,
+  type IWorkspaceWarmSetStatus,
+  type WorkspaceWarmSetConfiguration
+} from '../WorkspaceWarmSet';
+
+type Tap = (...args: unknown[]) => unknown;
+
+const CONFIGURATION: WorkspaceWarmSetConfiguration = {
+  watch: false,
+  warmIdleTimeoutSeconds: 3600,
+  warmMemoryBudgetMB: 1024 * 1024,
+  warmSetMaxProjects: 20,
+  autoWarmByTelemetry: false
+};
+
+interface ITestGraph {
+  readonly graph: IOperationGraph;
+  readonly operations: Operation[];
+  readonly requestAll: () => void;
+}
+
+function createHook(taps: Tap[]): { tap: (options: unknown, fn: Tap) => void } {
+  return {
+    tap: (options: unknown, fn: Tap) => {
+      taps.push(fn);
+    }
+  };
+}
+
+// A graph shaped like a warm generation of a large monorepo: every project has retained results and nothing
+// is running.
+function createGraph(projectCount: number): ITestGraph {
+  const operations: Operation[] = [];
+  for (let i: number = 0; i < projectCount; i++) {
+    operations.push({
+      name: `p${i} (build)`,
+      associatedProject: { packageName: `p${i}` },
+      enabled: true,
+      runner: undefined,
+      consumers: new Set()
+    } as unknown as Operation);
+  }
+  const configureIterationTaps: Tap[] = [];
+  const resultByOperation: Map<Operation, unknown> = new Map(
+    operations.map((operation) => [operation, { status: OperationStatus.Success }])
+  );
+  const graph: IOperationGraph = {
+    operations: new Set(operations),
+    resultByOperation,
+    hooks: {
+      configureIteration: createHook(configureIterationTaps),
+      extendIteration: createHook([]),
+      beforeExecuteOperationAsync: createHook([]),
+      afterExecuteIterationAsync: createHook([]),
+      onIdle: createHook([])
+    },
+    hasScheduledIteration: false,
+    status: OperationStatus.Ready,
+    abortController: new AbortController(),
+    deleteResults: (deleted: Iterable<Operation>): void => {
+      for (const operation of deleted) resultByOperation.delete(operation);
+    },
+    closeRunnersAsync: async (closed: Iterable<Operation>): Promise<void> => {
+      for (const operation of closed) await operation.runner?.closeAsync?.();
+    }
+  } as unknown as IOperationGraph;
+  return {
+    graph,
+    operations,
+    requestAll: () => {
+      for (const tap of configureIterationTaps) tap(new Map(), new Map(), {});
+    }
+  };
+}
+
+function attach(
+  graph: IOperationGraph,
+  configuration: Partial<WorkspaceWarmSetConfiguration> = {},
+  options: Partial<IWorkspaceWarmSetOptions> = {}
+): WorkspaceWarmSet {
+  return WorkspaceWarmSet.attach({
+    operationGraph: graph,
+    configuration: { ...CONFIGURATION, ...configuration },
+    scheduler: { acquireAsync: async () => ({ release: () => undefined }) } as unknown as RequestScheduler,
+    acquireExecutionLeaseAsync: async () => ({ [Symbol.asyncDispose]: async () => undefined }),
+    watcher: {
+      watchedProjectNames: new Set<string>(),
+      watchProjects: () => undefined,
+      unwatchProjectsAsync: async () => undefined
+    } as unknown as WorkspaceSessionFileWatcher,
+    ...options
+  });
+}
+
+interface ITestWatcher {
+  readonly watcher: WorkspaceSessionFileWatcher;
+  readonly watched: Set<string>;
+  readonly failNextWatch: () => void;
+}
+
+function createWatcher(): ITestWatcher {
+  const watched: Set<string> = new Set();
+  let fail: boolean = false;
+  const watcher: WorkspaceSessionFileWatcher = {
+    get watchedProjectNames(): ReadonlySet<string> {
+      return new Set(watched);
+    },
+    watchProjects: (projectNames: Iterable<string>): void => {
+      if (fail) {
+        fail = false;
+        throw new Error('watch failed');
+      }
+      for (const name of projectNames) watched.add(name);
+    },
+    unwatchProjectsAsync: async (projectNames: Iterable<string>): Promise<void> => {
+      for (const name of projectNames) watched.delete(name);
+    }
+  } as unknown as WorkspaceSessionFileWatcher;
+  return {
+    watcher,
+    watched,
+    failNextWatch: () => {
+      fail = true;
+    }
+  };
+}
+
+function createLease(): jest.Mock<Promise<AsyncDisposable>, []> {
+  return jest.fn(async () => ({ [Symbol.asyncDispose]: async () => undefined }));
+}
+
+async function settleAsync(warm: WorkspaceWarmSet): Promise<void> {
+  // Lets the passes scheduled by attachment and by a simulated request finish.
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  await warm.maintainAsync();
+}
+
+function createResidentRunner(): IOperationRunner {
+  let active: boolean = true;
+  return {
+    name: 'resident',
+    isNoOp: false,
+    cacheable: false,
+    reportTiming: false,
+    silent: false,
+    warningsAreAllowed: false,
+    get isActive(): boolean {
+      return active;
+    },
+    getConfigHash: () => '',
+    executeAsync: async () => OperationStatus.Success,
+    closeAsync: async () => {
+      active = false;
+    }
+  };
+}
+
+async function countStatusReadsInPassAsync(warm: WorkspaceWarmSet): Promise<number> {
+  // Let the pass scheduled by attachment and by the simulated request settle, so only the measured pass is counted.
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  await warm.maintainAsync();
+  const getStatus: jest.SpyInstance = jest.spyOn(warm, 'getStatus');
+  try {
+    await warm.maintainAsync();
+    return getStatus.mock.calls.length;
+  } finally {
+    getStatus.mockRestore();
+  }
+}
+
+describe('warm-set maintenance cost', () => {
+  const disposables: WorkspaceWarmSet[] = [];
+  afterEach(async () => {
+    for (const warm of disposables.splice(0)) await warm[Symbol.asyncDispose]();
+  });
+
+  it('reads status a constant number of times in a pass that evicts nothing, regardless of project count', async () => {
+    const counts: number[] = [];
+    for (const projectCount of [10, 2000]) {
+      const { graph, requestAll } = createGraph(projectCount);
+      const warm: WorkspaceWarmSet = attach(graph);
+      disposables.push(warm);
+      requestAll();
+      counts.push(await countStatusReadsInPassAsync(warm));
+      expect(graph.resultByOperation.size).toBe(projectCount);
+      expect(warm.getStatus().retainedProjectNames).toHaveLength(projectCount);
+    }
+    expect(counts[1]).toBe(counts[0]);
+    expect(counts[0]).toBeLessThanOrEqual(2);
+  });
+
+  it('re-reads status after each eviction attempt, so it stops evicting once back under the project cap', async () => {
+    const { graph, operations, requestAll } = createGraph(40);
+    for (const operation of operations.slice(0, 5)) operation.runner = createResidentRunner();
+    const warm: WorkspaceWarmSet = attach(graph, { warmSetMaxProjects: 3 });
+    disposables.push(warm);
+    requestAll();
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    const getStatus: jest.SpyInstance = jest.spyOn(warm, 'getStatus');
+    const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    // Two evictions: one read before the first attempt, one after each attempt, one for the pass result.
+    expect(getStatus.mock.calls.length).toBeLessThanOrEqual(4);
+    getStatus.mockRestore();
+    expect(status.overProjectLimit).toBe(false);
+    const evicted: Operation[] = operations.filter((operation) => !graph.resultByOperation.has(operation));
+    expect(evicted).toHaveLength(2);
+    expect(evicted.every((operation) => operation.runner?.isActive === false)).toBe(true);
+    expect(graph.resultByOperation.size).toBe(38);
+  });
+
+  it('takes the native repository lease only for a pass that releases resources or stops observing a project', async () => {
+    const { graph, operations, requestAll } = createGraph(10);
+    const { watcher, watched } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { warmSetMaxProjects: 3 },
+      { watcher, acquireExecutionLeaseAsync: acquire }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    acquire.mockClear();
+
+    // Retained results with nothing to release: native Rush commands can take the repository lock meanwhile.
+    const idle: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+    expect(idle.deferredReason).toBeUndefined();
+    expect(idle.retainedProjectNames).toHaveLength(10);
+
+    // With daemon.watch off, a remaining project watcher is closed under the lease.
+    watched.add('p3');
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(1);
+    expect(watched.size).toBe(0);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(1);
+
+    // Resource holders over the project cap are released under the lease.
+    for (const operation of operations.slice(0, 5)) operation.runner = createResidentRunner();
+    const evicted: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+    expect(evicted.overProjectLimit).toBe(false);
+    expect(operations.filter((operation) => operation.runner?.isActive)).toHaveLength(3);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+  });
+
+  it('takes the native repository lease to observe a requested project again and to clear an observation failure', async () => {
+    const { graph, requestAll } = createGraph(4);
+    const { watcher, watched, failNextWatch } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const diagnostics: string[] = [];
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { watch: true },
+      {
+        watcher,
+        acquireExecutionLeaseAsync: acquire,
+        onDiagnostic: (error: Error) => diagnostics.push(error.message)
+      }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    expect(watched.size).toBe(4);
+    acquire.mockClear();
+    await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+
+    watched.delete('p1');
+    failNextWatch();
+    const failed: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(1);
+    expect(failed.cleanupFailures).toEqual([expect.stringContaining('watch failed')]);
+    expect(watched.has('p1')).toBe(false);
+
+    const recovered: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+    expect(recovered.cleanupFailures).toEqual([]);
+    expect(watched.has('p1')).toBe(true);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+
+    // A request observes its projects again, but the reported failure is cleared only by a maintenance pass.
+    watched.delete('p2');
+    failNextWatch();
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(3);
+    requestAll();
+    expect(watched.size).toBe(4);
+    const cleared: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(4);
+    expect(cleared.cleanupFailures).toEqual([]);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(4);
+    expect(diagnostics).toEqual([
+      expect.stringContaining('watch failed'),
+      expect.stringContaining('watch failed')
+    ]);
+  });
+
+  it('takes no native repository lease for a project that daemon.watch leaves unobserved after its eviction failed', async () => {
+    const { graph, requestAll } = createGraph(4);
+    const { watcher, watched } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const diagnostics: string[] = [];
+    // The eviction stops observing the project, then fails to drop its results.
+    graph.deleteResults = () => {
+      throw new Error('delete failed');
+    };
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { watch: true, warmSetMaxProjects: 3 },
+      {
+        watcher,
+        acquireExecutionLeaseAsync: acquire,
+        onDiagnostic: (error: Error) => diagnostics.push(error.message)
+      }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    expect(watched.size).toBe(3);
+    expect(diagnostics).toEqual([expect.stringContaining('Could not evict warm project')]);
+    acquire.mockClear();
+
+    // daemon.watch doesn't observe a project whose eviction failed again, so a pass has nothing to apply
+    const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+    expect(status.cleanupFailures).toEqual([expect.stringContaining('delete failed')]);
+    expect(status.retainedProjectNames).toHaveLength(4);
+    expect(watched.size).toBe(3);
+    expect(diagnostics).toHaveLength(1);
+  });
+
+  it('takes no native repository lease for a protected project that stays observed with daemon.watch off', async () => {
+    const { graph, operations, requestAll } = createGraph(4);
+    const { watcher, watched } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      {},
+      {
+        watcher,
+        acquireExecutionLeaseAsync: acquire,
+        getProtectedOperations: () => new Set([operations[0]])
+      }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    watched.add('p0');
+    acquire.mockClear();
+
+    // daemon.watch off stops observing only the projects that aren't protected
+    const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+    expect(status.protectedProjectNames).toEqual(['p0']);
+    expect(watched.has('p0')).toBe(true);
+  });
+
+  it('takes no native repository lease for an expired protected project that holds resources, pass after pass', async () => {
+    const { graph, operations, requestAll } = createGraph(4);
+    operations[0].runner = createResidentRunner();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { warmIdleTimeoutSeconds: 0.001 },
+      { acquireExecutionLeaseAsync: acquire, getProtectedOperations: () => new Set([operations[0]]) }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    acquire.mockClear();
+
+    // Expiry never evicts a protected project, so no pass needs to own the repository for it
+    for (let pass: number = 0; pass < 2; pass++) {
+      const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+      expect(status.protectedProjectNames).toEqual(['p0']);
+      expect(status.deferredReason).toBeUndefined();
+    }
+    expect(acquire).not.toHaveBeenCalled();
+    expect(operations[0].runner?.isActive).toBe(true);
+    expect(graph.resultByOperation.size).toBe(4);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts b/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
new file mode 100644
index 00000000000..ef8ddd62b56
--- /dev/null
+++ b/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
@@ -0,0 +1,83 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { serveRushDaemonAsync, type IRushDaemonServeOptions } from '../../serveRushDaemon';
+import { TemporaryRepoWorkspaceSession } from '../TemporaryRepoWorkspaceSession';
+
+/**
+ * - `timer`: a timer that the daemon did not start keeps the process running after the daemon stops.
+ * - `failing`: the same, and the daemon fails right after it starts, so its caller sets exit code 1.
+ * - `nothing`: nothing keeps the process running.
+ */
+export type LeftBehind = 'timer' | 'failing' | 'nothing';
+
+/**
+ * - `callbacks`: passes `onError` and `onLog`, as the Rush daemon's own entry points do. Each one writes with its
+ *   own prefix, `fixture error: ` or `fixture log: `, so that a test can tell the paths apart.
+ * - `default`: neither.
+ */
+export type Reporter = 'callbacks' | 'default';
+
+/**
+ * - `process`: no `shutdownSignal`, so the daemon owns its process and handles SIGINT and SIGTERM itself.
+ * - `embedded`: the fixture passes a `shutdownSignal` that it never aborts. It owns the process, and the daemon
+ *   stops only when a client stops it.
+ */
+export type Ownership = 'process' | 'embedded';
+
+function writeJson(filename: string, value: unknown): void {
+  fs.writeFileSync(`${filename}.tmp`, JSON.stringify(value));
+  fs.renameSync(`${filename}.tmp`, filename);
+}
+
+function onReady(leftBehind: LeftBehind, controlFolder: string): IRushDaemonServeOptions['onReady'] {
+  return (host) => {
+    if (leftBehind !== 'nothing') {
+      // Like a plugin or an SDK client that polls and is never stopped. Its first poll would come long after
+      // the test ends, so it only keeps the process running.
+      setInterval(() => undefined, 600000);
+    }
+    if (leftBehind === 'failing') throw new Error('The fixture failed after it started.');
+    writeJson(path.join(controlFolder, 'ready.json'), { paths: host.paths });
+  };
+}
+
+function getReporterOptions(reporter: Reporter): Pick<IRushDaemonServeOptions, 'onError' | 'onLog'> {
+  if (reporter === 'default') return {};
+  return {
+    onError: (error: Error) => process.stderr.write(`fixture error: ${error.stack ?? error.message}\n`),
+    onLog: (message: string) => process.stderr.write(`fixture log: ${message}\n`)
+  };
+}
+
+async function runAsync(): Promise<void> {
+  const [repoRoot, controlFolder, leftBehind, reporter, ownership] = process.argv.slice(2);
+  if (!repoRoot || !controlFolder || !leftBehind || !reporter || !ownership) {
+    throw new Error(
+      'The fixture needs a repository, a control folder, what it leaves behind, a reporter and an owner.'
+    );
+  }
+  try {
+    await serveRushDaemonAsync({
+      repoRoot,
+      rushVersion: '5.178.1',
+      daemonVersion: 'lingering-fixture',
+      createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+      onReady: onReady(leftBehind as LeftBehind, controlFolder),
+      ...getReporterOptions(reporter as Reporter),
+      shutdownSignal: (ownership as Ownership) === 'embedded' ? new AbortController().signal : undefined
+    });
+  } finally {
+    writeJson(path.join(controlFolder, 'stopped.json'), { stoppedAtMs: Date.now() });
+  }
+}
+
+if (require.main === module) {
+  void runAsync().catch((error: unknown) => {
+    process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}
diff --git a/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts b/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
new file mode 100644
index 00000000000..511f0d64a08
--- /dev/null
+++ b/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { LockFile, SubprocessTerminator } from '@rushstack/node-core-library';
+
+import type { IResolveDaemonRequestOptions } from '../../DaemonRequestDispatcher';
+import { serveRushDaemonAsync } from '../../serveRushDaemon';
+import { CallbackDaemonRequestResolver } from '../DaemonRequestWireTestUtilities';
+import { TemporaryRepoWorkspaceSession } from '../TemporaryRepoWorkspaceSession';
+
+// Outlives the test, but ends by itself if a failed test leaves it behind.
+const OPERATION_SCRIPT: string = 'setTimeout(() => undefined, 60000);';
+
+function writeJson(filename: string, value: unknown): void {
+  fs.writeFileSync(`${filename}.tmp`, JSON.stringify(value));
+  fs.renameSync(`${filename}.tmp`, filename);
+}
+
+/**
+ * Like a request that holds the repository lock and runs an operation, and then waits for a lock that another
+ * process holds: it ignores its abort signal and never settles.
+ */
+async function runStuckRequestAsync(
+  options: IResolveDaemonRequestOptions,
+  controlFolder: string
+): Promise<never> {
+  const repoLock: LockFile | undefined = LockFile.tryAcquire(
+    options.workspaceSession.rushConfiguration.commonTempFolder,
+    'rush'
+  );
+  if (!repoLock) throw new Error('The repository lock is taken.');
+  const operation: ChildProcess = spawn(process.execPath, ['-e', OPERATION_SCRIPT], {
+    ...SubprocessTerminator.RECOMMENDED_OPTIONS,
+    stdio: 'ignore'
+  });
+  SubprocessTerminator.killProcessTreeOnExit(operation, SubprocessTerminator.RECOMMENDED_OPTIONS);
+  await new Promise<void>((resolve, reject) => {
+    operation.once('spawn', resolve);
+    operation.once('error', reject);
+  });
+  writeJson(path.join(controlFolder, 'request.json'), { operationPid: operation.pid });
+  return await new Promise<never>(() => undefined);
+}
+
+async function runAsync(): Promise<void> {
+  const [repoRoot, controlFolder, shutdownDeadlineMs] = process.argv.slice(2);
+  if (!repoRoot || !controlFolder || !shutdownDeadlineMs) {
+    throw new Error(
+      'The fixture needs a repository folder, a control folder and a shutdown deadline (or "default").'
+    );
+  }
+  // Process mode: no shutdownSignal, so the daemon handles SIGINT and SIGTERM itself.
+  await serveRushDaemonAsync({
+    repoRoot,
+    rushVersion: '5.178.1',
+    daemonVersion: 'stuck-shutdown-fixture',
+    // "default" leaves the deadline out, as rushd does.
+    ...(shutdownDeadlineMs === 'default' ? {} : { shutdownDeadlineMs: Number(shutdownDeadlineMs) }),
+    createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+    requestResolver: new CallbackDaemonRequestResolver((options: IResolveDaemonRequestOptions) =>
+      runStuckRequestAsync(options, controlFolder)
+    ),
+    onReady: (host) => writeJson(path.join(controlFolder, 'ready.json'), { paths: host.paths }),
+    onError: (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`)
+  });
+}
+
+if (require.main === module) {
+  void runAsync().catch((error: unknown) => {
+    process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}
diff --git a/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts b/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts
index a74d5eea606..52137a67ba8 100644
--- a/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts
+++ b/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts
@@ -70,7 +70,8 @@ async function runAsync(): Promise<void> {
       fs.writeFileSync(`${filename}.tmp`, JSON.stringify({ paths: host.paths, pid: process.pid }));
       fs.renameSync(`${filename}.tmp`, filename);
     },
-    onError: (error) => process.stderr.write(`${error.stack ?? error.message}\n`)
+    onError: (error) => process.stderr.write(`${error.stack ?? error.message}\n`),
+    onLog: (message) => process.stderr.write(`${message}\n`)
   });
 }
 
diff --git a/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json b/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
index 072e9f7d497..bd030586f4c 100644
--- a/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
+++ b/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
@@ -60,6 +60,19 @@
      */
     // "azureEnvironment": "AzurePublicCloud",
 
+    /**
+     * An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite,
+     * private endpoints, or storage emulators. When specified, this overrides the default endpoint derived
+     * from "storageAccountName". The URL must start with "http://" or "https://".
+     *
+     * A credential saved by "rush update-cloud-credentials" is used only with the endpoint that it was
+     * saved for. An Azure login ("rush update-cloud-credentials --interactive") needs an "https://"
+     * endpoint. For an "http://" endpoint, such as Azurite, provide a SAS token with
+     * "rush update-cloud-credentials --credential" or the RUSH_BUILD_CACHE_CREDENTIAL environment
+     * variable, or read without a credential.
+     */
+    // "storageEndpoint": "http://127.0.0.1:10000/devstoreaccount1",
+
     /**
      * An optional prefix for cache item blob names.
      */
diff --git a/libraries/rush-lib/assets/rush-init/rush.json b/libraries/rush-lib/assets/rush-init/rush.json
index 33fec400088..33d8c328197 100644
--- a/libraries/rush-lib/assets/rush-init/rush.json
+++ b/libraries/rush-lib/assets/rush-init/rush.json
@@ -337,6 +337,11 @@
    * Warm-set policies require the generation-owned WorkspaceWarmSet host attachment.
    * They retain requested work without starting scripts and impose no hard process-RSS ceiling.
    * The watch option retains host observation of warm project files between requests, without running builds.
+   * The daemon serves a command that a configured Rush plugin participates in only if the plugin's manifest
+   * declares "daemonCompatible", or if "compatiblePlugins" lists the plugin's name. Otherwise it runs in-process.
+   * One daemon engine serves several phased commands only if every plugin that taps the initialize or
+   * runAnyPhasedCommand hook is command-agnostic: its manifest declares "daemonCommandAgnostic", or
+   * "commandAgnosticPlugins" lists its name.
    */
   /*[LINE "HYPOTHETICAL"]*/ "daemon": {
     /*[LINE "HYPOTHETICAL"]*/ "enabled": false,
@@ -348,7 +353,9 @@
     /*[LINE "HYPOTHETICAL"]*/ "warmIdleTimeoutSeconds": 300,
     /*[LINE "HYPOTHETICAL"]*/ "warmMemoryBudgetMB": 512,
     /*[LINE "HYPOTHETICAL"]*/ "warmSetMaxProjects": 20,
-    /*[LINE "HYPOTHETICAL"]*/ "autoWarmByTelemetry": false
+    /*[LINE "HYPOTHETICAL"]*/ "autoWarmByTelemetry": false,
+    /*[LINE "HYPOTHETICAL"]*/ "compatiblePlugins": [],
+    /*[LINE "HYPOTHETICAL"]*/ "commandAgnosticPlugins": []
   /*[LINE "HYPOTHETICAL"]*/ },
 
   /**
diff --git a/libraries/rush-lib/src/api/CommandLineConfiguration.ts b/libraries/rush-lib/src/api/CommandLineConfiguration.ts
index 8ec4b5a3dee..7423e3cf952 100644
--- a/libraries/rush-lib/src/api/CommandLineConfiguration.ts
+++ b/libraries/rush-lib/src/api/CommandLineConfiguration.ts
@@ -1,10 +1,11 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { JsonFile, JsonSchema, FileSystem } from '@rushstack/node-core-library';
+import { JsonSchema, FileSystem } from '@rushstack/node-core-library';
 import type { CommandLineParameter } from '@rushstack/ts-command-line';
 
 import { RushConstants } from '../logic/RushConstants';
+import { type JsonFileLoadCache, loadJsonFile } from '../utilities/JsonFileLoadCache';
 import type {
   CommandJson,
   ICommandLineJson,
@@ -635,11 +636,19 @@ export class CommandLineConfiguration {
    * use {@see loadFromFileOrDefault} instead.
    *
    * If the file does not exist, this function returns `undefined`
+   *
+   * @param jsonFileLoadCache - The cache of a long-lived engine host, which parses the file again only if it changed.
    */
-  public static tryLoadFromFile(jsonFilePath: string): CommandLineConfiguration | undefined {
+  public static tryLoadFromFile(
+    jsonFilePath: string,
+    jsonFileLoadCache?: JsonFileLoadCache
+  ): CommandLineConfiguration | undefined {
     let commandLineJson: ICommandLineJson | undefined;
     try {
-      commandLineJson = JsonFile.loadAndValidate(jsonFilePath, _jsonSchema);
+      commandLineJson = loadJsonFile(jsonFileLoadCache, jsonFilePath, (json) => {
+        _jsonSchema.validateObject(json, jsonFilePath);
+        return json as ICommandLineJson;
+      });
     } catch (e) {
       if (!FileSystem.isNotExistError(e as Error)) {
         throw e;
@@ -667,39 +676,25 @@ export class CommandLineConfiguration {
    * Loads the configuration from the specified file and applies any omitted default build
    * settings.  If the file does not exist, then a default instance is returned.
    * If the file contains errors, then an exception is thrown.
+   *
+   * @param jsonFileLoadCache - The cache of a long-lived engine host, which parses the file again only if it changed.
    */
   public static loadFromFileOrDefault(
     jsonFilePath?: string,
-    doNotIncludeDefaultBuildCommands?: boolean
+    doNotIncludeDefaultBuildCommands?: boolean,
+    jsonFileLoadCache?: JsonFileLoadCache
   ): CommandLineConfiguration {
     let commandLineJson: ICommandLineJson | undefined = undefined;
     if (jsonFilePath) {
       try {
-        commandLineJson = JsonFile.load(jsonFilePath);
+        commandLineJson = loadJsonFile(jsonFileLoadCache, jsonFilePath, (json) =>
+          _prepareRepoCommandLineJson(json as ICommandLineJson, jsonFilePath)
+        );
       } catch (e) {
         if (!FileSystem.isNotExistError(e as Error)) {
           throw e;
         }
       }
-
-      // merge commands specified in command-line.json and default (re)build settings
-      // Ensure both build commands are included and preserve any other commands specified
-      if (commandLineJson?.commands) {
-        _applyBuildCommandDefaults(commandLineJson);
-
-        _jsonSchema.validateObject(commandLineJson, jsonFilePath);
-
-        // Validate that globalPlugin commands are not used in the repo's command-line.json
-        for (const { commandKind, name } of commandLineJson.commands) {
-          if (commandKind === RushConstants.globalPluginCommandKind) {
-            throw new Error(
-              `${RushConstants.commandLineFilename} defines a command "${name}" using ` +
-                `the command kind "${RushConstants.globalPluginCommandKind}". This command kind can only ` +
-                `be used in command-line.json files provided by Rush plugins.`
-            );
-          }
-        }
-      }
     }
 
     return new CommandLineConfiguration(commandLineJson, { doNotIncludeDefaultBuildCommands });
@@ -751,6 +746,31 @@ export class CommandLineConfiguration {
   }
 }
 
+function _prepareRepoCommandLineJson(
+  commandLineJson: ICommandLineJson,
+  jsonFilePath: string
+): ICommandLineJson {
+  // merge commands specified in command-line.json and default (re)build settings
+  // Ensure both build commands are included and preserve any other commands specified
+  if (commandLineJson?.commands) {
+    _applyBuildCommandDefaults(commandLineJson);
+
+    _jsonSchema.validateObject(commandLineJson, jsonFilePath);
+
+    // Validate that globalPlugin commands are not used in the repo's command-line.json
+    for (const { commandKind, name } of commandLineJson.commands) {
+      if (commandKind === RushConstants.globalPluginCommandKind) {
+        throw new Error(
+          `${RushConstants.commandLineFilename} defines a command "${name}" using ` +
+            `the command kind "${RushConstants.globalPluginCommandKind}". This command kind can only ` +
+            `be used in command-line.json files provided by Rush plugins.`
+        );
+      }
+    }
+  }
+  return commandLineJson;
+}
+
 function _applyBuildCommandDefaults(commandLineJson: ICommandLineJson): void {
   // merge commands specified in command-line.json and default (re)build settings
   // Ensure both build commands are included and preserve any other commands specified
diff --git a/libraries/rush-lib/src/api/CommandLineJson.ts b/libraries/rush-lib/src/api/CommandLineJson.ts
index 6d07a609808..e34dcef5483 100644
--- a/libraries/rush-lib/src/api/CommandLineJson.ts
+++ b/libraries/rush-lib/src/api/CommandLineJson.ts
@@ -48,6 +48,7 @@ export interface IPhasedCommandWithoutPhasesJson extends IBaseCommandJson {
  */
 export interface IPhasedCommandJson extends IPhasedCommandWithoutPhasesJson {
   phases: string[];
+  disableBuildCache?: boolean;
   watchOptions?: {
     alwaysWatch: boolean;
     debounceMs?: number;
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 695dcaa548f..fe33e4b888a 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -13,11 +13,55 @@ export interface IDaemonConfigurationJson {
   readonly watch?: boolean;
   /** Enables explicit operationSettings[].daemonIpc Node runners for daemon builds. Defaults to false. */
   readonly usePersistentIpcRunners?: boolean;
+  /**
+   * Lets daemon builds run an operation's `<phase>:incremental` script, instead of its initial script, on top of the
+   * outputs of its last successful run in the daemon, when only files that it builds were edited since then and its
+   * output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. Results of an
+   * incremental script are not written to the build cache. Defaults to true.
+   */
+  readonly incrementalBuilds?: boolean;
+  /**
+   * Keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation
+   * whose rush-project.json operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run
+   * when `incrementalBuilds` allows one. Otherwise the worker is closed and the initial script runs. Requires
+   * `incrementalBuilds`. Defaults to false.
+   */
+  readonly warmWorkers?: boolean;
+  /**
+   * Lets a build request that arrives while the daemon executes an incremental batch with the same request settings
+   * add its operations to the executing iteration, and get its result once they complete, instead of waiting for the
+   * iteration to end. Experimental. Defaults to false.
+   */
+  readonly joinRunningBatch?: boolean;
+  /**
+   * Lets an operation of a daemon build complete before its build cache entry is written. The daemon clones the
+   * operation's output files, which takes well under a second on a file system that can clone files (such as Btrfs,
+   * XFS or APFS), and writes the entry from the clones in the background. So the operations that depend on it, and the
+   * command, don't wait for the entry. An operation waits at most half a second for its clones. Slower clones finish
+   * in the background, and the entry is dropped if an output file changes before it is cloned. Otherwise, and in
+   * cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be
+   * written in the background doesn't change the operation's status, and the daemon drops the entries that it hasn't
+   * written when it stops. Defaults to false.
+   */
+  readonly deferCacheWrites?: boolean;
+  /**
+   * Lets an idle daemon load the next workspace graph and create its engine once the workspace inputs change in a way
+   * that the next request would otherwise reload for, so that the next request with the same command line as the last
+   * one starts on a bound engine. It never runs an operation. A request that it cannot serve stops it. Experimental.
+   * Defaults to false.
+   */
+  readonly backgroundPrepare?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
-  /** Idle resource expiration in an attached daemon warm set. Defaults to 300 seconds. */
+  /**
+   * Idle resource expiration in an attached daemon warm set; retained results of resource-free projects do not
+   * expire. Defaults to 300 seconds.
+   */
   readonly warmIdleTimeoutSeconds?: number;
-  /** Best-effort sampled RSS budget for an attached warm set, not a hard ceiling. Defaults to 512 MiB. */
+  /**
+   * Best-effort sampled RSS budget for an attached warm set, not a hard ceiling; active/protected work and retained
+   * results of resource-free projects are exempt. Defaults to 512 MiB.
+   */
   readonly warmMemoryBudgetMB?: number;
   /**
    * Best-effort limit on projects holding warm resources (active runners or file watchers); active/protected work
@@ -26,19 +70,40 @@ export interface IDaemonConfigurationJson {
   readonly warmSetMaxProjects?: number;
   /** Prefer measured time-saved * frequency / resident-memory retention over LRU. Never starts scripts. Defaults to false. */
   readonly autoWarmByTelemetry?: boolean;
+  /**
+   * Names of configured Rush plugins (their `pluginName` in rush-plugins.json) that the repository has verified
+   * for long-lived daemon engines, in addition to plugins whose manifest sets `daemonCompatible`. Defaults to none.
+   */
+  readonly compatiblePlugins?: ReadonlyArray<string>;
+  /**
+   * Names of configured Rush plugins (their `pluginName` in rush-plugins.json) that the repository has verified to be
+   * command-agnostic, in addition to plugins whose manifest sets `daemonCommandAgnostic`. Such a plugin's
+   * `initialize` and `runAnyPhasedCommand` taps do the same for every phased command, so they don't stop one
+   * daemon engine from serving several commands. Defaults to none.
+   */
+  readonly commandAgnosticPlugins?: ReadonlyArray<string>;
 }
 
+type PluginNamesKey = 'compatiblePlugins' | 'commandAgnosticPlugins';
+
 const defaults: Required<IDaemonConfigurationJson> = {
   enabled: false,
   idleTimeoutSeconds: 900,
   autoStart: true,
   watch: false,
   usePersistentIpcRunners: false,
+  incrementalBuilds: true,
+  warmWorkers: false,
+  joinRunningBatch: false,
+  deferCacheWrites: false,
+  backgroundPrepare: false,
   queueTimeoutSeconds: 30,
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
   warmSetMaxProjects: 20,
-  autoWarmByTelemetry: false
+  autoWarmByTelemetry: false,
+  compatiblePlugins: Object.freeze([]),
+  commandAgnosticPlugins: Object.freeze([])
 };
 
 /** The exact recognized environment names. Unknown RUSH_DAEMON* names are rejected. @beta */
@@ -49,11 +114,18 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     autoStart: 'RUSH_DAEMON_AUTO_START',
     watch: 'RUSH_DAEMON_WATCH',
     usePersistentIpcRunners: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
+    incrementalBuilds: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
+    warmWorkers: 'RUSH_DAEMON_WARM_WORKERS',
+    joinRunningBatch: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
+    deferCacheWrites: 'RUSH_DAEMON_DEFER_CACHE_WRITES',
+    backgroundPrepare: 'RUSH_DAEMON_BACKGROUND_PREPARE',
     queueTimeoutSeconds: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
     warmSetMaxProjects: 'RUSH_DAEMON_WARM_SET_MAX_PROJECTS',
-    autoWarmByTelemetry: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY'
+    autoWarmByTelemetry: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY',
+    compatiblePlugins: 'RUSH_DAEMON_COMPATIBLE_PLUGINS',
+    commandAgnosticPlugins: 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS'
   });
 
 /**
@@ -90,17 +162,64 @@ export function resolveDaemonConfiguration(
     autoStart: booleanOption('autoStart', json, environment),
     watch: booleanOption('watch', json, environment),
     usePersistentIpcRunners: booleanOption('usePersistentIpcRunners', json, environment),
+    incrementalBuilds: booleanOption('incrementalBuilds', json, environment),
+    warmWorkers: booleanOption('warmWorkers', json, environment),
+    joinRunningBatch: booleanOption('joinRunningBatch', json, environment),
+    deferCacheWrites: booleanOption('deferCacheWrites', json, environment),
+    backgroundPrepare: booleanOption('backgroundPrepare', json, environment),
     autoWarmByTelemetry: booleanOption('autoWarmByTelemetry', json, environment),
     idleTimeoutSeconds: numberOption('idleTimeoutSeconds', json, environment),
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
     warmIdleTimeoutSeconds: numberOption('warmIdleTimeoutSeconds', json, environment),
     warmMemoryBudgetMB: numberOption('warmMemoryBudgetMB', json, environment),
-    warmSetMaxProjects: numberOption('warmSetMaxProjects', json, environment)
+    warmSetMaxProjects: numberOption('warmSetMaxProjects', json, environment),
+    compatiblePlugins: pluginNamesOption('compatiblePlugins', json, environment),
+    commandAgnosticPlugins: pluginNamesOption('commandAgnosticPlugins', json, environment)
   });
 }
 
+function pluginNamesOption(
+  key: PluginNamesKey,
+  json: IDaemonConfigurationJson,
+  environment: Readonly<Record<string, string | undefined>>
+): ReadonlyArray<string> {
+  const configured: unknown = json[key];
+  if (
+    configured !== undefined &&
+    (!Array.isArray(configured) ||
+      configured.some((name: unknown) => typeof name !== 'string' || !isPluginName(name)))
+  ) {
+    throw new Error(`daemon.${key} must be an array of plugin names.`);
+  }
+  const name: string = daemonEnvironmentVariables[key];
+  const value: string | undefined = environment[name];
+  if (value === undefined) {
+    return configured ? Object.freeze([...(configured as string[])]) : defaults[key];
+  }
+  // An empty value overrides rush.json with no plugins.
+  const names: string[] = value.trim() === '' ? [] : value.split(',').map((entry: string) => entry.trim());
+  if (!names.every(isPluginName)) {
+    throw new Error(`${name} must be a comma-separated list of plugin names.`);
+  }
+  return Object.freeze(names);
+}
+
+function isPluginName(name: string): boolean {
+  return name !== '' && name === name.trim() && !name.includes(',');
+}
+
 function booleanOption(
-  key: 'enabled' | 'autoStart' | 'watch' | 'autoWarmByTelemetry' | 'usePersistentIpcRunners',
+  key:
+    | 'enabled'
+    | 'autoStart'
+    | 'watch'
+    | 'autoWarmByTelemetry'
+    | 'usePersistentIpcRunners'
+    | 'incrementalBuilds'
+    | 'warmWorkers'
+    | 'joinRunningBatch'
+    | 'deferCacheWrites'
+    | 'backgroundPrepare',
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): boolean {
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index b8f3357b177..8578b1d4805 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -237,6 +237,20 @@ export const EnvironmentVariableNames = {
    */
   _RUSH_LIB_PATH: '_RUSH_LIB_PATH',
 
+  /**
+   * Internal variable that `rush-client` sets when it runs Rush in-process after it tried the Rush daemon: the time,
+   * in milliseconds since the Unix epoch, until which the command waits for another Rush process to release the
+   * repository's lock, instead of failing at once. Rush reads and removes it when it starts.
+   */
+  _RUSH_LOCK_WAIT_DEADLINE: '_RUSH_LOCK_WAIT_DEADLINE',
+
+  /**
+   * Internal variable that `rush-client` sets with `_RUSH_LOCK_WAIT_DEADLINE`: the process ID of the Rush daemon
+   * that handed the command back, so that Rush can name the daemon when it holds the repository's lock.
+   * Rush reads and removes it when it starts.
+   */
+  _RUSH_LOCK_WAIT_DAEMON_PID: '_RUSH_LOCK_WAIT_DAEMON_PID',
+
   /**
    * When Rush executes shell scripts, it sometimes changes the working directory to be a project folder or
    * the repository root folder.  The original working directory (where the Rush command was invoked) is assigned
@@ -276,6 +290,16 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_WATCH: 'RUSH_DAEMON_WATCH',
   /** Enables explicitly configured persistent Node IPC operations in the daemon. */
   RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
+  /** Lets daemon builds run an operation's guarded `:incremental` script outside watch mode. */
+  RUSH_DAEMON_INCREMENTAL_BUILDS: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
+  /** Keeps `:incremental:ipc` watch-mode workers alive between daemon builds. */
+  RUSH_DAEMON_WARM_WORKERS: 'RUSH_DAEMON_WARM_WORKERS',
+  /** Lets a daemon build request add its operations to the executing iteration of a compatible batch. */
+  RUSH_DAEMON_JOIN_RUNNING_BATCH: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
+  /** Lets daemon operations complete before their build cache entries are written. */
+  RUSH_DAEMON_DEFER_CACHE_WRITES: 'RUSH_DAEMON_DEFER_CACHE_WRITES',
+  /** Lets an idle daemon load the next workspace graph and create its engine before the next request. */
+  RUSH_DAEMON_BACKGROUND_PREPARE: 'RUSH_DAEMON_BACKGROUND_PREPARE',
   /** Overrides the request admission queue timeout. */
   RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   /** Overrides idle eviction in an attached daemon warm set. */
@@ -286,6 +310,10 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_WARM_SET_MAX_PROJECTS: 'RUSH_DAEMON_WARM_SET_MAX_PROJECTS',
   /** Enables telemetry-weighted retention of requested work in an attached warm set. */
   RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY',
+  /** Overrides the plugins that the repository has verified for long-lived daemon engines. */
+  RUSH_DAEMON_COMPATIBLE_PLUGINS: 'RUSH_DAEMON_COMPATIBLE_PLUGINS',
+  /** Overrides the plugins that the repository has verified to tap `runAnyPhasedCommand` the same way for every command. */
+  RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS: 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS',
   /** Gates the experimental graph client; requires host graph integration. */
   RUSH_DAEMON_EXPERIMENTAL: 'RUSH_DAEMON_EXPERIMENTAL'
 } as const;
@@ -692,11 +720,18 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_AUTO_START:
           case EnvironmentVariableNames.RUSH_DAEMON_WATCH:
           case EnvironmentVariableNames.RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS:
+          case EnvironmentVariableNames.RUSH_DAEMON_INCREMENTAL_BUILDS:
+          case EnvironmentVariableNames.RUSH_DAEMON_WARM_WORKERS:
+          case EnvironmentVariableNames.RUSH_DAEMON_JOIN_RUNNING_BATCH:
+          case EnvironmentVariableNames.RUSH_DAEMON_DEFER_CACHE_WRITES:
+          case EnvironmentVariableNames.RUSH_DAEMON_BACKGROUND_PREPARE:
           case EnvironmentVariableNames.RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_SET_MAX_PROJECTS:
           case EnvironmentVariableNames.RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY:
+          case EnvironmentVariableNames.RUSH_DAEMON_COMPATIBLE_PLUGINS:
+          case EnvironmentVariableNames.RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS:
           case EnvironmentVariableNames.RUSH_DAEMON_EXPERIMENTAL:
             // Validated together by resolveDaemonConfiguration().
             break;
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index e5246fbfa1d..f9aa8dbee6f 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -2,24 +2,39 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import type { PerformanceEntry } from 'node:perf_hooks';
 
 import { FileSystem, LockFile } from '@rushstack/node-core-library';
-import type { ITerminalProvider } from '@rushstack/terminal';
+import { Terminal, type ITerminalProvider } from '@rushstack/terminal';
 import type { CommandLineAction } from '@rushstack/ts-command-line';
+// The package does not export the error that its parsers throw for an invalid command line.
+import { CommandLineParserExitError } from '@rushstack/ts-command-line/lib/providers/CommandLineParserExitError';
 
 import { RushCommandLineParser } from '../cli/RushCommandLineParser';
-import { PhasedScriptAction } from '../cli/scriptActions/PhasedScriptAction';
+import { PhasedScriptAction, type IEnginePhaseNames } from '../cli/scriptActions/PhasedScriptAction';
 import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from '../logic/incremental/InputsSnapshot';
 import type { IOperationGraph } from '../logic/operations/IOperationGraph';
 import type { Operation, OperationEnabledState } from '../logic/operations/Operation';
+import type { OperationStatus } from '../logic/operations/OperationStatus';
 import type { Parallelism } from '../logic/operations/ParseParallelism';
 import { PhasedCommandEngineExecution } from '../logic/operations/PhasedCommandEngineExecution';
+import { createPhasedTelemetryData } from '../logic/operations/PhasedCommandTelemetry';
+import { type ITelemetryData, Telemetry } from '../logic/Telemetry';
+import {
+  getCommandHookBlocker,
+  getRunAnyPhasedCommandBlocker
+} from '../pluginFramework/PhasedCommandHookTaps';
+import type { OperationGraphHooks } from '../pluginFramework/OperationGraphHooks';
 import type { RushSession } from '../pluginFramework/RushSession';
 import type { RushConfiguration } from './RushConfiguration';
 import { RushUserConfiguration } from './RushUserConfiguration';
 import { PhasedCommandEngineBusyError } from './PhasedCommandEngineBusyError';
+import { PhasedCommandEngineUsageError } from './PhasedCommandEngineUsageError';
 import { resolvePhasedCommandCwdAsync } from '../utilities/resolvePhasedCommandCwd';
 
+/** How long disposing an engine waits for `flushTelemetry` taps that are still running. */
+const TELEMETRY_FLUSH_WAIT_MS: number = 2000;
+
 /**
  * A native phased command graph prepared without executing an iteration.
  * @alpha
@@ -35,12 +50,77 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
   readonly phaseNames: ReadonlyArray<string>;
   readonly pluginNames: ReadonlyArray<string>;
   readonly isIncremental: boolean;
+  /**
+   * Logs one request's telemetry entry the way a native iteration logs its own: `beforeLogRequest` and `beforeLog`
+   * taps run first, then the entry is saved under `common/temp/telemetry` and passed to `flushTelemetry` taps.
+   * Disposing the engine waits up to 2 seconds for taps that are still running; a tap that takes longer, such as an
+   * upload over a stalled network, keeps running in the background, so that it cannot hold the host. Saving does
+   * nothing when telemetry is disabled for the repository.
+   *
+   * @remarks
+   * `beforeLog` taps describe the latest iteration, so a host logs an iteration's entries before it starts the
+   * next iteration.
+   */
+  readonly logTelemetry?: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
+}
+
+/**
+ * Options for `IPhasedCommandEngine.logTelemetry`.
+ * @alpha
+ */
+export interface IPhasedCommandEngineLogTelemetryOptions {
+  /**
+   * Whether a graph iteration served the request. If `false`, as for a request that the warm graph answered
+   * without an iteration, `beforeLog` taps are skipped, because they would describe an earlier iteration;
+   * `beforeLogRequest` taps still run. Defaults to `true`.
+   */
+  readonly servedByIteration?: boolean;
+}
+
+/**
+ * One operation's result in a request-scoped telemetry entry.
+ * @alpha
+ */
+export interface IPhasedCommandEngineTelemetryRecord {
+  /** The operation's status in this request. */
+  readonly status: OperationStatus;
+  /** Whether the operation's runner is silent. Silent operations are omitted from the entry. */
+  readonly silent: boolean;
+  /** `performance.now()` values for when the operation started and ended in this request. */
+  readonly stopwatch: { readonly startTime: number | undefined; readonly endTime: number | undefined };
+  /** How long the operation would have taken without the build cache. */
+  readonly nonCachedDurationMs: number | undefined;
+}
+
+/**
+ * The results of one request served by a long-lived engine.
+ * @alpha
+ */
+export interface IPhasedCommandEngineTelemetryOptions {
+  /** The results of the request's selected operations. Silent operations are omitted from the entry. */
+  readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+  /** Whether the request succeeded. As for a native command, only a `Success` status counts as success. */
+  readonly succeeded: boolean;
+  /** How long the request's graph iteration took, in seconds. */
+  readonly durationInSeconds: number;
+  /** A `performance.now()` value. Operation and performance entry times are reported relative to it. */
+  readonly timeOriginMs: number;
+  /** Host-specific fields, added after the native fields. */
+  readonly extraData?: Readonly<Record<string, string | number | boolean>>;
+  /** The request's performance entries, with `performance.now()` start times. */
+  readonly performanceEntries?: ReadonlyArray<PerformanceEntry>;
 }
 
 /** Options for parsing a command for a long-lived engine host. @alpha */
 export interface IParsePhasedCommandOptions {
   readonly argv: ReadonlyArray<string>;
   readonly cwd: string;
+  /**
+   * The environment of the client that sent the command. It supplies the defaults of environment-backed
+   * parameters (`RUSH_PARALLELISM`), because a long-lived host's own environment belongs to no request.
+   * Defaults to `process.env`.
+   */
+  readonly environment?: Readonly<Record<string, string | undefined>>;
   readonly rushConfiguration: RushConfiguration;
   readonly terminalProvider: ITerminalProvider;
 }
@@ -48,21 +128,46 @@ export interface IParsePhasedCommandOptions {
 /**
  * Presentation and scheduling settings of one parsed command. They do not affect the operation graph or any
  * operation hash, so they are not part of `PhasedCommandEngine.parameterIdentity`; hosts apply them to the
- * shared graph (`IOperationGraph.quietMode` / `IOperationGraph.parallelism`) before each iteration.
+ * shared graph (`IOperationGraph.quietMode` / `IOperationGraph.parallelism`) and to the iteration before each
+ * iteration.
  * @alpha
  */
 export interface IPhasedCommandEngineRequestSettings {
   readonly quietMode: boolean;
   readonly parallelism: Parallelism;
+  /**
+   * False for a command that runs every selected operation, such as `rebuild`. Hosts pass it to the iteration
+   * (`IOperationGraphIterationOptions.isIncrementalBuildAllowed`), because an engine created by an incremental
+   * command can serve such a command; see `PhasedCommandEngine.getEngineSharingBlocker`.
+   */
+  readonly isIncrementalBuildAllowed: boolean;
 }
 
 /**
- * A parsed native build/rebuild command. Parsing never runs scripts or changes cwd/process.env.
+ * How the reason that `PhasedCommandEngine.getEngineSharingBlocker` returns names the command that created the engine
+ * and the requested command, for example `"build"` or `the earlier "test"`.
+ * @alpha
+ */
+export interface IPhasedCommandEngineSharingLabels {
+  /** Names the command that created the engine. */
+  readonly engine: string;
+  /** Names the requested command. */
+  readonly request: string;
+}
+
+/**
+ * A parsed native phased command, such as build, rebuild or a phased command from command-line.json.
+ * Parsing never runs scripts or changes cwd/process.env.
  *
  * @remarks
- * The initial engine surface deliberately rejects watch/install, event-hook scripts, .env files, and
- * externally supplied plugins. Those require request-scoped initialization and asynchronous disposal
- * contracts before they can safely run in a shared process. Native graph/cache plugins are not replaced.
+ * The initial engine surface deliberately rejects watch/install, build event-hook scripts, .env files, and
+ * external plugins that Rush would initialize for the command or whose command-line.json shapes it, unless
+ * the plugin's manifest (`daemonCompatible`) or the repository (`daemon.compatiblePlugins`) declares that the
+ * plugin supports the engine lifecycle. An engine applies each plugin once and serves many requests: session
+ * hooks, `createOperationsAsync` (with every project and `isWatch` false) and `onGraphCreatedAsync` run once
+ * per engine, operation graph hooks run for each iteration (which can serve several coalesced requests), and
+ * disposal aborts `IOperationGraph.abortController` and then closes every operation runner. Plugins associated
+ * only with other commands are inert and permitted. Native graph/cache plugins are not replaced.
  * @alpha
  */
 export class PhasedCommandEngine {
@@ -72,23 +177,37 @@ export class PhasedCommandEngine {
 
   public readonly parameterIdentity: string;
   public readonly commandName: string;
+  /** False when every run executes all selected operations: `rebuild`, or `"incremental": false`. */
+  public readonly isIncremental: boolean;
+  /**
+   * Names listed by `daemon.compatiblePlugins` (or `RUSH_DAEMON_COMPATIBLE_PLUGINS`) that match no plugin
+   * configured in rush-plugins.json. They have no effect and are usually misspellings, so hosts should report them.
+   */
+  public readonly unmatchedCompatiblePluginNames: ReadonlyArray<string>;
 
-  private constructor(parser: RushCommandLineParser, action: PhasedScriptAction) {
+  private constructor(
+    parser: RushCommandLineParser,
+    action: PhasedScriptAction,
+    unmatchedCompatiblePluginNames: ReadonlyArray<string>
+  ) {
     this._parser = parser;
     this._action = action;
     this.commandName = action.actionName;
+    this.isIncremental = action.isIncrementalBuildAllowed;
     this.parameterIdentity = action.getEngineParameterIdentity();
+    this.unmatchedCompatiblePluginNames = unmatchedCompatiblePluginNames;
   }
 
+  /**
+   * Parses a native phased command line. Throws a {@link PhasedCommandEngineUsageError} for a command line of a
+   * phased command that native Rush rejects as invalid.
+   */
   public static async parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine> {
-    const { rushConfiguration, terminalProvider, cwd, argv } = options;
+    const { rushConfiguration, terminalProvider, cwd, argv, environment = process.env } = options;
     const resolvedCwd: string = await resolvePhasedCommandCwdAsync(cwd, rushConfiguration.rushJsonFolder);
     if (argv.length === 0 || argv.includes('--help') || argv.includes('-h')) {
       throw new Error('Command help must be handled by the native CLI, not by an engine request.');
     }
-    if (rushConfiguration._rushPluginsConfiguration.configuration.plugins.length > 0) {
-      throw new Error('Daemon engine execution does not yet support external Rush plugins. Use --no-daemon.');
-    }
     for (const folder of [rushConfiguration.rushJsonFolder, RushUserConfiguration.getRushUserFolderPath()]) {
       if (FileSystem.exists(path.join(folder, '.env'))) {
         throw new Error('Daemon engine execution does not yet support .env initialization. Use --no-daemon.');
@@ -96,22 +215,88 @@ export class PhasedCommandEngine {
     }
     const parser: RushCommandLineParser = new RushCommandLineParser({
       cwd: resolvedCwd,
-      engine: { rushConfiguration, terminalProvider }
+      engine: { rushConfiguration, terminalProvider, environment }
     });
-    await parser.executeWithoutErrorHandlingAsync([...argv]);
+    try {
+      await parser.executeWithoutErrorHandlingAsync([...argv]);
+    } catch (error) {
+      // Native Rush prints this message and exits with this exit code. It's a usage error only for a phased command,
+      // since the daemon serves no other command: in-process Rush reports an unknown or global command itself.
+      // Rush's global parameters are all flags, so the first argument that isn't a flag names the command.
+      const commandName: string | undefined = argv.find((arg: string) => !arg.startsWith('-'));
+      const commandAction: CommandLineAction | undefined =
+        commandName === undefined ? undefined : parser.tryGetAction(commandName);
+      if (
+        error instanceof CommandLineParserExitError &&
+        error.exitCode !== 0 &&
+        commandAction instanceof PhasedScriptAction
+      ) {
+        // The parser also wrote the usage to this process's stdout, which the client of a daemon does not see.
+        throw new PhasedCommandEngineUsageError(error.message.trim(), error.exitCode, {
+          cause: error,
+          usage: commandAction.renderUsageText()
+        });
+      }
+      throw error;
+    }
     const action: CommandLineAction | undefined = parser.selectedAction;
-    if (!(action instanceof PhasedScriptAction) || !['build', 'rebuild'].includes(action.actionName)) {
-      throw new Error('The production daemon engine currently supports native build and rebuild only.');
+    if (!(action instanceof PhasedScriptAction)) {
+      throw new Error(
+        `The daemon engine runs phased commands only; "${action?.actionName ?? argv[0]}" is not a phased command.`
+      );
+    }
+    const compatiblePluginNames: ReadonlySet<string> = new Set(rushConfiguration.daemon.compatiblePlugins);
+    const configuredPluginNames: ReadonlySet<string> = parser.pluginManager.configuredPluginNames;
+    const terminal: Terminal = new Terminal(terminalProvider);
+    const unmatchedCompatiblePluginNames: ReadonlyArray<string> = warnAboutUnmatchedPluginNames(
+      terminal,
+      configuredPluginNames,
+      compatiblePluginNames,
+      'compatible plugin list (rush.json "daemon.compatiblePlugins" or RUSH_DAEMON_COMPATIBLE_PLUGINS)'
+    );
+    warnAboutUnmatchedPluginNames(
+      terminal,
+      configuredPluginNames,
+      new Set(rushConfiguration.daemon.commandAgnosticPlugins),
+      'command-agnostic plugin list (rush.json "daemon.commandAgnosticPlugins" or ' +
+        'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS)'
+    );
+    // Plugins which the command would never initialize, and whose command-line.json does not shape
+    // this command, cannot affect a shared engine. Every other external plugin must be declared compatible
+    // with the engine lifecycle; otherwise the command still requires native Rush.
+    const incompatiblePlugins: ReadonlyArray<string> = parser.pluginManager.getPluginsIncompatibleWithEngine(
+      action.actionName,
+      action.schedulablePhaseNames,
+      compatiblePluginNames
+    );
+    if (incompatiblePlugins.length > 0) {
+      throw new Error(
+        `Daemon engine execution does not support Rush plugins that participate in "${action.actionName}" ` +
+          `unless they are declared daemon-compatible: ${incompatiblePlugins.join('; ')}. A plugin declares this ` +
+          `with "daemonCompatible" in its rush-plugin-manifest.json; a repository can list plugins it has ` +
+          `verified in the rush.json "daemon.compatiblePlugins" setting or RUSH_DAEMON_COMPATIBLE_PLUGINS. ` +
+          `Use --no-daemon.`
+      );
     }
     action.validateEngineCommand();
-    return new PhasedCommandEngine(parser, action);
+    return new PhasedCommandEngine(parser, action, unmatchedCompatiblePluginNames);
   }
 
   /**
    * Creates the all-project graph through the native CLI preparation pipeline.
    * Releases the preparation lock before returning. Hosts must acquire an execution lease around each iteration.
+   *
+   * @param preparationLock - The repository lock that the host already holds. The host keeps it; otherwise the
+   * engine takes the lock itself and releases it before returning.
+   * @param abortSignal - For a host that prepares an engine before any request needs it. Once the signal aborts, the
+   * preparation stops before its next step; a step that has started runs to its end. The partial graph is disposed,
+   * the lock is released unless the host lent it, and the promise rejects with the signal's reason. The parsed
+   * command cannot create an engine again, unless the signal had already aborted when this was called.
    */
-  public async createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine> {
+  public async createEngineAsync(
+    preparationLock?: LockFile,
+    abortSignal?: AbortSignal
+  ): Promise<IPhasedCommandEngine> {
     if (this._created) {
       throw new Error('This parsed command has already created its engine.');
     }
@@ -123,6 +308,7 @@ export class PhasedCommandEngine {
     ) {
       throw new Error('The borrowed preparation lock is not held for this workspace.');
     }
+    abortSignal?.throwIfAborted();
     const lock: LockFile | undefined = preparationLock ?? LockFile.tryAcquire(lockFolder, 'rush');
     if (!lock) throw new PhasedCommandEngineBusyError();
     this._created = true;
@@ -130,7 +316,7 @@ export class PhasedCommandEngine {
     let releaseAttempted: boolean = false;
     try {
       await this._parser.pluginManager.tryInitializeUnassociatedPluginsAsync();
-      engine = await this._action.createEngineAsync();
+      engine = await this._action.createEngineAsync(abortSignal);
       if (!preparationLock) {
         releaseAttempted = true;
         lock.release();
@@ -139,10 +325,20 @@ export class PhasedCommandEngine {
         engine,
         this._parser.rushConfiguration.commonTempFolder
       );
+      const { operationGraph } = engine;
+      const telemetry: Telemetry = new Telemetry(this._parser.rushConfiguration, this._parser.rushSession);
       return {
         ...engine,
         acquireExecutionLeaseAsync: () => execution.acquireExecutionLeaseAsync(),
-        [Symbol.asyncDispose]: () => execution[Symbol.asyncDispose]()
+        logTelemetry: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) =>
+          logEngineTelemetry(operationGraph.hooks, telemetry, data, options),
+        [Symbol.asyncDispose]: async () => {
+          try {
+            await execution[Symbol.asyncDispose]();
+          } finally {
+            await waitForTelemetryFlushAsync(telemetry.ensureFlushedAsync(), TELEMETRY_FLUSH_WAIT_MS);
+          }
+        }
       };
     } catch (error) {
       const cleanupErrors: unknown[] = [];
@@ -181,4 +377,278 @@ export class PhasedCommandEngine {
   public get requestSettings(): IPhasedCommandEngineRequestSettings {
     return this._action.getEngineRequestSettings();
   }
+
+  /**
+   * Explains why the engine created by this command cannot serve a request of `request`, or returns undefined if it
+   * can serve it. `rushSession` is the session of an engine created by this command or by `request`.
+   *
+   * @remarks
+   * An engine serves another request of the same command if its graph has the request's operations and the
+   * parameters of the two requests are the same, other than the ones that each request applies to its own iteration
+   * (selection, `requestSettings`, `--ignore-hooks` and `--include-phase-deps`). An engine created by an incremental
+   * command also serves another command, for example `rebuild` on a `build` engine or `build` on a `test` engine,
+   * if:
+   *
+   * - its graph has an operation of every project in each phase that the request selects;
+   *
+   * - the parameters of both commands give the same arguments to the phases that the request can run;
+   *
+   * - the same plugins are associated with both commands, and no plugin taps the `runPhasedCommand` hook of either
+   *   command. Rush calls this hook, `initialize` and `runAnyPhasedCommand` once per engine, with the command that
+   *   created it, so every tap of `initialize` and `runAnyPhasedCommand` must come from the `apply()` of a plugin
+   *   that is declared command-agnostic: its manifest sets `daemonCommandAgnostic`, or the repository lists it in
+   *   `daemon.commandAgnosticPlugins`
+   *   (or `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS`).
+   *
+   * A request of a command that is not incremental runs each operation that it selects
+   * (`IPhasedCommandEngineRequestSettings.isIncrementalBuildAllowed`). An engine that runs persistent
+   * IPC runners (`daemon.usePersistentIpcRunners`) does not serve it, because those runners serve only
+   * incremental commands.
+   *
+   * If the parameters differ, the reason names each parameter and which command sets it, or that both set it to
+   * different values. `labels` names the two commands in the reason. By default, they are the quoted command names,
+   * or `the engine's "name"` and `the requested "name"` if both commands have the same name.
+   */
+  public getEngineSharingBlocker(
+    request: PhasedCommandEngine,
+    rushSession: RushSession,
+    labels?: IPhasedCommandEngineSharingLabels
+  ): string | undefined {
+    const { commandName } = this;
+    const requestName: string = request.commandName;
+    const sameCommand: boolean = requestName === commandName;
+    const sharingLabels: IPhasedCommandEngineSharingLabels =
+      labels ?? getDefaultSharingLabels(commandName, requestName);
+    const { engine: engineLabel, request: requestLabel } = sharingLabels;
+    if (!sameCommand && !this.isIncremental) {
+      return `${engineLabel} is not incremental`;
+    }
+    if (!request.isIncremental && this._action.usesPersistentIpcRunners) {
+      return `${requestLabel} is not incremental, and ${engineLabel} runs persistent IPC runners`;
+    }
+    const enginePhases: IEnginePhaseNames = this._action.getEnginePhaseNames();
+    const requestPhases: IEnginePhaseNames = request._action.getEnginePhaseNames();
+    for (const phaseName of requestPhases.selected) {
+      if (!enginePhases.complete.has(phaseName)) {
+        return `the graph of ${engineLabel} does not have every operation of the "${phaseName}" phase`;
+      }
+    }
+    const { reachable } = requestPhases;
+    if (
+      this._action.getEngineGraphIdentity(reachable) !== request._action.getEngineGraphIdentity(reachable)
+    ) {
+      const differences: string = describeDifferences(
+        this._action.getEngineGraphIdentityParts(reachable),
+        request._action.getEngineGraphIdentityParts(reachable),
+        sharingLabels
+      );
+      return `the parameters of their phases differ${differences}`;
+    }
+    if (sameCommand) {
+      if (
+        this._action.getEngineCustomParameterIdentity(reachable) ===
+        request._action.getEngineCustomParameterIdentity(reachable)
+      ) {
+        return undefined;
+      }
+      const differences: string = describeDifferences(
+        this._action.getEngineCustomParameterIdentityParts(reachable),
+        request._action.getEngineCustomParameterIdentityParts(reachable),
+        sharingLabels
+      );
+      return `their parameters differ${differences}`;
+    }
+    let samePlugins: boolean;
+    try {
+      samePlugins =
+        this._parser.pluginManager.getPluginsAssociatedWithCommand(commandName).join('\n') ===
+        request._parser.pluginManager.getPluginsAssociatedWithCommand(requestName).join('\n');
+    } catch (error) {
+      return `a plugin manifest could not be read: ${(error as Error).message}`;
+    }
+    if (!samePlugins) {
+      return `different plugins are associated with ${requestLabel} and ${engineLabel}`;
+    }
+    const { initialize, runAnyPhasedCommand, runPhasedCommand } = rushSession.hooks;
+    const initializeBlocker: string | undefined = getCommandHookBlocker(initialize, 'initialize');
+    if (initializeBlocker !== undefined) {
+      return initializeBlocker;
+    }
+    const runAnyPhasedCommandBlocker: string | undefined = getRunAnyPhasedCommandBlocker(runAnyPhasedCommand);
+    if (runAnyPhasedCommandBlocker !== undefined) {
+      return runAnyPhasedCommandBlocker;
+    }
+    for (const name of [commandName, requestName]) {
+      if (runPhasedCommand.get(name)?.isUsed()) {
+        return `a plugin taps the runPhasedCommand hook of "${name}"`;
+      }
+    }
+    return undefined;
+  }
+
+  /**
+   * Builds the native telemetry entry for one request that this command made of a long-lived engine.
+   *
+   * @remarks
+   * The entry carries this command's own parameters, not those of the command that created the engine, and reports
+   * one initial, non-watch execution, as the native command's entry would.
+   */
+  public createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData {
+    const { timeOriginMs } = options;
+    const data: ITelemetryData = createPhasedTelemetryData({
+      ...this._action.getTelemetryFields(),
+      isWatch: false,
+      isInitial: true,
+      durationInSeconds: options.durationInSeconds,
+      succeeded: options.succeeded,
+      records: options.records,
+      timeOriginMs
+    });
+    return {
+      ...data,
+      extraData: { ...data.extraData, ...options.extraData },
+      performanceEntries: (options.performanceEntries ?? []).map((entry: PerformanceEntry) =>
+        rebasePerformanceEntry(entry, timeOriginMs)
+      )
+    };
+  }
+}
+
+function rebasePerformanceEntry(entry: PerformanceEntry, timeOriginMs: number): PerformanceEntry {
+  const { name, entryType, duration, detail } = entry;
+  const startTime: number = entry.startTime - timeOriginMs;
+  return {
+    name,
+    entryType,
+    startTime,
+    duration,
+    detail,
+    toJSON: () => ({ name, entryType, startTime, duration, detail })
+  };
+}
+
+/**
+ * Logs one request's telemetry entry for an engine: the graph's `beforeLogRequest` taps run first, then its
+ * `beforeLog` taps if an iteration served the request, then the entry is saved and flushed.
+ */
+export function logEngineTelemetry(
+  hooks: Pick<OperationGraphHooks, 'beforeLog' | 'beforeLogRequest'>,
+  telemetry: Pick<Telemetry, 'log' | 'flush'>,
+  data: ITelemetryData,
+  options: IPhasedCommandEngineLogTelemetryOptions | undefined
+): void {
+  hooks.beforeLogRequest.call(data);
+  if (options?.servedByIteration !== false) {
+    hooks.beforeLog.call(data);
+  }
+  telemetry.log(data);
+  telemetry.flush();
+}
+
+/**
+ * Waits for pending `flushTelemetry` taps, but no longer than `timeoutMs`. As in the native CLI, a failed tap does
+ * not fail the command.
+ *
+ * @returns `true` if the taps settled in time, or `false` if they are still running.
+ */
+export async function waitForTelemetryFlushAsync(
+  flushPromise: Promise<void>,
+  timeoutMs: number
+): Promise<boolean> {
+  let timeout: NodeJS.Timeout | undefined;
+  const expiredPromise: Promise<false> = new Promise((resolve) => {
+    timeout = setTimeout(() => resolve(false), timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      flushPromise.then(
+        () => true,
+        () => true
+      ),
+      expiredPromise
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * The labels of `getEngineSharingBlocker` by default: the quoted command names, or `the engine's "name"` and
+ * `the requested "name"` if both commands have the same name.
+ */
+function getDefaultSharingLabels(engineName: string, requestName: string): IPhasedCommandEngineSharingLabels {
+  return engineName === requestName
+    ? { engine: `the engine's "${engineName}"`, request: `the requested "${requestName}"` }
+    : { engine: `"${engineName}"`, request: `"${requestName}"` };
+}
+
+/**
+ * Names the parts that differ between the engine's command and the request, and which command sets each, as
+ * ` (only "a" sets --x; both set --y and --z, to different values)`. Each map has only the parts that its command
+ * sets. The groups of the two commands are in the order of their labels, and the group of the parts that both
+ * set comes last, so the text is the same whichever command created the engine. It returns an empty string if
+ * every part is the same, which happens only if two commands add the same arguments in another order.
+ */
+function describeDifferences(
+  engineParts: ReadonlyMap<string, string>,
+  requestParts: ReadonlyMap<string, string>,
+  labels: IPhasedCommandEngineSharingLabels
+): string {
+  const onlyEngine: string[] = [];
+  const onlyRequest: string[] = [];
+  const both: string[] = [];
+  for (const name of new Set([...engineParts.keys(), ...requestParts.keys()])) {
+    const engineValue: string | undefined = engineParts.get(name);
+    const requestValue: string | undefined = requestParts.get(name);
+    if (engineValue === requestValue) {
+      continue;
+    }
+    if (requestValue === undefined) {
+      onlyEngine.push(name);
+    } else if (engineValue === undefined) {
+      onlyRequest.push(name);
+    } else {
+      both.push(name);
+    }
+  }
+  const groups: [string, string[]][] = [
+    [labels.engine, onlyEngine],
+    [labels.request, onlyRequest]
+  ];
+  if (labels.request < labels.engine) {
+    groups.reverse();
+  }
+  const descriptions: string[] = groups
+    .filter(([, names]) => names.length > 0)
+    .map(([label, names]) => `only ${label} sets ${formatNameList(names)}`);
+  if (both.length > 0) {
+    descriptions.push(`both set ${formatNameList(both)}, to different values`);
+  }
+  return descriptions.length > 0 ? ` (${descriptions.join('; ')})` : '';
+}
+
+/** Sorts the names and joins them as "a", "a and b" or "a, b and c". */
+function formatNameList(names: string[]): string {
+  const sorted: string[] = [...names].sort();
+  return sorted.length > 1 ? `${sorted.slice(0, -1).join(', ')} and ${sorted[sorted.length - 1]}` : sorted[0];
+}
+
+/** Warns about the names in a daemon plugin list that match no plugin configured in rush-plugins.json. */
+function warnAboutUnmatchedPluginNames(
+  terminal: Terminal,
+  configuredPluginNames: ReadonlySet<string>,
+  listedPluginNames: ReadonlySet<string>,
+  listDescription: string
+): ReadonlyArray<string> {
+  const unmatchedPluginNames: ReadonlyArray<string> = Array.from(listedPluginNames).filter(
+    (pluginName) => !configuredPluginNames.has(pluginName)
+  );
+  if (unmatchedPluginNames.length > 0) {
+    terminal.writeWarningLine(
+      `The daemon's ${listDescription} names plugins that are not configured in rush-plugins.json: ` +
+        `${unmatchedPluginNames.map((pluginName) => `"${pluginName}"`).join(', ')}. ` +
+        `Check that each entry is the plugin's "pluginName".`
+    );
+  }
+  return unmatchedPluginNames;
 }
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts
new file mode 100644
index 00000000000..063271df680
--- /dev/null
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts
@@ -0,0 +1,27 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { AlreadyReportedError } from '@rushstack/node-core-library';
+
+/**
+ * The engine could not load the native configuration of a project.
+ *
+ * @remarks
+ * An engine loads every project in the workspace, whereas a native command loads only the projects that it
+ * selects. A native command may therefore succeed where the engine cannot, for example after a filtered
+ * install that left the rig package of an unselected project uninstalled. No operation has begun.
+ * @alpha
+ */
+export class PhasedCommandEngineProjectConfigurationError extends Error {
+  /** The package name of the project whose configuration could not be loaded. */
+  public readonly projectName: string;
+
+  public constructor(projectName: string, cause: unknown) {
+    // An AlreadyReportedError has written its details to the terminal; its own message adds nothing.
+    const detail: string =
+      cause instanceof Error && !(cause instanceof AlreadyReportedError) ? `: ${cause.message}` : '.';
+    super(`Rush could not load the configuration of project "${projectName}"${detail}`, { cause });
+    this.name = 'PhasedCommandEngineProjectConfigurationError';
+    this.projectName = projectName;
+  }
+}
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
new file mode 100644
index 00000000000..1bd49d362f9
--- /dev/null
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The command line is not valid for a phased command, for example because it names an unknown parameter.
+ * Native Rush prints the message and exits with {@link PhasedCommandEngineUsageError.exitCode}.
+ * No engine preparation has begun.
+ * @alpha
+ */
+export class PhasedCommandEngineUsageError extends Error {
+  /** The exit code of native Rush for this command line. */
+  public readonly exitCode: number;
+  /** The usage of the command, which native Rush prints to stdout before the message, if it is known. */
+  public readonly usage: string | undefined;
+
+  // The shape of ErrorOptions, which needs lib es2022. Consumers of these typings may use an older lib.
+  public constructor(message: string, exitCode: number, options?: { cause?: unknown; usage?: string }) {
+    super(message, options);
+    this.name = 'PhasedCommandEngineUsageError';
+    this.exitCode = exitCode;
+    this.usage = options?.usage;
+  }
+}
diff --git a/libraries/rush-lib/src/api/Rush.ts b/libraries/rush-lib/src/api/Rush.ts
index 177116070eb..af88e55cdef 100644
--- a/libraries/rush-lib/src/api/Rush.ts
+++ b/libraries/rush-lib/src/api/Rush.ts
@@ -18,6 +18,7 @@ import type { IBuiltInPluginConfiguration } from '../pluginFramework/PluginLoade
 import type { IRushSessionReporterOptions } from '../pluginFramework/RushSession';
 import { RushPnpmCommandLine } from '../cli/RushPnpmCommandLine';
 import { measureAsyncFn } from '../utilities/performance';
+import { StandardOutputClosure } from '../utilities/StandardOutputClosure';
 
 interface IRushFrontendLaunchOptions extends ILaunchOptions {
   reporterCloseAsync?: () => Promise<void>;
@@ -96,6 +97,8 @@ export class Rush {
   public static launch(launcherVersion: string, options: ILaunchOptions): void {
     options = _normalizeLaunchOptions(options);
     const frontendOptions: IRushFrontendLaunchOptions = options;
+    // Before the banner, so that a reader that exits during it (`rush build | head -1`) cannot crash Rush either.
+    const standardOutputClosure: StandardOutputClosure = StandardOutputClosure.install();
 
     if (!options.reporter?.operationStreamEnabled && !RushCommandLineParser.shouldRestrictConsoleOutput()) {
       RushStartupBanner.logBanner(Rush.version, options.isManaged);
@@ -112,7 +115,8 @@ export class Rush {
       alreadyReportedNodeTooNewError: options.alreadyReportedNodeTooNewError,
       builtInPluginConfigurations: options.builtInPluginConfigurations,
       reporter: options.reporter,
-      reporterCloseAsync: frontendOptions.reporterCloseAsync
+      reporterCloseAsync: frontendOptions.reporterCloseAsync,
+      standardOutputClosure
     });
     // CommandLineParser.executeAsync() should never reject the promise
     // eslint-disable-next-line no-console
diff --git a/libraries/rush-lib/src/api/RushProjectConfiguration.ts b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
index 9a621e544ac..d8c539c21e8 100644
--- a/libraries/rush-lib/src/api/RushProjectConfiguration.ts
+++ b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
@@ -2,11 +2,17 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import * as fs from 'node:fs';
 
-import { AlreadyReportedError, Async, FileSystem, JsonFile, Path } from '@rushstack/node-core-library';
+import { AlreadyReportedError, Async, FileSystem, Import, JsonFile, Path } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
 import { ProjectConfigurationFile, InheritanceType } from '@rushstack/heft-config-file';
-import { RigConfig, type IRigConfigJson } from '@rushstack/rig-package';
+import {
+  RigConfig,
+  type IRigConfig,
+  type IRigConfigJson,
+  type ILoadForProjectFolderOptions
+} from '@rushstack/rig-package';
 
 import type { RushConfigurationProject } from './RushConfigurationProject';
 import { RushConstants } from '../logic/RushConstants';
@@ -16,6 +22,13 @@ import schemaJson from '../schemas/rush-project.schema.json';
 import anythingSchemaJson from '../schemas/anything.schema.json';
 import { HotlinkManager } from '../utilities/HotlinkManager';
 import type { RushConfiguration } from './RushConfiguration';
+import { PhasedCommandEngineProjectConfigurationError } from './PhasedCommandEngineProjectConfigurationError';
+import {
+  getFileStamp,
+  getSettledBeforeNs,
+  isFileStatSettled,
+  MISSING_FILE_STAMP
+} from '../utilities/FileContentStamp';
 
 /**
  * Describes the file structure for the `<project root>/config/rush-project.json` config file.
@@ -114,6 +127,19 @@ export interface IOperationSettings {
    */
   daemonIpc?: IDaemonIpcConfiguration;
 
+  /**
+   * If true, and `daemon.warmWorkers` is enabled, the Rush daemon keeps the operation's `<phase>:incremental:ipc`
+   * script running as a warm worker between builds, and sends it the incremental runs that the incremental
+   * execution guard allows.
+   *
+   * @remarks
+   * Set this only if that script, run in watch mode, runs every task and check that the `<phase>` script runs,
+   * because the daemon reports a run on the worker as if the `<phase>` script had run. For Heft, that means the
+   * `lintInWatchMode` option of heft-lint-plugin and the `runInWatchMode` setting of API Extractor, which both
+   * default to skipping their task in watch mode.
+   */
+  allowDaemonWarmWorker?: boolean;
+
   /**
    * Specify the folders where this operation writes its output files. If enabled, the Rush build
    * cache will restore these folders from the cache. The strings are folder names under the project
@@ -305,11 +331,52 @@ const OLD_RUSH_PROJECT_CONFIGURATION_FILE: ProjectConfigurationFile<IOldRushProj
 
 const _configCache: Map<RushConfigurationProject, RushProjectConfiguration | false> = new Map();
 
-interface IIsolatedProjectConfigurationLoaders {
+interface IProjectConfigurationLoaders {
   readonly configurationFile: ProjectConfigurationFile<IRushProjectJson>;
   readonly oldConfigurationFile: ProjectConfigurationFile<IOldRushProjectJson>;
 }
 
+/** A configuration file that a load read, or found missing. */
+interface IConfigurationFileInput {
+  /** The path the loader reads. */
+  readonly filePath: string;
+  readonly stamp: string;
+  /** The file's `extends` value and the path it resolved to. */
+  readonly parent: { readonly specifier: string; readonly filePath: string } | undefined;
+}
+
+/** The rig profile that a project without its own configuration file loads it from. */
+interface IRigProfileInput {
+  /** `<project>/node_modules/<rig>/package.json`, the first path that the rig package can resolve to. */
+  readonly packageJsonPath: string;
+  /** `<project>/node_modules/<rig>/profiles/<profile>` */
+  readonly profileFolderPath: string;
+  /** The profile folder's real path, which the loader reads the rig's configuration file from. */
+  readonly realProfileFolderPath: string;
+}
+
+interface IProjectConfigurationInputs {
+  readonly rigJsonStamp: string;
+  readonly ownFileStamp: string;
+  readonly rigProfile: IRigProfileInput | undefined;
+  /** The loaded file and its `extends` chain, or the missing rig configuration file. */
+  readonly files: ReadonlyArray<IConfigurationFileInput>;
+}
+
+interface IProjectConfigurationCacheEntry {
+  readonly rushProjectJson: IRushProjectJson | undefined;
+  readonly jsonForFingerprint: string | undefined;
+  /** Undefined if the load can't be reused, for example because one of its files changed too recently. */
+  readonly inputs: IProjectConfigurationInputs | undefined;
+}
+
+/**
+ * The last configuration that {@link RushProjectConfiguration._tryLoadForProjectsUncachedAsync} loaded for a
+ * project, with the inputs it was loaded from.
+ */
+const _currentConfigurationCache: WeakMap<RushConfigurationProject, IProjectConfigurationCacheEntry> =
+  new WeakMap();
+
 /**
  * Use this class to load the "config/rush-project.json" config file.
  *
@@ -337,10 +404,11 @@ export class RushProjectConfiguration {
   private constructor(
     project: RushConfigurationProject,
     rushProjectJson: IRushProjectJson,
-    operationSettingsByOperationName: ReadonlyMap<string, IOperationSettings>
+    operationSettingsByOperationName: ReadonlyMap<string, IOperationSettings>,
+    jsonForFingerprint: string = JSON.stringify(rushProjectJson)
   ) {
     this.project = project;
-    this.#jsonForFingerprint = JSON.stringify(rushProjectJson);
+    this.#jsonForFingerprint = jsonForFingerprint;
     this.incrementalBuildIgnoredGlobs = rushProjectJson.incrementalBuildIgnoredGlobs || [];
     this.disableBuildCacheForProject = rushProjectJson.disableBuildCacheForProject || false;
     this.operationSettingsByOperationName = operationSettingsByOperationName;
@@ -565,39 +633,62 @@ export class RushProjectConfiguration {
   }
 
   /**
-   * Loads a fresh native configuration snapshot without reading or modifying process-wide
-   * project, inherited-file, or rig caches. The loaders are owned only by this invocation.
+   * Loads a native configuration snapshot of the current files without reading or modifying the process-wide
+   * project, inherited-file, or rig caches of other loads. The loaders are owned only by this invocation.
+   *
+   * @remarks
+   * Throws a {@link PhasedCommandEngineProjectConfigurationError} that names a project whose
+   * configuration could not be loaded.
+   *
+   * A project's merged configuration is reused from an earlier call only if every input of its load is
+   * unchanged: the stamps (identity, size, mtime and ctime) of its `config/rig.json`, its own
+   * `config/rush-project.json`, and each file of the `extends` chain that was loaded; the path each `extends`
+   * value resolves to; and, for a configuration that comes from a rig, the real path of the rig profile folder
+   * that the project's `node_modules` reaches. A configuration is recorded only if each of its files had
+   * already been unchanged for a few seconds when it was examined, and only after a load that succeeded; the
+   * warnings are reported again by every call.
    * @internal
    */
   public static async _tryLoadForProjectsUncachedAsync(
     projects: Iterable<RushConfigurationProject>,
     terminal: ITerminal
   ): Promise<ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>> {
-    const loaders: IIsolatedProjectConfigurationLoaders = {
+    const loaders: IProjectConfigurationLoaders = {
       configurationFile: createProjectConfigurationFile(),
       oldConfigurationFile: new ProjectConfigurationFile<IOldRushProjectJson>({
         projectRelativeFilePath: RUSH_PROJECT_CONFIGURATION_FILE.projectRelativeFilePath,
         jsonSchemaObject: anythingSchemaJson
       })
     };
+    const view: ConfigurationInputView = _createConfigurationInputView();
     const result: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
     await Async.forEachAsync(
       projects,
       async (project) => {
-        const rushProjectJson: IRushProjectJson | undefined = await _tryLoadJsonForProjectAsync(
-          project,
-          terminal,
-          loaders
-        );
-        if (rushProjectJson) {
-          result.set(
+        try {
+          const entry: IProjectConfigurationCacheEntry = await _getCurrentConfigurationEntryAsync(
             project,
-            new RushProjectConfiguration(
-              project,
-              rushProjectJson,
-              _getRushProjectConfiguration(project, rushProjectJson, terminal)
-            )
+            terminal,
+            loaders,
+            view
           );
+          const { rushProjectJson } = entry;
+          if (rushProjectJson) {
+            result.set(
+              project,
+              new RushProjectConfiguration(
+                project,
+                rushProjectJson,
+                _getRushProjectConfiguration(project, rushProjectJson, terminal),
+                entry.jsonForFingerprint
+              )
+            );
+          }
+          if (entry.inputs) {
+            _currentConfigurationCache.set(project, entry);
+          }
+        } catch (error) {
+          throw new PhasedCommandEngineProjectConfigurationError(project.packageName, error);
         }
       },
       { concurrency: 50 }
@@ -653,17 +744,26 @@ export class RushProjectConfiguration {
 
 async function _tryLoadJsonForProjectAsync(
   project: RushConfigurationProject,
-  terminal: ITerminal,
-  loaders?: IIsolatedProjectConfigurationLoaders
+  terminal: ITerminal
 ): Promise<IRushProjectJson | undefined> {
-  const configurationFile: ProjectConfigurationFile<IRushProjectJson> =
-    loaders?.configurationFile ?? RUSH_PROJECT_CONFIGURATION_FILE;
-  const oldConfigurationFile: ProjectConfigurationFile<IOldRushProjectJson> =
-    loaders?.oldConfigurationFile ?? OLD_RUSH_PROJECT_CONFIGURATION_FILE;
-  const rigConfig: RigConfig | undefined = loaders
-    ? await loadIsolatedRigConfigAsync(project.projectFolder)
-    : await RigConfig.loadForProjectFolderAsync({ projectFolderPath: project.projectFolder });
+  return await _tryLoadJsonForProjectWithRigAsync(
+    project,
+    terminal,
+    {
+      configurationFile: RUSH_PROJECT_CONFIGURATION_FILE,
+      oldConfigurationFile: OLD_RUSH_PROJECT_CONFIGURATION_FILE
+    },
+    await RigConfig.loadForProjectFolderAsync({ projectFolderPath: project.projectFolder })
+  );
+}
 
+async function _tryLoadJsonForProjectWithRigAsync(
+  project: RushConfigurationProject,
+  terminal: ITerminal,
+  loaders: IProjectConfigurationLoaders,
+  rigConfig: IRigConfig | undefined
+): Promise<IRushProjectJson | undefined> {
+  const { configurationFile, oldConfigurationFile } = loaders;
   try {
     return await configurationFile.tryLoadConfigurationFileForProjectAsync(
       terminal,
@@ -699,7 +799,50 @@ async function _tryLoadJsonForProjectAsync(
   }
 }
 
-async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<RigConfig | undefined> {
+/**
+ * A found rig whose resolved profile folder is the real path of the rig package's profile folder.
+ */
+class RealProfileFolderRigConfig implements IRigConfig {
+  public readonly projectFolderOriginalPath: string;
+  public readonly projectFolderPath: string;
+  public readonly rigFound: boolean;
+  public readonly filePath: string;
+  public readonly rigPackageName: string;
+  public readonly rigProfile: string;
+  public readonly relativeProfileFolderPath: string;
+  readonly #rigConfig: IRigConfig;
+  readonly #profileFolder: string;
+
+  public constructor(rigConfig: IRigConfig, profileFolder: string) {
+    this.projectFolderOriginalPath = rigConfig.projectFolderOriginalPath;
+    this.projectFolderPath = rigConfig.projectFolderPath;
+    this.rigFound = rigConfig.rigFound;
+    this.filePath = rigConfig.filePath;
+    this.rigPackageName = rigConfig.rigPackageName;
+    this.rigProfile = rigConfig.rigProfile;
+    this.relativeProfileFolderPath = rigConfig.relativeProfileFolderPath;
+    this.#rigConfig = rigConfig;
+    this.#profileFolder = profileFolder;
+  }
+
+  public getResolvedProfileFolder(): string {
+    return this.#profileFolder;
+  }
+
+  public async getResolvedProfileFolderAsync(): Promise<string> {
+    return this.#profileFolder;
+  }
+
+  public tryResolveConfigFilePath(configFileRelativePath: string): string | undefined {
+    return this.#rigConfig.tryResolveConfigFilePath(configFileRelativePath);
+  }
+
+  public async tryResolveConfigFilePathAsync(configFileRelativePath: string): Promise<string | undefined> {
+    return await this.#rigConfig.tryResolveConfigFilePathAsync(configFileRelativePath);
+  }
+}
+
+async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<IRigConfig | undefined> {
   let rigJson: IRigConfigJson;
   try {
     rigJson = await JsonFile.loadAsync(path.join(projectFolder, 'config', 'rig.json'));
@@ -712,10 +855,248 @@ async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<RigCon
   }
   // bypassCache still writes the shared rig cache. An explicit JSON override uses the
   // native schema/resolution path without either reading or populating that cache.
-  return await RigConfig.loadForProjectFolderAsync({
+  const options: ILoadForProjectFolderOptions = {
     projectFolderPath: projectFolder,
     overrideRigJsonObject: rigJson
-  });
+  };
+  const rigConfig: RigConfig = await RigConfig.loadForProjectFolderAsync(options);
+  if (rigConfig.rigFound) {
+    let profileFolder: string;
+    try {
+      // The configuration file loader resolves the rig profile synchronously, which serializes these
+      // concurrent project loads. Resolving it asynchronously first caches the same result on this instance.
+      profileFolder = await rigConfig.getResolvedProfileFolderAsync();
+    } catch {
+      // A fresh instance reports the failure exactly as the native loader does, if and when the rig is used.
+      return await RigConfig.loadForProjectFolderAsync(options);
+    }
+    // Each project reaches a shared rig through its own node_modules symlink, and the loaders cache by file
+    // path. The real profile folder lets every project share one load of the rig's files and "extends" chain.
+    return new RealProfileFolderRigConfig(rigConfig, await FileSystem.getRealPathAsync(profileFolder));
+  }
+  return rigConfig;
+}
+
+async function _getCurrentConfigurationEntryAsync(
+  project: RushConfigurationProject,
+  terminal: ITerminal,
+  loaders: IProjectConfigurationLoaders,
+  view: ConfigurationInputView
+): Promise<IProjectConfigurationCacheEntry> {
+  const entry: IProjectConfigurationCacheEntry | undefined = _currentConfigurationCache.get(project);
+  if (entry && view.isCurrent(project, entry)) {
+    return entry;
+  }
+  _currentConfigurationCache.delete(project);
+  // Examined before the loader reads them.
+  const rigJson: IConfigurationFileStat | undefined = view.getStat(getRigJsonPath(project));
+  const ownFile: IConfigurationFileStat | undefined = view.getStat(getOwnConfigurationFilePath(project));
+  const rigConfig: IRigConfig | undefined = await loadIsolatedRigConfigAsync(project.projectFolder);
+  const inputs: IProjectConfigurationInputs | undefined =
+    rigJson?.settled && ownFile?.settled
+      ? await view.tryGetInputsAsync(project, rigConfig, rigJson.stamp, ownFile.stamp)
+      : undefined;
+  const rushProjectJson: IRushProjectJson | undefined = await _tryLoadJsonForProjectWithRigAsync(
+    project,
+    terminal,
+    loaders,
+    rigConfig
+  );
+  return {
+    rushProjectJson,
+    jsonForFingerprint: rushProjectJson && JSON.stringify(rushProjectJson),
+    inputs
+  };
+}
+
+function getRigJsonPath(project: RushConfigurationProject): string {
+  return path.join(project.projectFolder, 'config', 'rig.json');
+}
+
+function getOwnConfigurationFilePath(project: RushConfigurationProject): string {
+  // The path that the loader reads.
+  return path.resolve(project.projectFolder, RUSH_PROJECT_CONFIGURATION_FILE.projectRelativeFilePath);
+}
+
+interface IConfigurationFileStat {
+  readonly stamp: string;
+  /** Whether the file had been unchanged long enough for its stamp to identify its content. */
+  readonly settled: boolean;
+}
+
+const getNativeRealPath: (folderPath: string) => string =
+  // As in the "resolve" package, which Windows network paths make fall back to the JavaScript implementation.
+  process.platform === 'win32' ? fs.realpathSync : fs.realpathSync.native;
+
+/**
+ * The file system state that one {@link RushProjectConfiguration._tryLoadForProjectsUncachedAsync} call compares
+ * recorded inputs with. Each fact is examined at most once per call, and a file is always examined before the
+ * call's loader reads it.
+ */
+class ConfigurationInputView {
+  readonly #settledBeforeNs: bigint = getSettledBeforeNs();
+  readonly #stats: Map<string, IConfigurationFileStat | undefined> = new Map();
+  readonly #realPaths: Map<string, string | undefined> = new Map();
+  readonly #resolutions: Map<string, string | undefined> = new Map();
+  readonly #fileInputs: Map<string, Promise<ReadonlyArray<IConfigurationFileInput> | undefined>> = new Map();
+
+  /** Returns undefined for a path that isn't a regular file or can't be examined. */
+  public getStat(filePath: string): IConfigurationFileStat | undefined {
+    if (!this.#stats.has(filePath)) {
+      let result: IConfigurationFileStat | undefined;
+      try {
+        // statSync follows links, so dev and ino identify the file whose content is loaded.
+        const stat: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+        if (!stat) {
+          result = { stamp: MISSING_FILE_STAMP, settled: true };
+        } else if (stat.isFile()) {
+          result = { stamp: getFileStamp(stat), settled: isFileStatSettled(stat, this.#settledBeforeNs) };
+        }
+      } catch (error) {
+        if (FileSystem.isNotExistError(error as Error)) {
+          result = { stamp: MISSING_FILE_STAMP, settled: true };
+        }
+      }
+      this.#stats.set(filePath, result);
+    }
+    return this.#stats.get(filePath);
+  }
+
+  public isCurrent(project: RushConfigurationProject, entry: IProjectConfigurationCacheEntry): boolean {
+    const { inputs } = entry;
+    if (
+      !inputs ||
+      this.getStat(getRigJsonPath(project))?.stamp !== inputs.rigJsonStamp ||
+      this.getStat(getOwnConfigurationFilePath(project))?.stamp !== inputs.ownFileStamp ||
+      (inputs.rigProfile && !this.#isRigProfileCurrent(inputs.rigProfile))
+    ) {
+      return false;
+    }
+    return inputs.files.every(
+      ({ filePath, stamp, parent }) =>
+        this.getStat(filePath)?.stamp === stamp &&
+        (!parent || this.#resolveExtends(parent.specifier, filePath) === parent.filePath)
+    );
+  }
+
+  /**
+   * Records what a load of the project's configuration depends on, before the loader reads any of it. Returns
+   * undefined if the load can't be reused.
+   */
+  public async tryGetInputsAsync(
+    project: RushConfigurationProject,
+    rigConfig: IRigConfig | undefined,
+    rigJsonStamp: string,
+    ownFileStamp: string
+  ): Promise<IProjectConfigurationInputs | undefined> {
+    let rigProfile: IRigProfileInput | undefined;
+    let filePath: string | undefined;
+    if (ownFileStamp !== MISSING_FILE_STAMP) {
+      filePath = getOwnConfigurationFilePath(project);
+    } else if (rigConfig instanceof RealProfileFolderRigConfig) {
+      const rigFolderPath: string = path.join(project.projectFolder, 'node_modules', rigConfig.rigPackageName);
+      rigProfile = {
+        packageJsonPath: path.join(rigFolderPath, 'package.json'),
+        profileFolderPath: path.join(rigFolderPath, rigConfig.relativeProfileFolderPath),
+        realProfileFolderPath: rigConfig.getResolvedProfileFolder()
+      };
+      // The shortcut that a reuse checks must agree with the loader's own resolution of the rig.
+      if (!this.#isRigProfileCurrent(rigProfile)) return undefined;
+      filePath = path.resolve(
+        rigProfile.realProfileFolderPath,
+        RUSH_PROJECT_CONFIGURATION_FILE.projectRelativeFilePath
+      );
+    } else if (rigConfig?.rigFound) {
+      // The rig package can't be resolved, which the loader reports if it needs the rig.
+      return undefined;
+    }
+    const files: ReadonlyArray<IConfigurationFileInput> | undefined = filePath
+      ? await this.#getFileInputsAsync(filePath)
+      : [];
+    return files && { rigJsonStamp, ownFileStamp, rigProfile, files };
+  }
+
+  #isRigProfileCurrent(rigProfile: IRigProfileInput): boolean {
+    // When this file exists, the rig package resolves to it before any other candidate.
+    const packageJson: IConfigurationFileStat | undefined = this.getStat(rigProfile.packageJsonPath);
+    return (
+      packageJson !== undefined &&
+      packageJson.stamp !== MISSING_FILE_STAMP &&
+      this.#getRealPath(rigProfile.profileFolderPath) === rigProfile.realProfileFolderPath
+    );
+  }
+
+  #getRealPath(folderPath: string): string | undefined {
+    if (!this.#realPaths.has(folderPath)) {
+      let realPath: string | undefined;
+      try {
+        realPath = getNativeRealPath(folderPath);
+      } catch {
+        // A missing profile folder is reported by the loader.
+      }
+      this.#realPaths.set(folderPath, realPath);
+    }
+    return this.#realPaths.get(folderPath);
+  }
+
+  #resolveExtends(specifier: string, configurationFilePath: string): string | undefined {
+    const baseFolderPath: string = path.dirname(configurationFilePath);
+    const key: string = `${baseFolderPath}\0${specifier}`;
+    if (!this.#resolutions.has(key)) {
+      let resolvedPath: string | undefined;
+      try {
+        // As the configuration file loader resolves "extends".
+        resolvedPath = Import.resolveModule({ modulePath: specifier, baseFolderPath });
+      } catch {
+        // The loader reports the failure.
+      }
+      this.#resolutions.set(key, resolvedPath);
+    }
+    return this.#resolutions.get(key);
+  }
+
+  #getFileInputsAsync(filePath: string): Promise<ReadonlyArray<IConfigurationFileInput> | undefined> {
+    let result: Promise<ReadonlyArray<IConfigurationFileInput> | undefined> | undefined =
+      this.#fileInputs.get(filePath);
+    if (!result) {
+      result = this.#readFileInputsAsync(filePath);
+      this.#fileInputs.set(filePath, result);
+    }
+    return result;
+  }
+
+  async #readFileInputsAsync(
+    firstFilePath: string
+  ): Promise<ReadonlyArray<IConfigurationFileInput> | undefined> {
+    const files: IConfigurationFileInput[] = [];
+    const visited: Set<string> = new Set();
+    for (let filePath: string | undefined = firstFilePath; filePath !== undefined; ) {
+      const stat: IConfigurationFileStat | undefined = this.getStat(filePath);
+      if (!stat?.settled || visited.has(filePath)) return undefined;
+      visited.add(filePath);
+      let specifier: unknown;
+      if (stat.stamp !== MISSING_FILE_STAMP) {
+        try {
+          specifier = JsonFile.parseString(await FileSystem.readFileAsync(filePath))?.extends;
+        } catch {
+          // The loader reports the failure.
+          return undefined;
+        }
+      }
+      if (specifier && typeof specifier !== 'string') return undefined;
+      const parentPath: string | undefined = specifier
+        ? this.#resolveExtends(specifier as string, filePath)
+        : undefined;
+      if (specifier && parentPath === undefined) return undefined;
+      files.push({
+        filePath,
+        stamp: stat.stamp,
+        parent: parentPath !== undefined ? { specifier: specifier as string, filePath: parentPath } : undefined
+      });
+      filePath = parentPath;
+    }
+    return files;
+  }
 }
 
 /**
@@ -785,3 +1166,7 @@ function _getRushProjectConfiguration(
 
   return operationSettingsByOperationName;
 }
+
+function _createConfigurationInputView(): ConfigurationInputView {
+  return new ConfigurationInputView();
+}
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index edb2b0bc26f..2deb810e59c 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -13,12 +13,21 @@ import type { RushConfiguration } from './RushConfiguration';
 import type { RushConfigurationProject } from './RushConfigurationProject';
 import { RushProjectConfiguration } from './RushProjectConfiguration';
 import { getDaemonIpcImplementationIdentityAsync } from '../logic/operations/DaemonIpcConfiguration';
+import { AutoinstallerPluginLoader } from '../pluginFramework/PluginLoader/AutoinstallerPluginLoader';
+import { getFileStamp, getSettledBeforeNs, isFileStatSettled } from '../utilities/FileContentStamp';
+
+// `DAEMON_OPERATION_GROUPS_ENV_VAR` of @rushstack/rush-daemon-transport, which rush-lib does not depend on.
+const OPERATION_GROUPS_VARIABLE: string = 'RUSHD_OPERATION_GROUPS';
 
 /** Stable inputs which distinguish reusable, reloadable, and process-bound workspace state. @alpha */
 export interface IWorkspaceInputFingerprint {
   readonly configurationHash: string;
   readonly environmentHash: string;
   readonly installationHash: string;
+  /**
+   * The Node.js executable and version, the running Rush package, the host's `runtimePaths`, and the installed
+   * package folder of every configured Rush plugin. A change requires a new process.
+   */
   readonly runtimeHash: string;
   readonly selectedRushVersion: string;
 }
@@ -29,7 +38,11 @@ export interface IWorkspaceInputFingerprintOptions {
   readonly environment: Readonly<Record<string, string | undefined>>;
   /** Additional implementation files/folders owned by the embedding host. */
   readonly runtimePaths?: ReadonlyArray<string>;
-  /** Invocation-owner cache for implementation files; workspace definitions are always read by content. */
+  /**
+   * Invocation-owner cache for file digests. Workspace definitions are always compared by content: a cached
+   * digest is reused only for a file that had stopped changing before it was read (see
+   * {@link WorkspaceRuntimeFingerprintCache}).
+   */
   readonly runtimeCache?: WorkspaceRuntimeFingerprintCache;
 }
 
@@ -37,27 +50,55 @@ export interface IWorkspaceInputFingerprintOptions {
  * Environment variable names that are excluded from {@link IWorkspaceInputFingerprint.environmentHash}.
  *
  * @remarks
- * These variables are maintained per shell, terminal, remote session or client invocation. Rush never reads them
- * to configure the engine, construct the operation graph or compute operation hashes, so a difference must not
- * discard a warm workspace:
+ * These variables are maintained per shell, terminal, remote session, service unit, agent session or client
+ * invocation. Rush never reads them to configure the engine, construct the operation graph or compute operation
+ * hashes, so a difference must not discard a warm workspace:
  *
  * - shell bookkeeping: `_`, `PWD`, `OLDPWD`, `SHLVL`, `PS1`, `HISTFILE`, `HISTSIZE`
  *   (a child shell recomputes `PWD`/`SHLVL`/`_` for its own working directory)
  * - terminal presentation: `TERM`, `TERM_PROGRAM`, `TERM_PROGRAM_VERSION`, `TERM_SESSION_ID`, `COLORTERM`,
- *   `COLUMNS`, `LINES`, `LS_COLORS`, `WINDOWID`
+ *   `COLUMNS`, `LINES`, `LS_COLORS`, `WINDOWID`, and the per-window handles of terminal emulators:
+ *   `WT_SESSION`, `WT_PROFILE_ID`, `ITERM_SESSION_ID`
  * - session and multiplexer handles: `WSL_INTEROP`, `WSLENV`, `SSH_CLIENT`, `SSH_CONNECTION`, `SSH_TTY`,
  *   `SSH_AUTH_SOCK`, `TMUX`, `TMUX_PANE`, `STY`, `XDG_SESSION_ID`, `XDG_SESSION_TYPE`, `DBUS_SESSION_BUS_ADDRESS`
- * - `INIT_CWD`, which Rush removes from every lifecycle script environment and sets explicitly where needed
- * - client routing: `RUSH_DAEMON` and `RUSH_DAEMON_AUTO_START` only select and start a daemon, and
- *   `RUSH_DAEMON_EXPERIMENTAL` is read from each request rather than from the process
+ * - service manager metadata that systemd assigns to every unit and scope: `INVOCATION_ID`, `JOURNAL_STREAM`,
+ *   `MANAGERPID`, `SYSTEMD_EXEC_PID`, `MEMORY_PRESSURE_WATCH`, `MEMORY_PRESSURE_WRITE`
+ * - editor and credential-prompt handles of an integrated terminal: `VSCODE_IPC_HOOK_CLI`,
+ *   `VSCODE_GIT_IPC_HANDLE`, `VSCODE_GIT_ASKPASS_MAIN`, `VSCODE_GIT_ASKPASS_NODE`,
+ *   `VSCODE_GIT_ASKPASS_EXTRA_ARGS`, `VSCODE_INJECTION`, `VSCODE_NONCE`, `GIT_ASKPASS`, `SSH_ASKPASS`
+ * - coding agent session markers: `COPILOT_CLI`, `COPILOT_AGENT_SESSION_ID`, `COPILOT_LOADER_PID`,
+ *   `COPILOT_CLI_BINARY_VERSION`, `COPILOT_CLI_RESOLVED_DIST_DIR`, `CLAUDECODE`, `CLAUDE_CODE_ENTRYPOINT`
+ * - the values that Claude Code sets in each command its Bash tool runs: `CLAUDE_CODE_CHILD_SESSION`,
+ *   `CLAUDE_CODE_SESSION_ID`, `CLAUDE_EFFORT` (the session's effort level, which can change within a session),
+ *   `CLAUDE_PID`, and, when the session has the feature, `CLAUDE_CODE_BRIDGE_SESSION_ID` (Remote Control),
+ *   `CLAUDE_CODE_MESSAGING_SOCKET` and `CLAUDE_CODE_MESSAGING_TOKEN` (cross-session messaging) and
+ *   `CLAUDE_JOB_DIR` (background sessions)
+ * - W3C trace context for one command: `TRACEPARENT` and `TRACESTATE`, which a traced caller such as Claude Code
+ *   sets to the span of that command
+ * - `RUSHD_TELEMETRY_TAG`, which tags the telemetry entry of one command with its caller's label
+ * - `INIT_CWD`, which Rush removes from every lifecycle script environment and sets explicitly where needed,
+ *   and `RUSH_INVOKED_FOLDER`, which Rush assigns for each invocation
+ * - client routing and presentation: `RUSH_DAEMON` and `RUSH_DAEMON_AUTO_START` only select and start a daemon,
+ *   `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` is sent as each request's admission deadline, `RUSHD_OUTPUT` selects
+ *   the client's output mode, and `RUSH_DAEMON_EXPERIMENTAL` is read from each request rather than from the process
+ * - `RUSH_PARALLELISM`, which a long-lived host applies to each request as its `--parallelism` default
+ * - temporary and runtime folders, which are often set per session, job or sandbox: `TMPDIR`, `TMP`, `TEMP` and
+ *   `XDG_RUNTIME_DIR`, and `RUSHD_RUNTIME_DIR`, which only selects the folder where a client meets its daemon
+ * - `RUSHD_OPERATION_GROUPS`, which a daemon on Linux sets in its own environment after it starts, to mark the
+ *   processes that it starts, so that a later daemon can tell which process groups the daemon left running
  *
  * Every other variable remains a process-bound input, including the remaining `RUSH_*` settings (such as
  * `RUSH_BUILD_CACHE_*` and the daemon's own `RUSH_DAEMON_*` resource settings), `NODE_*`, npm/pnpm
- * configuration, `PATH` and `HOME`. On Windows, names are matched case-insensitively.
+ * configuration, credentials, `PATH` and `HOME`. On Windows, names are matched case-insensitively.
+ * `PATH` is compared without repeated entries, because a later duplicate can never change which executable
+ * a lookup finds.
  *
- * A long-lived host that ignores these variables keeps the values from its own startup environment for the
- * processes it launches. Projects that need one of these values as an operation input should not rely on it
- * being request-specific in such a host.
+ * A long-lived host that ignores these variables must not give the processes it launches the values of the
+ * client that started it. Each operation instead takes every one of these variables from the request that it
+ * serves ({@link getWorkspaceRequestOperationEnvironment}), and does not receive the variable when that
+ * request does not define it, except `RUSHD_OPERATION_GROUPS`, which names the host and is taken from it. The
+ * host's own process also drops {@link workspaceRequestScopedEnvironmentVariables}, because code running inside
+ * it reads them from `process.env`.
  *
  * @alpha
  */
@@ -78,6 +119,9 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'LINES',
   'LS_COLORS',
   'WINDOWID',
+  'WT_SESSION',
+  'WT_PROFILE_ID',
+  'ITERM_SESSION_ID',
   'WSL_INTEROP',
   'WSLENV',
   'SSH_CLIENT',
@@ -90,19 +134,96 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'XDG_SESSION_ID',
   'XDG_SESSION_TYPE',
   'DBUS_SESSION_BUS_ADDRESS',
+  'INVOCATION_ID',
+  'JOURNAL_STREAM',
+  'MANAGERPID',
+  'SYSTEMD_EXEC_PID',
+  'MEMORY_PRESSURE_WATCH',
+  'MEMORY_PRESSURE_WRITE',
+  'VSCODE_IPC_HOOK_CLI',
+  'VSCODE_GIT_IPC_HANDLE',
+  'VSCODE_GIT_ASKPASS_MAIN',
+  'VSCODE_GIT_ASKPASS_NODE',
+  'VSCODE_GIT_ASKPASS_EXTRA_ARGS',
+  'VSCODE_INJECTION',
+  'VSCODE_NONCE',
+  'GIT_ASKPASS',
+  'SSH_ASKPASS',
+  'COPILOT_CLI',
+  'COPILOT_AGENT_SESSION_ID',
+  'COPILOT_LOADER_PID',
+  'COPILOT_CLI_BINARY_VERSION',
+  'COPILOT_CLI_RESOLVED_DIST_DIR',
+  'CLAUDECODE',
+  'CLAUDE_CODE_ENTRYPOINT',
+  'CLAUDE_CODE_CHILD_SESSION',
+  'CLAUDE_CODE_SESSION_ID',
+  'CLAUDE_EFFORT',
+  'CLAUDE_PID',
+  'CLAUDE_CODE_BRIDGE_SESSION_ID',
+  'CLAUDE_CODE_MESSAGING_SOCKET',
+  'CLAUDE_CODE_MESSAGING_TOKEN',
+  'CLAUDE_JOB_DIR',
+  'TRACEPARENT',
+  'TRACESTATE',
+  'RUSHD_TELEMETRY_TAG',
   'INIT_CWD',
+  'RUSH_INVOKED_FOLDER',
   'RUSH_DAEMON',
   'RUSH_DAEMON_AUTO_START',
-  'RUSH_DAEMON_EXPERIMENTAL'
+  'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
+  'RUSHD_OUTPUT',
+  'RUSH_DAEMON_EXPERIMENTAL',
+  'RUSH_PARALLELISM',
+  'TMPDIR',
+  'TMP',
+  'TEMP',
+  'XDG_RUNTIME_DIR',
+  'RUSHD_RUNTIME_DIR',
+  OPERATION_GROUPS_VARIABLE
+]);
+
+/**
+ * The subset of {@link workspaceFingerprintIgnoredEnvironmentVariables} whose value belongs to one request.
+ *
+ * @remarks
+ * A long-lived host must not inherit these variables from the client that started it: it applies
+ * `RUSH_PARALLELISM` from each request's own environment, and code running inside the host that reads a session
+ * identifier such as `COPILOT_AGENT_SESSION_ID` or `CLAUDE_CODE_SESSION_ID`, a telemetry label such as
+ * `RUSHD_TELEMETRY_TAG` or a trace context such as `TRACEPARENT` from `process.env` would otherwise attribute every
+ * later session's work to the first one. `CLAUDE_PID` names the first client's agent process, and
+ * `CLAUDE_CODE_MESSAGING_TOKEN` is that session's own credential. Likewise, the first client's `TMPDIR`,
+ * `XDG_RUNTIME_DIR`, `CLAUDE_JOB_DIR` or `CLAUDE_CODE_MESSAGING_SOCKET` may be removed when that client's session
+ * or job ends, while the host lives on. (`TMP` and `TEMP` stay, because Windows has no usable default for them.)
+ * A client that an operation of another daemon runs has that daemon's `RUSHD_OPERATION_GROUPS`, which a host must
+ * not pass on as its own. On Windows, names are matched case-insensitively.
+ *
+ * @alpha
+ */
+export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string> = new Set([
+  'RUSH_PARALLELISM',
+  'COPILOT_AGENT_SESSION_ID',
+  'CLAUDE_CODE_SESSION_ID',
+  'CLAUDE_PID',
+  'CLAUDE_CODE_BRIDGE_SESSION_ID',
+  'CLAUDE_CODE_MESSAGING_SOCKET',
+  'CLAUDE_CODE_MESSAGING_TOKEN',
+  'CLAUDE_JOB_DIR',
+  'TRACEPARENT',
+  'TRACESTATE',
+  'RUSHD_TELEMETRY_TAG',
+  'TMPDIR',
+  'XDG_RUNTIME_DIR',
+  OPERATION_GROUPS_VARIABLE
 ]);
 
 /**
  * Returns the defined environment entries that participate in workspace fingerprints, sorted by name.
  *
  * @remarks
- * Omits undefined values and {@link workspaceFingerprintIgnoredEnvironmentVariables}. Hosts that compare
- * environments outside {@link captureWorkspaceInputFingerprintAsync} must use this function so that every
- * comparison applies the same normalization.
+ * Omits undefined values and {@link workspaceFingerprintIgnoredEnvironmentVariables}, and removes repeated
+ * `PATH` entries. Hosts that compare environments outside {@link captureWorkspaceInputFingerprintAsync} must use
+ * this function so that every comparison applies the same normalization.
  *
  * @alpha
  */
@@ -110,13 +231,79 @@ export function getWorkspaceFingerprintEnvironmentEntries(
   environment: Readonly<Record<string, string | undefined>>
 ): [string, string][] {
   const isWindows: boolean = process.platform === 'win32';
-  return Object.entries(environment)
-    .filter(
-      (entry): entry is [string, string] =>
-        entry[1] !== undefined &&
-        !workspaceFingerprintIgnoredEnvironmentVariables.has(isWindows ? entry[0].toUpperCase() : entry[0])
-    )
-    .sort(([left], [right]) => Sort.compareByValue(left, right));
+  const entries: [string, string][] = [];
+  for (const [name, value] of Object.entries(environment)) {
+    if (value === undefined) continue;
+    const normalizedName: string = isWindows ? name.toUpperCase() : name;
+    if (workspaceFingerprintIgnoredEnvironmentVariables.has(normalizedName)) continue;
+    entries.push([name, normalizedName === 'PATH' ? removeRepeatedPathEntries(value) : value]);
+  }
+  return entries.sort(([left], [right]) => Sort.compareByValue(left, right));
+}
+
+/**
+ * Returns a copy of a host startup environment without {@link workspaceRequestScopedEnvironmentVariables}.
+ *
+ * @alpha
+ */
+export function getWorkspaceHostEnvironment(
+  environment: Readonly<Record<string, string | undefined>>
+): Record<string, string> {
+  const isWindows: boolean = process.platform === 'win32';
+  const hostEnvironment: Record<string, string> = {};
+  for (const [name, value] of Object.entries(environment)) {
+    if (
+      value !== undefined &&
+      !workspaceRequestScopedEnvironmentVariables.has(isWindows ? name.toUpperCase() : name)
+    ) {
+      hostEnvironment[name] = value;
+    }
+  }
+  return hostEnvironment;
+}
+
+/**
+ * Returns the environment that an operation starts from when a long-lived host runs it for a request.
+ *
+ * @remarks
+ * Every variable in {@link workspaceFingerprintIgnoredEnvironmentVariables} takes the request's value, and is
+ * omitted when the request does not define it, so that the operation sees its own requester's session, terminal
+ * and credential-helper variables. Every other variable comes from the host, whose environment matches the
+ * request's for identity, and so does `RUSHD_OPERATION_GROUPS`, which marks the processes that the host starts
+ * and is omitted when the host does not define it. A host returns the result from
+ * `IOperationGraphIterationOptions.getOperationEnvironment`. On Windows, names are matched case-insensitively.
+ *
+ * @alpha
+ */
+export function getWorkspaceRequestOperationEnvironment(
+  hostEnvironment: Readonly<Record<string, string | undefined>>,
+  requestEnvironment: Readonly<Record<string, string | undefined>>
+): Record<string, string> {
+  const isWindows: boolean = process.platform === 'win32';
+  const isRequestValue = (name: string): boolean => {
+    const normalizedName: string = isWindows ? name.toUpperCase() : name;
+    return (
+      normalizedName !== OPERATION_GROUPS_VARIABLE &&
+      workspaceFingerprintIgnoredEnvironmentVariables.has(normalizedName)
+    );
+  };
+  const environment: Record<string, string> = {};
+  for (const [name, value] of Object.entries(hostEnvironment)) {
+    if (value !== undefined && !isRequestValue(name)) environment[name] = value;
+  }
+  for (const [name, value] of Object.entries(requestEnvironment)) {
+    if (value !== undefined && isRequestValue(name)) environment[name] = value;
+  }
+  return environment;
+}
+
+function removeRepeatedPathEntries(value: string): string {
+  return Array.from(new Set(value.split(path.delimiter))).join(path.delimiter);
+}
+
+interface IFileDigest {
+  readonly stamp: string;
+  readonly entry: ReadonlyArray<string>;
 }
 
 /**
@@ -126,15 +313,30 @@ export function getWorkspaceFingerprintEnvironmentEntries(
  * @remarks
  * Embedding hosts create one cache per workspace lifetime and pass it to
  * {@link captureWorkspaceInputFingerprintAsync} through `runtimeCache`. The capture function
- * updates the cache; hosts can inspect {@link WorkspaceRuntimeFingerprintCache.changedPaths}
- * when reporting why a process restart is required.
+ * updates the cache; hosts can inspect {@link WorkspaceRuntimeFingerprintCache.changedPaths} and
+ * {@link WorkspaceRuntimeFingerprintCache.changedInstallationPaths} when reporting why a process restart
+ * is required.
+ *
+ * The cache also memoizes the digests of workspace definition and installation files, which users edit while
+ * a host is running. Such a digest is recorded only if the file's ctime and mtime were at least 3 seconds old
+ * when the file was examined, and it is reused only while the file's identity, size, mtime and ctime are
+ * unchanged. A file that changed more recently is read again by every capture. Every write updates a file's
+ * ctime, which userspace can't set, so a later write can't keep the recorded stamp even on a filesystem whose
+ * timestamps are coarse, provided that the filesystem's clock agrees with the host's to within that margin.
+ *
+ * Like the runtime digests, a memoized entry keeps the file's resolved path while the identity of the file it
+ * reaches is unchanged. A symbolic link that is retargeted to another hard link of the same file, or a parent
+ * folder that is moved without changing the file, keeps the previous resolved path.
  *
  * @alpha
  */
 export class WorkspaceRuntimeFingerprintCache {
-  private readonly _files: Map<string, { stamp: string; entry: ReadonlyArray<string> }> = new Map();
+  private readonly _files: Map<string, IFileDigest> = new Map();
+  private readonly _inputFiles: Map<string, IFileDigest> = new Map();
   private _baseline: ReadonlyMap<string, string> | undefined;
   private _changedPaths: ReadonlyArray<string> = [];
+  private _installationBaseline: ReadonlyMap<string, string> | undefined;
+  private _changedInstallationPaths: ReadonlyArray<string> = [];
 
   /**
    * Implementation paths whose content or existence differs from the first capture using this cache.
@@ -144,25 +346,36 @@ export class WorkspaceRuntimeFingerprintCache {
     return this._changedPaths;
   }
 
+  /**
+   * Installation files, such as lockfiles and the flags that an install writes, whose content or existence
+   * differs from the first capture using this cache. Updated by each capture; metadata-only changes do not
+   * appear in this list.
+   */
+  public get changedInstallationPaths(): ReadonlyArray<string> {
+    return this._changedInstallationPaths;
+  }
+
   /** @internal */
   public _hashPaths(paths: ReadonlyArray<string>): string {
     const filenames: Set<string> = new Set();
-    for (const filename of paths) {
+    // Several configured plugins often come from one package, whose folder is walked only once.
+    for (const filename of new Set(paths)) {
       for (const file of listRuntimeFilesSync(filename)) filenames.add(file);
     }
     const entries: ReadonlyArray<string>[] = [];
     for (const filename of Array.from(filenames).sort()) {
       try {
+        // statSync follows links, so dev and ino identify the file that is loaded. Its resolved path is
+        // recomputed whenever that identity changes, which avoids a costly realpath for every unchanged file.
         const stat: fsSync.BigIntStats = fsSync.statSync(filename, { bigint: true });
-        const realPath: string = fsSync.realpathSync(filename);
-        const stamp: string = `${realPath}:${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
-        let cached: { stamp: string; entry: ReadonlyArray<string> } | undefined = this._files.get(filename);
+        const stamp: string = getFileStamp(stat);
+        let cached: IFileDigest | undefined = this._files.get(filename);
         if (cached?.stamp !== stamp) {
           cached = {
             stamp,
             entry: [
               filename,
-              realPath,
+              fsSync.realpathSync(filename),
               createHash('sha256').update(fsSync.readFileSync(filename)).digest('hex')
             ]
           };
@@ -175,15 +388,94 @@ export class WorkspaceRuntimeFingerprintCache {
         entries.push([filename, 'missing']);
       }
     }
-    const current: ReadonlyMap<string, string> = new Map(
-      entries.map((entry) => [entry[0], JSON.stringify(entry)])
-    );
+    const current: ReadonlyMap<string, string> = getEntryMap(entries);
     this._baseline ??= current;
-    this._changedPaths = Array.from(new Set([...this._baseline.keys(), ...current.keys()])).filter(
-      (filename) => this._baseline!.get(filename) !== current.get(filename)
-    );
+    this._changedPaths = getChangedPaths(this._baseline, current);
     return hashText(JSON.stringify(entries));
   }
+
+  /**
+   * Hashes workspace definition or installation files by content, as `[filename, realpath, sha256]` entries or
+   * `[filename, 'missing']`. See the remarks of {@link WorkspaceRuntimeFingerprintCache} for when a digest is reused.
+   * @internal
+   */
+  public async _hashInputFilesAsync(filenames: Iterable<string>): Promise<string> {
+    return hashText(JSON.stringify(await this._getInputFileEntriesAsync(filenames)));
+  }
+
+  /**
+   * Hashes installation files as {@link WorkspaceRuntimeFingerprintCache._hashInputFilesAsync} does, and
+   * updates {@link WorkspaceRuntimeFingerprintCache.changedInstallationPaths}.
+   * @internal
+   */
+  public async _hashInstallationFilesAsync(filenames: Iterable<string>): Promise<string> {
+    const entries: ReadonlyArray<string>[] = await this._getInputFileEntriesAsync(filenames);
+    const current: ReadonlyMap<string, string> = getEntryMap(entries);
+    this._installationBaseline ??= current;
+    this._changedInstallationPaths = getChangedPaths(this._installationBaseline, current);
+    return hashText(JSON.stringify(entries));
+  }
+
+  private async _getInputFileEntriesAsync(filenames: Iterable<string>): Promise<ReadonlyArray<string>[]> {
+    const settledBeforeNs: bigint = getSettledBeforeNs();
+    const sortedFilenames: string[] = Array.from(filenames).sort();
+    const entries: ReadonlyArray<string>[] = new Array(sortedFilenames.length);
+    const misses: { index: number; stat: fsSync.BigIntStats | undefined }[] = [];
+    for (let index: number = 0; index < sortedFilenames.length; index++) {
+      const filename: string = sortedFilenames[index];
+      let stat: fsSync.BigIntStats | undefined;
+      try {
+        // statSync follows links, so dev and ino identify the file whose content is hashed.
+        stat = fsSync.statSync(filename, { bigint: true, throwIfNoEntry: false });
+      } catch {
+        // Hashing the file reports the error, or its absence, as an uncached capture does.
+        misses.push({ index, stat: undefined });
+        continue;
+      }
+      if (!stat) {
+        this._inputFiles.delete(filename);
+        entries[index] = [filename, 'missing'];
+      } else if (!stat.isFile()) {
+        misses.push({ index, stat: undefined });
+      } else {
+        const cached: IFileDigest | undefined = this._inputFiles.get(filename);
+        if (cached?.stamp === getFileStamp(stat)) {
+          entries[index] = cached.entry;
+        } else {
+          misses.push({ index, stat });
+        }
+      }
+    }
+    await Async.forEachAsync(
+      misses,
+      async ({ index, stat }) => {
+        const filename: string = sortedFilenames[index];
+        const entry: ReadonlyArray<string> = await hashFileAsync(filename);
+        entries[index] = entry;
+        if (stat && entry.length === 3 && isFileStatSettled(stat, settledBeforeNs)) {
+          this._inputFiles.set(filename, { stamp: getFileStamp(stat), entry });
+        } else {
+          this._inputFiles.delete(filename);
+        }
+      },
+      { concurrency: 3 }
+    );
+    return entries;
+  }
+}
+
+function getEntryMap(entries: ReadonlyArray<ReadonlyArray<string>>): ReadonlyMap<string, string> {
+  return new Map(entries.map((entry) => [entry[0], JSON.stringify(entry)]));
+}
+
+/** Returns the paths whose entries differ between two captures, including paths that only one of them has. */
+function getChangedPaths(
+  baseline: ReadonlyMap<string, string>,
+  current: ReadonlyMap<string, string>
+): string[] {
+  return Array.from(new Set([...baseline.keys(), ...current.keys()])).filter(
+    (filename) => baseline.get(filename) !== current.get(filename)
+  );
 }
 
 /** The strongest action required by a workspace input change. @alpha */
@@ -234,15 +526,33 @@ export async function captureWorkspaceInputFingerprintAsync(
     installation.add(path.join(subspace.getSubspaceTempFolderPath(), 'last-install.flag'));
   }
   installation.add(path.join(rushConfiguration.commonTempFolder, 'current-variants.json'));
-  const configurationFiles: string[] = await listFilesAsync(path.join(root, 'common', 'config'), false);
-  for (const filename of configurationFiles) {
-    (isProcessBoundConfiguration(filename) ? installation : definitions).add(filename);
-  }
+  const projectFolders: string[] = [];
   for (const project of rushJson.projects) {
     const projectFolder: string = path.resolve(root, project.projectFolder);
     if (!Path.isUnderOrEqual(projectFolder, root)) {
       throw new Error('A fingerprint project folder must be inside the workspace.');
     }
+    projectFolders.push(projectFolder);
+  }
+  const commonConfigFolder: string = path.join(root, 'common', 'config');
+  const configurationFiles: string[] = await listFilesAsync(
+    commonConfigFolder,
+    false,
+    getNestedProjectFolders(commonConfigFolder, projectFolders, rushConfiguration)
+  );
+  for (const filename of configurationFiles) {
+    (isProcessBoundConfiguration(filename) ? installation : definitions).add(filename);
+  }
+  // Configured plugins shape the command-line parser even when they are never loaded for a command.
+  for (const pluginConfiguration of rushConfiguration._rushPluginsConfiguration.configuration.plugins) {
+    for (const filename of AutoinstallerPluginLoader.getPluginShapeFilePaths(
+      rushConfiguration,
+      pluginConfiguration
+    )) {
+      definitions.add(filename);
+    }
+  }
+  for (const projectFolder of projectFolders) {
     for (const relativePath of [
       'package.json',
       '.gitignore',
@@ -259,21 +569,34 @@ export async function captureWorkspaceInputFingerprintAsync(
   const runtimePaths: string[] = [
     path.join(packageFolder, 'package.json'),
     path.join(packageFolder, 'lib-commonjs'),
+    // In a bundled Rush, lib-commonjs only forwards to the bundle chunks, which contain the implementation.
+    path.join(packageFolder, 'dist'),
     ...(options.runtimePaths ?? [])
   ];
-  const runtimeHash: string = (options.runtimeCache ?? new WorkspaceRuntimeFingerprintCache())._hashPaths(
-    runtimePaths
-  );
+  // A host loads plugins with require(), and Node.js never reloads a module, so a plugin's implementation is
+  // bound to the process that loaded it: an engine recreated in the same process would reuse the old code.
+  for (const pluginConfiguration of rushConfiguration._rushPluginsConfiguration.configuration.plugins) {
+    runtimePaths.push(
+      AutoinstallerPluginLoader.getPluginPackageFolder(rushConfiguration, pluginConfiguration)
+    );
+  }
+  const cache: WorkspaceRuntimeFingerprintCache =
+    options.runtimeCache ?? new WorkspaceRuntimeFingerprintCache();
+  const runtimeHash: string = cache._hashPaths(runtimePaths);
   return {
-    configurationHash: await hashFilesAsync(definitions),
+    configurationHash: await cache._hashInputFilesAsync(definitions),
     environmentHash: hashText(JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment))),
-    installationHash: await hashFilesAsync(installation),
+    installationHash: await cache._hashInstallationFilesAsync(installation),
     runtimeHash: hashText(JSON.stringify([process.execPath, process.version, runtimeHash])),
     selectedRushVersion: environment.RUSH_PREVIEW_VERSION ?? rushJson.rushVersion
   };
 }
 
-/** Fingerprints native merged project/rig/inherited configuration using invocation-owned loader caches. @alpha */
+/**
+ * Fingerprints native merged project/rig/inherited configuration using invocation-owned loader caches.
+ * Throws a {@link PhasedCommandEngineProjectConfigurationError} if a project's configuration cannot be loaded.
+ * @alpha
+ */
 export async function captureProjectConfigurationFingerprintAsync(
   rushConfiguration: RushConfiguration,
   terminal: ITerminal
@@ -298,29 +621,53 @@ function hashText(text: string): string {
   return createHash('sha256').update(text).digest('hex');
 }
 
-async function hashFilesAsync(filenames: Iterable<string>): Promise<string> {
-  const entries: string[][] = await Async.mapAsync(
-    Array.from(filenames).sort(),
-    async (filename) => {
-      try {
-        return [
-          filename,
-          await fs.realpath(filename),
-          createHash('sha256')
-            .update(await fs.readFile(filename))
-            .digest('hex')
-        ];
-      } catch (error) {
-        if (!FileSystem.isNotExistError(error as Error)) throw error;
-        return [filename, 'missing'];
-      }
-    },
-    { concurrency: 3 }
+async function hashFileAsync(filename: string): Promise<ReadonlyArray<string>> {
+  try {
+    return [
+      filename,
+      await fs.realpath(filename),
+      createHash('sha256')
+        .update(await fs.readFile(filename))
+        .digest('hex')
+    ];
+  } catch (error) {
+    if (!FileSystem.isNotExistError(error as Error)) throw error;
+    return [filename, 'missing'];
+  }
+}
+
+/**
+ * Returns the Rush project folders nested inside `common/config`. Rush reads such a project only through the
+ * project definition files fingerprinted for every project, and running its operations rewrites logs, build
+ * outputs and `.rush/temp` state inside it, which must not look like a configuration change. A project folder
+ * that is inside or contains a Rush configuration folder is never excluded.
+ */
+function getNestedProjectFolders(
+  commonConfigFolder: string,
+  projectFolders: ReadonlyArray<string>,
+  rushConfiguration: RushConfiguration
+): ReadonlySet<string> {
+  const rushConfigurationFolders: string[] = [
+    rushConfiguration.commonRushConfigFolder,
+    path.join(commonConfigFolder, 'subspaces'),
+    ...rushConfiguration.subspaces.map((subspace) => subspace.getSubspaceConfigFolderPath())
+  ];
+  return new Set(
+    projectFolders.filter(
+      (projectFolder) =>
+        Path.isUnder(projectFolder, commonConfigFolder) &&
+        !rushConfigurationFolders.some(
+          (folder) => Path.isUnderOrEqual(folder, projectFolder) || Path.isUnderOrEqual(projectFolder, folder)
+        )
+    )
   );
-  return hashText(JSON.stringify(entries));
 }
 
-async function listFilesAsync(folderOrFile: string, runtime: boolean): Promise<string[]> {
+async function listFilesAsync(
+  folderOrFile: string,
+  runtime: boolean,
+  excludedFolders: ReadonlySet<string> = new Set()
+): Promise<string[]> {
   try {
     const stat: Awaited<ReturnType<typeof fs.stat>> = await fs.stat(folderOrFile);
     if (!stat.isDirectory()) return [folderOrFile];
@@ -328,8 +675,14 @@ async function listFilesAsync(folderOrFile: string, runtime: boolean): Promise<s
     for (const entry of await fs.readdir(folderOrFile, { withFileTypes: true })) {
       if (entry.name === 'node_modules' || (runtime && entry.name === 'test')) continue;
       const filename: string = path.join(folderOrFile, entry.name);
-      if (entry.isDirectory()) files.push(...(await listFilesAsync(filename, runtime)));
-      else if (!runtime || (/\.(?:js|cjs|mjs|json)$/.test(entry.name) && !entry.name.endsWith('.test.js'))) {
+      if (entry.isDirectory()) {
+        if (!excludedFolders.has(filename)) {
+          files.push(...(await listFilesAsync(filename, runtime, excludedFolders)));
+        }
+      } else if (
+        !runtime ||
+        (/\.(?:js|cjs|mjs|json)$/.test(entry.name) && !entry.name.endsWith('.test.js'))
+      ) {
         files.push(filename);
       }
     }
@@ -346,12 +699,16 @@ function isProcessBoundConfiguration(filename: string): boolean {
   );
 }
 
+// Declaration and ES module output, which a plugin's CommonJS entry point doesn't load. Listing them would only
+// slow down the synchronous walk that every request runs.
+const NON_RUNTIME_FOLDER_NAMES: ReadonlySet<string> = new Set(['node_modules', 'test', 'lib-dts', 'lib-esm']);
+
 function listRuntimeFilesSync(folderOrFile: string): string[] {
   try {
     if (!fsSync.statSync(folderOrFile).isDirectory()) return [folderOrFile];
     const files: string[] = [];
     for (const entry of fsSync.readdirSync(folderOrFile, { withFileTypes: true })) {
-      if (entry.name === 'node_modules' || entry.name === 'test') continue;
+      if (NON_RUNTIME_FOLDER_NAMES.has(entry.name)) continue;
       const filename: string = path.join(folderOrFile, entry.name);
       if (entry.isDirectory()) files.push(...listRuntimeFilesSync(filename));
       else if (/\.(?:js|cjs|mjs|json)$/.test(entry.name) && !entry.name.endsWith('.test.js'))
diff --git a/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts b/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
new file mode 100644
index 00000000000..912d2531679
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
@@ -0,0 +1,130 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { BuildCacheConfiguration } from '../BuildCacheConfiguration';
+import { EnvironmentConfiguration, EnvironmentVariableNames } from '../EnvironmentConfiguration';
+import { RushConfiguration } from '../RushConfiguration';
+import { RushSession, type CloudBuildCacheProviderFactory } from '../../pluginFramework/RushSession';
+import type { ICloudBuildCacheProvider } from '../../logic/buildCache/ICloudBuildCacheProvider';
+
+type FactoryMock = jest.Mock<
+  ReturnType<CloudBuildCacheProviderFactory>,
+  Parameters<CloudBuildCacheProviderFactory>
+>;
+
+const OVERRIDE_JSON_VARIABLE: string = EnvironmentVariableNames.RUSH_BUILD_CACHE_OVERRIDE_JSON;
+const AZURE_CACHE_PROVIDER: string = 'azure-blob-storage';
+const STORAGE_ENDPOINT: string = 'http://127.0.0.1:10000/devstoreaccount1';
+
+describe(BuildCacheConfiguration.name, () => {
+  const originalOverrideJson: string | undefined = process.env[OVERRIDE_JSON_VARIABLE];
+  let rushConfiguration: RushConfiguration;
+  let factory: FactoryMock;
+
+  beforeAll(() => {
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(`${__dirname}/repo/rush-npm.json`);
+  });
+
+  beforeEach(() => {
+    const cloudCacheProvider: ICloudBuildCacheProvider = {} as ICloudBuildCacheProvider;
+    factory = jest.fn<ReturnType<CloudBuildCacheProviderFactory>, Parameters<CloudBuildCacheProviderFactory>>(
+      () => cloudCacheProvider
+    );
+  });
+
+  afterEach(() => {
+    if (originalOverrideJson === undefined) {
+      delete process.env[OVERRIDE_JSON_VARIABLE];
+    } else {
+      process.env[OVERRIDE_JSON_VARIABLE] = originalOverrideJson;
+    }
+    EnvironmentConfiguration.reset();
+  });
+
+  async function tryLoadAzureConfigurationAsync(
+    azureBlobStorageConfiguration: Record<string, unknown>
+  ): Promise<BuildCacheConfiguration | undefined> {
+    process.env[OVERRIDE_JSON_VARIABLE] = JSON.stringify({
+      buildCacheEnabled: true,
+      cacheProvider: AZURE_CACHE_PROVIDER,
+      azureBlobStorageConfiguration
+    });
+    EnvironmentConfiguration.reset();
+
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const rushSession: RushSession = new RushSession({ terminalProvider, getIsDebugMode: () => false });
+    rushSession.registerCloudBuildCacheProviderFactory(AZURE_CACHE_PROVIDER, factory);
+
+    return await BuildCacheConfiguration.tryLoadAsync(
+      new Terminal(terminalProvider),
+      rushConfiguration,
+      rushSession
+    );
+  }
+
+  it('passes azureBlobStorageConfiguration.storageEndpoint to the cloud cache provider', async () => {
+    const configuration: BuildCacheConfiguration | undefined = await tryLoadAzureConfigurationAsync({
+      storageAccountName: 'example',
+      storageContainerName: 'build-cache',
+      storageEndpoint: STORAGE_ENDPOINT
+    });
+
+    expect(configuration?.buildCacheEnabled).toBe(true);
+    expect(factory).toHaveBeenCalledTimes(1);
+    expect(factory.mock.calls[0][0]).toMatchObject({
+      azureBlobStorageConfiguration: { storageEndpoint: STORAGE_ENDPOINT }
+    });
+  });
+
+  it('rejects a property that azureBlobStorageConfiguration does not define', async () => {
+    await expect(
+      tryLoadAzureConfigurationAsync({
+        storageAccountName: 'example',
+        storageContainerName: 'build-cache',
+        storageEndpointUrl: STORAGE_ENDPOINT
+      })
+    ).rejects.toThrow(/must NOT have additional properties: storageEndpointUrl/);
+    expect(factory).not.toHaveBeenCalled();
+  });
+
+  it('rejects a storageEndpoint that is not a URI', async () => {
+    await expect(
+      tryLoadAzureConfigurationAsync({
+        storageAccountName: 'example',
+        storageContainerName: 'build-cache',
+        storageEndpoint: 'http://127.0.0.1 port 10000'
+      })
+    ).rejects.toThrow(/#\/azureBlobStorageConfiguration\/storageEndpoint\s+must match format "uri"/);
+    expect(factory).not.toHaveBeenCalled();
+  });
+
+  it('rejects a storageEndpoint without an http or https scheme', async () => {
+    // "localhost:" parses as a URI scheme, so only the pattern catches this common mistake.
+    await expect(
+      tryLoadAzureConfigurationAsync({
+        storageAccountName: 'example',
+        storageContainerName: 'build-cache',
+        storageEndpoint: 'localhost:10000/devstoreaccount1'
+      })
+    ).rejects.toThrow(
+      /#\/azureBlobStorageConfiguration\/storageEndpoint\s+must match pattern "\^\[Hh\]\[Tt\]\[Tt\]\[Pp\]\[Ss\]\?:\/\/"/
+    );
+    expect(factory).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    { kind: 'an https storageEndpoint', storageEndpoint: 'https://my-proxy.example.com/devstoreaccount1' },
+    // URI schemes are case-insensitive, and Rush accepted this before the pattern existed.
+    { kind: 'a storageEndpoint with an uppercase scheme', storageEndpoint: 'HTTP://127.0.0.1:10000/x' }
+  ])('accepts $kind', async ({ storageEndpoint }: { storageEndpoint: string }) => {
+    await tryLoadAzureConfigurationAsync({
+      storageAccountName: 'example',
+      storageContainerName: 'build-cache',
+      storageEndpoint
+    });
+    expect(factory).toHaveBeenCalledTimes(1);
+    expect(factory.mock.calls[0][0]).toMatchObject({ azureBlobStorageConfiguration: { storageEndpoint } });
+  });
+});
diff --git a/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts b/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts
index 6cd9360ed1b..0aa5e783534 100644
--- a/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts
@@ -294,4 +294,34 @@ describe(CommandLineConfiguration.name, () => {
       expect(phase.shellCommand).toEqual('echo');
     });
   });
+
+  describe('disableBuildCache in phased command', () => {
+    const loaders: {
+      loaderName: string;
+      load: (jsonFilePath: string) => CommandLineConfiguration | undefined;
+    }[] = [
+      {
+        loaderName: 'loadFromFileOrDefault',
+        load: (jsonFilePath: string) => CommandLineConfiguration.loadFromFileOrDefault(jsonFilePath)
+      },
+      {
+        loaderName: 'tryLoadFromFile',
+        load: (jsonFilePath: string) => CommandLineConfiguration.tryLoadFromFile(jsonFilePath)
+      }
+    ];
+
+    it.each(loaders)('is allowed by $loaderName', ({ load }) => {
+      const command: IPhasedCommandConfig | undefined = load(
+        `${__dirname}/jsonFiles/command-line-phased-disableBuildCache.json`
+      )?.commands.get('ship') as IPhasedCommandConfig | undefined;
+      expect(command?.commandKind).toEqual('phased');
+      expect(command?.disableBuildCache).toEqual(true);
+    });
+
+    it.each(loaders)('does not allow other undeclared properties in $loaderName', ({ load }) => {
+      expect(() => load(`${__dirname}/jsonFiles/command-line-phased-unknown-property.json`)).toThrow(
+        /must NOT have additional properties: disableBuildCaches/
+      );
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index c2e46f39ad2..347940d7b30 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -2,7 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { JsonSchema } from '@rushstack/node-core-library';
-import { resolveDaemonConfiguration } from '../DaemonConfiguration';
+import { type IDaemonConfigurationJson, resolveDaemonConfiguration } from '../DaemonConfiguration';
 import schemaJson from '../../schemas/rush.schema.json';
 
 describe('daemon configuration', () => {
@@ -11,6 +11,11 @@ describe('daemon configuration', () => {
       enabled: false,
       autoStart: true,
       usePersistentIpcRunners: false,
+      incrementalBuilds: true,
+      warmWorkers: false,
+      joinRunningBatch: false,
+      deferCacheWrites: false,
+      backgroundPrepare: false,
       idleTimeoutSeconds: 900
     });
     expect(
@@ -35,7 +40,14 @@ describe('daemon configuration', () => {
     { RUSH_DAEMON_WARM_SET_MAX_PROJECTS: '1.5' },
     { RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: '' },
     { RUSH_DAEMON_EXPERIMENTAL: 'yes' },
-    { RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'yes' }
+    { RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'yes' },
+    { RUSH_DAEMON_INCREMENTAL_BUILDS: 'off' },
+    { RUSH_DAEMON_WARM_WORKERS: 'true' },
+    { RUSH_DAEMON_JOIN_RUNNING_BATCH: 'true' },
+    { RUSH_DAEMON_JOIN_RUNNING_BATCH: '' },
+    { RUSH_DAEMON_DEFER_CACHE_WRITES: 'on' },
+    { RUSH_DAEMON_BACKGROUND_PREPARE: 'true' },
+    { RUSH_DAEMON_BACKGROUND_PREPARE: '' }
   ])('rejects invalid overrides %j', (environment) => {
     expect(() => resolveDaemonConfiguration({}, environment)).toThrow();
   });
@@ -52,7 +64,22 @@ describe('daemon configuration', () => {
     { warmMemoryBudgetMB: 0 },
     { warmSetMaxProjects: 0.5 },
     { autoWarmByTelemetry: 1 },
-    { usePersistentIpcRunners: 'true' }
+    { usePersistentIpcRunners: 'true' },
+    { incrementalBuilds: 'false' },
+    { warmWorkers: 1 },
+    { joinRunningBatch: 'true' },
+    { deferCacheWrites: 'true' },
+    { backgroundPrepare: 1 },
+    { compatiblePlugins: 'rush-example-plugin' },
+    { compatiblePlugins: [''] },
+    { compatiblePlugins: [' rush-example-plugin'] },
+    { compatiblePlugins: ['rush-a-plugin,rush-b-plugin'] },
+    { compatiblePlugins: [1] },
+    { commandAgnosticPlugins: 'rush-example-plugin' },
+    { commandAgnosticPlugins: [''] },
+    { commandAgnosticPlugins: [' rush-example-plugin'] },
+    { commandAgnosticPlugins: ['rush-a-plugin,rush-b-plugin'] },
+    { commandAgnosticPlugins: [1] }
   ])('publishes schema rejection for %j', (daemon) => {
     const schema = JsonSchema.fromLoadedObject(schemaJson);
     expect(() =>
@@ -63,6 +90,114 @@ describe('daemon configuration', () => {
     ).toThrow();
   });
 
+  it('runs :incremental scripts in the daemon unless the environment or configuration turns it off', () => {
+    expect(resolveDaemonConfiguration({ incrementalBuilds: false }, {}).incrementalBuilds).toBe(false);
+    expect(
+      resolveDaemonConfiguration({ incrementalBuilds: false }, { RUSH_DAEMON_INCREMENTAL_BUILDS: '1' })
+        .incrementalBuilds
+    ).toBe(true);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_INCREMENTAL_BUILDS: '0' }).incrementalBuilds).toBe(
+      false
+    );
+  });
+
+  it('keeps warm workers only if the environment or configuration turns them on', () => {
+    expect(resolveDaemonConfiguration({ warmWorkers: true }, {}).warmWorkers).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ warmWorkers: true }, { RUSH_DAEMON_WARM_WORKERS: '0' }).warmWorkers
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_WARM_WORKERS: '1' }).warmWorkers).toBe(true);
+  });
+
+  it('lets requests join a running batch only if the environment or configuration turns it on', () => {
+    expect(resolveDaemonConfiguration({ joinRunningBatch: true }, {}).joinRunningBatch).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ joinRunningBatch: true }, { RUSH_DAEMON_JOIN_RUNNING_BATCH: '0' })
+        .joinRunningBatch
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_JOIN_RUNNING_BATCH: '1' }).joinRunningBatch).toBe(
+      true
+    );
+  });
+
+  it('defers cache writes only if the environment or configuration turns it on', () => {
+    expect(resolveDaemonConfiguration({ deferCacheWrites: true }, {}).deferCacheWrites).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ deferCacheWrites: true }, { RUSH_DAEMON_DEFER_CACHE_WRITES: '0' })
+        .deferCacheWrites
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_DEFER_CACHE_WRITES: '1' }).deferCacheWrites).toBe(
+      true
+    );
+  });
+
+  it('prepares the next engine in the background only if the environment or configuration turns it on', () => {
+    expect(resolveDaemonConfiguration({ backgroundPrepare: true }, {}).backgroundPrepare).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ backgroundPrepare: true }, { RUSH_DAEMON_BACKGROUND_PREPARE: '0' })
+        .backgroundPrepare
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_BACKGROUND_PREPARE: '1' }).backgroundPrepare).toBe(
+      true
+    );
+  });
+
+  describe.each([
+    ['compatiblePlugins', 'RUSH_DAEMON_COMPATIBLE_PLUGINS'],
+    ['commandAgnosticPlugins', 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS']
+  ] as const)('%s', (key, variable) => {
+    it('resolves plugin names from the environment, then configuration, then no plugins', () => {
+      expect(resolveDaemonConfiguration({}, {})[key]).toEqual([]);
+      const configured: string[] = ['rush-a-plugin', 'rush-b-plugin'];
+      expect(resolveDaemonConfiguration({ [key]: configured }, {})[key]).toEqual(configured);
+      expect(
+        resolveDaemonConfiguration({ [key]: configured }, { [variable]: ' rush-c-plugin , rush-d-plugin' })[
+          key
+        ]
+      ).toEqual(['rush-c-plugin', 'rush-d-plugin']);
+      // An empty value is an explicit override that declares no plugins.
+      for (const value of ['', ' ']) {
+        expect(resolveDaemonConfiguration({ [key]: configured }, { [variable]: value })[key]).toEqual([]);
+      }
+      const resolved: readonly string[] = resolveDaemonConfiguration({ [key]: configured }, {})[key];
+      expect(Object.isFrozen(resolved)).toBe(true);
+      expect(resolved).not.toBe(configured);
+    });
+
+    it('resolves the other plugin list independently', () => {
+      const otherKey: typeof key =
+        key === 'compatiblePlugins' ? 'commandAgnosticPlugins' : 'compatiblePlugins';
+      const resolved: Readonly<Required<IDaemonConfigurationJson>> = resolveDaemonConfiguration(
+        { [key]: ['rush-a-plugin'] },
+        { [variable]: 'rush-b-plugin' }
+      );
+      expect(resolved[key]).toEqual(['rush-b-plugin']);
+      expect(resolved[otherKey]).toEqual([]);
+    });
+
+    it.each([',', 'rush-a-plugin,', 'rush-a-plugin,,rush-b-plugin', ' , rush-a-plugin'])(
+      'rejects override %j with an empty entry',
+      (value) => {
+        expect(() => resolveDaemonConfiguration({}, { [variable]: value })).toThrow(
+          `${variable} must be a comma-separated list of plugin names.`
+        );
+      }
+    );
+
+    it.each([
+      'rush-example-plugin',
+      [''],
+      [' rush-example-plugin'],
+      ['rush-a-plugin,rush-b-plugin'],
+      [1],
+      [null]
+    ])('rejects configured value %j', (value) => {
+      expect(() => resolveDaemonConfiguration({ [key]: value as unknown as string[] }, {})).toThrow(
+        `daemon.${key} must be an array of plugin names.`
+      );
+    });
+  });
+
   it('accepts all valid knobs in the published schema', () => {
     JsonSchema.fromLoadedObject(schemaJson).validateObject(
       {
@@ -73,5 +208,17 @@ describe('daemon configuration', () => {
       },
       'rush.json'
     );
+    JsonSchema.fromLoadedObject(schemaJson).validateObject(
+      {
+        rushVersion: '5.179.0',
+        pnpmVersion: '10.27.0',
+        projects: [],
+        daemon: resolveDaemonConfiguration(
+          { compatiblePlugins: ['rush-example-plugin'], commandAgnosticPlugins: ['rush-example-plugin'] },
+          {}
+        )
+      },
+      'rush.json'
+    );
   });
 });
diff --git a/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts b/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts
index 0dc982bb2ea..ca75e513a19 100644
--- a/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import { daemonEnvironmentVariables } from '../DaemonConfiguration';
 import { EnvironmentConfiguration } from '../EnvironmentConfiguration';
 
 describe(EnvironmentConfiguration.name, () => {
@@ -37,6 +38,13 @@ describe(EnvironmentConfiguration.name, () => {
       expect(process.env.RUSH_LOG_LEVEL).toBe(env.RUSH_LOG_LEVEL);
     });
 
+    it('allows every daemon environment variable', () => {
+      for (const name of Object.values(daemonEnvironmentVariables)) {
+        process.env[name] = '1';
+      }
+      expect(EnvironmentConfiguration.validate).not.toThrow();
+    });
+
     it('does not allow unknown environment variables', () => {
       process.env['rush_foobar'] = 'asdf'; // eslint-disable-line dot-notation
       expect(EnvironmentConfiguration.validate).toThrow();
diff --git a/libraries/rush-lib/src/api/test/FlagFile.test.ts b/libraries/rush-lib/src/api/test/FlagFile.test.ts
index 017c648aeb1..6e30604cf53 100644
--- a/libraries/rush-lib/src/api/test/FlagFile.test.ts
+++ b/libraries/rush-lib/src/api/test/FlagFile.test.ts
@@ -7,7 +7,7 @@ import { FileSystem } from '@rushstack/node-core-library';
 import { FlagFile } from '../FlagFile';
 import { RushConstants } from '../../logic/RushConstants';
 
-const TEMP_DIR_PATH: string = `${__dirname}/temp`;
+const TEMP_DIR_PATH: string = `${__dirname}/temp-${FlagFile.name}`;
 
 describe(FlagFile.name, () => {
   beforeEach(() => {
diff --git a/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts b/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts
index 11aa23f09a5..c0433bf28d3 100644
--- a/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts
+++ b/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts
@@ -6,7 +6,7 @@ import { FileSystem } from '@rushstack/node-core-library';
 
 import { LastInstallFlag } from '../LastInstallFlag';
 
-const TEMP_DIR_PATH: string = `${__dirname}/temp`;
+const TEMP_DIR_PATH: string = `${__dirname}/temp-${LastInstallFlag.name}`;
 
 describe(LastInstallFlag.name, () => {
   beforeEach(() => {
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
new file mode 100644
index 00000000000..fc61489292d
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -0,0 +1,987 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem, type IPackageJson, JsonFile } from '@rushstack/node-core-library';
+import { NoOpTerminalProvider, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { PhasedCommandEngine } from '../PhasedCommandEngine';
+import { PhasedCommandEngineUsageError } from '../PhasedCommandEngineUsageError';
+import { Rush } from '../Rush';
+import { RushConfiguration } from '../RushConfiguration';
+import { RushGlobalFolder } from '../RushGlobalFolder';
+import { EnvironmentConfiguration } from '../EnvironmentConfiguration';
+import { RushCommandLineParser } from '../../cli/RushCommandLineParser';
+import { Autoinstaller } from '../../logic/Autoinstaller';
+import type { IBuiltInPluginConfiguration } from '../../pluginFramework/PluginLoader/BuiltInPluginLoader';
+import type { IRushPluginManifestJson } from '../../pluginFramework/PluginLoader/PluginLoaderBase';
+import { PluginManager } from '../../pluginFramework/PluginManager';
+import { RushSession } from '../../pluginFramework/RushSession';
+import { JsonFileLoadCache } from '../../utilities/JsonFileLoadCache';
+
+const PACKAGE_NAME: string = '@example/rush-example-plugin';
+const PLUGIN_NAME: string = 'rush-example-plugin';
+const PLUGIN_COMMAND: string = 'record-example';
+const OTHER_PLUGIN_NAME: string = 'rush-other-plugin';
+const COMPATIBLE_PLUGINS_VARIABLE: string = 'RUSH_DAEMON_COMPATIBLE_PLUGINS';
+const COMMAND_AGNOSTIC_PLUGINS_VARIABLE: string = 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS';
+
+interface IPluginFixture {
+  /** Defaults to PLUGIN_NAME. The plugin's package is `@example/<pluginName>`. */
+  readonly pluginName?: string;
+  readonly associatedCommands?: string[];
+  readonly commandLineJson?: object;
+  readonly writeManifest?: boolean;
+  readonly daemonCompatible?: boolean;
+  readonly daemonCommandAgnostic?: boolean;
+  /** If set, the plugin package has an entry point whose apply() taps these session hooks. */
+  readonly taps?: {
+    readonly initialize?: boolean;
+    readonly runAnyPhasedCommand?: boolean;
+    /** The commands whose runPhasedCommand hook it taps. */
+    readonly runPhasedCommand?: string[];
+  };
+}
+
+interface IRepoFixture {
+  readonly plugins: ReadonlyArray<IPluginFixture>;
+  /** The rush.json `daemon.compatiblePlugins` setting. */
+  readonly compatiblePlugins?: string[];
+  /** The rush.json `daemon.commandAgnosticPlugins` setting. */
+  readonly commandAgnosticPlugins?: string[];
+  readonly commandLineJson?: object;
+}
+
+// Mirrors the command-scoped plugin that rushstack configures in common/config/rush/rush-plugins.json.
+const COMMAND_SCOPED_COMMAND_LINE_JSON: object = {
+  commands: [{ commandKind: 'globalPlugin', name: PLUGIN_COMMAND, summary: 'Records an example.' }],
+  parameters: [
+    {
+      parameterKind: 'string',
+      longName: '--output-path',
+      argumentName: 'FILE_PATH',
+      description: 'The output path.',
+      associatedCommands: [PLUGIN_COMMAND]
+    }
+  ]
+};
+
+// A plugin that shapes the build phase.
+const PHASE_SHAPING_COMMAND_LINE_JSON: object = {
+  ...COMMAND_SCOPED_COMMAND_LINE_JSON,
+  phases: [{ name: '_phase:build' }],
+  parameters: [
+    {
+      parameterKind: 'flag',
+      longName: '--example-flag',
+      description: 'An example flag.',
+      associatedCommands: [PLUGIN_COMMAND],
+      associatedPhases: ['_phase:build']
+    }
+  ]
+};
+
+const REPO_COMMAND_LINE_JSON: object = {
+  commands: [
+    {
+      commandKind: 'phased',
+      name: 'build',
+      summary: 'Build',
+      phases: ['_phase:build'],
+      enableParallelism: true,
+      incremental: true
+    }
+  ],
+  phases: [{ name: '_phase:build', dependencies: { upstream: ['_phase:build'] } }]
+};
+
+function getPackageName(plugin: IPluginFixture): string {
+  return `@example/${plugin.pluginName ?? PLUGIN_NAME}`;
+}
+
+function getPluginManifest(plugin: IPluginFixture): object {
+  return {
+    plugins: [
+      {
+        pluginName: plugin.pluginName ?? PLUGIN_NAME,
+        description: 'An example plugin.',
+        entryPoint: './lib/index.js',
+        associatedCommands: plugin.associatedCommands,
+        commandLineJsonFilePath: './command-line.json',
+        daemonCompatible: plugin.daemonCompatible,
+        daemonCommandAgnostic: plugin.daemonCommandAgnostic
+      }
+    ]
+  };
+}
+
+/** Writes the package of `plugin`, with an entry point whose apply() taps the hooks of `plugin.taps`. */
+function writePluginPackage(packageFolder: string, plugin: IPluginFixture): void {
+  const pluginName: string = plugin.pluginName ?? PLUGIN_NAME;
+  const { initialize, runAnyPhasedCommand, runPhasedCommand = [] } = plugin.taps ?? {};
+  const statements: string[] = [
+    ...(initialize ? ['hooks.initialize.tapPromise(name, async () => {});'] : []),
+    ...(runAnyPhasedCommand ? ['hooks.runAnyPhasedCommand.tapPromise(name, async () => {});'] : []),
+    ...runPhasedCommand.map(
+      (commandName) => `hooks.runPhasedCommand.for(${JSON.stringify(commandName)}).tap(name, () => {});`
+    )
+  ];
+  fs.mkdirSync(path.join(packageFolder, 'lib'), { recursive: true });
+  fs.writeFileSync(
+    path.join(packageFolder, 'package.json'),
+    JSON.stringify({ name: getPackageName(plugin), version: '1.0.0' })
+  );
+  fs.writeFileSync(
+    path.join(packageFolder, 'lib/index.js'),
+    [
+      'module.exports = class {',
+      '  apply({ hooks }) {',
+      `    const name = ${JSON.stringify(pluginName)};`,
+      ...statements.map((statement) => `    ${statement}`),
+      '  }',
+      '};'
+    ].join('\n')
+  );
+}
+
+/** Writes `plugin` as a plugin that Rush provides itself, like its build cache plugins, in `pluginPackageFolder`. */
+function writeBuiltInPlugin(
+  pluginPackageFolder: string,
+  plugin: IPluginFixture
+): IBuiltInPluginConfiguration {
+  writePluginPackage(pluginPackageFolder, plugin);
+  fs.writeFileSync(
+    path.join(pluginPackageFolder, 'rush-plugin-manifest.json'),
+    JSON.stringify(getPluginManifest(plugin))
+  );
+  return {
+    packageName: getPackageName(plugin),
+    pluginName: plugin.pluginName ?? PLUGIN_NAME,
+    pluginPackageFolder
+  };
+}
+
+function createRepo(repo: IRepoFixture): string {
+  const folder: string = fs.mkdtempSync(
+    path.join(fs.realpathSync.native(os.tmpdir()), 'rush-engine-plugins-')
+  );
+  const write = (relativePath: string, json: object): void => {
+    const filename: string = path.join(folder, relativePath);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, JSON.stringify(json));
+  };
+  const { compatiblePlugins, commandAgnosticPlugins } = repo;
+  write('rush.json', {
+    rushVersion: '5.179.0',
+    pnpmVersion: '10.27.0',
+    projects: [],
+    ...(compatiblePlugins || commandAgnosticPlugins
+      ? { daemon: { compatiblePlugins, commandAgnosticPlugins } }
+      : {})
+  });
+  write('common/config/rush/command-line.json', repo.commandLineJson ?? REPO_COMMAND_LINE_JSON);
+  write('common/config/rush/rush-plugins.json', {
+    plugins: repo.plugins.map((plugin) => ({
+      packageName: getPackageName(plugin),
+      pluginName: plugin.pluginName ?? PLUGIN_NAME,
+      autoinstallerName: 'plugins'
+    }))
+  });
+  write('common/autoinstallers/plugins/package.json', {
+    name: 'plugins',
+    version: '1.0.0',
+    private: true,
+    dependencies: Object.fromEntries(repo.plugins.map((plugin) => [getPackageName(plugin), '1.0.0']))
+  });
+  for (const plugin of repo.plugins) {
+    const pluginName: string = plugin.pluginName ?? PLUGIN_NAME;
+    const storeFolder: string = `common/autoinstallers/plugins/rush-plugins/${getPackageName(plugin)}`;
+    if (plugin.writeManifest !== false) {
+      write(`${storeFolder}/rush-plugin-manifest.json`, getPluginManifest(plugin));
+    }
+    if (plugin.commandLineJson) {
+      write(`${storeFolder}/${pluginName}/command-line.json`, plugin.commandLineJson);
+    }
+    if (plugin.taps) {
+      writePluginPackage(
+        path.join(folder, `common/autoinstallers/plugins/node_modules/${getPackageName(plugin)}`),
+        plugin
+      );
+    }
+  }
+  return folder;
+}
+
+/** Applies the plugins that Rush initializes for `commandName` to a new session, as an engine does. */
+async function applyPluginsAsync(
+  folder: string,
+  commandName: string,
+  builtInPluginConfigurations: IBuiltInPluginConfiguration[] = []
+): Promise<RushSession> {
+  const terminalProvider: NoOpTerminalProvider = new NoOpTerminalProvider();
+  const rushSession: RushSession = new RushSession({ terminalProvider, getIsDebugMode: () => false });
+  const pluginManager: PluginManager = new PluginManager({
+    terminal: new Terminal(terminalProvider),
+    rushConfiguration: RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json')),
+    rushSession,
+    builtInPluginConfigurations: [...builtInPluginConfigurations],
+    restrictConsoleOutput: true,
+    rushGlobalFolder: new RushGlobalFolder()
+  });
+  await pluginManager.tryInitializeUnassociatedPluginsAsync();
+  await pluginManager.tryInitializeAssociatedCommandPluginsAsync(commandName);
+  expect(pluginManager.error).toBeUndefined();
+  return rushSession;
+}
+
+async function parseBuildAsync(
+  folder: string,
+  argv: string[] = ['build'],
+  terminalProvider: NoOpTerminalProvider | StringBufferTerminalProvider = new NoOpTerminalProvider()
+): Promise<PhasedCommandEngine> {
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    path.join(folder, 'rush.json')
+  );
+  return await PhasedCommandEngine.parseAsync({
+    argv,
+    cwd: folder,
+    rushConfiguration,
+    terminalProvider
+  });
+}
+
+describe(PhasedCommandEngine.name, () => {
+  const folders: string[] = [];
+  function createTestRepo(plugin: IPluginFixture, repo?: Omit<IRepoFixture, 'plugins'>): string {
+    return createMultiPluginTestRepo({ ...repo, plugins: [plugin] });
+  }
+  function createMultiPluginTestRepo(repo: IRepoFixture): string {
+    const folder: string = createRepo(repo);
+    folders.push(folder);
+    return folder;
+  }
+
+  const originalEnvironment: ReadonlyMap<string, string | undefined> = new Map(
+    [COMPATIBLE_PLUGINS_VARIABLE, COMMAND_AGNOSTIC_PLUGINS_VARIABLE].map((name) => [name, process.env[name]])
+  );
+  afterEach(() => {
+    for (const [name, value] of originalEnvironment) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+    for (const folder of folders.splice(0)) {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('accepts a plugin that is associated with, and only shapes, a different command', async () => {
+    const folder: string = createTestRepo({
+      associatedCommands: [PLUGIN_COMMAND],
+      commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON
+    });
+    for (const commandName of ['build', 'rebuild']) {
+      const command: PhasedCommandEngine = await parseBuildAsync(folder, [commandName]);
+      expect(command.commandName).toBe(commandName);
+    }
+  });
+
+  it('accepts a plugin associated with no commands and without a command-line.json', async () => {
+    const folder: string = createTestRepo({ associatedCommands: [] });
+    const command: PhasedCommandEngine = await parseBuildAsync(folder);
+    expect(command.commandName).toBe('build');
+  });
+
+  it('parses the phased commands of command-line.json and rejects a global command', async () => {
+    const phase: string = '_phase:build';
+    const folder: string = createMultiPluginTestRepo({
+      plugins: [],
+      commandLineJson: {
+        commands: [
+          {
+            commandKind: 'phased',
+            name: 'build',
+            summary: 'Build',
+            phases: [phase],
+            enableParallelism: true,
+            incremental: true
+          },
+          {
+            commandKind: 'phased',
+            name: 'retest',
+            summary: 'Retest',
+            phases: [phase],
+            enableParallelism: true
+          },
+          { commandKind: 'global', name: 'hello', summary: 'Hello', shellCommand: 'echo hello' }
+        ],
+        phases: [{ name: phase, dependencies: { upstream: [phase] } }]
+      }
+    });
+    const build: PhasedCommandEngine = await parseBuildAsync(folder);
+    const retest: PhasedCommandEngine = await parseBuildAsync(folder, ['retest']);
+    expect([build.commandName, build.isIncremental]).toEqual(['build', true]);
+    expect([retest.commandName, retest.isIncremental]).toEqual(['retest', false]);
+    expect(retest.parameterIdentity).not.toBe(build.parameterIdentity);
+    await expect(parseBuildAsync(folder, ['hello'])).rejects.toThrow(
+      'The daemon engine runs phased commands only; "hello" is not a phased command.'
+    );
+    // Only a phased command's command line is a usage error. In-process Rush reports any other invalid one.
+    const stderrWrite: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    try {
+      for (const argv of [
+        ['retest', '--nope'],
+        ['--debug', 'retest', '--nope']
+      ]) {
+        await expect(parseBuildAsync(folder, argv)).rejects.toMatchObject({
+          name: PhasedCommandEngineUsageError.name,
+          message: 'rush retest: error: Unrecognized arguments: --nope.',
+          exitCode: 2
+        });
+      }
+      for (const argv of [['hello', '--nope'], ['nope']]) {
+        const error: unknown = await parseBuildAsync(folder, argv).catch((e: unknown) => e);
+        expect(error).toBeInstanceOf(Error);
+        expect(error).not.toBeInstanceOf(PhasedCommandEngineUsageError);
+      }
+    } finally {
+      stderrWrite.mockRestore();
+    }
+  });
+
+  it('reports an invalid command line as a usage error with the exit code of native Rush', async () => {
+    const folder: string = createTestRepo({ associatedCommands: [] });
+    // Like native Rush, the parser also writes the usage to stdout. The error carries the same text.
+    const written: [stream: 'stdout' | 'stderr', text: string][] = [];
+    const writeSpies: jest.SpyInstance[] = (['stdout', 'stderr'] as const).map((stream) =>
+      jest
+        .spyOn(process[stream], 'write')
+        .mockImplementation((chunk: string | Uint8Array) => written.push([stream, String(chunk)]) > 0)
+    );
+    try {
+      for (const [argv, message] of [
+        [['build', '--nope'], 'rush build: error: Unrecognized arguments: --nope.'],
+        [['rebuild', '--to'], 'rush rebuild: error: argument "-t/--to": Expected one argument. null']
+      ] as const) {
+        written.length = 0;
+        const error: unknown = await parseBuildAsync(folder, [...argv]).catch((e: unknown) => e);
+        expect(error).toBeInstanceOf(PhasedCommandEngineUsageError);
+        const { message: actualMessage, exitCode, usage } = error as PhasedCommandEngineUsageError;
+        expect({ message: actualMessage, exitCode }).toEqual({ message, exitCode: 2 });
+        expect(usage).toMatch(new RegExp(`^usage: rush ${argv[0]} \\[-h\\] `));
+        expect(written).toEqual([['stdout', usage]]);
+      }
+    } finally {
+      for (const writeSpy of writeSpies) {
+        writeSpy.mockRestore();
+      }
+    }
+  });
+
+  it('rejects an unassociated plugin, which Rush initializes for every command', async () => {
+    const folder: string = createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON });
+    await expect(parseBuildAsync(folder)).rejects.toThrow(
+      `Daemon engine execution does not support Rush plugins that participate in "build" unless they are ` +
+        `declared daemon-compatible: "${PLUGIN_NAME}" (${PACKAGE_NAME}) is initialized for every command. ` +
+        `A plugin declares this with "daemonCompatible" in its rush-plugin-manifest.json; a repository can ` +
+        `list plugins it has verified in the rush.json "daemon.compatiblePlugins" setting or ` +
+        `RUSH_DAEMON_COMPATIBLE_PLUGINS. Use --no-daemon.`
+    );
+  });
+
+  it('rejects a plugin associated with the requested command', async () => {
+    const folder: string = createTestRepo({
+      associatedCommands: [PLUGIN_COMMAND, 'build'],
+      commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON
+    });
+    await expect(parseBuildAsync(folder)).rejects.toThrow(
+      `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+    );
+    // The association is specific to the requested command.
+    await expect(parseBuildAsync(folder, ['rebuild'])).resolves.toBeInstanceOf(PhasedCommandEngine);
+  });
+
+  it('rejects a plugin parameter associated with the requested command', async () => {
+    const folder: string = createTestRepo({
+      associatedCommands: [PLUGIN_COMMAND],
+      commandLineJson: {
+        commands: [
+          { commandKind: 'globalPlugin', name: PLUGIN_COMMAND, summary: 'Records an example.' },
+          { commandKind: 'bulk', name: 'build', summary: 'Build', enableParallelism: true }
+        ],
+        parameters: [
+          {
+            parameterKind: 'flag',
+            longName: '--example-flag',
+            description: 'An example flag.',
+            associatedCommands: [PLUGIN_COMMAND, 'build']
+          }
+        ]
+      }
+    });
+    // A plugin-defined build replaces the repository build, so the repository must not also define it.
+    fs.rmSync(path.join(folder, 'common/config/rush/command-line.json'));
+    await expect(parseBuildAsync(folder)).rejects.toThrow(
+      `"${PLUGIN_NAME}" (${PACKAGE_NAME}) associates "--example-flag" with "build"`
+    );
+  });
+
+  it('rejects a plugin parameter associated with a phase of the requested command', async () => {
+    const folder: string = createTestRepo({
+      associatedCommands: [PLUGIN_COMMAND],
+      commandLineJson: PHASE_SHAPING_COMMAND_LINE_JSON
+    });
+    await expect(parseBuildAsync(folder)).rejects.toThrow(
+      `"${PLUGIN_NAME}" (${PACKAGE_NAME}) associates "--example-flag" with the "_phase:build" phase`
+    );
+  });
+
+  it('fails closed when a configured plugin manifest cannot be read', async () => {
+    const folder: string = createTestRepo({ writeManifest: false });
+    await expect(parseBuildAsync(folder)).rejects.toThrow(
+      `"${PLUGIN_NAME}" (${PACKAGE_NAME}): its manifest could not be read`
+    );
+  });
+
+  describe('daemon-compatible declarations', () => {
+    // Associated with build and rebuild, and shapes a build phase and parameter.
+    const BUILD_PLUGIN: IPluginFixture = {
+      associatedCommands: [PLUGIN_COMMAND, 'build', 'rebuild'],
+      commandLineJson: PHASE_SHAPING_COMMAND_LINE_JSON
+    };
+
+    async function expectAcceptedAsync(folder: string): Promise<void> {
+      for (const commandName of ['build', 'rebuild']) {
+        const command: PhasedCommandEngine = await parseBuildAsync(folder, [commandName]);
+        expect(command.commandName).toBe(commandName);
+        expect(command.unmatchedCompatiblePluginNames).toEqual([]);
+      }
+    }
+
+    it('reports every reason for an undeclared plugin', async () => {
+      const folder: string = createTestRepo(BUILD_PLUGIN);
+      const label: string = `"${PLUGIN_NAME}" (${PACKAGE_NAME})`;
+      await expect(parseBuildAsync(folder)).rejects.toThrow(
+        `${label} is associated with "build"; ${label} defines the "_phase:build" phase; ` +
+          `${label} associates "--example-flag" with the "_phase:build" phase. A plugin declares this`
+      );
+    });
+
+    it('accepts a plugin whose manifest declares it daemon-compatible', async () => {
+      await expectAcceptedAsync(createTestRepo({ ...BUILD_PLUGIN, daemonCompatible: true }));
+    });
+
+    it('accepts a plugin that rush.json declares daemon-compatible', async () => {
+      await expectAcceptedAsync(createTestRepo(BUILD_PLUGIN, { compatiblePlugins: [PLUGIN_NAME] }));
+    });
+
+    it('accepts a plugin that RUSH_DAEMON_COMPATIBLE_PLUGINS declares, overriding rush.json', async () => {
+      const folder: string = createTestRepo(BUILD_PLUGIN, { compatiblePlugins: [] });
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = ` ${PLUGIN_NAME} `;
+      await expectAcceptedAsync(folder);
+    });
+
+    it('lets an empty RUSH_DAEMON_COMPATIBLE_PLUGINS withdraw the rush.json declarations', async () => {
+      const folder: string = createTestRepo(BUILD_PLUGIN, { compatiblePlugins: [PLUGIN_NAME] });
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = '';
+      await expect(parseBuildAsync(folder)).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+      );
+    });
+
+    it('accepts a declared plugin that Rush initializes for every command', async () => {
+      await expectAcceptedAsync(
+        createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON, daemonCompatible: true })
+      );
+      await expectAcceptedAsync(
+        createTestRepo(
+          { commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON },
+          { compatiblePlugins: [PLUGIN_NAME] }
+        )
+      );
+    });
+
+    it('still rejects an undeclared plugin next to a declared one, and reports only the undeclared one', async () => {
+      const folder: string = createMultiPluginTestRepo({
+        plugins: [BUILD_PLUGIN, { pluginName: OTHER_PLUGIN_NAME, associatedCommands: ['build'] }],
+        compatiblePlugins: [PLUGIN_NAME]
+      });
+      const error: Error | undefined = await parseBuildAsync(folder).then(
+        () => undefined,
+        (reason: Error) => reason
+      );
+      expect(error?.message).toContain(
+        `unless they are declared daemon-compatible: "${OTHER_PLUGIN_NAME}" (@example/${OTHER_PLUGIN_NAME}) ` +
+          `is associated with "build". A plugin declares this`
+      );
+      expect(error?.message).not.toContain(PLUGIN_NAME);
+    });
+
+    it('fails closed for a declared plugin whose manifest or command-line.json cannot be read', async () => {
+      await expect(
+        parseBuildAsync(createTestRepo({ writeManifest: false }, { compatiblePlugins: [PLUGIN_NAME] }))
+      ).rejects.toThrow(`"${PLUGIN_NAME}" (${PACKAGE_NAME}): its manifest could not be read`);
+      // The native parser also reads the file, and may fail first; either way, parsing fails.
+      await expect(
+        parseBuildAsync(
+          createTestRepo({
+            ...BUILD_PLUGIN,
+            daemonCompatible: true,
+            commandLineJson: { commands: 'invalid' }
+          })
+        )
+      ).rejects.toThrow(/command-line\.json/);
+    });
+
+    it('keeps the parameters that a declared plugin reads in the engine parameter identity', async () => {
+      // The plugin reads --example-mode, which the repository's command-line.json defines.
+      const folder: string = createTestRepo(
+        { ...BUILD_PLUGIN, daemonCompatible: true },
+        {
+          commandLineJson: {
+            ...REPO_COMMAND_LINE_JSON,
+            parameters: [
+              {
+                parameterKind: 'choice',
+                longName: '--example-mode',
+                description: 'An example mode.',
+                associatedCommands: ['build'],
+                alternatives: [
+                  { name: 'on', description: 'On.' },
+                  { name: 'off', description: 'Off.' }
+                ],
+                defaultValue: 'on'
+              }
+            ]
+          }
+        }
+      );
+      const defaultIdentity: string = (await parseBuildAsync(folder)).parameterIdentity;
+      expect((await parseBuildAsync(folder)).parameterIdentity).toBe(defaultIdentity);
+      expect((await parseBuildAsync(folder, ['build', '--example-mode', 'off'])).parameterIdentity).not.toBe(
+        defaultIdentity
+      );
+    });
+
+    it('shares an engine between commands only if the same plugins are associated with both', async () => {
+      const rushSession: RushSession = new RushSession({
+        terminalProvider: new NoOpTerminalProvider(),
+        getIsDebugMode: () => false
+      });
+      const getRebuildBlockerAsync = async (plugin: IPluginFixture): Promise<string | undefined> => {
+        const folder: string = createTestRepo({ ...plugin, daemonCompatible: true });
+        const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
+        return build.getEngineSharingBlocker(await parseBuildAsync(folder, ['rebuild']), rushSession);
+      };
+      expect(await getRebuildBlockerAsync(BUILD_PLUGIN)).toBeUndefined();
+      // Rush initializes a plugin that is associated with no command for every command.
+      expect(
+        await getRebuildBlockerAsync({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON })
+      ).toBeUndefined();
+      expect(await getRebuildBlockerAsync({ ...BUILD_PLUGIN, associatedCommands: ['build'] })).toBe(
+        'different plugins are associated with "rebuild" and "build"'
+      );
+    });
+
+    it('warns about declared names that match no configured plugin', async () => {
+      const folder: string = createTestRepo(
+        { ...BUILD_PLUGIN, daemonCompatible: true },
+        { compatiblePlugins: ['rush-exmaple-plugin', PLUGIN_NAME] }
+      );
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const command: PhasedCommandEngine = await parseBuildAsync(folder, ['build'], terminalProvider);
+      expect(command.unmatchedCompatiblePluginNames).toEqual(['rush-exmaple-plugin']);
+      expect(terminalProvider.getWarningOutput()).toContain(
+        'names plugins that are not configured in rush-plugins.json: "rush-exmaple-plugin".'
+      );
+      // A misspelled name does not declare the plugin that it was meant to name.
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = 'rush-exmaple-plugin';
+      await expect(parseBuildAsync(createTestRepo(BUILD_PLUGIN))).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+      );
+    });
+  });
+
+  describe('command-agnostic declarations', () => {
+    // Initialized for every command, like a plugin that skips unchanged operations in watch mode,
+    // which taps runAnyPhasedCommand.
+    const ANY_COMMAND_PLUGIN: IPluginFixture = {
+      daemonCompatible: true,
+      taps: { runAnyPhasedCommand: true }
+    };
+    const getUndeclaredMessage = (hookName: string, pluginName: string = PLUGIN_NAME): string =>
+      `the plugin "${pluginName}" (@example/${pluginName}) taps the ${hookName} hook and is not ` +
+      'declared command-agnostic';
+    const UNDECLARED: string = getUndeclaredMessage('runAnyPhasedCommand');
+
+    beforeEach(() => {
+      jest.spyOn(Autoinstaller.prototype, 'prepareAsync').mockImplementation(async () => {});
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+
+    /** Whether an engine that `build` created, with the plugins applied, can serve `rebuild`. */
+    async function getRebuildBlockerAsync(
+      folder: string,
+      builtInPluginConfigurations?: IBuiltInPluginConfiguration[]
+    ): Promise<string | undefined> {
+      const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
+      const rushSession: RushSession = await applyPluginsAsync(folder, 'build', builtInPluginConfigurations);
+      // The plugins never prevent the engine from serving its own command.
+      expect(
+        build.getEngineSharingBlocker(await parseBuildAsync(folder, ['build']), rushSession)
+      ).toBeUndefined();
+      return build.getEngineSharingBlocker(await parseBuildAsync(folder, ['rebuild']), rushSession);
+    }
+
+    it('shares no engine between commands while an undeclared plugin taps runAnyPhasedCommand', async () => {
+      expect(await getRebuildBlockerAsync(createTestRepo(ANY_COMMAND_PLUGIN))).toBe(UNDECLARED);
+    });
+
+    it('shares no engine between commands while an undeclared plugin taps initialize', async () => {
+      expect(
+        await getRebuildBlockerAsync(createTestRepo({ daemonCompatible: true, taps: { initialize: true } }))
+      ).toBe(getUndeclaredMessage('initialize'));
+    });
+
+    it('shares an engine between commands if the manifest declares the plugin command-agnostic', async () => {
+      expect(
+        await getRebuildBlockerAsync(createTestRepo({ ...ANY_COMMAND_PLUGIN, daemonCommandAgnostic: true }))
+      ).toBeUndefined();
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo({
+            daemonCompatible: true,
+            daemonCommandAgnostic: true,
+            taps: { initialize: true }
+          })
+        )
+      ).toBeUndefined();
+      // The declaration also covers a plugin that is associated with both commands.
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo({
+            ...ANY_COMMAND_PLUGIN,
+            associatedCommands: ['build', 'rebuild'],
+            daemonCommandAgnostic: true
+          })
+        )
+      ).toBeUndefined();
+    });
+
+    it('shares an engine between commands if rush.json declares the plugin command-agnostic', async () => {
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo(ANY_COMMAND_PLUGIN, { commandAgnosticPlugins: [PLUGIN_NAME] })
+        )
+      ).toBeUndefined();
+    });
+
+    it('lets only its manifest declare a built-in plugin command-agnostic', async () => {
+      // Like daemon.compatiblePlugins, rush.json's list names the plugins that rush-plugins.json configures.
+      const folder: string = createMultiPluginTestRepo({
+        plugins: [],
+        commandAgnosticPlugins: [PLUGIN_NAME]
+      });
+      const listed: IBuiltInPluginConfiguration = writeBuiltInPlugin(
+        path.join(folder, 'listed'),
+        ANY_COMMAND_PLUGIN
+      );
+      expect(await getRebuildBlockerAsync(folder, [listed])).toBe(UNDECLARED);
+      const declared: IBuiltInPluginConfiguration = writeBuiltInPlugin(path.join(folder, 'declared'), {
+        ...ANY_COMMAND_PLUGIN,
+        daemonCommandAgnostic: true
+      });
+      expect(await getRebuildBlockerAsync(folder, [declared])).toBeUndefined();
+    });
+
+    it("shares an engine between commands while Rush's built-in build cache plugins tap initialize", async () => {
+      // A published rush-lib depends on these packages and loads their plugins for every command. The plugin that
+      // shares its package's name taps initialize only to register a build cache provider. Each fixture copies
+      // that plugin's declaration from its manifest in this repository.
+      const rushLibPackageJson: IPackageJson & { publishOnlyDependencies?: Record<string, string> } =
+        Rush._rushLibPackageJson;
+      const repository: RushConfiguration = RushConfiguration.loadFromDefaultLocation({
+        startingFolder: __dirname
+      });
+      const folder: string = createMultiPluginTestRepo({ plugins: [] });
+      const builtInPlugins: IBuiltInPluginConfiguration[] = Object.keys(
+        rushLibPackageJson.publishOnlyDependencies ?? {}
+      ).map((packageName) => {
+        const pluginName: string = packageName.replace('@rushstack/', '');
+        const manifest: IRushPluginManifestJson = JsonFile.load(
+          `${repository.getProjectByName(packageName)!.projectFolder}/rush-plugin-manifest.json`
+        );
+        const { daemonCommandAgnostic } = manifest.plugins.find(
+          (plugin) => plugin.pluginName === pluginName
+        )!;
+        return writeBuiltInPlugin(path.join(folder, pluginName), {
+          pluginName,
+          daemonCommandAgnostic,
+          taps: { initialize: true }
+        });
+      });
+      expect(builtInPlugins).toHaveLength(3);
+      expect(await getRebuildBlockerAsync(folder, builtInPlugins)).toBeUndefined();
+    });
+
+    it('lets RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS override rush.json', async () => {
+      process.env[COMMAND_AGNOSTIC_PLUGINS_VARIABLE] = ` ${PLUGIN_NAME} `;
+      expect(
+        await getRebuildBlockerAsync(createTestRepo(ANY_COMMAND_PLUGIN, { commandAgnosticPlugins: [] }))
+      ).toBeUndefined();
+      // An empty value withdraws the rush.json declarations.
+      process.env[COMMAND_AGNOSTIC_PLUGINS_VARIABLE] = '';
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo(ANY_COMMAND_PLUGIN, { commandAgnosticPlugins: [PLUGIN_NAME] })
+        )
+      ).toBe(UNDECLARED);
+    });
+
+    it('names an undeclared plugin that taps runAnyPhasedCommand next to a declared one', async () => {
+      const folder: string = createMultiPluginTestRepo({
+        plugins: [ANY_COMMAND_PLUGIN, { ...ANY_COMMAND_PLUGIN, pluginName: OTHER_PLUGIN_NAME }],
+        commandAgnosticPlugins: [PLUGIN_NAME]
+      });
+      expect(await getRebuildBlockerAsync(folder)).toBe(
+        getUndeclaredMessage('runAnyPhasedCommand', OTHER_PLUGIN_NAME)
+      );
+    });
+
+    it('shares no engine while a declared plugin taps the runPhasedCommand hook of either command', async () => {
+      for (const commandName of ['build', 'rebuild']) {
+        const folder: string = createTestRepo({
+          ...ANY_COMMAND_PLUGIN,
+          daemonCommandAgnostic: true,
+          taps: { runAnyPhasedCommand: true, runPhasedCommand: [commandName] }
+        });
+        expect(await getRebuildBlockerAsync(folder)).toBe(
+          `a plugin taps the runPhasedCommand hook of "${commandName}"`
+        );
+      }
+    });
+
+    it('shares no engine while a tap that no plugin applied is on runAnyPhasedCommand', async () => {
+      const folder: string = createTestRepo({ ...ANY_COMMAND_PLUGIN, daemonCommandAgnostic: true });
+      const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
+      const rushSession: RushSession = await applyPluginsAsync(folder, 'build');
+      const rebuild: PhasedCommandEngine = await parseBuildAsync(folder, ['rebuild']);
+      expect(build.getEngineSharingBlocker(rebuild, rushSession)).toBeUndefined();
+      rushSession.hooks.runAnyPhasedCommand.tap('late', () => {});
+      expect(build.getEngineSharingBlocker(rebuild, rushSession)).toBe(
+        'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "late")'
+      );
+    });
+
+    it('warns about command-agnostic names that match no configured plugin', async () => {
+      const folder: string = createTestRepo(ANY_COMMAND_PLUGIN, {
+        commandAgnosticPlugins: ['rush-exmaple-plugin']
+      });
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const command: PhasedCommandEngine = await parseBuildAsync(folder, ['build'], terminalProvider);
+      expect(command.unmatchedCompatiblePluginNames).toEqual([]);
+      expect(terminalProvider.getWarningOutput()).toContain(
+        `The daemon's command-agnostic plugin list (rush.json "daemon.commandAgnosticPlugins" or ` +
+          `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS) names plugins that are not configured in rush-plugins.json: ` +
+          `"rush-exmaple-plugin".`
+      );
+      // A misspelled name does not declare the plugin that it was meant to name.
+      expect(await getRebuildBlockerAsync(folder)).toBe(UNDECLARED);
+    });
+  });
+
+  describe('JSON configuration files of parses that share a workspace configuration', () => {
+    const REPO_COMMAND_LINE_PATH: string = 'common/config/rush/command-line.json';
+    const AUTOINSTALLER_PACKAGE_JSON_PATH: string = 'common/autoinstallers/plugins/package.json';
+    const PLUGIN_STORE_FOLDER: string = `common/autoinstallers/plugins/rush-plugins/${PACKAGE_NAME}`;
+    const MANIFEST_PATH: string = `${PLUGIN_STORE_FOLDER}/rush-plugin-manifest.json`;
+    const PLUGIN_COMMAND_LINE_PATH: string = `${PLUGIN_STORE_FOLDER}/${PLUGIN_NAME}/command-line.json`;
+    const EXAMPLE_MODE_PARAMETER: object = {
+      parameterKind: 'choice',
+      longName: '--example-mode',
+      description: 'An example mode.',
+      associatedCommands: ['build'],
+      alternatives: [
+        { name: 'on', description: 'On.' },
+        { name: 'off', description: 'Off.' }
+      ],
+      defaultValue: 'on'
+    };
+    // A global command whose autoinstaller's package.json Rush reads while it parses any command line.
+    const GLOBAL_COMMAND_LINE_JSON: object = {
+      ...REPO_COMMAND_LINE_JSON,
+      commands: [
+        ...(REPO_COMMAND_LINE_JSON as { commands: object[] }).commands,
+        {
+          commandKind: 'global',
+          name: 'example-global',
+          summary: 'An example.',
+          shellCommand: 'node example.js',
+          autoinstallerName: 'plugins'
+        }
+      ]
+    };
+
+    interface IManifestJson {
+      plugins: { associatedCommands: string[] }[];
+    }
+
+    function createSharedConfigurationRepo(): RushConfiguration {
+      const folder: string = createTestRepo(
+        { associatedCommands: [PLUGIN_COMMAND], commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON },
+        { commandLineJson: GLOBAL_COMMAND_LINE_JSON }
+      );
+      return RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+    }
+
+    function editJson<T>(
+      rushConfiguration: RushConfiguration,
+      relativePath: string,
+      edit: (json: T) => void
+    ): void {
+      const filePath: string = path.join(rushConfiguration.rushJsonFolder, relativePath);
+      const json: T = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      edit(json);
+      fs.writeFileSync(filePath, JSON.stringify(json));
+    }
+
+    async function parseAsync(
+      rushConfiguration: RushConfiguration,
+      argv: string[] = ['build']
+    ): Promise<PhasedCommandEngine> {
+      return await PhasedCommandEngine.parseAsync({
+        argv,
+        cwd: rushConfiguration.rushJsonFolder,
+        rushConfiguration,
+        terminalProvider: new NoOpTerminalProvider()
+      });
+    }
+
+    async function getParseErrorAsync(rushConfiguration: RushConfiguration): Promise<Error | undefined> {
+      return await parseAsync(rushConfiguration).then(
+        () => undefined,
+        (error: Error) => error
+      );
+    }
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+
+    it('sees each change to the repository command-line.json', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await expect(parseAsync(rushConfiguration, ['build', '--example-mode', 'off'])).rejects.toThrow(
+        '--example-mode'
+      );
+
+      editJson<{ parameters?: object[] }>(rushConfiguration, REPO_COMMAND_LINE_PATH, (json) => {
+        json.parameters = [EXAMPLE_MODE_PARAMETER];
+      });
+      const offIdentity: string = (await parseAsync(rushConfiguration, ['build', '--example-mode', 'off']))
+        .parameterIdentity;
+      expect((await parseAsync(rushConfiguration)).parameterIdentity).not.toBe(offIdentity);
+    });
+
+    it('reports an invalid repository command-line.json for every parse, as a parse without the cache does', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await parseAsync(rushConfiguration);
+
+      editJson<{ unknownSetting?: boolean }>(rushConfiguration, REPO_COMMAND_LINE_PATH, (json) => {
+        json.unknownSetting = true;
+      });
+      const error: Error | undefined = await getParseErrorAsync(rushConfiguration);
+      expect(error?.message).toMatch(/command-line\.json/);
+      expect((await getParseErrorAsync(rushConfiguration))?.message).toBe(error?.message);
+      await expect(parseBuildAsync(rushConfiguration.rushJsonFolder)).rejects.toThrow(error?.message);
+
+      editJson<{ unknownSetting?: boolean }>(rushConfiguration, REPO_COMMAND_LINE_PATH, (json) => {
+        delete json.unknownSetting;
+      });
+      await expect(parseAsync(rushConfiguration)).resolves.toBeInstanceOf(PhasedCommandEngine);
+    });
+
+    it("sees each change to a plugin's manifest and command-line.json", async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await expect(parseAsync(rushConfiguration)).resolves.toBeInstanceOf(PhasedCommandEngine);
+
+      editJson<IManifestJson>(rushConfiguration, MANIFEST_PATH, (manifest) => {
+        manifest.plugins[0].associatedCommands.push('build');
+      });
+      await expect(parseAsync(rushConfiguration)).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+      );
+
+      editJson<IManifestJson>(rushConfiguration, MANIFEST_PATH, (manifest) => {
+        manifest.plugins[0].associatedCommands.pop();
+      });
+      fs.writeFileSync(
+        path.join(rushConfiguration.rushJsonFolder, PLUGIN_COMMAND_LINE_PATH),
+        JSON.stringify(PHASE_SHAPING_COMMAND_LINE_JSON)
+      );
+      await expect(parseAsync(rushConfiguration)).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) associates "--example-flag" with the "_phase:build" phase`
+      );
+    });
+
+    it("sees each change to the package.json of a global command's autoinstaller", async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await expect(parseAsync(rushConfiguration)).resolves.toBeInstanceOf(PhasedCommandEngine);
+
+      editJson<{ name: string }>(rushConfiguration, AUTOINSTALLER_PACKAGE_JSON_PATH, (packageJson) => {
+        packageJson.name = 'other';
+      });
+      await expect(parseAsync(rushConfiguration)).rejects.toThrow(
+        `specifies an "autoinstallerName" setting, but the package.json file's "name" field is not "plugins"`
+      );
+    });
+
+    it('reads each file for every parse, but parses it only if it changed', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      const filePaths: string[] = [
+        REPO_COMMAND_LINE_PATH,
+        AUTOINSTALLER_PACKAGE_JSON_PATH,
+        MANIFEST_PATH,
+        PLUGIN_COMMAND_LINE_PATH
+      ].map((relativePath) => path.join(rushConfiguration.rushJsonFolder, relativePath));
+      const texts: string[] = filePaths.map((filePath) => fs.readFileSync(filePath, 'utf8'));
+      await parseAsync(rushConfiguration);
+
+      const readFileSpy: jest.SpyInstance = jest.spyOn(FileSystem, 'readFile');
+      const loadSpy: jest.SpyInstance = jest.spyOn(JsonFile, 'load');
+      const parseStringSpy: jest.SpyInstance = jest.spyOn(JsonFile, 'parseString');
+      await parseAsync(rushConfiguration);
+
+      const readFilePaths: Set<string> = new Set(readFileSpy.mock.calls.map(([filePath]) => filePath));
+      expect(filePaths.filter((filePath) => !readFilePaths.has(filePath))).toEqual([]);
+      expect(loadSpy.mock.calls.filter(([filePath]) => filePaths.includes(filePath))).toEqual([]);
+      expect(parseStringSpy.mock.calls.filter(([text]) => texts.includes(text))).toEqual([]);
+    });
+
+    it('does not cache the files for a native command line', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      const cacheLoadSpy: jest.SpyInstance = jest.spyOn(JsonFileLoadCache.prototype, 'load');
+      const loadSpy: jest.SpyInstance = jest.spyOn(JsonFile, 'load');
+      // Engine parses in this process validated the environment, and a native parser must load .env files first.
+      EnvironmentConfiguration.reset();
+
+      const parser: RushCommandLineParser = new RushCommandLineParser({
+        cwd: rushConfiguration.rushJsonFolder
+      });
+      expect(parser.getAction('example-global')).toBeDefined();
+      expect(cacheLoadSpy).not.toHaveBeenCalled();
+      const loadedFilePaths: Set<string> = new Set(loadSpy.mock.calls.map(([filePath]) => filePath));
+      expect(loadedFilePaths).toContain(path.join(rushConfiguration.rushJsonFolder, REPO_COMMAND_LINE_PATH));
+      expect(loadedFilePaths).toContain(
+        path.join(rushConfiguration.rushJsonFolder, AUTOINSTALLER_PACKAGE_JSON_PATH)
+      );
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
index 6aebbe7d354..4865e55610d 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
@@ -26,6 +26,8 @@ describe(`${PhasedCommandEngine.name} parameter identity`, () => {
     return await PhasedCommandEngine.parseAsync({
       argv,
       cwd: folder,
+      // Otherwise environment-backed defaults such as RUSH_PARALLELISM come from the test host.
+      environment: {},
       rushConfiguration,
       terminalProvider: new NoOpTerminalProvider()
     });
@@ -96,15 +98,63 @@ describe(`${PhasedCommandEngine.name} parameter identity`, () => {
   it('reports the excluded settings per request', async () => {
     expect((await parseAsync('build')).requestSettings).toEqual({
       quietMode: true,
-      parallelism: parseParallelism(undefined)
+      parallelism: parseParallelism(undefined),
+      isIncrementalBuildAllowed: true
     });
     expect((await parseAsync('build', '--verbose', '-p', '2')).requestSettings).toEqual({
       quietMode: false,
-      parallelism: 2
+      parallelism: 2,
+      isIncrementalBuildAllowed: true
     });
     expect((await parseAsync('build', '-p', '50%')).requestSettings).toEqual({
       quietMode: true,
-      parallelism: { scalar: 0.5 }
+      parallelism: { scalar: 0.5 },
+      isIncrementalBuildAllowed: true
     });
+    expect((await parseAsync('rebuild', '--only', 'a')).requestSettings).toEqual({
+      quietMode: true,
+      parallelism: parseParallelism(undefined),
+      isIncrementalBuildAllowed: false
+    });
+  });
+
+  it("takes the RUSH_PARALLELISM default from the request's environment, not the host's", async () => {
+    const parseInEnvironmentAsync = async (
+      environment: Record<string, string | undefined>,
+      ...argv: string[]
+    ): Promise<PhasedCommandEngine> =>
+      await PhasedCommandEngine.parseAsync({
+        argv,
+        cwd: folder,
+        environment,
+        rushConfiguration,
+        terminalProvider: new NoOpTerminalProvider()
+      });
+    const hostValue: string | undefined = process.env.RUSH_PARALLELISM;
+    process.env.RUSH_PARALLELISM = '7';
+    try {
+      expect((await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build')).requestSettings).toEqual({
+        quietMode: true,
+        parallelism: 3,
+        isIncrementalBuildAllowed: true
+      });
+      expect(
+        (await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build', '-p', '5')).requestSettings
+          .parallelism
+      ).toBe(5);
+      expect((await parseInEnvironmentAsync({}, 'build')).requestSettings.parallelism).toEqual(
+        parseParallelism(undefined)
+      );
+      const baseline: string = (await parseInEnvironmentAsync({}, 'build')).parameterIdentity;
+      expect((await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build')).parameterIdentity).toBe(
+        baseline
+      );
+    } finally {
+      if (hostValue === undefined) {
+        delete process.env.RUSH_PARALLELISM;
+      } else {
+        process.env.RUSH_PARALLELISM = hostValue;
+      }
+    }
   });
 });
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
new file mode 100644
index 00000000000..5723c5ab8a4
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
@@ -0,0 +1,314 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import { PhasedCommandEngine, type IPhasedCommandEngineSharingLabels } from '../PhasedCommandEngine';
+import { RushConfiguration } from '../RushConfiguration';
+import { Rush } from '../Rush';
+import { RushSession } from '../../pluginFramework/RushSession';
+
+describe(`${PhasedCommandEngine.name} engine sharing`, () => {
+  let folder: string;
+  let rushConfiguration: RushConfiguration;
+
+  function write(name: string, value: unknown): void {
+    const filename: string = path.join(folder, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, JSON.stringify(value));
+  }
+
+  async function parseAsync(
+    argv: string[],
+    configuration: RushConfiguration = rushConfiguration
+  ): Promise<PhasedCommandEngine> {
+    return await PhasedCommandEngine.parseAsync({
+      argv,
+      cwd: folder,
+      environment: {},
+      rushConfiguration: configuration,
+      terminalProvider: new NoOpTerminalProvider()
+    });
+  }
+
+  function createRushSession(): RushSession {
+    return new RushSession({ terminalProvider: new NoOpTerminalProvider(), getIsDebugMode: () => false });
+  }
+
+  /** Why an engine created by `engineArgv` cannot serve `requestArgv`, or undefined if it can. */
+  async function getBlockerAsync(
+    engineArgv: string[],
+    requestArgv: string[],
+    rushSession: RushSession = createRushSession(),
+    configuration: RushConfiguration = rushConfiguration
+  ): Promise<string | undefined> {
+    const engine: PhasedCommandEngine = await parseAsync(engineArgv, configuration);
+    return engine.getEngineSharingBlocker(await parseAsync(requestArgv, configuration), rushSession);
+  }
+
+  beforeAll(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-sharing-')));
+    write('rush.json', {
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: [
+        { packageName: 'a', projectFolder: 'a' },
+        { packageName: 'b', projectFolder: 'b' }
+      ]
+    });
+    for (const name of ['a', 'b']) {
+      write(`${name}/package.json`, {
+        name,
+        version: '1.0.0',
+        dependencies: name === 'b' ? { a: '1.0.0' } : {},
+        scripts: { '_phase:compile': 'node -v', '_phase:test': 'node -v', '_phase:lint': 'node -v' }
+      });
+    }
+    write('common/config/rush/command-line.json', {
+      phases: [
+        { name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } },
+        { name: '_phase:test', dependencies: { self: ['_phase:compile'] } },
+        // Like a lint phase that reads the declarations of its dependencies.
+        { name: '_phase:lint', dependencies: { upstream: ['_phase:compile'] } }
+      ],
+      commands: [
+        { name: 'build', phases: ['_phase:compile'], incremental: true },
+        { name: 'test', phases: ['_phase:compile', '_phase:test'], incremental: true },
+        { name: 'retest', phases: ['_phase:compile', '_phase:test'], incremental: false },
+        { name: 'lint', phases: ['_phase:lint'], incremental: true },
+        // Lists the test phase without the compile phase that it depends on in the same project.
+        { name: 'unit', phases: ['_phase:test'], incremental: true },
+        // Like build, with the settings of command-line.json that are not the defaults.
+        {
+          name: 'quickbuild',
+          phases: ['_phase:compile'],
+          incremental: true,
+          disableBuildCache: true,
+          allowOversubscription: false
+        }
+      ].map((command) => ({
+        ...command,
+        commandKind: 'phased',
+        summary: `The ${command.name} command`,
+        enableParallelism: true
+      })),
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'Changes the commands of the compile phase',
+          associatedCommands: ['build', 'test', 'retest', 'lint', 'quickbuild'],
+          associatedPhases: ['_phase:compile']
+        },
+        {
+          parameterKind: 'string',
+          longName: '--target',
+          argumentName: 'TARGET',
+          description: 'Changes the commands of the compile phase',
+          associatedCommands: ['build', 'test', 'retest', 'lint', 'quickbuild'],
+          associatedPhases: ['_phase:compile']
+        },
+        {
+          parameterKind: 'flag',
+          longName: '--coverage',
+          description: 'Changes the commands of the test phase',
+          associatedCommands: ['test', 'retest'],
+          associatedPhases: ['_phase:test']
+        },
+        {
+          parameterKind: 'string',
+          longName: '--report',
+          argumentName: 'FILE',
+          description: 'Read only by plugins',
+          associatedCommands: ['test']
+        }
+      ]
+    });
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+  });
+
+  afterAll(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('serves other commands on the engine of an incremental command whose graph has their phases', async () => {
+    expect(await getBlockerAsync(['build'], ['rebuild', '--only', 'a'])).toBeUndefined();
+    expect(
+      await getBlockerAsync(['build', '--to', 'a'], ['build', '--ignore-hooks', '--verbose'])
+    ).toBeUndefined();
+    for (const request of [
+      ['build'],
+      ['rebuild'],
+      ['retest', '--only', 'b'],
+      ['test', '--include-phase-deps']
+    ]) {
+      expect(await getBlockerAsync(['test'], request)).toBeUndefined();
+    }
+    expect(await getBlockerAsync(['lint'], ['build'])).toBeUndefined();
+    expect(await getBlockerAsync(['lint'], ['lint', '--only', 'b', '--include-phase-deps'])).toBeUndefined();
+
+    expect(await getBlockerAsync(['build'], ['test'])).toBe(
+      'the graph of "build" does not have every operation of the "_phase:test" phase'
+    );
+    // With --include-phase-deps, the graph has compile operations only for the projects that others depend on.
+    expect(await getBlockerAsync(['lint', '--include-phase-deps'], ['build'])).toBe(
+      'the graph of "lint" does not have every operation of the "_phase:compile" phase'
+    );
+    // Each test operation needs the compile operation of its own project, so that graph has all of them.
+    expect(await getBlockerAsync(['unit', '--include-phase-deps'], ['build'])).toBeUndefined();
+  });
+
+  it('serves only its own command on the engine of a command that is not incremental', async () => {
+    expect(await getBlockerAsync(['rebuild'], ['rebuild', '--only', 'a', '-p', '2'])).toBeUndefined();
+    expect(await getBlockerAsync(['retest', '--to', 'b'], ['retest', '--only', 'a'])).toBeUndefined();
+    expect(await getBlockerAsync(['rebuild'], ['build'])).toBe('"rebuild" is not incremental');
+    expect(await getBlockerAsync(['retest'], ['test'])).toBe('"retest" is not incremental');
+  });
+
+  it('serves no command that is not incremental on an engine that runs persistent IPC runners', async () => {
+    const rushJsonPath: string = path.join(folder, 'rush.json');
+    const rushJson: Record<string, unknown> = JSON.parse(fs.readFileSync(rushJsonPath, 'utf8'));
+    write('rush.json', { ...rushJson, daemon: { usePersistentIpcRunners: true } });
+    try {
+      const withIpc: RushConfiguration = RushConfiguration.loadFromConfigurationFile(rushJsonPath);
+      const getIpcBlockerAsync = (engineArgv: string[], requestArgv: string[]): Promise<string | undefined> =>
+        getBlockerAsync(engineArgv, requestArgv, createRushSession(), withIpc);
+      expect(await getIpcBlockerAsync(['build'], ['rebuild', '--only', 'a'])).toBe(
+        '"rebuild" is not incremental, and "build" runs persistent IPC runners'
+      );
+      expect(await getIpcBlockerAsync(['test'], ['retest'])).toBe(
+        '"retest" is not incremental, and "test" runs persistent IPC runners'
+      );
+      // Incremental commands still share the engine, and a command that is not incremental keeps its own.
+      expect(await getIpcBlockerAsync(['test'], ['build'])).toBeUndefined();
+      expect(await getIpcBlockerAsync(['build'], ['build', '--to', 'b'])).toBeUndefined();
+      expect(await getIpcBlockerAsync(['rebuild'], ['rebuild', '--only', 'a'])).toBeUndefined();
+      expect(await getIpcBlockerAsync(['rebuild'], ['build'])).toBe('"rebuild" is not incremental');
+      const build: PhasedCommandEngine = await parseAsync(['build'], withIpc);
+      expect(
+        build.getEngineSharingBlocker(await parseAsync(['rebuild'], withIpc), createRushSession(), {
+          engine: 'the engine',
+          request: 'the request'
+        })
+      ).toBe('the request is not incremental, and the engine runs persistent IPC runners');
+    } finally {
+      write('rush.json', rushJson);
+    }
+  });
+
+  it('compares the arguments of the phases that the request can run', async () => {
+    const differ: string = 'the parameters of their phases differ';
+    const production: string = '--production for "_phase:compile"';
+    expect(await getBlockerAsync(['test'], ['build', '--production'])).toBe(
+      `${differ} (only "build" sets ${production})`
+    );
+    expect(await getBlockerAsync(['build', '--production'], ['rebuild'])).toBe(
+      `${differ} (only "build" sets ${production})`
+    );
+    expect(await getBlockerAsync(['build', '--production'], ['rebuild', '--production'])).toBeUndefined();
+    // --coverage changes only the test phase, which build cannot run.
+    expect(await getBlockerAsync(['test', '--coverage'], ['build'])).toBeUndefined();
+    expect(await getBlockerAsync(['test', '--coverage'], ['retest'])).toBe(
+      `${differ} (only "test" sets --coverage for "_phase:test")`
+    );
+    expect(await getBlockerAsync(['test', '--coverage'], ['test', '--production'])).toBe(
+      `${differ} (only the engine's "test" sets --coverage for "_phase:test"; ` +
+        `only the requested "test" sets ${production})`
+    );
+    // --changed-projects-only changes how the graph enables operations.
+    expect(await getBlockerAsync(['build', '--changed-projects-only'], ['rebuild'])).toBe(
+      `${differ} (only "build" sets --changed-projects-only)`
+    );
+    expect(await getBlockerAsync(['build'], ['build', '--changed-projects-only'])).toBe(
+      `${differ} (only the requested "build" sets --changed-projects-only)`
+    );
+  });
+
+  it('names the command that sets each parameter that differs, or that both set it', async () => {
+    const differ: string = 'the parameters of their phases differ';
+    expect(await getBlockerAsync(['build', '--target', 'es5'], ['build', '--target', 'es2020'])).toBe(
+      `${differ} (both set --target for "_phase:compile", to different values)`
+    );
+    // An unset flag of the parser (--quiet) is false, and command-line.json sets its settings only if they are not
+    // the defaults. Two commands that can serve each other get the same text in both directions.
+    const expected: string =
+      `${differ} (only "build" sets --quiet; only "quickbuild" sets --production for "_phase:compile", ` +
+      'allowOversubscription to false in command-line.json and disableBuildCache to true in command-line.json)';
+    expect(await getBlockerAsync(['--quiet', 'build'], ['quickbuild', '--production'])).toBe(expected);
+    expect(await getBlockerAsync(['quickbuild', '--production'], ['--quiet', 'build'])).toBe(expected);
+  });
+
+  it('names the commands with the labels that the host passes', async () => {
+    const rushSession: RushSession = createRushSession();
+    const first: PhasedCommandEngine = await parseAsync(['test', '--coverage', '--target', 'es5']);
+    const second: PhasedCommandEngine = await parseAsync(['test', '--production', '--target', 'es2020']);
+    const firstLabel: string = 'the first "test"';
+    const secondLabel: string = 'the second "test"';
+    // The groups are in the order of the labels, whichever command created the engine.
+    const expected: string =
+      `the parameters of their phases differ (only ${firstLabel} sets --coverage for "_phase:test"; ` +
+      `only ${secondLabel} sets --production for "_phase:compile"; ` +
+      'both set --target for "_phase:compile", to different values)';
+    expect(
+      first.getEngineSharingBlocker(second, rushSession, { engine: firstLabel, request: secondLabel })
+    ).toBe(expected);
+    expect(
+      second.getEngineSharingBlocker(first, rushSession, { engine: secondLabel, request: firstLabel })
+    ).toBe(expected);
+    const labels: IPhasedCommandEngineSharingLabels = { engine: 'the engine', request: 'the request' };
+    const build: PhasedCommandEngine = await parseAsync(['build']);
+    const rebuild: PhasedCommandEngine = await parseAsync(['rebuild']);
+    expect(rebuild.getEngineSharingBlocker(build, rushSession, labels)).toBe('the engine is not incremental');
+    expect(build.getEngineSharingBlocker(await parseAsync(['test']), rushSession, labels)).toBe(
+      'the graph of the engine does not have every operation of the "_phase:test" phase'
+    );
+  });
+
+  it('serves the same command only with the same values of the parameters that no phase has', async () => {
+    expect(await getBlockerAsync(['test', '--report', 'x.json'], ['test'])).toBe(
+      `their parameters differ (only the engine's "test" sets --report)`
+    );
+    expect(await getBlockerAsync(['test'], ['test', '--report', 'x.json'])).toBe(
+      `their parameters differ (only the requested "test" sets --report)`
+    );
+    expect(await getBlockerAsync(['test', '--report', 'x.json'], ['test', '--report', 'y.json'])).toBe(
+      'their parameters differ (both set --report, to different values)'
+    );
+    expect(
+      await getBlockerAsync(['test', '--report', 'x.json'], ['test', '--only', 'a', '--report', 'x.json'])
+    ).toBeUndefined();
+    // Only plugins that are associated with test could read it, and build shares the engine only if there are none.
+    expect(await getBlockerAsync(['test', '--report', 'x.json'], ['build'])).toBeUndefined();
+  });
+
+  it('serves no other command while a plugin taps the hooks that Rush calls with the command', async () => {
+    const anyCommand: RushSession = createRushSession();
+    anyCommand.hooks.runAnyPhasedCommand.tap('test', () => {});
+    // Only a plugin's apply() can add a tap that a command-agnostic declaration covers.
+    expect(await getBlockerAsync(['build'], ['rebuild'], anyCommand)).toBe(
+      'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "test")'
+    );
+    const intercepted: RushSession = createRushSession();
+    intercepted.hooks.runAnyPhasedCommand.intercept({ call: () => {} });
+    expect(await getBlockerAsync(['build'], ['rebuild'], intercepted)).toBe(
+      'a plugin intercepts the runAnyPhasedCommand hook'
+    );
+    expect(await getBlockerAsync(['build'], ['build', '--to', 'b'], anyCommand)).toBeUndefined();
+
+    const testCommand: RushSession = createRushSession();
+    testCommand.hooks.runPhasedCommand.for('test').tap('test', () => {});
+    expect(await getBlockerAsync(['test'], ['build'], testCommand)).toBe(
+      'a plugin taps the runPhasedCommand hook of "test"'
+    );
+    expect(await getBlockerAsync(['build'], ['rebuild'], testCommand)).toBeUndefined();
+    // A hook that no plugin taps does not block.
+    const untapped: RushSession = createRushSession();
+    untapped.hooks.runPhasedCommand.for('build');
+    expect(await getBlockerAsync(['build'], ['rebuild'], untapped)).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
new file mode 100644
index 00000000000..13df5c22bd5
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
@@ -0,0 +1,315 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import type { PerformanceEntry } from 'node:perf_hooks';
+
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import {
+  PhasedCommandEngine,
+  logEngineTelemetry,
+  waitForTelemetryFlushAsync,
+  type IPhasedCommandEngineLogTelemetryOptions,
+  type IPhasedCommandEngineTelemetryOptions,
+  type IPhasedCommandEngineTelemetryRecord
+} from '../PhasedCommandEngine';
+import { RushConfiguration } from '../RushConfiguration';
+import { Rush } from '../Rush';
+import type { IPhase } from '../CommandLineConfiguration';
+import type { ITelemetryData } from '../../logic/Telemetry';
+import { Operation } from '../../logic/operations/Operation';
+import { OperationStatus } from '../../logic/operations/OperationStatus';
+import { MockOperationRunner } from '../../logic/operations/test/MockOperationRunner';
+import { OperationGraphHooks } from '../../pluginFramework/OperationGraphHooks';
+
+describe(`${PhasedCommandEngine.name} telemetry`, () => {
+  let folder: string;
+  let rushConfiguration: RushConfiguration;
+  let operationA: Operation;
+  let operationB: Operation;
+
+  function write(name: string, value: unknown): void {
+    const filename: string = path.join(folder, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, JSON.stringify(value));
+  }
+
+  async function parseAsync(...argv: string[]): Promise<PhasedCommandEngine> {
+    return await PhasedCommandEngine.parseAsync({
+      argv,
+      cwd: folder,
+      rushConfiguration,
+      terminalProvider: new NoOpTerminalProvider()
+    });
+  }
+
+  function createRecord(
+    status: OperationStatus,
+    startTime: number | undefined,
+    endTime: number | undefined
+  ): IPhasedCommandEngineTelemetryRecord {
+    return { status, silent: false, stopwatch: { startTime, endTime }, nonCachedDurationMs: undefined };
+  }
+
+  function createOptions(
+    overrides: Partial<IPhasedCommandEngineTelemetryOptions> = {}
+  ): IPhasedCommandEngineTelemetryOptions {
+    return {
+      records: new Map([
+        [operationB, createRecord(OperationStatus.Skipped, 1500, 1500)],
+        [operationA, createRecord(OperationStatus.Success, 1600, 1900)]
+      ]),
+      succeeded: true,
+      durationInSeconds: 0.4,
+      timeOriginMs: 1000,
+      ...overrides
+    };
+  }
+
+  beforeAll(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-telemetry-')));
+    write('rush.json', {
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: [
+        { packageName: 'a', projectFolder: 'a' },
+        { packageName: 'b', projectFolder: 'b' }
+      ]
+    });
+    write('a/package.json', {
+      name: 'a',
+      version: '1.0.0',
+      dependencies: { b: 'workspace:*' },
+      scripts: { '_phase:compile': 'node -v' }
+    });
+    write('b/package.json', { name: 'b', version: '1.0.0', scripts: { '_phase:compile': 'node -v' } });
+    write('common/config/rush/command-line.json', {
+      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          summary: 'Build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        }
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'A graph-affecting custom parameter',
+          associatedCommands: ['build'],
+          associatedPhases: ['_phase:compile']
+        }
+      ]
+    });
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+    const phase: IPhase = { name: '_phase:compile' } as IPhase;
+    operationB = new Operation({
+      phase,
+      project: rushConfiguration.getProjectByName('b')!,
+      runner: new MockOperationRunner('b (compile)'),
+      logFilenameIdentifier: 'b_compile'
+    });
+    operationA = new Operation({
+      phase,
+      project: rushConfiguration.getProjectByName('a')!,
+      runner: new MockOperationRunner('a (compile)'),
+      logFilenameIdentifier: 'a_compile'
+    });
+    operationA.addDependency(operationB);
+  });
+
+  afterAll(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it("reports the request's own parameters as one initial, non-watch execution", async () => {
+    const first: PhasedCommandEngine = await parseAsync('build', '--to', 'a', '--production');
+    const second: PhasedCommandEngine = await parseAsync('build', '--only', 'b');
+    const firstData: ITelemetryData = first.createTelemetryData(createOptions());
+    const secondData: ITelemetryData = second.createTelemetryData(createOptions());
+
+    expect(firstData).toMatchObject({
+      name: 'build',
+      result: 'Succeeded',
+      durationInSeconds: 0.4,
+      extraData: {
+        isWatch: false,
+        isInitial: true,
+        command_to: 'true',
+        command_only: 'false',
+        '--to': 'a',
+        '--production': 'true',
+        '--changed-projects-only': false,
+        countAll: 2,
+        countSuccess: 1,
+        countSkipped: 1
+      }
+    });
+    expect(secondData.extraData).toMatchObject({
+      command_to: 'false',
+      command_only: 'true',
+      '--only': 'b',
+      '--production': 'false'
+    });
+  });
+
+  it('reports operation and performance entry times relative to the time origin', async () => {
+    const engine: PhasedCommandEngine = await parseAsync('build');
+    const data: ITelemetryData = engine.createTelemetryData(
+      createOptions({
+        records: new Map([
+          [operationB, createRecord(OperationStatus.Aborted, 1500, undefined)],
+          [operationA, createRecord(OperationStatus.Failure, 1600, 1900)]
+        ]),
+        succeeded: false,
+        performanceEntries: [
+          createMeasure('rush:daemon:queueWait', 1010, 5),
+          createMeasure('rush:executionManager:executeOperations', 1600, 300)
+        ]
+      })
+    );
+
+    expect(data.result).toBe('Failed');
+    expect(data.operationResults).toEqual({
+      'b (compile)': {
+        startTimestampMs: 500,
+        endTimestampMs: undefined,
+        nonCachedDurationMs: undefined,
+        wasExecutedOnThisMachine: true,
+        result: OperationStatus.Aborted,
+        dependencies: []
+      },
+      'a (compile)': {
+        startTimestampMs: 600,
+        endTimestampMs: 900,
+        nonCachedDurationMs: undefined,
+        wasExecutedOnThisMachine: true,
+        result: OperationStatus.Failure,
+        dependencies: ['b (compile)']
+      }
+    });
+    expect(JSON.parse(JSON.stringify(data.performanceEntries))).toEqual([
+      { name: 'rush:daemon:queueWait', entryType: 'measure', startTime: 10, duration: 5, detail: null },
+      {
+        name: 'rush:executionManager:executeOperations',
+        entryType: 'measure',
+        startTime: 600,
+        duration: 300,
+        detail: null
+      }
+    ]);
+  });
+
+  it('adds host fields after the native fields and never falls back to process-wide entries', async () => {
+    const engine: PhasedCommandEngine = await parseAsync('build');
+    const data: ITelemetryData = engine.createTelemetryData(
+      createOptions({ extraData: { daemon: true, requestIndex: 3, countAll: 99 } })
+    );
+
+    expect(data.extraData).toMatchObject({ daemon: true, requestIndex: 3, countAll: 99, countSuccess: 1 });
+    expect(data.performanceEntries).toEqual([]);
+  });
+});
+
+describe(logEngineTelemetry.name, () => {
+  // One tap is like a plugin that flags that it is active; the other reports what it did since the last iteration.
+  function logEntry(options: IPhasedCommandEngineLogTelemetryOptions | undefined): string[] {
+    const hooks: OperationGraphHooks = new OperationGraphHooks();
+    const events: string[] = [];
+    hooks.beforeLogRequest.tap('plugin flag', (data: ITelemetryData) => {
+      events.push('beforeLogRequest');
+      data.extraData!.pluginActive = true;
+    });
+    hooks.beforeLog.tap('iteration report', (data: ITelemetryData) => {
+      events.push(`beforeLog, pluginActive ${data.extraData!.pluginActive}`);
+      data.extraData!.iterationAuthSeconds = 2;
+    });
+    const data: ITelemetryData = { name: 'build', durationInSeconds: 1, result: 'Succeeded', extraData: {} };
+    logEngineTelemetry(
+      hooks,
+      {
+        log: (entry: ITelemetryData) => events.push(`log ${JSON.stringify(entry.extraData)}`),
+        flush: () => events.push('flush')
+      },
+      data,
+      options
+    );
+    return events;
+  }
+
+  it('runs only beforeLogRequest taps for a request that no iteration served', () => {
+    expect(logEntry({ servedByIteration: false })).toEqual([
+      'beforeLogRequest',
+      'log {"pluginActive":true}',
+      'flush'
+    ]);
+  });
+
+  it('runs beforeLogRequest taps, then beforeLog taps, for a request that an iteration served', () => {
+    for (const options of [{ servedByIteration: true }, {}, undefined]) {
+      expect(logEntry(options)).toEqual([
+        'beforeLogRequest',
+        'beforeLog, pluginActive true',
+        'log {"pluginActive":true,"iterationAuthSeconds":2}',
+        'flush'
+      ]);
+    }
+  });
+});
+
+describe(waitForTelemetryFlushAsync.name, () => {
+  it('waits for taps that settle before the timeout', async () => {
+    let settled: boolean = false;
+    const flushPromise: Promise<void> = new Promise((resolve) => {
+      setTimeout(() => {
+        settled = true;
+        resolve();
+      }, 20);
+    });
+
+    await expect(waitForTelemetryFlushAsync(flushPromise, 60_000)).resolves.toBe(true);
+    expect(settled).toBe(true);
+  });
+
+  it('treats a failed tap as settled', async () => {
+    await expect(waitForTelemetryFlushAsync(Promise.reject(new Error('upload failed')), 60_000)).resolves.toBe(
+      true
+    );
+  });
+
+  it('clears its timer when the taps settle first, so that the timer does not keep the process alive', async () => {
+    jest.useFakeTimers();
+    try {
+      await expect(waitForTelemetryFlushAsync(Promise.resolve(), 60_000)).resolves.toBe(true);
+      expect(jest.getTimerCount()).toBe(0);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('stops waiting for taps that never settle, such as an upload over a stalled network', async () => {
+    const startMs: number = Date.now();
+
+    await expect(waitForTelemetryFlushAsync(new Promise(() => undefined), 50)).resolves.toBe(false);
+    expect(Date.now() - startMs).toBeGreaterThanOrEqual(45);
+  });
+});
+
+function createMeasure(name: string, startTime: number, duration: number): PerformanceEntry {
+  return {
+    name,
+    entryType: 'measure',
+    startTime,
+    duration,
+    detail: null,
+    toJSON: () => ({ name, entryType: 'measure', startTime, duration, detail: null })
+  } as PerformanceEntry;
+}
diff --git a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
index 76ecd423cc3..69a08b77bba 100644
--- a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
@@ -1,12 +1,18 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { AlreadyReportedError, FileSystem, Path } from '@rushstack/node-core-library';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import type { CommandLineParameter } from '@rushstack/ts-command-line';
 
 import type { IPhase } from '../CommandLineConfiguration';
 import type { RushConfigurationProject } from '../RushConfigurationProject';
 import { RushProjectConfiguration } from '../RushProjectConfiguration';
+import { PhasedCommandEngineProjectConfigurationError } from '../PhasedCommandEngineProjectConfigurationError';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function stripSymbolsFromObject(obj: any | undefined): void {
@@ -96,6 +102,479 @@ function validateConfigurationWithParameters(
 }
 
 describe(RushProjectConfiguration.name, () => {
+  describe(RushProjectConfiguration._tryLoadForProjectsUncachedAsync.name, () => {
+    let folder: string;
+    const write = (relativePath: string, json: object): void => {
+      const filename: string = path.join(folder, relativePath);
+      fs.mkdirSync(path.dirname(filename), { recursive: true });
+      fs.writeFileSync(filename, JSON.stringify(json));
+    };
+    const project = (name: string): RushConfigurationProject =>
+      ({
+        packageName: name,
+        projectFolder: path.join(folder, name),
+        projectRelativeFolder: name
+      }) as RushConfigurationProject;
+    const loadAsync = (
+      ...projects: RushConfigurationProject[]
+    ): Promise<ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>> =>
+      RushProjectConfiguration._tryLoadForProjectsUncachedAsync(
+        projects,
+        new Terminal(new StringBufferTerminalProvider())
+      );
+    const getOutputFolderNames = (
+      configuration: RushProjectConfiguration | undefined
+    ): string[] | undefined => {
+      const outputFolderNames: ReadonlyArray<string> | undefined =
+        configuration?.operationSettingsByOperationName.get('_phase:build')?.outputFolderNames;
+      return outputFolderNames && [...outputFolderNames];
+    };
+
+    beforeEach(() => {
+      folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-project-rigs-'));
+      for (const name of ['rigged', 'missing-profile', 'own-file']) {
+        write(`${name}/package.json`, { name, version: '1.0.0' });
+      }
+      write('rigged/node_modules/example-rig/package.json', { name: 'example-rig', version: '1.0.0' });
+      write('rigged/node_modules/example-rig/profiles/default/config/rush-project.json', {
+        operationSettings: [{ operationName: '_phase:build', outputFolderNames: ['from-rig'] }]
+      });
+      write('rigged/config/rig.json', { rigPackageName: 'example-rig' });
+      for (const name of ['missing-profile', 'own-file']) {
+        write(`${name}/node_modules/example-rig/package.json`, { name: 'example-rig', version: '1.0.0' });
+        write(`${name}/config/rig.json`, { rigPackageName: 'example-rig', rigProfile: 'missing' });
+      }
+      write('own-file/config/rush-project.json', {
+        operationSettings: [{ operationName: '_phase:build', outputFolderNames: ['from-project'] }]
+      });
+    });
+
+    afterEach(() => {
+      fs.rmSync(folder, { recursive: true, force: true });
+    });
+
+    it('loads configuration from a rig profile', async () => {
+      const rigged: RushConfigurationProject = project('rigged');
+      const configurations = await loadAsync(rigged);
+      expect(getOutputFolderNames(configurations.get(rigged))).toEqual(['from-rig']);
+    });
+
+    it('reports a missing rig profile only when the rig provides the configuration', async () => {
+      await expect(loadAsync(project('missing-profile'))).rejects.toThrow(
+        'The rig profile "missing" is not defined by the rig package "example-rig"'
+      );
+      const ownFile: RushConfigurationProject = project('own-file');
+      const configurations = await loadAsync(ownFile);
+      expect(getOutputFolderNames(configurations.get(ownFile))).toEqual(['from-project']);
+    });
+
+    it('names the project whose rig package is not installed, with the native error as the cause', async () => {
+      write('uninstalled/package.json', { name: 'uninstalled', version: '1.0.0' });
+      write('uninstalled/config/rig.json', { rigPackageName: 'uninstalled-rig' });
+      const uninstalled: RushConfigurationProject = project('uninstalled');
+      const nativeError: Error = await RushProjectConfiguration.tryLoadForProjectAsync(
+        uninstalled,
+        new Terminal(new StringBufferTerminalProvider())
+      ).then(
+        () => {
+          throw new Error('The native load succeeded.');
+        },
+        (error: Error) => error
+      );
+      expect(nativeError).toMatchObject({ code: 'MODULE_NOT_FOUND' });
+
+      const error: unknown = await loadAsync(project('rigged'), uninstalled).catch((e: unknown) => e);
+      expect(error).toBeInstanceOf(PhasedCommandEngineProjectConfigurationError);
+      expect(error).toMatchObject({
+        projectName: 'uninstalled',
+        message: `Rush could not load the configuration of project "uninstalled": ${nativeError.message}`,
+        cause: { code: 'MODULE_NOT_FOUND', message: nativeError.message }
+      });
+    });
+
+    it('does not repeat the message of an error that has already been reported', () => {
+      expect(
+        new PhasedCommandEngineProjectConfigurationError('reported', new AlreadyReportedError())
+      ).toMatchObject({
+        projectName: 'reported',
+        message: 'Rush could not load the configuration of project "reported".'
+      });
+    });
+
+    it('loads a rig profile shared through per-project node_modules symlinks once, with native results', async () => {
+      write('store/example-rig/package.json', { name: 'example-rig', version: '1.0.0' });
+      write('store/example-rig/profiles/default/config/rush-project.json', {
+        extends: '../../../shared/rush-project.json',
+        operationSettings: [{ operationName: '_phase:build', outputFolderNames: ['from-rig'] }]
+      });
+      write('store/example-rig/shared/rush-project.json', {
+        operationSettings: [{ operationName: '_phase:test', outputFolderNames: ['from-shared'] }]
+      });
+      const names: string[] = ['linked-1', 'linked-2', 'linked-3', 'linked-own'];
+      for (const name of names) {
+        write(`${name}/package.json`, { name, version: '1.0.0' });
+        write(`${name}/config/rig.json`, { rigPackageName: 'example-rig' });
+        fs.mkdirSync(path.join(folder, name, 'node_modules'));
+        fs.symlinkSync(
+          path.join(folder, 'store/example-rig'),
+          path.join(folder, name, 'node_modules/example-rig'),
+          'junction'
+        );
+      }
+      write('linked-own/config/rush-project.json', {
+        operationSettings: [{ operationName: '_phase:build', outputFolderNames: ['from-project'] }]
+      });
+      const projects: RushConfigurationProject[] = names.map(project);
+
+      // Files that changed moments ago aren't recorded for reuse, which would read them once more.
+      const dateNow: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(Date.now());
+      const readFileAsync: jest.SpyInstance = jest.spyOn(FileSystem, 'readFileAsync');
+      let configurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>;
+      let readPaths: string[];
+      try {
+        configurations = await loadAsync(...projects);
+        readPaths = readFileAsync.mock.calls.map(([filePath]) => Path.convertToSlashes(filePath));
+      } finally {
+        readFileAsync.mockRestore();
+        dateNow.mockRestore();
+      }
+      expect(readPaths.filter((p) => p.endsWith('/profiles/default/config/rush-project.json'))).toHaveLength(1);
+      expect(readPaths.filter((p) => p.endsWith('/shared/rush-project.json'))).toHaveLength(1);
+
+      for (const linked of projects.slice(0, 3)) {
+        expect(getOutputFolderNames(configurations.get(linked))).toEqual(['from-rig']);
+        expect([
+          ...configurations.get(linked)!.operationSettingsByOperationName.get('_phase:test')!.outputFolderNames!
+        ]).toEqual(['from-shared']);
+      }
+      expect(getOutputFolderNames(configurations.get(projects[3]))).toEqual(['from-project']);
+
+      const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+      for (const linked of projects) {
+        const native: RushProjectConfiguration | undefined = await RushProjectConfiguration.tryLoadForProjectAsync(
+          linked,
+          terminal
+        );
+        expect(configurations.get(linked)!._getJsonForFingerprint()).toBe(native!._getJsonForFingerprint());
+      }
+    });
+
+    describe('reuse of unchanged configurations', () => {
+      const realDateNow: () => number = Date.now;
+      let dateNow: jest.SpyInstance;
+      let readFileAsync: jest.SpyInstance;
+
+      /** Makes every file look as if it had been unchanged for several seconds. */
+      const settleFiles = (): void => {
+        dateNow.mockImplementation(() => realDateNow() + 10_000);
+      };
+      /** Makes the files that exist look as if they had just changed, however long the test takes. */
+      const stopClock = (): void => {
+        dateNow.mockReturnValue(realDateNow());
+      };
+      const takeReadCount = (): number => {
+        const count: number = readFileAsync.mock.calls.length;
+        readFileAsync.mockClear();
+        return count;
+      };
+      /** Waits until a write gets a later ctime than the file has, which a coarse clock can delay. */
+      const waitForLaterCtime = (relativePath: string): void => {
+        const { ctimeNs } = fs.statSync(path.join(folder, relativePath), { bigint: true });
+        const probePath: string = path.join(folder, 'probe');
+        do {
+          fs.writeFileSync(probePath, '');
+        } while (fs.statSync(probePath, { bigint: true }).ctimeNs <= ctimeNs);
+      };
+      const link = (linkPath: string, targetPath: string): void => {
+        const fullLinkPath: string = path.join(folder, linkPath);
+        fs.mkdirSync(path.dirname(fullLinkPath), { recursive: true });
+        // Node 24.11.1 can reject fs.rmSync() for directory symlinks.
+        FileSystem.deleteFile(fullLinkPath);
+        fs.symlinkSync(path.join(folder, targetPath), fullLinkPath, 'junction');
+      };
+      const operationSettings = (operationName: string, outputFolderName: string): object => ({
+        operationSettings: [{ operationName, outputFolderNames: [outputFolderName] }]
+      });
+      const getOutputFolders = (
+        configuration: RushProjectConfiguration | undefined
+      ): Record<string, string[]> =>
+        Object.fromEntries(
+          Array.from(configuration?.operationSettingsByOperationName ?? [], ([name, settings]) => [
+            name,
+            [...(settings.outputFolderNames ?? [])]
+          ])
+        );
+      /** Checks the configuration that is loaded for the project, and for a project that has never been loaded. */
+      const expectOutputFoldersAsync = async (
+        rushProject: RushConfigurationProject,
+        expected: Record<string, string[]>
+      ): Promise<void> => {
+        const unloaded: RushConfigurationProject = project(rushProject.packageName);
+        expect(getOutputFolders((await loadAsync(rushProject)).get(rushProject))).toEqual(expected);
+        expect(getOutputFolders((await loadAsync(unloaded)).get(unloaded))).toEqual(expected);
+      };
+
+      beforeEach(() => {
+        dateNow = jest.spyOn(Date, 'now');
+        readFileAsync = jest.spyOn(FileSystem, 'readFileAsync');
+      });
+
+      afterEach(() => {
+        jest.restoreAllMocks();
+      });
+
+      it('reuses unchanged configurations without reading any file', async () => {
+        settleFiles();
+        write('plain/package.json', { name: 'plain', version: '1.0.0' });
+        const projects: RushConfigurationProject[] = ['rigged', 'own-file', 'plain'].map(project);
+        const first: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> = await loadAsync(
+          ...projects
+        );
+        expect(takeReadCount()).toBeGreaterThan(0);
+        const second: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> = await loadAsync(
+          ...projects
+        );
+        expect(takeReadCount()).toBe(0);
+        expect([...second.keys()]).toEqual(projects.slice(0, 2));
+        for (const rushProject of projects.slice(0, 2)) {
+          expect(second.get(rushProject)!._getJsonForFingerprint()).toBe(
+            first.get(rushProject)!._getJsonForFingerprint()
+          );
+          expect(getOutputFolders(second.get(rushProject))).toEqual(getOutputFolders(first.get(rushProject)));
+        }
+      });
+
+      it('loads a configuration again after any file that it was loaded from changes', async () => {
+        settleFiles();
+        const rigged: RushConfigurationProject = project('rigged');
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-rig'] });
+        write(
+          'rigged/node_modules/example-rig/profiles/default/config/rush-project.json',
+          operationSettings('_phase:build', 'from-rig-2')
+        );
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-rig-2'] });
+
+        // The project's own file takes precedence over the rig's while it exists.
+        write('rigged/config/rush-project.json', operationSettings('_phase:build', 'from-project'));
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-project'] });
+        // An edit that keeps the file's identity, size and modification time
+        const ownFilePath: string = path.join(folder, 'rigged/config/rush-project.json');
+        fs.utimesSync(ownFilePath, 1_000_000, 1_000_000);
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-project'] });
+        waitForLaterCtime('rigged/config/rush-project.json');
+        write('rigged/config/rush-project.json', operationSettings('_phase:build', 'from-PROJECT'));
+        fs.utimesSync(ownFilePath, 1_000_000, 1_000_000);
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-PROJECT'] });
+        fs.rmSync(ownFilePath);
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-rig-2'] });
+
+        write(
+          'rigged/node_modules/example-rig/profiles/other/config/rush-project.json',
+          operationSettings('_phase:build', 'from-other')
+        );
+        write('rigged/config/rig.json', { rigPackageName: 'example-rig', rigProfile: 'other' });
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-other'] });
+
+        write('rigged/config/base.json', operationSettings('_phase:test', 'from-base'));
+        write('rigged/config/rush-project.json', {
+          extends: './base.json',
+          ...operationSettings('_phase:build', 'from-project')
+        });
+        await expectOutputFoldersAsync(rigged, {
+          '_phase:build': ['from-project'],
+          '_phase:test': ['from-base']
+        });
+        write('rigged/config/base.json', operationSettings('_phase:test', 'from-base-2'));
+        await expectOutputFoldersAsync(rigged, {
+          '_phase:build': ['from-project'],
+          '_phase:test': ['from-base-2']
+        });
+      });
+
+      it('loads a configuration again after its rig or an extended package resolves to another folder', async () => {
+        settleFiles();
+        for (const version of ['1', '2']) {
+          write(`store/shared-config@${version}/package.json`, { name: 'shared-config', version });
+          write(
+            `store/shared-config@${version}/rush-project.json`,
+            operationSettings('_phase:test', `from-shared-${version}`)
+          );
+          write(`store/example-rig@${version}/package.json`, { name: 'example-rig', version });
+          write(`store/example-rig@${version}/profiles/default/config/rush-project.json`, {
+            extends: 'shared-config/rush-project.json',
+            ...operationSettings('_phase:build', `from-rig-${version}`)
+          });
+          link(`store/example-rig@${version}/node_modules/shared-config`, 'store/shared-config@1');
+        }
+        write('linked/package.json', { name: 'linked', version: '1.0.0' });
+        write('linked/config/rig.json', { rigPackageName: 'example-rig' });
+        link('linked/node_modules/example-rig', 'store/example-rig@1');
+        const linked: RushConfigurationProject = project('linked');
+        await expectOutputFoldersAsync(linked, {
+          '_phase:build': ['from-rig-1'],
+          '_phase:test': ['from-shared-1']
+        });
+        link('linked/node_modules/example-rig', 'store/example-rig@2');
+        await expectOutputFoldersAsync(linked, {
+          '_phase:build': ['from-rig-2'],
+          '_phase:test': ['from-shared-1']
+        });
+        link('store/example-rig@2/node_modules/shared-config', 'store/shared-config@2');
+        await expectOutputFoldersAsync(linked, {
+          '_phase:build': ['from-rig-2'],
+          '_phase:test': ['from-shared-2']
+        });
+      });
+
+      it('loads a configuration again after the rig package leaves the project node_modules folder', async () => {
+        settleFiles();
+        write('nested/package.json', { name: 'nested', version: '1.0.0' });
+        write('nested/config/rig.json', { rigPackageName: 'example-rig' });
+        for (const [rigFolderPath, outputFolderName] of [
+          ['nested/node_modules/example-rig', 'from-nested'],
+          ['node_modules/example-rig', 'from-hoisted']
+        ]) {
+          write(`${rigFolderPath}/package.json`, { name: 'example-rig', version: '1.0.0' });
+          write(
+            `${rigFolderPath}/profiles/default/config/rush-project.json`,
+            operationSettings('_phase:build', outputFolderName)
+          );
+        }
+        const nested: RushConfigurationProject = project('nested');
+        await expectOutputFoldersAsync(nested, { '_phase:build': ['from-nested'] });
+        // Without its package.json, the folder no longer provides the rig package, even though the profile
+        // folder is still there.
+        fs.rmSync(path.join(folder, 'nested/node_modules/example-rig/package.json'));
+        await expectOutputFoldersAsync(nested, { '_phase:build': ['from-hoisted'] });
+      });
+
+      it('reads a configuration again while any of its files may still be changing', async () => {
+        const rigged: RushConfigurationProject = project('rigged');
+        const loadTwiceAsync = async (): Promise<number> => {
+          await loadAsync(rigged);
+          takeReadCount();
+          await loadAsync(rigged);
+          return takeReadCount();
+        };
+        stopClock();
+        expect(await loadTwiceAsync()).toBeGreaterThan(0);
+
+        settleFiles();
+        const rigFilePath: string = path.join(
+          folder,
+          'rigged/node_modules/example-rig/profiles/default/config/rush-project.json'
+        );
+        const future: number = realDateNow() / 1000 + 60;
+        fs.utimesSync(rigFilePath, future, future);
+        expect(await loadTwiceAsync()).toBeGreaterThan(0);
+        fs.utimesSync(rigFilePath, 1_000_000, 1_000_000);
+        expect(await loadTwiceAsync()).toBe(0);
+
+        // The same holds when rig.json is the only file that may still be changing.
+        const rigJsonPath: string = path.join(folder, 'rigged/config/rig.json');
+        fs.utimesSync(rigJsonPath, future, future);
+        expect(await loadTwiceAsync()).toBeGreaterThan(0);
+        fs.utimesSync(rigJsonPath, 1_000_000, 1_000_000);
+        expect(await loadTwiceAsync()).toBe(0);
+      });
+
+      it('reports errors and warnings on every call', async () => {
+        settleFiles();
+        write('deprecated/package.json', { name: 'deprecated', version: '1.0.0' });
+        write('deprecated/config/rush-project.json', {
+          operationSettings: [
+            { operationName: '_phase:build', sharding: { count: 2, shardOperationSettings: {} } }
+          ]
+        });
+        write('duplicate/package.json', { name: 'duplicate', version: '1.0.0' });
+        write('duplicate/config/rush-project.json', {
+          operationSettings: [{ operationName: '_phase:build' }, { operationName: '_phase:build' }]
+        });
+        const [deprecated, duplicate, missingProfile] = ['deprecated', 'duplicate', 'missing-profile'].map(
+          project
+        );
+        const deprecatedReadCounts: number[] = [];
+        for (let i: number = 0; i < 2; i++) {
+          const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+          const terminal: Terminal = new Terminal(terminalProvider);
+          takeReadCount();
+          await RushProjectConfiguration._tryLoadForProjectsUncachedAsync([deprecated], terminal);
+          deprecatedReadCounts.push(takeReadCount());
+          expect(terminalProvider.getWarningOutput()).toContain(
+            'DEPRECATED: The "sharding.shardOperationSettings" field is deprecated.'
+          );
+          await expect(
+            RushProjectConfiguration._tryLoadForProjectsUncachedAsync([duplicate], terminal)
+          ).rejects.toThrow();
+          expect(terminalProvider.getErrorOutput()).toContain(
+            'The operation "_phase:build" appears multiple times'
+          );
+          await expect(
+            RushProjectConfiguration._tryLoadForProjectsUncachedAsync([missingProfile], terminal)
+          ).rejects.toThrow('The rig profile "missing" is not defined by the rig package "example-rig"');
+        }
+        // The second warning comes from a reused configuration.
+        expect(deprecatedReadCounts[0]).toBeGreaterThan(0);
+        expect(deprecatedReadCounts[1]).toBe(0);
+        write(
+          'missing-profile/node_modules/example-rig/profiles/missing/config/rush-project.json',
+          operationSettings('_phase:build', 'from-missing')
+        );
+        await expectOutputFoldersAsync(missingProfile, { '_phase:build': ['from-missing'] });
+      });
+
+      it('loads a configuration afresh after a load that failed is fixed', async () => {
+        settleFiles();
+        const rigged: RushConfigurationProject = project('rigged');
+        const loadWithReadCountAsync = async (): Promise<[Record<string, string[]>, number]> => {
+          takeReadCount();
+          const configurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+            await loadAsync(rigged);
+          return [getOutputFolders(configurations.get(rigged)), takeReadCount()];
+        };
+        const expectProjectErrorAsync = async (cause: object): Promise<void> => {
+          const error: unknown = await loadAsync(rigged).catch((e: unknown) => e);
+          expect(error).toBeInstanceOf(PhasedCommandEngineProjectConfigurationError);
+          expect(error).toMatchObject({ projectName: 'rigged', cause });
+        };
+        const ownFilePath: string = 'rigged/config/rush-project.json';
+        write(ownFilePath, operationSettings('_phase:build', 'from-project'));
+        const recordedContent: string = fs.readFileSync(path.join(folder, ownFilePath)).toString();
+        expect((await loadWithReadCountAsync())[0]).toEqual({ '_phase:build': ['from-project'] });
+        expect(await loadWithReadCountAsync()).toEqual([{ '_phase:build': ['from-project'] }, 0]);
+
+        waitForLaterCtime(ownFilePath);
+        fs.writeFileSync(path.join(folder, ownFilePath), recordedContent.slice(0, -1));
+        await expectProjectErrorAsync({});
+        await expectProjectErrorAsync({});
+        // Even with the content that it had when its configuration was recorded, the file is read again.
+        waitForLaterCtime(ownFilePath);
+        fs.writeFileSync(path.join(folder, ownFilePath), recordedContent);
+        const [fixedOutputFolders, fixedReadCount] = await loadWithReadCountAsync();
+        expect(fixedOutputFolders).toEqual({ '_phase:build': ['from-project'] });
+        expect(fixedReadCount).toBeGreaterThan(0);
+        expect(await loadWithReadCountAsync()).toEqual([{ '_phase:build': ['from-project'] }, 0]);
+
+        fs.rmSync(path.join(folder, ownFilePath));
+        write('rigged/config/rig.json', { rigPackageName: 'uninstalled-rig' });
+        await expectProjectErrorAsync({ code: 'MODULE_NOT_FOUND' });
+        await expectProjectErrorAsync({ code: 'MODULE_NOT_FOUND' });
+        write('rigged/node_modules/uninstalled-rig/package.json', {
+          name: 'uninstalled-rig',
+          version: '1.0.0'
+        });
+        write(
+          'rigged/node_modules/uninstalled-rig/profiles/default/config/rush-project.json',
+          operationSettings('_phase:build', 'from-installed-rig')
+        );
+        const [installedOutputFolders, installedReadCount] = await loadWithReadCountAsync();
+        expect(installedOutputFolders).toEqual({ '_phase:build': ['from-installed-rig'] });
+        expect(installedReadCount).toBeGreaterThan(0);
+        expect(await loadWithReadCountAsync()).toEqual([{ '_phase:build': ['from-installed-rig'] }, 0]);
+      });
+    });
+  });
+
   describe('operationSettingsByOperationName', () => {
     it('loads a rush-project.json config that extends another config file', async () => {
       const rushProjectConfiguration: RushProjectConfiguration | undefined =
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 96ec77fc728..51c4e437cd1 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -9,6 +9,10 @@ import {
   captureWorkspaceInputFingerprintAsync,
   classifyWorkspaceInputChange,
   getWorkspaceFingerprintEnvironmentEntries,
+  getWorkspaceHostEnvironment,
+  getWorkspaceRequestOperationEnvironment,
+  workspaceFingerprintIgnoredEnvironmentVariables,
+  workspaceRequestScopedEnvironmentVariables,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
   type IWorkspaceInputFingerprint
@@ -42,6 +46,141 @@ describe('workspace input fingerprints', () => {
     }
   });
 
+  it('reloads when a configured plugin shape outside common/config changes', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write('rush.json', JSON.stringify({ rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] }));
+      write(
+        'common/config/rush/rush-plugins.json',
+        JSON.stringify({
+          plugins: [{ packageName: '@example/plugin', pluginName: 'example', autoinstallerName: 'plugins' }]
+        })
+      );
+      const store: string = 'common/autoinstallers/plugins/rush-plugins/@example/plugin';
+      write('common/autoinstallers/plugins/package.json', '{"name":"plugins","version":"1.0.0"}');
+      write(`${store}/rush-plugin-manifest.json`, '{"plugins":[]}');
+      write(`${store}/example/command-line.json`, '{"commands":[]}');
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+
+      let previous: IWorkspaceInputFingerprint = await captureAsync();
+      for (const [relativePath, content] of [
+        [`${store}/example/command-line.json`, '{"commands":[],"parameters":[]}'],
+        [`${store}/rush-plugin-manifest.json`, '{"plugins":[{}]}'],
+        ['common/autoinstallers/plugins/package.json', '{"name":"plugins","version":"1.0.1"}']
+      ]) {
+        write(relativePath, content);
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Reload);
+        previous = next;
+      }
+      fs.rmSync(path.join(folder, `${store}/example/command-line.json`));
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(
+        WorkspaceInputChangeTier.Reload
+      );
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('restarts when the implementation of a configured plugin changes, including through a link', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write('rush.json', JSON.stringify({ rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] }));
+      write(
+        'common/config/rush/rush-plugins.json',
+        JSON.stringify({
+          plugins: [
+            { packageName: '@example/installed', pluginName: 'installed', autoinstallerName: 'plugins' },
+            { packageName: '@example/linked', pluginName: 'linked', autoinstallerName: 'plugins' }
+          ]
+        })
+      );
+      write('common/autoinstallers/plugins/package.json', '{"name":"plugins","version":"1.0.0"}');
+      write('common/autoinstallers/plugins/node_modules/@example/installed/lib/index.js', 'exports.v = 1;');
+      // Like a `link:` dependency, whose implementation is checked in outside node_modules.
+      write('common/autoinstallers/plugins/linked-plugin/release/index.js', 'exports.v = 1;');
+      fs.symlinkSync(
+        path.join(folder, 'common/autoinstallers/plugins/linked-plugin'),
+        path.join(folder, 'common/autoinstallers/plugins/node_modules/@example/linked'),
+        'junction'
+      );
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+
+      let previous: IWorkspaceInputFingerprint = await captureAsync();
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(
+        WorkspaceInputChangeTier.Reuse
+      );
+      for (const [relativePath, content] of [
+        ['common/autoinstallers/plugins/node_modules/@example/installed/lib/index.js', 'exports.v = 2;'],
+        ['common/autoinstallers/plugins/linked-plugin/release/index.js', 'exports.v = 2;'],
+        ['common/autoinstallers/plugins/linked-plugin/release/worker.js', 'exports.w = 1;']
+      ]) {
+        write(relativePath, content);
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Restart);
+        expect(runtimeCache.changedPaths).toContain(
+          path.join(
+            folder,
+            relativePath.replace('plugins/linked-plugin/', 'plugins/node_modules/@example/linked/')
+          )
+        );
+        previous = next;
+      }
+      // Files that Node.js never loads as plugin code do not restart the host.
+      write('common/autoinstallers/plugins/linked-plugin/README.md', 'Documentation');
+      write('common/autoinstallers/plugins/linked-plugin/lib-esm/index.js', 'export const v = 2;');
+      write('common/autoinstallers/plugins/linked-plugin/lib-dts/tsdoc-metadata.json', '{}');
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(
+        WorkspaceInputChangeTier.Reuse
+      );
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('reloads when rush.json declares daemon-compatible plugins', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const rushJsonPath: string = path.join(folder, 'rush.json');
+      const rushJson: object = { rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] };
+      fs.writeFileSync(rushJsonPath, JSON.stringify(rushJson));
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(rushJsonPath);
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+      const previous: IWorkspaceInputFingerprint = await captureAsync();
+      fs.writeFileSync(
+        rushJsonPath,
+        JSON.stringify({ ...rushJson, daemon: { compatiblePlugins: ['rush-example-plugin'] } })
+      );
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(
+        WorkspaceInputChangeTier.Reload
+      );
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
   it('ignores volatile per-shell variables but not engine, Node.js or tool resolution inputs', async () => {
     const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
     try {
@@ -71,18 +210,66 @@ describe('workspace input fingerprints', () => {
         { SSH_CONNECTION: '10.0.0.1 1 10.0.0.2 22', SSH_AUTH_SOCK: '/tmp/agent', TMUX: '/tmp/tmux' },
         { INIT_CWD: '/repo/packages/p03' },
         { RUSH_DAEMON: '1', RUSH_DAEMON_AUTO_START: '0', RUSH_DAEMON_EXPERIMENTAL: '1' },
-        { TERM: undefined, PWD: undefined }
+        { RUSHD_OUTPUT: 'legacy', RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: '600' },
+        { RUSH_PARALLELISM: '48', RUSH_INVOKED_FOLDER: '/repo/packages/p03' },
+        { INVOCATION_ID: 'a1b2', JOURNAL_STREAM: '8:123', MANAGERPID: '1', SYSTEMD_EXEC_PID: '42' },
+        {
+          VSCODE_IPC_HOOK_CLI: '/run/vscode.sock',
+          VSCODE_GIT_IPC_HANDLE: '/run/git.sock',
+          GIT_ASKPASS: '/a'
+        },
+        {
+          COPILOT_CLI: '1',
+          COPILOT_AGENT_SESSION_ID: 'session-2',
+          COPILOT_LOADER_PID: '77',
+          WT_SESSION: 'w'
+        },
+        { RUSHD_TELEMETRY_TAG: 'nightly-7' },
+        // What Claude Code's Bash tool sets in every command, and with Remote Control, messaging or a
+        // background session
+        {
+          CLAUDECODE: '1',
+          CLAUDE_CODE_ENTRYPOINT: 'cli',
+          CLAUDE_CODE_CHILD_SESSION: '1',
+          CLAUDE_CODE_SESSION_ID: 'claude-session-2',
+          CLAUDE_EFFORT: 'high',
+          CLAUDE_PID: '4242'
+        },
+        {
+          CLAUDE_CODE_BRIDGE_SESSION_ID: 'session_01bridge',
+          CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-2.sock',
+          CLAUDE_CODE_MESSAGING_TOKEN: 'token-2',
+          CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-2'
+        },
+        { TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01', TRACESTATE: 'vendor=1' },
+        { PATH: `${base.PATH}${path.delimiter}${base.PATH}` },
+        { TERM: undefined, PWD: undefined },
+        { TMPDIR: '/scratch/job-1', XDG_RUNTIME_DIR: '/run/user/1000' },
+        { TMP: 'C:\\Temp\\2', TEMP: 'C:\\Temp\\2', RUSHD_RUNTIME_DIR: '/run/rush' },
+        // The marker that a daemon gives the processes it starts, such as a client that an operation runs
+        { RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/key-a.pid.json.groups-4242' },
+        { RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/key-b.pid.json.groups-5151' }
       ]) {
         expect(await getHashAsync({ ...base, ...volatile })).toBe(baseHash);
       }
+      expect(
+        getWorkspaceFingerprintEnvironmentEntries({ ...base, RUSHD_OPERATION_GROUPS: '/tmp/x.groups-1' })
+      ).toEqual(getWorkspaceFingerprintEnvironmentEntries(base));
       for (const relevant of [
         { FOO: '1' },
+        // Declaring a plugin daemon-compatible changes which plugins the engine applies.
+        { RUSH_DAEMON_COMPATIBLE_PLUGINS: 'rush-example-plugin' },
+        // Declaring a plugin command-agnostic changes which commands the engine serves.
+        { RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS: 'rush-example-plugin' },
         { RUSH_BUILD_CACHE_ENABLED: '1' },
         { RUSH_BUILD_CACHE_WRITE_ALLOWED: '0' },
         { RUSH_DAEMON_WATCH: '1' },
+        { RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400' },
         { NODE_OPTIONS: '--max-old-space-size=8192' },
         { NPM_CONFIG_REGISTRY: 'https://example.invalid/' },
+        { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'core.fsmonitor', GIT_CONFIG_VALUE_0: 'false' },
         { PATH: '/usr/bin:/usr/local/bin' },
+        { PATH: ['/opt/node/bin', '/usr/local/bin', '/usr/bin'].join(path.delimiter) },
         { HOME: '/home/other' }
       ]) {
         expect(await getHashAsync({ ...base, ...relevant })).not.toBe(baseHash);
@@ -91,11 +278,140 @@ describe('workspace input fingerprints', () => {
         ['HOME', '/home/user'],
         ['PATH', '/usr/local/bin:/usr/bin']
       ]);
+      const repeatedPath: string = ['/a', '/b', '/a', '', '/c', '', '/b'].join(path.delimiter);
+      expect(getWorkspaceFingerprintEnvironmentEntries({ PATH: repeatedPath })).toEqual([
+        ['PATH', ['/a', '/b', '', '/c'].join(path.delimiter)]
+      ]);
     } finally {
       fs.rmSync(folder, { recursive: true, force: true });
     }
   });
 
+  it('keeps request-scoped variables out of a host environment', () => {
+    const environment: Record<string, string | undefined> = {
+      HOME: '/home/user',
+      RUSH_PARALLELISM: '48',
+      COPILOT_AGENT_SESSION_ID: 'session-1',
+      RUSHD_TELEMETRY_TAG: 'tag-1',
+      CLAUDE_CODE_CHILD_SESSION: '1',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-1',
+      CLAUDE_EFFORT: 'high',
+      CLAUDE_PID: '4242',
+      CLAUDE_CODE_BRIDGE_SESSION_ID: 'session_01bridge',
+      CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-1.sock',
+      CLAUDE_CODE_MESSAGING_TOKEN: 'token-1',
+      CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-1',
+      TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+      TRACESTATE: 'vendor=1',
+      RUSHD_OUTPUT: 'agent',
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      TMPDIR: '/scratch/job-1',
+      XDG_RUNTIME_DIR: '/run/user/1000',
+      TEMP: 'C:\\Temp',
+      RUSHD_RUNTIME_DIR: '/run/rush',
+      // A client that an operation of another daemon runs carries that daemon's marker.
+      RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/other.pid.json.groups-4242',
+      UNSET: undefined
+    };
+    expect(getWorkspaceHostEnvironment(environment)).toEqual({
+      HOME: '/home/user',
+      // Markers and settings that name no session, process, folder or secret stay.
+      CLAUDE_CODE_CHILD_SESSION: '1',
+      CLAUDE_EFFORT: 'high',
+      RUSHD_OUTPUT: 'agent',
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      TEMP: 'C:\\Temp',
+      RUSHD_RUNTIME_DIR: '/run/rush'
+    });
+    for (const name of workspaceRequestScopedEnvironmentVariables) {
+      expect(workspaceFingerprintIgnoredEnvironmentVariables.has(name)).toBe(true);
+    }
+  });
+
+  it("gives operations the request's values of variables that are not host identity", () => {
+    const hostEnvironment: Record<string, string | undefined> = {
+      HOME: '/home/user',
+      PATH: '/usr/bin',
+      NODE_OPTIONS: '--max-old-space-size=8192',
+      COPILOT_AGENT_SESSION_ID: 'session-A',
+      RUSHD_TELEMETRY_TAG: 'tag-A',
+      COPILOT_CLI: '1',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-A',
+      CLAUDE_EFFORT: 'high',
+      CLAUDE_PID: '4242',
+      TRACEPARENT: '00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01',
+      GIT_ASKPASS: '/window-A/askpass.sh',
+      WT_SESSION: 'wt-A',
+      UNSET: undefined
+    };
+    const requestEnvironment: Record<string, string | undefined> = {
+      HOME: '/home/other',
+      PATH: '/other/bin',
+      COPILOT_AGENT_SESSION_ID: 'session-B',
+      RUSHD_TELEMETRY_TAG: 'tag-B',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-B',
+      CLAUDE_EFFORT: 'max',
+      TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+      RUSH_PARALLELISM: '2',
+      WT_SESSION: 'wt-B',
+      RUSH_INVOKED_FOLDER: '/repo/apps/b',
+      TERM: undefined
+    };
+    expect(getWorkspaceRequestOperationEnvironment(hostEnvironment, requestEnvironment)).toEqual({
+      HOME: '/home/user',
+      PATH: '/usr/bin',
+      NODE_OPTIONS: '--max-old-space-size=8192',
+      COPILOT_AGENT_SESSION_ID: 'session-B',
+      RUSHD_TELEMETRY_TAG: 'tag-B',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-B',
+      CLAUDE_EFFORT: 'max',
+      TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+      RUSH_PARALLELISM: '2',
+      WT_SESSION: 'wt-B',
+      RUSH_INVOKED_FOLDER: '/repo/apps/b'
+    });
+    expect(getWorkspaceRequestOperationEnvironment(hostEnvironment, {})).toEqual({
+      HOME: '/home/user',
+      PATH: '/usr/bin',
+      NODE_OPTIONS: '--max-old-space-size=8192'
+    });
+  });
+
+  it("gives operations the host's marker of the processes that it starts, never the request's", () => {
+    const hostMarker: string = '/tmp/rushd-1000/key.pid.json.groups-4242';
+    const requestEnvironment: Record<string, string | undefined> = {
+      HOME: '/home/other',
+      RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/outer.pid.json.groups-5151',
+      WT_SESSION: 'wt-B'
+    };
+    expect(
+      getWorkspaceRequestOperationEnvironment(
+        { HOME: '/home/user', RUSHD_OPERATION_GROUPS: hostMarker },
+        requestEnvironment
+      )
+    ).toEqual({ HOME: '/home/user', RUSHD_OPERATION_GROUPS: hostMarker, WT_SESSION: 'wt-B' });
+    expect(getWorkspaceRequestOperationEnvironment({ HOME: '/home/user' }, requestEnvironment)).toEqual({
+      HOME: '/home/user',
+      WT_SESSION: 'wt-B'
+    });
+  });
+
+  it('matches request variable names case-insensitively on Windows', () => {
+    const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+    const mixedCaseSessionVariable: string = 'Copilot_Agent_Session_Id';
+    Object.defineProperty(process, 'platform', { ...platform, value: 'win32' });
+    try {
+      expect(
+        getWorkspaceRequestOperationEnvironment(
+          { Path: 'C:\\bin', [mixedCaseSessionVariable]: 'session-A' },
+          { Path: 'D:\\bin', COPILOT_AGENT_SESSION_ID: 'session-B' }
+        )
+      ).toEqual({ Path: 'C:\\bin', COPILOT_AGENT_SESSION_ID: 'session-B' });
+    } finally {
+      Object.defineProperty(process, 'platform', platform);
+    }
+  });
+
   it('classifies content, configuration and process-bound identities', () => {
     const current: IWorkspaceInputFingerprint = {
       configurationHash: 'configuration',
@@ -146,4 +462,159 @@ describe('workspace input fingerprints', () => {
       fs.rmSync(folder, { recursive: true, force: true });
     }
   });
+
+  it('ignores operation state inside a project nested in common/config but not its definitions', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write(
+        'rush.json',
+        JSON.stringify({
+          rushVersion: '5.179.0',
+          pnpmVersion: '10.27.0',
+          projectFolderMaxDepth: 4,
+          projects: [
+            { packageName: 'pipelines', projectFolder: 'common/config/pipelines' },
+            { packageName: 'inside-rush', projectFolder: 'common/config/rush/inside-rush' }
+          ]
+        })
+      );
+      write('common/config/pipelines/package.json', '{"name":"pipelines","version":"1.0.0"}');
+      write('common/config/rush/inside-rush/package.json', '{"name":"inside-rush","version":"1.0.0"}');
+      write('common/config/rush/command-line.json', '{"commands":[]}');
+      write('common/config/other/settings.json', '{}');
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+
+      let previous: IWorkspaceInputFingerprint = await captureAsync();
+      for (const relativePath of [
+        'common/config/pipelines/rush-logs/pipelines._phase_build.log',
+        'common/config/pipelines/.rush/temp/operation/_phase_build/state.json',
+        'common/config/pipelines/lib/index.js',
+        'common/config/pipelines/config/heft.json'
+      ]) {
+        write(relativePath, String(Math.random()));
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(next.configurationHash).toBe(previous.configurationHash);
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Reuse);
+      }
+      for (const [relativePath, content] of [
+        ['common/config/pipelines/package.json', '{"name":"pipelines","version":"1.0.1"}'],
+        ['common/config/pipelines/config/rush-project.json', '{"operationSettings":[]}'],
+        ['common/config/pipelines/config/rig.json', '{"rigPackageName":"rig"}'],
+        ['common/config/rush/command-line.json', '{"commands":[],"parameters":[]}'],
+        ['common/config/rush/inside-rush/rush-logs/inside-rush._phase_build.log', 'log'],
+        ['common/config/other/settings.json', '{"changed":true}']
+      ]) {
+        write(relativePath, content);
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Reload);
+        previous = next;
+      }
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('reuses the digests of definition and installation files only once they have stopped changing', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    const realDateNow: () => number = Date.now;
+    const readFile: jest.SpyInstance = jest.spyOn(fs.promises, 'readFile');
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write(
+        'rush.json',
+        JSON.stringify({
+          rushVersion: '5.179.0',
+          pnpmVersion: '10.27.0',
+          projects: [{ packageName: 'a', projectFolder: 'a' }]
+        })
+      );
+      write('a/package.json', '{"name":"a","version":"1.0.0"}');
+      write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 1');
+      write('npmrc/a', 'registry=https://a.example/');
+      write('npmrc/b', 'registry=https://b.example/');
+      fs.symlinkSync(path.join(folder, 'npmrc/a'), path.join(folder, '.npmrc'));
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const packageJsonPath: string = path.join(rushConfiguration.rushJsonFolder, 'a', 'package.json');
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      /** Returns the fingerprint and the number of times that the capture read the project's package.json. */
+      const captureAsync = async (): Promise<[IWorkspaceInputFingerprint, number]> => {
+        readFile.mockClear();
+        const fingerprint: IWorkspaceInputFingerprint = await captureWorkspaceInputFingerprintAsync({
+          rushConfiguration,
+          runtimeCache,
+          environment: {}
+        });
+        return [fingerprint, readFile.mock.calls.filter(([filename]) => filename === packageJsonPath).length];
+      };
+
+      // Files that changed moments ago are read by every capture.
+      const dateNow: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(realDateNow());
+      const [first, firstReadCount] = await captureAsync();
+      expect(firstReadCount).toBe(1);
+      expect(await captureAsync()).toEqual([first, 1]);
+      // Once they have been unchanged for a few seconds, a capture records digests that later captures reuse.
+      dateNow.mockImplementation(() => realDateNow() + 10_000);
+      expect(await captureAsync()).toEqual([first, 1]);
+      expect(await captureAsync()).toEqual([first, 0]);
+
+      // An edit that keeps the file's identity, size and modification time
+      fs.utimesSync(packageJsonPath, 1_000_000, 1_000_000);
+      expect(await captureAsync()).toEqual([first, 1]);
+      const { ctimeNs } = fs.statSync(packageJsonPath, { bigint: true });
+      const probePath: string = path.join(folder, 'probe');
+      do {
+        // A coarse clock can give a write the same ctime as the previous one.
+        fs.writeFileSync(probePath, '');
+      } while (fs.statSync(probePath, { bigint: true }).ctimeNs <= ctimeNs);
+      write('a/package.json', '{"name":"a","version":"1.0.1"}');
+      fs.utimesSync(packageJsonPath, 1_000_000, 1_000_000);
+      const [edited, editedReadCount] = await captureAsync();
+      expect(editedReadCount).toBe(1);
+      expect(classifyWorkspaceInputChange(first, edited)).toBe(WorkspaceInputChangeTier.Reload);
+      expect(await captureAsync()).toEqual([edited, 0]);
+
+      // A link that reaches another file
+      fs.rmSync(path.join(folder, '.npmrc'));
+      fs.symlinkSync(path.join(folder, 'npmrc/b'), path.join(folder, '.npmrc'));
+      const [retargeted] = await captureAsync();
+      expect(classifyWorkspaceInputChange(edited, retargeted)).toBe(WorkspaceInputChangeTier.Reload);
+      // A file that is removed, and then created again
+      fs.rmSync(packageJsonPath);
+      const [removed] = await captureAsync();
+      expect(classifyWorkspaceInputChange(retargeted, removed)).toBe(WorkspaceInputChangeTier.Reload);
+      write('a/package.json', '{"name":"a","version":"1.0.1"}');
+      expect(await captureAsync()).toEqual([retargeted, 1]);
+      expect(runtimeCache.changedInstallationPaths).toEqual([]);
+      // An installation file
+      write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 10');
+      const [installed] = await captureAsync();
+      expect(classifyWorkspaceInputChange(retargeted, installed)).toBe(WorkspaceInputChangeTier.Restart);
+      const lockfilePath: string = path.join(rushConfiguration.commonRushConfigFolder, 'pnpm-lock.yaml');
+      expect(runtimeCache.changedInstallationPaths).toEqual([lockfilePath]);
+      // Content, not the edit, identifies the installation.
+      write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 1');
+      const [restored] = await captureAsync();
+      expect(restored.installationHash).toBe(first.installationHash);
+      expect(runtimeCache.changedInstallationPaths).toEqual([]);
+    } finally {
+      jest.restoreAllMocks();
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts b/libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts
new file mode 100644
index 00000000000..192c572255e
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('node:fs', () => {
+  const actual: typeof import('node:fs') = jest.requireActual('node:fs');
+  return { ...actual, readdirSync: jest.fn(actual.readdirSync) };
+});
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { captureWorkspaceInputFingerprintAsync } from '../WorkspaceInputFingerprint';
+import { RushConfiguration } from '../RushConfiguration';
+
+describe('workspace runtime walk', () => {
+  it('walks a package folder that several configured plugins share only once per capture', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write('rush.json', JSON.stringify({ rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] }));
+      write(
+        'common/config/rush/rush-plugins.json',
+        JSON.stringify({
+          plugins: ['first', 'second', 'third'].map((pluginName: string) => ({
+            packageName: '@example/plugins',
+            pluginName,
+            autoinstallerName: 'plugins'
+          }))
+        })
+      );
+      const packageFolder: string = 'common/autoinstallers/plugins/node_modules/@example/plugins';
+      write(`${packageFolder}/release/first.js`, 'exports.v = 1;');
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+
+      const readdirSync: jest.Mock = fs.readdirSync as unknown as jest.Mock;
+      readdirSync.mockClear();
+      await captureWorkspaceInputFingerprintAsync({ rushConfiguration, environment: {} });
+      const walks: unknown[] = readdirSync.mock.calls.filter(
+        ([walked]: unknown[]) => walked === path.join(folder, packageFolder)
+      );
+      expect(walks).toHaveLength(1);
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap b/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap
index 8de9fe79d08..876fe54baed 100644
--- a/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap
+++ b/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap
@@ -41,6 +41,7 @@ exports[`RushProjectConfiguration operationSettingsByOperationName loads a rush-
 exports[`RushProjectConfiguration operationSettingsByOperationName loads a rush-project.json config that extends another config file 2`] = `
 Map {
   "_phase:a" => Object {
+    "allowDaemonWarmWorker": true,
     "operationName": "_phase:a",
     "outputFolderNames": Array [
       "a-a",
diff --git a/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json
new file mode 100644
index 00000000000..52b463aaa67
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [
+    {
+      "commandKind": "phased",
+      "name": "ship",
+      "summary": "Ships every project, without the build cache or skipping.",
+      "enableParallelism": true,
+      "incremental": true,
+      "disableBuildCache": true,
+      "phases": ["_phase:ship"]
+    }
+  ],
+  "phases": [
+    {
+      "name": "_phase:ship",
+      "dependencies": {
+        "upstream": ["_phase:ship"]
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json
new file mode 100644
index 00000000000..3721053fbff
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [
+    {
+      "commandKind": "phased",
+      "name": "ship",
+      "summary": "Ships every project.",
+      "enableParallelism": true,
+      "incremental": true,
+      "disableBuildCaches": true,
+      "phases": ["_phase:ship"]
+    }
+  ],
+  "phases": [
+    {
+      "name": "_phase:ship",
+      "dependencies": {
+        "upstream": ["_phase:ship"]
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json b/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json
index 2d9827001fd..fcf2bb0c973 100644
--- a/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json
+++ b/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json
@@ -2,7 +2,8 @@
   "operationSettings": [
     {
       "operationName": "_phase:a",
-      "outputFolderNames": ["a-a"]
+      "outputFolderNames": ["a-a"],
+      "allowDaemonWarmWorker": true
     },
     {
       "operationName": "_phase:b",
diff --git a/libraries/rush-lib/src/cli/RushCommandLineParser.ts b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
index 3127c27e7d9..f9b5fdce416 100644
--- a/libraries/rush-lib/src/cli/RushCommandLineParser.ts
+++ b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
@@ -71,9 +71,13 @@ import { type IRushSessionReporterOptions, RushSession } from '../pluginFramewor
 import type { IBuiltInPluginConfiguration } from '../pluginFramework/PluginLoader/BuiltInPluginLoader';
 import { InitSubspaceAction } from './actions/InitSubspaceAction';
 import { RushAlerts } from '../utilities/RushAlerts';
+import { getEngineJsonFileLoadCache, type JsonFileLoadCache } from '../utilities/JsonFileLoadCache';
 import { initializeDotEnv } from '../logic/dotenv';
 import { measureAsyncFn } from '../utilities/performance';
+import { waitForStreamsToFlushAsync } from '../utilities/streamUtilities';
+import type { StandardOutputClosure } from '../utilities/StandardOutputClosure';
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
+import { consumeRepositoryLockWait, type IRepositoryLockWait } from '../logic/RepositoryLockWait';
 import {
   _correlateRushSessionError,
   _flushRushSessionReporterAsync,
@@ -94,10 +98,17 @@ export interface IRushCommandLineParserOptions {
   builtInPluginConfigurations: IBuiltInPluginConfiguration[];
   reporter?: IRushSessionReporterOptions;
   reporterCloseAsync?: () => Promise<void>;
+  /**
+   * Reports that a reader of the process's stdout or stderr exited, for example `head` in `rush build | head -5`.
+   * Only the Rush CLI supplies it; see {@link RushCommandLineParser.standardOutputClosure}.
+   */
+  standardOutputClosure?: StandardOutputClosure;
   /** Parse native commands without executing CLI actions or initializing process-global state. */
   engine?: {
     rushConfiguration: RushConfiguration;
     terminalProvider: ITerminalProvider;
+    /** The environment of the request; see {@link RushCommandLineParser.engineEnvironment}. */
+    environment?: Readonly<Record<string, string | undefined>>;
   };
 }
 
@@ -180,11 +191,18 @@ export class RushCommandLineParser extends CommandLineParser {
   public readonly rushConfiguration!: RushConfiguration;
   public readonly rushSession: RushSession;
   public readonly pluginManager: PluginManager;
+  /**
+   * The wait for the repository lock that `rush-client` asked for when it ran this command in-process after it tried
+   * the Rush daemon. A parser that serves an engine host never has one.
+   */
+  public readonly repositoryLockWait: IRepositoryLockWait | undefined;
 
   readonly #debugParameter: CommandLineFlagParameter;
   readonly #quietParameter: CommandLineFlagParameter;
   readonly #restrictConsoleOutput: boolean = RushCommandLineParser.shouldRestrictConsoleOutput();
   readonly #rushOptions: IRushCommandLineParserOptions;
+  /** For a parser that serves a long-lived engine host, the cache through which it reads JSON configuration files. */
+  readonly #jsonFileLoadCache: JsonFileLoadCache | undefined;
   readonly #terminalProvider: ITerminalProvider;
   readonly #terminal: Terminal;
   readonly #autocreateBuildCommand: boolean;
@@ -203,6 +221,23 @@ export class RushCommandLineParser extends CommandLineParser {
     return this.#rushOptions.cwd;
   }
 
+  /**
+   * For a parser that serves a long-lived engine host, the environment of the request being parsed. Actions read
+   * environment-backed parameter defaults from it instead of from `process.env`.
+   */
+  public get engineEnvironment(): Readonly<Record<string, string | undefined>> | undefined {
+    const engine: IRushCommandLineParserOptions['engine'] = this.#rushOptions.engine;
+    return engine ? (engine.environment ?? process.env) : undefined;
+  }
+
+  /**
+   * For the Rush CLI, reports that a reader of the process's stdout or stderr exited. A phased command then stops
+   * starting operations. Undefined for the automation API and for a parser that serves an engine host.
+   */
+  public get standardOutputClosure(): StandardOutputClosure | undefined {
+    return this.#rushOptions.engine ? undefined : this.#rushOptions.standardOutputClosure;
+  }
+
   public constructor(options?: Partial<IRushCommandLineParserOptions>) {
     super({
       toolFilename: 'rush',
@@ -231,7 +266,12 @@ export class RushCommandLineParser extends CommandLineParser {
     });
 
     this.#rushOptions = this.#normalizeOptions(options || {});
+    // An engine host's process environment is not the request's, and rush-client never sets these variables in it.
+    this.repositoryLockWait = this.#rushOptions.engine ? undefined : consumeRepositoryLockWait(process.env);
     const { cwd, alreadyReportedNodeTooNewError, builtInPluginConfigurations, reporter } = this.#rushOptions;
+    this.#jsonFileLoadCache = this.#rushOptions.engine
+      ? getEngineJsonFileLoadCache(this.#rushOptions.engine.rushConfiguration)
+      : undefined;
     const reporterTerminalProvider: ReporterTerminalProvider | undefined = reporter?.operationStreamEnabled
       ? new ReporterTerminalProvider()
       : undefined;
@@ -285,7 +325,8 @@ export class RushCommandLineParser extends CommandLineParser {
       terminal,
       builtInPluginConfigurations,
       restrictConsoleOutput: this.#restrictConsoleOutput,
-      rushGlobalFolder: this.rushGlobalFolder
+      rushGlobalFolder: this.rushGlobalFolder,
+      jsonFileLoadCache: this.#jsonFileLoadCache
     });
     if (this.#initializationFailed) {
       this.#autocreateBuildCommand = true;
@@ -502,6 +543,7 @@ export class RushCommandLineParser extends CommandLineParser {
       builtInPluginConfigurations: options.builtInPluginConfigurations || [],
       reporter: options.reporter,
       reporterCloseAsync: options.reporterCloseAsync,
+      standardOutputClosure: options.standardOutputClosure,
       engine: options.engine
     };
   }
@@ -572,7 +614,8 @@ export class RushCommandLineParser extends CommandLineParser {
 
     const commandLineConfiguration: CommandLineConfiguration = CommandLineConfiguration.loadFromFileOrDefault(
       commandLineConfigFilePath,
-      doNotIncludeDefaultBuildCommands
+      doNotIncludeDefaultBuildCommands,
+      this.#jsonFileLoadCache
     );
     this.#addCommandLineConfigActions(commandLineConfiguration);
   }
@@ -650,7 +693,8 @@ export class RushCommandLineParser extends CommandLineParser {
 
         shellCommand,
         autoinstallerName,
-        providedByPlugin
+        providedByPlugin,
+        jsonFileLoadCache: this.#jsonFileLoadCache
       })
     );
   }
@@ -810,7 +854,11 @@ export class RushCommandLineParser extends CommandLineParser {
     if (telemetryFlushAsync) {
       pendingFlushes.push(telemetryFlushAsync);
     }
-    void Promise.allSettled(pendingFlushes).then(handleExit);
+    // process.exit() discards output that a pipe hasn't accepted yet, such as the end of a failed build's
+    // log and its summary when the reader is slower than Rush.
+    void Promise.allSettled(pendingFlushes)
+      .then(() => waitForStreamsToFlushAsync([process.stdout, process.stderr]))
+      .finally(handleExit);
   }
 
   #reportInitializationErrorAndSetExitCode(error: Error): void {
diff --git a/libraries/rush-lib/src/cli/RushXCommandLine.ts b/libraries/rush-lib/src/cli/RushXCommandLine.ts
index 60342cbfac3..0b625d3e9c4 100644
--- a/libraries/rush-lib/src/cli/RushXCommandLine.ts
+++ b/libraries/rush-lib/src/cli/RushXCommandLine.ts
@@ -164,7 +164,11 @@ export class RushXCommand {
       ignoredHooks?.handle(Event.postRushx, args.isDebug, true, consoleTerminal);
       return 0;
     } catch (error) {
-      consoleTerminal.writeErrorLine(Colorize.red('Error: ' + (error as Error).message));
+      // When the request is cancelled or the daemon shuts down, the client says so; the abort reason adds nothing.
+      const aborted: boolean = !!options.abortSignal?.aborted && error === options.abortSignal.reason;
+      if (!aborted) {
+        consoleTerminal.writeErrorLine(Colorize.red('Error: ' + (error as Error).message));
+      }
       return _getRushXExitCode(error);
     }
   }
@@ -357,7 +361,12 @@ async function _launchRushXInternalAsync(
     }
   };
   const exitCode: number = execution?.spawn
-    ? await _executeOwnedLifecycleAsync(commandWithArgs, lifecycleOptions, execution.spawn)
+    ? await _executeOwnedLifecycleAsync(
+        commandWithArgs,
+        lifecycleOptions,
+        execution.spawn,
+        execution.abortSignal
+      )
     : Utilities.executeLifecycleCommand(commandWithArgs, lifecycleOptions);
 
   execution?.abortSignal?.throwIfAborted();
@@ -541,7 +550,8 @@ function _getPackageJsonFilePath(lookup: PackageJsonLookup, cwd: string): string
 function _executeOwnedLifecycleAsync(
   command: string,
   options: ILifecycleCommandOptions,
-  spawn: NonNullable<IRushXCommandOptions['spawn']>
+  spawn: NonNullable<IRushXCommandOptions['spawn']>,
+  abortSignal: AbortSignal | undefined
 ): Promise<number> {
   const child: childProcess.ChildProcess = Utilities.executeLifecycleCommandAsync(command, {
     ...options,
@@ -550,9 +560,11 @@ function _executeOwnedLifecycleAsync(
   });
   return new Promise((resolve, reject) => {
     child.once('error', reject);
-    child.once('close', (code) => {
-      if (code === null) reject(new Error('An unknown error occurred.'));
-      else resolve(code);
+    child.once('close', (code, signal) => {
+      if (code !== null) resolve(code);
+      // The daemon ends the script when the request is cancelled or the daemon shuts down.
+      else if (abortSignal?.aborted) reject(abortSignal.reason);
+      else reject(new Error(Utilities.describeLifecycleCommandSignal(signal ?? undefined)));
     });
   });
 }
diff --git a/libraries/rush-lib/src/cli/actions/BaseRushAction.ts b/libraries/rush-lib/src/cli/actions/BaseRushAction.ts
index 1f40359f146..bdbd78fdc4e 100644
--- a/libraries/rush-lib/src/cli/actions/BaseRushAction.ts
+++ b/libraries/rush-lib/src/cli/actions/BaseRushAction.ts
@@ -4,12 +4,13 @@
 import * as path from 'node:path';
 
 import { CommandLineAction, type ICommandLineActionOptions } from '@rushstack/ts-command-line';
-import { AlreadyReportedError, LockFile } from '@rushstack/node-core-library';
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { Colorize, type ITerminal } from '@rushstack/terminal';
 import type { IScopedReporter } from '@rushstack/rush-reporter';
 
 import type { RushConfiguration } from '../../api/RushConfiguration';
 import { EventHooksManager } from '../../logic/EventHooksManager';
+import { acquireRepositoryLockAsync, type IRepositoryLockResult } from '../../logic/RepositoryLockWait';
 import { RushCommandLineParser } from '../RushCommandLineParser';
 import { Utilities } from '../../utilities/Utilities';
 import type { RushGlobalFolder } from '../../api/RushGlobalFolder';
@@ -69,8 +70,15 @@ export abstract class BaseConfiglessRushAction extends CommandLineAction impleme
 
     if (this.rushConfiguration) {
       if (!this.#safeForSimultaneousRushProcesses) {
-        if (!LockFile.tryAcquire(this.rushConfiguration.commonTempFolder, 'rush')) {
-          const message: string = 'Another Rush command is already running in this repository.';
+        const { lock, holderSentence }: IRepositoryLockResult = await acquireRepositoryLockAsync({
+          lockFolder: this.rushConfiguration.commonTempFolder,
+          wait: this.parser.repositoryLockWait,
+          terminal: this.terminal
+        });
+        if (!lock) {
+          const message: string =
+            'Another Rush command is already running in this repository.' +
+            (holderSentence ? ` ${holderSentence}` : '');
           if (_isRushSessionOperationStreamEnabled(this.rushSession)) {
             this.terminal.writeErrorLine(message);
             throw new AlreadyReportedError();
diff --git a/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts
index 421bd5adeaf..ad541948cc1 100644
--- a/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts
@@ -9,7 +9,6 @@ import type { CommandLineParameter } from '@rushstack/ts-command-line';
 import {
   FileSystem,
   type IPackageJson,
-  JsonFile,
   AlreadyReportedError,
 } from '@rushstack/node-core-library';
 import { Colorize } from '@rushstack/terminal';
@@ -22,6 +21,7 @@ import { Autoinstaller } from '../../logic/Autoinstaller';
 import { RushConstants } from '../../logic/RushConstants';
 import type { IGlobalCommandConfig, IShellCommandTokenContext } from '../../api/CommandLineConfiguration';
 import { measureAsyncFn } from '../../utilities/performance';
+import { type JsonFileLoadCache, loadJsonFile } from '../../utilities/JsonFileLoadCache';
 
 /**
  * Constructor parameters for GlobalScriptAction.
@@ -30,6 +30,8 @@ export interface IGlobalScriptActionOptions extends IBaseScriptActionOptions<IGl
   shellCommand: string;
   autoinstallerName: string | undefined;
   providedByPlugin: boolean;
+  /** The cache of a long-lived engine host, through which the action reads its autoinstaller's package.json. */
+  jsonFileLoadCache?: JsonFileLoadCache;
 }
 
 /**
@@ -53,7 +55,7 @@ export class GlobalScriptAction extends BaseScriptAction<IGlobalCommandConfig> {
 
   public constructor(options: IGlobalScriptActionOptions) {
     super(options);
-    const { shellCommand, providedByPlugin, autoinstallerName = '' } = options;
+    const { shellCommand, providedByPlugin, autoinstallerName = '', jsonFileLoadCache } = options;
     this.#shellCommand = shellCommand;
     this.#providedByPlugin = providedByPlugin;
     this.#autoinstallerName = autoinstallerName;
@@ -85,9 +87,13 @@ export class GlobalScriptAction extends BaseScriptAction<IGlobalCommandConfig> {
         );
       }
 
-      const packageJson: IPackageJson = JsonFile.load(packageJsonPath);
+      const packageName: string | undefined = loadJsonFile(
+        jsonFileLoadCache,
+        packageJsonPath,
+        (packageJson) => (packageJson as IPackageJson).name
+      );
 
-      if (packageJson.name !== this.#autoinstallerName) {
+      if (packageName !== this.#autoinstallerName) {
         throw new Error(
           `The custom command "${this.actionName}" specifies an "autoinstallerName" setting,` +
             ` but the package.json file's "name" field is not "${this.#autoinstallerName}": ` +
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index b04cb177b4f..69b030f04f6 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -43,6 +43,7 @@ import { Stopwatch } from '../../utilities/Stopwatch';
 import { BaseScriptAction, type IBaseScriptActionOptions } from './BaseScriptAction';
 import type { IOperationGraphOptions, IOperationGraphTelemetry } from '../../logic/operations/OperationGraph';
 import { OperationGraph } from '../../logic/operations/OperationGraph';
+import type { IPhasedCommandTelemetryFields } from '../../logic/operations/PhasedCommandTelemetry';
 import { RushConstants } from '../../logic/RushConstants';
 import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
 import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
@@ -55,9 +56,15 @@ import { associateParametersByPhase } from '../parsing/associateParametersByPhas
 import { PhasedOperationPlugin } from '../../logic/operations/PhasedOperationPlugin';
 import { ShellOperationRunnerPlugin } from '../../logic/operations/ShellOperationRunnerPlugin';
 import { Event } from '../../api/EventHooks';
-import { ProjectChangeAnalyzer } from '../../logic/ProjectChangeAnalyzer';
+import {
+  ProjectChangeAnalyzer,
+  tryGetMissingProjectShrinkwrapFileErrorAsync
+} from '../../logic/ProjectChangeAnalyzer';
 import { OperationStatus } from '../../logic/operations/OperationStatus';
-import type { IExecutionResult } from '../../logic/operations/IOperationExecutionResult';
+import type {
+  IExecutionResult,
+  IOperationExecutionResult
+} from '../../logic/operations/IOperationExecutionResult';
 import { OperationResultSummarizerPlugin } from '../../logic/operations/OperationResultSummarizerPlugin';
 import type { ITelemetryData } from '../../logic/Telemetry';
 import {
@@ -67,9 +74,10 @@ import {
 } from '../../logic/operations/ParseParallelism';
 import { CobuildConfiguration } from '../../api/CobuildConfiguration';
 import { CacheableOperationPlugin } from '../../logic/operations/CacheableOperationPlugin';
+import { DeferredCacheEntryWrites } from '../../logic/buildCache/DeferredCacheEntryWrites';
 import type { IInputsSnapshot, GetInputsSnapshotAsyncFn } from '../../logic/incremental/InputsSnapshot';
 import { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
-import { LegacySkipPlugin } from '../../logic/operations/LegacySkipPlugin';
+import { LegacySkipInvalidationPlugin, LegacySkipPlugin } from '../../logic/operations/LegacySkipPlugin';
 import { ValidateOperationsPlugin } from '../../logic/operations/ValidateOperationsPlugin';
 import { ShardedPhasedOperationPlugin } from '../../logic/operations/ShardedPhaseOperationPlugin';
 import { FlagFile } from '../../api/FlagFile';
@@ -80,6 +88,12 @@ import { IgnoredParametersPlugin } from '../../logic/operations/IgnoredParameter
 import { TrimRushEnvironmentVariablesPlugin } from '../../logic/operations/TrimRushEnvironmentVariablesPlugin';
 import { DebugHashesPlugin } from '../../logic/operations/DebugHashesPlugin';
 import { measureAsyncFn, measureFn } from '../../utilities/performance';
+import { runDuringChecksAsync } from '../../utilities/runDuringChecksAsync';
+import {
+  formatClosedOutputNotice,
+  type IClosedStandardOutput,
+  type StandardOutputClosure
+} from '../../utilities/StandardOutputClosure';
 import { attachReporterOperationEventSink } from '../../logic/operations/ReporterOperationEventSink';
 import { _isRushSessionOperationStreamEnabled } from '../../pluginFramework/RushSession';
 
@@ -96,6 +110,28 @@ const ENGINE_REQUEST_SCOPED_PARAMETER_NAMES: ReadonlySet<string> = new Set([
   '--timeline'
 ]);
 
+/**
+ * Parameters that are part of the engine parameter identity, but that do not keep an engine created by one command
+ * from serving another command (see `getEngineGraphIdentity`). An engine never runs build event-hook scripts, and
+ * it selects the operations of each request with the request's own `--include-phase-deps`.
+ */
+const ENGINE_SHAREABLE_PARAMETER_NAMES: ReadonlySet<string> = new Set([
+  '--ignore-hooks',
+  '--include-phase-deps'
+]);
+
+/**
+ * The phases of an engine's graph and of one request, by name; see `PhasedScriptAction.getEnginePhaseNames`.
+ */
+export interface IEnginePhaseNames {
+  /** The phases for which the graph of an engine created by this command has an operation of every project. */
+  readonly complete: ReadonlySet<string>;
+  /** The phases whose operations a request of this command selects for each project that it selects. */
+  readonly selected: ReadonlySet<string>;
+  /** Every phase that a request of this command can run: its selected phases and all of their dependencies. */
+  readonly reachable: ReadonlySet<string>;
+}
+
 /**
  * The set of overall execution statuses that mean the command did what was asked of it and should
  * exit with code 0.
@@ -175,7 +211,9 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   readonly #alwaysWatch: boolean;
   readonly #alwaysInstall: boolean | undefined;
   readonly #includeAllProjectsInWatchGraph: boolean;
+  readonly #phases: ReadonlyMap<string, IPhase>;
   readonly #terminal: ITerminal;
+  readonly #engineEnvironment: Readonly<Record<string, string | undefined>> | undefined;
 
   readonly #changedProjectsOnlyParameter: CommandLineFlagParameter | undefined;
   readonly #selectionParameters: SelectionParameterSet;
@@ -219,19 +257,24 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     this.#alwaysWatch = alwaysWatch;
     this.#alwaysInstall = alwaysInstall;
     this.#includeAllProjectsInWatchGraph = includeAllProjectsInWatchGraph;
+    this.#phases = phases;
     this._runsBeforeInstall = false;
     this.sessionAbortController = new AbortController();
 
     this.hooks = new PhasedCommandHooks();
 
     this.#terminal = new Terminal(this.rushSession.terminalProvider);
+    this.#engineEnvironment = options.parser.engineEnvironment;
 
     this.#parallelismParameter = this.#enableParallelism
       ? this.defineStringParameter({
           parameterLongName: '--parallelism',
           parameterShortName: '-p',
           argumentName: 'COUNT',
-          environmentVariable: EnvironmentVariableNames.RUSH_PARALLELISM,
+          // An engine host reads this default from the request's environment instead; see #getParallelism().
+          environmentVariable: this.#engineEnvironment
+            ? undefined
+            : EnvironmentVariableNames.RUSH_PARALLELISM,
           description:
             'Specifies the maximum number of concurrent processes to launch during a build.' +
             ' The COUNT should be a positive integer, a percentage value (eg. "50%") or the word "max"' +
@@ -359,6 +402,44 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     await this.#runAsync();
   }
 
+  /** False when every run executes all selected operations: `rebuild`, or `"incremental": false`. */
+  public get isIncrementalBuildAllowed(): boolean {
+    return this.#isIncrementalBuildAllowed;
+  }
+
+  /**
+   * A daemon engine keeps its results between requests, so for a command that disables the build cache it runs
+   * every selected operation, as native Rush does. Native Rush still gives its operation runners the command's
+   * `incremental` setting.
+   */
+  get #isEngineIncrementalBuildAllowed(): boolean {
+    return this.#isIncrementalBuildAllowed && !this.#disableBuildCache;
+  }
+
+  /**
+   * Whether an engine created by this command runs the operations that declare `daemonIpc` in persistent
+   * Node IPC processes. `DaemonIpcOperationRunnerPlugin` installs those runners only for an incremental
+   * command.
+   */
+  public get usesPersistentIpcRunners(): boolean {
+    return (
+      this.#isEngineIncrementalBuildAllowed &&
+      this.rushConfiguration.daemon.usePersistentIpcRunners &&
+      !this.#noIPCParameter?.value
+    );
+  }
+
+  /** The names of every phase this command can schedule, including dependency and watch phases. */
+  public get schedulablePhaseNames(): ReadonlySet<string> {
+    const phaseNames: Set<string> = new Set();
+    for (const phases of [this.#originalPhases, this.#initialPhases, this.#watchPhases]) {
+      for (const phase of phases) {
+        phaseNames.add(phase.name);
+      }
+    }
+    return phaseNames;
+  }
+
   public validateEngineCommand(): void {
     if (
       this.#alwaysWatch ||
@@ -371,6 +452,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
       throw new Error('Watch, install, variant and diagnostic-directory options require --no-daemon.');
     }
     if (
+      this.#runsBuildEventHooks() &&
       !this.#ignoreHooksParameter.value &&
       (this.rushConfiguration.eventHooks.get(Event.preRushBuild).length ||
         this.rushConfiguration.eventHooks.get(Event.postRushBuild).length)
@@ -390,6 +472,145 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     ]);
   }
 
+  /**
+   * The phases of the graph of an engine created by this command, and of the operations of one request of it.
+   *
+   * @remarks
+   * An engine creates operations of every project for the phases that the command selects, and, through their
+   * dependencies, operations of the phases that these depend on. A phase that is reached only through an `upstream`
+   * dependency has operations only for the projects that other projects depend on.
+   */
+  public getEnginePhaseNames(): IEnginePhaseNames {
+    const selected: ReadonlySet<IPhase> = this.#includePhaseDeps?.value
+      ? this.#originalPhases
+      : this.#initialPhases;
+    const complete: Set<IPhase> = new Set(selected);
+    for (const phase of complete) {
+      for (const dependency of phase.dependencies.self) {
+        complete.add(dependency);
+      }
+    }
+    const getNames = (phases: Iterable<IPhase>): ReadonlySet<string> =>
+      new Set(Array.from(phases, (phase: IPhase) => phase.name));
+    return {
+      complete: getNames(complete),
+      selected: getNames(selected),
+      reachable: getNames(this.#initialPhases)
+    };
+  }
+
+  /**
+   * The settings of this command that shape the operations of the specified phases or the graph that contains them,
+   * as JSON. An engine created by one command can serve a request of another command only if both commands have the
+   * same graph identity for the phases that the request can run.
+   *
+   * @remarks
+   * It includes the global parameters, the arguments that the custom parameters associated with each phase add to
+   * the phase's commands (and therefore to the hashes of its operations), the built-in parameters that are set,
+   * other than selection, request-scoped and `ENGINE_SHAREABLE_PARAMETER_NAMES` parameters, and the command's
+   * build cache and oversubscription settings. Unlike `getEngineParameterIdentity`, it excludes the command name
+   * and whether the command is incremental, which each request applies to its own iteration.
+   */
+  public getEngineGraphIdentity(phaseNames: ReadonlySet<string>): string {
+    const phaseArguments: [string, string[]][] = [];
+    for (const phaseName of Array.from(phaseNames).sort()) {
+      const phaseArgumentList: string[] = [];
+      for (const parameter of this.#phases.get(phaseName)?.associatedParameters ?? []) {
+        parameter.appendToArgList(phaseArgumentList);
+      }
+      phaseArguments.push([phaseName, phaseArgumentList]);
+    }
+    return JSON.stringify({
+      global: this.parser.getParameterStringMap(),
+      phases: phaseArguments,
+      builtIn: this.#getEngineGraphBuiltInParameters(),
+      disableBuildCache: this.#disableBuildCache,
+      allowOversubscription: this.#allowOversubscription
+    });
+  }
+
+  /**
+   * The contents of `getEngineGraphIdentity` for the specified phases that the command sets, keyed by what each
+   * describes, so that the parameters and settings that differ between two commands can be named, with the
+   * commands that set them: `--name for "phase"` for the arguments that a phase's parameter adds, the name of a
+   * global or built-in parameter, or `name to value in command-line.json` for a setting that is not the default.
+   * A parameter that the command does not set (false, empty or absent) has no part.
+   */
+  public getEngineGraphIdentityParts(phaseNames: ReadonlySet<string>): ReadonlyMap<string, string> {
+    const parts: Map<string, string> = new Map(
+      Object.entries(this.parser.getParameterStringMap()).filter(([, value]) => isParameterValueSet(value))
+    );
+    for (const phaseName of phaseNames) {
+      for (const parameter of this.#phases.get(phaseName)?.associatedParameters ?? []) {
+        const argumentList: string[] = [];
+        parameter.appendToArgList(argumentList);
+        if (argumentList.length > 0) {
+          parts.set(`${parameter.longName} for "${phaseName}"`, JSON.stringify(argumentList));
+        }
+      }
+    }
+    for (const [name, value] of this.#getEngineGraphBuiltInParameters()) {
+      parts.set(name, value);
+    }
+    if (this.#disableBuildCache) {
+      parts.set('disableBuildCache to true in command-line.json', 'true');
+    }
+    if (!this.#allowOversubscription) {
+      parts.set('allowOversubscription to false in command-line.json', 'false');
+    }
+    return parts;
+  }
+
+  /**
+   * The arguments of the custom parameters of this command that are associated with none of the specified phases,
+   * as JSON. They cannot affect the operations of these phases, but a plugin that is initialized for this command can
+   * read them, so an engine serves another request of the same command only if they are equal.
+   */
+  public getEngineCustomParameterIdentity(phaseNames: ReadonlySet<string>): string {
+    const argumentList: string[] = [];
+    for (const parameter of this.#getCustomParametersOfNoPhase(phaseNames)) {
+      parameter.appendToArgList(argumentList);
+    }
+    return JSON.stringify(argumentList);
+  }
+
+  /** The arguments in `getEngineCustomParameterIdentity`, keyed by the name of the parameter that adds them. */
+  public getEngineCustomParameterIdentityParts(phaseNames: ReadonlySet<string>): ReadonlyMap<string, string> {
+    const parts: Map<string, string> = new Map();
+    for (const parameter of this.#getCustomParametersOfNoPhase(phaseNames)) {
+      const argumentList: string[] = [];
+      parameter.appendToArgList(argumentList);
+      if (argumentList.length > 0) {
+        parts.set(parameter.longName, JSON.stringify(argumentList));
+      }
+    }
+    return parts;
+  }
+
+  /** The set built-in parameters that shape the graph: not selection, request-scoped or shareable ones. */
+  #getEngineGraphBuiltInParameters(): [string, string][] {
+    const excludedNames: Set<string> = new Set([
+      ...this.#selectionParameters.parameterNames,
+      ...ENGINE_REQUEST_SCOPED_PARAMETER_NAMES,
+      ...ENGINE_SHAREABLE_PARAMETER_NAMES
+    ]);
+    for (const parameter of this.customParameters.values()) {
+      excludedNames.add(parameter.scopedLongName ?? parameter.longName);
+    }
+    return Object.entries(this.getParameterStringMap()).filter(
+      ([name, value]) => !excludedNames.has(name) && isParameterValueSet(value)
+    );
+  }
+
+  #getCustomParametersOfNoPhase(phaseNames: ReadonlySet<string>): CommandLineParameter[] {
+    return Array.from(this.customParameters)
+      .filter(
+        ([parameterJson]) =>
+          !parameterJson.associatedPhases?.some((phaseName: string) => phaseNames.has(phaseName))
+      )
+      .map(([, parameter]) => parameter);
+  }
+
   /**
    * Output verbosity and scheduling settings for one engine request. These are excluded from
    * `getEngineParameterIdentity` and must be applied to the shared graph before each iteration.
@@ -397,10 +618,32 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   public getEngineRequestSettings(): IPhasedCommandEngineRequestSettings {
     return {
       quietMode: !this.#verboseParameter.value,
-      parallelism: this.#enableParallelism ? parseParallelism(this.#parallelismParameter?.value) : 1
+      parallelism: this.#getParallelism(),
+      isIncrementalBuildAllowed: this.#isEngineIncrementalBuildAllowed
     };
   }
 
+  /**
+   * The `--parallelism` value, else the `RUSH_PARALLELISM` default, or 1 if the command does not run in parallel.
+   * An engine parser takes the default from the request's environment, because the host process belongs to no
+   * request; on Windows its name is matched case-insensitively, like `process.env`.
+   */
+  #getParallelism(): Parallelism {
+    if (!this.#enableParallelism) return 1;
+    const engineEnvironment: Readonly<Record<string, string | undefined>> | undefined =
+      this.#engineEnvironment;
+    let value: string | undefined = this.#parallelismParameter?.value;
+    if (value === undefined && engineEnvironment) {
+      const name: string = EnvironmentVariableNames.RUSH_PARALLELISM;
+      const key: string | undefined =
+        process.platform === 'win32'
+          ? Object.keys(engineEnvironment).find((candidate: string) => candidate.toUpperCase() === name)
+          : name;
+      value = key === undefined ? undefined : engineEnvironment[key];
+    }
+    return parseParallelism(value);
+  }
+
   public async selectEngineOperationsAsync(
     graph: IOperationGraph
   ): Promise<ReadonlyMap<Operation, OperationEnabledState>> {
@@ -443,18 +686,44 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     return selected;
   }
 
-  public async createEngineAsync(): Promise<IPhasedCommandEngine> {
+  /** The command-scoped fields of this command's phased telemetry entries. */
+  public getTelemetryFields(): IPhasedCommandTelemetryFields {
+    const changedProjectsOnlyParameter: CommandLineFlagParameter | undefined =
+      this.#changedProjectsOnlyParameter;
+    return {
+      changedProjectsOnlyKey:
+        changedProjectsOnlyParameter?.scopedLongName ?? changedProjectsOnlyParameter?.longName,
+      changedProjectsOnly: !!changedProjectsOnlyParameter?.value,
+      initialExtraData: {
+        // Fields preserved across the command invocation
+        ...this.#selectionParameters.getTelemetry(),
+        ...this.getParameterStringMap()
+      },
+      nameForLog: this.actionName
+    };
+  }
+
+  /**
+   * Prepares an engine through the native pipeline, with every project selected.
+   *
+   * @param abortSignal - Once aborted, the preparation stops before its next step and rejects with the signal's
+   * reason; see `PhasedCommandEngine.createEngineAsync`.
+   */
+  public async createEngineAsync(abortSignal?: AbortSignal): Promise<IPhasedCommandEngine> {
     this.validateEngineCommand();
     await this.initializePluginsAsync();
     let engine: IPhasedCommandEngine | undefined;
     await this.#runAsync((result) => {
       engine = result;
-    });
+    }, abortSignal);
     if (!engine) throw new Error('Native command preparation did not produce an operation graph.');
     return engine;
   }
 
-  async #runAsync(onEngine?: (engine: IPhasedCommandEngine) => void): Promise<void> {
+  async #runAsync(
+    onEngine?: (engine: IPhasedCommandEngine) => void,
+    abortSignal?: AbortSignal
+  ): Promise<void> {
     // Initialize the stopwatch's start time at 0 (process startup).
     const stopwatch: Stopwatch = Stopwatch.start(0);
 
@@ -488,6 +757,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     }
 
     await this.#validateInstallStateAsync();
+    abortSignal?.throwIfAborted();
 
     measureFn(`${PERF_PREFIX}:doBeforeTask`, () => this.#doBeforeTask());
 
@@ -501,9 +771,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     // if this is parallelizable, then use the value from the flag (undefined or a number),
     // if parallelism is not enabled, then restrict to 1 core
     const maxParallelism: number = getNumberOfCores();
-    const parallelism: Parallelism = this.#enableParallelism
-      ? parseParallelism(this.#parallelismParameter?.value)
-      : 1;
+    const parallelism: Parallelism = this.#getParallelism();
 
     await measureAsyncFn(`${PERF_PREFIX}:applyStandardPlugins`, async () => {
       // Generates the default operation graph
@@ -564,6 +832,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         await hookForAction.promise(this);
       });
     }
+    abortSignal?.throwIfAborted();
 
     const isQuietMode: boolean = !this.#verboseParameter.value;
 
@@ -591,8 +860,11 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     const generateFullGraph: boolean = !!onEngine || (isWatch && this.#includeAllProjectsInWatchGraph);
     let transferredEngine: boolean = false;
     let ownedGraph: OperationGraph | undefined;
+    let stopOnClosedOutput: (() => void) | undefined;
 
     try {
+      // Inside the try block, so that the cobuild lock provider is destroyed.
+      abortSignal?.throwIfAborted();
       const projectSelection: Set<RushConfigurationProject> = await measureAsyncFn(
         `${PERF_PREFIX}:getSelectedProjects`,
         () =>
@@ -624,6 +896,24 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           );
           new DaemonIpcOperationRunnerPlugin().apply(this.hooks);
         }
+        if (
+          onEngine &&
+          this.#isIncrementalBuildAllowed &&
+          this.rushConfiguration.daemon.incrementalBuilds &&
+          !cobuildConfiguration?.cobuildFeatureEnabled
+        ) {
+          const { IncrementalExecutionGuardPlugin } = await import(
+            /* webpackChunkName: 'IncrementalExecutionGuardPlugin' */ '../../logic/operations/IncrementalExecutionGuardPlugin'
+          );
+          new IncrementalExecutionGuardPlugin().apply(this.hooks);
+          if (this.rushConfiguration.daemon.warmWorkers && !this.#noIPCParameter?.value) {
+            // Applied after DaemonIpcOperationRunnerPlugin, so that an explicit IPC tool keeps its runner.
+            const { DaemonWarmWorkerPlugin } = await import(
+              /* webpackChunkName: 'DaemonWarmWorkerPlugin' */ '../../logic/operations/DaemonWarmWorkerPlugin'
+            );
+            new DaemonWarmWorkerPlugin().apply(this.hooks);
+          }
+        }
         if (isWatch && this.#noIPCParameter?.value === false) {
           new (
             await import(
@@ -644,6 +934,11 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           },
           isPnpm
         } = this.rushConfiguration;
+        if (buildCacheConfiguration?.buildCacheEnabled || this.#disableBuildCache) {
+          // These strategies change outputs without updating the records of legacy skip detection, which a
+          // later command without the build cache would otherwise trust.
+          new LegacySkipInvalidationPlugin().apply(this.hooks);
+        }
         if (buildCacheConfiguration?.buildCacheEnabled) {
           terminal.writeVerboseLine(`Incremental strategy: cache restoration`);
           new CacheableOperationPlugin({
@@ -652,7 +947,12 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             cobuildConfiguration,
             terminal,
             excludeAppleDoubleFiles,
-            useDirectFileTransfersForBuildCache
+            useDirectFileTransfersForBuildCache,
+            // The writes outlive the engine, which a reload replaces.
+            deferredCacheEntryWrites:
+              onEngine && this.rushConfiguration.daemon.deferCacheWrites
+                ? DeferredCacheEntryWrites.instance
+                : undefined
           }).apply(this.hooks);
 
           if (this.#debugBuildCacheIdsParameter.value) {
@@ -690,6 +990,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         }
       });
 
+      abortSignal?.throwIfAborted();
       const relevantProjects: Set<RushConfigurationProject> = generateFullGraph
         ? new Set(this.rushConfiguration.projects)
         : Selection.expandAllDependencies(projectSelection);
@@ -699,7 +1000,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         ? new Map()
         : await measureAsyncFn(`${PERF_PREFIX}:loadProjectConfigurations`, () =>
             onEngine
-              ? RushProjectConfiguration._tryLoadForProjectsUncachedAsync(relevantProjects, terminal)
+              ? this.#loadEngineProjectConfigurationsAsync(relevantProjects, terminal)
               : RushProjectConfiguration.tryLoadForProjectsAsync(relevantProjects, terminal)
           );
       const projectConfigurationIdentity: string | undefined = onEngine
@@ -708,6 +1009,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             this.rushConfiguration.daemon.usePersistentIpcRunners
           )
         : undefined;
+      abortSignal?.throwIfAborted();
 
       const includePhaseDeps: boolean = this.#includePhaseDeps?.value ?? false;
 
@@ -717,7 +1019,9 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         customParameters: customParametersByName,
         changedProjectsOnly,
         includePhaseDeps,
-        isIncrementalBuildAllowed: this.#isIncrementalBuildAllowed,
+        isIncrementalBuildAllowed: onEngine
+          ? this.#isEngineIncrementalBuildAllowed
+          : this.#isIncrementalBuildAllowed,
         isWatch,
         rushConfiguration: this.rushConfiguration,
         parallelism,
@@ -734,6 +1038,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
       const operations: Set<Operation> = await measureAsyncFn(`${PERF_PREFIX}:createOperations`, () =>
         this.hooks.createOperationsAsync.promise(new Set(), createOperationsContext)
       );
+      abortSignal?.throwIfAborted();
 
       const [getInputsSnapshotAsync, initialSnapshot] = await measureAsyncFn(
         `${PERF_PREFIX}:analyzeRepoState`,
@@ -748,7 +1053,13 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
               projectConfigurations,
               terminal,
               // We need to include all dependencies, otherwise build cache id calculation will be incorrect
-              relevantProjects
+              relevantProjects,
+              {
+                // An engine cannot continue without a snapshot, so it reports why none could be taken.
+                throwOnMissingProjectShrinkwrapFile: !!onEngine,
+                // An engine takes a snapshot for each request
+                reuseUnchangedInputs: !!onEngine
+              }
             );
           const innerInitialSnapshot: IInputsSnapshot | undefined = innerGetInputsSnapshotAsync
             ? await innerGetInputsSnapshotAsync()
@@ -760,21 +1071,16 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           return [innerGetInputsSnapshotAsync, innerInitialSnapshot];
         }
       );
+      abortSignal?.throwIfAborted();
 
       let executionTelemetryHandler: IOperationGraphTelemetry | undefined;
       const { telemetry: parserTelemetry } = this.parser;
       if (parserTelemetry) {
-        const changedProjectsOnlyParameter: CommandLineFlagParameter | undefined =
-          this.#changedProjectsOnlyParameter;
+        const { changedProjectsOnlyKey, initialExtraData, nameForLog } = this.getTelemetryFields();
         executionTelemetryHandler = {
-          changedProjectsOnlyKey:
-            changedProjectsOnlyParameter?.scopedLongName ?? changedProjectsOnlyParameter?.longName,
-          initialExtraData: {
-            // Fields preserved across the command invocation
-            ...this.#selectionParameters.getTelemetry(),
-            ...this.getParameterStringMap()
-          },
-          nameForLog: this.actionName,
+          changedProjectsOnlyKey,
+          initialExtraData,
+          nameForLog,
           log: (logEntry: ITelemetryData) => {
             parserTelemetry.log(logEntry);
             parserTelemetry.flush();
@@ -784,20 +1090,21 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
 
       const getGraphInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined =
         onEngine && getInputsSnapshotAsync
-          ? async () => {
-              await this.#validateInstallStateAsync();
-              const currentConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
-                await RushProjectConfiguration._tryLoadForProjectsUncachedAsync(relevantProjects, terminal);
-              if (
-                (await getProjectConfigurationIdentityAsync(
-                  currentConfigurations,
-                  this.rushConfiguration.daemon.usePersistentIpcRunners
-                )) !== projectConfigurationIdentity
-              ) {
-                throw new PhasedCommandEngineConfigurationChangedError();
-              }
-              return await getInputsSnapshotAsync();
-            }
+          ? () =>
+              // Git reads the repository state while the configuration is checked
+              runDuringChecksAsync(getInputsSnapshotAsync, async () => {
+                await this.#validateInstallStateAsync();
+                const currentConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+                  await this.#loadEngineProjectConfigurationsAsync(relevantProjects, terminal);
+                if (
+                  (await getProjectConfigurationIdentityAsync(
+                    currentConfigurations,
+                    this.rushConfiguration.daemon.usePersistentIpcRunners
+                  )) !== projectConfigurationIdentity
+                ) {
+                  throw new PhasedCommandEngineConfigurationChangedError();
+                }
+              })
           : getInputsSnapshotAsync;
       const graphOptions: IOperationGraphOptions = {
         quietMode: isQuietMode,
@@ -835,6 +1142,28 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             return result.toObject();
           }
         );
+      } else {
+        // A native command makes one request for each iteration. An engine host invokes this hook itself, once for
+        // each request that it serves.
+        graph.hooks.afterExecuteIterationAsync.tapPromise(
+          { name: 'PhasedScriptAction', stage: Infinity },
+          async (
+            status: OperationStatus,
+            operationResults: ReadonlyMap<Operation, IOperationExecutionResult>
+          ): Promise<OperationStatus> => {
+            if (graph.hooks.afterExecuteRequestAsync.isUsed()) {
+              await graph.hooks.afterExecuteRequestAsync.promise({
+                commandName: this.actionName,
+                environment: process.env,
+                operationResults,
+                requestId: undefined,
+                status,
+                terminal
+              });
+            }
+            return status;
+          }
+        );
       }
 
       const graphContext: IOperationGraphContext = {
@@ -846,6 +1175,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         await hooks.onGraphCreatedAsync.promise(graph, graphContext);
       });
       if (onEngine) {
+        // Before the graph is transferred, so that it is disposed below.
+        abortSignal?.throwIfAborted();
         if (!getGraphInputsSnapshotAsync || !initialSnapshot) {
           throw new Error('The daemon engine requires a Git-backed workspace inputs snapshot.');
         }
@@ -855,7 +1186,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           rushSession: this.rushSession,
           inputsSnapshot: initialSnapshot,
           getInputsSnapshotAsync: getGraphInputsSnapshotAsync,
-          isIncremental: this.#isIncrementalBuildAllowed,
+          isIncremental: this.#isEngineIncrementalBuildAllowed,
           phaseNames: Array.from(new Set(Array.from(operations, (op) => op.associatedPhase.name))).sort(),
           pluginNames: Array.from(
             new Set([
@@ -875,6 +1206,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         terminal.writeLine(`Shutting down Rush...`);
         return await graph.abortCurrentIterationAsync();
       });
+      // After abortPromise listens, because a reader that already exited aborts the session at once.
+      stopOnClosedOutput = this.#stopOnClosedOutput(graph);
       attachReporterOperationEventSink(graph, this.rushSession, this.actionName, isWatch);
 
       const executeOptions: IExecuteOperationsOptions = {
@@ -907,6 +1240,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           rushConfiguration: this.rushConfiguration,
           graph,
           initialSnapshot,
+          getInputsSnapshotAsync,
           terminal: presentationTerminal,
           debounceMs: this.#watchDebounceMs,
           renderStatusInPlace: !_isRushSessionOperationStreamEnabled(this.rushSession)
@@ -918,6 +1252,9 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         });
 
         await abortPromise;
+        // So that Git doesn't read the repository after the command returns: the watcher can still be taking a
+        // snapshot, e.g. to check for edits made during the last iteration.
+        await watcher.waitForSnapshotsAsync();
 
         terminal.writeLine(`Watch mode exited.`);
       } else {
@@ -928,6 +1265,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         );
       }
     } finally {
+      // A reader that exits after the command's operations have settled cancels nothing; the exit code still says so.
+      stopOnClosedOutput?.();
       if (onEngine && !transferredEngine && ownedGraph) {
         await disposeEngineGraphAsync(ownedGraph, cobuildConfiguration);
       } else if (cobuildConfiguration && !transferredEngine) {
@@ -936,6 +1275,47 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     }
   }
 
+  /**
+   * When the process reading the CLI's stdout or stderr exits, for example `head` in `rush build | head -5`, stops
+   * starting operations, as aborting the session does, and says so once on stderr. Operations that already started
+   * finish first: a native command does not start them in their own process groups, so it cannot stop their
+   * process trees. Returns a function that stops listening, or undefined when the parser does not report closures.
+   */
+  #stopOnClosedOutput(graph: OperationGraph): (() => void) | undefined {
+    const standardOutputClosure: StandardOutputClosure | undefined = this.parser.standardOutputClosure;
+    if (!standardOutputClosure) {
+      return undefined;
+    }
+
+    let closedOutput: IClosedStandardOutput | undefined;
+    let iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+    graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'StandardOutputClosure', stage: -Infinity },
+      (records: ReadonlyMap<Operation, IOperationExecutionResult>): OperationStatus | undefined => {
+        iterationRecords = records;
+        // The reader exited before this iteration started, possibly while it was being scheduled: run nothing.
+        return closedOutput ? OperationStatus.Aborted : undefined;
+      }
+    );
+
+    return standardOutputClosure.onClosed((closed: IClosedStandardOutput) => {
+      if (closedOutput) {
+        return;
+      }
+      closedOutput = closed;
+      let operationsRunning: boolean = false;
+      for (const record of iterationRecords?.values() ?? []) {
+        if (record.status === OperationStatus.Executing) {
+          operationsRunning = true;
+          break;
+        }
+      }
+      // Directly to stderr: the terminal may write to the closed stdout, for example through a reporter.
+      process.stderr.write(formatClosedOutputNotice(this.actionName, closed, operationsRunning));
+      this.sessionAbortController.abort();
+    });
+  }
+
   /**
    * Runs a set of operations and reports the results.
    */
@@ -992,6 +1372,23 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     }
   }
 
+  /**
+   * Loads the configuration of every specified project for an engine, which loads projects that a native
+   * command might not select.
+   */
+  async #loadEngineProjectConfigurationsAsync(
+    projects: ReadonlySet<RushConfigurationProject>,
+    terminal: ITerminal
+  ): Promise<ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>> {
+    try {
+      return await RushProjectConfiguration._tryLoadForProjectsUncachedAsync(projects, terminal);
+    } catch (error) {
+      // An incomplete install can leave both a project dependency file and a rig package missing. Without the
+      // file, native Rush cannot analyze the repo state either, so report it: "rush install" fixes both.
+      throw (await tryGetMissingProjectShrinkwrapFileErrorAsync(this.rushConfiguration)) ?? error;
+    }
+  }
+
   async #validateInstallStateAsync(): Promise<void> {
     if (!this._runsBeforeInstall) {
       await measureAsyncFn(`${PERF_PREFIX}:checkInstallFlag`, async () => {
@@ -1018,10 +1415,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   }
 
   #doBeforeTask(): void {
-    if (
-      this.actionName !== RushConstants.buildCommandName &&
-      this.actionName !== RushConstants.rebuildCommandName
-    ) {
+    if (!this.#runsBuildEventHooks()) {
       // Only collects information for built-in commands like build or rebuild.
       return;
     }
@@ -1032,15 +1426,25 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   }
 
   #doAfterTask(): void {
-    if (
-      this.actionName !== RushConstants.buildCommandName &&
-      this.actionName !== RushConstants.rebuildCommandName
-    ) {
+    if (!this.#runsBuildEventHooks()) {
       // Only collects information for built-in commands like build or rebuild.
       return;
     }
     this.eventHooksManager.handle(Event.postRushBuild, this.parser.isDebug, this.#ignoreHooksParameter.value);
   }
+
+  /** Whether this command runs the preRushBuild/postRushBuild event hooks, which only build and rebuild do. */
+  #runsBuildEventHooks(): boolean {
+    return (
+      this.actionName === RushConstants.buildCommandName ||
+      this.actionName === RushConstants.rebuildCommandName
+    );
+  }
+}
+
+/** `getParameterStringMap` maps an unset flag to "false", an unset list to "" and other unset values to undefined. */
+function isParameterValueSet(value: string | undefined): boolean {
+  return value !== undefined && value !== 'false' && value !== '';
 }
 
 async function getProjectConfigurationIdentityAsync(
diff --git a/libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts b/libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts
new file mode 100644
index 00000000000..d350650a8c4
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts
@@ -0,0 +1,239 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { execFileSync, spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { Rush } from '../../api/Rush';
+
+// These tests spawn the Rush CLI, which runs real operations.
+jest.setTimeout(60000);
+
+const START_PATH: string = path.resolve(__dirname, '../../../lib-commonjs/start.js');
+
+function writeFile(folder: string, name: string, text: string): void {
+  const filename: string = path.join(folder, name);
+  fs.mkdirSync(path.dirname(filename), { recursive: true });
+  fs.writeFileSync(filename, text);
+}
+
+/**
+ * A repo with projects `a` and `b`, where `b` depends on `a`. Operation `a` prints `tick-<n>` every 50 ms for about
+ * 2 s. Each operation appends its progress to `runs.txt` in the repo folder.
+ */
+function createRepo(): string {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-closed-output-'));
+  writeFile(
+    folder,
+    'rush.json',
+    JSON.stringify({
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: ['a', 'b'].map((name) => ({ packageName: name, projectFolder: name }))
+    })
+  );
+  writeFile(folder, '.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\n');
+  writeFile(folder, 'common/temp/last-link.flag', '{}');
+  writeFile(folder, 'common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
+  writeFile(
+    folder,
+    'common/config/rush/command-line.json',
+    JSON.stringify({
+      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          phases: ['_phase:compile'],
+          enableParallelism: true,
+          incremental: true
+        }
+      ]
+    })
+  );
+  for (const name of ['a', 'b']) {
+    writeFile(
+      folder,
+      `${name}/package.json`,
+      JSON.stringify({
+        name,
+        version: '1.0.0',
+        scripts: { '_phase:compile': 'node build.cjs' },
+        dependencies: name === 'b' ? { a: '1.0.0' } : {}
+      })
+    );
+  }
+  writeFile(
+    folder,
+    'a/build.cjs',
+    "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a:start\\n');let n=0;" +
+      "const t=setInterval(()=>{console.log('tick-'+ ++n);if(n===40){clearInterval(t);" +
+      "fs.appendFileSync('../runs.txt','a:done\\n');}},50);"
+  );
+  writeFile(folder, 'b/build.cjs', "require('node:fs').appendFileSync('../runs.txt','b:start\\n');");
+  execFileSync('git', ['init', '--quiet'], { cwd: folder, stdio: 'pipe' });
+  execFileSync('git', ['add', '.'], { cwd: folder, stdio: 'pipe' });
+  execFileSync(
+    'git',
+    [
+      '-c',
+      'user.name=Rush test',
+      '-c',
+      'user.email=rush-test@example.com',
+      '-c',
+      'commit.gpgSign=false',
+      'commit',
+      '--quiet',
+      '-m',
+      'Initialize closed output fixture'
+    ],
+    { cwd: folder, stdio: 'pipe' }
+  );
+  return folder;
+}
+
+interface IRushProcess {
+  readonly child: ChildProcess;
+  readonly closed: Promise<unknown[]>;
+  /** Lines of stderr that mention a cancellation, a closed stream or a crash. */
+  readonly getReportLines: () => string[];
+  readonly getRuns: () => string | undefined;
+}
+
+function startRush(folder: string, closedStreams: 'none' | 'stdout' | 'both'): IRushProcess {
+  const environment: NodeJS.ProcessEnv = { ...process.env, RUSH_REPORTER: 'legacy' };
+  for (const name of ['CI', 'TF_BUILD', 'GITHUB_ACTIONS', 'RUSH_PARALLELISM', 'RUSH_DAEMON']) {
+    delete environment[name];
+  }
+  const child: ChildProcess = spawn(process.execPath, [START_PATH, 'build', '--to', 'b', '--verbose'], {
+    cwd: folder,
+    env: environment,
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+  const closed: Promise<unknown[]> = once(child, 'close');
+  let errors: string = '';
+  if (closedStreams === 'both') {
+    // The readers exit before Rush writes anything, as when `rush build 2>&1 | true` runs.
+    child.stdout!.destroy();
+    child.stderr!.destroy();
+  } else {
+    child.stderr!.on('data', (bytes: Buffer) => {
+      errors += bytes.toString();
+    });
+    if (closedStreams === 'stdout') {
+      child.stdout!.destroy();
+    } else {
+      child.stdout!.resume();
+    }
+  }
+  return {
+    child,
+    closed,
+    getReportLines: () =>
+      errors.split('\n').filter((line) => /cancel|EPIPE|ECONNRESET|Unhandled|Error/i.test(line)),
+    getRuns: () => {
+      const filename: string = path.join(folder, 'runs.txt');
+      return fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8') : undefined;
+    }
+  };
+}
+
+describe('The Rush CLI with a stdout reader that exits', () => {
+  const folders: string[] = [];
+  const children: ChildProcess[] = [];
+
+  function track(rush: IRushProcess): IRushProcess {
+    children.push(rush.child);
+    return rush;
+  }
+
+  function createTrackedRepo(): string {
+    const folder: string = createRepo();
+    folders.push(folder);
+    return folder;
+  }
+
+  afterEach(async () => {
+    for (const child of children.splice(0)) {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill('SIGTERM');
+        await once(child, 'close');
+      }
+    }
+    for (const folder of folders.splice(0)) {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('stops starting operations, lets the running one finish, and exits with 141', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'none'));
+    const { child } = rush;
+    // Stops reading at the operation's first line, as `grep -m1 tick-` would.
+    let output: string = '';
+    await new Promise<void>((resolve, reject) => {
+      child.stdout!.on('data', (bytes: Buffer) => {
+        output += bytes.toString();
+        if (output.includes('tick-')) {
+          child.stdout!.destroy();
+          resolve();
+        }
+      });
+      rush.closed.then(
+        () => reject(new Error(`The build ended before its output arrived: ${output}`)),
+        reject
+      );
+    });
+
+    expect(await rush.closed).toEqual([141, null]);
+    // A socket (here) may report ECONNRESET where a shell's pipe reports EPIPE.
+    expect(rush.getReportLines()).toEqual([
+      expect.stringMatching(
+        /^rush: build cancelled, because the process reading its stdout exited \((EPIPE|ECONNRESET)\)\. Operations that already started will finish first\.$/
+      )
+    ]);
+    // "a" finished before Rush exited, and "b" never started.
+    expect(rush.getRuns()).toBe('a:start\na:done\n');
+
+    // The cancelled build left nothing behind that stops the next one from building "b".
+    fs.rmSync(path.join(folder, 'runs.txt'));
+    const next: IRushProcess = track(startRush(folder, 'none'));
+    expect(await next.closed).toEqual([0, null]);
+    expect(next.getReportLines()).toEqual([]);
+    expect(next.getRuns()).toMatch(/(^|\n)b:start\n$/);
+  });
+
+  it('runs no operation when the reader exits before the build starts, and exits with 141', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'stdout'));
+
+    expect(await rush.closed).toEqual([141, null]);
+    expect(rush.getReportLines()).toEqual([
+      expect.stringMatching(
+        /^rush: build cancelled, because the process reading its stdout exited \((EPIPE|ECONNRESET)\)\.$/
+      )
+    ]);
+    expect(rush.getRuns()).toBeUndefined();
+  });
+
+  it('exits with 141 when the readers of both stdout and stderr exit', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'both'));
+
+    expect(await rush.closed).toEqual([141, null]);
+    expect(rush.getRuns()).toBeUndefined();
+  });
+
+  it('runs the whole build when the reader keeps reading, as `| cat` does', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'none'));
+
+    expect(await rush.closed).toEqual([0, null]);
+    expect(rush.getReportLines()).toEqual([]);
+    expect(rush.getRuns()).toBe('a:start\na:done\nb:start\n');
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
index 6a7920715ee..db15266114b 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
@@ -32,17 +32,25 @@ import type { SpawnOptions } from 'node:child_process';
 import { FileSystem, JsonFile, LockFile, Path } from '@rushstack/node-core-library';
 import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
 import type { IReporterEmitEventInput, IReporterEventSink } from '@rushstack/rush-reporter';
+import type { CommandLineAction } from '@rushstack/ts-command-line';
+import { RushConfiguration } from '../../api/RushConfiguration';
 import { Autoinstaller } from '../../logic/Autoinstaller';
+import type { IOperationGraphRequestResult } from '../../logic/operations/IOperationGraph';
+import { OperationStatus } from '../../logic/operations/OperationStatus';
+import type { IRepositoryLockWait } from '../../logic/RepositoryLockWait';
 import type { ITelemetryData } from '../../logic/Telemetry';
+import type { RushCommandLineParser as RushCommandLineParserType } from '../RushCommandLineParser';
 import {
   getCommandLineParserInstanceAsync,
+  setSpawnMock,
+  type IParserTestInstance,
   type SpawnMockArgs,
   type SpawnMockCall,
   isolateEnvironmentConfigurationForTests,
   type IEnvironmentConfigIsolation
 } from './TestUtils';
 import { IS_WINDOWS } from '../../utilities/executionUtilities';
-import { AnsiEscape } from '@rushstack/terminal';
+import { AnsiEscape, StringBufferTerminalProvider } from '@rushstack/terminal';
 
 // Ordinals into the `mock.calls` array referencing each of the arguments to `spawn`. Note that
 // the exact structure of these arguments differs between Windows and non-Windows platforms, so
@@ -110,6 +118,30 @@ async function expectInitializationFailureAsync(repoName: string, expectedMessag
   }
 }
 
+function captureRequestResults(parser: IParserTestInstance['parser']): IOperationGraphRequestResult[] {
+  const requests: IOperationGraphRequestResult[] = [];
+  parser.rushSession.hooks.runAnyPhasedCommand.tap('RequestHookTest', (command) => {
+    command.hooks.onGraphCreatedAsync.tap('RequestHookTest', (graph) => {
+      graph.hooks.afterExecuteRequestAsync.tapPromise(
+        'RequestHookTest',
+        async (request: IOperationGraphRequestResult) => {
+          requests.push(request);
+        }
+      );
+    });
+  });
+  return requests;
+}
+
+function getStatusByProjectName(request: IOperationGraphRequestResult): Record<string, OperationStatus> {
+  return Object.fromEntries(
+    Array.from(request.operationResults, ([operation, { status }]) => [
+      operation.associatedProject.packageName,
+      status
+    ])
+  );
+}
+
 describe('RushCommandLineParser', () => {
   describe('execute', () => {
     let _envIsolation: IEnvironmentConfigIsolation;
@@ -264,6 +296,237 @@ describe('RushCommandLineParser', () => {
             lockSpy.mockRestore();
           }
         });
+
+        // The file's default timeout is about 17 minutes, so each lock-wait test, which takes a few seconds, sets
+        // its own: a wait that never ends then fails the test in a minute.
+        it('waits for the lock until the deadline that rush-client set, and names the daemon that holds it', async () => {
+          const daemonPid: number = process.pid + 1;
+          const deadlineMs: number = Date.now() + 60000;
+          process.env._RUSH_LOCK_WAIT_DEADLINE = `${deadlineMs}`;
+          process.env._RUSH_LOCK_WAIT_DAEMON_PID = `${daemonPid}`;
+          const reporterSink: CapturingReporterSink = new CapturingReporterSink();
+          let attempts: number = 0;
+          const lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire> = jest
+            .spyOn(LockFile, 'tryAcquire')
+            .mockImplementation(() => {
+              // The wait below tries every 100 ms for 300 ms. One that never stopped would outlive this test.
+              if (++attempts > 100) throw new Error(`tryAcquire was called ${attempts} times`);
+              return undefined;
+            });
+          const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
+            .spyOn(process, 'exit')
+            .mockImplementation(() => undefined as never);
+          try {
+            const { parser } = await getCommandLineParserInstanceAsync(
+              'basicAndRunBuildActionRepo',
+              'build',
+              {
+                eventSink: reporterSink,
+                sessionId: 'parser-lock-wait-expired',
+                operationStreamEnabled: true
+              }
+            );
+            // The command's operations must not inherit the wait.
+            expect(process.env._RUSH_LOCK_WAIT_DEADLINE).toBeUndefined();
+            expect(process.env._RUSH_LOCK_WAIT_DAEMON_PID).toBeUndefined();
+            expect(parser.repositoryLockWait).toEqual({ deadlineMs, daemonPid });
+            // A deadline that starts now does not depend on how long the parser took to start.
+            const shortDeadlineMs: number = Date.now() + 300;
+            (parser as unknown as { repositoryLockWait: IRepositoryLockWait }).repositoryLockWait = {
+              deadlineMs: shortDeadlineMs,
+              daemonPid
+            };
+            FileSystem.writeFile(
+              `${parser.rushConfiguration.commonTempFolder}/rush#${daemonPid}.lock`,
+              'start time',
+              { ensureFolderExists: true }
+            );
+
+            await parser.executeAsync();
+            await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+
+            expect(Date.now()).toBeGreaterThanOrEqual(shortDeadlineMs);
+            expect(
+              lockSpy.mock.calls.filter(([, resourceName]) => resourceName === 'rush').length
+            ).toBeGreaterThan(1);
+            const messages: unknown[] = reporterSink.inputs
+              .filter(({ type }) => type === 'messageEmitted')
+              .map(({ payload }) => payload);
+            expect(messages).toContainEqual(
+              expect.objectContaining({
+                severity: 'warning',
+                text: expect.stringContaining(
+                  `Waiting up to 1 s for the Rush daemon (PID ${daemonPid}) to release this repository's lock.`
+                )
+              })
+            );
+            expect(messages).toContainEqual(
+              expect.objectContaining({
+                severity: 'error',
+                text: expect.stringContaining(
+                  'Another Rush command is already running in this repository. ' +
+                    `The Rush daemon (PID ${daemonPid}) still holds this repository's lock.`
+                )
+              })
+            );
+          } finally {
+            delete process.env._RUSH_LOCK_WAIT_DEADLINE;
+            delete process.env._RUSH_LOCK_WAIT_DAEMON_PID;
+            exitSpy.mockRestore();
+            lockSpy.mockRestore();
+          }
+        }, 60000);
+
+        it('runs the command once the lock is released before the deadline that rush-client set', async () => {
+          process.env._RUSH_LOCK_WAIT_DEADLINE = `${Date.now() + 60000}`;
+          const reporterSink: CapturingReporterSink = new CapturingReporterSink();
+          const lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire> = jest
+            .spyOn(LockFile, 'tryAcquire')
+            .mockReturnValueOnce(undefined)
+            .mockReturnValueOnce(undefined);
+          // A command that fails exits the process, which would end this test file instead of this test.
+          const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
+            .spyOn(process, 'exit')
+            .mockImplementation(() => undefined as never);
+          try {
+            const { parser } = await getCommandLineParserInstanceAsync(
+              'basicAndRunBuildActionRepo',
+              'build',
+              {
+                eventSink: reporterSink,
+                sessionId: 'parser-lock-wait-released',
+                operationStreamEnabled: true
+              }
+            );
+
+            await expect(parser.executeAsync()).resolves.toEqual(true);
+
+            expect(exitSpy).not.toHaveBeenCalled();
+            expect(lockSpy.mock.calls.filter(([, resourceName]) => resourceName === 'rush')).toHaveLength(3);
+            expect(reporterSink.inputs).toContainEqual(
+              expect.objectContaining({
+                type: 'messageEmitted',
+                payload: expect.objectContaining({
+                  severity: 'warning',
+                  text: expect.stringMatching(
+                    /Waiting up to \d+ s for another Rush process to release this repository's lock\./
+                  )
+                })
+              })
+            );
+            expect(reporterSink.inputs.at(-3)?.payload).toMatchObject({ succeeded: true, exitCode: 0 });
+          } finally {
+            delete process.env._RUSH_LOCK_WAIT_DEADLINE;
+            exitSpy.mockRestore();
+            lockSpy.mockRestore();
+          }
+        }, 60000);
+
+        it('leaves the wait that rush-client set alone in an engine host, whose environment is not the request', async () => {
+          process.env._RUSH_LOCK_WAIT_DEADLINE = '1000';
+          process.env._RUSH_LOCK_WAIT_DAEMON_PID = '42';
+          try {
+            const { RushCommandLineParser } = await import('../RushCommandLineParser');
+            const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+              `${__dirname}/basicAndRunBuildActionRepo/rush.json`
+            );
+            const parser: RushCommandLineParserType = new RushCommandLineParser({
+              cwd: rushConfiguration.rushJsonFolder,
+              engine: { rushConfiguration, terminalProvider: new StringBufferTerminalProvider() }
+            });
+
+            expect(parser.repositoryLockWait).toBeUndefined();
+            expect(process.env._RUSH_LOCK_WAIT_DEADLINE).toBe('1000');
+            expect(process.env._RUSH_LOCK_WAIT_DAEMON_PID).toBe('42');
+          } finally {
+            delete process.env._RUSH_LOCK_WAIT_DEADLINE;
+            delete process.env._RUSH_LOCK_WAIT_DAEMON_PID;
+          }
+        });
+
+        it('invokes afterExecuteRequestAsync once, after afterExecuteIterationAsync, with the command results', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync('basicAndRunBuildActionRepo', 'build');
+          const hookOrder: string[] = [];
+          const requests: IOperationGraphRequestResult[] = [];
+          parser.rushSession.hooks.runAnyPhasedCommand.tap('RequestHookTest', (command) => {
+            command.hooks.onGraphCreatedAsync.tap('RequestHookTest', (graph) => {
+              graph.hooks.afterExecuteIterationAsync.tap(
+                { name: 'RequestHookTest', stage: Number.MAX_SAFE_INTEGER },
+                (status: OperationStatus) => {
+                  hookOrder.push('afterExecuteIterationAsync');
+                  return status;
+                }
+              );
+              graph.hooks.afterExecuteRequestAsync.tapPromise(
+                'RequestHookTest',
+                async (request: IOperationGraphRequestResult) => {
+                  hookOrder.push('afterExecuteRequestAsync');
+                  requests.push(request);
+                }
+              );
+            });
+          });
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(hookOrder).toEqual(['afterExecuteIterationAsync', 'afterExecuteRequestAsync']);
+          expect(requests).toHaveLength(1);
+          const [request] = requests;
+          expect(request).toMatchObject({
+            commandName: 'build',
+            requestId: undefined,
+            status: OperationStatus.Success
+          });
+          expect(request.environment).toBe(process.env);
+          expect(request.terminal).toBeDefined();
+          expect(Array.from(request.operationResults.values(), ({ status }) => status)).toEqual([
+            OperationStatus.Success,
+            OperationStatus.Success
+          ]);
+        });
+
+        it('invokes afterExecuteRequestAsync with the Failure status when an operation fails', async () => {
+          const originalExitCode: typeof process.exitCode = process.exitCode;
+          let onExit!: () => void;
+          const exited: Promise<void> = new Promise<void>((resolve: () => void) => {
+            onExit = resolve;
+          });
+          // Rush exits after it reports the failure, so wait for that before restoring process.exit.
+          const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
+            .spyOn(process, 'exit')
+            .mockImplementation((): never => {
+              onExit();
+              return undefined as never;
+            });
+          const stderrSpy: jest.SpiedFunction<typeof process.stderr.write> = jest
+            .spyOn(process.stderr, 'write')
+            .mockImplementation(() => true);
+          try {
+            const { parser } = await getCommandLineParserInstanceAsync('basicAndRunBuildActionRepo', 'build');
+            const requests: IOperationGraphRequestResult[] = captureRequestResults(parser);
+            setSpawnMock({ emitError: false, returnCode: 1 });
+
+            await parser.executeAsync();
+            await exited;
+
+            expect(exitSpy).toHaveBeenCalledWith(1);
+            expect(requests).toHaveLength(1);
+            const [request] = requests;
+            expect(request).toMatchObject({
+              commandName: 'build',
+              requestId: undefined,
+              status: OperationStatus.Failure
+            });
+            expect(getStatusByProjectName(request)).toEqual({
+              a: OperationStatus.Failure,
+              b: OperationStatus.Blocked
+            });
+          } finally {
+            stderrSpy.mockRestore();
+            exitSpy.mockRestore();
+            process.exitCode = originalExitCode;
+          }
+        });
       });
 
       describe("'custom-output' action", () => {
@@ -296,6 +559,64 @@ describe('RushCommandLineParser', () => {
         });
       });
 
+      describe("'custom-short-name' action", () => {
+        it('accepts a custom parameter by its long name when its short name is also the global -d', async () => {
+          const { parser, repoPath } = await getCommandLineParserInstanceAsync(
+            'basicAndRunBuildActionRepo',
+            'custom-short-name'
+          );
+          process.argv.push('--stale-after-days', '3');
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(JsonFile.load(`${repoPath}/custom-output-args.json`)).toEqual(['--stale-after-days', '3']);
+        });
+      });
+
+      describe("'update-cloud-credentials' action", () => {
+        it('accepts --delete, whose short name -d is also the global --debug parameter', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync(
+            'basicAndRunBuildActionRepo',
+            'update-cloud-credentials'
+          );
+          process.argv.push('--delete');
+          const action: CommandLineAction = parser.getAction('update-cloud-credentials');
+          // Stop before the action loads the build cache configuration, which this repo doesn't have
+          const runSpy: jest.SpyInstance = jest
+            .spyOn(action as unknown as { runAsync(): Promise<void> }, 'runAsync')
+            .mockResolvedValue(undefined);
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(runSpy).toHaveBeenCalledTimes(1);
+          expect(action.getFlagParameter('--delete').value).toBe(true);
+          expect(parser.getFlagParameter('--debug').value).toBe(false);
+        });
+
+        it('reports -d after the action name as ambiguous', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync(
+            'basicAndRunBuildActionRepo',
+            'update-cloud-credentials'
+          );
+          process.argv.push('-d');
+          const originalExitCode: string | number | undefined = process.exitCode;
+          const errorSpy: jest.SpyInstance = jest.spyOn(console, 'error').mockImplementation(() => undefined);
+          const logSpy: jest.SpyInstance = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+          try {
+            await expect(parser.executeAsync()).resolves.toEqual(false);
+
+            expect(process.exitCode).toBe(1);
+            expect(errorSpy).toHaveBeenCalledWith(
+              'Error: rush update-cloud-credentials: error: Ambiguous option: "-d".\n'
+            );
+          } finally {
+            errorSpy.mockRestore();
+            logSpy.mockRestore();
+            process.exitCode = originalExitCode;
+          }
+        });
+      });
+
       describe("'rebuild' action", () => {
         it(`executes the package's 'build' script`, async () => {
           const repoName: string = 'basicAndRunRebuildActionRepo';
@@ -321,6 +642,28 @@ describe('RushCommandLineParser', () => {
           expectSpawnToMatchRegexp(secondSpawn, expectedBuildTaskRegexp);
           cwdOptionEquals(secondSpawn, `${repoPath}/b`);
         });
+
+        it('invokes afterExecuteRequestAsync with the rebuild command name', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync(
+            'basicAndRunRebuildActionRepo',
+            'rebuild'
+          );
+          const requests: IOperationGraphRequestResult[] = captureRequestResults(parser);
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(requests).toHaveLength(1);
+          const [request] = requests;
+          expect(request).toMatchObject({
+            commandName: 'rebuild',
+            requestId: undefined,
+            status: OperationStatus.Success
+          });
+          expect(getStatusByProjectName(request)).toEqual({
+            a: OperationStatus.Success,
+            b: OperationStatus.Success
+          });
+        });
       });
 
       describe("'custom-reporter-flag' action", () => {
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts
new file mode 100644
index 00000000000..bc64c358a14
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts
@@ -0,0 +1,107 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock(`@rushstack/package-deps-hash`, () => {
+  return {
+    getRepoRoot(dir: string): string {
+      return dir;
+    },
+    getDetailedRepoStateAsync(): IDetailedRepoState {
+      return {
+        hasSubmodules: false,
+        hasUncommittedChanges: false,
+        // The shrinkwrap file of the test repo, which every project depends on. As in the other mocks, a file's
+        // hash is its path.
+        files: new Map([
+          ['common/config/rush/npm-shrinkwrap.json', 'common/config/rush/npm-shrinkwrap.json']
+        ]),
+        symlinks: new Map()
+      };
+    },
+    getRepoChangesAsync(): ReadonlyMap<string, string> {
+      return new Map();
+    },
+    getGitHashForFiles(filePaths: Iterable<string>): ReadonlyMap<string, string> {
+      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+    },
+    hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): Promise<ReadonlyMap<string, string>> {
+      return Promise.resolve(new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath])));
+    }
+  };
+});
+
+import './mockRushCommandLineParser';
+
+import { JsonFile } from '@rushstack/node-core-library';
+import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
+
+import { DeferredCacheEntryWrites } from '../../logic/buildCache/DeferredCacheEntryWrites';
+import { CacheableOperationPlugin } from '../../logic/operations/CacheableOperationPlugin';
+import {
+  getCommandLineParserInstanceAsync,
+  isolateEnvironmentConfigurationForTests,
+  type IEnvironmentConfigIsolation
+} from './TestUtils';
+
+const REPO_NAME: string = 'legacySkipRepo';
+const DEFER_CACHE_WRITES_VARIABLE_NAME: string = 'RUSH_DAEMON_DEFER_CACHE_WRITES';
+
+jest.setTimeout(1000000);
+
+describe('RushCommandLineParser with the deferCacheWrites setting', () => {
+  let _envIsolation: IEnvironmentConfigIsolation;
+  let _originalExitCode: string | number | undefined;
+  let _originalDeferCacheWrites: string | undefined;
+
+  beforeEach(() => {
+    // A command that succeeds sets process.exitCode to 0. When Jest runs only this file, it shares the
+    // process with Heft, which would then exit with 0 even though tests failed.
+    _originalExitCode = process.exitCode;
+    _originalDeferCacheWrites = process.env[DEFER_CACHE_WRITES_VARIABLE_NAME];
+    _envIsolation = isolateEnvironmentConfigurationForTests();
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    _envIsolation.restore();
+    if (_originalDeferCacheWrites === undefined) {
+      delete process.env[DEFER_CACHE_WRITES_VARIABLE_NAME];
+    } else {
+      process.env[DEFER_CACHE_WRITES_VARIABLE_NAME] = _originalDeferCacheWrites;
+    }
+    process.exitCode = _originalExitCode;
+  });
+
+  it('does not defer the build cache writes of a build outside the daemon', async () => {
+    process.env[DEFER_CACHE_WRITES_VARIABLE_NAME] = '1';
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(parser.rushConfiguration.daemon.deferCacheWrites).toBe(true);
+    await JsonFile.saveAsync(
+      { buildCacheEnabled: true, cacheProvider: 'local-only' },
+      `${repoPath}/common/config/rush/build-cache.json`,
+      { ensureFolderExists: true }
+    );
+
+    // A deferred write outlives its command, and only the daemon outlives a command. The projects write no
+    // entries, since they have no rush-project.json, so what matters is whether the build gets the daemon's queue.
+    const applySpy: jest.SpiedFunction<CacheableOperationPlugin['apply']> = jest.spyOn(
+      CacheableOperationPlugin.prototype,
+      'apply'
+    );
+    const instanceSpy: jest.SpyInstance<DeferredCacheEntryWrites, []> = jest.spyOn(
+      DeferredCacheEntryWrites,
+      'instance',
+      'get'
+    );
+    try {
+      await expect(parser.executeAsync()).resolves.toEqual(true);
+
+      expect(spawnMock).toHaveBeenCalledTimes(2);
+      expect(applySpy).toHaveBeenCalledTimes(1);
+      expect(instanceSpy).not.toHaveBeenCalled();
+    } finally {
+      instanceSpy.mockRestore();
+      applySpy.mockRestore();
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
new file mode 100644
index 00000000000..aa7cfce6ad7
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
@@ -0,0 +1,200 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock(`@rushstack/package-deps-hash`, () => {
+  return {
+    getRepoRoot(dir: string): string {
+      return dir;
+    },
+    getDetailedRepoStateAsync(): IDetailedRepoState {
+      return {
+        hasSubmodules: false,
+        hasUncommittedChanges: false,
+        // The shrinkwrap file of the test repo, which every project depends on. As in the other mocks, a file's
+        // hash is its path.
+        files: new Map([
+          ['common/config/rush/npm-shrinkwrap.json', 'common/config/rush/npm-shrinkwrap.json']
+        ]),
+        symlinks: new Map()
+      };
+    },
+    getRepoChangesAsync(): ReadonlyMap<string, string> {
+      return new Map();
+    },
+    getGitHashForFiles(filePaths: Iterable<string>): ReadonlyMap<string, string> {
+      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+    },
+    hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): Promise<ReadonlyMap<string, string>> {
+      return Promise.resolve(new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath])));
+    }
+  };
+});
+
+import './mockRushCommandLineParser';
+
+import * as path from 'node:path';
+import type { SpawnOptions } from 'node:child_process';
+
+import { FileSystem, JsonFile, LockFile } from '@rushstack/node-core-library';
+import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
+
+import type { RushCommandLineParser } from '../RushCommandLineParser';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import {
+  getCommandLineParserInstanceAsync,
+  isolateEnvironmentConfigurationForTests,
+  setSpawnMock,
+  type IEnvironmentConfigIsolation,
+  type SpawnMockCall
+} from './TestUtils';
+
+// The repo has no command-line.json, so "build" is the default command, which uses legacy skip detection.
+const REPO_NAME: string = 'legacySkipRepo';
+const PROJECT_FOLDER_NAMES: ReadonlyArray<string> = ['a', 'b'];
+
+jest.setTimeout(1000000);
+
+/**
+ * Executes the command and returns the folder names of the projects whose script it spawned.
+ */
+async function executeAsync(parser: RushCommandLineParser, spawnMock: jest.Mock): Promise<string[]> {
+  spawnMock.mockClear();
+  await expect(parser.executeAsync()).resolves.toEqual(true);
+  return spawnMock.mock.calls
+    .map((spawnCall: SpawnMockCall) => path.basename(String((spawnCall[2] as SpawnOptions).cwd)))
+    .sort();
+}
+
+/**
+ * Runs another command in a repo that {@link getCommandLineParserInstanceAsync} created, as a new Rush process
+ * would.
+ */
+async function runAsync(repoPath: string, commandName: string): Promise<string[]> {
+  const { RushCommandLineParser: Parser } = await import('../RushCommandLineParser');
+  // The parser refuses to load .env files after the previous command validated the environment.
+  EnvironmentConfiguration.reset();
+  const parser: RushCommandLineParser = new Parser({ cwd: repoPath });
+  process.argv = ['pretend-this-is-node.exe', 'pretend-this-is-rush', commandName];
+  return await executeAsync(parser, setSpawnMock());
+}
+
+/**
+ * Returns the folder names of the projects that have a legacy skip record for the "build" command.
+ */
+function getProjectsWithRecords(repoPath: string): string[] {
+  return PROJECT_FOLDER_NAMES.filter((projectFolderName: string) =>
+    FileSystem.exists(`${repoPath}/${projectFolderName}/.rush/temp/package-deps_build.json`)
+  );
+}
+
+describe('RushCommandLineParser legacy skip records', () => {
+  let _envIsolation: IEnvironmentConfigIsolation;
+  let _lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire>;
+  let _originalExitCode: string | number | undefined;
+
+  beforeEach(() => {
+    // A command that succeeds sets process.exitCode to 0. When Jest runs only this file, it shares the
+    // process with Heft, which would then exit with 0 even though tests failed.
+    _originalExitCode = process.exitCode;
+    _envIsolation = isolateEnvironmentConfigurationForTests();
+
+    // Rush keeps the repo lock until the process exits, so it would refuse the second command in a repo.
+    const tryAcquire: typeof LockFile.tryAcquire = LockFile.tryAcquire.bind(LockFile);
+    _lockSpy = jest
+      .spyOn(LockFile, 'tryAcquire')
+      .mockImplementation((resourceFolder: string, resourceName: string) =>
+        resourceName === 'rush' ? ({} as LockFile) : tryAcquire(resourceFolder, resourceName)
+      );
+  });
+
+  afterEach(() => {
+    _lockSpy.mockRestore();
+    jest.clearAllMocks();
+    _envIsolation.restore();
+    process.exitCode = _originalExitCode;
+  });
+
+  it('keeps the records in a build without the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+
+    expect(await runAsync(repoPath, 'build')).toEqual([]);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+
+  it('keeps the records in a build whose build-cache.json disables the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    // "rush init" creates build-cache.json with the build cache disabled.
+    await JsonFile.saveAsync(
+      { buildCacheEnabled: false, cacheProvider: 'local-only' },
+      `${repoPath}/common/config/rush/build-cache.json`,
+      { ensureFolderExists: true }
+    );
+    expect(await runAsync(repoPath, 'build')).toEqual([]);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+
+  it('deletes the records in a build with the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    const buildCacheJsonPath: string = `${repoPath}/common/config/rush/build-cache.json`;
+    await JsonFile.saveAsync({ buildCacheEnabled: true, cacheProvider: 'local-only' }, buildCacheJsonPath, {
+      ensureFolderExists: true
+    });
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual([]);
+
+    // Without the records, a later build without the build cache can't skip the projects.
+    await FileSystem.deleteFileAsync(buildCacheJsonPath);
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+
+  it('deletes the records in a rebuild with the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    // A rebuild replaces the outputs even though it never skips.
+    await JsonFile.saveAsync(
+      { buildCacheEnabled: true, cacheProvider: 'local-only' },
+      `${repoPath}/common/config/rush/build-cache.json`,
+      { ensureFolderExists: true }
+    );
+    expect(await runAsync(repoPath, 'rebuild')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual([]);
+  });
+
+  it('deletes the records in a command that disables the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    const commandLineJsonPath: string = `${repoPath}/common/config/rush/command-line.json`;
+    await JsonFile.saveAsync(
+      {
+        commands: [
+          {
+            commandKind: 'bulk',
+            name: 'build',
+            summary: 'Builds every project, without the build cache or skipping.',
+            enableParallelism: true,
+            incremental: true,
+            disableBuildCache: true
+          }
+        ]
+      },
+      commandLineJsonPath,
+      { ensureFolderExists: true }
+    );
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual([]);
+
+    // Without the records, the build can't skip the projects once it uses legacy skip detection again.
+    await FileSystem.deleteFileAsync(commandLineJsonPath);
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
new file mode 100644
index 00000000000..71f8414d06a
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
@@ -0,0 +1,213 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock(`@rushstack/package-deps-hash`, () => {
+  return {
+    getRepoRoot(dir: string): string {
+      return dir;
+    },
+    getDetailedRepoStateAsync(): IDetailedRepoState {
+      return {
+        hasSubmodules: false,
+        hasUncommittedChanges: false,
+        // The shrinkwrap file of the test repo, which every project depends on. As in the other mocks, a file's
+        // hash is its path.
+        files: new Map([
+          ['common/config/rush/npm-shrinkwrap.json', 'common/config/rush/npm-shrinkwrap.json']
+        ]),
+        symlinks: new Map()
+      };
+    },
+    getRepoChangesAsync(): ReadonlyMap<string, string> {
+      return new Map();
+    },
+    getGitHashForFiles(filePaths: Iterable<string>): ReadonlyMap<string, string> {
+      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+    },
+    hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): Promise<ReadonlyMap<string, string>> {
+      return Promise.resolve(new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath])));
+    }
+  };
+});
+
+import './mockRushCommandLineParser';
+
+import * as path from 'node:path';
+import type { SpawnOptions } from 'node:child_process';
+
+import { LockFile } from '@rushstack/node-core-library';
+import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import { PhasedCommandEngine } from '../../api/PhasedCommandEngine';
+import { RushConfiguration } from '../../api/RushConfiguration';
+import { ProjectChangeAnalyzer } from '../../logic/ProjectChangeAnalyzer';
+import type { IInputsSnapshot } from '../../logic/incremental/InputsSnapshot';
+import type { Operation } from '../../logic/operations/Operation';
+import type { ICreateOperationsContext } from '../../pluginFramework/PhasedCommandHooks';
+import type { RushCommandLineParser } from '../RushCommandLineParser';
+import { PhasedScriptAction } from '../scriptActions/PhasedScriptAction';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import {
+  getCommandLineParserInstanceAsync,
+  isolateEnvironmentConfigurationForTests,
+  setSpawnMock,
+  type IEnvironmentConfigIsolation,
+  type SpawnMockCall
+} from './TestUtils';
+
+// The repo has no build cache, so its incremental phased commands use legacy skip detection, unless they set
+// "disableBuildCache" in command-line.json.
+const REPO_NAME: string = 'phasedDisableBuildCacheRepo';
+
+jest.setTimeout(1000000);
+
+/**
+ * Executes the command and returns the folder names of the projects whose script it spawned.
+ */
+async function executeAsync(parser: RushCommandLineParser, spawnMock: jest.Mock): Promise<string[]> {
+  spawnMock.mockClear();
+  await expect(parser.executeAsync()).resolves.toEqual(true);
+  return spawnMock.mock.calls
+    .map((spawnCall: SpawnMockCall) => path.basename(String((spawnCall[2] as SpawnOptions).cwd)))
+    .sort();
+}
+
+/**
+ * Runs another command in a repo that {@link getCommandLineParserInstanceAsync} created, as a new Rush process
+ * would.
+ */
+async function runAsync(repoPath: string, commandName: string): Promise<string[]> {
+  const { RushCommandLineParser: Parser } = await import('../RushCommandLineParser');
+  // The parser refuses to load .env files after the previous command validated the environment.
+  EnvironmentConfiguration.reset();
+  const parser: RushCommandLineParser = new Parser({ cwd: repoPath });
+  process.argv = ['pretend-this-is-node.exe', 'pretend-this-is-rush', commandName];
+  return await executeAsync(parser, setSpawnMock());
+}
+
+/**
+ * Runs two daemon graph iterations and returns the folder names of the projects whose script each one spawned.
+ */
+async function runEngineTwiceAsync(repoPath: string, commandName: string): Promise<[string[], string[]]> {
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    path.join(repoPath, 'rush.json')
+  );
+  const command: PhasedCommandEngine = await PhasedCommandEngine.parseAsync({
+    argv: [commandName],
+    cwd: repoPath,
+    rushConfiguration,
+    terminalProvider: new NoOpTerminalProvider()
+  });
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes: new Map(),
+    rootDirectory: repoPath,
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: () => new Map(),
+    getOperationOwnStateHash: (project) => project.projectRelativeFolder
+  };
+  const snapshotSpy: jest.SpiedFunction<ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync']> = jest
+    .spyOn(ProjectChangeAnalyzer.prototype, '_tryGetSnapshotProviderAsync')
+    .mockResolvedValue(async () => inputsSnapshot);
+  let engine: Awaited<ReturnType<PhasedCommandEngine['createEngineAsync']>> | undefined;
+  try {
+    engine = await command.createEngineAsync();
+    const activeEngine: Awaited<ReturnType<PhasedCommandEngine['createEngineAsync']>> = engine;
+    const selectedOperations = await command.selectOperationsAsync(activeEngine.operationGraph);
+    const runIterationAsync = async (): Promise<string[]> => {
+      const spawnMock: jest.Mock = setSpawnMock();
+      spawnMock.mockClear();
+      activeEngine.operationGraph.setEnabledStates(activeEngine.operationGraph.operations, false, 'unsafe');
+      for (const [operation, enabled] of selectedOperations) {
+        operation.enabled = enabled;
+      }
+      if (
+        await activeEngine.operationGraph.scheduleIterationAsync({
+          inputsSnapshot: activeEngine.inputsSnapshot,
+          isIncrementalBuildAllowed: command.requestSettings.isIncrementalBuildAllowed
+        })
+      ) {
+        await activeEngine.operationGraph.executeScheduledIterationAsync();
+      }
+      return spawnMock.mock.calls
+        .map((spawnCall: SpawnMockCall) => path.basename(String((spawnCall[2] as SpawnOptions).cwd)))
+        .sort();
+    };
+    return [await runIterationAsync(), await runIterationAsync()];
+  } finally {
+    await engine?.[Symbol.asyncDispose]();
+    snapshotSpy.mockRestore();
+  }
+}
+
+describe('RushCommandLineParser phased command with disableBuildCache', () => {
+  let _envIsolation: IEnvironmentConfigIsolation;
+  let _lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire>;
+  let _originalExitCode: string | number | undefined;
+
+  beforeEach(() => {
+    // A command that succeeds sets process.exitCode to 0. When Jest runs only this file, it shares the
+    // process with Heft, which would then exit with 0 even though tests failed.
+    _originalExitCode = process.exitCode;
+    _envIsolation = isolateEnvironmentConfigurationForTests();
+
+    // Rush keeps the repo lock until the process exits, so it would refuse the second command in a repo.
+    const tryAcquire: typeof LockFile.tryAcquire = LockFile.tryAcquire.bind(LockFile);
+    _lockSpy = jest
+      .spyOn(LockFile, 'tryAcquire')
+      .mockImplementation((resourceFolder: string, resourceName: string) => {
+        if (resourceName !== 'rush') {
+          return tryAcquire(resourceFolder, resourceName);
+        }
+        return {
+          filePath: LockFile.getLockFilePath(resourceFolder, resourceName),
+          isReleased: false,
+          release: jest.fn()
+        } as unknown as LockFile;
+      });
+  });
+
+  afterEach(() => {
+    _lockSpy.mockRestore();
+    jest.clearAllMocks();
+    _envIsolation.restore();
+    process.exitCode = _originalExitCode;
+  });
+
+  it('skips the unchanged projects in a phased command without disableBuildCache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'stage');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(await runAsync(repoPath, 'stage')).toEqual([]);
+  });
+
+  it('runs every project again in a phased command with disableBuildCache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'ship');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(await runAsync(repoPath, 'ship')).toEqual(['a', 'b']);
+  });
+
+  it('gives the operation runners of a native command with disableBuildCache its incremental setting', async () => {
+    // For example, a watch command's IPC runners and "<phase>:incremental" scripts depend on it.
+    const { parser, spawnMock } = await getCommandLineParserInstanceAsync(REPO_NAME, 'ship');
+    const action: PhasedScriptAction = parser.getAction('ship') as PhasedScriptAction;
+    expect(action).toBeInstanceOf(PhasedScriptAction);
+    const incrementalSettings: boolean[] = [];
+    action.hooks.createOperationsAsync.tap(
+      'Test',
+      (operations: Set<Operation>, context: ICreateOperationsContext) => {
+        incrementalSettings.push(context.isIncrementalBuildAllowed);
+        return operations;
+      }
+    );
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(incrementalSettings).toEqual([true]);
+  });
+
+  it('runs every project again in a daemon graph for a phased command with disableBuildCache', async () => {
+    const { repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'ship');
+    expect(await runEngineTwiceAsync(repoPath, 'ship')).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts
index e8a29259319..bb6b5e7ceb6 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts
@@ -118,6 +118,53 @@ describe('RushCommandLineParser reporter close', () => {
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
 
+  it('waits for queued stdout and stderr output before an explicit parser exit', async () => {
+    const streams: NodeJS.WriteStream[] = [process.stdout, process.stderr];
+    const flushCallbacks: Map<NodeJS.WriteStream, () => void> = new Map();
+    for (const stream of streams) {
+      // Writable.prototype.writableLength isn't configurable, so jest can't spy on it; shadow it instead.
+      Object.defineProperty(stream, 'writableLength', { configurable: true, get: () => 100 });
+      jest.spyOn(stream, 'write').mockImplementation(((chunk: unknown, callback?: () => void): boolean => {
+        if (chunk === '' && callback) {
+          flushCallbacks.set(stream, callback);
+        }
+        return true;
+      }) as typeof stream.write);
+    }
+
+    try {
+      const parser: RushCommandLineParser = new RushCommandLineParser({
+        cwd: `${__dirname}/repo`,
+        reporterCloseAsync: async () => undefined
+      });
+      jest
+        .spyOn(parser.pluginManager, 'tryInitializeUnassociatedPluginsAsync')
+        .mockRejectedValue(new Error('parser failed'));
+      const exitSpy: jest.SpyInstance<never, [code?: string | number | null | undefined]> = jest
+        .spyOn(process, 'exit')
+        .mockImplementation(() => undefined as never);
+      jest.spyOn(console, 'error').mockImplementation(() => undefined);
+
+      await expect(parser.executeAsync(['build'])).resolves.toBe(false);
+      await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+
+      expect(flushCallbacks.size).toBe(2);
+      expect(exitSpy).not.toHaveBeenCalled();
+
+      flushCallbacks.get(process.stdout)!();
+      await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+      expect(exitSpy).not.toHaveBeenCalled();
+
+      flushCallbacks.get(process.stderr)!();
+      await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    } finally {
+      for (const stream of streams) {
+        Reflect.deleteProperty(stream, 'writableLength');
+      }
+    }
+  });
+
   it('does not execute after an initialization failure', async () => {
     let resolveClose: (() => void) | undefined;
     const closeAsync: jest.Mock<Promise<void>, []> = jest.fn(
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterLifecycle.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterLifecycle.test.ts
index a1c84370165..a01b20676df 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterLifecycle.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterLifecycle.test.ts
@@ -63,7 +63,9 @@ describe('RushCommandLineParser reporter lifecycle', () => {
   }
 
   async function copyRepositoryAsync(): Promise<string> {
-    const directory: string = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'rush-reporter-lifecycle-'));
+    const directory: string = await fs.promises.mkdtemp(
+      path.join(fs.realpathSync.native(os.tmpdir()), 'rush-reporter-lifecycle-')
+    );
     temporaryFolders.push(directory);
     const repoPath: string = path.join(directory, 'repo');
     await fs.promises.cp(path.join(__dirname, 'basicAndRunBuildActionRepo'), repoPath, { recursive: true });
@@ -92,10 +94,13 @@ describe('RushCommandLineParser reporter lifecycle', () => {
         }
       }
       try {
+        // On Windows, a process that the watch session started can keep the folder busy for a moment after it ends.
         await Promise.all(
           temporaryFolders
             .splice(0)
-            .map((directory) => fs.promises.rm(directory, { recursive: true, force: true }))
+            .map((directory) =>
+              fs.promises.rm(directory, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+            )
         );
       } finally {
         process.exitCode = originalExitCode;
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts
new file mode 100644
index 00000000000..a7cbeaa9e6a
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts
@@ -0,0 +1,228 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { once } from 'node:events';
+
+import { JsonFile, LockFile } from '@rushstack/node-core-library';
+
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import { FlagFile } from '../../api/FlagFile';
+import { ProjectChangeAnalyzer } from '../../logic/ProjectChangeAnalyzer';
+import { RushConstants } from '../../logic/RushConstants';
+import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from '../../logic/incremental/InputsSnapshot';
+import type { IOperationExecutionResult } from '../../logic/operations/IOperationExecutionResult';
+import type { Operation } from '../../logic/operations/Operation';
+import { OperationStatus } from '../../logic/operations/OperationStatus';
+import { RushCommandLineParser } from '../RushCommandLineParser';
+import { PhasedScriptAction } from '../scriptActions/PhasedScriptAction';
+
+const COMMAND_NAME: string = 'watch-test';
+const PHASE_NAME: string = '_phase:watch-test';
+// A passing run starts its second iteration well within this.
+const SECOND_ITERATION_DEADLINE_MS: number = 20000;
+
+type IterationStatuses = ReadonlyMap<string, OperationStatus>;
+
+async function createRepositoryAsync(parentFolder: string): Promise<string> {
+  const repoPath: string = path.join(parentFolder, 'repo');
+  await fs.promises.cp(path.join(__dirname, 'basicAndRunBuildActionRepo'), repoPath, { recursive: true });
+  JsonFile.save(
+    {
+      commands: [
+        {
+          commandKind: 'phased',
+          name: COMMAND_NAME,
+          summary: 'Watch fixture',
+          phases: [PHASE_NAME],
+          enableParallelism: false,
+          safeForSimultaneousRushProcesses: true,
+          watchOptions: { alwaysWatch: true, debounceMs: 1, watchPhases: [PHASE_NAME] }
+        }
+      ],
+      phases: [{ name: PHASE_NAME, dependencies: { upstream: [PHASE_NAME] } }]
+    },
+    path.join(repoPath, 'common/config/rush/command-line.json')
+  );
+  JsonFile.save({}, path.join(repoPath, 'common/config/rush/npm-shrinkwrap.json'));
+  // The lines of `rush init`'s .gitignore that cover the files Rush writes during an iteration, so that they
+  // aren't inputs.
+  await fs.promises.writeFile(path.join(repoPath, '.gitignore'), '*.log\ncommon/temp/\n**/.rush/temp/\n');
+  for (const name of ['a', 'b']) {
+    const packageJsonPath: string = path.join(repoPath, name, 'package.json');
+    const packageJson: { scripts?: Record<string, string> } = JsonFile.load(packageJsonPath);
+    JsonFile.save({ ...packageJson, scripts: { [PHASE_NAME]: 'node watch-test.js' } }, packageJsonPath);
+    await fs.promises.writeFile(path.join(repoPath, name, 'watch-test.js'), 'process.exitCode = 0;\n');
+  }
+  // Failed Git commands still throw with their stderr.
+  execFileSync('git', ['init', '--quiet'], { cwd: repoPath, stdio: 'pipe' });
+  execFileSync('git', ['add', '.'], { cwd: repoPath, stdio: 'pipe' });
+  execFileSync(
+    'git',
+    [
+      '-c',
+      'user.name=Rush test',
+      '-c',
+      'user.email=rush-test@example.com',
+      '-c',
+      'commit.gpgSign=false',
+      'commit',
+      '--quiet',
+      '-m',
+      'Initialize watch fixture'
+    ],
+    { cwd: repoPath, stdio: 'pipe' }
+  );
+  return repoPath;
+}
+
+function getStatusesByName(results: ReadonlyMap<Operation, IOperationExecutionResult>): IterationStatuses {
+  return new Map(Array.from(results, ([operation, result]) => [operation.name, result.status]));
+}
+
+describe('RushCommandLineParser watch mode', () => {
+  const temporaryFolders: string[] = [];
+  let originalExitCode: string | number | undefined;
+  let lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire>;
+
+  beforeEach(() => {
+    originalExitCode = process.exitCode;
+    process.exitCode = undefined;
+    EnvironmentConfiguration.reset();
+    lockSpy = jest.spyOn(LockFile, 'tryAcquire');
+  });
+
+  afterEach(async () => {
+    try {
+      for (const result of lockSpy.mock.results) {
+        if (result.type === 'return' && result.value && !result.value.isReleased) {
+          result.value.release();
+        }
+      }
+      // On Windows, a process that the watch session started can keep the folder busy for a moment after it ends.
+      await Promise.all(
+        temporaryFolders
+          .splice(0)
+          .map((folder) =>
+            fs.promises.rm(folder, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+          )
+      );
+    } finally {
+      process.exitCode = originalExitCode;
+      EnvironmentConfiguration.reset();
+      jest.restoreAllMocks();
+    }
+  });
+
+  // Covers PhasedScriptAction passing its snapshot provider to ProjectWatcher. Without the provider, the watcher
+  // can't find the edit below.
+  it('runs again for an input that changed while the first iteration ran', async () => {
+    const temporaryFolder: string = await fs.promises.mkdtemp(
+      path.join(fs.realpathSync.native(os.tmpdir()), 'rush-watch-')
+    );
+    temporaryFolders.push(temporaryFolder);
+    const repoPath: string = await createRepositoryAsync(temporaryFolder);
+    const editedInputPath: string = path.join(repoPath, 'a', 'watch-test.js');
+
+    const closedWatchers: Promise<unknown>[] = [];
+    const originalWatch: typeof fs.watch = fs.watch;
+    jest.spyOn(fs, 'watch').mockImplementation(((...args: Parameters<typeof fs.watch>) => {
+      const watcher: fs.FSWatcher = originalWatch(...args);
+      closedWatchers.push(once(watcher, 'close'));
+      return watcher;
+    }) as typeof fs.watch);
+    // The watcher takes snapshots on its own, e.g. each time the graph goes idle. The session must wait for them,
+    // so that Git doesn't read the repository after the command returns, when afterEach removes it.
+    let runningSnapshotCount: number = 0;
+    const originalTryGetSnapshotProviderAsync: ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync'] =
+      ProjectChangeAnalyzer.prototype._tryGetSnapshotProviderAsync;
+    jest
+      .spyOn(ProjectChangeAnalyzer.prototype, '_tryGetSnapshotProviderAsync')
+      .mockImplementation(async function (
+        this: ProjectChangeAnalyzer,
+        ...args: Parameters<ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync']>
+      ): Promise<GetInputsSnapshotAsyncFn | undefined> {
+        const getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined =
+          await originalTryGetSnapshotProviderAsync.apply(this, args);
+        return (
+          getInputsSnapshotAsync &&
+          (async (): Promise<IInputsSnapshot | undefined> => {
+            runningSnapshotCount++;
+            try {
+              return await getInputsSnapshotAsync();
+            } finally {
+              runningSnapshotCount--;
+            }
+          })
+        );
+      });
+
+    const parser: RushCommandLineParser = new RushCommandLineParser({ cwd: repoPath });
+    await new FlagFile(
+      parser.rushConfiguration.defaultSubspace.getSubspaceTempFolderPath(),
+      RushConstants.lastLinkFlagFilename,
+      {}
+    ).createAsync();
+    const action = parser.getAction(COMMAND_NAME);
+    if (!(action instanceof PhasedScriptAction)) {
+      throw new Error('Expected the production phased watch action');
+    }
+
+    const iterations: IterationStatuses[] = [];
+    let deadline: NodeJS.Timeout | undefined;
+    const stop = (): void => {
+      clearTimeout(deadline);
+      action.sessionAbortController.abort();
+    };
+    parser.rushSession.hooks.runPhasedCommand.for(COMMAND_NAME).tap('WatchTest', (command) => {
+      command.hooks.onGraphCreatedAsync.tap('WatchTest', (graph) => {
+        graph.hooks.beforeExecuteIterationAsync.tap('WatchTest', () => {
+          if (iterations.length === 0) {
+            // The watcher opens its file system watchers only when the graph goes idle, so no watcher sees
+            // this edit. Only the snapshot that the watcher takes at idle can find it.
+            fs.writeFileSync(editedInputPath, 'process.exitCode = 0; // edited\n');
+          }
+        });
+        graph.hooks.afterExecuteIterationAsync.tap('WatchTest', (status, results) => {
+          iterations.push(getStatusesByName(results));
+          return status;
+        });
+        graph.hooks.onIdle.tap({ name: 'WatchTest', stage: Number.MAX_SAFE_INTEGER }, () => {
+          if (iterations.length < 2) {
+            clearTimeout(deadline);
+            deadline = setTimeout(stop, SECOND_ITERATION_DEADLINE_MS);
+          } else {
+            stop();
+          }
+        });
+      });
+    });
+
+    try {
+      await expect(parser.executeAsync([COMMAND_NAME])).resolves.toBe(true);
+      expect(runningSnapshotCount).toBe(0);
+    } finally {
+      stop();
+      await Promise.all(closedWatchers);
+    }
+
+    // On Windows, the watcher can report another change while the second iteration runs, which aborts that
+    // iteration and runs it again.
+    const completedIterations: IterationStatuses[] = iterations.filter(
+      (iteration: IterationStatuses) => !Array.from(iteration.values()).includes(OperationStatus.Aborted)
+    );
+    expect(completedIterations).toEqual([
+      new Map([
+        ['a (watch-test)', OperationStatus.Success],
+        ['b (watch-test)', OperationStatus.Success]
+      ]),
+      new Map([
+        ['a (watch-test)', OperationStatus.Success],
+        ['b (watch-test)', OperationStatus.Success]
+      ])
+    ]);
+  }, 60000);
+});
diff --git a/libraries/rush-lib/src/cli/test/RushXCommand.test.ts b/libraries/rush-lib/src/cli/test/RushXCommand.test.ts
new file mode 100644
index 00000000000..a488e0ed436
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushXCommand.test.ts
@@ -0,0 +1,79 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import { EventEmitter } from 'node:events';
+
+import { PackageJsonLookup } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { RushXCommand } from '../RushXCommandLine';
+
+type EndScript = (child: EventEmitter, controller: AbortController) => void;
+
+interface IServedResult {
+  exitCode: number;
+  stderr: string;
+}
+
+async function runOwnedScriptAsync(endScript: EndScript): Promise<IServedResult> {
+  const controller: AbortController = new AbortController();
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const terminal: Terminal = new Terminal(terminalProvider);
+  const exitCode: number = await RushXCommand.executeAsync({
+    arguments: RushXCommand.parseArguments(['-q', 'nap'], {}),
+    abortSignal: controller.signal,
+    cwd: '/repo/app',
+    environment: {},
+    rushConfiguration: undefined,
+    terminal,
+    consoleTerminal: terminal,
+    launchOptions: { isManaged: false },
+    spawn: () => {
+      const child: EventEmitter = new EventEmitter();
+      setImmediate(() => endScript(child, controller));
+      return child as childProcess.ChildProcess;
+    }
+  });
+  return { exitCode, stderr: terminalProvider.getErrorOutput({ normalizeSpecialCharacters: false }) };
+}
+
+describe(`${RushXCommand.name} with an owned spawn`, () => {
+  beforeEach(() => {
+    jest
+      .spyOn(PackageJsonLookup.prototype, 'tryGetPackageJsonFilePathFor')
+      .mockReturnValue('/repo/app/package.json');
+    jest
+      .spyOn(PackageJsonLookup.prototype, 'loadPackageJson')
+      .mockReturnValue({ name: 'app', version: '1.0.0', scripts: { nap: 'sleep 60' } });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('prints nothing for a script that ends because the request was aborted', async () => {
+    const result: IServedResult = await runOwnedScriptAsync((child, controller) => {
+      controller.abort(new Error('The request was cancelled.'));
+      child.emit('close', null, 'SIGTERM');
+    });
+    expect(result).toEqual({ exitCode: 1, stderr: '' });
+  });
+
+  it('prints an error that is not the abort reason, even after an abort', async () => {
+    const result: IServedResult = await runOwnedScriptAsync((child, controller) => {
+      controller.abort(new Error('The request was cancelled.'));
+      child.emit('error', new Error('spawn sh EACCES'));
+    });
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain('Error: spawn sh EACCES');
+  });
+
+  it('names the signal that ended a script when the request was not aborted', async () => {
+    const result: IServedResult = await runOwnedScriptAsync((child) => {
+      child.emit('close', null, 'SIGKILL');
+    });
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain('Error: The script was ended by SIGKILL.');
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap b/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap
index efe3e717b7d..bed4fdd30af 100644
--- a/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap
+++ b/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap
@@ -1445,7 +1445,8 @@ Optional arguments:
 
 exports[`CommandLineHelp prints the help for each action: update-cloud-credentials 1`] = `
 "usage: rush update-cloud-credentials [-h] [-i]
-                                     [--credential CREDENTIAL_STRING] [-d]
+                                     [--credential CREDENTIAL_STRING]
+                                     [--delete]
                                      
 
 (EXPERIMENTAL) If the build caching feature is configured, this command 
@@ -1457,7 +1458,7 @@ Optional arguments:
                         mode, if supported by the provider.
   --credential CREDENTIAL_STRING
                         A static credential, to be cached.
-  -d, --delete          If specified, delete stored credentials.
+  --delete              If specified, delete stored credentials.
 "
 `;
 
diff --git a/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json b/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json
index c7d4e88c76b..b73ec58834b 100644
--- a/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json
+++ b/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json
@@ -5,6 +5,12 @@
       "name": "custom-output",
       "summary": "Exercises custom parameters that overlap reporter controls.",
       "shellCommand": "node custom-output.js"
+    },
+    {
+      "commandKind": "global",
+      "name": "custom-short-name",
+      "summary": "Exercises a custom parameter whose short name is also a global parameter's short name.",
+      "shellCommand": "node custom-output.js"
     }
   ],
   "parameters": [
@@ -34,6 +40,14 @@
       "longName": "--verbose",
       "description": "Custom verbose flag.",
       "associatedCommands": ["custom-output"]
+    },
+    {
+      "parameterKind": "integer",
+      "longName": "--stale-after-days",
+      "shortName": "-d",
+      "argumentName": "DAYS",
+      "description": "Custom parameter whose short name is also the short name of the global --debug parameter.",
+      "associatedCommands": ["custom-short-name"]
     }
   ]
 }
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json
new file mode 100644
index 00000000000..7ee3b0abd1d
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "a",
+  "version": "1.0.0",
+  "description": "Test package a",
+  "scripts": {
+    "build": "fake_build_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json
new file mode 100644
index 00000000000..c8e366acc54
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "b",
+  "version": "1.0.0",
+  "description": "Test package b",
+  "dependencies": {
+    "a": "1.0.0"
+  },
+  "scripts": {
+    "build": "fake_build_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json
new file mode 100644
index 00000000000..2377472bdd1
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json
@@ -0,0 +1,7 @@
+{
+  "name": "rush-common",
+  "version": "0.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {}
+}
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json
new file mode 100644
index 00000000000..f39da1606c4
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json
@@ -0,0 +1,17 @@
+{
+  "npmVersion": "6.4.1",
+  "rushVersion": "5.5.2",
+  "projectFolderMinDepth": 1,
+  "projectFolderMaxDepth": 99,
+
+  "projects": [
+    {
+      "packageName": "a",
+      "projectFolder": "a"
+    },
+    {
+      "packageName": "b",
+      "projectFolder": "b"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json
new file mode 100644
index 00000000000..6cfb59b20aa
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "a",
+  "version": "1.0.0",
+  "description": "Test package a",
+  "scripts": {
+    "_phase:ship": "fake_ship_task_but_works_with_mock",
+    "_phase:stage": "fake_stage_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json
new file mode 100644
index 00000000000..be10955ab72
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "b",
+  "version": "1.0.0",
+  "description": "Test package b",
+  "dependencies": {
+    "a": "1.0.0"
+  },
+  "scripts": {
+    "_phase:ship": "fake_ship_task_but_works_with_mock",
+    "_phase:stage": "fake_stage_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json
new file mode 100644
index 00000000000..59256a24dec
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json
@@ -0,0 +1,36 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [
+    {
+      "commandKind": "phased",
+      "name": "stage",
+      "summary": "An incremental phased command, which skips the projects whose inputs didn't change.",
+      "enableParallelism": true,
+      "incremental": true,
+      "phases": ["_phase:stage"]
+    },
+    {
+      "commandKind": "phased",
+      "name": "ship",
+      "summary": "An incremental phased command that disables the build cache, and with it the skipping.",
+      "enableParallelism": true,
+      "incremental": true,
+      "disableBuildCache": true,
+      "phases": ["_phase:ship"]
+    }
+  ],
+  "phases": [
+    {
+      "name": "_phase:stage",
+      "dependencies": {
+        "upstream": ["_phase:stage"]
+      }
+    },
+    {
+      "name": "_phase:ship",
+      "dependencies": {
+        "upstream": ["_phase:ship"]
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json
new file mode 100644
index 00000000000..2377472bdd1
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json
@@ -0,0 +1,7 @@
+{
+  "name": "rush-common",
+  "version": "0.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {}
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json
new file mode 100644
index 00000000000..f39da1606c4
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json
@@ -0,0 +1,17 @@
+{
+  "npmVersion": "6.4.1",
+  "rushVersion": "5.5.2",
+  "projectFolderMinDepth": 1,
+  "projectFolderMaxDepth": 99,
+
+  "projects": [
+    {
+      "packageName": "a",
+      "projectFolder": "a"
+    },
+    {
+      "packageName": "b",
+      "projectFolder": "b"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index a2346d9e993..e181e2bce72 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -164,6 +164,11 @@ export type {
   IOperationRunnerContext,
   IOperationLastState
 } from './logic/operations/IOperationRunner';
+export type {
+  IIncrementalExecutionGuard,
+  IIncrementalExecutionGuardOptions,
+  IOperationCommandExecution
+} from './logic/operations/IncrementalExecutionState';
 export type {
   IConfigurableOperation,
   IBaseOperationExecutionResult,
@@ -179,16 +184,25 @@ export {
   PhasedCommandEngine,
   type IPhasedCommandEngine,
   type IPhasedCommandEngineRequestSettings,
+  type IPhasedCommandEngineLogTelemetryOptions,
+  type IPhasedCommandEngineSharingLabels,
+  type IPhasedCommandEngineTelemetryOptions,
+  type IPhasedCommandEngineTelemetryRecord,
   type IParsePhasedCommandOptions
 } from './api/PhasedCommandEngine';
 export { PhasedCommandEngineConfigurationChangedError } from './api/PhasedCommandEngineConfigurationChangedError';
+export { PhasedCommandEngineProjectConfigurationError } from './api/PhasedCommandEngineProjectConfigurationError';
 export { PhasedCommandEngineBusyError } from './api/PhasedCommandEngineBusyError';
+export { PhasedCommandEngineUsageError } from './api/PhasedCommandEngineUsageError';
 export {
   captureWorkspaceInputFingerprintAsync,
   captureProjectConfigurationFingerprintAsync,
   classifyWorkspaceInputChange,
   getWorkspaceFingerprintEnvironmentEntries,
+  getWorkspaceHostEnvironment,
+  getWorkspaceRequestOperationEnvironment,
   workspaceFingerprintIgnoredEnvironmentVariables,
+  workspaceRequestScopedEnvironmentVariables,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
   type IWorkspaceInputFingerprint,
@@ -232,11 +246,18 @@ export {
   type IPhasedCommandPlugin,
   PhasedCommandHooks
 } from './pluginFramework/PhasedCommandHooks';
-export type { IOperationGraph, IOperationGraphIterationOptions } from './logic/operations/IOperationGraph';
 export type {
-  IOperationChildProcessReporter as _IOperationChildProcessReporter,
-  IOperationGraphEventSink as _IOperationGraphEventSink,
-  IOperationActivityOptions as _IOperationActivityOptions
+  IOperationGraph,
+  IOperationGraphExtensionOptions,
+  IOperationGraphExtensionResult,
+  IOperationGraphIterationOptions,
+  IOperationGraphRequestResult
+} from './logic/operations/IOperationGraph';
+export {
+  type IOperationChildProcessReporter as _IOperationChildProcessReporter,
+  type IOperationGraphEventSink as _IOperationGraphEventSink,
+  type IOperationActivityOptions as _IOperationActivityOptions,
+  _formatIterationStartLines
 } from './logic/operations/OperationEventSink';
 export { OperationGraphHooks } from './pluginFramework/OperationGraphHooks';
 
diff --git a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
index 960c313db37..2720d5504c5 100644
--- a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
+++ b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
@@ -21,7 +21,9 @@ import {
   getRepoRoot,
   getDetailedRepoStateAsync,
   hashFilesAsync,
-  type IFileDiffStatus
+  type IDetailedRepoState,
+  type IFileDiffStatus,
+  RepoStateCache
 } from '@rushstack/package-deps-hash';
 import type { ITerminal } from '@rushstack/terminal';
 
@@ -86,6 +88,18 @@ export interface IRawRepoState {
   rawHashes: Map<string, string>;
 }
 
+/**
+ * A project dependency file (shrinkwrap-deps.json) that change detection hashes is missing.
+ */
+class MissingProjectShrinkwrapFileError extends Error {
+  public constructor(projectShrinkwrapFilePath: string) {
+    super(
+      `A project dependency file (${projectShrinkwrapFilePath}) is missing. You may need to run ` +
+        '"rush install" or "rush update".'
+    );
+  }
+}
+
 /**
  * @beta
  */
@@ -316,13 +330,28 @@ export class ProjectChangeAnalyzer {
   /**
    * Gets a snapshot of the input state of the Rush workspace that can be queried for incremental
    * build operations and use by the build cache.
+   *
+   * @remarks
+   * If the state cannot be calculated, this writes a warning and continues without a snapshot. With
+   * `throwOnMissingProjectShrinkwrapFile`, a missing project dependency file (shrinkwrap-deps.json) instead
+   * throws its error, whether it is detected when the provider is created or when a snapshot fails. A host that
+   * cannot continue without a snapshot can then report that actionable cause.
+   *
+   * With `reuseUnchangedInputs`, the provider keeps the state of the Git repository between snapshots, and
+   * returns its previous snapshot while the inputs are unchanged. This suits a long-lived host, such as the Rush
+   * daemon, that takes a snapshot for each request.
    * @internal
    */
   public async _tryGetSnapshotProviderAsync(
     projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>,
     terminal: ITerminal,
-    projectSelection?: ReadonlySet<RushConfigurationProject>
+    projectSelection?: ReadonlySet<RushConfigurationProject>,
+    options?: {
+      readonly throwOnMissingProjectShrinkwrapFile?: boolean;
+      readonly reuseUnchangedInputs?: boolean;
+    }
   ): Promise<GetInputsSnapshotAsyncFn | undefined> {
+    const throwOnMissingProjectShrinkwrapFile: boolean = !!options?.throwOnMissingProjectShrinkwrapFile;
     try {
       const gitPath: string = this.#git.getGitPathOrThrow();
 
@@ -375,6 +404,7 @@ export class ProjectChangeAnalyzer {
 
       // Include project shrinkwrap files as part of the computation
       const additionalRelativePathsToHash: string[] = [];
+      const projectShrinkwrapFilePaths: string[] = [];
       const globalAdditionalFiles: string[] = [];
       if (rushConfiguration.isPnpm) {
         await Async.forEachAsync(rushConfiguration.projects, async (project: RushConfigurationProject) => {
@@ -384,16 +414,16 @@ export class ProjectChangeAnalyzer {
               return;
             }
 
-            throw new Error(
-              `A project dependency file (${projectShrinkwrapFilePath}) is missing. You may need to run ` +
-                '"rush install" or "rush update".'
-            );
+            throw new MissingProjectShrinkwrapFileError(projectShrinkwrapFilePath);
           }
 
           const relativeProjectShrinkwrapFilePath: string = Path.convertToSlashes(
             path.relative(rootDirectory, projectShrinkwrapFilePath)
           );
           additionalRelativePathsToHash.push(relativeProjectShrinkwrapFilePath);
+          if (!rushConfiguration.subspacesFeatureEnabled) {
+            projectShrinkwrapFilePaths.push(projectShrinkwrapFilePath);
+          }
         });
       } else {
         // Add the shrinkwrap file to every project's dependencies
@@ -423,10 +453,19 @@ export class ProjectChangeAnalyzer {
         filterPath = Array.from(projectSelection, ({ projectFolder }) => projectFolder);
       }
 
+      const repoStateCache: RepoStateCache | undefined = options?.reuseUnchangedInputs
+        ? getRepoStateCache(rootDirectory, gitPath, rushConfiguration.commonTempFolder)
+        : undefined;
+      let previousSnapshot: IReusableInputsSnapshot | undefined;
+
       return async function tryGetSnapshotAsync(): Promise<IInputsSnapshot | undefined> {
+        // Recorded before Git reads the working tree: a file saved after this may be newer than its hash.
+        const workingTreeReadStartTimeMs: number = Date.now();
         try {
-          const [{ files: hashes, symlinks, hasUncommittedChanges }, additionalFiles] = await Promise.all([
-            getDetailedRepoStateAsync(rootDirectory, additionalRelativePathsToHash, gitPath, filterPath),
+          const [repoState, additionalFiles] = await Promise.all([
+            repoStateCache
+              ? repoStateCache.getDetailedRepoStateAsync(additionalRelativePathsToHash, filterPath)
+              : getDetailedRepoStateAsync(rootDirectory, additionalRelativePathsToHash, gitPath, filterPath),
             getAdditionalFilesFromRushProjectConfigurationAsync(
               additionalGlobs,
               lookupByPath,
@@ -434,6 +473,7 @@ export class ProjectChangeAnalyzer {
               terminal
             )
           ]);
+          const { files: hashes, symlinks, hasUncommittedChanges } = repoState;
 
           if (symlinks.size > 0) {
             terminal.writeWarningLine(
@@ -449,24 +489,61 @@ export class ProjectChangeAnalyzer {
           }
 
           const additionalHashes: Map<string, string> = new Map(
-            await hashFilesAsync(rootDirectory, additionalFiles, gitPath)
+            additionalFiles.size > 0 ? await hashFilesAsync(rootDirectory, additionalFiles, gitPath) : []
           );
+          const environment: Record<string, string | undefined> = { ...process.env };
+          // The files that each operation depends on accumulate across snapshots
+          const operationAdditionalFileCount: number = countOperationAdditionalFiles(projectMap);
+
+          if (
+            previousSnapshot &&
+            previousSnapshot.repoState === repoState &&
+            previousSnapshot.operationAdditionalFileCount === operationAdditionalFileCount &&
+            areMapsEqual(previousSnapshot.additionalHashes, additionalHashes) &&
+            areEnvironmentsEqual(previousSnapshot.environment, environment)
+          ) {
+            // Every hash that a new snapshot would compute is the same. The previous snapshot began reading the
+            // working tree earlier, which only widens the window in which a saved file may be newer than its hash.
+            return previousSnapshot.snapshot;
+          }
 
-          return new InputsSnapshot({
+          const snapshot: InputsSnapshot = new InputsSnapshot({
             additionalHashes,
+            environment,
             globalAdditionalFiles,
             hashes,
             hasUncommittedChanges,
             lookupByPath,
+            // Only the projects whose inputs changed need new state, and their hashes computed again
+            previousSnapshot: previousSnapshot?.snapshot,
             projectMap,
-            rootDir: rootDirectory
+            rootDir: rootDirectory,
+            workingTreeReadStartTimeMs
           });
+          if (repoStateCache) {
+            previousSnapshot = {
+              additionalHashes,
+              environment,
+              operationAdditionalFileCount,
+              repoState,
+              snapshot
+            };
+          }
+
+          return snapshot;
         } catch (e) {
+          // The files were checked once, when this provider was created. A file removed since then fails
+          // "git hash-object" with an obscure message, so check them again, only after a failure.
+          const error: Error = (await tryGetMissingFileErrorAsync(projectShrinkwrapFilePaths)) ?? e;
+          if (throwOnMissingProjectShrinkwrapFile && error instanceof MissingProjectShrinkwrapFileError) {
+            throw error;
+          }
+
           // If getRepoState fails, don't fail the whole build. Treat this case as if we don't know anything about
           // the state of the files in the repo. This can happen if the environment doesn't have Git.
           terminal.writeWarningLine(
             `Error calculating the state of the repo. (inner error: ${
-              e.stack ?? e.message ?? e
+              error.stack ?? error.message ?? error
             }). Continuing without diffing files.`
           );
 
@@ -474,6 +551,10 @@ export class ProjectChangeAnalyzer {
         }
       };
     } catch (e) {
+      if (throwOnMissingProjectShrinkwrapFile && e instanceof MissingProjectShrinkwrapFileError) {
+        throw e;
+      }
+
       // If getRepoState fails, don't fail the whole build. Treat this case as if we don't know anything about
       // the state of the files in the repo. This can happen if the environment doesn't have Git.
       terminal.writeWarningLine(
@@ -684,6 +765,41 @@ async function isVersionBumpChangeAsync(
   }
 }
 
+/**
+ * Returns an error naming the first of the specified project dependency files that is missing, if any.
+ */
+async function tryGetMissingFileErrorAsync(
+  projectShrinkwrapFilePaths: ReadonlyArray<string>
+): Promise<MissingProjectShrinkwrapFileError | undefined> {
+  const exists: boolean[] = await Async.mapAsync(
+    projectShrinkwrapFilePaths,
+    (filePath: string) => FileSystem.existsAsync(filePath),
+    { concurrency: 50 }
+  );
+  const missingIndex: number = exists.indexOf(false);
+  return missingIndex < 0
+    ? undefined
+    : new MissingProjectShrinkwrapFileError(projectShrinkwrapFilePaths[missingIndex]);
+}
+
+/**
+ * Returns the error that {@link ProjectChangeAnalyzer._tryGetSnapshotProviderAsync} reports for a missing
+ * project dependency file, if any is missing. This happens when a project is added before "rush install".
+ */
+export async function tryGetMissingProjectShrinkwrapFileErrorAsync(
+  rushConfiguration: RushConfiguration
+): Promise<Error | undefined> {
+  if (!rushConfiguration.isPnpm || rushConfiguration.subspacesFeatureEnabled) {
+    return undefined;
+  }
+
+  return await tryGetMissingFileErrorAsync(
+    rushConfiguration.projects.map((project: RushConfigurationProject) =>
+      BaseProjectShrinkwrapFile.getFilePathForProject(project)
+    )
+  );
+}
+
 interface IAdditionalGlob {
   project: RushConfigurationProject;
   operationName: string;
@@ -691,6 +807,73 @@ interface IAdditionalGlob {
   pattern: string;
 }
 
+/**
+ * A snapshot, and the inputs that it was computed from.
+ */
+interface IReusableInputsSnapshot {
+  readonly additionalHashes: ReadonlyMap<string, string>;
+  readonly environment: Readonly<Record<string, string | undefined>>;
+  readonly operationAdditionalFileCount: number;
+  readonly repoState: IDetailedRepoState;
+  readonly snapshot: InputsSnapshot;
+}
+
+/**
+ * The caches of the state of each Git repository, by the path of Git and the root of the repository. They outlive
+ * the snapshot providers, so that a long-lived host, such as the Rush daemon, keeps using a cache when it creates
+ * a provider again.
+ */
+const repoStateCacheByRepository: Map<string, RepoStateCache> = new Map();
+
+function getRepoStateCache(
+  rootDirectory: string,
+  gitPath: string,
+  temporaryFolderPath: string
+): RepoStateCache {
+  const key: string = `${gitPath}\0${rootDirectory}`;
+  let repoStateCache: RepoStateCache | undefined = repoStateCacheByRepository.get(key);
+  if (!repoStateCache) {
+    repoStateCache = new RepoStateCache({ rootDirectory, gitPath, temporaryFolderPath });
+    repoStateCacheByRepository.set(key, repoStateCache);
+  }
+
+  return repoStateCache;
+}
+
+function countOperationAdditionalFiles(
+  projectMap: ReadonlyMap<RushConfigurationProject, IInputsSnapshotProjectMetadata>
+): number {
+  let count: number = 0;
+  for (const { additionalFilesByOperationName } of projectMap.values()) {
+    for (const additionalFiles of additionalFilesByOperationName?.values() ?? []) {
+      count += additionalFiles.size;
+    }
+  }
+
+  return count;
+}
+
+function areMapsEqual<TValue>(a: ReadonlyMap<string, TValue>, b: ReadonlyMap<string, TValue>): boolean {
+  if (a.size !== b.size) {
+    return false;
+  }
+
+  for (const [key, value] of a) {
+    if (b.get(key) !== value || !b.has(key)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function areEnvironmentsEqual(
+  a: Readonly<Record<string, string | undefined>>,
+  b: Readonly<Record<string, string | undefined>>
+): boolean {
+  return areMapsEqual(new Map(Object.entries(a)), new Map(Object.entries(b)));
+}
+
 async function getAdditionalFilesFromRushProjectConfigurationAsync(
   additionalGlobs: IAdditionalGlob[],
   rootRelativeLookupByPath: IReadonlyLookupByPath<RushConfigurationProject>,
diff --git a/libraries/rush-lib/src/logic/ProjectWatcher.ts b/libraries/rush-lib/src/logic/ProjectWatcher.ts
index 9fccfcb0c9c..aa43c903957 100644
--- a/libraries/rush-lib/src/logic/ProjectWatcher.ts
+++ b/libraries/rush-lib/src/logic/ProjectWatcher.ts
@@ -11,10 +11,11 @@ import { Path } from '@rushstack/node-core-library';
 import { Colorize, type ITerminal } from '@rushstack/terminal';
 
 import { Git } from './Git';
-import type { IInputsSnapshot } from './incremental/InputsSnapshot';
+import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from './incremental/InputsSnapshot';
 import type { RushConfiguration } from '../api/RushConfiguration';
 import type { RushConfigurationProject } from '../api/RushConfigurationProject';
 import type { IOperationGraph, IOperationGraphIterationOptions } from './operations/IOperationGraph';
+import type { IOperationExecutionResult } from './operations/IOperationExecutionResult';
 import type { Operation } from './operations/Operation';
 import { OperationStatus } from './operations/OperationStatus';
 
@@ -26,6 +27,11 @@ export interface IProjectWatcherOptions {
   renderStatusInPlace?: boolean;
   /** Initial inputs snapshot; required so watcher can enumerate nested folders immediately */
   initialSnapshot: IInputsSnapshot;
+  /**
+   * Takes a new inputs snapshot, like the graph does for each iteration. If provided, the watcher uses it when the
+   * graph goes idle after an iteration, to find inputs that changed while the iteration ran.
+   */
+  getInputsSnapshotAsync?: GetInputsSnapshotAsyncFn;
 }
 
 export interface IProjectChangeResult {
@@ -59,12 +65,43 @@ const KEYBIND_HELP: string =
   `[${KEY_CLOSE_RUNNERS}]close-runners [${KEY_DEBUG}]debug [${KEY_VERBOSE}]verbose ` +
   `[${KEY_PAUSE_RESUME}]pause/resume [${KEY_BUILD}]build [${KEY_PARALLELISM_UP}/${KEY_PARALLELISM_DOWN}]parallelism`;
 
+/**
+ * The invalidation reason of the `i` keybind (and of rush-serve-plugin's `invalidate` command). It only marks
+ * operations as stale; a separate build command runs them. Any other invalidation, such as an IPC runner's
+ * `requestRun`, asks for the operations to run again, so the watcher queues an iteration for it.
+ */
+const MANUAL_INVALIDATION_REASON: 'manual-invalidation' = 'manual-invalidation';
+
+/**
+ * The statuses of an execution record that has not started executing in its iteration.
+ */
+const NOT_STARTED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Waiting,
+  OperationStatus.Ready,
+  OperationStatus.Queued
+]);
+
+/**
+ * An operation's request to run again, kept until an iteration that could serve it has finished.
+ */
+interface IRunRequest {
+  readonly reason: string | undefined;
+  /**
+   * The id of the first iteration whose run of the operation starts after the request.
+   */
+  readonly servedByIterationId: number;
+}
+
 /**
  * Watches a set of projects in the repository for file changes and triggers
- * rebuild iterations on the operation graph.
+ * rebuild iterations on the operation graph. Also queues an iteration when an operation
+ * asks to run again, for example when an IPC runner's process sends `requestRun`.
  *
  * Uses `fs.watch()` rather than `chokidar` because only a boolean "something changed"
  * signal is needed; actual change detection is deferred to `getInputsSnapshotAsync`.
+ *
+ * The file system watchers are closed while an iteration runs. When the graph next goes idle, the watcher opens
+ * them again, then compares a new snapshot with the iteration's to find the edits made in the meantime.
  */
 export class ProjectWatcher {
   readonly #debounceMs: number;
@@ -72,6 +109,7 @@ export class ProjectWatcher {
   readonly #terminal: ITerminal;
   readonly #graph: IOperationGraph;
   readonly #renderStatusInPlace: boolean;
+  readonly #getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined;
 
   #repoRoot: string | undefined;
   #watchers: Map<string, fs.FSWatcher> | undefined;
@@ -84,6 +122,26 @@ export class ProjectWatcher {
   #stdinListening: boolean = false;
   #stdinHadRawMode: boolean | undefined;
   #onStdinDataBound: ((chunk: Buffer | string) => void) | undefined;
+  /**
+   * The records of the iteration that most recently started executing, until the graph next goes idle.
+   */
+  #iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+  #lastIterationId: number = 0;
+  readonly #runRequests: Map<Operation, IRunRequest> = new Map();
+  /**
+   * What the pending debounce will queue an iteration for.
+   */
+  #hasQueuedFileChange: boolean = false;
+  readonly #queuedRunRequests: Set<string> = new Set();
+  /**
+   * Identifies the pending check for inputs that changed during the last iteration. Clearing it cancels the check.
+   */
+  #inputsCheck: object | undefined;
+  /**
+   * The unfinished work that the watcher started on its own and that takes a snapshot: checks for inputs that changed
+   * during an iteration, including cancelled checks, and iterations that it is queuing.
+   */
+  readonly #pendingSnapshots: Set<Promise<unknown>> = new Set();
 
   public constructor(options: IProjectWatcherOptions) {
     const {
@@ -92,13 +150,15 @@ export class ProjectWatcher {
       rushConfiguration,
       terminal,
       initialSnapshot,
-      renderStatusInPlace = true
+      renderStatusInPlace = true,
+      getInputsSnapshotAsync
     } = options;
     this.#graph = graph;
     this.#debounceMs = debounceMs;
     this.#rushConfiguration = rushConfiguration;
     this.#terminal = terminal;
     this.#renderStatusInPlace = renderStatusInPlace;
+    this.#getInputsSnapshotAsync = getInputsSnapshotAsync;
     this.#lastSnapshot = initialSnapshot; // Seed snapshot
 
     const gitPath: string = new Git(rushConfiguration).getGitPathOrThrow();
@@ -111,30 +171,61 @@ export class ProjectWatcher {
     graph.hooks.beforeExecuteIterationAsync.tapPromise(
       'ProjectWatcher',
       async (
-        records: ReadonlyMap<Operation, unknown>,
+        records: ReadonlyMap<Operation, IOperationExecutionResult>,
         iterationOptions: IOperationGraphIterationOptions
       ): Promise<void> => {
         this.clearStatus();
         this.#lastSnapshot = iterationOptions.inputsSnapshot;
+        this.#iterationRecords = records;
+        const firstRecord: IOperationExecutionResult | undefined = records.values().next().value;
+        this.#lastIterationId = firstRecord?.iterationId ?? this.#lastIterationId;
+        // This iteration serves the file changes and run requests that were waiting to queue one.
+        this.#clearDebounce();
+        // The check after this iteration compares against its snapshot, which is newer.
+        this.#inputsCheck = undefined;
         await this.#stopWatchingAsync();
       }
     );
 
     // Start watching once execution loop enters waiting state
     graph.hooks.onIdle.tap('ProjectWatcher', () => {
+      const iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined =
+        this.#iterationRecords;
+      this.#iterationRecords = undefined;
       this.#startWatching();
+      if (iterationRecords) {
+        this.#requeueUnservedRunRequests(iterationRecords);
+        // Only after the watchers are open, so that an edit is either in the new snapshot or raises an event.
+        this.#trackSnapshot(this.#queueIterationIfInputsChangedAsync());
+      }
     });
 
+    graph.hooks.onInvalidateOperations.tap(
+      'ProjectWatcher',
+      (operations: Iterable<Operation>, reason: string | undefined) => {
+        this.#onInvalidateOperations(operations, reason);
+      }
+    );
+
     // Dispose stdin listener when session aborts
     graph.abortController.signal.addEventListener(
       'abort',
       () => {
+        this.#clearDebounce();
+        this.#inputsCheck = undefined;
         this.#disposeStdin();
       },
       { once: true }
     );
   }
 
+  /**
+   * Waits for the snapshots that the watcher is taking on its own. It takes none once the session is aborted.
+   */
+  public async waitForSnapshotsAsync(): Promise<void> {
+    await Promise.all(this.#pendingSnapshots);
+  }
+
   /**
    * Resets the rendered line count so the next status update does not attempt
    * to overwrite previously rendered lines.
@@ -301,22 +392,181 @@ export class ProjectWatcher {
     if (fileName === '.git' || fileName === 'node_modules') {
       return;
     }
+    this.#hasQueuedFileChange = true;
+    this.#debounce();
+  }
+
+  /**
+   * Queues an iteration after `debounceMs` without further file changes or run requests.
+   */
+  #debounce(): void {
+    if (this.#graph.abortController.signal.aborted) {
+      // The watch session has ended.
+      return;
+    }
     if (this.#debounceHandle) {
       clearTimeout(this.#debounceHandle);
     }
     this.#debounceHandle = setTimeout(() => this.#scheduleIteration(), this.#debounceMs);
   }
 
+  #clearDebounce(): void {
+    if (this.#debounceHandle) {
+      clearTimeout(this.#debounceHandle);
+      this.#debounceHandle = undefined;
+    }
+    this.#hasQueuedFileChange = false;
+    this.#queuedRunRequests.clear();
+  }
+
   /**
-   * Schedules a new execution iteration on the graph in response to detected file changes.
+   * Schedules a new execution iteration on the graph in response to detected file changes
+   * or run requests.
    */
   #scheduleIteration(): void {
-    this.#setStatus('File change detected. Queuing new iteration...');
-    this.#graph
-      .scheduleIterationAsync({})
-      .catch((e: unknown) =>
-        this.#terminal.writeErrorLine(`Failed to queue iteration: ${(e as Error).message}`)
+    this.#debounceHandle = undefined;
+    const runRequests: string[] = Array.from(this.#queuedRunRequests);
+    const status: string =
+      runRequests.length > 0 && !this.#hasQueuedFileChange
+        ? `Run requested by ${runRequests.join(', ')}. Queuing new iteration...`
+        : 'File change detected. Queuing new iteration...';
+    this.#hasQueuedFileChange = false;
+    this.#queuedRunRequests.clear();
+    this.#setStatus(status);
+    this.#trackSnapshot(
+      this.#graph
+        .scheduleIterationAsync({})
+        .catch((e: unknown) =>
+          this.#terminal.writeErrorLine(`Failed to queue iteration: ${(e as Error).message}`)
+        )
+    );
+  }
+
+  #trackSnapshot(work: Promise<unknown>): void {
+    const trackedWork: Promise<unknown> = work.finally(() => this.#pendingSnapshots.delete(trackedWork));
+    this.#pendingSnapshots.add(trackedWork);
+  }
+
+  /**
+   * Records operations that asked to run again. While the graph is idle, queues an iteration for them.
+   * During an iteration, waits until the graph goes idle to check whether the iteration served them.
+   */
+  #onInvalidateOperations(operations: Iterable<Operation>, reason: string | undefined): void {
+    if (reason === MANUAL_INVALIDATION_REASON) {
+      return;
+    }
+    const isIdle: boolean = !this.#iterationRecords;
+    for (const operation of operations) {
+      this.#runRequests.set(operation, {
+        reason,
+        servedByIterationId: this.#getServingIterationId(operation)
+      });
+      if (isIdle) {
+        this.#queuedRunRequests.add(reason ? `${operation.name} [${reason}]` : operation.name);
+      }
+    }
+    if (isIdle) {
+      this.#debounce();
+    }
+  }
+
+  /**
+   * Returns the id of the first iteration whose run of the operation would start after a request made now.
+   */
+  #getServingIterationId(operation: Operation): number {
+    const record: IOperationExecutionResult | undefined = this.#iterationRecords?.get(operation);
+    // A record that is already committed has finished, even if a deferred invalidation has reset it to Ready.
+    const hasStarted: boolean =
+      !record ||
+      !NOT_STARTED_STATUSES.has(record.status) ||
+      this.#graph.resultByOperation.get(operation) === record;
+    return hasStarted ? this.#lastIterationId + 1 : this.#lastIterationId;
+  }
+
+  /**
+   * Called when the graph goes idle after an iteration. Queues another iteration for each run request that
+   * the iteration did not serve. The graph marks an invalidated operation's committed result as Ready, but
+   * an iteration that was already running the operation then commits a newer result over it, so such a
+   * request is invalidated again here.
+   */
+  #requeueUnservedRunRequests(iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>): void {
+    const graph: IOperationGraph = this.#graph;
+    // Operations whose result predates the request. They must be marked as stale again.
+    const outdatedOperationsByReason: Map<string | undefined, Operation[]> = new Map();
+    // Operations with no result, or whose result is still marked as stale. The next iteration runs them.
+    const readyOperationsByReason: Map<string | undefined, Operation[]> = new Map();
+    for (const [operation, { reason, servedByIterationId }] of this.#runRequests) {
+      const result: IOperationExecutionResult | undefined = graph.resultByOperation.get(operation);
+      const unmarkedResult: IOperationExecutionResult | undefined =
+        result?.status === OperationStatus.Ready ? undefined : result;
+      if (unmarkedResult && unmarkedResult.iterationId >= servedByIterationId) {
+        continue;
+      }
+      const record: IOperationExecutionResult | undefined = iterationRecords.get(operation);
+      if (record?.enabled && record.iterationId >= servedByIterationId) {
+        // The operation was selected to run after the request, but did not produce a result, for example
+        // because a dependency failed or the iteration was aborted. Do not retry it.
+        continue;
+      }
+      const operationsByReason: Map<string | undefined, Operation[]> = unmarkedResult
+        ? outdatedOperationsByReason
+        : readyOperationsByReason;
+      let group: Operation[] | undefined = operationsByReason.get(reason);
+      if (!group) {
+        group = [];
+        operationsByReason.set(reason, group);
+      }
+      group.push(operation);
+    }
+    this.#runRequests.clear();
+    for (const [reason, operations] of outdatedOperationsByReason) {
+      // Fires onInvalidateOperations, which records the request again and queues an iteration.
+      graph.invalidateOperations(operations, reason);
+    }
+    for (const [reason, operations] of readyOperationsByReason) {
+      this.#onInvalidateOperations(operations, reason);
+    }
+  }
+
+  /**
+   * Called when the graph goes idle after an iteration. The watchers were closed while the iteration ran, so
+   * this compares the inputs of each operation in a new snapshot with the iteration's snapshot, and queues an
+   * iteration if any changed. Starting another iteration cancels the check.
+   */
+  async #queueIterationIfInputsChangedAsync(): Promise<void> {
+    const getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined = this.#getInputsSnapshotAsync;
+    const iterationSnapshot: IInputsSnapshot | undefined = this.#lastSnapshot;
+    if (!getInputsSnapshotAsync || !iterationSnapshot) {
+      return;
+    }
+    const check: object = {};
+    this.#inputsCheck = check;
+    let changedOperation: Operation | undefined;
+    try {
+      const currentSnapshot: IInputsSnapshot | undefined = await getInputsSnapshotAsync();
+      if (this.#inputsCheck !== check || !currentSnapshot) {
+        return;
+      }
+      changedOperation = _findOperationWithChangedInputs(
+        this.#graph.operations,
+        iterationSnapshot,
+        currentSnapshot
       );
+    } catch (e) {
+      if (this.#inputsCheck === check) {
+        this.#terminal.writeErrorLine(
+          `Failed to check for file changes made during the iteration: ${(e as Error).message}`
+        );
+      }
+      return;
+    }
+    if (changedOperation) {
+      this.#terminal.writeDebugLine(
+        `ProjectWatcher: the inputs of ${changedOperation.name} changed during the iteration`
+      );
+      this.#hasQueuedFileChange = true;
+      this.#debounce();
+    }
   }
 
   /**
@@ -397,7 +647,7 @@ export class ProjectWatcher {
           break;
         }
         case KEY_INVALIDATE: {
-          graph.invalidateOperations(undefined, 'manual-invalidation');
+          graph.invalidateOperations(undefined, MANUAL_INVALIDATION_REASON);
           this.#setStatus('All operations invalidated');
           break;
         }
@@ -465,6 +715,27 @@ export class ProjectWatcher {
   }
 }
 
+/**
+ * Returns an operation whose own state hash differs between the two snapshots, if there is one. The own state
+ * hash covers the operation's tracked files, additional files and environment variables.
+ */
+function _findOperationWithChangedInputs(
+  operations: Iterable<Operation>,
+  previousSnapshot: IInputsSnapshot,
+  currentSnapshot: IInputsSnapshot
+): Operation | undefined {
+  for (const operation of operations) {
+    const { associatedProject, associatedPhase } = operation;
+    if (
+      currentSnapshot.getOperationOwnStateHash(associatedProject, associatedPhase.name) !==
+      previousSnapshot.getOperationOwnStateHash(associatedProject, associatedPhase.name)
+    ) {
+      return operation;
+    }
+  }
+  return undefined;
+}
+
 /**
  * Given an iterable of repo-relative file paths, yields the set of directory prefixes
  * that should be watched to cover those files. Used on platforms without native recursive
diff --git a/libraries/rush-lib/src/logic/RepositoryLockWait.ts b/libraries/rush-lib/src/logic/RepositoryLockWait.ts
new file mode 100644
index 00000000000..036c0e5e49e
--- /dev/null
+++ b/libraries/rush-lib/src/logic/RepositoryLockWait.ts
@@ -0,0 +1,182 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { Async, FileSystem, type FileSystemStats, LockFile } from '@rushstack/node-core-library';
+import type { ITerminal } from '@rushstack/terminal';
+
+import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
+
+/** The resource name of Rush's repository lock, which Rush takes in the common temp folder. */
+const REPOSITORY_LOCK_NAME: string = 'rush';
+/** The name of each lock file of the repository lock on Linux and macOS. On Windows, `rush.lock` names no process. */
+const LOCK_FILE_NAME_REGEXP: RegExp = /^rush#(\d+)\.lock$/;
+/** How often a command that waits tries again to take the lock, as `LockFile.acquireAsync` does. */
+const RETRY_INTERVAL_MS: number = 100;
+const WHOLE_NUMBER_REGEXP: RegExp = /^\d{1,15}$/;
+
+/**
+ * A wait for the repository lock that `rush-client` asks for when it runs Rush in-process after it tried the daemon.
+ */
+export interface IRepositoryLockWait {
+  /** The time, in milliseconds since the Unix epoch, until which the command waits for the lock. */
+  readonly deadlineMs: number;
+  /** The process ID of the Rush daemon that handed the command back. */
+  readonly daemonPid?: number;
+}
+
+/**
+ * Reads the wait for the repository lock that `rush-client` asked for, and removes its variables from `environment`,
+ * so that neither the command's operations nor any Rush process that they start inherit it.
+ *
+ * @returns undefined if `rush-client` asked for no wait, or if its deadline is not a whole number.
+ */
+export function consumeRepositoryLockWait(
+  environment: NodeJS.ProcessEnv = process.env
+): IRepositoryLockWait | undefined {
+  const deadline: string | undefined = environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE];
+  const daemonPid: string | undefined = environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID];
+  delete environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE];
+  delete environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID];
+  const deadlineMs: number | undefined = parseWholeNumber(deadline);
+  if (deadlineMs === undefined) {
+    return undefined;
+  }
+  const pid: number | undefined = parseWholeNumber(daemonPid);
+  return pid ? { deadlineMs, daemonPid: pid } : { deadlineMs };
+}
+
+/**
+ * Describes the process that holds Rush's repository lock in `lockFolder`: "the Rush daemon (PID 4242)" if it is
+ * `daemonPid`, "another Rush process (PID 17)", or "another Rush process" if no lock file names it.
+ *
+ * @remarks
+ * On Linux and macOS, a process that tries to take the lock writes `rush#<pid>.lock`, and deletes it again if it
+ * fails, so at rest only the process that holds the lock has a lock file with content. If several do, the oldest
+ * one is named. On Windows, the lock file names no process. This only reads files.
+ */
+export function describeRepositoryLockHolder(
+  lockFolder: string,
+  daemonPid: number | undefined,
+  ownPid: number = process.pid
+): string {
+  const pid: number | undefined = findRepositoryLockHolderPid(lockFolder, ownPid);
+  if (pid === undefined) {
+    return 'another Rush process';
+  }
+  return pid === daemonPid ? `the Rush daemon (PID ${pid})` : `another Rush process (PID ${pid})`;
+}
+
+/** The outcome of {@link acquireRepositoryLockAsync}. */
+export interface IRepositoryLockResult {
+  /** The lock, if this process took it. */
+  readonly lock: LockFile | undefined;
+  /**
+   * If this process did not take the lock, and `rush-client` asked for a wait, the sentence that names the process
+   * that holds it, for example "The Rush daemon (PID 4242) still holds this repository's lock."
+   */
+  readonly holderSentence?: string;
+}
+
+/** The options of {@link acquireRepositoryLockAsync}. */
+export interface IAcquireRepositoryLockOptions {
+  /** The folder of the lock, which is the common temp folder. */
+  readonly lockFolder: string;
+  /** The wait that `rush-client` asked for. Without one, this tries once to take the lock, as Rush always has. */
+  readonly wait: IRepositoryLockWait | undefined;
+  /** Receives, as a warning, the line that says what the command waits for. */
+  readonly terminal: ITerminal;
+  /** Tries once to take the lock. Defaults to `LockFile.tryAcquire`. */
+  readonly tryAcquire?: (lockFolder: string) => LockFile | undefined;
+  /** Returns the current time in milliseconds since the Unix epoch. Defaults to `Date.now`. */
+  readonly now?: () => number;
+  /** Waits before the next attempt. Defaults to `Async.sleepAsync`. */
+  readonly sleepAsync?: (ms: number) => Promise<void>;
+  /** This process's ID, whose own lock file never names the holder. Defaults to `process.pid`. */
+  readonly ownPid?: number;
+}
+
+/**
+ * Takes Rush's repository lock. Without a wait, this tries once. With a wait whose deadline has not passed, it writes
+ * a line that names the process that holds the lock, then tries again every 100 ms until it takes the lock or the
+ * deadline passes. Errors other than a held lock are thrown, as `LockFile.tryAcquire` throws them.
+ */
+export async function acquireRepositoryLockAsync(
+  options: IAcquireRepositoryLockOptions
+): Promise<IRepositoryLockResult> {
+  const {
+    lockFolder,
+    wait,
+    terminal,
+    tryAcquire = tryAcquireRepositoryLock,
+    now = Date.now,
+    sleepAsync = Async.sleepAsync,
+    ownPid = process.pid
+  } = options;
+  let lock: LockFile | undefined = tryAcquire(lockFolder);
+  if (lock || !wait) {
+    return { lock };
+  }
+  let remainingMs: number = wait.deadlineMs - now();
+  const waits: boolean = remainingMs > 0;
+  if (waits) {
+    const holder: string = describeRepositoryLockHolder(lockFolder, wait.daemonPid, ownPid);
+    terminal.writeWarningLine(
+      `Waiting up to ${Math.ceil(remainingMs / 1000)} s for ${holder} to release this repository's lock.`
+    );
+  }
+  while (remainingMs > 0) {
+    await sleepAsync(Math.min(RETRY_INTERVAL_MS, remainingMs));
+    lock = tryAcquire(lockFolder);
+    if (lock) {
+      return { lock };
+    }
+    remainingMs = wait.deadlineMs - now();
+  }
+  const holder: string = describeRepositoryLockHolder(lockFolder, wait.daemonPid, ownPid);
+  const holds: string = waits ? 'still holds' : 'holds';
+  return { lock, holderSentence: `${capitalize(holder)} ${holds} this repository's lock.` };
+}
+
+function tryAcquireRepositoryLock(lockFolder: string): LockFile | undefined {
+  return LockFile.tryAcquire(lockFolder, REPOSITORY_LOCK_NAME);
+}
+
+function findRepositoryLockHolderPid(lockFolder: string, ownPid: number): number | undefined {
+  let names: string[];
+  try {
+    names = FileSystem.readFolderItemNames(lockFolder);
+  } catch {
+    return undefined;
+  }
+  let holderPid: number | undefined;
+  let holderWrittenMs: number = Infinity;
+  for (const name of names) {
+    const pid: number = Number(LOCK_FILE_NAME_REGEXP.exec(name)?.[1]);
+    if (!Number.isSafeInteger(pid) || pid === ownPid) {
+      continue;
+    }
+    let stats: FileSystemStats;
+    try {
+      stats = FileSystem.getStatistics(path.join(lockFolder, name));
+    } catch {
+      // The process released the lock and deleted its lock file.
+      continue;
+    }
+    // An empty lock file belongs to a process that has only begun to try to take the lock.
+    if (stats.size > 0 && stats.mtimeMs < holderWrittenMs) {
+      holderPid = pid;
+      holderWrittenMs = stats.mtimeMs;
+    }
+  }
+  return holderPid;
+}
+
+function parseWholeNumber(value: string | undefined): number | undefined {
+  return value !== undefined && WHOLE_NUMBER_REGEXP.test(value) ? Number(value) : undefined;
+}
+
+function capitalize(text: string): string {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
diff --git a/libraries/rush-lib/src/logic/Telemetry.ts b/libraries/rush-lib/src/logic/Telemetry.ts
index 8c6ac3fab72..dc45dee1200 100644
--- a/libraries/rush-lib/src/logic/Telemetry.ts
+++ b/libraries/rush-lib/src/logic/Telemetry.ts
@@ -155,6 +155,34 @@ export interface ITelemetryData {
 const MAX_FILE_COUNT: number = 100;
 const ONE_MEGABYTE_IN_BYTES: 1048576 = 1048576;
 
+interface ICpuSummary {
+  model: string;
+  count: number;
+}
+
+// os.cpus() takes milliseconds on a machine with many CPUs (on Linux it reads a file for each one), and the
+// Rush daemon logs telemetry for every request, so the CPUs are read at most once per process.
+let _cpuSummary: ICpuSummary | undefined;
+
+function getMachineInfo(): ITelemetryMachineInfo {
+  if (!_cpuSummary) {
+    const cpus: os.CpuInfo[] = os.cpus();
+    _cpuSummary = {
+      // The Node.js model is sometimes padded, for example:
+      // "AMD Ryzen 7 3700X 8-Core Processor             "
+      model: cpus[0].model.trim(),
+      count: cpus.length
+    };
+  }
+  return {
+    machineArchitecture: os.arch(),
+    machineCpu: _cpuSummary.model,
+    machineCores: _cpuSummary.count,
+    machineTotalMemoryMiB: Math.round(os.totalmem() / ONE_MEGABYTE_IN_BYTES),
+    machineFreeMemoryMiB: Math.round(os.freemem() / ONE_MEGABYTE_IN_BYTES)
+  };
+}
+
 export class Telemetry {
   #enabled: boolean;
   #store: ITelemetryData[];
@@ -163,6 +191,7 @@ export class Telemetry {
   #rushSession: RushSession;
   readonly #flushAsyncTasks: Set<Promise<void>> = new Set();
   #telemetryStartTime: number = 0;
+  #lastFileTimeMs: number = 0;
 
   public constructor(rushConfiguration: RushConfiguration, rushSession: RushSession) {
     this.#rushConfiguration = rushConfiguration;
@@ -183,7 +212,6 @@ export class Telemetry {
     );
     const processExitCode: number =
       typeof process.exitCode === 'number' ? process.exitCode : Number(process.exitCode);
-    const cpus: os.CpuInfo[] = os.cpus();
     const data: ITelemetryData = {
       ...telemetryData,
       reporterData: reporterAggregate
@@ -204,15 +232,7 @@ export class Telemetry {
         : telemetryData.reporterData,
       performanceEntries:
         telemetryData.performanceEntries || collectPerformanceEntries(this.#telemetryStartTime),
-      machineInfo: telemetryData.machineInfo || {
-        machineArchitecture: os.arch(),
-        // The Node.js model is sometimes padded, for example:
-        // "AMD Ryzen 7 3700X 8-Core Processor             "
-        machineCpu: cpus[0].model.trim(),
-        machineCores: cpus.length,
-        machineTotalMemoryMiB: Math.round(os.totalmem() / ONE_MEGABYTE_IN_BYTES),
-        machineFreeMemoryMiB: Math.round(os.freemem() / ONE_MEGABYTE_IN_BYTES)
-      },
+      machineInfo: telemetryData.machineInfo || getMachineInfo(),
       timestampMs: telemetryData.timestampMs || new Date().getTime(),
       platform: telemetryData.platform || process.platform,
       rushVersion: telemetryData.rushVersion || Rush.version
@@ -296,8 +316,18 @@ export class Telemetry {
   }
 
   #getFilePath(): string {
-    let fileName: string = `telemetry_${new Date().toISOString()}`;
-    fileName = fileName.replace(/[\-\:\.]/g, '_') + '.json';
-    return path.join(this.#dataFolder, fileName);
+    // A long-lived host can flush several entries within one millisecond, so keep every file name distinct.
+    let timeMs: number = Math.max(Date.now(), this.#lastFileTimeMs + 1);
+    let fullPath: string = path.join(this.#dataFolder, getFileName(timeMs));
+    while (FileSystem.exists(fullPath)) {
+      timeMs++;
+      fullPath = path.join(this.#dataFolder, getFileName(timeMs));
+    }
+    this.#lastFileTimeMs = timeMs;
+    return fullPath;
   }
 }
+
+function getFileName(timeMs: number): string {
+  return `telemetry_${new Date(timeMs).toISOString()}`.replace(/[\-\:\.]/g, '_') + '.json';
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts b/libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts
new file mode 100644
index 00000000000..2762f6ea7bd
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts
@@ -0,0 +1,681 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+/**
+ * The folder, under the common temp folder, that holds the sealed outputs of operations until their build cache
+ * entries are written. Each process uses a subfolder named by its PID, which is empty when it has no pending writes.
+ */
+export const DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME: string = 'build-cache-staging';
+
+// How many files are cloned at once when outputs are sealed
+const CLONE_CONCURRENCY: number = 16;
+// How long an operation waits for its output files to be cloned. Cloning takes longer when the file system must first
+// write back the data that the build just wrote, which can take seconds. The rest of the files are then cloned in the
+// background.
+const SEAL_WAIT_MS: number = 500;
+// How many build cache entries are written at once. Each write runs tar and gzip, which use about a core each.
+const WRITE_CONCURRENCY: number = 2;
+// The errors with which a file system refuses to clone files. After one of them, outputs are no longer sealed.
+const CLONE_UNSUPPORTED_ERROR_CODES: ReadonlySet<string> = new Set([
+  'EXDEV',
+  'EOPNOTSUPP',
+  'ENOTSUP',
+  'ENOSYS'
+]);
+const BYTES_PER_MB: number = 1024 * 1024;
+const NANOSECONDS_PER_MICROSECOND: bigint = BigInt(1000);
+const MICROSECONDS_PER_SECOND: number = 1000 * 1000;
+
+/**
+ * Output files that were cloned into a staging folder.
+ */
+export interface ISealedOutputs {
+  /** The staging folder, which the paths of the files are relative to */
+  readonly folderPath: string;
+  readonly fileCount: number;
+  readonly byteCount: number;
+  /**
+   * True if some of the files were still being cloned when the outputs were returned. They are cloned in the
+   * background, and the build cache entry is written only if none of them changed before it was cloned.
+   */
+  readonly isSealing?: boolean;
+}
+
+export interface ISealOutputsOptions {
+  /** The common temp folder of the repository, which holds the staging folder */
+  readonly commonTempFolder: string;
+  /** The folder that `relativePaths` are relative to */
+  readonly sourceFolderPath: string;
+  readonly relativePaths: ReadonlyArray<string>;
+  /** Gets a line if the files can't be sealed */
+  readonly terminal: ITerminal;
+}
+
+/**
+ * A build cache entry to write from sealed outputs.
+ */
+export interface IDeferredCacheEntryWrite {
+  readonly cacheId: string;
+  /** The name of the operation, such as `my-project (build)` */
+  readonly operationName: string;
+  readonly sealedOutputs: ISealedOutputs;
+  /**
+   * Writes the entry from the sealed outputs. Resolves to the size of the entry in bytes, or to `undefined` if it
+   * was not written, in which case its terminal output is logged. The abort signal kills tar.
+   */
+  readonly writeAsync: (terminal: ITerminal, abortSignal: AbortSignal) => Promise<number | undefined>;
+}
+
+export interface IDeferredCacheEntryWritesReport {
+  /** Entries that were queued since the previous report */
+  readonly queuedCount: number;
+  /** Entries that were written since the previous report */
+  readonly writtenCount: number;
+  /** The total size in bytes of those entries */
+  readonly writtenByteCount: number;
+  /** Entries that failed to be written since the previous report */
+  readonly failedCount: number;
+  /**
+   * Entries that were dropped since the previous report, because an output file changed before it was sealed or
+   * because the writes were aborted
+   */
+  readonly droppedCount: number;
+  /** Entries that are being sealed, queued or being written */
+  readonly pendingCount: number;
+}
+
+export interface IDeferredCacheEntryWritesOptions {
+  /** Clones a file. By default, this fails unless the file system can clone the file. */
+  readonly cloneFileAsync?: (sourcePath: string, destinationPath: string) => Promise<void>;
+  /** Whether a process with the given ID is running */
+  readonly isProcessRunning?: (pid: number) => boolean;
+  /** The ID of this process */
+  readonly pid?: number;
+  /**
+   * How long `trySealAsync` waits for the files to be cloned before it lets them be cloned in the background. By
+   * default, half a second.
+   */
+  readonly sealWaitMs?: number;
+}
+
+/**
+ * A seal that went on in the background after `trySealAsync` returned.
+ */
+interface IBackgroundSeal {
+  readonly abortController: AbortController;
+  /** Resolves when the files are all cloned, and rejects if one of them changed first or couldn't be cloned */
+  readonly clonePromise: Promise<void>;
+  readonly startTimeMs: number;
+}
+
+/**
+ * An output file, with its statistics from when the operation ended.
+ */
+interface ISealSource {
+  readonly relativePath: string;
+  readonly stats: fs.BigIntStats;
+}
+
+/**
+ * The error with which a seal fails if an output file changed or was deleted before it was cloned.
+ */
+class OutputFileChangedError extends Error {
+  public readonly relativePath: string;
+
+  public constructor(relativePath: string) {
+    super(`${relativePath} changed before it was sealed`);
+    this.relativePath = relativePath;
+  }
+}
+
+/**
+ * Writes build cache entries in the background, for the `deferCacheWrites` setting of the Rush daemon.
+ *
+ * @remarks
+ * When an operation completes, its output files are cloned into a staging folder. On a file system that can clone
+ * files, this usually takes well under a second, even for thousands of files, because the clones share the data of
+ * the files until either changes. The build cache entry is then written from the clones while the build goes on, so
+ * that later changes to the output files can't change the entry. If the clones take longer, for example while the
+ * file system writes back what the build just wrote, the operation stops waiting for them after half a second. The
+ * rest are cloned in the background, and the entry is dropped if a file changed before it was cloned. There is one
+ * instance for each process, so that the writes outlive the engine of the build that queued them.
+ */
+export class DeferredCacheEntryWrites {
+  static #instance: DeferredCacheEntryWrites | undefined;
+
+  readonly #cloneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void>;
+  readonly #isProcessRunning: (pid: number) => boolean;
+  readonly #pid: number;
+  readonly #sealWaitMs: number;
+  readonly #queue: IDeferredCacheEntryWrite[] = [];
+  readonly #runningWrites: Set<Promise<void>> = new Set();
+  // The seals that went on in the background, by the path of their staging folder
+  readonly #backgroundSeals: Map<string, IBackgroundSeal> = new Map();
+  // The writes that were queued while their outputs were still being sealed
+  readonly #sealingWrites: Set<Promise<void>> = new Set();
+  // The writes from when they are queued until they are written, fail or are dropped
+  readonly #pendingWrites: Set<IDeferredCacheEntryWrite> = new Set();
+  // The folder of this process in each staging folder that it used, by the path of the staging folder
+  readonly #processFolderPromises: Map<string, Promise<string>> = new Map();
+  #abortController: AbortController = new AbortController();
+  #log: ((message: string) => void) | undefined;
+  #nextFolderIndex: number = 0;
+  // The error with which the file system refused to clone a file, if it did
+  #cloneUnsupportedErrorCode: string | undefined;
+  #queuedCount: number = 0;
+  #writtenCount: number = 0;
+  #writtenByteCount: number = 0;
+  #failedCount: number = 0;
+  #droppedCount: number = 0;
+
+  public constructor(options: IDeferredCacheEntryWritesOptions = {}) {
+    this.#cloneFileAsync = options.cloneFileAsync ?? cloneFileAsync;
+    this.#isProcessRunning = options.isProcessRunning ?? isProcessRunning;
+    this.#pid = options.pid ?? process.pid;
+    this.#sealWaitMs = options.sealWaitMs ?? SEAL_WAIT_MS;
+  }
+
+  /**
+   * The instance for this process.
+   */
+  public static get instance(): DeferredCacheEntryWrites {
+    return (DeferredCacheEntryWrites.#instance ??= new DeferredCacheEntryWrites());
+  }
+
+  /**
+   * Sets the function that gets a line for each entry that is written, fails or is dropped.
+   */
+  public setLog(log: ((message: string) => void) | undefined): void {
+    this.#log = log;
+  }
+
+  /**
+   * Clones the files into a new staging folder, keeping their modes and modification times. If that takes longer
+   * than half a second, the rest of the files are cloned in the background.
+   *
+   * @returns The staging folder, or `undefined` if the files could not be cloned. The build cache entry must then
+   * be written from the files themselves.
+   */
+  public async trySealAsync(options: ISealOutputsOptions): Promise<ISealedOutputs | undefined> {
+    const { commonTempFolder, sourceFolderPath, relativePaths, terminal } = options;
+    if (this.#cloneUnsupportedErrorCode !== undefined) {
+      terminal.writeVerboseLine(
+        `The output files can't be cloned (${this.#cloneUnsupportedErrorCode}), so the build cache entry is written now.`
+      );
+      return undefined;
+    }
+
+    const startTimeMs: number = performance.now();
+    let folderPath: string | undefined;
+    try {
+      folderPath = await this.#createStagingFolderAsync(commonTempFolder);
+      // Each clone is checked against the state that its file had when the operation ended.
+      const sources: ISealSource[] = await statFilesAsync(sourceFolderPath, relativePaths);
+      let byteCount: number = 0;
+      for (const { stats } of sources) {
+        byteCount += Number(stats.size);
+      }
+      const abortController: AbortController = new AbortController();
+      const clonePromise: Promise<void> = cloneFilesAsync(
+        sourceFolderPath,
+        folderPath,
+        sources,
+        this.#cloneFileAsync,
+        abortController.signal
+      );
+      if (await isResolvedWithinAsync(clonePromise, this.#sealWaitMs)) {
+        return { folderPath, fileCount: sources.length, byteCount };
+      }
+      // The write of the entry reports a failure of the seal once it is queued.
+      clonePromise.catch(() => undefined);
+      this.#backgroundSeals.set(folderPath, { abortController, clonePromise, startTimeMs });
+      return { folderPath, fileCount: sources.length, byteCount, isSealing: true };
+    } catch (error) {
+      if (folderPath !== undefined) {
+        await deleteFolderQuietlyAsync(folderPath);
+      }
+      const code: string | undefined = (error as NodeJS.ErrnoException).code;
+      if (code !== undefined && CLONE_UNSUPPORTED_ERROR_CODES.has(code)) {
+        this.#cloneUnsupportedErrorCode = code;
+      }
+      terminal.writeLine(
+        `Unable to clone the output files (${code ?? (error as Error).message}), so the build cache entry is ` +
+          `written now.`
+      );
+      return undefined;
+    }
+  }
+
+  /**
+   * Queues a write. It starts when its outputs are sealed and fewer than two writes are running.
+   */
+  public enqueue(write: IDeferredCacheEntryWrite): void {
+    this.#queuedCount++;
+    this.#pendingWrites.add(write);
+    const backgroundSeal: IBackgroundSeal | undefined = this.#backgroundSeals.get(
+      write.sealedOutputs.folderPath
+    );
+    if (!backgroundSeal) {
+      this.#queue.push(write);
+      this.#startWrites();
+      return;
+    }
+    const sealingWrite: Promise<void> = this.#queueWhenSealedAsync(write, backgroundSeal).finally(() => {
+      this.#sealingWrites.delete(sealingWrite);
+    });
+    this.#sealingWrites.add(sealingWrite);
+  }
+
+  /**
+   * Whether a write of the build cache entry with the given ID is being sealed, is queued or is running. Such a
+   * write replaces the entry when it ends.
+   */
+  public hasPendingWrite(cacheId: string): boolean {
+    for (const write of this.#pendingWrites) {
+      if (write.cacheId === cacheId) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Returns the counts since the previous report, and the number of pending writes.
+   */
+  public takeReport(): IDeferredCacheEntryWritesReport {
+    const report: IDeferredCacheEntryWritesReport = {
+      queuedCount: this.#queuedCount,
+      writtenCount: this.#writtenCount,
+      writtenByteCount: this.#writtenByteCount,
+      failedCount: this.#failedCount,
+      droppedCount: this.#droppedCount,
+      pendingCount: this.#queue.length + this.#runningWrites.size + this.#sealingWrites.size
+    };
+    this.#queuedCount = 0;
+    this.#writtenCount = 0;
+    this.#writtenByteCount = 0;
+    this.#failedCount = 0;
+    this.#droppedCount = 0;
+    return report;
+  }
+
+  /**
+   * Resolves when no writes are being sealed, queued or running.
+   */
+  public async waitForIdleAsync(): Promise<void> {
+    while (this.#runningWrites.size > 0 || this.#sealingWrites.size > 0) {
+      await Promise.all([...this.#runningWrites, ...this.#sealingWrites]);
+    }
+  }
+
+  /**
+   * Drops the queued writes, stops the seals in the background, kills the tar processes of the running writes and
+   * waits for them all, then deletes the staging folders of this process. Their entries are not written. Writes
+   * that are queued later run as usual.
+   */
+  public async abortAsync(): Promise<void> {
+    const droppedWrites: IDeferredCacheEntryWrite[] = this.#queue.splice(0);
+    const runningWrites: Promise<void>[] = Array.from(this.#runningWrites);
+    const sealingWrites: Promise<void>[] = Array.from(this.#sealingWrites);
+    // Each seal stays in the map until its write is queued, and that write drops the entry.
+    const backgroundSeals: IBackgroundSeal[] = Array.from(this.#backgroundSeals.values());
+    for (const { abortController } of backgroundSeals) {
+      abortController.abort();
+    }
+    this.#abortController.abort();
+    this.#abortController = new AbortController();
+    for (const write of droppedWrites) {
+      this.#pendingWrites.delete(write);
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${write.cacheId} for ${write.operationName}, which was not written yet.`
+      );
+    }
+    await Promise.all([
+      ...droppedWrites.map(({ sealedOutputs }) => deleteFolderQuietlyAsync(sealedOutputs.folderPath)),
+      ...runningWrites,
+      ...sealingWrites,
+      // The clones that are running when a seal is stopped finish first.
+      ...backgroundSeals.map(({ clonePromise }) => clonePromise.catch(() => undefined))
+    ]);
+
+    const processFolderPromises: Promise<string>[] = Array.from(this.#processFolderPromises.values());
+    this.#processFolderPromises.clear();
+    for (const processFolderPromise of processFolderPromises) {
+      try {
+        await deleteFolderQuietlyAsync(await processFolderPromise);
+      } catch {
+        // The folder was not created.
+      }
+    }
+  }
+
+  async #queueWhenSealedAsync(
+    write: IDeferredCacheEntryWrite,
+    backgroundSeal: IBackgroundSeal
+  ): Promise<void> {
+    const { cacheId, operationName, sealedOutputs } = write;
+    const { abortController, clonePromise, startTimeMs } = backgroundSeal;
+    let sealError: { error: unknown } | undefined;
+    try {
+      await clonePromise;
+    } catch (error) {
+      sealError = { error };
+    }
+    this.#backgroundSeals.delete(sealedOutputs.folderPath);
+
+    if (!sealError && !abortController.signal.aborted) {
+      this.#writeLog(
+        `Sealed the output files of ${operationName} in the background in ` +
+          `${Math.round(performance.now() - startTimeMs)} ms.`
+      );
+      this.#queue.push(write);
+      this.#startWrites();
+      return;
+    }
+
+    this.#pendingWrites.delete(write);
+    await deleteFolderQuietlyAsync(sealedOutputs.folderPath);
+    const error: unknown = sealError?.error;
+    if (abortController.signal.aborted) {
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${cacheId} for ${operationName}, which was not written yet.`
+      );
+    } else if (error instanceof OutputFileChangedError) {
+      // The entry would hold output files that no longer exist, so this is not a failure.
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${cacheId} for ${operationName}, because ${error.relativePath} changed ` +
+          `before it was sealed.`
+      );
+    } else {
+      const code: string | undefined = (error as NodeJS.ErrnoException).code;
+      if (code !== undefined && CLONE_UNSUPPORTED_ERROR_CODES.has(code)) {
+        this.#cloneUnsupportedErrorCode = code;
+      }
+      this.#failedCount++;
+      this.#writeLog(
+        `Failed to write the build cache entry ${cacheId} for ${operationName}: Unable to clone the output ` +
+          `files (${code ?? (error as Error).message}).`
+      );
+    }
+  }
+
+  #startWrites(): void {
+    while (this.#runningWrites.size < WRITE_CONCURRENCY && this.#queue.length > 0) {
+      const write: IDeferredCacheEntryWrite = this.#queue.shift()!;
+      const runningWrite: Promise<void> = this.#writeAsync(write, this.#abortController.signal).finally(
+        () => {
+          this.#pendingWrites.delete(write);
+          this.#runningWrites.delete(runningWrite);
+          this.#startWrites();
+        }
+      );
+      this.#runningWrites.add(runningWrite);
+    }
+  }
+
+  async #writeAsync(write: IDeferredCacheEntryWrite, abortSignal: AbortSignal): Promise<void> {
+    const { cacheId, operationName, sealedOutputs } = write;
+    const startTimeMs: number = performance.now();
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const terminal: Terminal = new Terminal(terminalProvider);
+    let byteCount: number | undefined;
+    try {
+      byteCount = await write.writeAsync(terminal, abortSignal);
+    } catch (error) {
+      terminal.writeErrorLine((error as Error).message);
+    } finally {
+      await deleteFolderQuietlyAsync(sealedOutputs.folderPath);
+    }
+
+    const durationMs: number = Math.round(performance.now() - startTimeMs);
+    if (byteCount !== undefined) {
+      this.#writtenCount++;
+      this.#writtenByteCount += byteCount;
+      this.#writeLog(
+        `Wrote the build cache entry ${cacheId} (${formatMegabytes(byteCount)}) for ${operationName} in ` +
+          `${durationMs} ms.`
+      );
+    } else if (abortSignal.aborted) {
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${cacheId} for ${operationName}, which was being written.`
+      );
+    } else {
+      this.#failedCount++;
+      const output: string = [
+        terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false }),
+        terminalProvider.getErrorOutput({ normalizeSpecialCharacters: false })
+      ]
+        .join(' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+      this.#writeLog(`Failed to write the build cache entry ${cacheId} for ${operationName}: ${output}`);
+    }
+  }
+
+  #writeLog(message: string): void {
+    try {
+      this.#log?.(message);
+    } catch {
+      // A log that throws must not stop the writes.
+    }
+  }
+
+  async #createStagingFolderAsync(commonTempFolder: string): Promise<string> {
+    const stagingFolderPath: string = path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME);
+    let processFolderPromise: Promise<string> | undefined =
+      this.#processFolderPromises.get(stagingFolderPath);
+    if (!processFolderPromise) {
+      processFolderPromise = this.#prepareProcessFolderAsync(stagingFolderPath);
+      this.#processFolderPromises.set(stagingFolderPath, processFolderPromise);
+    }
+    const folderPath: string = path.join(await processFolderPromise, `${this.#nextFolderIndex++}`);
+    await fs.promises.mkdir(folderPath);
+    return folderPath;
+  }
+
+  async #prepareProcessFolderAsync(stagingFolderPath: string): Promise<string> {
+    const processFolderPath: string = path.join(stagingFolderPath, `${this.#pid}`);
+    // An earlier process with the same ID may have left files behind.
+    await FileSystem.ensureEmptyFolderAsync(processFolderPath);
+    // Delete the folders of processes that ended without deleting theirs, for example because they crashed.
+    for (const name of await FileSystem.readFolderItemNamesAsync(stagingFolderPath)) {
+      const pid: number = Number(name);
+      if (/^\d+$/.test(name) && pid !== this.#pid && !this.#isProcessRunning(pid)) {
+        await deleteFolderQuietlyAsync(path.join(stagingFolderPath, name));
+      }
+    }
+    return processFolderPath;
+  }
+}
+
+/**
+ * Formats a number of bytes in megabytes, such as `12.3 MB`.
+ */
+export function formatMegabytes(byteCount: number): string {
+  return `${(byteCount / BYTES_PER_MB).toFixed(1)} MB`;
+}
+
+async function cloneFileAsync(sourcePath: string, destinationPath: string): Promise<void> {
+  // FICLONE_FORCE fails unless the file system clones the file, which shares its data until either copy changes.
+  await fs.promises.copyFile(sourcePath, destinationPath, fs.constants.COPYFILE_FICLONE_FORCE);
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    // Signal 0 checks that the process exists, without signaling it.
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM means that the process exists, but belongs to another user.
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+/**
+ * Gets the statistics of each output file, which must be a file.
+ */
+async function statFilesAsync(
+  sourceFolderPath: string,
+  relativePaths: ReadonlyArray<string>
+): Promise<ISealSource[]> {
+  const sources: ISealSource[] = new Array(relativePaths.length);
+  await forEachConcurrentlyAsync(
+    Array.from(relativePaths.keys()),
+    async (index: number) => {
+      const relativePath: string = relativePaths[index];
+      const stats: fs.BigIntStats = await fs.promises.lstat(path.join(sourceFolderPath, relativePath), {
+        bigint: true
+      });
+      if (!stats.isFile()) {
+        throw new Error(`"${relativePath}" is not a file`);
+      }
+      sources[index] = { relativePath, stats };
+    },
+    undefined
+  );
+  return sources;
+}
+
+async function cloneFilesAsync(
+  sourceFolderPath: string,
+  destinationFolderPath: string,
+  sources: ReadonlyArray<ISealSource>,
+  cloneOneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void>,
+  abortSignal: AbortSignal
+): Promise<void> {
+  const folderPaths: Set<string> = new Set();
+  for (const { relativePath } of sources) {
+    folderPaths.add(path.join(destinationFolderPath, path.dirname(relativePath)));
+  }
+  await forEachConcurrentlyAsync(
+    Array.from(folderPaths),
+    async (folderPath: string) => {
+      await fs.promises.mkdir(folderPath, { recursive: true });
+    },
+    abortSignal
+  );
+
+  await forEachConcurrentlyAsync(
+    sources,
+    async ({ relativePath, stats }: ISealSource) => {
+      const sourcePath: string = path.join(sourceFolderPath, relativePath);
+      const destinationPath: string = path.join(destinationFolderPath, relativePath);
+      let cloneError: { error: unknown } | undefined;
+      try {
+        await cloneOneFileAsync(sourcePath, destinationPath);
+      } catch (error) {
+        cloneError = { error };
+      }
+      // A clone is a consistent copy of its file. Writing, truncating or replacing the file after its statistics
+      // were taken changes its change time or its inode, so if they are the same now, the clone holds the file as it
+      // was when the operation ended.
+      if (!(await isUnchangedAsync(sourcePath, stats))) {
+        throw new OutputFileChangedError(relativePath);
+      }
+      if (cloneError) {
+        throw cloneError.error;
+      }
+      // The build cache entry has the modification time of each file. A clone has the mode of its source.
+      await fs.promises.utimes(
+        destinationPath,
+        getSecondsForUtimes(stats.atimeNs),
+        getSecondsForUtimes(stats.mtimeNs)
+      );
+    },
+    abortSignal
+  );
+}
+
+/**
+ * Converts a time in nanoseconds to seconds for `utimes`, with the same whole seconds. The dates of `fs.Stats` are
+ * rounded to the nearest millisecond, which moves a time in the last half millisecond of a second to the next second.
+ */
+export function getSecondsForUtimes(timeNs: bigint): number {
+  // A number holds a count of microseconds exactly, and the quotient stays below the next whole second.
+  return Number(timeNs / NANOSECONDS_PER_MICROSECOND) / MICROSECONDS_PER_SECOND;
+}
+
+async function isUnchangedAsync(filePath: string, stats: fs.BigIntStats): Promise<boolean> {
+  let current: fs.BigIntStats;
+  try {
+    current = await fs.promises.lstat(filePath, { bigint: true });
+  } catch {
+    return false;
+  }
+  return (
+    current.dev === stats.dev &&
+    current.ino === stats.ino &&
+    current.size === stats.size &&
+    current.mtimeNs === stats.mtimeNs &&
+    current.ctimeNs === stats.ctimeNs
+  );
+}
+
+/**
+ * Resolves to true if the promise resolves within the given time, and to false if it hasn't settled by then. Rejects
+ * if the promise rejects within that time.
+ */
+async function isResolvedWithinAsync(promise: Promise<void>, timeoutMs: number): Promise<boolean> {
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise.then(() => true),
+      new Promise<boolean>((resolve) => {
+        timeout = setTimeout(() => resolve(false), timeoutMs);
+      })
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * Calls the callback for each item, for up to 16 items at once. Unlike `Async.forEachAsync`, it waits for the
+ * callbacks that are running when one fails or the signal is aborted, so that the caller can delete what they
+ * created.
+ */
+async function forEachConcurrentlyAsync<T>(
+  items: ReadonlyArray<T>,
+  callbackAsync: (item: T) => Promise<void>,
+  abortSignal: AbortSignal | undefined
+): Promise<void> {
+  let nextIndex: number = 0;
+  let failure: { error: unknown } | undefined;
+  const workAsync = async (): Promise<void> => {
+    while (!failure && !abortSignal?.aborted && nextIndex < items.length) {
+      const item: T = items[nextIndex++];
+      try {
+        await callbackAsync(item);
+      } catch (error) {
+        failure ??= { error };
+      }
+    }
+  };
+  const workerCount: number = Math.min(CLONE_CONCURRENCY, items.length);
+  await Promise.all(Array.from({ length: workerCount }, workAsync));
+  if (failure) {
+    throw failure.error;
+  }
+  if (abortSignal?.aborted) {
+    throw new Error('The seal was stopped.');
+  }
+}
+
+async function deleteFolderQuietlyAsync(folderPath: string): Promise<void> {
+  try {
+    await FileSystem.deleteFolderAsync(folderPath);
+  } catch {
+    // It is deleted with the other staging folders of this process when they are aborted, or by the next process
+    // with the same ID.
+  }
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
index bfcd964a6f0..e323de1ff90 100644
--- a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
+++ b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
@@ -14,6 +14,13 @@ import type { FileSystemBuildCacheProvider } from './FileSystemBuildCacheProvide
 import { TarExecutable } from '../../utilities/TarExecutable';
 import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
 import type { IBaseOperationExecutionResult } from '../operations/IOperationExecutionResult';
+import { OutputFolderReceipt, type PendingOutputFolderReceipt } from './OutputFolderReceipt';
+import { tryRestoreThroughStagingFolderAsync } from './StagedRestore';
+import {
+  type DeferredCacheEntryWrites,
+  type ISealedOutputs,
+  formatMegabytes
+} from './DeferredCacheEntryWrites';
 
 /**
  * How long to wait to acquire the per-cache-entry download lock (see
@@ -138,8 +145,14 @@ export class OperationBuildCache {
   readonly #cacheId: string | undefined;
   readonly #excludeAppleDoubleFiles: boolean;
   readonly #useDirectFileTransfersForBuildCache: boolean;
-
-  private constructor(cacheId: string | undefined, options: IProjectBuildCacheOptions) {
+  readonly #receipt: OutputFolderReceipt | undefined;
+  readonly #phaseName: string;
+
+  private constructor(
+    cacheId: string | undefined,
+    options: IProjectBuildCacheOptions,
+    receipt?: OutputFolderReceipt
+  ) {
     const {
       buildCacheConfiguration: {
         localCacheProvider,
@@ -150,7 +163,8 @@ export class OperationBuildCache {
       project,
       projectOutputFolderNames,
       excludeAppleDoubleFiles,
-      useDirectFileTransfersForBuildCache
+      useDirectFileTransfersForBuildCache,
+      phaseName
     } = options;
     this.#project = project;
     this.#localBuildCacheProvider = localCacheProvider;
@@ -161,6 +175,8 @@ export class OperationBuildCache {
     this.#cacheId = cacheId;
     this.#excludeAppleDoubleFiles = excludeAppleDoubleFiles && process.platform === 'darwin';
     this.#useDirectFileTransfersForBuildCache = useDirectFileTransfersForBuildCache;
+    this.#receipt = receipt;
+    this.#phaseName = phaseName;
   }
 
   public get cacheId(): string | undefined {
@@ -198,7 +214,14 @@ export class OperationBuildCache {
       useDirectFileTransfersForBuildCache
     };
     const cacheId: string | undefined = _getCacheId(buildCacheOptions);
-    return new OperationBuildCache(cacheId, buildCacheOptions);
+    // Only an operation's own build cache has a receipt, because the receipt is kept per operation.
+    const receipt: OutputFolderReceipt | undefined = OutputFolderReceipt.tryCreate({
+      projectFolder: buildCacheOptions.project.projectFolder,
+      projectRushTempFolder: buildCacheOptions.project.projectRushTempFolder,
+      logFilenameIdentifier: executionResult.operation.logFilenameIdentifier,
+      outputFolderNames: outputFolders
+    });
+    return new OperationBuildCache(cacheId, buildCacheOptions, receipt);
   }
 
   public async tryRestoreFromCacheAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean> {
@@ -215,6 +238,18 @@ export class OperationBuildCache {
 
     let localCacheEntryPath: string | undefined =
       await this.#localBuildCacheProvider.tryGetCacheEntryPathByIdAsync(terminal, cacheId);
+    if (
+      localCacheEntryPath &&
+      (await this.#tryReceiptActionAsync(terminal, 'read', (receipt: OutputFolderReceipt) =>
+        receipt.isMatchAsync(cacheId)
+      ))
+    ) {
+      terminal.writeLine('Build cache hit.');
+      terminal.writeVerboseLine(`Cache key: ${cacheId}`);
+      terminal.writeLine('The output folders already match this cache entry; nothing to restore.');
+      return true;
+    }
+
     let cloudCacheHit: boolean = false;
     let updateLocalCacheSuccess: boolean | undefined;
     if (!localCacheEntryPath && this.#cloudBuildCacheProvider) {
@@ -333,34 +368,55 @@ export class OperationBuildCache {
 
     const projectFolderPath: string = this.#project.projectFolder;
 
-    // Purge output folders
-    terminal.writeVerboseLine(`Clearing cached folders: ${this.#projectOutputFolderNames.join(', ')}`);
-    await Promise.all(
-      this.#projectOutputFolderNames.map((outputFolderName: string) =>
-        FileSystem.deleteFolderAsync(`${projectFolderPath}/${outputFolderName}`)
-      )
+    // The receipt describes the output folders, so it must not outlive them, even if the restore fails.
+    await this.#tryReceiptActionAsync(terminal, 'delete', (receipt: OutputFolderReceipt) =>
+      receipt.deleteAsync()
     );
 
     const tarUtility: TarExecutable | undefined = await _tryGetTarUtility(terminal);
-    let restoreSuccess: boolean = false;
+    const logFilePath: string = this.#getTarLogFilePath(cacheId, 'untar');
+    let tarExitCode: number | undefined;
     if (tarUtility && localCacheEntryPath) {
-      const logFilePath: string = this.#getTarLogFilePath(cacheId, 'untar');
-      const tarExitCode: number = await tarUtility.tryUntarAsync({
-        archivePath: localCacheEntryPath,
-        outputFolderPath: projectFolderPath,
-        logFilePath
+      // Restoring through a staging folder never leaves a file that is in both the old outputs and the entry
+      // missing, so a process that reads the outputs during the restore finds them.
+      const archivePath: string = localCacheEntryPath;
+      tarExitCode = await tryRestoreThroughStagingFolderAsync(terminal, {
+        projectFolder: projectFolderPath,
+        projectRushTempFolder: this.#project.projectRushTempFolder,
+        outputFolderNames: this.#projectOutputFolderNames,
+        untarAsync: (outputFolderPath: string) =>
+          tarUtility.tryUntarAsync({ archivePath, outputFolderPath, logFilePath })
       });
-      if (tarExitCode === 0) {
-        restoreSuccess = true;
-        terminal.writeLine('Successfully restored output from the build cache.');
-      } else {
-        terminal.writeWarningLine(
-          'Unable to restore output from the build cache. ' +
-            `See "${logFilePath}" for logs from the tar process.`
-        );
+    }
+
+    if (tarExitCode !== 0) {
+      // Purge output folders
+      terminal.writeVerboseLine(`Clearing cached folders: ${this.#projectOutputFolderNames.join(', ')}`);
+      for (const outputFolderName of this.#projectOutputFolderNames) {
+        await FileSystem.deleteFolderAsync(path.join(projectFolderPath, outputFolderName));
+      }
+
+      if (tarUtility && localCacheEntryPath && tarExitCode === undefined) {
+        tarExitCode = await tarUtility.tryUntarAsync({
+          archivePath: localCacheEntryPath,
+          outputFolderPath: projectFolderPath,
+          logFilePath
+        });
       }
     }
 
+    let restoreSuccess: boolean = false;
+    if (tarExitCode === 0) {
+      restoreSuccess = true;
+      terminal.writeLine('Successfully restored output from the build cache.');
+      await this.#tryWriteRestoredReceiptAsync(terminal, cacheId);
+    } else if (tarExitCode !== undefined) {
+      terminal.writeWarningLine(
+        'Unable to restore output from the build cache. ' +
+          `See "${logFilePath}" for logs from the tar process.`
+      );
+    }
+
     if (updateLocalCacheSuccess === false) {
       terminal.writeWarningLine('Unable to update the local build cache with data from the cloud cache.');
     }
@@ -368,7 +424,18 @@ export class OperationBuildCache {
     return restoreSuccess;
   }
 
-  public async trySetCacheEntryAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean> {
+  /**
+   * Writes the build cache entry for the output files of the operation.
+   *
+   * @param deferredCacheEntryWrites - If specified, the output files are sealed, and the entry is written from them
+   * in the background, so that this resolves as soon as they are sealed. If they can't be sealed, the entry is
+   * written before this resolves, as it is without this parameter.
+   */
+  public async trySetCacheEntryAsync(
+    terminal: ITerminal,
+    specifiedCacheId?: string,
+    deferredCacheEntryWrites?: DeferredCacheEntryWrites
+  ): Promise<boolean> {
     if (!this.#cacheWriteEnabled) {
       // Skip writing local and cloud build caches, without any noise
       return true;
@@ -380,6 +447,32 @@ export class OperationBuildCache {
       return false;
     }
 
+    // The stamp comes before the output folders are read, so a change to them while they are archived keeps the
+    // receipt from being written. No receipt is written while an older write of this entry is pending: that write
+    // would replace the entry that is written now, and the receipt would then describe outputs that the entry doesn't
+    // hold.
+    const isOlderWritePending: boolean = !!deferredCacheEntryWrites?.hasPendingWrite(cacheId);
+    const pendingReceipt: PendingOutputFolderReceipt | undefined = isOlderWritePending
+      ? undefined
+      : await this.#tryBeginReceiptAsync(terminal);
+    try {
+      return await this.#trySetCacheEntryWithReceiptAsync(
+        terminal,
+        cacheId,
+        pendingReceipt,
+        deferredCacheEntryWrites
+      );
+    } finally {
+      await this.#tryDisposeReceiptAsync(terminal, pendingReceipt);
+    }
+  }
+
+  async #trySetCacheEntryWithReceiptAsync(
+    terminal: ITerminal,
+    cacheId: string,
+    pendingReceipt: PendingOutputFolderReceipt | undefined,
+    deferredCacheEntryWrites: DeferredCacheEntryWrites | undefined
+  ): Promise<boolean> {
     const filesToCache: IPathsToCache | undefined = await this._tryCollectPathsToCacheAsync(terminal);
     if (!filesToCache) {
       return false;
@@ -389,6 +482,79 @@ export class OperationBuildCache {
       `Caching build output folders: ${filesToCache.filteredOutputFolderNames.join(', ')}`
     );
 
+    // If tar can't be found, the write below fails at once, so that the operation reports it.
+    if (deferredCacheEntryWrites && (await _tryGetTarUtility(terminal))) {
+      // A restore consults the receipt only if the local cache has the entry, so a receipt for an entry that is not
+      // written yet is never consulted if the write is dropped or fails. But an older entry for the same cache ID,
+      // such as one that "rush rebuild" wrote, would be paired with these outputs until the write replaces it, or for
+      // good if it doesn't. So if there is one, no receipt is written, and the next restore writes one.
+      const canWriteReceipt: boolean =
+        !!pendingReceipt &&
+        !(await this.#localBuildCacheProvider.tryGetCacheEntryPathByIdAsync(terminal, cacheId));
+      const sealStartTimeMs: number = performance.now();
+      const sealedOutputs: ISealedOutputs | undefined = await deferredCacheEntryWrites.trySealAsync({
+        commonTempFolder: this.#project.rushConfiguration.commonTempFolder,
+        sourceFolderPath: this.#project.projectFolder,
+        relativePaths: filesToCache.outputFilePaths,
+        terminal
+      });
+      if (sealedOutputs) {
+        deferredCacheEntryWrites.enqueue({
+          cacheId,
+          operationName: `${this.#project.packageName} (${this.#phaseName})`,
+          sealedOutputs,
+          writeAsync: async (writeTerminal: ITerminal, abortSignal: AbortSignal) => {
+            const written: boolean = await this.#tryWriteCacheEntryAsync(
+              writeTerminal,
+              cacheId,
+              filesToCache,
+              undefined,
+              {
+                baseFolderPath: sealedOutputs.folderPath,
+                abortSignal
+              }
+            );
+            if (!written) {
+              return undefined;
+            }
+            const cacheEntryPath: string = this.#localBuildCacheProvider.getCacheEntryPath(cacheId);
+            return (await FileSystem.getStatisticsAsync(cacheEntryPath)).size;
+          }
+        });
+        const { fileCount, byteCount, isSealing } = sealedOutputs;
+        const files: string = `${fileCount} output ${fileCount === 1 ? 'file' : 'files'}`;
+        const size: string = formatMegabytes(byteCount);
+        const sealDurationMs: number = Math.round(performance.now() - sealStartTimeMs);
+        if (isSealing) {
+          terminal.writeLine(
+            `Sealing ${files} (${size}) in the background after ${sealDurationMs} ms; the build cache entry ` +
+              `is written once they're sealed.`
+          );
+        } else {
+          terminal.writeLine(
+            `Sealed ${files} (${size}) in ${sealDurationMs} ms; writing the build cache entry in the background.`
+          );
+        }
+        terminal.writeVerboseLine(`Cache key: ${cacheId}`);
+        if (canWriteReceipt) {
+          // The receipt is written only if no output changed after the stamp, which was taken before the files were
+          // sealed, so it describes the sealed files that the entry is written from.
+          await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId, filesToCache.outputFilePaths);
+        }
+        return true;
+      }
+    }
+
+    return await this.#tryWriteCacheEntryAsync(terminal, cacheId, filesToCache, pendingReceipt, undefined);
+  }
+
+  async #tryWriteCacheEntryAsync(
+    terminal: ITerminal,
+    cacheId: string,
+    filesToCache: IPathsToCache,
+    pendingReceipt: PendingOutputFolderReceipt | undefined,
+    deferredWrite: { baseFolderPath: string; abortSignal: AbortSignal } | undefined
+  ): Promise<boolean> {
     let localCacheEntryPath: string | undefined;
 
     const tarUtility: TarExecutable | undefined = await _tryGetTarUtility(terminal);
@@ -401,7 +567,9 @@ export class OperationBuildCache {
         archivePath: tempLocalCacheEntryPath,
         paths: filesToCache.outputFilePaths,
         project: this.#project,
-        logFilePath
+        logFilePath,
+        baseFolderPath: deferredWrite?.baseFolderPath,
+        abortSignal: deferredWrite?.abortSignal
       });
 
       if (tarExitCode === 0) {
@@ -426,7 +594,12 @@ export class OperationBuildCache {
           throw moveError;
         }
         localCacheEntryPath = finalLocalCacheEntryPath;
+        await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId, filesToCache.outputFilePaths);
       } else {
+        if (deferredWrite) {
+          // A write in the background can be cut short, so it deletes its partial archive.
+          await FileSystem.deleteFileAsync(tempLocalCacheEntryPath);
+        }
         terminal.writeWarningLine(
           `"tar" exited with code ${tarExitCode} while attempting to create the cache entry. ` +
             `See "${logFilePath}" for logs from the tar process.`
@@ -578,4 +751,62 @@ export class OperationBuildCache {
   #getTarLogFilePath(cacheId: string, mode: 'tar' | 'untar'): string {
     return path.join(this.#project.projectRushTempFolder, `${cacheId}.${mode}.log`);
   }
+
+  // The stamp comes after the untar, so a change to the output folders after it keeps the receipt from being
+  // written, or from matching later.
+  async #tryWriteRestoredReceiptAsync(terminal: ITerminal, cacheId: string): Promise<void> {
+    const pendingReceipt: PendingOutputFolderReceipt | undefined = await this.#tryBeginReceiptAsync(terminal);
+    try {
+      await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId);
+    } finally {
+      await this.#tryDisposeReceiptAsync(terminal, pendingReceipt);
+    }
+  }
+
+  async #tryBeginReceiptAsync(terminal: ITerminal): Promise<PendingOutputFolderReceipt | undefined> {
+    return await this.#tryReceiptActionAsync(terminal, 'write', (receipt: OutputFolderReceipt) =>
+      receipt.beginAsync()
+    );
+  }
+
+  async #tryCommitReceiptAsync(
+    terminal: ITerminal,
+    pendingReceipt: PendingOutputFolderReceipt | undefined,
+    cacheId: string,
+    archivedFilePaths?: ReadonlyArray<string>
+  ): Promise<void> {
+    if (pendingReceipt) {
+      const reason: string | undefined = await this.#tryReceiptActionAsync(terminal, 'write', () =>
+        pendingReceipt.tryCommitAsync(cacheId, archivedFilePaths)
+      );
+      if (reason) {
+        terminal.writeVerboseLine(`Not writing a build cache receipt: ${reason}.`);
+      }
+    }
+  }
+
+  async #tryDisposeReceiptAsync(
+    terminal: ITerminal,
+    pendingReceipt: PendingOutputFolderReceipt | undefined
+  ): Promise<void> {
+    await this.#tryReceiptActionAsync(terminal, 'clean up', async () => await pendingReceipt?.disposeAsync());
+  }
+
+  // A receipt only saves work, so if it can't be read or written, the build cache works as it would without one.
+  async #tryReceiptActionAsync<T>(
+    terminal: ITerminal,
+    verb: 'read' | 'write' | 'delete' | 'clean up',
+    action: (receipt: OutputFolderReceipt) => Promise<T>
+  ): Promise<T | undefined> {
+    const receipt: OutputFolderReceipt | undefined = this.#receipt;
+    if (!receipt) {
+      return undefined;
+    }
+    try {
+      return await action(receipt);
+    } catch (error) {
+      terminal.writeVerboseLine(`Unable to ${verb} the build cache receipt "${receipt.filePath}": ${error}`);
+      return undefined;
+    }
+  }
 }
diff --git a/libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts b/libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts
new file mode 100644
index 00000000000..7f9c375b528
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts
@@ -0,0 +1,443 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, randomBytes, type Hash } from 'node:crypto';
+import * as fs from 'node:fs';
+import { appendFile, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import * as path from 'node:path';
+
+import { Async, FileSystem } from '@rushstack/node-core-library';
+
+const RECEIPT_VERSION: 1 = 1;
+const STAMP_MAX_WAIT_MS: number = 100;
+const STAMP_RETRY_DELAY_MS: number = 1;
+const STAMP_BYTE: Uint8Array = new Uint8Array(1);
+
+/**
+ * A time on the file system clock. A file or folder that last changed before the stamp was taken has modification
+ * and status change times earlier than the stamp. One that changes afterwards gets times at or after the stamp.
+ */
+export interface IOutputFolderStamp {
+  /**
+   * The time, in nanoseconds.
+   */
+  readonly timeNs: bigint;
+  /**
+   * The device of the file that the stamp was taken from. Times on another device may come from another clock.
+   */
+  readonly dev: bigint;
+}
+
+/**
+ * The files and folders in the output folders of an operation.
+ */
+export interface IOutputFolderListing {
+  /**
+   * Covers the path, device, identity and mode of every file and folder, and the size, modification time and status
+   * change time of every file. Any change to a file's content changes its status change time.
+   */
+  readonly digest: string;
+  /**
+   * The project-relative paths of the files, sorted, in the form that the build cache archives them.
+   */
+  readonly files: ReadonlyArray<string>;
+  /**
+   * If defined, a receipt must not certify the listing, and this says why: a restore from the build cache would not
+   * leave the same tree, or (if the listing was given a stamp) something changed at or after the stamp.
+   */
+  readonly uncertifiableReason: string | undefined;
+}
+
+/**
+ * The options for {@link OutputFolderReceipt.tryCreate}.
+ */
+export interface IOutputFolderReceiptOptions {
+  /**
+   * The absolute path of the project folder.
+   */
+  projectFolder: string;
+  /**
+   * The absolute path of the project's `.rush/temp` folder, where the receipt is written.
+   */
+  projectRushTempFolder: string;
+  /**
+   * Identifies the operation, e.g. `_phase_build`.
+   */
+  logFilenameIdentifier: string;
+  /**
+   * The project-relative output folders of the operation, including its metadata folder.
+   */
+  outputFolderNames: ReadonlyArray<string>;
+}
+
+interface IOutputFolderReceiptJson {
+  version: number;
+  cacheId: string;
+  outputFolderNames: string[];
+  listingDigest: string;
+}
+
+/**
+ * Whether a file or folder may have changed at or after the stamp. If it did, a later change within the same clock
+ * tick would not change its times.
+ */
+export function isNewerThanStamp(
+  stats: Pick<fs.BigIntStats, 'dev' | 'mtimeNs' | 'ctimeNs'>,
+  stamp: IOutputFolderStamp
+): boolean {
+  return stats.dev !== stamp.dev || stats.mtimeNs >= stamp.timeNs || stats.ctimeNs >= stamp.timeNs;
+}
+
+/**
+ * Creates a file and takes a stamp from it. It waits until the file system clock has moved past the file's creation,
+ * so every file that changed before this call has times strictly earlier than the stamp, even on a file system with
+ * coarse timestamps.
+ *
+ * @param filePath - The file to create. It must not exist. It is left in place, for the caller to reuse or delete.
+ * @returns The stamp, or `undefined` if the clock didn't move within 100 ms.
+ */
+export async function createStampAsync(filePath: string): Promise<IOutputFolderStamp | undefined> {
+  await writeFile(filePath, '', { flag: 'wx' });
+  const created: fs.BigIntStats = await stat(filePath, { bigint: true });
+  const createdNs: bigint = created.mtimeNs > created.ctimeNs ? created.mtimeNs : created.ctimeNs;
+  const deadline: number = Date.now() + STAMP_MAX_WAIT_MS;
+  do {
+    // Each write closes its handle before the file is stat'ed: on Windows, a file's times are only certain to be
+    // current once the handle that changed it is closed.
+    await appendFile(filePath, STAMP_BYTE);
+    const stats: fs.BigIntStats = await stat(filePath, { bigint: true });
+    const timeNs: bigint = stats.mtimeNs < stats.ctimeNs ? stats.mtimeNs : stats.ctimeNs;
+    if (timeNs > createdNs) {
+      return { timeNs, dev: stats.dev };
+    }
+    await Async.sleepAsync(STAMP_RETRY_DELAY_MS);
+  } while (Date.now() < deadline);
+  return undefined;
+}
+
+/**
+ * Lists the files and folders in the output folders of an operation, in the same order and form as the build cache
+ * collects them. A symbolic link or other special file, a folder with no file under it, or an entry that is deleted
+ * or replaced while it is listed makes the listing uncertifiable.
+ *
+ * @param projectFolder - The absolute path of the project folder
+ * @param outputFolderNames - The project-relative output folders of the operation
+ * @param stamp - If given, an entry that is newer than the stamp makes the listing uncertifiable
+ */
+export async function listOutputFoldersAsync(
+  projectFolder: string,
+  outputFolderNames: ReadonlyArray<string>,
+  stamp?: IOutputFolderStamp
+): Promise<IOutputFolderListing> {
+  const entries: string[] = [];
+  const files: string[] = [];
+  let uncertifiableReason: string | undefined;
+
+  // Adds the entry, and returns whether it's a file or a folder, or undefined if the listing is uncertifiable.
+  function addEntry(relativePath: string, stats: fs.BigIntStats | undefined): 'file' | 'folder' | undefined {
+    if (!stats) {
+      uncertifiableReason = `"${relativePath}" was deleted while it was listed`;
+    } else if (stamp && isNewerThanStamp(stats, stamp)) {
+      uncertifiableReason = `"${relativePath}" changed while the receipt was being written`;
+    } else if (stats.isDirectory()) {
+      entries.push(`d ${relativePath} ${stats.dev} ${stats.ino} ${stats.mode}`);
+      return 'folder';
+    } else if (stats.isFile()) {
+      entries.push(
+        `f ${relativePath} ${stats.dev} ${stats.ino} ${stats.size} ${stats.mode} ${stats.mtimeNs} ${stats.ctimeNs}`
+      );
+      files.push(relativePath);
+      return 'file';
+    } else {
+      uncertifiableReason = `"${relativePath}" is a symbolic link or another special file`;
+    }
+    return undefined;
+  }
+
+  // Lists a folder's children, and returns the number of files under it.
+  async function listFolderAsync(relativePath: string, diskPath: string): Promise<number> {
+    let children: fs.Dirent[];
+    try {
+      children = await readdir(diskPath, { withFileTypes: true });
+    } catch (error) {
+      if (!FileSystem.isNotExistError(error as Error)) {
+        throw error;
+      }
+      uncertifiableReason = `"${relativePath}" was deleted or replaced while it was listed`;
+      return 0;
+    }
+
+    let fileCount: number = 0;
+    for (const { name } of children) {
+      const childRelativePath: string = `${relativePath}/${name}`;
+      const childDiskPath: string = `${diskPath}/${name}`;
+      const childStats: fs.BigIntStats | undefined = fs.lstatSync(childDiskPath, {
+        bigint: true,
+        throwIfNoEntry: false
+      });
+      const kind: 'file' | 'folder' | undefined = addEntry(childRelativePath, childStats);
+      if (kind === 'file') {
+        fileCount++;
+      } else if (kind === 'folder') {
+        fileCount += await listFolderAsync(childRelativePath, childDiskPath);
+      }
+      if (uncertifiableReason) {
+        return fileCount;
+      }
+    }
+
+    if (fileCount === 0) {
+      // The build cache archives only files, so a restore would not recreate this folder.
+      uncertifiableReason = `"${relativePath}" has no files in it`;
+    }
+    return fileCount;
+  }
+
+  for (const folderName of outputFolderNames) {
+    const diskPath: string = `${projectFolder}/${folderName}`;
+    const stats: fs.BigIntStats | undefined = fs.lstatSync(diskPath, { bigint: true, throwIfNoEntry: false });
+    if (!stats) {
+      entries.push(`missing ${folderName}`);
+    } else if (!stats.isDirectory()) {
+      uncertifiableReason = `"${folderName}" is not a folder`;
+    } else if (addEntry(folderName, stats)) {
+      await listFolderAsync(folderName, diskPath);
+    }
+    if (uncertifiableReason) {
+      break;
+    }
+  }
+
+  entries.sort();
+  files.sort();
+  const hash: Hash = createHash('sha1');
+  for (const entry of entries) {
+    // File names can't contain a NUL character, so entries can't run into each other.
+    hash.update(entry);
+    hash.update('\0');
+  }
+
+  return { digest: hash.digest('hex'), files, uncertifiableReason };
+}
+
+interface IPendingOutputFolderReceiptOptions {
+  filePath: string;
+  tempFilePath: string;
+  projectFolder: string;
+  outputFolderNames: ReadonlyArray<string>;
+  stamp: IOutputFolderStamp | undefined;
+}
+
+/**
+ * A receipt that has its stamp and its temporary file, and hasn't been written yet.
+ */
+export class PendingOutputFolderReceipt {
+  readonly #options: IPendingOutputFolderReceiptOptions;
+  #isCommitted: boolean = false;
+
+  public constructor(options: IPendingOutputFolderReceiptOptions) {
+    this.#options = options;
+  }
+
+  /**
+   * Lists the output folders and writes the receipt, unless the listing is uncertifiable or its files are not the
+   * files in the cache entry.
+   *
+   * @param cacheId - The cache entry that the output folders hold
+   * @param archivedFilePaths - The files in the cache entry, if it was just written from the output folders
+   * @returns `undefined` if the receipt was written, or else why not
+   */
+  public async tryCommitAsync(
+    cacheId: string,
+    archivedFilePaths?: ReadonlyArray<string>
+  ): Promise<string | undefined> {
+    const { filePath, tempFilePath, projectFolder, outputFolderNames, stamp } = this.#options;
+    if (!stamp) {
+      return 'the file system clock did not advance';
+    }
+
+    const listing: IOutputFolderListing = await listOutputFoldersAsync(
+      projectFolder,
+      outputFolderNames,
+      stamp
+    );
+    if (listing.uncertifiableReason !== undefined) {
+      return listing.uncertifiableReason;
+    }
+    if (archivedFilePaths && !areArraysEqual(listing.files, archivedFilePaths)) {
+      return 'the output folders do not hold the same files as the cache entry';
+    }
+
+    const receipt: IOutputFolderReceiptJson = {
+      version: RECEIPT_VERSION,
+      cacheId,
+      outputFolderNames: [...outputFolderNames],
+      listingDigest: listing.digest
+    };
+    await writeFile(tempFilePath, JSON.stringify(receipt, undefined, 2));
+    await rename(tempFilePath, filePath);
+    this.#isCommitted = true;
+    return undefined;
+  }
+
+  /**
+   * Deletes the temporary file, unless the receipt was written.
+   */
+  public async disposeAsync(): Promise<void> {
+    if (!this.#isCommitted) {
+      await deleteFileIfExistsAsync(this.#options.tempFilePath);
+    }
+  }
+}
+
+/**
+ * A file in the project's `.rush/temp` folder that says: the output folders of this operation hold exactly the files
+ * of this build cache entry. The build cache writes it after it restores or writes the entry, and trusts it only if
+ * the output folders are listed again with the same result. It never needs to be deleted when the outputs change:
+ * any change to a file or folder that it lists gives that entry a status change time at or after the receipt's stamp,
+ * which is later than every time in the receipt.
+ */
+export class OutputFolderReceipt {
+  /**
+   * The path of the receipt file.
+   */
+  public readonly filePath: string;
+  readonly #projectFolder: string;
+  readonly #outputFolderNames: ReadonlyArray<string>;
+
+  private constructor(filePath: string, projectFolder: string, outputFolderNames: ReadonlyArray<string>) {
+    this.filePath = filePath;
+    this.#projectFolder = projectFolder;
+    this.#outputFolderNames = outputFolderNames;
+  }
+
+  /**
+   * Returns the receipt for an operation's output folders, or `undefined` if it can't have one: if one of its
+   * output folders contains the project's `.rush/temp` folder, or if a folder name is absolute or contains `..`.
+   */
+  public static tryCreate(options: IOutputFolderReceiptOptions): OutputFolderReceipt | undefined {
+    const { projectFolder, projectRushTempFolder, logFilenameIdentifier, outputFolderNames } = options;
+    if (!logFilenameIdentifier) {
+      return undefined;
+    }
+
+    const filePath: string = path.join(
+      projectRushTempFolder,
+      `build-cache-receipt_${logFilenameIdentifier}.json`
+    );
+    for (const folderName of outputFolderNames) {
+      if (path.isAbsolute(folderName) || folderName.split(/[\\/]/).includes('..')) {
+        return undefined;
+      }
+      const folderPath: string = path.resolve(projectFolder, folderName);
+      if (
+        isInFolder(projectRushTempFolder, folderPath) ||
+        folderPath.toLowerCase().startsWith(filePath.toLowerCase())
+      ) {
+        return undefined;
+      }
+    }
+
+    return new OutputFolderReceipt(filePath, projectFolder, [...outputFolderNames]);
+  }
+
+  /**
+   * Whether the receipt says that the output folders hold exactly the given cache entry, and a new listing of the
+   * output folders matches the receipt's.
+   */
+  public async isMatchAsync(cacheId: string): Promise<boolean> {
+    let json: string;
+    try {
+      json = await readFile(this.filePath, 'utf8');
+    } catch (error) {
+      if (FileSystem.isNotExistError(error as Error)) {
+        return false;
+      }
+      throw error;
+    }
+
+    const receipt: Partial<IOutputFolderReceiptJson> | undefined = tryParseReceipt(json);
+    if (
+      receipt?.version !== RECEIPT_VERSION ||
+      receipt.cacheId !== cacheId ||
+      !areArraysEqual(receipt.outputFolderNames, this.#outputFolderNames)
+    ) {
+      return false;
+    }
+
+    const listing: IOutputFolderListing = await listOutputFoldersAsync(
+      this.#projectFolder,
+      this.#outputFolderNames
+    );
+    return listing.uncertifiableReason === undefined && listing.digest === receipt.listingDigest;
+  }
+
+  /**
+   * Deletes the receipt, if it exists.
+   */
+  public async deleteAsync(): Promise<void> {
+    await deleteFileIfExistsAsync(this.filePath);
+  }
+
+  /**
+   * Starts a new receipt by taking its stamp. Call it before the step whose result the receipt will describe starts
+   * to read or write the output folders, and dispose of the result when that step is done.
+   */
+  public async beginAsync(): Promise<PendingOutputFolderReceipt> {
+    await FileSystem.ensureFolderAsync(path.dirname(this.filePath));
+    const tempFilePath: string = `${this.filePath}.${randomBytes(8).toString('hex')}.tmp`;
+    let stamp: IOutputFolderStamp | undefined;
+    try {
+      stamp = await createStampAsync(tempFilePath);
+    } catch (error) {
+      await deleteFileIfExistsAsync(tempFilePath);
+      throw error;
+    }
+    return new PendingOutputFolderReceipt({
+      filePath: this.filePath,
+      tempFilePath,
+      projectFolder: this.#projectFolder,
+      outputFolderNames: this.#outputFolderNames,
+      stamp
+    });
+  }
+}
+
+function tryParseReceipt(json: string): Partial<IOutputFolderReceiptJson> | undefined {
+  try {
+    const value: unknown = JSON.parse(json);
+    return typeof value === 'object' && value !== null
+      ? (value as Partial<IOutputFolderReceiptJson>)
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function areArraysEqual(array1: ReadonlyArray<unknown> | undefined, array2: ReadonlyArray<unknown>): boolean {
+  return (
+    Array.isArray(array1) &&
+    array1.length === array2.length &&
+    array1.every((value: unknown, index: number) => value === array2[index])
+  );
+}
+
+// Whether the path is the folder or inside it. Compared without case, since the file system may ignore it.
+function isInFolder(childPath: string, folderPath: string): boolean {
+  const relativePath: string = path.relative(folderPath.toLowerCase(), childPath.toLowerCase());
+  return !(
+    relativePath === '..' ||
+    relativePath.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativePath)
+  );
+}
+
+async function deleteFileIfExistsAsync(filePath: string): Promise<void> {
+  try {
+    await unlink(filePath);
+  } catch (error) {
+    if (!FileSystem.isNotExistError(error as Error)) {
+      throw error;
+    }
+  }
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/StagedRestore.ts b/libraries/rush-lib/src/logic/buildCache/StagedRestore.ts
new file mode 100644
index 00000000000..dc71289113e
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/StagedRestore.ts
@@ -0,0 +1,320 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, readdir, rename, rm, stat } from 'node:fs/promises';
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library';
+import type { ITerminal } from '@rushstack/terminal';
+
+/**
+ * The start of the name of a staging folder in the project's `.rush/temp` folder.
+ */
+export const STAGING_FOLDER_PREFIX: string = 'build-cache-restore-';
+
+const MOVE_CONCURRENCY: number = 10;
+
+/**
+ * Options for {@link tryRestoreThroughStagingFolderAsync}.
+ */
+export interface IStagedRestoreOptions {
+  /**
+   * The absolute path of the project folder.
+   */
+  projectFolder: string;
+  /**
+   * The absolute path of the project's `.rush/temp` folder, where the staging folder is made.
+   */
+  projectRushTempFolder: string;
+  /**
+   * The project-relative output folders to restore.
+   */
+  outputFolderNames: ReadonlyArray<string>;
+  /**
+   * Extracts the cache entry into the given folder, and returns the exit code of tar.
+   */
+  untarAsync: (folderPath: string) => Promise<number>;
+}
+
+/**
+ * Restores output folders from a build cache entry so that a file that is in both the old outputs and the entry is
+ * never missing: tar extracts the entry into a new staging folder in the project's `.rush/temp` folder, and then each
+ * output folder is moved into place. A file, or a folder that has no folder in its place, is moved with one rename,
+ * which replaces a file in its place at once. A folder that has a folder in its place is merged into it: the names in
+ * it that the entry lacks are deleted, each entry is moved in, and the folder gets the staged folder's mode. An output
+ * folder that the entry lacks is deleted. The staging folder is deleted in the end.
+ *
+ * @returns The exit code of tar, which is 0 if the output folders were restored. If it isn't 0, the output folders
+ * weren't changed. `undefined` means that the output folders must be restored in place instead: either nothing in
+ * them was changed, or moving them failed partway.
+ */
+export async function tryRestoreThroughStagingFolderAsync(
+  terminal: ITerminal,
+  options: IStagedRestoreOptions
+): Promise<number | undefined> {
+  const { projectFolder, projectRushTempFolder, outputFolderNames, untarAsync } = options;
+  const relativeFolderPaths: string[] = [];
+  const unsupportedReason: string | undefined = getUnsupportedReason(
+    projectFolder,
+    projectRushTempFolder,
+    outputFolderNames,
+    relativeFolderPaths
+  );
+  if (unsupportedReason) {
+    terminal.writeVerboseLine(`Restoring the output folders in place, because ${unsupportedReason}.`);
+    return undefined;
+  }
+
+  let stagingFolderPath: string | undefined;
+  try {
+    // Never make the project folder just to stage a restore in it.
+    if (!(await tryGetStatsAsync(stat, projectFolder))?.isDirectory()) {
+      terminal.writeVerboseLine(
+        `Restoring the output folders in place, because "${projectFolder}" is not a folder.`
+      );
+      return undefined;
+    }
+
+    await mkdir(projectRushTempFolder, { recursive: true });
+    stagingFolderPath = await mkdtemp(path.join(projectRushTempFolder, STAGING_FOLDER_PREFIX));
+    terminal.writeVerboseLine(
+      `Extracting the cache entry into "${stagingFolderPath}", to move the output folders into place from there.`
+    );
+    const tarExitCode: number = await untarAsync(stagingFolderPath);
+    if (tarExitCode !== 0) {
+      return tarExitCode;
+    }
+
+    const outsidePath: string | undefined = await tryFindPathOutsideFoldersAsync(
+      stagingFolderPath,
+      relativeFolderPaths
+    );
+    if (outsidePath !== undefined) {
+      terminal.writeVerboseLine(
+        `Restoring the output folders in place, because the cache entry has "${outsidePath}", ` +
+          'which is not in an output folder.'
+      );
+      return undefined;
+    }
+
+    await moveFoldersIntoPlaceAsync(stagingFolderPath, projectFolder, relativeFolderPaths);
+    return 0;
+  } catch (error) {
+    terminal.writeVerboseLine(
+      `Unable to restore the output folders through a staging folder; restoring them in place: ${error}`
+    );
+    return undefined;
+  } finally {
+    if (stagingFolderPath) {
+      try {
+        await rm(stagingFolderPath, { recursive: true, force: true });
+      } catch (error) {
+        terminal.writeVerboseLine(`Unable to delete the staging folder "${stagingFolderPath}": ${error}`);
+      }
+    }
+  }
+}
+
+// Returns why the output folders can't be restored through a staging folder, or undefined if they can, in which case
+// it fills relativeFolderPaths with the normalized project-relative paths of the output folders.
+function getUnsupportedReason(
+  projectFolder: string,
+  projectRushTempFolder: string,
+  outputFolderNames: ReadonlyArray<string>,
+  relativeFolderPaths: string[]
+): string | undefined {
+  const folderPaths: string[] = [];
+  for (const folderName of outputFolderNames) {
+    if (path.isAbsolute(folderName) || folderName.split(/[\\/]/).includes('..')) {
+      return `the output folder name "${folderName}" is absolute or has ".."`;
+    }
+    const folderPath: string = path.resolve(projectFolder, folderName);
+    if (isInFolder(projectRushTempFolder, folderPath)) {
+      // The staging folder would be in it.
+      return `the output folder "${folderName}" contains "${projectRushTempFolder}"`;
+    }
+    for (let i: number = 0; i < folderPaths.length; i++) {
+      if (isInFolder(folderPath, folderPaths[i]) || isInFolder(folderPaths[i], folderPath)) {
+        return `the output folders "${outputFolderNames[i]}" and "${folderName}" overlap`;
+      }
+    }
+    folderPaths.push(folderPath);
+  }
+
+  for (const folderPath of folderPaths) {
+    relativeFolderPaths.push(path.relative(projectFolder, folderPath));
+  }
+  return undefined;
+}
+
+// Whether the path is the folder or inside it. Compared without case, since the file system may ignore it.
+function isInFolder(childPath: string, folderPath: string): boolean {
+  const relativePath: string = path.relative(folderPath.toLowerCase(), childPath.toLowerCase());
+  return !(
+    relativePath === '..' ||
+    relativePath.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativePath)
+  );
+}
+
+// Returns the relative path of the first thing in the staging folder that is neither in an output folder nor a folder
+// that holds one, or undefined if there is none. A restore in place would put it in the project folder.
+async function tryFindPathOutsideFoldersAsync(
+  stagingFolderPath: string,
+  relativeFolderPaths: ReadonlyArray<string>
+): Promise<string | undefined> {
+  const folderPaths: Set<string> = new Set(relativeFolderPaths);
+  const parentPaths: Set<string> = new Set();
+  for (const relativeFolderPath of relativeFolderPaths) {
+    for (
+      let parent: string = path.dirname(relativeFolderPath);
+      parent !== '.';
+      parent = path.dirname(parent)
+    ) {
+      parentPaths.add(parent);
+    }
+  }
+
+  const queue: string[] = [''];
+  for (const relativeParentPath of queue) {
+    const children: fs.Dirent[] = await readdir(path.join(stagingFolderPath, relativeParentPath), {
+      withFileTypes: true
+    });
+    for (const child of children) {
+      const relativePath: string = relativeParentPath
+        ? path.join(relativeParentPath, child.name)
+        : child.name;
+      if (parentPaths.has(relativePath) && child.isDirectory()) {
+        queue.push(relativePath);
+      } else if (!folderPaths.has(relativePath)) {
+        return relativePath;
+      }
+    }
+  }
+  return undefined;
+}
+
+async function moveFoldersIntoPlaceAsync(
+  stagingFolderPath: string,
+  projectFolder: string,
+  relativeFolderPaths: ReadonlyArray<string>
+): Promise<void> {
+  await forEachSettledAsync(relativeFolderPaths, async (relativeFolderPath: string) => {
+    const stagedPath: string = path.join(stagingFolderPath, relativeFolderPath);
+    const targetPath: string = path.join(projectFolder, relativeFolderPath);
+    const stagedStats: fs.Stats | undefined = await tryGetStatsAsync(lstat, stagedPath);
+    if (!stagedStats) {
+      // The entry lacks this output folder, so a restore in place would leave it deleted.
+      await rm(targetPath, { recursive: true, force: true });
+      return;
+    }
+
+    await mkdir(path.dirname(targetPath), { recursive: true });
+    const targetStats: fs.Stats | undefined = await tryGetStatsAsync(lstat, targetPath);
+    await moveIntoPlaceAsync(stagedPath, stagedStats.isDirectory(), targetPath, targetStats?.isDirectory());
+  });
+}
+
+// Moves a staged file or folder to the target path. targetIsFolder is undefined if nothing is there. A symbolic link
+// is never followed: it is replaced like a file.
+async function moveIntoPlaceAsync(
+  stagedPath: string,
+  stagedIsFolder: boolean,
+  targetPath: string,
+  targetIsFolder: boolean | undefined
+): Promise<void> {
+  if (stagedIsFolder && targetIsFolder) {
+    await mergeFolderAsync(stagedPath, targetPath);
+    return;
+  }
+
+  if (targetIsFolder !== undefined && (stagedIsFolder || targetIsFolder)) {
+    // A rename can't put a folder in place of a file, or a file in place of a folder.
+    await rm(targetPath, { recursive: true, force: true });
+  }
+  await rename(stagedPath, targetPath);
+}
+
+async function mergeFolderAsync(stagedFolderPath: string, targetFolderPath: string): Promise<void> {
+  const [stagedChildren, targetChildren]: [fs.Dirent[], fs.Dirent[]] = await Promise.all([
+    readdir(stagedFolderPath, { withFileTypes: true }),
+    readdir(targetFolderPath, { withFileTypes: true })
+  ]);
+  const stagedNames: Set<string> = new Set(stagedChildren.map((child: fs.Dirent) => child.name));
+  const targetIsFolderByName: Map<string, boolean> = new Map();
+  const staleNames: string[] = [];
+  for (const child of targetChildren) {
+    if (stagedNames.has(child.name)) {
+      targetIsFolderByName.set(child.name, child.isDirectory());
+    } else {
+      staleNames.push(child.name);
+    }
+  }
+
+  // The names that the entry lacks are deleted first. Where the file system ignores case, one of them may be the
+  // same file as a staged name that differs only in case, and deleting it afterwards would delete the new file.
+  await forEachSettledAsync(
+    staleNames,
+    async (name: string) => await rm(path.join(targetFolderPath, name), { recursive: true, force: true })
+  );
+  await forEachSettledAsync(
+    stagedChildren,
+    async (child: fs.Dirent) =>
+      await moveIntoPlaceAsync(
+        path.join(stagedFolderPath, child.name),
+        child.isDirectory(),
+        path.join(targetFolderPath, child.name),
+        targetIsFolderByName.get(child.name)
+      )
+  );
+
+  // A restore in place would make this folder anew.
+  const { mode } = await lstat(stagedFolderPath);
+  // eslint-disable-next-line no-bitwise
+  await chmod(targetFolderPath, mode & 0o7777);
+}
+
+// Calls the callback for each item, MOVE_CONCURRENCY at a time. After a call fails, no more calls start, and it rejects
+// with the first error once the calls that started have settled, so that nothing still moves files when the caller
+// restores the output folders in place instead.
+async function forEachSettledAsync<T>(
+  items: ReadonlyArray<T>,
+  callback: (item: T) => Promise<void>
+): Promise<void> {
+  let nextIndex: number = 0;
+  let failure: { error: unknown } | undefined;
+  async function workAsync(): Promise<void> {
+    while (nextIndex < items.length && !failure) {
+      const item: T = items[nextIndex++];
+      try {
+        await callback(item);
+      } catch (error) {
+        failure = failure || { error };
+      }
+    }
+  }
+
+  const workers: Promise<void>[] = [];
+  for (let i: number = 0; i < Math.min(MOVE_CONCURRENCY, items.length); i++) {
+    workers.push(workAsync());
+  }
+  await Promise.all(workers);
+  if (failure) {
+    throw failure.error;
+  }
+}
+
+async function tryGetStatsAsync(
+  getStatsAsync: (filePath: string) => Promise<fs.Stats>,
+  filePath: string
+): Promise<fs.Stats | undefined> {
+  try {
+    return await getStatsAsync(filePath);
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) {
+      return undefined;
+    }
+    throw error;
+  }
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts b/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
new file mode 100644
index 00000000000..63bbf5dab2b
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
@@ -0,0 +1,814 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+import {
+  DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME,
+  DeferredCacheEntryWrites,
+  getSecondsForUtimes,
+  type IDeferredCacheEntryWrite,
+  type IDeferredCacheEntryWritesOptions,
+  type ISealedOutputs
+} from '../DeferredCacheEntryWrites';
+
+const PID: number = 4242;
+const OUTPUT_PATHS: string[] = ['lib/index.js', 'lib/nested/a.js'];
+const MODIFICATION_TIME: Date = new Date('2020-02-03T04:05:06.000Z');
+// More output files than are cloned at once
+const MANY_OUTPUT_PATHS: string[] = [
+  ...OUTPUT_PATHS,
+  ...Array.from(new Array(18).keys(), (index: number) => `lib/many/${index}.js`)
+];
+// How long a test waits for a seal that should end at once
+const SEAL_TIMEOUT_MS: number = 2000;
+// Longer than a tick of the clocks that coarse timestamps come from
+const CLOCK_TICK_MS: number = 50;
+const NANOSECONDS_PER_SECOND: bigint = BigInt(1000 * 1000 * 1000);
+
+async function copyFileAsync(sourcePath: string, destinationPath: string): Promise<void> {
+  await fs.promises.copyFile(sourcePath, destinationPath);
+}
+
+async function delayAsync(ms: number): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/** Resolves to what the promise resolves to, or to 'timed out' if that takes longer than SEAL_TIMEOUT_MS. */
+async function withTimeoutAsync<T>(promise: Promise<T>): Promise<T | 'timed out'> {
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<'timed out'>((resolve) => {
+        timeout = setTimeout(() => resolve('timed out'), SEAL_TIMEOUT_MS);
+      })
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+interface IGatedClones {
+  /** Copies the file once its clone is released */
+  readonly cloneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void>;
+  /** The source paths of the clones that started */
+  readonly startedPaths: string[];
+  /** Releases the clones of the given files, or of all files if none are given, including clones that start later */
+  readonly release: (...sourcePaths: string[]) => void;
+  /** Resolves when at least the given number of clones have started */
+  readonly whenStartedAsync: (count: number) => Promise<void>;
+}
+
+function createGatedClones(): IGatedClones {
+  const gates: Map<string, { opened: Promise<void>; open: () => void }> = new Map();
+  let isReleased: boolean = false;
+  const startListeners: (() => void)[] = [];
+  const getGate = (sourcePath: string): { opened: Promise<void>; open: () => void } => {
+    let gate: { opened: Promise<void>; open: () => void } | undefined = gates.get(sourcePath);
+    if (!gate) {
+      let open!: () => void;
+      const opened: Promise<void> = new Promise((resolve) => (open = resolve));
+      gate = { opened, open };
+      gates.set(sourcePath, gate);
+    }
+    return gate;
+  };
+  const clones: IGatedClones = {
+    startedPaths: [],
+    cloneFileAsync: async (sourcePath: string, destinationPath: string) => {
+      clones.startedPaths.push(sourcePath);
+      for (const listener of startListeners.splice(0)) {
+        listener();
+      }
+      if (!isReleased) {
+        await getGate(sourcePath).opened;
+      }
+      await fs.promises.copyFile(sourcePath, destinationPath);
+    },
+    release: (...sourcePaths: string[]) => {
+      if (sourcePaths.length === 0) {
+        isReleased = true;
+      }
+      for (const sourcePath of sourcePaths.length ? sourcePaths : Array.from(gates.keys())) {
+        getGate(sourcePath).open();
+      }
+    },
+    whenStartedAsync: async (count: number) => {
+      while (clones.startedPaths.length < count) {
+        await new Promise<void>((resolve) => startListeners.push(resolve));
+      }
+    }
+  };
+  return clones;
+}
+
+function canCloneFilesIn(folderPath: string): boolean {
+  const probeFolderPath: string = fs.mkdtempSync(path.join(folderPath, 'deferred-cache-entry-clone-probe-'));
+  try {
+    fs.writeFileSync(path.join(probeFolderPath, 'source'), 'probe');
+    fs.copyFileSync(
+      path.join(probeFolderPath, 'source'),
+      path.join(probeFolderPath, 'clone'),
+      fs.constants.COPYFILE_FICLONE_FORCE
+    );
+    return true;
+  } catch {
+    return false;
+  } finally {
+    fs.rmSync(probeFolderPath, { recursive: true, force: true });
+  }
+}
+
+interface IControlledWrite {
+  readonly write: IDeferredCacheEntryWrite;
+  readonly finish: (byteCount: number | undefined) => void;
+  /** Resolves when the write starts */
+  readonly whenStarted: Promise<void>;
+  started: boolean;
+  signal: AbortSignal | undefined;
+}
+
+/** A write that runs until `finish` is called, or until it is aborted, as tar is. */
+function createControlledWrite(cacheId: string, sealedOutputs: ISealedOutputs): IControlledWrite {
+  let finish!: (byteCount: number | undefined) => void;
+  const finished: Promise<number | undefined> = new Promise((resolve) => (finish = resolve));
+  let start!: () => void;
+  const controlled: IControlledWrite = {
+    finish,
+    whenStarted: new Promise((resolve) => (start = resolve)),
+    started: false,
+    signal: undefined,
+    write: {
+      cacheId,
+      operationName: `${cacheId} (build)`,
+      sealedOutputs,
+      writeAsync: async (terminal: ITerminal, abortSignal: AbortSignal) => {
+        controlled.started = true;
+        controlled.signal = abortSignal;
+        start();
+        abortSignal.addEventListener('abort', () => finish(undefined), { once: true });
+        return await finished;
+      }
+    }
+  };
+  return controlled;
+}
+
+describe(DeferredCacheEntryWrites.name, () => {
+  let folderPath: string;
+  let commonTempFolder: string;
+  let projectFolder: string;
+  let terminalProvider: StringBufferTerminalProvider;
+  let terminal: Terminal;
+  let logLines: string[];
+
+  function writeOutputFile(relativePath: string, contents: string): void {
+    const filePath: string = path.join(projectFolder, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, contents);
+    fs.utimesSync(filePath, MODIFICATION_TIME, MODIFICATION_TIME);
+  }
+
+  function getOutputPath(relativePath: string): string {
+    return path.join(projectFolder, relativePath);
+  }
+
+  function getProcessFolderPath(pid: number = PID): string {
+    return path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME, `${pid}`);
+  }
+
+  function createSubject(options: IDeferredCacheEntryWritesOptions = {}): DeferredCacheEntryWrites {
+    const subject: DeferredCacheEntryWrites = new DeferredCacheEntryWrites({
+      cloneFileAsync: copyFileAsync,
+      isProcessRunning: () => false,
+      pid: PID,
+      // Unless a test says otherwise, the files are cloned before the seal resolves, however slow the machine is.
+      sealWaitMs: 60 * 1000,
+      ...options
+    });
+    subject.setLog((line: string) => logLines.push(line));
+    return subject;
+  }
+
+  async function sealAsync(
+    subject: DeferredCacheEntryWrites,
+    relativePaths: string[] = OUTPUT_PATHS
+  ): Promise<ISealedOutputs | undefined> {
+    return await subject.trySealAsync({
+      commonTempFolder,
+      sourceFolderPath: projectFolder,
+      relativePaths,
+      terminal
+    });
+  }
+
+  beforeEach(() => {
+    folderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'deferred-cache-entry-writes-'));
+    commonTempFolder = path.join(folderPath, 'common', 'temp');
+    projectFolder = path.join(folderPath, 'project');
+    fs.mkdirSync(commonTempFolder, { recursive: true });
+    writeOutputFile('lib/index.js', 'index contents');
+    writeOutputFile('lib/nested/a.js', 'a');
+    fs.chmodSync(path.join(projectFolder, 'lib/index.js'), 0o755);
+    terminalProvider = new StringBufferTerminalProvider();
+    terminal = new Terminal(terminalProvider);
+    logLines = [];
+  });
+
+  afterEach(() => {
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  });
+
+  describe('trySealAsync', () => {
+    it('copies the output files with their contents, modes and modification times', async () => {
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject());
+
+      expect(sealedOutputs).toEqual({
+        folderPath: path.join(getProcessFolderPath(), '0'),
+        fileCount: 2,
+        byteCount: 'index contents'.length + 'a'.length
+      });
+      for (const relativePath of OUTPUT_PATHS) {
+        const source: fs.Stats = fs.statSync(path.join(projectFolder, relativePath));
+        const sealedPath: string = path.join(sealedOutputs!.folderPath, relativePath);
+        const sealed: fs.Stats = fs.statSync(sealedPath);
+        expect(fs.readFileSync(sealedPath, 'utf8')).toBe(
+          fs.readFileSync(path.join(projectFolder, relativePath), 'utf8')
+        );
+        expect(sealed.mode).toBe(source.mode);
+        expect(sealed.mtimeMs).toBe(MODIFICATION_TIME.getTime());
+      }
+      expect(terminalProvider.getAllOutput(true)).toEqual({});
+    });
+
+    it('keeps the whole second of a modification time in the last half millisecond of a second', async () => {
+      const fractions: [string, number][] = [
+        ['lib/index.js', 0.9996],
+        ['lib/nested/a.js', 0.999999]
+      ];
+      for (const [relativePath, fraction] of fractions) {
+        const seconds: number = MODIFICATION_TIME.getTime() / 1000 + fraction;
+        fs.utimesSync(getOutputPath(relativePath), seconds, seconds);
+        // fs.Stats rounds this time to the next second.
+        expect(fs.statSync(getOutputPath(relativePath)).mtime.getTime()).toBe(
+          MODIFICATION_TIME.getTime() + 1000
+        );
+      }
+
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject());
+
+      for (const [relativePath] of fractions) {
+        const sourceTimeNs: bigint = fs.statSync(getOutputPath(relativePath), { bigint: true }).mtimeNs;
+        const sealedTimeNs: bigint = fs.statSync(path.join(sealedOutputs!.folderPath, relativePath), {
+          bigint: true
+        }).mtimeNs;
+        expect(sealedTimeNs / NANOSECONDS_PER_SECOND).toBe(sourceTimeNs / NANOSECONDS_PER_SECOND);
+        expect(Math.abs(Number(sourceTimeNs - sealedTimeNs))).toBeLessThan(1000 * 1000);
+      }
+    });
+
+    it('keeps the sealed files when the output files change afterward', async () => {
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject());
+
+      fs.writeFileSync(path.join(projectFolder, 'lib/index.js'), 'changed contents');
+      fs.rmSync(path.join(projectFolder, 'lib/nested'), { recursive: true });
+
+      expect(fs.readFileSync(path.join(sealedOutputs!.folderPath, 'lib/index.js'), 'utf8')).toBe(
+        'index contents'
+      );
+      expect(fs.readFileSync(path.join(sealedOutputs!.folderPath, 'lib/nested/a.js'), 'utf8')).toBe('a');
+    });
+
+    it('seals each operation into a folder of its own', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const first: ISealedOutputs | undefined = await sealAsync(subject);
+      const second: ISealedOutputs | undefined = await sealAsync(subject, ['lib/nested/a.js']);
+
+      expect(second!.folderPath).toBe(path.join(getProcessFolderPath(), '1'));
+      expect(fs.readdirSync(getProcessFolderPath()).sort()).toEqual(['0', '1']);
+      expect(fs.existsSync(path.join(first!.folderPath, 'lib/index.js'))).toBe(true);
+      expect(fs.existsSync(path.join(second!.folderPath, 'lib/index.js'))).toBe(false);
+    });
+
+    (canCloneFilesIn(os.tmpdir()) ? it : it.skip)(
+      'clones the output files where the file system can clone files',
+      async () => {
+        const subject: DeferredCacheEntryWrites = new DeferredCacheEntryWrites({ pid: PID });
+        const sealedOutputs: ISealedOutputs | undefined = await sealAsync(subject);
+
+        expect(sealedOutputs?.fileCount).toBe(2);
+        expect(fs.readFileSync(path.join(sealedOutputs!.folderPath, 'lib/index.js'), 'utf8')).toBe(
+          'index contents'
+        );
+        expect(fs.statSync(path.join(sealedOutputs!.folderPath, 'lib/index.js')).mode).toBe(
+          fs.statSync(path.join(projectFolder, 'lib/index.js')).mode
+        );
+      }
+    );
+
+    it('stops sealing once the file system refuses to clone files', async () => {
+      const cloneFileAsync: jest.Mock = jest
+        .fn()
+        .mockRejectedValue(Object.assign(new Error('operation not supported'), { code: 'EOPNOTSUPP' }));
+      const subject: DeferredCacheEntryWrites = createSubject({ cloneFileAsync });
+
+      expect(await sealAsync(subject)).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain(
+        'Unable to clone the output files (EOPNOTSUPP), so the build cache entry is written now.'
+      );
+      const cloneCount: number = cloneFileAsync.mock.calls.length;
+      expect(cloneCount).toBeGreaterThan(0);
+
+      expect(await sealAsync(subject)).toBeUndefined();
+      expect(cloneFileAsync).toHaveBeenCalledTimes(cloneCount);
+      expect(terminalProvider.getVerboseOutput()).toContain(
+        "The output files can't be cloned (EOPNOTSUPP), so the build cache entry is written now."
+      );
+    });
+
+    it('seals again after an error that does not mean that files cannot be cloned', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      expect(await sealAsync(subject, [...OUTPUT_PATHS, 'lib/missing.js'])).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain('Unable to clone the output files (ENOENT)');
+
+      expect(await sealAsync(subject)).toMatchObject({ fileCount: 2 });
+    });
+
+    it('does not seal a path that is not a file', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      expect(await sealAsync(subject, ['lib/nested'])).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain(
+        'Unable to clone the output files ("lib/nested" is not a file)'
+      );
+    });
+
+    it('does not seal a symbolic link', async () => {
+      // A clone would copy the target of the link, not the link.
+      fs.symlinkSync('index.js', getOutputPath('lib/link.js'));
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      expect(await sealAsync(subject, [...OUTPUT_PATHS, 'lib/link.js'])).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain(
+        'Unable to clone the output files ("lib/link.js" is not a file)'
+      );
+    });
+
+    it('deletes the staging folders of processes that are not running', async () => {
+      const stagingFolderPath: string = path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME);
+      for (const name of [`${PID}`, '1111', '2222', 'other']) {
+        fs.mkdirSync(path.join(stagingFolderPath, name, '0'), { recursive: true });
+        fs.writeFileSync(path.join(stagingFolderPath, name, '0', 'left-behind.js'), '');
+      }
+      const isProcessRunning: jest.Mock = jest.fn((pid: number) => pid === 2222);
+
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject({ isProcessRunning }));
+
+      expect(fs.readdirSync(stagingFolderPath).sort()).toEqual(['2222', `${PID}`, 'other'].sort());
+      expect(fs.readdirSync(path.join(sealedOutputs!.folderPath))).toEqual(['lib']);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual(['0']);
+      expect(isProcessRunning.mock.calls.map(([pid]) => pid).sort()).toEqual([1111, 2222]);
+    });
+  });
+
+  describe('with clones that take longer than the wait', () => {
+    function writeManyOutputFiles(): void {
+      for (const relativePath of MANY_OUTPUT_PATHS.slice(OUTPUT_PATHS.length)) {
+        writeOutputFile(relativePath, 'many');
+      }
+    }
+
+    /** Seals the files in the background, and queues the write of their entry. */
+    async function sealInBackgroundAsync(
+      subject: DeferredCacheEntryWrites,
+      relativePaths: string[] = OUTPUT_PATHS
+    ): Promise<IControlledWrite> {
+      const sealedOutputs: ISealedOutputs | undefined | 'timed out' = await withTimeoutAsync(
+        sealAsync(subject, relativePaths)
+      );
+      expect(sealedOutputs).toEqual({
+        folderPath: path.join(getProcessFolderPath(), '0'),
+        fileCount: relativePaths.length,
+        byteCount: expect.any(Number),
+        isSealing: true
+      });
+      const write: IControlledWrite = createControlledWrite('a', sealedOutputs as ISealedOutputs);
+      subject.enqueue(write.write);
+      return write;
+    }
+
+    it('waits for clones that finish within the wait, as without it', async () => {
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({ cloneFileAsync: clones.cloneFileAsync });
+
+      const sealing: Promise<ISealedOutputs | undefined> = sealAsync(subject);
+      await clones.whenStartedAsync(OUTPUT_PATHS.length);
+      clones.release();
+      const sealedOutputs: ISealedOutputs | undefined = await sealing;
+
+      expect(sealedOutputs).toEqual({
+        folderPath: path.join(getProcessFolderPath(), '0'),
+        fileCount: 2,
+        byteCount: 'index contents'.length + 'a'.length
+      });
+      const write: IControlledWrite = createControlledWrite('a', sealedOutputs!);
+      subject.enqueue(write.write);
+      expect(write.started).toBe(true);
+      write.finish(1);
+      await subject.waitForIdleAsync();
+      expect(logLines).toEqual([expect.stringMatching(/^Wrote the build cache entry a /)]);
+    });
+
+    it('resolves first, and writes the entry once the files are cloned', async () => {
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+
+      const write: IControlledWrite = await sealInBackgroundAsync(subject);
+
+      expect(write.write.sealedOutputs.byteCount).toBe('index contents'.length + 'a'.length);
+      expect(write.started).toBe(false);
+      expect(subject.takeReport()).toMatchObject({ queuedCount: 1, pendingCount: 1 });
+      expect(subject.hasPendingWrite('a')).toBe(true);
+      clones.release();
+      await write.whenStarted;
+      expect(fs.readFileSync(path.join(getProcessFolderPath(), '0', 'lib/index.js'), 'utf8')).toBe(
+        'index contents'
+      );
+      write.finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0, pendingCount: 0 });
+      expect(subject.hasPendingWrite('a')).toBe(false);
+      expect(logLines.map((line: string) => line.replace(/ in \d+ ms\.$/, ' in N ms.'))).toEqual([
+        'Sealed the output files of a (build) in the background in N ms.',
+        'Wrote the build cache entry a (0.0 MB) for a (build) in N ms.'
+      ]);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('drops the entry if an output file changes before it is cloned, even if only its change time does', async () => {
+      writeManyOutputFiles();
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject, MANY_OUTPUT_PATHS);
+
+      // The last file is cloned once the first clones are released. It keeps its size and modification time.
+      await delayAsync(CLOCK_TICK_MS);
+      writeOutputFile('lib/many/17.js', 'MANY');
+      clones.release();
+      await withTimeoutAsync(subject.waitForIdleAsync());
+
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual([
+        'Dropped the build cache entry a for a (build), because lib/many/17.js changed before it was sealed.'
+      ]);
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 1,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 1,
+        pendingCount: 0
+      });
+      expect(subject.hasPendingWrite('a')).toBe(false);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('drops the entry if an output file is deleted before it is cloned', async () => {
+      writeManyOutputFiles();
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject, MANY_OUTPUT_PATHS);
+
+      fs.rmSync(getOutputPath('lib/many/17.js'));
+      clones.release();
+      await withTimeoutAsync(subject.waitForIdleAsync());
+
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual([
+        'Dropped the build cache entry a for a (build), because lib/many/17.js changed before it was sealed.'
+      ]);
+      expect(subject.takeReport()).toMatchObject({ failedCount: 0, droppedCount: 1, pendingCount: 0 });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('writes the entry if an output file changes after it is cloned', async () => {
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject);
+
+      clones.release(getOutputPath('lib/index.js'));
+      // The modification time of a clone is set after the clone is checked.
+      const sealedPath: string = path.join(getProcessFolderPath(), '0', 'lib/index.js');
+      while (!fs.existsSync(sealedPath) || fs.statSync(sealedPath).mtimeMs !== MODIFICATION_TIME.getTime()) {
+        await delayAsync(1);
+      }
+      await delayAsync(CLOCK_TICK_MS);
+      writeOutputFile('lib/index.js', 'INDEX CONTENTS');
+      clones.release();
+      await write.whenStarted;
+
+      expect(fs.readFileSync(sealedPath, 'utf8')).toBe('index contents');
+      write.finish(1);
+      await subject.waitForIdleAsync();
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, droppedCount: 0, pendingCount: 0 });
+    });
+
+    /** Seals the files in the background with a first clone that fails with the given code. */
+    async function failCloneAsync(code: string): Promise<[DeferredCacheEntryWrites, IGatedClones]> {
+      const clones: IGatedClones = createGatedClones();
+      let hasFailed: boolean = false;
+      const cloneFileAsync = async (sourcePath: string, destinationPath: string): Promise<void> => {
+        await clones.cloneFileAsync(sourcePath, destinationPath);
+        if (!hasFailed && sourcePath === getOutputPath('lib/index.js')) {
+          hasFailed = true;
+          throw Object.assign(new Error('The clone failed.'), { code });
+        }
+      };
+      const subject: DeferredCacheEntryWrites = createSubject({ cloneFileAsync, sealWaitMs: 0 });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject);
+
+      clones.release();
+      await withTimeoutAsync(subject.waitForIdleAsync());
+
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual([
+        `Failed to write the build cache entry a for a (build): Unable to clone the output files (${code}).`
+      ]);
+      expect(subject.takeReport()).toMatchObject({ failedCount: 1, droppedCount: 0, pendingCount: 0 });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      return [subject, clones];
+    }
+
+    it('reports a clone that fails as a failed write, and seals the next outputs', async () => {
+      const [subject]: [DeferredCacheEntryWrites, IGatedClones] = await failCloneAsync('EIO');
+
+      expect(await withTimeoutAsync(sealAsync(subject))).toMatchObject({ fileCount: 2 });
+      await subject.abortAsync();
+    });
+
+    it('stops sealing once a clone in the background is refused', async () => {
+      const [subject, clones]: [DeferredCacheEntryWrites, IGatedClones] = await failCloneAsync('EOPNOTSUPP');
+
+      expect(await sealAsync(subject)).toBeUndefined();
+      expect(clones.startedPaths).toHaveLength(2);
+      expect(terminalProvider.getVerboseOutput()).toContain(
+        "The output files can't be cloned (EOPNOTSUPP), so the build cache entry is written now."
+      );
+    });
+
+    it('is stopped by abortAsync, which waits for the clones that are running', async () => {
+      writeManyOutputFiles();
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject, MANY_OUTPUT_PATHS);
+      await clones.whenStartedAsync(16);
+
+      let isAborted: boolean = false;
+      const aborting: Promise<void> = subject.abortAsync().then(() => {
+        isAborted = true;
+      });
+      await delayAsync(CLOCK_TICK_MS);
+      expect(isAborted).toBe(false);
+      clones.release();
+      await aborting;
+
+      // No more files are cloned once the seal is stopped.
+      expect(clones.startedPaths).toHaveLength(16);
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual(['Dropped the build cache entry a for a (build), which was not written yet.']);
+      expect(subject.takeReport()).toMatchObject({ failedCount: 0, droppedCount: 1, pendingCount: 0 });
+      expect(subject.hasPendingWrite('a')).toBe(false);
+      expect(fs.existsSync(getProcessFolderPath())).toBe(false);
+    });
+  });
+
+  describe('enqueue', () => {
+    it('writes two entries at a time, deletes their sealed files and reports them', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const writes: IControlledWrite[] = [];
+      for (const cacheId of ['a', 'b', 'c']) {
+        writes.push(createControlledWrite(cacheId, (await sealAsync(subject))!));
+      }
+
+      for (const { write } of writes) {
+        subject.enqueue(write);
+      }
+      expect(writes.map(({ started }) => started)).toEqual([true, true, false]);
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 3,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 3
+      });
+
+      writes[0].finish(1024 * 1024);
+      await writes[2].whenStarted;
+      expect(logLines).toHaveLength(1);
+      writes[1].finish(512 * 1024);
+      writes[2].finish(0);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 0,
+        writtenCount: 3,
+        writtenByteCount: 1.5 * 1024 * 1024,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 0
+      });
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 0,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 0
+      });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      // b and c finish together, in either order.
+      expect(logLines.map((line) => line.replace(/ in \d+ ms\.$/, ' in N ms.')).sort()).toEqual([
+        'Wrote the build cache entry a (1.0 MB) for a (build) in N ms.',
+        'Wrote the build cache entry b (0.5 MB) for b (build) in N ms.',
+        'Wrote the build cache entry c (0.0 MB) for c (build) in N ms.'
+      ]);
+    });
+
+    it('reports a write that fails, with its warnings and errors', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const sealedOutputs: ISealedOutputs[] = [(await sealAsync(subject))!, (await sealAsync(subject))!];
+
+      subject.enqueue({
+        cacheId: 'a',
+        operationName: 'a (build)',
+        sealedOutputs: sealedOutputs[0],
+        writeAsync: async (writeTerminal: ITerminal) => {
+          writeTerminal.writeLine('Not a problem.');
+          writeTerminal.writeWarningLine('"tar" exited with code 2.');
+          return undefined;
+        }
+      });
+      subject.enqueue({
+        cacheId: 'b',
+        operationName: 'b (build)',
+        sealedOutputs: sealedOutputs[1],
+        writeAsync: async () => {
+          throw new Error('The disk is full.');
+        }
+      });
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 0, failedCount: 2, pendingCount: 0 });
+      // They fail together, in either order.
+      expect(logLines.sort()).toEqual([
+        'Failed to write the build cache entry a for a (build): "tar" exited with code 2.',
+        'Failed to write the build cache entry b for b (build): The disk is full.'
+      ]);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('has a pending write for a cache ID until each write of it is written or fails', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const writes: IControlledWrite[] = [];
+      for (const cacheId of ['a', 'b', 'c', 'a']) {
+        writes.push(createControlledWrite(cacheId, (await sealAsync(subject))!));
+      }
+      const getPendingCacheIds = (): string[] =>
+        ['a', 'b', 'c', 'd'].filter((cacheId: string) => subject.hasPendingWrite(cacheId));
+
+      expect(getPendingCacheIds()).toEqual([]);
+      for (const { write } of writes) {
+        subject.enqueue(write);
+      }
+      // The first write of a and the write of b are running. The others are queued.
+      expect(writes.map(({ started }) => started)).toEqual([true, true, false, false]);
+      expect(getPendingCacheIds()).toEqual(['a', 'b', 'c']);
+      writes[0].finish(1);
+      await writes[2].whenStarted;
+      expect(getPendingCacheIds()).toEqual(['a', 'b', 'c']);
+      writes[1].finish(undefined);
+      await writes[3].whenStarted;
+      expect(getPendingCacheIds()).toEqual(['a', 'c']);
+      writes[2].finish(1);
+      writes[3].finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 3, failedCount: 1, pendingCount: 0 });
+      expect(getPendingCacheIds()).toEqual([]);
+    });
+
+    it('keeps writing when its log throws', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      subject.setLog(() => {
+        throw new Error('The log is closed.');
+      });
+      const write: IControlledWrite = createControlledWrite('a', (await sealAsync(subject))!);
+
+      subject.enqueue(write.write);
+      write.finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0 });
+    });
+  });
+
+  describe('abortAsync', () => {
+    it('drops the writes that are not finished and deletes the staging folder of the process', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const writes: IControlledWrite[] = [];
+      for (const cacheId of ['a', 'b', 'c']) {
+        writes.push(createControlledWrite(cacheId, (await sealAsync(subject))!));
+      }
+      for (const { write } of writes) {
+        subject.enqueue(write);
+      }
+
+      await subject.abortAsync();
+
+      expect(writes.map(({ started }) => started)).toEqual([true, true, false]);
+      expect(writes.map(({ signal }) => signal?.aborted)).toEqual([true, true, undefined]);
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 3,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 3,
+        pendingCount: 0
+      });
+      expect(['a', 'b', 'c'].filter((cacheId: string) => subject.hasPendingWrite(cacheId))).toEqual([]);
+      expect(fs.existsSync(getProcessFolderPath())).toBe(false);
+      expect(logLines.sort()).toEqual([
+        'Dropped the build cache entry a for a (build), which was being written.',
+        'Dropped the build cache entry b for b (build), which was being written.',
+        'Dropped the build cache entry c for c (build), which was not written yet.'
+      ]);
+    });
+
+    it('writes entries that are queued afterward', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      subject.enqueue(createControlledWrite('a', (await sealAsync(subject))!).write);
+      await subject.abortAsync();
+      logLines.length = 0;
+
+      const write: IControlledWrite = createControlledWrite('b', (await sealAsync(subject))!);
+      subject.enqueue(write.write);
+      expect(write.signal?.aborted).toBe(false);
+      write.finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0, pendingCount: 0 });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('does nothing if nothing was sealed', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      await subject.abortAsync();
+
+      expect(fs.existsSync(path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME))).toBe(
+        false
+      );
+      expect(logLines).toEqual([]);
+    });
+  });
+});
+
+describe('getSecondsForUtimes', () => {
+  it('keeps the whole second of a time in nanoseconds', () => {
+    const seconds: number = 1790713413;
+    for (const nanoseconds of [0, 1000, 499999999, 999499999, 999500000, 999999000, 999999900, 999999999]) {
+      const timeNs: bigint = BigInt(seconds) * NANOSECONDS_PER_SECOND + BigInt(nanoseconds);
+      const result: number = getSecondsForUtimes(timeNs);
+      expect(Math.floor(result)).toBe(seconds);
+      // Microseconds are kept.
+      expect(Math.abs(result - seconds - Math.floor(nanoseconds / 1000) / 1e6)).toBeLessThan(1e-6);
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts
new file mode 100644
index 00000000000..fa3e8c20563
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts
@@ -0,0 +1,302 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { TarExecutable } from '../../../utilities/TarExecutable';
+import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import {
+  DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME,
+  DeferredCacheEntryWrites,
+  type IDeferredCacheEntryWritesReport
+} from '../DeferredCacheEntryWrites';
+import type { FileSystemBuildCacheProvider } from '../FileSystemBuildCacheProvider';
+import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
+
+const PID: number = 4242;
+const CACHE_ID: string = 'acme-wizard-1926f30e8ed24cb47be89aea39e7efd70fcda075';
+
+/**
+ * Copies a file. A file with no data blocks, such as a sparse one, is copied as a sparse file. Not on Windows, where
+ * NTFS keeps a small file's data in its file record and so reports no blocks for it either.
+ */
+async function copyFileAsync(sourcePath: string, destinationPath: string): Promise<void> {
+  const { blocks, size } = await fs.promises.stat(sourcePath);
+  if (process.platform !== 'win32' && blocks === 0 && size > 0) {
+    await fs.promises.writeFile(destinationPath, '');
+    await fs.promises.truncate(destinationPath, size);
+  } else {
+    await fs.promises.copyFile(sourcePath, destinationPath);
+  }
+}
+
+function readFolder(folderPath: string): Record<string, string> {
+  const files: Record<string, string> = {};
+  for (const relativePath of fs.readdirSync(folderPath, { recursive: true }) as string[]) {
+    const filePath: string = path.join(folderPath, relativePath);
+    if (fs.statSync(filePath).isFile()) {
+      files[relativePath.split(path.sep).join('/')] = fs.readFileSync(filePath, 'utf8');
+    }
+  }
+  return files;
+}
+
+describe('OperationBuildCache with deferred cache entry writes', () => {
+  let tar: TarExecutable;
+  let folderPath: string;
+  let projectFolder: string;
+  let commonTempFolder: string;
+  let cacheFolder: string;
+  let terminalProvider: StringBufferTerminalProvider;
+  let terminal: Terminal;
+  let logLines: string[];
+
+  beforeAll(async () => {
+    const found: TarExecutable | undefined = await TarExecutable.tryInitializeAsync(
+      new Terminal(new StringBufferTerminalProvider())
+    );
+    if (!found) {
+      throw new Error('"tar" was not found on the PATH');
+    }
+    tar = found;
+  });
+
+  beforeEach(() => {
+    folderPath = fs.mkdtempSync(path.join(fs.realpathSync.native(os.tmpdir()), 'rush-deferred-cache-entry-'));
+    projectFolder = path.join(folderPath, 'apps', 'acme-wizard');
+    commonTempFolder = path.join(folderPath, 'common', 'temp');
+    cacheFolder = path.join(commonTempFolder, 'build-cache');
+    fs.mkdirSync(path.join(projectFolder, 'dist', 'nested'), { recursive: true });
+    fs.mkdirSync(path.join(commonTempFolder, 'project'), { recursive: true });
+    fs.mkdirSync(cacheFolder);
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'index.js'), 'index 1');
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'nested', 'a.js'), 'a 1');
+    terminalProvider = new StringBufferTerminalProvider();
+    terminal = new Terminal(terminalProvider);
+    logLines = [];
+    _setTarUtilityPromiseForTesting(Promise.resolve(tar));
+  });
+
+  afterEach(() => {
+    _setTarUtilityPromiseForTesting(undefined);
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  });
+
+  function createSubject(): OperationBuildCache {
+    return OperationBuildCache.getOperationBuildCache({
+      buildCacheConfiguration: {
+        buildCacheEnabled: true,
+        cacheWriteEnabled: true,
+        getCacheEntryId: (options: IGenerateCacheEntryIdOptions) =>
+          `${options.projectName}-${options.projectStateHash}`,
+        localCacheProvider: {
+          getCacheEntryPath: (cacheId: string) => path.join(cacheFolder, cacheId)
+        } as unknown as FileSystemBuildCacheProvider,
+        cloudCacheProvider: undefined
+      } as unknown as BuildCacheConfiguration,
+      projectOutputFolderNames: ['dist'],
+      project: {
+        packageName: 'acme-wizard',
+        projectRelativeFolder: 'apps/acme-wizard',
+        projectFolder,
+        projectRushTempFolder: path.join(commonTempFolder, 'project'),
+        rushConfiguration: { commonTempFolder },
+        dependencyProjects: []
+      } as unknown as RushConfigurationProject,
+      operationStateHash: '1926f30e8ed24cb47be89aea39e7efd70fcda075',
+      terminal,
+      phaseName: 'build',
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+  }
+
+  function createWrites(
+    cloneFileAsync: typeof copyFileAsync = copyFileAsync,
+    // Unless a test says otherwise, the files are cloned before the seal resolves, however slow the machine is.
+    sealWaitMs: number = 60 * 1000
+  ): DeferredCacheEntryWrites {
+    const writes: DeferredCacheEntryWrites = new DeferredCacheEntryWrites({
+      cloneFileAsync,
+      pid: PID,
+      sealWaitMs
+    });
+    // A write that outlives its test can't log into the next test's lines.
+    const lines: string[] = logLines;
+    writes.setLog((line: string) => lines.push(line));
+    return writes;
+  }
+
+  async function restoreEntryAsync(): Promise<Record<string, string>> {
+    const outputFolderPath: string = path.join(folderPath, 'restored');
+    fs.mkdirSync(outputFolderPath);
+    const exitCode: number = await tar.tryUntarAsync({
+      archivePath: path.join(cacheFolder, CACHE_ID),
+      outputFolderPath,
+      logFilePath: path.join(folderPath, 'untar.log')
+    });
+    expect(exitCode).toBe(0);
+    return readFolder(outputFolderPath);
+  }
+
+  function getProcessFolderPath(): string {
+    return path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME, `${PID}`);
+  }
+
+  it('writes the entry after it resolves, from the output files as they were then', async () => {
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+
+    // The entry is written by tar, which can't have ended before this resolved.
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    expect(terminalProvider.getOutput({ normalizeSpecialCharacters: false })).toMatch(
+      /^Sealed 2 output files \(0\.0 MB\) in \d+ ms; writing the build cache entry in the background\.\n$/
+    );
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'index.js'), 'index 2');
+    fs.rmSync(path.join(projectFolder, 'dist', 'nested', 'a.js'));
+    await writes.waitForIdleAsync();
+
+    expect(fs.readdirSync(cacheFolder)).toEqual([CACHE_ID]);
+    expect(await restoreEntryAsync()).toEqual({ 'dist/index.js': 'index 1', 'dist/nested/a.js': 'a 1' });
+    expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 1, writtenCount: 1, failedCount: 0 });
+    expect(logLines).toEqual([
+      expect.stringMatching(
+        new RegExp(
+          `^Wrote the build cache entry ${CACHE_ID} \\(0\\.0 MB\\) for acme-wizard \\(build\\) in \\d+ ms\\.$`
+        )
+      )
+    ]);
+  });
+
+  it('writes the entry once the output files are sealed, if that takes longer than the wait', async () => {
+    let release!: () => void;
+    const released: Promise<void> = new Promise((resolve) => (release = resolve));
+    const cloneFileAsync = async (sourcePath: string, destinationPath: string): Promise<void> => {
+      await released;
+      await copyFileAsync(sourcePath, destinationPath);
+    };
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync, 0);
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+
+    expect(terminalProvider.getOutput({ normalizeSpecialCharacters: false })).toMatch(
+      new RegExp(
+        '^Sealing 2 output files \\(0\\.0 MB\\) in the background after \\d+ ms; ' +
+          "the build cache entry is written once they're sealed\\.\\n$"
+      )
+    );
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 1, pendingCount: 1 });
+    release();
+    await writes.waitForIdleAsync();
+
+    expect(await restoreEntryAsync()).toEqual({ 'dist/index.js': 'index 1', 'dist/nested/a.js': 'a 1' });
+    expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    expect(logLines).toEqual([
+      expect.stringMatching(
+        /^Sealed the output files of acme-wizard \(build\) in the background in \d+ ms\.$/
+      ),
+      expect.stringMatching(
+        new RegExp(
+          `^Wrote the build cache entry ${CACHE_ID} \\(0\\.0 MB\\) for acme-wizard \\(build\\) in \\d+ ms\\.$`
+        )
+      )
+    ]);
+  });
+
+  it('writes the entry before it resolves if the output files cannot be cloned', async () => {
+    const cloneFileAsync: jest.Mock = jest.fn(async () => {
+      throw Object.assign(new Error('The file system cannot clone files.'), { code: 'EOPNOTSUPP' });
+    });
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync);
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+
+    expect(fs.readdirSync(cacheFolder)).toEqual([CACHE_ID]);
+    expect(await restoreEntryAsync()).toEqual({ 'dist/index.js': 'index 1', 'dist/nested/a.js': 'a 1' });
+    expect(terminalProvider.getOutput({ normalizeSpecialCharacters: false })).toBe(
+      'Unable to clone the output files (EOPNOTSUPP), so the build cache entry is written now.\n' +
+        'Successfully set cache entry.\n'
+    );
+    expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    const cloneCount: number = cloneFileAsync.mock.calls.length;
+
+    // The next operation doesn't try to clone its output files.
+    fs.rmSync(path.join(cacheFolder, CACHE_ID));
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+    expect(fs.readdirSync(cacheFolder)).toEqual([CACHE_ID]);
+    expect(cloneFileAsync).toHaveBeenCalledTimes(cloneCount);
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, pendingCount: 0 });
+  });
+
+  it('seals nothing if an output is a symbolic link', async () => {
+    fs.symlinkSync('index.js', path.join(projectFolder, 'dist', 'link.js'));
+    const cloneFileAsync: jest.Mock = jest.fn(copyFileAsync);
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync);
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(false);
+
+    expect(cloneFileAsync).not.toHaveBeenCalled();
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, pendingCount: 0 });
+  });
+
+  it('seals nothing if tar is not found', async () => {
+    _setTarUtilityPromiseForTesting(Promise.resolve(undefined));
+    const cloneFileAsync: jest.Mock = jest.fn(copyFileAsync);
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync);
+
+    // The operation reports the failure, instead of the daemon's log reporting it later.
+    const result: boolean = await createSubject().trySetCacheEntryAsync(terminal, undefined, writes);
+    await writes.waitForIdleAsync();
+
+    expect(result).toBe(false);
+    expect(cloneFileAsync).not.toHaveBeenCalled();
+    expect(terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false })).toContain(
+      'Unable to locate "tar".'
+    );
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, pendingCount: 0 });
+    expect(logLines).toEqual([]);
+  });
+
+  it('kills tar, and deletes its partial archive and the sealed files, when aborted', async () => {
+    // A sparse file takes no space, but tar reads 2 GB of zeros from it and gzip compresses them, which takes
+    // seconds.
+    const fd: number = fs.openSync(path.join(projectFolder, 'dist', 'large.bin'), 'w');
+    try {
+      fs.ftruncateSync(fd, 2 * 1024 * 1024 * 1024);
+    } finally {
+      fs.closeSync(fd);
+    }
+    const writes: DeferredCacheEntryWrites = createWrites();
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+    const deadline: number = Date.now() + 10000;
+    while (fs.readdirSync(cacheFolder).length === 0 && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    // The partial archive
+    expect(fs.readdirSync(cacheFolder)).toEqual([expect.stringMatching(/\.temp$/)]);
+
+    const abortedAtMs: number = performance.now();
+    await writes.abortAsync();
+
+    // Unless it was killed, tar would have run for seconds. On Windows, tar can take a second or two to exit after
+    // it is killed.
+    expect(performance.now() - abortedAtMs).toBeLessThan(process.platform === 'win32' ? 5000 : 1000);
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    expect(fs.existsSync(getProcessFolderPath())).toBe(false);
+    const report: IDeferredCacheEntryWritesReport = writes.takeReport();
+    expect(report).toMatchObject({ writtenCount: 0, failedCount: 0, pendingCount: 0 });
+    expect(logLines).toEqual([
+      `Dropped the build cache entry ${CACHE_ID} for acme-wizard (build), which was being written.`
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
new file mode 100644
index 00000000000..979e5df9e41
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
@@ -0,0 +1,734 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { ICreateArchiveOptions, IUntarOptions, TarExecutable } from '../../../utilities/TarExecutable';
+import type { IBaseOperationExecutionResult } from '../../operations/IOperationExecutionResult';
+import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import { DeferredCacheEntryWrites } from '../DeferredCacheEntryWrites';
+import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
+
+const HIT_LINE: string = 'Build cache hit.';
+const SKIP_LINE: string = 'The output folders already match this cache entry; nothing to restore.';
+const METADATA_FOLDER: string = '.rush/temp/operation/_phase_build';
+const RECEIPT: string = '.rush/temp/build-cache-receipt__phase_build.json';
+const CACHE_ID: string = 'acme-hash1';
+
+// A fake cache entry: the project-relative path and content of each file.
+type FakeArchive = Record<string, string>;
+
+const ENTRY: FakeArchive = {
+  'lib/out.txt': 'out',
+  'lib/nested/deep/data.json': '{"a":1}',
+  [`${METADATA_FOLDER}/state.json`]: '{}'
+};
+
+interface ISubjectOptions {
+  stateHash?: string;
+  outputFolderNames?: string[];
+  excludeAppleDoubleFiles?: boolean;
+}
+
+interface IRestoreResult {
+  result: boolean;
+  output: string;
+}
+
+describe('OperationBuildCache receipts', () => {
+  let rootFolder: string;
+  let projectFolder: string;
+  let cacheFolder: string;
+  let untarHook: ((outputFolderPath: string) => void) | undefined;
+  let tarHook: ((projectFolderPath: string) => void) | undefined;
+  // If defined, the fake tar waits for it, or for its abort signal, before it reads the files.
+  let tarGate: Promise<void> | undefined;
+  let untarMock: jest.Mock<Promise<number>, [IUntarOptions]>;
+  let createArchiveMock: jest.Mock<Promise<number>, [ICreateArchiveOptions]>;
+
+  beforeEach(() => {
+    rootFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-build-cache-receipt-'));
+    projectFolder = path.join(rootFolder, 'project');
+    cacheFolder = path.join(rootFolder, 'cache');
+    fs.mkdirSync(projectFolder);
+    fs.mkdirSync(cacheFolder);
+    untarHook = undefined;
+    tarHook = undefined;
+    tarGate = undefined;
+
+    untarMock = jest.fn(async ({ archivePath, outputFolderPath }: IUntarOptions) => {
+      const archive: FakeArchive = JSON.parse(fs.readFileSync(archivePath, 'utf8'));
+      writeFiles(outputFolderPath, archive);
+      untarHook?.(outputFolderPath);
+      return 0;
+    });
+    createArchiveMock = jest.fn(
+      async ({ archivePath, paths, project, baseFolderPath, abortSignal }: ICreateArchiveOptions) => {
+        await waitForGateAsync(abortSignal);
+        if (abortSignal?.aborted) {
+          // As a killed tar would
+          return 1;
+        }
+        const archive: FakeArchive = {};
+        for (const relativePath of paths) {
+          archive[relativePath] = fs.readFileSync(
+            path.join(baseFolderPath ?? project.projectFolder, relativePath),
+            'utf8'
+          );
+        }
+        tarHook?.(project.projectFolder);
+        fs.writeFileSync(archivePath, JSON.stringify(archive));
+        return 0;
+      }
+    );
+    _setTarUtilityPromiseForTesting(
+      Promise.resolve({
+        tryUntarAsync: untarMock,
+        tryCreateArchiveFromProjectPathsAsync: createArchiveMock
+      } as unknown as TarExecutable)
+    );
+  });
+
+  afterEach(() => {
+    _setTarUtilityPromiseForTesting(undefined);
+    fs.rmSync(rootFolder, { recursive: true, force: true });
+  });
+
+  function writeFiles(folderPath: string, files: FakeArchive): void {
+    for (const [relativePath, content] of Object.entries(files)) {
+      const filePath: string = path.join(folderPath, relativePath);
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, content);
+    }
+  }
+
+  async function waitForGateAsync(abortSignal: AbortSignal | undefined): Promise<void> {
+    const gate: Promise<void> | undefined = tarGate;
+    if (gate) {
+      await new Promise<void>((resolve) => {
+        void gate.then(resolve);
+        abortSignal?.addEventListener('abort', () => resolve(), { once: true });
+      });
+    }
+  }
+
+  function getProject(): RushConfigurationProject {
+    return {
+      packageName: 'acme',
+      projectFolder,
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp'),
+      rushConfiguration: { commonTempFolder: path.join(rootFolder, 'common-temp') }
+    } as unknown as RushConfigurationProject;
+  }
+
+  function getBuildCacheConfiguration(): BuildCacheConfiguration {
+    return {
+      buildCacheEnabled: true,
+      cacheWriteEnabled: true,
+      getCacheEntryId: ({ projectName, projectStateHash }: IGenerateCacheEntryIdOptions) =>
+        `${projectName}-${projectStateHash}`,
+      localCacheProvider: {
+        getCacheEntryPath: (cacheId: string) => path.join(cacheFolder, cacheId),
+        tryGetCacheEntryPathByIdAsync: async (terminal: ITerminal, cacheId: string) => {
+          const cacheEntryPath: string = path.join(cacheFolder, cacheId);
+          return fs.existsSync(cacheEntryPath) ? cacheEntryPath : undefined;
+        }
+      },
+      cloudCacheProvider: undefined
+    } as unknown as BuildCacheConfiguration;
+  }
+
+  function createSubject(options: ISubjectOptions = {}): OperationBuildCache {
+    const { stateHash = 'hash1', outputFolderNames = ['lib'], excludeAppleDoubleFiles = false } = options;
+    const project: RushConfigurationProject = getProject();
+    const executionResult: IBaseOperationExecutionResult = {
+      operation: {
+        settings: { outputFolderNames },
+        associatedProject: project,
+        associatedPhase: { name: '_phase:build' },
+        logFilenameIdentifier: '_phase_build'
+      },
+      metadataFolderPath: METADATA_FOLDER,
+      getStateHash: () => stateHash
+    } as unknown as IBaseOperationExecutionResult;
+    return OperationBuildCache.forOperation(executionResult, {
+      buildCacheConfiguration: getBuildCacheConfiguration(),
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      excludeAppleDoubleFiles,
+      useDirectFileTransfersForBuildCache: false
+    });
+  }
+
+  function seedEntry(cacheId: string = CACHE_ID, archive: FakeArchive = ENTRY): void {
+    fs.writeFileSync(path.join(cacheFolder, cacheId), JSON.stringify(archive));
+  }
+
+  async function restoreAsync(
+    subject: OperationBuildCache,
+    specifiedCacheId?: string
+  ): Promise<IRestoreResult> {
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const result: boolean = await subject.tryRestoreFromCacheAsync(
+      new Terminal(terminalProvider),
+      specifiedCacheId
+    );
+    return { result, output: terminalProvider.getOutput() };
+  }
+
+  async function setCacheEntryAsync(
+    subject: OperationBuildCache,
+    deferredCacheEntryWrites?: DeferredCacheEntryWrites
+  ): Promise<boolean> {
+    return await subject.trySetCacheEntryAsync(
+      new Terminal(new StringBufferTerminalProvider()),
+      undefined,
+      deferredCacheEntryWrites
+    );
+  }
+
+  // Copies the files instead of cloning them, which works on any file system.
+  function createWrites(
+    cloneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void> = fs.promises.copyFile
+  ): DeferredCacheEntryWrites {
+    // The files are cloned before the seal resolves, however slow the machine is.
+    return new DeferredCacheEntryWrites({ cloneFileAsync, sealWaitMs: 60 * 1000 });
+  }
+
+  function hasEntry(): boolean {
+    return fs.existsSync(path.join(cacheFolder, CACHE_ID));
+  }
+
+  // The identity, modification time and status change time of every file in the entry.
+  function statOutputs(): Record<string, bigint[]> {
+    const result: Record<string, bigint[]> = {};
+    for (const relativePath of Object.keys(ENTRY)) {
+      const { ino, mtimeNs, ctimeNs } = fs.statSync(path.join(projectFolder, relativePath), { bigint: true });
+      result[relativePath] = [ino, mtimeNs, ctimeNs];
+    }
+    return result;
+  }
+
+  function hasReceipt(): boolean {
+    return fs.existsSync(path.join(projectFolder, RECEIPT));
+  }
+
+  function getReceiptTempFiles(): string[] {
+    const rushTempFolder: string = path.join(projectFolder, '.rush', 'temp');
+    return fs.existsSync(rushTempFolder)
+      ? fs.readdirSync(rushTempFolder).filter((name: string) => name.endsWith('.tmp'))
+      : [];
+  }
+
+  function readEntry(): FakeArchive {
+    return JSON.parse(fs.readFileSync(path.join(cacheFolder, CACHE_ID), 'utf8'));
+  }
+
+  // Waits for the writes in the background to make the condition true.
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    while (!condition()) {
+      await new Promise<void>((resolve) => setTimeout(resolve, 1));
+    }
+  }
+
+  /**
+   * Writes the entry of the outputs in the background, with a write that waits at the tar gate. Then rebuilds the
+   * outputs with other content and writes the entry again, while that write is pending.
+   */
+  async function rebuildWhileWritePendingAsync(
+    writes: DeferredCacheEntryWrites
+  ): Promise<{ subject: OperationBuildCache; openGate: () => void }> {
+    let openGate: () => void = () => undefined;
+    tarGate = new Promise<void>((resolve: () => void) => {
+      openGate = resolve;
+    });
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(true);
+    const receipt: string = fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8');
+    await waitForAsync(() => createArchiveMock.mock.calls.length === 1);
+    // Only the first write waits at the gate.
+    tarGate = undefined;
+    writeFiles(projectFolder, { 'lib/out.txt': 'rebuilt' });
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+
+    // The receipt of the first write is left, and it doesn't match the rebuilt outputs.
+    expect(fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8')).toBe(receipt);
+    expect(getReceiptTempFiles()).toEqual([]);
+    return { subject, openGate };
+  }
+
+  // Restores the entry, so that the project has a receipt for it.
+  async function restoreWithReceiptAsync(subject: OperationBuildCache): Promise<void> {
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(hasReceipt()).toBe(true);
+  }
+
+  it('T1: skips a second restore of the same entry, and leaves every output as it was', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    const before: Record<string, bigint[]> = statOutputs();
+
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).toContain(HIT_LINE);
+    expect(output).toContain(SKIP_LINE);
+    expect(statOutputs()).toEqual(before);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T2: restores again if an output was rewritten with the same content', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.writeFileSync(path.join(projectFolder, 'lib/out.txt'), ENTRY['lib/out.txt']);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it.each([
+    ['a file was added', () => fs.writeFileSync(path.join(projectFolder, 'lib/added.txt'), 'added')],
+    ['a file was deleted', () => fs.unlinkSync(path.join(projectFolder, 'lib/nested/deep/data.json'))],
+    ['an empty folder was added', () => fs.mkdirSync(path.join(projectFolder, 'lib/empty'))]
+  ])('T3: restores again if %s', async (description: string, change: () => void) => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    change();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T4: restores another entry for another state hash', async () => {
+    seedEntry();
+    seedEntry('acme-hash2');
+    await restoreWithReceiptAsync(createSubject());
+
+    const { result, output } = await restoreAsync(createSubject({ stateHash: 'hash2' }));
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T4: restores another entry for a specified cache id', async () => {
+    seedEntry();
+    seedEntry('acme-other');
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    const { result, output } = await restoreAsync(subject, 'acme-other');
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(JSON.parse(fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8')).cacheId).toBe('acme-other');
+  });
+
+  it('T5: does not skip if the entry is gone from the local cache', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.unlinkSync(path.join(cacheFolder, CACHE_ID));
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(false);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('T6: restores again after a same-size rewrite whose modification time was put back', async () => {
+    const mtime: Date = new Date('2020-01-01T00:00:00Z');
+    untarHook = (outputFolderPath: string) =>
+      fs.utimesSync(path.join(outputFolderPath, 'lib/out.txt'), mtime, mtime);
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+    const filePath: string = path.join(projectFolder, 'lib/out.txt');
+    const before: fs.BigIntStats = fs.statSync(filePath, { bigint: true });
+
+    fs.writeFileSync(filePath, ENTRY['lib/out.txt'].toUpperCase());
+    fs.utimesSync(filePath, mtime, mtime);
+    const after: fs.BigIntStats = fs.statSync(filePath, { bigint: true });
+    expect([after.ino, after.size, after.mode, after.mtimeNs]).toEqual([
+      before.ino,
+      before.size,
+      before.mode,
+      before.mtimeNs
+    ]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(filePath, 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T7: writes no receipt if an output has a time after the stamp', async () => {
+    const future: Date = new Date(Date.now() + 60 * 60 * 1000);
+    untarHook = (outputFolderPath: string) =>
+      fs.utimesSync(path.join(outputFolderPath, 'lib/out.txt'), future, future);
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T8: writes a receipt when it writes an entry, and then skips its restore', async () => {
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(JSON.parse(fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8'))).toEqual({
+      version: 1,
+      cacheId: CACHE_ID,
+      outputFolderNames: ['lib', METADATA_FOLDER],
+      listingDigest: expect.stringMatching(/^[0-9a-f]{40}$/)
+    });
+    expect(getReceiptTempFiles()).toEqual([]);
+    const before: Record<string, bigint[]> = statOutputs();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).not.toHaveBeenCalled();
+    expect(output).toContain(SKIP_LINE);
+    expect(statOutputs()).toEqual(before);
+  });
+
+  it('T9: writes no receipt if an output changes while the entry is written', async () => {
+    tarHook = (projectFolderPath: string) =>
+      fs.appendFileSync(path.join(projectFolderPath, 'lib/out.txt'), '!');
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T10: deletes the receipt before a restore that fails', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.appendFileSync(path.join(projectFolder, 'lib/out.txt'), '!');
+    untarMock.mockResolvedValueOnce(1);
+    const { result } = await restoreAsync(subject);
+
+    expect(result).toBe(false);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(hasReceipt()).toBe(false);
+  });
+
+  it('T11: restores again for the same cache id with other output folders', async () => {
+    seedEntry();
+    await restoreWithReceiptAsync(createSubject());
+
+    const { result, output } = await restoreAsync(createSubject({ outputFolderNames: ['lib', 'dist'] }));
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T12: restores again, without throwing, if the receipt is not valid JSON', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.writeFileSync(path.join(projectFolder, RECEIPT), '{ not JSON');
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it("T28: restores and writes entries, without throwing, if the receipt can't be read, written or deleted", async () => {
+    seedEntry();
+    fs.mkdirSync(path.join(projectFolder, RECEIPT), { recursive: true });
+    const subject: OperationBuildCache = createSubject();
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+
+    expect(await subject.tryRestoreFromCacheAsync(new Terminal(terminalProvider))).toBe(true);
+    expect(terminalProvider.getVerboseOutput()).toContain('Unable to read the build cache receipt');
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(fs.statSync(path.join(projectFolder, RECEIPT)).isDirectory()).toBe(true);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T13: writes no receipt if an output folder contains the receipt folder', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject({ outputFolderNames: ['lib', '.rush'] });
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T14: restores again after the operation writes an output', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+    expect((await restoreAsync(subject)).output).toContain(SKIP_LINE);
+
+    fs.writeFileSync(path.join(projectFolder, 'lib/out.txt'), 'rebuilt');
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T16: writes no receipt for an entry written while an output folder has an empty folder', async () => {
+    writeFiles(projectFolder, ENTRY);
+    fs.mkdirSync(path.join(projectFolder, 'lib/empty'));
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T17: writes no receipt if an output folder has a symbolic link', async () => {
+    untarHook = (outputFolderPath: string) =>
+      fs.symlinkSync(
+        path.join(outputFolderPath, 'lib/nested'),
+        path.join(outputFolderPath, 'lib/link'),
+        'junction'
+      );
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(fs.lstatSync(path.join(projectFolder, 'lib/link')).isSymbolicLink()).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T18: writes no receipt for a build cache that is not for an operation', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = OperationBuildCache.getOperationBuildCache({
+      buildCacheConfiguration: getBuildCacheConfiguration(),
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      project: getProject(),
+      phaseName: '_phase:build',
+      projectOutputFolderNames: ['lib', METADATA_FOLDER],
+      operationStateHash: 'hash1',
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T19: writes a receipt when it seals the outputs for a deferred write, and then skips its restore', async () => {
+    let openGate: () => void = () => undefined;
+    tarGate = new Promise<void>((resolve: () => void) => {
+      openGate = resolve;
+    });
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(true);
+    expect(hasEntry()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    openGate();
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0 });
+    const before: Record<string, bigint[]> = statOutputs();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).not.toHaveBeenCalled();
+    expect(output).toContain(SKIP_LINE);
+    expect(statOutputs()).toEqual(before);
+  });
+
+  it('T20: does not skip a restore if a deferred write is dropped', async () => {
+    tarGate = new Promise<void>(() => undefined);
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(true);
+    await writes.abortAsync();
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(false);
+    expect(untarMock).not.toHaveBeenCalled();
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T21: writes the entry at once, and no receipt, if an output changes while it is sealed for a deferred write', async () => {
+    const changedFilePath: string = path.join(projectFolder, 'lib/out.txt');
+    const changedContent: string = `${ENTRY['lib/out.txt']}!`;
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites(
+      async (sourcePath: string, destinationPath: string) => {
+        await fs.promises.copyFile(sourcePath, destinationPath);
+        if (sourcePath === changedFilePath) {
+          await fs.promises.appendFile(sourcePath, '!');
+        }
+      }
+    );
+
+    // The file changed before its clone was checked, so the seal fails, and the entry is written from the files.
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    const entry: FakeArchive = JSON.parse(fs.readFileSync(path.join(cacheFolder, CACHE_ID), 'utf8'));
+    expect(entry['lib/out.txt']).toBe(changedContent);
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, droppedCount: 0, failedCount: 0 });
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(changedFilePath, 'utf8')).toBe(changedContent);
+  });
+
+  it('T22: writes no receipt for a deferred write if the entry leaves out a file of an output folder', async () => {
+    // On macOS, the entry leaves out an AppleDouble file that has a companion file.
+    const originalPlatform: NodeJS.Platform = process.platform;
+    Object.defineProperty(process, 'platform', { value: 'darwin' });
+    let subject: OperationBuildCache;
+    try {
+      subject = createSubject({ excludeAppleDoubleFiles: true });
+    } finally {
+      Object.defineProperty(process, 'platform', { value: originalPlatform });
+    }
+    writeFiles(projectFolder, { ...ENTRY, 'lib/._out.txt': 'attributes' });
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    await writes.waitForIdleAsync();
+    const entry: FakeArchive = JSON.parse(fs.readFileSync(path.join(cacheFolder, CACHE_ID), 'utf8'));
+    expect(Object.keys(entry).sort()).toEqual(Object.keys(ENTRY).sort());
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T23: writes no receipt for a deferred write if the local cache already has an entry', async () => {
+    tarGate = new Promise<void>(() => undefined);
+    seedEntry();
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    await writes.abortAsync();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(hasReceipt()).toBe(true);
+  });
+
+  it('T24: writes no receipt while an older write of the entry is pending', async () => {
+    const writes: DeferredCacheEntryWrites = createWrites();
+    const { subject, openGate } = await rebuildWhileWritePendingAsync(writes);
+
+    // The entry of the rebuilt outputs is written first, and the older write replaces it.
+    await waitForAsync(() => fs.existsSync(path.join(cacheFolder, CACHE_ID)));
+    expect(readEntry()['lib/out.txt']).toBe('rebuilt');
+    openGate();
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 2, writtenCount: 2, failedCount: 0 });
+    expect(readEntry()).toEqual(ENTRY);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T25: writes no receipt while an older write of the entry is pending, if the entry is written at once', async () => {
+    const writes: DeferredCacheEntryWrites = createWrites(
+      async (sourcePath: string, destinationPath: string) => {
+        // The seal of the rebuilt outputs fails, so their entry is written at once.
+        if (fs.readFileSync(sourcePath, 'utf8') === 'rebuilt') {
+          throw Object.assign(new Error('The clone failed.'), { code: 'EIO' });
+        }
+        await fs.promises.copyFile(sourcePath, destinationPath);
+      }
+    );
+    const { subject, openGate } = await rebuildWhileWritePendingAsync(writes);
+
+    expect(readEntry()['lib/out.txt']).toBe('rebuilt');
+    openGate();
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 1, writtenCount: 1, failedCount: 0 });
+    expect(readEntry()).toEqual(ENTRY);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
new file mode 100644
index 00000000000..1cc125d96e5
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
@@ -0,0 +1,215 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  createStampAsync,
+  isNewerThanStamp,
+  OutputFolderReceipt,
+  type IOutputFolderStamp,
+  type PendingOutputFolderReceipt
+} from '../OutputFolderReceipt';
+
+describe(isNewerThanStamp.name, () => {
+  const stamp: IOutputFolderStamp = { timeNs: 1000n, dev: 7n };
+
+  it('T15: does not count a file whose times are both before the stamp', () => {
+    expect(isNewerThanStamp({ dev: 7n, mtimeNs: 999n, ctimeNs: 999n }, stamp)).toBe(false);
+  });
+
+  it.each([
+    ['its modification time equals the stamp', { dev: 7n, mtimeNs: 1000n, ctimeNs: 999n }],
+    ['its status change time equals the stamp', { dev: 7n, mtimeNs: 999n, ctimeNs: 1000n }],
+    ['its modification time is after the stamp', { dev: 7n, mtimeNs: 1001n, ctimeNs: 999n }],
+    ['it is on another device', { dev: 8n, mtimeNs: 1n, ctimeNs: 1n }]
+  ])(
+    'T15: counts a file if %s',
+    (description: string, stats: { dev: bigint; mtimeNs: bigint; ctimeNs: bigint }) => {
+      expect(isNewerThanStamp(stats, stamp)).toBe(true);
+    }
+  );
+});
+
+describe(createStampAsync.name, () => {
+  let folder: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-folder-receipt-'));
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  // Makes the file system report these times, one for each stat call, and then the last one again.
+  function useStatTimes(times: bigint[]): jest.SpyInstance {
+    let call: number = 0;
+    return jest.spyOn(fs.promises, 'stat').mockImplementation((async () => {
+      const timeNs: bigint = times[Math.min(call, times.length - 1)];
+      call++;
+      return { dev: 7n, mtimeNs: timeNs, ctimeNs: timeNs };
+    }) as never);
+  }
+
+  it('T19: takes a stamp that is strictly after the times of a file written just before it', async () => {
+    const folderDev: bigint = fs.statSync(folder, { bigint: true }).dev;
+    for (let i: number = 0; i < 20; i++) {
+      const filePath: string = path.join(folder, `file-${i}.txt`);
+      fs.writeFileSync(filePath, `content ${i}`);
+      const stamp: IOutputFolderStamp | undefined = await createStampAsync(
+        path.join(folder, `stamp-${i}.tmp`)
+      );
+      const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+      expect({
+        isDefined: !!stamp,
+        isBeforeStamp: !!stamp && mtimeNs < stamp.timeNs && ctimeNs < stamp.timeNs
+      }).toEqual({
+        isDefined: true,
+        isBeforeStamp: true
+      });
+      expect(stamp?.dev).toBe(folderDev);
+    }
+  });
+
+  it('fails if the file already exists', async () => {
+    const filePath: string = path.join(folder, 'stamp.tmp');
+    fs.writeFileSync(filePath, '');
+    await expect(createStampAsync(filePath)).rejects.toThrow(/EEXIST/);
+  });
+
+  it('T27: waits until the file system clock moves past the time the file was created', async () => {
+    const stat: jest.SpyInstance = useStatTimes([1000n, 1000n, 2000n]);
+
+    const stamp: IOutputFolderStamp | undefined = await createStampAsync(path.join(folder, 'stamp.tmp'));
+
+    expect(stamp).toEqual({ timeNs: 2000n, dev: 7n });
+    expect(stat).toHaveBeenCalledTimes(3);
+  });
+
+  it('T27: takes no stamp if the file system clock does not move within 100 ms', async () => {
+    useStatTimes([1000n]);
+
+    expect(await createStampAsync(path.join(folder, 'stamp.tmp'))).toBeUndefined();
+  });
+});
+
+describe(OutputFolderReceipt.name, () => {
+  let projectFolder: string;
+  let projectRushTempFolder: string;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-folder-receipt-'));
+    projectRushTempFolder = path.join(projectFolder, '.rush', 'temp');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  function tryCreateReceipt(outputFolderNames: string[]): OutputFolderReceipt | undefined {
+    return OutputFolderReceipt.tryCreate({
+      projectFolder,
+      projectRushTempFolder,
+      logFilenameIdentifier: '_phase_build',
+      outputFolderNames
+    });
+  }
+
+  // Writes a receipt for the output folders as they are now.
+  async function writeReceiptAsync(receipt: OutputFolderReceipt, cacheId: string): Promise<void> {
+    const pendingReceipt: PendingOutputFolderReceipt = await receipt.beginAsync();
+    try {
+      expect(await pendingReceipt.tryCommitAsync(cacheId)).toBeUndefined();
+    } finally {
+      await pendingReceipt.disposeAsync();
+    }
+  }
+
+  it('T20: writes no receipt if the output folders do not hold the files that were just archived', async () => {
+    fs.mkdirSync(path.join(projectFolder, 'lib'));
+    fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
+    fs.writeFileSync(path.join(projectFolder, 'lib/b.txt'), 'b');
+    const receipt: OutputFolderReceipt = tryCreateReceipt(['lib'])!;
+    const pendingReceipt: PendingOutputFolderReceipt = await receipt.beginAsync();
+
+    const reason: string | undefined = await pendingReceipt.tryCommitAsync('acme-hash1', ['lib/a.txt']);
+
+    expect(reason).toBe('the output folders do not hold the same files as the cache entry');
+    expect(fs.existsSync(receipt.filePath)).toBe(false);
+    expect(fs.readdirSync(projectRushTempFolder)).toEqual([
+      expect.stringMatching(/^build-cache-receipt__phase_build\.json\.[0-9a-f]+\.tmp$/)
+    ]);
+    await pendingReceipt.disposeAsync();
+    expect(fs.readdirSync(projectRushTempFolder)).toEqual([]);
+  });
+
+  it.each([['.rush'], ['.'], ['.rush/temp']])(
+    'T21: has no receipt if the output folder "%s" contains the .rush/temp folder',
+    (folderName: string) => {
+      expect(tryCreateReceipt(['lib', folderName])).toBeUndefined();
+    }
+  );
+
+  it('T21: has a receipt if no output folder contains the .rush/temp folder', () => {
+    expect(tryCreateReceipt(['lib', '.rush/temp/operation/_phase_build'])).toBeInstanceOf(
+      OutputFolderReceipt
+    );
+  });
+
+  it.each([['../out'], ['lib/../../out'], ['lib\\..\\..\\out'], [path.resolve('/out')]])(
+    'T24: has no receipt if the output folder "%s" is absolute or goes up with ".."',
+    (folderName: string) => {
+      expect(tryCreateReceipt(['lib', folderName])).toBeUndefined();
+    }
+  );
+
+  it.each([
+    ['2', { version: 2 }],
+    ['missing', { version: undefined }]
+  ])(
+    'T25: does not match a receipt whose version is %s',
+    async (description: string, change: { version: number | undefined }) => {
+      fs.mkdirSync(path.join(projectFolder, 'lib'));
+      fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
+      const receipt: OutputFolderReceipt = tryCreateReceipt(['lib'])!;
+      await writeReceiptAsync(receipt, 'acme-hash1');
+      expect(await receipt.isMatchAsync('acme-hash1')).toBe(true);
+
+      const json: Record<string, unknown> = JSON.parse(fs.readFileSync(receipt.filePath, 'utf8'));
+      fs.writeFileSync(receipt.filePath, JSON.stringify({ ...json, ...change }));
+
+      expect(await receipt.isMatchAsync('acme-hash1')).toBe(false);
+    }
+  );
+
+  it('T26: does not match after a symbolic link is added, even if the link is the last entry listed', async () => {
+    // The listing stops at the first entry that it can't certify, so only a link listed last leaves the
+    // digest as it was. Sorting the children by name makes lib/zz-link the last entry.
+    const readdir: (...args: unknown[]) => Promise<fs.Dirent[]> = fs.promises.readdir as unknown as (
+      ...args: unknown[]
+    ) => Promise<fs.Dirent[]>;
+    jest.spyOn(fs.promises, 'readdir').mockImplementation((async (...args: unknown[]) => {
+      const children: fs.Dirent[] = await readdir(...args);
+      return children.sort((a: fs.Dirent, b: fs.Dirent) => a.name.localeCompare(b.name));
+    }) as never);
+    fs.mkdirSync(path.join(projectFolder, 'lib/nested'), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
+    fs.writeFileSync(path.join(projectFolder, 'lib/nested/b.txt'), 'b');
+    const receipt: OutputFolderReceipt = tryCreateReceipt(['lib'])!;
+    await writeReceiptAsync(receipt, 'acme-hash1');
+    expect(await receipt.isMatchAsync('acme-hash1')).toBe(true);
+
+    fs.symlinkSync(
+      path.join(projectFolder, 'lib/nested'),
+      path.join(projectFolder, 'lib/zz-link'),
+      'junction'
+    );
+
+    expect(await receipt.isMatchAsync('acme-hash1')).toBe(false);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts b/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
new file mode 100644
index 00000000000..698f31b3468
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
@@ -0,0 +1,569 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IUntarOptions, TarExecutable } from '../../../utilities/TarExecutable';
+import type { IBaseOperationExecutionResult } from '../../operations/IOperationExecutionResult';
+import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
+
+const SUCCESS_LINE: string = 'Successfully restored output from the build cache.';
+const WARNING_LINE: string = 'Unable to restore output from the build cache.';
+const SKIP_LINE: string = 'The output folders already match this cache entry; nothing to restore.';
+const METADATA_FOLDER: string = '.rush/temp/operation/_phase_build';
+const STAGING_FOLDER_PREFIX: string = 'build-cache-restore-';
+const CACHE_ID: string = 'acme-hash1';
+
+// A fake cache entry: the project-relative path and content of each file.
+type FakeArchive = Record<string, string>;
+
+// Each file and folder under some folders: its type and mode, and a file's content or a link's target.
+type Snapshot = Record<string, string>;
+
+const ENTRY: FakeArchive = {
+  'lib/plugin.js': 'new plugin',
+  'lib/out.txt': 'out',
+  'lib/nested/deep/data.json': '{"a":1}',
+  [`${METADATA_FOLDER}/state.json`]: '{}'
+};
+
+const OLD_OUTPUTS: FakeArchive = {
+  ...ENTRY,
+  'lib/plugin.js': 'old plugin',
+  'lib/out.txt': 'old out'
+};
+
+const DEEP_ENTRY: FakeArchive = {
+  'lib/a/b/c/d/e.txt': 'e',
+  'lib/a/b/c/f.txt': 'f',
+  'lib/a/b/x.txt': 'x',
+  'lib/a/y.txt': 'y',
+  'lib/top.txt': 'top',
+  [`${METADATA_FOLDER}/state.json`]: '{}'
+};
+
+interface ISubjectOptions {
+  outputFolderNames?: string[];
+}
+
+interface IRestoreResult {
+  result: boolean;
+  output: string;
+  verbose: string;
+  warning: string;
+}
+
+interface IOldState {
+  outputFolderNames?: string[];
+  archive?: FakeArchive;
+  setUp: () => void;
+  check?: () => void;
+}
+
+describe('OperationBuildCache restores through a staging folder', () => {
+  let rootFolder: string;
+  let projectFolder: string;
+  let cacheFolder: string;
+  let untarStartHook: ((outputFolderPath: string) => void) | undefined;
+  let untarEndHook: ((outputFolderPath: string) => void) | undefined;
+  let untarMock: jest.Mock<Promise<number>, [IUntarOptions]>;
+
+  beforeEach(() => {
+    rootFolder = fs.mkdtempSync(path.join(fs.realpathSync.native(os.tmpdir()), 'rush-build-cache-staging-'));
+    projectFolder = path.join(rootFolder, 'project');
+    cacheFolder = path.join(rootFolder, 'cache');
+    fs.mkdirSync(projectFolder);
+    fs.mkdirSync(cacheFolder);
+    untarStartHook = undefined;
+    untarEndHook = undefined;
+
+    untarMock = jest.fn(async ({ archivePath, outputFolderPath }: IUntarOptions) => {
+      untarStartHook?.(outputFolderPath);
+      writeFiles(outputFolderPath, JSON.parse(fs.readFileSync(archivePath, 'utf8')));
+      untarEndHook?.(outputFolderPath);
+      return 0;
+    });
+    _setTarUtilityPromiseForTesting(
+      Promise.resolve({ tryUntarAsync: untarMock } as unknown as TarExecutable)
+    );
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    _setTarUtilityPromiseForTesting(undefined);
+    fs.rmSync(rootFolder, { recursive: true, force: true });
+  });
+
+  function writeFiles(folderPath: string, files: FakeArchive): void {
+    for (const [relativePath, content] of Object.entries(files)) {
+      const filePath: string = path.join(folderPath, relativePath);
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, content);
+    }
+  }
+
+  function takeSnapshot(folderPath: string, folderNames: ReadonlyArray<string>): Snapshot {
+    const snapshot: Snapshot = {};
+    function visit(relativePath: string): void {
+      const itemPath: string = path.join(folderPath, relativePath);
+      const stats: fs.Stats | undefined = fs.lstatSync(itemPath, { throwIfNoEntry: false });
+      if (!stats) {
+        return;
+      }
+      // eslint-disable-next-line no-bitwise
+      const mode: string = (stats.mode & 0o7777).toString(8);
+      if (stats.isSymbolicLink()) {
+        snapshot[relativePath] = `link ${fs.readlinkSync(itemPath)}`;
+      } else if (stats.isDirectory()) {
+        snapshot[relativePath] = `folder ${mode}`;
+        for (const name of fs.readdirSync(itemPath).sort()) {
+          visit(`${relativePath}/${name}`);
+        }
+      } else {
+        snapshot[relativePath] = `file ${mode} ${fs.readFileSync(itemPath, 'utf8')}`;
+      }
+    }
+    for (const folderName of folderNames) {
+      visit(folderName);
+    }
+    return snapshot;
+  }
+
+  // What a fresh extraction of the entry into an empty folder holds.
+  function getExpectedSnapshot(archive: FakeArchive, folderNames: ReadonlyArray<string>): Snapshot {
+    const oracleFolder: string = fs.mkdtempSync(path.join(rootFolder, 'oracle-'));
+    writeFiles(oracleFolder, archive);
+    return takeSnapshot(oracleFolder, folderNames);
+  }
+
+  function getStagingFolders(): string[] {
+    const rushTempFolder: string = path.join(projectFolder, '.rush', 'temp');
+    return fs.existsSync(rushTempFolder)
+      ? fs.readdirSync(rushTempFolder).filter((name: string) => name.startsWith(STAGING_FOLDER_PREFIX))
+      : [];
+  }
+
+  function getProject(): RushConfigurationProject {
+    return {
+      packageName: 'acme',
+      projectFolder,
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp')
+    } as unknown as RushConfigurationProject;
+  }
+
+  function getBuildCacheConfiguration(): BuildCacheConfiguration {
+    return {
+      buildCacheEnabled: true,
+      cacheWriteEnabled: true,
+      getCacheEntryId: ({ projectName, projectStateHash }: IGenerateCacheEntryIdOptions) =>
+        `${projectName}-${projectStateHash}`,
+      localCacheProvider: {
+        getCacheEntryPath: (cacheId: string) => path.join(cacheFolder, cacheId),
+        tryGetCacheEntryPathByIdAsync: async (terminal: ITerminal, cacheId: string) => {
+          const cacheEntryPath: string = path.join(cacheFolder, cacheId);
+          return fs.existsSync(cacheEntryPath) ? cacheEntryPath : undefined;
+        }
+      },
+      cloudCacheProvider: undefined
+    } as unknown as BuildCacheConfiguration;
+  }
+
+  function createSubject(options: ISubjectOptions = {}): OperationBuildCache {
+    const { outputFolderNames = ['lib'] } = options;
+    const project: RushConfigurationProject = getProject();
+    const executionResult: IBaseOperationExecutionResult = {
+      operation: {
+        settings: { outputFolderNames },
+        associatedProject: project,
+        associatedPhase: { name: '_phase:build' },
+        logFilenameIdentifier: '_phase_build'
+      },
+      metadataFolderPath: METADATA_FOLDER,
+      getStateHash: () => 'hash1'
+    } as unknown as IBaseOperationExecutionResult;
+    return OperationBuildCache.forOperation(executionResult, {
+      buildCacheConfiguration: getBuildCacheConfiguration(),
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+  }
+
+  function seedEntry(archive: FakeArchive = ENTRY): void {
+    fs.writeFileSync(path.join(cacheFolder, CACHE_ID), JSON.stringify(archive));
+  }
+
+  async function restoreAsync(subject: OperationBuildCache): Promise<IRestoreResult> {
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const result: boolean = await subject.tryRestoreFromCacheAsync(new Terminal(terminalProvider));
+    return {
+      result,
+      output: terminalProvider.getOutput(),
+      verbose: terminalProvider.getVerboseOutput(),
+      warning: terminalProvider.getWarningOutput()
+    };
+  }
+
+  // Calls the check after each call of the fs.promises function, and passes the call through.
+  function spyAfterEachCall(name: 'rename' | 'rm' | 'unlink' | 'chmod', check: (when: string) => void): void {
+    const original: (...args: unknown[]) => Promise<unknown> = fs.promises[name] as unknown as (
+      ...args: unknown[]
+    ) => Promise<unknown>;
+    jest.spyOn(fs.promises, name).mockImplementation((async (...args: unknown[]) => {
+      try {
+        return await original(...args);
+      } finally {
+        check(`after ${name} ${args[0]}`);
+      }
+    }) as never);
+  }
+
+  it('U1: never leaves a file that the old outputs and the entry both have missing', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const pluginPath: string = path.join(projectFolder, 'lib/plugin.js');
+    const checks: string[] = [];
+    const missing: string[] = [];
+    const check: (when: string) => void = (when: string) => {
+      checks.push(when);
+      if (!fs.existsSync(pluginPath)) {
+        missing.push(when);
+      }
+    };
+    untarStartHook = () => check('when the untar starts');
+    untarEndHook = () => check('when the untar ends');
+    for (const name of ['rename', 'rm', 'unlink', 'chmod'] as const) {
+      spyAfterEachCall(name, check);
+    }
+
+    const { result } = await restoreAsync(createSubject());
+
+    expect(missing).toEqual([]);
+    // The check ran after the rename that put the new plugin.js in place.
+    expect(checks).toContain(
+      `after rename ${path.join(untarMock.mock.calls[0][0].outputFolderPath, 'lib/plugin.js')}`
+    );
+    expect(result).toBe(true);
+    expect(fs.readFileSync(pluginPath, 'utf8')).toBe('new plugin');
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  const oldStates: [string, IOldState][] = [
+    ['a: a stray file', { setUp: () => writeFiles(projectFolder, { ...ENTRY, 'lib/stray.txt': 'stray' }) }],
+    [
+      'b: a stray folder with a file',
+      { setUp: () => writeFiles(projectFolder, { ...ENTRY, 'lib/stray/file.txt': 'stray' }) }
+    ],
+    [
+      'c: a deleted file',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, ENTRY);
+          fs.unlinkSync(path.join(projectFolder, 'lib/nested/deep/data.json'));
+        }
+      }
+    ],
+    ['d: a changed file', { setUp: () => writeFiles(projectFolder, OLD_OUTPUTS) }],
+    [
+      'e: a file with mode 0600',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, ENTRY);
+          fs.chmodSync(path.join(projectFolder, 'lib/out.txt'), 0o600);
+        }
+      }
+    ],
+    [
+      'f: a folder with mode 0700',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, ENTRY);
+          fs.chmodSync(path.join(projectFolder, 'lib/nested'), 0o700);
+        }
+      }
+    ],
+    [
+      'g: a file where the entry has a folder',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, { 'lib/out.txt': 'out', 'lib/nested': 'a file' });
+        }
+      }
+    ],
+    [
+      'h: a folder where the entry has a file',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, {
+            'lib/plugin.js/inner.txt': 'inner',
+            'lib/nested/deep/data.json': '{}'
+          });
+        }
+      }
+    ],
+    [
+      'i: an output folder that is a symbolic link to a folder outside the project',
+      (() => {
+        const outsideFiles: FakeArchive = { 'plugin.js': 'outside plugin', 'keep.txt': 'keep' };
+        let outsideBefore: Snapshot = {};
+        return {
+          setUp: () => {
+            writeFiles(path.join(rootFolder, 'outside'), outsideFiles);
+            outsideBefore = takeSnapshot(rootFolder, ['outside']);
+            fs.symlinkSync(path.join(rootFolder, 'outside'), path.join(projectFolder, 'lib'), 'junction');
+          },
+          check: () => {
+            expect(Object.keys(outsideBefore)).toHaveLength(3);
+            expect(takeSnapshot(rootFolder, ['outside'])).toEqual(outsideBefore);
+          }
+        };
+      })()
+    ],
+    ['j: an output folder that is a file', { setUp: () => writeFiles(projectFolder, { lib: 'a file' }) }],
+    [
+      'k: an output folder that the entry lacks',
+      {
+        outputFolderNames: ['lib', 'dist'],
+        setUp: () => writeFiles(projectFolder, { ...ENTRY, 'dist/index.js': 'dist' }),
+        check: () => expect(fs.existsSync(path.join(projectFolder, 'dist'))).toBe(false)
+      }
+    ],
+    [
+      'l: a deep tree that differs at several levels',
+      {
+        archive: DEEP_ENTRY,
+        setUp: () =>
+          writeFiles(projectFolder, {
+            'lib/a/b/c/d/e.txt': 'old e',
+            'lib/a/b/c/d/stale.txt': 'stale',
+            'lib/a/b/x.txt': 'x',
+            'lib/a/z/w.txt': 'w',
+            'lib/top.txt': 'old top',
+            [`${METADATA_FOLDER}/old.json`]: '{}'
+          })
+      }
+    ]
+  ];
+
+  it.each(oldStates)('U2%s', async (description: string, oldState: IOldState) => {
+    const { outputFolderNames = ['lib'], archive = ENTRY, setUp, check } = oldState;
+    const folderNames: string[] = [...outputFolderNames, METADATA_FOLDER];
+    setUp();
+    seedEntry(archive);
+
+    const { result, output } = await restoreAsync(createSubject({ outputFolderNames }));
+
+    expect(result).toBe(true);
+    expect(output).toContain(SUCCESS_LINE);
+    // A restore in place after a failed move would give the same end state, so check that there was none.
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+    expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
+    expect(getStagingFolders()).toEqual([]);
+    check?.();
+  });
+
+  it('U3: clears the output folders and warns if tar fails', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    untarMock.mockImplementationOnce(async ({ outputFolderPath }: IUntarOptions) => {
+      writeFiles(outputFolderPath, { 'lib/partial.txt': 'partial' });
+      return 1;
+    });
+
+    const { result, warning } = await restoreAsync(createSubject());
+
+    expect(result).toBe(false);
+    expect(warning).toContain(WARNING_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(fs.existsSync(path.join(projectFolder, 'lib'))).toBe(false);
+    expect(fs.existsSync(path.join(projectFolder, METADATA_FOLDER))).toBe(false);
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  it('U4: restores in place if moving the output folders into place fails', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const libFolder: string = path.join(projectFolder, 'lib');
+    const originalRename: typeof fs.promises.rename = fs.promises.rename;
+    let failedRename: string | undefined;
+    jest.spyOn(fs.promises, 'rename').mockImplementation((async (oldPath: string, newPath: string) => {
+      if (!failedRename && (newPath === libFolder || newPath.startsWith(`${libFolder}${path.sep}`))) {
+        failedRename = newPath;
+        throw Object.assign(
+          new Error(`EPERM: operation not permitted, rename '${oldPath}' -> '${newPath}'`),
+          {
+            code: 'EPERM'
+          }
+        );
+      }
+      return await originalRename(oldPath, newPath);
+    }) as never);
+    const folderNames: string[] = ['lib', METADATA_FOLDER];
+
+    const { result, verbose } = await restoreAsync(createSubject());
+
+    expect(failedRename).toBeDefined();
+    expect(result).toBe(true);
+    expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(ENTRY, folderNames));
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+    expect(untarMock.mock.calls[1][0].outputFolderPath).toBe(projectFolder);
+    expect(verbose).toContain('EPERM: operation not permitted');
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  it('U4b: starts no more moves after one fails, and then restores in place', async () => {
+    // More files than the moves that run at once, in a folder that is merged into the old one.
+    const fileCount: number = 30;
+    const archive: FakeArchive = { [`${METADATA_FOLDER}/state.json`]: '{}' };
+    for (let i: number = 0; i < fileCount; i++) {
+      archive[`lib/file${i}.txt`] = `file ${i}`;
+    }
+    writeFiles(projectFolder, { 'lib/old.txt': 'old' });
+    seedEntry(archive);
+    const libFolder: string = path.join(projectFolder, 'lib');
+    const originalRename: typeof fs.promises.rename = fs.promises.rename;
+    const renamesIntoLib: string[] = [];
+    jest.spyOn(fs.promises, 'rename').mockImplementation((async (oldPath: string, newPath: string) => {
+      if (newPath.startsWith(`${libFolder}${path.sep}`)) {
+        renamesIntoLib.push(newPath);
+        if (renamesIntoLib.length === 1) {
+          throw Object.assign(
+            new Error(`EPERM: operation not permitted, rename '${oldPath}' -> '${newPath}'`),
+            { code: 'EPERM' }
+          );
+        }
+      }
+      return await originalRename(oldPath, newPath);
+    }) as never);
+    const folderNames: string[] = ['lib', METADATA_FOLDER];
+
+    const { result } = await restoreAsync(createSubject());
+
+    expect(result).toBe(true);
+    expect(renamesIntoLib.length).toBeGreaterThan(0);
+    expect(renamesIntoLib.length).toBeLessThan(fileCount);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+    expect(untarMock.mock.calls[1][0].outputFolderPath).toBe(projectFolder);
+    expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  describe('U5: restores in place', () => {
+    let stagingFoldersDuringUntar: string[][];
+
+    beforeEach(() => {
+      stagingFoldersDuringUntar = [];
+      untarStartHook = () => stagingFoldersDuringUntar.push(getStagingFolders());
+    });
+
+    async function expectRestoredInPlaceAsync(subject: OperationBuildCache): Promise<void> {
+      writeFiles(projectFolder, OLD_OUTPUTS);
+      seedEntry();
+
+      const { result } = await restoreAsync(subject);
+
+      expect(result).toBe(true);
+      expect(untarMock).toHaveBeenCalledTimes(1);
+      expect(untarMock.mock.calls[0][0].outputFolderPath).toBe(projectFolder);
+      expect(stagingFoldersDuringUntar).toEqual([[]]);
+      expect(getStagingFolders()).toEqual([]);
+      expect(fs.readFileSync(path.join(projectFolder, 'lib/plugin.js'), 'utf8')).toBe('new plugin');
+    }
+
+    it.each([
+      ['a: if output folders are nested', ['lib', 'lib/nested']],
+      ['b: if output folders are equal ignoring case', ['lib', 'LIB']],
+      ['d: if an output folder name has ".."', ['lib', 'lib/../dist']],
+      ['f: if output folders are nested, the inner one first', ['lib/nested', 'lib']]
+    ])('U5%s', async (description: string, outputFolderNames: string[]) => {
+      await expectRestoredInPlaceAsync(createSubject({ outputFolderNames }));
+    });
+
+    it('U5c: if an output folder contains the .rush/temp folder', async () => {
+      await expectRestoredInPlaceAsync(
+        OperationBuildCache.getOperationBuildCache({
+          buildCacheConfiguration: getBuildCacheConfiguration(),
+          terminal: new Terminal(new StringBufferTerminalProvider()),
+          project: getProject(),
+          phaseName: '_phase:build',
+          projectOutputFolderNames: ['lib', '.rush'],
+          operationStateHash: 'hash1',
+          excludeAppleDoubleFiles: false,
+          useDirectFileTransfersForBuildCache: false
+        })
+      );
+    });
+
+    it('U5e: after staging, if the entry has a file outside the output folders', async () => {
+      writeFiles(projectFolder, OLD_OUTPUTS);
+      const archive: FakeArchive = { ...ENTRY, 'extra/x.txt': 'extra' };
+      seedEntry(archive);
+      const folderNames: string[] = ['lib', METADATA_FOLDER];
+
+      const { result } = await restoreAsync(createSubject());
+
+      expect(result).toBe(true);
+      expect(untarMock).toHaveBeenCalledTimes(2);
+      expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+      expect(untarMock.mock.calls[1][0].outputFolderPath).toBe(projectFolder);
+      expect(fs.readFileSync(path.join(projectFolder, 'extra/x.txt'), 'utf8')).toBe('extra');
+      expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
+      expect(getStagingFolders()).toEqual([]);
+    });
+
+    it('U5g: if the project folder is missing', async () => {
+      fs.rmSync(projectFolder, { recursive: true, force: true });
+      seedEntry();
+
+      const { result, verbose } = await restoreAsync(createSubject());
+
+      expect(result).toBe(true);
+      expect(verbose).toContain(`"${projectFolder}" is not a folder`);
+      expect(untarMock).toHaveBeenCalledTimes(1);
+      expect(untarMock.mock.calls[0][0].outputFolderPath).toBe(projectFolder);
+      expect(stagingFoldersDuringUntar).toEqual([[]]);
+      expect(fs.readFileSync(path.join(projectFolder, 'lib/plugin.js'), 'utf8')).toBe('new plugin');
+    });
+  });
+
+  it('U6: clears the output folders if there is no tar', async () => {
+    _setTarUtilityPromiseForTesting(Promise.resolve(undefined));
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const mkdtempSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'mkdtemp');
+
+    const { result, warning } = await restoreAsync(createSubject());
+
+    expect(result).toBe(false);
+    // Without tar, no extraction was tried, so there is no warning about one.
+    expect(warning).not.toContain(WARNING_LINE);
+    expect(fs.existsSync(path.join(projectFolder, 'lib'))).toBe(false);
+    expect(fs.existsSync(path.join(projectFolder, METADATA_FOLDER))).toBe(false);
+    expect(mkdtempSpy).not.toHaveBeenCalled();
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  it('U7: skips a second restore of the same entry after a restore through a staging folder', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(output).toContain(SKIP_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
index 4fa4d1b0ac2..ad96a3e9007 100644
--- a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
+++ b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
@@ -115,6 +115,18 @@ export interface IInputsSnapshotParameters {
    * Optimized lookup engine used to route `hashes` to individual projects.
    */
   lookupByPath: IReadonlyLookupByPath<IRushConfigurationProjectForSnapshot>;
+  /**
+   * An earlier snapshot of the same repository. The new snapshot reuses the state of each project whose inputs
+   * have the same hashes in both, including the hashes that the earlier snapshot has computed for it. This makes
+   * a snapshot in which few files changed faster to create and to query, and doesn't change any result.
+   *
+   * @remarks
+   * The state is reused only if `lookupByPath` and `projectMap` are the same objects, and the root directory,
+   * the Node.js version, the environment, the hashes of the global additional files and the number of additional
+   * files of the operations are the same. Otherwise the snapshot is created from scratch. The additional files of
+   * an operation may be added to, but not removed or replaced.
+   */
+  previousSnapshot?: InputsSnapshot;
   /**
    * Metadata for each project.
    */
@@ -123,10 +135,16 @@ export interface IInputsSnapshotParameters {
    * The directory that all relative paths are relative to.
    */
   rootDir: string;
+  /**
+   * {@inheritdoc IInputsSnapshot.workingTreeReadStartTimeMs}
+   */
+  workingTreeReadStartTimeMs?: number;
 }
 
 const { hashDelimiter } = RushConstants;
 
+const EMPTY_MAP: ReadonlyMap<string, string> = new Map();
+
 /**
  * Represents a synchronously-queryable in-memory snapshot of the state of the inputs to a Rush repository.
  *
@@ -149,6 +167,16 @@ export interface IInputsSnapshot {
    */
   readonly hasUncommittedChanges: boolean;
 
+  /**
+   * The time, in milliseconds since the epoch, at which this snapshot began reading the state of the working tree,
+   * if known.
+   *
+   * @remarks
+   * A tracked file that was modified at or after this time may be newer than its hash in `hashes`, because Git
+   * may have read the file before it was saved.
+   */
+  readonly workingTreeReadStartTimeMs?: number;
+
   /**
    * Gets the map of file paths to Git hashes that will be used to compute the local state hash of the operation.
    * Exposed separately from the final state hash to facilitate detailed change detection.
@@ -167,9 +195,15 @@ export interface IInputsSnapshot {
    * the command being executed and the final hashes of the operation's dependencies to compute the final hash for the operation.
    * @param project - The Rush project to compute the state hash for
    * @param operationName - The name of the operation (phase) to get hashes for. If omitted, returns a generic hash for the whole project, as used for bulk commands.
+   * @param environment - The environment that the operation runs with, if it differs from the environment of the
+   * snapshot. The operation's `dependsOnEnvVars` are hashed from it.
    * @returns The local state hash for the project. This is a hash of the environment, the project's tracked files, and any additional files.
    */
-  getOperationOwnStateHash(project: IRushConfigurationProjectForSnapshot, operationName?: string): string;
+  getOperationOwnStateHash(
+    project: IRushConfigurationProjectForSnapshot,
+    operationName?: string,
+    environment?: Readonly<Record<string, string | undefined>>
+  ): string;
 }
 
 /**
@@ -194,6 +228,10 @@ export class InputsSnapshot implements IInputsSnapshot {
    * {@inheritdoc IInputsSnapshot.rootDirectory}
    */
   public readonly rootDirectory: string;
+  /**
+   * {@inheritdoc IInputsSnapshot.workingTreeReadStartTimeMs}
+   */
+  public readonly workingTreeReadStartTimeMs: number | undefined;
 
   /**
    * The metadata for each project. This is a superset of the information in `projectMap` and includes caching of queries.
@@ -218,6 +256,13 @@ export class InputsSnapshot implements IInputsSnapshot {
    * Pre-computed Node.js version strings at each granularity level for `dependsOnNodeVersion`.
    */
   readonly #nodeVersionByGranularity: Readonly<Record<NodeVersionGranularity, string>>;
+  /**
+   * The inputs that a later snapshot must share to reuse the state of the projects in this one.
+   */
+  readonly #lookupByPath: IReadonlyLookupByPath<IRushConfigurationProjectForSnapshot>;
+  readonly #projectMap: IRushSnapshotProjectMetadataMap;
+  readonly #nodeVersion: string;
+  readonly #operationAdditionalFileCount: number;
 
   /**
    *
@@ -233,30 +278,11 @@ export class InputsSnapshot implements IInputsSnapshot {
       hasUncommittedChanges,
       lookupByPath,
       nodeVersion = process.version,
-      rootDir
+      previousSnapshot,
+      projectMap,
+      rootDir,
+      workingTreeReadStartTimeMs
     } = params;
-    const projectMetadataMap: Map<
-      IRushConfigurationProjectForSnapshot,
-      IInternalInputsSnapshotProjectMetadata
-    > = new Map();
-    for (const [project, record] of params.projectMap) {
-      projectMetadataMap.set(project, createInternalRecord(project, record, rootDir));
-    }
-
-    // Route hashes to individual projects
-    for (const [file, hash] of hashes) {
-      const project: IRushConfigurationProjectForSnapshot | undefined = lookupByPath.findChildPath(file);
-      if (!project) {
-        continue;
-      }
-
-      let record: IInternalInputsSnapshotProjectMetadata | undefined = projectMetadataMap.get(project);
-      if (!record) {
-        projectMetadataMap.set(project, (record = createInternalRecord(project, undefined, rootDir)));
-      }
-
-      record.hashes.set(file, hash);
-    }
 
     let globalAdditionalHashes: Map<string, string> | undefined;
     if (globalAdditionalFiles) {
@@ -278,21 +304,32 @@ export class InputsSnapshot implements IInputsSnapshot {
       }
     }
 
-    for (const record of projectMetadataMap.values()) {
-      // Ensure stable ordering.
-      Sort.sortMapKeys(record.hashes);
-    }
-
-    this.#projectMetadataMap = projectMetadataMap;
+    const operationAdditionalFileCount: number = countOperationAdditionalFiles(projectMap);
+
+    this.#projectMetadataMap =
+      (previousSnapshot &&
+        previousSnapshot.#tryDeriveProjectMetadataMap(
+          params,
+          environment,
+          nodeVersion,
+          globalAdditionalHashes,
+          operationAdditionalFileCount
+        )) ??
+      createProjectMetadataMap(hashes, lookupByPath, projectMap, rootDir);
     this.#additionalHashes = additionalHashes;
     this.#globalAdditionalHashes = globalAdditionalHashes;
     // Snapshot the environment so that queries are not impacted by when they happen
     this.#environment = environment;
     // Parse Node.js version once so it doesn't need to be re-parsed per operation
     this.#nodeVersionByGranularity = _parseNodeVersion(nodeVersion);
+    this.#lookupByPath = lookupByPath;
+    this.#projectMap = projectMap;
+    this.#nodeVersion = nodeVersion;
+    this.#operationAdditionalFileCount = operationAdditionalFileCount;
     this.hashes = hashes;
     this.hasUncommittedChanges = hasUncommittedChanges;
     this.rootDirectory = rootDir;
+    this.workingTreeReadStartTimeMs = workingTreeReadStartTimeMs;
   }
 
   /**
@@ -311,7 +348,6 @@ export class InputsSnapshot implements IInputsSnapshot {
     let hashes: Map<string, string> | undefined = fileHashesByOperationName.get(operationName);
     if (!hashes) {
       hashes = new Map();
-      fileHashesByOperationName.set(operationName, hashes);
       // TODO: Support incrementalBuildIgnoredGlobs per-operation
       const filter: (filePath: string) => boolean = getOrCreateProjectFilter(record);
 
@@ -367,6 +403,9 @@ export class InputsSnapshot implements IInputsSnapshot {
           );
         }
       }
+
+      // Only a complete result is kept, so that a query that fails fails again
+      fileHashesByOperationName.set(operationName, hashes);
     }
 
     return hashes;
@@ -377,59 +416,80 @@ export class InputsSnapshot implements IInputsSnapshot {
    */
   public getOperationOwnStateHash(
     project: IRushConfigurationProjectForSnapshot,
-    operationName?: string
+    operationName?: string,
+    environment?: Readonly<Record<string, string | undefined>>
   ): string {
     const record: IInternalInputsSnapshotProjectMetadata | undefined = this.#projectMetadataMap.get(project);
     if (!record) {
       throw new Error(`No information available for project at ${project.projectFolder}`);
     }
 
+    const operationSettings: Readonly<IOperationSettings> | undefined = operationName
+      ? record.projectConfig?.operationSettingsByOperationName.get(operationName)
+      : undefined;
+    const snapshotEnvironment: Readonly<Record<string, string | undefined>> = this.#environment;
+    if (
+      environment &&
+      operationSettings?.dependsOnEnvVars?.some(
+        (envVar: string) => (environment[envVar] || '') !== (snapshotEnvironment[envVar] || '')
+      )
+    ) {
+      // The operation's environment differs from the snapshot's in a variable that it hashes, so don't memoize.
+      return this.#computeOperationOwnStateHash(project, operationName, operationSettings, environment);
+    }
+
     const { hashByOperationName } = record;
     let hash: string | undefined = hashByOperationName.get(operationName);
     if (!hash) {
-      const hashes: ReadonlyMap<string, string> = this.getTrackedFileHashesForOperation(
+      hash = this.#computeOperationOwnStateHash(
         project,
-        operationName
+        operationName,
+        operationSettings,
+        snapshotEnvironment
       );
+      hashByOperationName.set(operationName, hash);
+    }
 
-      const hasher: Hash = createHash('sha1');
-      // If this is for a specific operation, apply operation-specific options
-      if (operationName) {
-        const operationSettings: Readonly<IOperationSettings> | undefined =
-          record.projectConfig?.operationSettingsByOperationName.get(operationName);
-        if (operationSettings) {
-          const { dependsOnEnvVars, dependsOnNodeVersion, outputFolderNames } = operationSettings;
-          if (dependsOnEnvVars) {
-            // As long as we enumerate environment variables in a consistent order, we will get a stable hash.
-            // Changing the order in rush-project.json will change the hash anyway since the file contents are part of the hash.
-            for (const envVar of dependsOnEnvVars) {
-              hasher.update(`${hashDelimiter}$${envVar}=${this.#environment[envVar] || ''}`);
-            }
-          }
-
-          if (dependsOnNodeVersion) {
-            const granularity: NodeVersionGranularity =
-              dependsOnNodeVersion === true ? 'patch' : dependsOnNodeVersion;
-            hasher.update(`${hashDelimiter}nodeVersion=${this.#nodeVersionByGranularity[granularity]}`);
-          }
+    return hash;
+  }
 
-          if (outputFolderNames) {
-            hasher.update(`${hashDelimiter}${JSON.stringify(outputFolderNames)}`);
-          }
+  #computeOperationOwnStateHash(
+    project: IRushConfigurationProjectForSnapshot,
+    operationName: string | undefined,
+    operationSettings: Readonly<IOperationSettings> | undefined,
+    environment: Readonly<Record<string, string | undefined>>
+  ): string {
+    const hashes: ReadonlyMap<string, string> = this.getTrackedFileHashesForOperation(project, operationName);
+
+    const hasher: Hash = createHash('sha1');
+    // If this is for a specific operation, apply operation-specific options
+    if (operationSettings) {
+      const { dependsOnEnvVars, dependsOnNodeVersion, outputFolderNames } = operationSettings;
+      if (dependsOnEnvVars) {
+        // As long as we enumerate environment variables in a consistent order, we will get a stable hash.
+        // Changing the order in rush-project.json will change the hash anyway since the file contents are part of the hash.
+        for (const envVar of dependsOnEnvVars) {
+          hasher.update(`${hashDelimiter}$${envVar}=${environment[envVar] || ''}`);
         }
       }
 
-      // Hash the base project files
-      for (const [filePath, fileHash] of hashes) {
-        hasher.update(`${hashDelimiter}${filePath}${hashDelimiter}${fileHash}`);
+      if (dependsOnNodeVersion) {
+        const granularity: NodeVersionGranularity =
+          dependsOnNodeVersion === true ? 'patch' : dependsOnNodeVersion;
+        hasher.update(`${hashDelimiter}nodeVersion=${this.#nodeVersionByGranularity[granularity]}`);
       }
 
-      hash = hasher.digest('hex');
+      if (outputFolderNames) {
+        hasher.update(`${hashDelimiter}${JSON.stringify(outputFolderNames)}`);
+      }
+    }
 
-      hashByOperationName.set(operationName, hash);
+    // Hash the base project files
+    for (const [filePath, fileHash] of hashes) {
+      hasher.update(`${hashDelimiter}${filePath}${hashDelimiter}${fileHash}`);
     }
 
-    return hash;
+    return hasher.digest('hex');
   }
 
   *#resolveHashes(filePaths: Iterable<string>): Generator<[string, string]> {
@@ -444,6 +504,266 @@ export class InputsSnapshot implements IInputsSnapshot {
       yield [filePath, hash];
     }
   }
+
+  /**
+   * Returns the state of each project for a later snapshot with the given parameters. It is the state of each
+   * project in this snapshot whose inputs have the same hashes, and new state for each other project. Returns
+   * undefined if the later snapshot differs from this one in more than the hashes of files.
+   */
+  #tryDeriveProjectMetadataMap(
+    params: IInputsSnapshotParameters,
+    environment: Readonly<Record<string, string | undefined>>,
+    nodeVersion: string,
+    globalAdditionalHashes: ReadonlyMap<string, string> | undefined,
+    operationAdditionalFileCount: number
+  ): Map<IRushConfigurationProjectForSnapshot, IInternalInputsSnapshotProjectMetadata> | undefined {
+    const { additionalHashes, hashes, lookupByPath, projectMap, rootDir } = params;
+    if (
+      lookupByPath !== this.#lookupByPath ||
+      projectMap !== this.#projectMap ||
+      rootDir !== this.rootDirectory ||
+      nodeVersion !== this.#nodeVersion ||
+      operationAdditionalFileCount !== this.#operationAdditionalFileCount ||
+      !areMapsEqual(globalAdditionalHashes ?? EMPTY_MAP, this.#globalAdditionalHashes ?? EMPTY_MAP) ||
+      !areEnvironmentsEqual(environment, this.#environment)
+    ) {
+      return undefined;
+    }
+
+    const changedFiles: Set<string> = new Set();
+    addChangedFiles(this.hashes, hashes, changedFiles);
+    addChangedFiles(this.#additionalHashes ?? EMPTY_MAP, additionalHashes ?? EMPTY_MAP, changedFiles);
+
+    const previousMetadataMap: ReadonlyMap<
+      IRushConfigurationProjectForSnapshot,
+      IInternalInputsSnapshotProjectMetadata
+    > = this.#projectMetadataMap;
+    const projectMetadataMap: Map<
+      IRushConfigurationProjectForSnapshot,
+      IInternalInputsSnapshotProjectMetadata
+    > = new Map(previousMetadataMap);
+    if (changedFiles.size === 0) {
+      return projectMetadataMap;
+    }
+
+    const changedFilesByProject: Map<IRushConfigurationProjectForSnapshot, string[]> = new Map();
+    for (const file of changedFiles) {
+      const project: IRushConfigurationProjectForSnapshot | undefined = lookupByPath.findChildPath(file);
+      if (project) {
+        let projectFiles: string[] | undefined = changedFilesByProject.get(project);
+        if (!projectFiles) {
+          changedFilesByProject.set(project, (projectFiles = []));
+        }
+        projectFiles.push(file);
+      }
+    }
+
+    // The operations of a project also depend on their additional files, which may be outside of the project
+    for (const [project, { additionalFilesByOperationName }] of previousMetadataMap) {
+      if (
+        additionalFilesByOperationName &&
+        !changedFilesByProject.has(project) &&
+        dependsOnAnyFile(additionalFilesByOperationName, changedFiles)
+      ) {
+        changedFilesByProject.set(project, []);
+      }
+    }
+
+    for (const [project, projectFiles] of changedFilesByProject) {
+      const previousRecord: IInternalInputsSnapshotProjectMetadata | undefined =
+        previousMetadataMap.get(project);
+      const record: IInternalInputsSnapshotProjectMetadata = createInternalRecord(
+        project,
+        projectMap.get(project),
+        rootDir
+      );
+      if (previousRecord) {
+        // The filter depends only on the configuration of the project
+        record.projectFilePathFilter = previousRecord.projectFilePathFilter;
+        for (const [file, hash] of previousRecord.hashes) {
+          // A query adds the global additional files to the hashes of the project
+          if (!globalAdditionalHashes?.has(file)) {
+            record.hashes.set(file, hash);
+          }
+        }
+      }
+
+      let addedFile: boolean = false;
+      for (const file of projectFiles) {
+        const hash: string | undefined = hashes.get(file);
+        if (hash === undefined) {
+          record.hashes.delete(file);
+        } else {
+          addedFile ||= !record.hashes.has(file);
+          record.hashes.set(file, hash);
+        }
+      }
+
+      if (addedFile) {
+        // Ensure stable ordering.
+        Sort.sortMapKeys(record.hashes);
+      }
+
+      if (record.hashes.size === 0 && !projectMap.has(project)) {
+        // A project that has no metadata has state only while it has files
+        projectMetadataMap.delete(project);
+      } else {
+        projectMetadataMap.set(project, record);
+      }
+    }
+
+    return projectMetadataMap;
+  }
+}
+
+function createProjectMetadataMap(
+  hashes: ReadonlyMap<string, string>,
+  lookupByPath: IReadonlyLookupByPath<IRushConfigurationProjectForSnapshot>,
+  projectMap: IRushSnapshotProjectMetadataMap,
+  rootDir: string
+): Map<IRushConfigurationProjectForSnapshot, IInternalInputsSnapshotProjectMetadata> {
+  const projectMetadataMap: Map<
+    IRushConfigurationProjectForSnapshot,
+    IInternalInputsSnapshotProjectMetadata
+  > = new Map();
+  for (const [project, record] of projectMap) {
+    projectMetadataMap.set(project, createInternalRecord(project, record, rootDir));
+  }
+
+  // Route hashes to individual projects
+  for (const [file, hash] of hashes) {
+    const project: IRushConfigurationProjectForSnapshot | undefined = lookupByPath.findChildPath(file);
+    if (!project) {
+      continue;
+    }
+
+    let record: IInternalInputsSnapshotProjectMetadata | undefined = projectMetadataMap.get(project);
+    if (!record) {
+      projectMetadataMap.set(project, (record = createInternalRecord(project, undefined, rootDir)));
+    }
+
+    record.hashes.set(file, hash);
+  }
+
+  for (const record of projectMetadataMap.values()) {
+    // Ensure stable ordering.
+    Sort.sortMapKeys(record.hashes);
+  }
+
+  return projectMetadataMap;
+}
+
+/**
+ * Adds each file that has a hash in only one of the maps, or different hashes in them, to `changedFiles`.
+ */
+function addChangedFiles(
+  previousHashes: ReadonlyMap<string, string>,
+  hashes: ReadonlyMap<string, string>,
+  changedFiles: Set<string>
+): void {
+  if (previousHashes === hashes) {
+    return;
+  }
+
+  // Both maps usually list almost all files in sorted order. Merge them in that order, which reads each map in
+  // sequence, and look up only the files that are out of order.
+  const previousEntries: Iterator<[string, string]> = previousHashes.entries();
+  let previous: IteratorResult<[string, string]> = previousEntries.next();
+  for (const [file, hash] of hashes) {
+    let previousHash: string | undefined;
+    while (!previous.done) {
+      const [previousFile, previousFileHash] = previous.value;
+      if (previousFile === file) {
+        previousHash = previousFileHash;
+        previous = previousEntries.next();
+        break;
+      }
+
+      if (previousFile > file) {
+        break;
+      }
+
+      if (!hashes.has(previousFile)) {
+        changedFiles.add(previousFile);
+      }
+      previous = previousEntries.next();
+    }
+
+    if (previousHash === undefined) {
+      previousHash = previousHashes.get(file);
+    }
+
+    if (previousHash !== hash) {
+      changedFiles.add(file);
+    }
+  }
+
+  for (; !previous.done; previous = previousEntries.next()) {
+    const previousFile: string = previous.value[0];
+    if (!hashes.has(previousFile)) {
+      changedFiles.add(previousFile);
+    }
+  }
+}
+
+function dependsOnAnyFile(
+  additionalFilesByOperationName: ReadonlyMap<string, ReadonlySet<string>>,
+  files: ReadonlySet<string>
+): boolean {
+  for (const additionalFiles of additionalFilesByOperationName.values()) {
+    const [smaller, larger] =
+      additionalFiles.size < files.size ? [additionalFiles, files] : [files, additionalFiles];
+    for (const file of smaller) {
+      if (larger.has(file)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+function countOperationAdditionalFiles(projectMap: IRushSnapshotProjectMetadataMap): number {
+  let count: number = 0;
+  for (const { additionalFilesByOperationName } of projectMap.values()) {
+    for (const additionalFiles of additionalFilesByOperationName?.values() ?? []) {
+      count += additionalFiles.size;
+    }
+  }
+
+  return count;
+}
+
+function areMapsEqual(a: ReadonlyMap<string, string>, b: ReadonlyMap<string, string>): boolean {
+  if (a.size !== b.size) {
+    return false;
+  }
+
+  for (const [key, value] of a) {
+    if (b.get(key) !== value) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function areEnvironmentsEqual(
+  a: Readonly<Record<string, string | undefined>>,
+  b: Readonly<Record<string, string | undefined>>
+): boolean {
+  const keys: string[] = Object.keys(a);
+  if (keys.length !== Object.keys(b).length) {
+    return false;
+  }
+
+  for (const key of keys) {
+    if (a[key] !== b[key] || !Object.prototype.hasOwnProperty.call(b, key)) {
+      return false;
+    }
+  }
+
+  return true;
 }
 
 /**
diff --git a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
index 0ace6c14725..fc29aaa8487 100644
--- a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
+++ b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
@@ -7,6 +7,7 @@ import type { RushProjectConfiguration } from '../../../api/RushProjectConfigura
 import {
   InputsSnapshot,
   type IInputsSnapshotParameters,
+  type IInputsSnapshotProjectMetadata,
   type IRushConfigurationProjectForSnapshot
 } from '../InputsSnapshot';
 
@@ -49,6 +50,14 @@ describe(InputsSnapshot.name, () => {
     return { project, input };
   }
 
+  it('Exposes the time at which it began reading the working tree', () => {
+    const { options } = getTestConfig();
+    expect(new InputsSnapshot(options).workingTreeReadStartTimeMs).toBeUndefined();
+    expect(
+      new InputsSnapshot({ ...options, workingTreeReadStartTimeMs: 1234 }).workingTreeReadStartTimeMs
+    ).toBe(1234);
+  });
+
   describe(InputsSnapshot.prototype.getTrackedFileHashesForOperation.name, () => {
     it('Handles trivial input', () => {
       const { project, input } = getTrivialSnapshot();
@@ -93,6 +102,41 @@ describe(InputsSnapshot.name, () => {
       ).toThrowErrorMatchingSnapshot();
     });
 
+    it('Fails each time for an operation whose input files cannot be listed', () => {
+      const { project, options } = getTestConfig();
+
+      const projectConfig: Pick<RushProjectConfiguration, 'operationSettingsByOperationName'> = {
+        operationSettingsByOperationName: new Map([
+          ['_phase:build', { operationName: '_phase:build', outputFolderNames: ['lib'] }]
+        ])
+      };
+
+      const input: InputsSnapshot = new InputsSnapshot({
+        ...options,
+        projectMap: new Map([
+          [
+            project,
+            {
+              projectConfig: projectConfig as RushProjectConfiguration,
+              additionalFilesByOperationName: new Map([['_phase:test', new Set(['/ext/missing.json'])]])
+            }
+          ]
+        ])
+      });
+
+      for (let i: number = 0; i < 2; i++) {
+        expect(() => input.getTrackedFileHashesForOperation(project, '_phase:build')).toThrow(
+          'contains tracked input file "a/lib/file3.js"'
+        );
+        expect(() => input.getOperationOwnStateHash(project, '_phase:build')).toThrow(
+          'contains tracked input file "a/lib/file3.js"'
+        );
+        expect(() => input.getTrackedFileHashesForOperation(project, '_phase:test')).toThrow(
+          'Could not find hash for file path "/ext/missing.json"'
+        );
+      }
+    });
+
     it('Respects additionalFilesByOperationName', () => {
       const { project, options } = getTestConfig();
 
@@ -713,5 +757,392 @@ describe(InputsSnapshot.name, () => {
       expect(result2).not.toEqual(baseline);
       expect(result2).not.toEqual(result1);
     });
+
+    it("Hashes dependsOnEnvVars from an operation's own environment when one is supplied", () => {
+      const { project, options } = getTestConfig();
+      const projectConfig: Pick<RushProjectConfiguration, 'operationSettingsByOperationName'> = {
+        operationSettingsByOperationName: new Map([
+          ['_phase:build', { operationName: '_phase:build', dependsOnEnvVars: ['ENV_VAR'] }]
+        ])
+      };
+      const createSnapshot = (environment: Record<string, string>): InputsSnapshot =>
+        new InputsSnapshot({
+          ...options,
+          projectMap: new Map([[project, { projectConfig: projectConfig as RushProjectConfiguration }]]),
+          environment
+        });
+      const snapshotA: InputsSnapshot = createSnapshot({ ENV_VAR: 'a', OTHER: 'a' });
+      const snapshotB: InputsSnapshot = createSnapshot({ ENV_VAR: 'b' });
+      const hashA: string = createSnapshot({ ENV_VAR: 'a' }).getOperationOwnStateHash(
+        project,
+        '_phase:build'
+      );
+      const hashB: string = snapshotB.getOperationOwnStateHash(project, '_phase:build');
+      expect(hashB).not.toEqual(hashA);
+
+      // An operation that runs with another environment gets the hash of a snapshot of that environment,
+      // whether or not the snapshot's own hash was already computed.
+      expect(snapshotA.getOperationOwnStateHash(project, '_phase:build', { ENV_VAR: 'b' })).toEqual(hashB);
+      expect(snapshotA.getOperationOwnStateHash(project, '_phase:build')).toEqual(hashA);
+      expect(snapshotA.getOperationOwnStateHash(project, '_phase:build', { ENV_VAR: 'b' })).toEqual(hashB);
+      // Variables that the operation does not depend on never change its hash.
+      expect(
+        snapshotA.getOperationOwnStateHash(project, '_phase:build', { ENV_VAR: 'a', OTHER: 'b' })
+      ).toEqual(hashA);
+      expect(snapshotA.getOperationOwnStateHash(project, undefined, { ENV_VAR: 'b' })).toEqual(
+        snapshotB.getOperationOwnStateHash(project, undefined)
+      );
+    });
+  });
+
+  describe('previousSnapshot', () => {
+    const operationNames: (string | undefined)[] = [undefined, '_phase:build', '_phase:test'];
+
+    interface IDerivationTestConfig {
+      projects: IRushConfigurationProjectForSnapshot[];
+      a: IRushConfigurationProjectForSnapshot;
+      b: IRushConfigurationProjectForSnapshot;
+      c: IRushConfigurationProjectForSnapshot;
+      bAdditionalFiles: Set<string>;
+      options: IInputsSnapshotParameters;
+    }
+
+    function getDerivationTestConfig(): IDerivationTestConfig {
+      const a: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/a',
+        projectRelativeFolder: 'a'
+      };
+      const b: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/b',
+        projectRelativeFolder: 'b'
+      };
+      // A project that has no metadata, which has state only while it has files
+      const c: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/c',
+        projectRelativeFolder: 'c'
+      };
+      // A project that has metadata but no files
+      const d: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/d',
+        projectRelativeFolder: 'd'
+      };
+
+      const aConfig: Pick<
+        RushProjectConfiguration,
+        'incrementalBuildIgnoredGlobs' | 'operationSettingsByOperationName'
+      > = {
+        incrementalBuildIgnoredGlobs: ['*.md'],
+        operationSettingsByOperationName: new Map([
+          [
+            '_phase:build',
+            { operationName: '_phase:build', dependsOnEnvVars: ['FOO'], outputFolderNames: ['lib'] }
+          ],
+          ['_phase:test', { operationName: '_phase:test', dependsOnNodeVersion: 'major' }]
+        ])
+      };
+      const bConfig: Pick<RushProjectConfiguration, 'operationSettingsByOperationName'> = {
+        operationSettingsByOperationName: new Map([['_phase:build', { operationName: '_phase:build' }]])
+      };
+      const bAdditionalFiles: Set<string> = new Set(['common/shared.json', '/ext/tool.json']);
+
+      return {
+        projects: [a, b, c, d],
+        a,
+        b,
+        c,
+        bAdditionalFiles,
+        options: {
+          rootDir: '/root',
+          additionalHashes: new Map([['/ext/tool.json', 'ext1']]),
+          environment: { FOO: '1' },
+          globalAdditionalFiles: ['common/config/global.json'],
+          hashes: new Map([
+            ['a/README.md', 'a0'],
+            ['a/src/x.ts', 'a1'],
+            ['a/src/y.ts', 'a2'],
+            ['b/index.ts', 'b1'],
+            ['c/file.ts', 'c1'],
+            ['common/config/global.json', 'g1'],
+            ['common/other.txt', 'o1'],
+            ['common/shared.json', 's1']
+          ]),
+          hasUncommittedChanges: false,
+          lookupByPath: new LookupByPath(
+            [a, b, c, d].map((project) => [project.projectRelativeFolder, project])
+          ),
+          nodeVersion: 'v22.1.0',
+          projectMap: new Map<IRushConfigurationProjectForSnapshot, IInputsSnapshotProjectMetadata>([
+            [a, { projectConfig: aConfig as RushProjectConfiguration }],
+            [
+              b,
+              {
+                projectConfig: bConfig as RushProjectConfiguration,
+                additionalFilesByOperationName: new Map([['_phase:build', bAdditionalFiles]])
+              }
+            ],
+            [d, {}]
+          ])
+        }
+      };
+    }
+
+    function queryAll(snapshot: InputsSnapshot, projects: IRushConfigurationProjectForSnapshot[]): string[] {
+      const results: string[] = [];
+      for (const project of projects) {
+        for (const operationName of operationNames) {
+          try {
+            const tracked: [string, string][] = Array.from(
+              snapshot.getTrackedFileHashesForOperation(project, operationName)
+            );
+            const hash: string = snapshot.getOperationOwnStateHash(project, operationName);
+            const hashInOtherEnvironment: string = snapshot.getOperationOwnStateHash(project, operationName, {
+              FOO: 'other'
+            });
+            results.push(JSON.stringify({ tracked, hash, hashInOtherEnvironment }));
+          } catch (error) {
+            results.push(`error: ${error.message}`);
+          }
+        }
+      }
+
+      return results;
+    }
+
+    function expectSameAsNewSnapshot(
+      derived: InputsSnapshot,
+      options: IInputsSnapshotParameters,
+      projects: IRushConfigurationProjectForSnapshot[]
+    ): void {
+      const created: InputsSnapshot = new InputsSnapshot({ ...options, previousSnapshot: undefined });
+      expect(queryAll(derived, projects)).toEqual(queryAll(created, projects));
+      expect(derived.hashes).toBe(options.hashes);
+      expect(derived.hasUncommittedChanges).toBe(options.hasUncommittedChanges);
+      expect(derived.workingTreeReadStartTimeMs).toBe(options.workingTreeReadStartTimeMs);
+    }
+
+    it('Reuses the state of each project whose inputs did not change', () => {
+      const { projects, a, b, options } = getDerivationTestConfig();
+      const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      queryAll(previousSnapshot, projects);
+
+      const hashes: Map<string, string> = new Map(options.hashes);
+      hashes.set('a/src/x.ts', 'a1-changed');
+      const derivedOptions: IInputsSnapshotParameters = {
+        ...options,
+        hashes,
+        hasUncommittedChanges: true,
+        workingTreeReadStartTimeMs: 1234,
+        previousSnapshot
+      };
+      const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+      expect(derived.getTrackedFileHashesForOperation(b, '_phase:build')).toBe(
+        previousSnapshot.getTrackedFileHashesForOperation(b, '_phase:build')
+      );
+      expect(derived.getTrackedFileHashesForOperation(a, '_phase:build')).not.toBe(
+        previousSnapshot.getTrackedFileHashesForOperation(a, '_phase:build')
+      );
+      expect(derived.getOperationOwnStateHash(a, '_phase:build')).not.toEqual(
+        previousSnapshot.getOperationOwnStateHash(a, '_phase:build')
+      );
+      expectSameAsNewSnapshot(derived, derivedOptions, projects);
+    });
+
+    it('Computes the state of a project again when its files are added, changed or removed', () => {
+      const { projects, a, options } = getDerivationTestConfig();
+      const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      queryAll(previousSnapshot, projects);
+
+      const hashes: Map<string, string> = new Map(options.hashes);
+      // Sorts before the other files of the project
+      hashes.set('a/.eslintrc.js', 'a3');
+      hashes.delete('a/src/y.ts');
+      hashes.set('c/file.ts', 'c1-changed');
+      hashes.set('common/other.txt', 'o1-changed');
+      const derivedOptions: IInputsSnapshotParameters = { ...options, hashes, previousSnapshot };
+      const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+      expect(Array.from(derived.getTrackedFileHashesForOperation(a).keys())).toEqual([
+        'a/.eslintrc.js',
+        'a/src/x.ts',
+        'common/config/global.json'
+      ]);
+      expectSameAsNewSnapshot(derived, derivedOptions, projects);
+    });
+
+    it('Computes the state of a project again when one of its additional files changes', () => {
+      const { projects, b, options } = getDerivationTestConfig();
+      for (const [file, hashes, additionalHashes] of [
+        [
+          'common/shared.json',
+          new Map([...options.hashes, ['common/shared.json', 's2']]),
+          options.additionalHashes
+        ],
+        ['/ext/tool.json', options.hashes, new Map([['/ext/tool.json', 'ext2']])]
+      ] as const) {
+        const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+        queryAll(previousSnapshot, projects);
+
+        const derivedOptions: IInputsSnapshotParameters = {
+          ...options,
+          hashes,
+          additionalHashes,
+          previousSnapshot
+        };
+        const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+        expect(derived.getTrackedFileHashesForOperation(b, '_phase:build').get(file)).not.toEqual(
+          previousSnapshot.getTrackedFileHashesForOperation(b, '_phase:build').get(file)
+        );
+        expectSameAsNewSnapshot(derived, derivedOptions, projects);
+      }
+    });
+
+    it('Removes the state of a project that has no metadata when it no longer has files', () => {
+      const { projects, c, options } = getDerivationTestConfig();
+      const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      queryAll(previousSnapshot, projects);
+
+      const hashes: Map<string, string> = new Map(options.hashes);
+      hashes.delete('c/file.ts');
+      const derivedOptions: IInputsSnapshotParameters = { ...options, hashes, previousSnapshot };
+      const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+      expect(() => derived.getTrackedFileHashesForOperation(c)).toThrow('No information available');
+      expectSameAsNewSnapshot(derived, derivedOptions, projects);
+
+      // And creates it again when a file is added back
+      const restoredOptions: IInputsSnapshotParameters = {
+        ...options,
+        previousSnapshot: derived
+      };
+      expectSameAsNewSnapshot(new InputsSnapshot(restoredOptions), restoredOptions, projects);
+    });
+
+    it('Creates the state of every project again when any other input changes', () => {
+      const { projects, b, bAdditionalFiles, options } = getDerivationTestConfig();
+      const hashes: Map<string, string> = new Map(options.hashes);
+      hashes.set('a/src/x.ts', 'a1-changed');
+      const changes: [string, () => Partial<IInputsSnapshotParameters>][] = [
+        ['environment', () => ({ environment: { FOO: '2' } })],
+        ['an environment variable that no operation hashes', () => ({ environment: { FOO: '1', BAR: '' } })],
+        ['node version', () => ({ nodeVersion: 'v23.0.0' })],
+        [
+          'global additional file',
+          () => ({ hashes: new Map([...hashes, ['common/config/global.json', 'g2']]) })
+        ],
+        ['global additional files', () => ({ globalAdditionalFiles: [] })],
+        ['root directory', () => ({ rootDir: '/root/' })],
+        ['lookup', () => ({ lookupByPath: new LookupByPath(Array.from(options.lookupByPath.entries())) })],
+        ['project map', () => ({ projectMap: new Map(options.projectMap) })],
+        [
+          'additional files of an operation',
+          () => {
+            bAdditionalFiles.add('common/other.txt');
+            return {};
+          }
+        ]
+      ];
+
+      for (const [name, getChange] of changes) {
+        const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+        queryAll(previousSnapshot, projects);
+
+        const derivedOptions: IInputsSnapshotParameters = {
+          ...options,
+          hashes,
+          ...getChange(),
+          previousSnapshot
+        };
+        const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+        const reusedState: boolean =
+          derived.getTrackedFileHashesForOperation(b, '_phase:build') ===
+          previousSnapshot.getTrackedFileHashesForOperation(b, '_phase:build');
+        expect({ name, reusedState }).toEqual({ name, reusedState: false });
+        expectSameAsNewSnapshot(derived, derivedOptions, projects);
+      }
+    });
+
+    it('Computes the same state as a new snapshot after any sequence of changes', () => {
+      const { projects, bAdditionalFiles, options } = getDerivationTestConfig();
+      const files: string[] = [
+        'a/README.md',
+        'a/src/x.ts',
+        'a/src/y.ts',
+        'a/src/z.ts',
+        'a/b.ts',
+        'a/lib/output.js',
+        'a/libs/input.ts',
+        'aa/file.ts',
+        'b/index.ts',
+        'b/util.ts',
+        'c/file.ts',
+        'c/other.ts',
+        'd/new.ts',
+        'common/other.txt',
+        'common/shared.json',
+        'common/zzz.txt'
+      ];
+      const random: () => number = createRandom(42);
+      const pick = <T>(items: T[]): T => items[Math.floor(random() * items.length)];
+
+      let hashes: Map<string, string> = new Map(options.hashes);
+      let additionalHashes: ReadonlyMap<string, string> | undefined = options.additionalHashes;
+      let previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      for (let i: number = 0; i < 300; i++) {
+        // Query some operations of the previous snapshot, as a host does before it takes the next one
+        for (const project of projects) {
+          for (const operationName of operationNames) {
+            if (random() < 0.5) {
+              try {
+                previousSnapshot.getOperationOwnStateHash(project, operationName);
+              } catch {
+                // Compared below
+              }
+            }
+          }
+        }
+
+        hashes = new Map(hashes);
+        const changeCount: number = Math.floor(random() * 4);
+        for (let j: number = 0; j < changeCount; j++) {
+          const file: string = pick(files);
+          if (hashes.has(file) && random() < 0.4) {
+            hashes.delete(file);
+          } else {
+            hashes.set(file, `${pick(['h1', 'h2', 'h3'])}`);
+          }
+        }
+
+        if (random() < 0.2) {
+          additionalHashes = new Map([['/ext/tool.json', pick(['ext1', 'ext2'])]]);
+        }
+
+        if (random() < 0.03) {
+          bAdditionalFiles.add(pick(files));
+        }
+
+        const derivedOptions: IInputsSnapshotParameters = {
+          ...options,
+          additionalHashes,
+          // Sometimes list the files out of order
+          hashes: random() < 0.2 ? new Map(Array.from(hashes).reverse()) : hashes,
+          previousSnapshot
+        };
+        const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+        expectSameAsNewSnapshot(derived, derivedOptions, projects);
+        previousSnapshot = derived;
+      }
+    });
   });
 });
+
+function createRandom(seed: number): () => number {
+  // A Park-Miller generator, so that a failure can be reproduced
+  let state: number = seed;
+  return (): number => {
+    state = (state * 48271) % 2147483647;
+    return state / 2147483647;
+  };
+}
diff --git a/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts b/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
index 8ae6806b00d..1d1eb22c5a6 100644
--- a/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
+++ b/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
@@ -494,66 +494,81 @@ export class InstallHelpers {
 
     logIfConsoleOutputIsNotRestricted(`Acquired lock for ${packageManagerAndVersion}`);
 
-    if (!(await packageManagerMarker.isValidAsync()) || lock.dirtyWhenAcquired) {
-      logIfConsoleOutputIsNotRestricted(
-        Colorize.bold(`Installing ${packageManager} version ${packageManagerVersion}\n`)
-      );
-
-      // note that this will remove the last-install flag from the directory
-      await Utilities.installPackageInDirectoryAsync({
-        directory: packageManagerToolFolder,
-        packageName: packageManager,
-        version: rushConfiguration.packageManagerToolVersion,
-        tempPackageTitle: `${packageManager}-local-install`,
-        maxInstallAttempts: maxInstallAttempts,
-        // This is using a local configuration to install a package in a shared global location.
-        // Generally that's a bad practice, but in this case if we can successfully install
-        // the package at all, we can reasonably assume it's good for all the repositories.
-        // In particular, we'll assume that two different NPM registries cannot have two
-        // different implementations of the same version of the same package.
-        // This was needed for: https://github.com/microsoft/rushstack/issues/691
-        commonRushConfigFolder: rushConfiguration.commonRushConfigFolder,
-        // Only filter npm-incompatible properties when the repo uses pnpm or yarn.
-        // If the repo uses npm, the .npmrc is already configured for npm, so don't filter.
-        filterNpmIncompatibleProperties: rushConfiguration.packageManager !== 'npm'
-      });
+    try {
+      // Only the flag decides whether to reinstall. A stale lock (lock.dirtyWhenAcquired) only means that
+      // some process exited while it held the lock. An install deletes the flag before it changes the
+      // folder, so an interrupted install leaves no flag. Reinstalling because of a stale lock alone would
+      // empty a shared folder that other processes may be running the package manager from.
+      if (!(await packageManagerMarker.isValidAsync())) {
+        logIfConsoleOutputIsNotRestricted(
+          Colorize.bold(`Installing ${packageManager} version ${packageManagerVersion}\n`)
+        );
 
-      logIfConsoleOutputIsNotRestricted(
-        `Successfully installed ${packageManager} version ${packageManagerVersion}`
-      );
-    } else {
-      logIfConsoleOutputIsNotRestricted(
-        `Found ${packageManager} version ${packageManagerVersion} in ${packageManagerToolFolder}`
-      );
-    }
+        // Delete the flag first, so that an interrupted install can't leave it next to a partly
+        // deleted or partly installed folder.
+        await packageManagerMarker.clearAsync();
+
+        await Utilities.installPackageInDirectoryAsync({
+          directory: packageManagerToolFolder,
+          packageName: packageManager,
+          version: rushConfiguration.packageManagerToolVersion,
+          tempPackageTitle: `${packageManager}-local-install`,
+          maxInstallAttempts: maxInstallAttempts,
+          // This is using a local configuration to install a package in a shared global location.
+          // Generally that's a bad practice, but in this case if we can successfully install
+          // the package at all, we can reasonably assume it's good for all the repositories.
+          // In particular, we'll assume that two different NPM registries cannot have two
+          // different implementations of the same version of the same package.
+          // This was needed for: https://github.com/microsoft/rushstack/issues/691
+          commonRushConfigFolder: rushConfiguration.commonRushConfigFolder,
+          // Only filter npm-incompatible properties when the repo uses pnpm or yarn.
+          // If the repo uses npm, the .npmrc is already configured for npm, so don't filter.
+          filterNpmIncompatibleProperties: rushConfiguration.packageManager !== 'npm'
+        });
+
+        logIfConsoleOutputIsNotRestricted(
+          `Successfully installed ${packageManager} version ${packageManagerVersion}`
+        );
 
-    await packageManagerMarker.createAsync();
+        // Write the flag only after an install. Rewriting a valid flag on every call would let a process
+        // that is killed during the write leave an empty flag, and the next caller would reinstall.
+        await packageManagerMarker.createAsync();
+      } else {
+        logIfConsoleOutputIsNotRestricted(
+          `Found ${packageManager} version ${packageManagerVersion} in ${packageManagerToolFolder}`
+        );
+      }
 
-    // Example: "C:\MyRepo\common\temp"
-    FileSystem.ensureFolder(rushConfiguration.commonTempFolder);
+      // Example: "C:\MyRepo\common\temp"
+      FileSystem.ensureFolder(rushConfiguration.commonTempFolder);
 
-    // Example: "C:\MyRepo\common\temp\pnpm-local"
-    const localPackageManagerToolFolder: string = `${rushConfiguration.commonTempFolder}/${packageManager}-local`;
+      // Example: "C:\MyRepo\common\temp\pnpm-local"
+      const localPackageManagerToolFolder: string = `${rushConfiguration.commonTempFolder}/${packageManager}-local`;
 
-    logIfConsoleOutputIsNotRestricted(`\nSymlinking "${localPackageManagerToolFolder}"`);
-    logIfConsoleOutputIsNotRestricted(`  --> "${packageManagerToolFolder}"`);
+      logIfConsoleOutputIsNotRestricted(`\nSymlinking "${localPackageManagerToolFolder}"`);
+      logIfConsoleOutputIsNotRestricted(`  --> "${packageManagerToolFolder}"`);
 
-    // We cannot use FileSystem.exists() to test the existence of a symlink, because it will
-    // return false for broken symlinks.  There is no way to test without catching an exception.
-    try {
-      await FileSystem.deleteFolderAsync(localPackageManagerToolFolder);
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
-        throw error;
+      // We cannot use FileSystem.exists() to test the existence of a symlink, because it will
+      // return false for broken symlinks.  There is no way to test without catching an exception.
+      try {
+        await FileSystem.deleteFolderAsync(localPackageManagerToolFolder);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+          throw error;
+        }
       }
-    }
-
-    await FileSystem.createSymbolicLinkJunctionAsync({
-      linkTargetPath: packageManagerToolFolder,
-      newLinkPath: localPackageManagerToolFolder
-    });
 
-    lock.release();
+      await FileSystem.createSymbolicLinkJunctionAsync({
+        linkTargetPath: packageManagerToolFolder,
+        newLinkPath: localPackageManagerToolFolder
+      });
+    } finally {
+      // A long-lived process such as the Rush daemon calls this again after a failed install.
+      // LockFile keeps an in-process record of every held lock, so a lock that is never released
+      // makes that later call wait forever. A failed install deletes the last-install flag before it
+      // changes the tool folder, so the next caller installs again.
+      lock.release();
+    }
   }
 }
 
diff --git a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
index 035eb53395a..e0344f716fb 100644
--- a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
+++ b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
@@ -21,6 +21,16 @@ export class AsyncOperationQueue
   readonly #pendingIterators: ((result: IteratorResult<OperationExecutionRecord>) => void)[];
   readonly #totalOperations: number;
   readonly #completedOperations: Set<OperationExecutionRecord>;
+  readonly #sortFn: IOperationSortFunction;
+
+  /**
+   * Operations that are not dispatched until they are released. They are kept out of `#queue`, so that
+   * `assignOperations()` does not scan them.
+   */
+  readonly #heldOperations: Set<OperationExecutionRecord>;
+  /** Operations that are dispatched before all others, see `prioritizeOperations()`. */
+  readonly #prioritizedOperations: Set<OperationExecutionRecord>;
+  #holdRetainCount: number;
 
   /**
    * Tracks how many times each operation has been assigned to an execution slot.
@@ -30,6 +40,7 @@ export class AsyncOperationQueue
   readonly #numberOfTimesQueuedByOperation: Map<OperationExecutionRecord, number>;
 
   #isDone: boolean;
+  #hasDispatched: boolean;
 
   /**
    * @param operations - The set of operations to be executed
@@ -37,14 +48,116 @@ export class AsyncOperationQueue
    *   - Returning a positive value indicates that `a` should execute before `b`.
    *   - Returning a negative value indicates that `b` should execute before `a`.
    *   - Returning 0 indicates no preference.
+   * @param heldOperations - Operations of `operations` that are not dispatched until they are released, see
+   *   `releaseHeldOperations()`. They are released when every other operation has completed, unless a caller
+   *   retains them (see `retainHeldOperations()`).
    */
-  public constructor(operations: Iterable<OperationExecutionRecord>, sortFn: IOperationSortFunction) {
-    this.#queue = computeTopologyAndSort(operations, sortFn);
+  public constructor(
+    operations: Iterable<OperationExecutionRecord>,
+    sortFn: IOperationSortFunction,
+    heldOperations?: Iterable<OperationExecutionRecord>
+  ) {
+    const sortedOperations: OperationExecutionRecord[] = computeTopologyAndSort(operations, sortFn);
+    const held: Set<OperationExecutionRecord> = new Set();
+    if (heldOperations) {
+      const candidates: ReadonlySet<OperationExecutionRecord> = new Set(heldOperations);
+      for (const record of sortedOperations) {
+        if (candidates.has(record)) {
+          held.add(record);
+        }
+      }
+    }
+    this.#queue = held.size
+      ? sortedOperations.filter((record: OperationExecutionRecord) => !held.has(record))
+      : sortedOperations;
+    this.#heldOperations = held;
+    this.#prioritizedOperations = new Set();
+    this.#holdRetainCount = 0;
+    this.#sortFn = sortFn;
     this.#pendingIterators = [];
-    this.#totalOperations = this.#queue.length;
+    this.#totalOperations = sortedOperations.length;
     this.#isDone = false;
+    this.#hasDispatched = false;
     this.#completedOperations = new Set<OperationExecutionRecord>();
     this.#numberOfTimesQueuedByOperation = new Map();
+    // If every operation is held, none would ever complete to release them.
+    this.#releaseIfOnlyHeldOperationsRemain();
+  }
+
+  /**
+   * Whether every operation has completed, or the queue has nothing left to dispatch.
+   */
+  public get isDone(): boolean {
+    return this.#isDone;
+  }
+
+  /**
+   * Whether an iterator has requested an operation and the queue is not done.
+   */
+  public get isDispatching(): boolean {
+    return this.#hasDispatched && !this.#isDone;
+  }
+
+  /**
+   * The operations that are held back from dispatch.
+   */
+  public get heldOperations(): ReadonlySet<OperationExecutionRecord> {
+    return this.#heldOperations;
+  }
+
+  /**
+   * Keeps the held operations held even when every other operation has completed, until the returned function is
+   * called. Aborting the iteration still releases them, see `releaseHeldOperations()`.
+   */
+  public retainHeldOperations(): () => void {
+    this.#holdRetainCount++;
+    let released: boolean = false;
+    return () => {
+      if (released) {
+        return;
+      }
+      released = true;
+      this.#holdRetainCount--;
+      this.#releaseIfOnlyHeldOperationsRemain();
+      this.assignOperations();
+    };
+  }
+
+  /**
+   * Makes held operations available for dispatch.
+   * @param operations - The held operations to release, or undefined to release all of them.
+   */
+  public releaseHeldOperations(operations?: Iterable<OperationExecutionRecord>): void {
+    const held: Set<OperationExecutionRecord> = this.#heldOperations;
+    let releasedAny: boolean = false;
+    for (const record of operations ?? Array.from(held)) {
+      if (held.delete(record)) {
+        this.#queue.push(record);
+        releasedAny = true;
+      }
+    }
+    if (releasedAny) {
+      this.#sortQueue();
+      this.assignOperations();
+    }
+  }
+
+  /**
+   * Dispatches the given operations before all other ready operations. Among each other, they keep the order of the
+   * sort function.
+   */
+  public prioritizeOperations(operations: Iterable<OperationExecutionRecord>): void {
+    let changed: boolean = false;
+    for (const record of operations) {
+      if (!this.#prioritizedOperations.has(record)) {
+        this.#prioritizedOperations.add(record);
+        changed = true;
+      }
+    }
+    if (changed) {
+      this.#sortQueue();
+      this.assignOperations();
+    }
   }
 
   /**
@@ -52,6 +165,7 @@ export class AsyncOperationQueue
    * @see {AsyncIterator}
    */
   public next(): Promise<IteratorResult<OperationExecutionRecord>> {
+    this.#hasDispatched = true;
     const waitingIterators: Array<(result: IteratorResult<OperationExecutionRecord>) => void> =
       this.#pendingIterators;
 
@@ -71,6 +185,8 @@ export class AsyncOperationQueue
    * If all operations are completed, set the queue to done, resolve all pending iterators in next cycle.
    */
   public complete(record: OperationExecutionRecord): void {
+    // A held operation completes without dispatch if a failure blocks it.
+    this.#heldOperations.delete(record);
     this.#completedOperations.add(record);
     this.#numberOfTimesQueuedByOperation.delete(record);
 
@@ -89,6 +205,7 @@ export class AsyncOperationQueue
       }
     }
 
+    this.#releaseIfOnlyHeldOperationsRemain();
     this.assignOperations();
 
     if (this.#completedOperations.size === this.#totalOperations) {
@@ -108,8 +225,14 @@ export class AsyncOperationQueue
 
     const readyOperations: OperationExecutionRecord[] = [];
 
+    // Operations that were never assigned are assigned first, in the order in which they are found, so the
+    // scan can stop once it has found one for each waiting iterator. This method runs each time an operation
+    // is requested, completes or becomes ready, and the queue of a long-lived graph (such as the Rush
+    // daemon's) can hold thousands of operations, so scanning all of them each time would be quadratic.
+    let untriedReadyCount: number = 0;
+
     // By iterating in reverse order we do less array shuffling when removing operations
-    for (let i: number = queue.length - 1; waitingIterators.length > 0 && i >= 0; i--) {
+    for (let i: number = queue.length - 1; untriedReadyCount < waitingIterators.length && i >= 0; i--) {
       const record: OperationExecutionRecord = queue[i];
 
       if (
@@ -137,6 +260,9 @@ export class AsyncOperationQueue
         throw new Error(`Unexpected status "${record.status}" for queued operation: ${record.name}`);
       } else {
         readyOperations.push(record);
+        if (!timesQueued.has(record)) {
+          untriedReadyCount++;
+        }
       }
       // Otherwise operation is still waiting
     }
@@ -163,7 +289,7 @@ export class AsyncOperationQueue
     }
 
     // Since items only get removed from the queue when they have a final status, this should be safe.
-    if (queue.length === 0) {
+    if (queue.length === 0 && this.#heldOperations.size === 0) {
       this.#isDone = true;
     }
 
@@ -178,6 +304,33 @@ export class AsyncOperationQueue
     }
   }
 
+  #releaseIfOnlyHeldOperationsRemain(): void {
+    const heldCount: number = this.#heldOperations.size;
+    if (
+      heldCount > 0 &&
+      this.#holdRetainCount === 0 &&
+      this.#completedOperations.size + heldCount === this.#totalOperations
+    ) {
+      for (const record of this.#heldOperations) {
+        this.#queue.push(record);
+      }
+      this.#heldOperations.clear();
+      this.#sortQueue();
+    }
+  }
+
+  #sortQueue(): void {
+    const sortFn: IOperationSortFunction = this.#sortFn;
+    const prioritized: ReadonlySet<OperationExecutionRecord> = this.#prioritizedOperations;
+    // The queue is scanned from its end, so the prioritized operations go last.
+    this.#queue.sort(
+      prioritized.size
+        ? (a: OperationExecutionRecord, b: OperationExecutionRecord) =>
+            Number(prioritized.has(a)) - Number(prioritized.has(b)) || sortFn(a, b)
+        : sortFn
+    );
+  }
+
   /**
    * Returns this queue as an async iterator, such that multiple functions iterating this object concurrently
    * receive distinct iteration results.
@@ -253,8 +406,9 @@ function calculateCriticalPathLength(
     }
     dependencyChain.delete(operation);
   }
-  // Include the contribution from the current operation
-  operation.criticalPathLength = criticalPathLength + operation.weight;
+  // Include the contribution from the current operation, and return the same value that later visits will read
+  criticalPathLength += operation.weight;
+  operation.criticalPathLength = criticalPathLength;
 
   // Directly writing operations to an output collection here would yield a topological sorted set
   // However, we want a bit more fine-tuning of the output than just the raw topology
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 6213db3edeb..2632a88df3d 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -19,6 +19,11 @@ import { CollatedTerminalProvider } from '../../utilities/CollatedTerminalProvid
 import { OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 import { CobuildLock, type ICobuildCompletedState } from '../cobuild/CobuildLock';
 import { OperationBuildCache } from '../buildCache/OperationBuildCache';
+import {
+  type DeferredCacheEntryWrites,
+  type IDeferredCacheEntryWritesReport,
+  formatMegabytes
+} from '../buildCache/DeferredCacheEntryWrites';
 import { RushConstants } from '../RushConstants';
 import type { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
 import {
@@ -31,10 +36,13 @@ import { DisjointSet } from '../cobuild/DisjointSet';
 import { PeriodicCallback } from './PeriodicCallback';
 import {
   captureInputFilesState,
-  haveInputFilesChanged,
   hasUntrackedGitFiles,
   type IInputFilesState
 } from './InputFilesStatSignature';
+import {
+  getInputFilesChangeKindSinceSnapshotAsync,
+  type InputFilesChangeKind
+} from './OperationInputFilesCheck';
 import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
 import { NullTerminalProvider } from '../../utilities/NullTerminalProvider';
 import type { Operation } from './Operation';
@@ -45,13 +53,30 @@ import type {
   IPhasedCommandPlugin,
   PhasedCommandHooks
 } from '../../pluginFramework/PhasedCommandHooks';
-import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
+import type {
+  IOperationGraph,
+  IOperationGraphIterationOptions,
+  IOperationGraphRequestResult
+} from './IOperationGraph';
 import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration';
-import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
+import {
+  CAPTURE_INPUT_FILES_STAGE,
+  enableUnverifiedRetainedOperations,
+  getVerifiedSkipStateHash,
+  markInputFilesChecked,
+  markResultUnverifiable,
+  setTrustedStateHash
+} from './RetainedResultVerification';
+import { getSnapshotStartTimeMs } from './OperationInputFilesCheck';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import { isBuildCacheReadSkipped, wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
 const PERIODIC_CALLBACK_INTERVAL_IN_SECONDS: number = 10;
+// Runs after the default-stage taps (e.g. PhasedOperationPlugin) have decided which operations to enable.
+const RE_ENABLE_UNTRUSTED_RESULTS_STAGE: number = 1;
 
 export interface IProjectDeps {
   files: { [filePath: string]: string };
@@ -63,7 +88,11 @@ export interface IOperationBuildCacheContext {
   isCacheReadAllowed: boolean;
 
   operationBuildCache: OperationBuildCache | undefined;
-  cacheDisabledReason: string | undefined;
+  // Computed when first read, by getCacheDisabledReason. See the beforeExecuteIterationAsync tap.
+  readonly cacheDisabledReason: string | undefined;
+  // Replaced, like inputsSnapshot, snapshotStartTimeMs and inputFileHashes, when a request joins the iteration (see
+  // the extendIteration tap), since it depends on the inputs snapshot
+  getCacheDisabledReason: () => string | undefined;
   outputFolderNames: ReadonlyArray<string>;
 
   cobuildLock: CobuildLock | undefined;
@@ -79,9 +108,29 @@ export interface IOperationBuildCacheContext {
   cacheRestored: boolean;
   isCacheReadAttempted: boolean;
 
-  // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
-  // the iteration's inputs snapshot. Used to refuse cache writes if the inputs changed while the operation
-  // was executing.
+  // True if the outputs of this operation were produced by its incremental command in this iteration (see
+  // IncrementalExecutionGuardPlugin), or if it executed against outputs of a dependency that were. Such outputs
+  // can differ from those of the initial command, so neither they nor the outputs of their consumers are written
+  // to the build cache. Unlike a blocked cache write, this does not stop a long-lived graph from trusting them.
+  isIncrementalResult: boolean;
+
+  // True if a dependency of this operation, or one of theirs, was skipped by an iteration of a long-lived graph (e.g.
+  // the Rush daemon) that did not select it, while its retained result was trusted. The iteration did not verify its
+  // outputs, which may have been edited in place, so neither the outputs of this operation nor those of its consumers
+  // are written to the build cache, as in a run that does not select that dependency. If this operation executes, its
+  // result is not trusted. If it is skipped, it keeps its trust, since its outputs were not built in this iteration.
+  hasUnverifiedDependency: boolean;
+
+  // The inputs snapshot that the state hash of the operation was computed from (the iteration's, or that of a request
+  // that joined the iteration before the operation was dispatched), and the start of the window in which the tracked
+  // input files may have changed after it read them (see getSnapshotStartTimeMs)
+  inputsSnapshot: IInputsSnapshot;
+  snapshotStartTimeMs: number;
+  // The hashes of the tracked input files in that inputs snapshot
+  inputFileHashes: ReadonlyMap<string, string>;
+  // The on-disk state of the tracked input files whose hashes produced the cache key, captured right before the
+  // operation executes. Used to refuse cache writes, and to keep a long-lived graph from skipping the operation
+  // later, if the inputs changed after the snapshot read them, until the operation has executed.
   inputFilesState?: IInputFilesState;
 }
 
@@ -92,6 +141,11 @@ export interface ICacheableOperationPluginOptions {
   terminal: ITerminal;
   excludeAppleDoubleFiles: boolean;
   useDirectFileTransfersForBuildCache: boolean;
+  /**
+   * If specified, an operation completes once its output files are sealed, and its build cache entry is written
+   * from them in the background. Ignored for cobuilds.
+   */
+  deferredCacheEntryWrites?: DeferredCacheEntryWrites;
 }
 
 interface ITryGetOperationBuildCacheOptionsBase<TRecord> {
@@ -122,24 +176,30 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
     this.#options = options;
   }
 
+  #getGitPath(): string | undefined {
+    if (!this.#gitPathResolved) {
+      this.#gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
+      this.#gitPathResolved = true;
+    }
+    return this.#gitPath;
+  }
+
   #isNewInput(
     newEntryPaths: ReadonlyArray<string>,
     rootDirectory: string,
     projectFolder: string,
-    outputFolderNames: ReadonlyArray<string>
+    outputFolderNames: ReadonlyArray<string>,
+    snapshotHashes: ReadonlyMap<string, string>
   ): boolean {
-    if (!this.#gitPathResolved) {
-      this.#gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
-      this.#gitPathResolved = true;
-    }
-    if (!this.#gitPath) {
+    const gitPath: string | undefined = this.#getGitPath();
+    if (!gitPath) {
       // Without Git we cannot tell whether the new entries are ignored, so assume they are inputs.
       return true;
     }
     const outputFolderPaths: string[] = outputFolderNames.map((folderName: string) =>
       path.resolve(projectFolder, folderName)
     );
-    return hasUntrackedGitFiles(this.#gitPath, rootDirectory, newEntryPaths, outputFolderPaths);
+    return hasUntrackedGitFiles(gitPath, rootDirectory, newEntryPaths, outputFolderPaths, snapshotHashes);
   }
 
   public apply(hooks: PhasedCommandHooks): void {
@@ -150,15 +210,22 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
       excludeAppleDoubleFiles,
       useDirectFileTransfersForBuildCache
     } = this.#options;
+    // Other cobuild agents wait for an entry once its operation completes, so it must be written by then.
+    const deferredCacheEntryWrites: DeferredCacheEntryWrites | undefined =
+      cobuildConfiguration?.cobuildFeatureEnabled ? undefined : this.#options.deferredCacheEntryWrites;
 
     hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph: IOperationGraph, context: IOperationGraphContext) => {
       // The state hash at which each operation last completed successfully in an iteration of this graph
       // in which cache writes were allowed for it (i.e. no dependency had an unknown state).
       const trustedStateHashByOperation: Map<Operation, string> = new Map();
+      // The trusted state hash of each operation whose trusted outputs are an incremental result, which must not
+      // be written to the build cache, nor may the outputs of its consumers.
+      const incrementalStateHashByOperation: Map<Operation, string> = new Map();
 
       graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>) => {
         for (const operation of operations) {
           trustedStateHashByOperation.delete(operation);
+          incrementalStateHashByOperation.delete(operation);
         }
         // Terminals and cobuild callbacks can retain the entire completed iteration, including other
         // projects' records. All of this scratch state is rebuilt by beforeExecuteIterationAsync.
@@ -168,6 +235,33 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         }
         this.#buildCacheContextByOperation.clear();
       });
+      graph.hooks.configureIteration.tap(
+        { name: PLUGIN_NAME, stage: RE_ENABLE_UNTRUSTED_RESULTS_STAGE },
+        (
+          currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
+          lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
+          iterationOptions: IOperationGraphIterationOptions
+        ) => {
+          // PhasedOperationPlugin re-verifies results that were built against unverified dependency outputs.
+          // This also re-verifies results that are not trusted for other reasons, e.g. because their input files
+          // changed while they were executing. Without cache writes, nothing is ever trusted.
+          if (buildCacheConfiguration.cacheWriteEnabled && iterationOptions.inputsSnapshot) {
+            // An operation that this iteration does not select blocks the cache writes of its consumers (see the
+            // afterExecuteOperationAsync tap below), so running them again would not make them trusted either.
+            const trustedStateHashBySelectedOperation: Map<Operation, string> = new Map();
+            for (const [operation, stateHash] of trustedStateHashByOperation) {
+              if (operation.enabled !== false) {
+                trustedStateHashBySelectedOperation.set(operation, stateHash);
+              }
+            }
+            enableUnverifiedRetainedOperations(
+              currentStates,
+              lastStates,
+              trustedStateHashBySelectedOperation
+            );
+          }
+        }
+      );
       graph.hooks.beforeExecuteIterationAsync.tap(
         PLUGIN_NAME,
         (
@@ -184,32 +278,18 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
           const { isIncrementalBuildAllowed, projectConfigurations } = context;
           const { cacheWriteEnabled } = buildCacheConfiguration;
+          const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
 
           const disjointSet: DisjointSet<Operation> | undefined = cobuildConfiguration?.cobuildFeatureEnabled
             ? new DisjointSet()
             : undefined;
 
           for (const [operation, record] of recordByOperation) {
-            const { associatedProject, associatedPhase, runner, settings: operationSettings } = operation;
+            const { associatedProject, runner, settings: operationSettings } = operation;
             if (!runner) {
               return;
             }
 
-            const { name: phaseName } = associatedPhase;
-
-            const projectConfiguration: RushProjectConfiguration | undefined =
-              projectConfigurations.get(associatedProject);
-
-            // This value can *currently* be cached per-project, but in the future the list of files will vary
-            // depending on the selected phase.
-            const fileHashes: ReadonlyMap<string, string> | undefined =
-              inputsSnapshot.getTrackedFileHashesForOperation(associatedProject, phaseName);
-
-            const cacheDisabledReason: string | undefined = projectConfiguration
-              ? projectConfiguration.getCacheDisabledReason(fileHashes.keys(), phaseName, operation.isNoOp)
-              : `Project does not have a ${RushConstants.rushProjectConfigFilename} configuration file, ` +
-                'or one provided by a rig, so it does not support caching.';
-
             const outputFolderNames: string[] = [record.metadataFolderPath];
             const configuredOutputFolderNames: string[] | undefined = operationSettings?.outputFolderNames;
             if (configuredOutputFolderNames) {
@@ -220,19 +300,17 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
             disjointSet?.add(operation);
 
-            const inputFilesState: IInputFilesState | undefined =
-              cacheWriteEnabled && !cacheDisabledReason && record.enabled
-                ? captureInputFilesState(inputsSnapshot.rootDirectory, fileHashes.keys())
-                : undefined;
-
             const buildCacheContext: IOperationBuildCacheContext = {
               // Supports cache writes by default for initial operations.
               // Don't write during watch runs for performance reasons (and to avoid flooding the cache)
               isCacheWriteAllowed: cacheWriteEnabled,
-              isCacheReadAllowed: isIncrementalBuildAllowed,
+              isCacheReadAllowed:
+                isIncrementalBuildAllowed && iterationOptions.isIncrementalBuildAllowed !== false,
               operationBuildCache: undefined,
               outputFolderNames,
-              cacheDisabledReason,
+              get cacheDisabledReason(): string | undefined {
+                return buildCacheContext.getCacheDisabledReason();
+              },
               cobuildLock: undefined,
               cobuildClusterId: undefined,
               buildCacheTerminal: undefined,
@@ -242,7 +320,14 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }),
               cacheRestored: false,
               isCacheReadAttempted: false,
-              inputFilesState
+              isIncrementalResult: false,
+              hasUnverifiedDependency: false,
+              ...readCacheInputs(
+                operation,
+                inputsSnapshot,
+                snapshotStartTimeMs,
+                projectConfigurations.get(associatedProject)
+              )
             };
             // Upstream runners may mutate the property of build cache context for downstream runners
             this.#buildCacheContextByOperation.set(operation, buildCacheContext);
@@ -281,6 +366,38 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      graph.hooks.extendIteration.tap(
+        PLUGIN_NAME,
+        (
+          changedRecords: ReadonlyMap<Operation, IOperationExecutionResult>,
+          iterationOptions: IOperationGraphIterationOptions
+        ): void => {
+          const { inputsSnapshot } = iterationOptions;
+          if (!inputsSnapshot) {
+            return;
+          }
+          const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+          for (const operation of changedRecords.keys()) {
+            const buildCacheContext: IOperationBuildCacheContext | undefined =
+              this.#buildCacheContextByOperation.get(operation);
+            if (buildCacheContext) {
+              // Updated in place, since upstream operations may have updated other properties of the context.
+              // The operation was not dispatched yet, so the tap at CAPTURE_INPUT_FILES_STAGE captures its input
+              // files later, for the newer snapshot.
+              Object.assign(
+                buildCacheContext,
+                readCacheInputs(
+                  operation,
+                  inputsSnapshot,
+                  snapshotStartTimeMs,
+                  context.projectConfigurations.get(operation.associatedProject)
+                )
+              );
+            }
+          }
+        }
+      );
+
       graph.hooks.beforeExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (
@@ -429,6 +546,9 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }
               return !!restoreFromCacheSuccess;
             };
+            // A runner that reuses outputs that it keeps in memory, e.g. a warm worker, can skip the read.
+            const isCacheReadAllowed: boolean =
+              buildCacheContext.isCacheReadAllowed && !isBuildCacheReadSkipped(record);
             if (cobuildLock) {
               // handling rebuilds. "rush rebuild" or "rush retest" command will save operations to
               // the build cache once completed, but does not retrieve them (since the "incremental"
@@ -452,14 +572,14 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                 if (restoreFromCacheSuccess) {
                   return status;
                 }
-              } else if (!buildCacheContext.isCacheReadAttempted && buildCacheContext.isCacheReadAllowed) {
+              } else if (!buildCacheContext.isCacheReadAttempted && isCacheReadAllowed) {
                 const restoreFromCacheSuccess: boolean = await restoreCacheAsync(operationBuildCache);
 
                 if (restoreFromCacheSuccess) {
                   return OperationStatus.FromCache;
                 }
               }
-            } else if (buildCacheContext.isCacheReadAllowed) {
+            } else if (isCacheReadAllowed) {
               const restoreFromCacheSuccess: boolean = await restoreCacheAsync(operationBuildCache);
 
               if (restoreFromCacheSuccess) {
@@ -467,7 +587,11 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }
             }
 
-            if (buildCacheContext.isCacheWriteAllowed && cobuildLock) {
+            if (
+              buildCacheContext.isCacheWriteAllowed &&
+              !buildCacheContext.hasUnverifiedDependency &&
+              cobuildLock
+            ) {
               const acquireSuccess: boolean = await cobuildLock.tryAcquireLockAsync();
               if (acquireSuccess) {
                 const { periodicCallback } = buildCacheContext;
@@ -488,6 +612,34 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      // Captured in a late tap, after the taps that can skip the operation or restore it from the build cache,
+      // so that the input files of an operation that does not execute are not read.
+      graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
+        (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+          const buildCacheContext: IOperationBuildCacheContext | undefined =
+            this.#buildCacheContextByOperation.get(record.operation);
+          if (
+            !buildCacheContext ||
+            !record.enabled ||
+            !record.operation.runner?.cacheable ||
+            buildCacheContext.cacheDisabledReason
+          ) {
+            return;
+          }
+          const { inputsSnapshot, inputFileHashes, snapshotStartTimeMs } = buildCacheContext;
+          // Captured even if cache writes are disabled, since a long-lived graph (e.g. the Rush daemon) must not
+          // retain outputs that were built from input files that changed after the inputs snapshot read them.
+          buildCacheContext.inputFilesState = captureInputFilesState(
+            inputsSnapshot.rootDirectory,
+            inputFileHashes.keys(),
+            snapshotStartTimeMs
+          );
+          // The input files are checked after the operation executes, so IncrementalExecutionGuardPlugin need not.
+          markInputFilesChecked(record);
+        }
+      );
+
       graph.hooks.afterExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (runnerContext: IOperationRunnerContext): Promise<void> => {
@@ -517,8 +669,23 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             return;
           }
 
-          const { cobuildLock, operationBuildCache, isCacheWriteAllowed, buildCacheTerminal, cacheRestored } =
-            buildCacheContext;
+          const ranIncrementalCommand: boolean =
+            !buildCacheContext.cacheRestored && wasExecutedIncrementally(record);
+          if (ranIncrementalCommand) {
+            buildCacheContext.isIncrementalResult = true;
+          }
+
+          const {
+            cobuildLock,
+            operationBuildCache,
+            isCacheWriteAllowed: isCacheWriteAllowedForOperation,
+            isIncrementalResult,
+            hasUnverifiedDependency,
+            buildCacheTerminal,
+            cacheRestored
+          } = buildCacheContext;
+          const isCacheWriteAllowed: boolean =
+            isCacheWriteAllowedForOperation && !isIncrementalResult && !hasUnverifiedDependency;
 
           try {
             if (!cacheRestored) {
@@ -548,6 +715,12 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               throw new InternalError(`Build Cache Terminal is not created`);
             }
 
+            if (ranIncrementalCommand && isCacheWriteAllowedForOperation) {
+              buildCacheTerminal.writeLine(
+                'This operation ran its incremental command; not writing a build cache entry.'
+              );
+            }
+
             let setCompletedStatePromiseFunction: (() => Promise<void> | undefined) | undefined;
             let setCacheEntryPromise: (() => Promise<boolean> | undefined) | undefined;
             if (cobuildLock && isCacheWriteAllowed) {
@@ -585,30 +758,51 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             // If the command is successful, we can calculate project hash, and no dependencies were skipped,
             // write a new cache entry.
             if (!setCacheEntryPromise && taskIsSuccessful && isCacheWriteAllowed && operationBuildCache) {
-              setCacheEntryPromise = () => operationBuildCache.trySetCacheEntryAsync(buildCacheTerminal);
+              setCacheEntryPromise = () =>
+                operationBuildCache.trySetCacheEntryAsync(
+                  buildCacheTerminal,
+                  undefined,
+                  deferredCacheEntryWrites
+                );
             }
-            const { inputFilesState } = buildCacheContext;
-            if (
-              !cacheRestored &&
-              isCacheWriteAllowed &&
-              inputFilesState &&
-              haveInputFilesChanged(inputFilesState, (newEntryPaths: ReadonlyArray<string>) =>
-                this.#isNewInput(
-                  newEntryPaths,
-                  inputFilesState.rootDirectory,
-                  project.projectFolder,
-                  buildCacheContext.outputFolderNames
-                )
-              )
-            ) {
+            const { inputFilesState, inputFileHashes, inputsSnapshot } = buildCacheContext;
+            let inputFilesChangedMessage: string | undefined;
+            if (!cacheRestored && inputFilesState) {
+              const { outputFolderNames } = buildCacheContext;
+              const inputFilesChangeKind: InputFilesChangeKind =
+                await getInputFilesChangeKindSinceSnapshotAsync({
+                  inputFilesState,
+                  snapshotHashes: inputFileHashes,
+                  getGitPath: () => this.#getGitPath(),
+                  isNewInput: (newEntryPaths: ReadonlyArray<string>) =>
+                    this.#isNewInput(
+                      newEntryPaths,
+                      inputFilesState.rootDirectory,
+                      project.projectFolder,
+                      outputFolderNames,
+                      inputsSnapshot.hashes
+                    )
+                });
+              if (inputFilesChangeKind === 'file-state') {
+                inputFilesChangedMessage =
+                  'Input files changed after the inputs snapshot was taken; not writing a build cache entry.';
+              } else if (inputFilesChangeKind === 'snapshot-hashes') {
+                inputFilesChangedMessage =
+                  'Input files changed after Git hashed them for the inputs snapshot; not writing a build cache entry.';
+              }
+            }
+            if (inputFilesChangedMessage) {
               // The cache key was derived from the iteration's inputs snapshot. Storing outputs produced from
               // edited inputs under that key would poison the cache for every consumer of the entry.
               // Consumers' cache keys also embed this operation's pre-edit state, so block their writes too.
-              buildCacheTerminal.writeLine(
-                'Input files changed while this operation was executing; not writing a build cache entry.'
-              );
+              if (isCacheWriteAllowed) {
+                buildCacheTerminal.writeLine(inputFilesChangedMessage);
+              }
               buildCacheContext.isCacheWriteAllowed = false;
               setCacheEntryPromise = undefined;
+              // For the same reason, a long-lived graph must not skip this operation, or the consumers built against
+              // its outputs, while the state hash is unchanged, whether or not cache writes are enabled.
+              markResultUnverifiable(record);
             }
             if (!cacheRestored) {
               const cacheWriteSuccess: boolean | undefined = await setCacheEntryPromise?.();
@@ -633,45 +827,90 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             this.#buildCacheContextByOperation.get(operation);
           // Status changes to direct dependents
           let blockCacheWrite: boolean = !buildCacheContext?.isCacheWriteAllowed;
+          // Whether the outputs that consumers execute against are an incremental result
+          let isIncrementalResult: boolean = false;
+          // Whether consumers execute against outputs that this iteration did not verify
+          let hasUnverifiedOutputs: boolean = !!buildCacheContext?.hasUnverifiedDependency;
 
           switch (record.status) {
             case OperationStatus.Skipped: {
               // Skipping generally means we cannot guarantee integrity, so prevent cache writes in dependents.
-              // The exception is an operation that was not re-run because a previous iteration of this graph
+              // The exceptions are an operation that was not re-run because a previous iteration of this graph
               // produced a trusted result at exactly the same state hash (e.g. a result retained by a
-              // long-lived graph such as the Rush daemon). Since the state hash of an operation covers the
-              // state hashes of all of its dependencies, a consumer's cache key fully describes this input.
-              if (
+              // long-lived graph such as the Rush daemon), and an operation that a plugin skipped because it
+              // verified that the outputs are those of the build cache entry at exactly this state hash (see
+              // markSkipVerified). Since the state hash of an operation covers the state hashes of all of its
+              // dependencies, a consumer's cache key fully describes this input.
+              if (!blockCacheWrite && getVerifiedSkipStateHash(record) === record.getStateHash()) {
+                // Trusted as if the outputs were restored from that build cache entry.
+                trustedStateHashByOperation.set(operation, record.getStateHash());
+                incrementalStateHashByOperation.delete(operation);
+                setTrustedStateHash(record, record.getStateHash());
+              } else if (
                 blockCacheWrite ||
-                record.operation.enabled === false ||
                 trustedStateHashByOperation.get(operation) !== record.getStateHash()
               ) {
                 blockCacheWrite = true;
                 trustedStateHashByOperation.delete(operation);
+                incrementalStateHashByOperation.delete(operation);
+              } else {
+                isIncrementalResult =
+                  incrementalStateHashByOperation.get(operation) === record.getStateHash();
+                // Output files are not part of the state hash, and only the outputs of selected operations are
+                // checked (e.g. by the Rush daemon), so those of an operation that this iteration did not select
+                // may have been edited in place since. As in a run that does not select it, its consumers do not
+                // write to the build cache, but it keeps its trust for later iterations that select it.
+                if (operation.enabled === false && !operation.isNoOp) {
+                  hasUnverifiedOutputs = true;
+                }
               }
               break;
             }
 
             default: {
+              // Outputs restored from the build cache are those of the initial command.
+              isIncrementalResult =
+                record.status !== OperationStatus.FromCache &&
+                (!!buildCacheContext?.isIncrementalResult || wasExecutedIncrementally(record));
+              if (hasUnverifiedOutputs && record.status !== OperationStatus.FromCache && !operation.isNoOp) {
+                // The outputs of this operation may embed unverified outputs of its dependencies.
+                blockCacheWrite = true;
+              }
               if (!blockCacheWrite && buildCacheContext && SUCCESS_STATUSES.has(record.status)) {
                 // The outputs of this operation were produced (or restored) in an iteration where cache
                 // writes were allowed, so they can be trusted by consumers in later iterations as long as
-                // the state hash is unchanged.
+                // the state hash is unchanged. An incremental result is trusted too, but it still blocks the
+                // cache writes of consumers.
                 trustedStateHashByOperation.set(operation, record.getStateHash());
+                if (isIncrementalResult) {
+                  incrementalStateHashByOperation.set(operation, record.getStateHash());
+                } else {
+                  incrementalStateHashByOperation.delete(operation);
+                  setTrustedStateHash(record, record.getStateHash());
+                }
               } else {
                 trustedStateHashByOperation.delete(operation);
+                incrementalStateHashByOperation.delete(operation);
               }
               break;
             }
           }
 
           // Apply status changes to direct dependents
-          if (blockCacheWrite) {
+          if (blockCacheWrite || isIncrementalResult || hasUnverifiedOutputs) {
             for (const consumer of operation.consumers) {
               const consumerBuildCacheContext: IOperationBuildCacheContext | undefined =
                 this.#getBuildCacheContextByOperation(consumer);
               if (consumerBuildCacheContext) {
-                consumerBuildCacheContext.isCacheWriteAllowed = false;
+                if (blockCacheWrite) {
+                  consumerBuildCacheContext.isCacheWriteAllowed = false;
+                }
+                if (isIncrementalResult) {
+                  consumerBuildCacheContext.isIncrementalResult = true;
+                }
+                if (hasUnverifiedOutputs) {
+                  consumerBuildCacheContext.hasUnverifiedDependency = true;
+                }
               }
             }
           }
@@ -682,6 +921,32 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         this.#buildCacheContextByOperation.clear();
         return status;
       });
+
+      if (deferredCacheEntryWrites) {
+        graph.hooks.afterExecuteRequestAsync.tap(
+          PLUGIN_NAME,
+          ({ terminal }: IOperationGraphRequestResult): void => {
+            const report: IDeferredCacheEntryWritesReport = deferredCacheEntryWrites.takeReport();
+            const { queuedCount, writtenCount, writtenByteCount, failedCount, droppedCount, pendingCount } =
+              report;
+            if (queuedCount || writtenCount || failedCount || droppedCount || pendingCount) {
+              // An entry is dropped only if an output file changed before it was sealed, or if the daemon stopped.
+              const dropped: string = droppedCount ? `, ${droppedCount} dropped` : '';
+              const line: string =
+                `Build cache entries written in the background since the previous command: ` +
+                `${queuedCount} queued, ${writtenCount} written (${formatMegabytes(writtenByteCount)}), ` +
+                `${failedCount} failed${dropped}; ${pendingCount} pending.`;
+              if (failedCount) {
+                // A failed write before the operation completes is a warning too. Output that shows only a
+                // summary, such as the daemon client's agent output, still shows warnings.
+                terminal.writeWarningLine(line);
+              } else {
+                terminal.writeLine(line);
+              }
+            }
+          }
+        );
+      }
     });
   }
 
@@ -936,3 +1201,62 @@ export function clusterOperations(
     }
   }
 }
+
+/**
+ * Reads the parts of the build cache context of an operation that depend on the inputs snapshot.
+ */
+function readCacheInputs(
+  operation: Operation,
+  inputsSnapshot: IInputsSnapshot,
+  snapshotStartTimeMs: number,
+  projectConfiguration: RushProjectConfiguration | undefined
+): Pick<
+  IOperationBuildCacheContext,
+  'getCacheDisabledReason' | 'inputsSnapshot' | 'snapshotStartTimeMs' | 'inputFileHashes'
+> {
+  const { name: phaseName } = operation.associatedPhase;
+
+  // This value can *currently* be cached per-project, but in the future the list of files will vary
+  // depending on the selected phase.
+  const fileHashes: ReadonlyMap<string, string> = inputsSnapshot.getTrackedFileHashesForOperation(
+    operation.associatedProject,
+    phaseName
+  );
+
+  // Computing the reason checks each tracked file of the project, and an iteration of a long-lived graph
+  // (e.g. the Rush daemon) holds every operation of the workspace. It is only read for the operations
+  // that execute and for cobuild clustering, so it is computed once, when it is first read.
+  let cacheDisabledReason: string | undefined;
+  let isCacheDisabledReasonComputed: boolean = false;
+  const getCacheDisabledReason = (): string | undefined => {
+    if (!isCacheDisabledReasonComputed) {
+      cacheDisabledReason = getCacheDisabledReasonForOperation(
+        projectConfiguration,
+        fileHashes,
+        phaseName,
+        operation.isNoOp
+      );
+      isCacheDisabledReasonComputed = true;
+    }
+    return cacheDisabledReason;
+  };
+
+  return {
+    getCacheDisabledReason,
+    inputsSnapshot,
+    snapshotStartTimeMs,
+    inputFileHashes: fileHashes
+  };
+}
+
+function getCacheDisabledReasonForOperation(
+  projectConfiguration: RushProjectConfiguration | undefined,
+  fileHashes: ReadonlyMap<string, string>,
+  phaseName: string,
+  isNoOp: boolean
+): string | undefined {
+  return projectConfiguration
+    ? projectConfiguration.getCacheDisabledReason(fileHashes.keys(), phaseName, isNoOp)
+    : `Project does not have a ${RushConstants.rushProjectConfigFilename} configuration file, ` +
+        'or one provided by a rig, so it does not support caching.';
+}
diff --git a/libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts b/libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts
new file mode 100644
index 00000000000..0af5e0f7f6f
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts
@@ -0,0 +1,127 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  ICreateOperationsContext,
+  IOperationGraphContext,
+  IPhasedCommandPlugin,
+  PhasedCommandHooks
+} from '../../pluginFramework/PhasedCommandHooks';
+import type { IOperationGraph } from './IOperationGraph';
+import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IOperationRunnerContext } from './IOperationRunner';
+import type { Operation } from './Operation';
+import type { OperationStatus } from './OperationStatus';
+import {
+  PLUGIN_NAME as ShellOperationPluginName,
+  formatCommand,
+  getCustomParameterValuesByOperation,
+  getDisplayName,
+  type ICustomParameterValuesForOperation
+} from './ShellOperationRunnerPlugin';
+import { WarmWorkerOperationRunner } from './WarmWorkerOperationRunner';
+
+const PLUGIN_NAME: 'DaemonWarmWorkerPlugin' = 'DaemonWarmWorkerPlugin';
+
+// Before the default stage, so that a worker that must not be reused is closed before CacheableOperationPlugin
+// restores the operation's outputs, and before the Rush daemon notes which runners were active.
+const PREPARE_STAGE: number = -1;
+
+/**
+ * Runs the operations whose settings set `allowDaemonWarmWorker` and whose projects define a
+ * `<phase>:incremental:ipc` script in warm workers, see `WarmWorkerOperationRunner`. For the non-watch commands of
+ * the Rush daemon, with `IncrementalExecutionGuardPlugin`, which decides whether a worker may build on top of the
+ * outputs of its last run.
+ *
+ * @remarks
+ * The script alone is not enough, because `rush start` runs the same script in watch mode, where a project may
+ * intend to skip tasks such as lint. Operations that already have a runner, e.g. one for an explicit IPC tool, and
+ * operations with a shell command or shards are not changed.
+ */
+export class DaemonWarmWorkerPlugin implements IPhasedCommandPlugin {
+  public apply(hooks: PhasedCommandHooks): void {
+    hooks.createOperationsAsync.tap(
+      {
+        name: PLUGIN_NAME,
+        before: ShellOperationPluginName
+      },
+      (operations: Set<Operation>, context: ICreateOperationsContext): Set<Operation> => {
+        const { isWatch, isIncrementalBuildAllowed } = context;
+        if (isWatch || !isIncrementalBuildAllowed) {
+          return operations;
+        }
+
+        const getCustomParameterValues: (operation: Operation) => ICustomParameterValuesForOperation =
+          getCustomParameterValuesByOperation();
+
+        for (const operation of operations) {
+          const { associatedPhase: phase, associatedProject: project, runner, settings } = operation;
+          if (
+            runner ||
+            phase.shellCommand !== undefined ||
+            settings?.sharding ||
+            settings?.allowDaemonWarmWorker !== true
+          ) {
+            continue;
+          }
+
+          const { scripts } = project.packageJson;
+          const { name: phaseName } = phase;
+          const initialScript: string | undefined = scripts?.[phaseName];
+          const incrementalIpcScript: string | undefined = scripts?.[`${phaseName}:incremental:ipc`];
+          if (!initialScript || !incrementalIpcScript) {
+            continue;
+          }
+          const initialIpcScript: string | undefined = scripts?.[`${phaseName}:ipc`];
+
+          const { parameterValues: customParameterValues, ignoredParameterValues } =
+            getCustomParameterValues(operation);
+          const initialCommand: string = formatCommand(initialScript, customParameterValues);
+          operation.runner = new WarmWorkerOperationRunner({
+            phase,
+            rushProject: project,
+            displayName: getDisplayName(phase, project),
+            initialCommand,
+            initialIpcCommand: initialIpcScript
+              ? formatCommand(initialIpcScript, customParameterValues)
+              : undefined,
+            incrementalIpcCommand: formatCommand(incrementalIpcScript, customParameterValues),
+            // As for ShellOperationRunner, so that the build cache entries do not depend on warm workers.
+            commandForHash: initialCommand,
+            ignoredParameterValues
+          });
+        }
+
+        return operations;
+      }
+    );
+
+    hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph: IOperationGraph, context: IOperationGraphContext) => {
+      if (context.isWatch || !context.isIncrementalBuildAllowed) {
+        return;
+      }
+      graph.hooks.beforeExecuteOperationAsync.tapPromise(
+        { name: PLUGIN_NAME, stage: PREPARE_STAGE },
+        async (
+          record: IOperationRunnerContext & IOperationExecutionResult
+        ): Promise<OperationStatus | undefined> => {
+          const { operation } = record;
+          const { runner } = operation;
+          if (record.enabled && runner instanceof WarmWorkerOperationRunner) {
+            await runner.prepareAsync(record, graph.resultByOperation.has(operation));
+          }
+          return undefined;
+        }
+      );
+      graph.hooks.afterExecuteOperationAsync.tapPromise(
+        PLUGIN_NAME,
+        async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+          const { runner } = record.operation;
+          if (runner instanceof WarmWorkerOperationRunner) {
+            await runner.writeUnusedNotesAsync(record);
+          }
+        }
+      );
+    });
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index e6b4316fbe1..85d73919c4a 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -1,10 +1,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { TerminalWritable } from '@rushstack/terminal';
+import type { ITerminal, TerminalWritable } from '@rushstack/terminal';
 
 import type { Operation } from './Operation';
-import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { Parallelism } from './ParseParallelism';
 import type { OperationStatus } from './OperationStatus';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
@@ -21,6 +21,167 @@ export interface IOperationGraphIterationOptions {
    * The time when the iteration was scheduled, if available, as returned by `performance.now()`.
    */
   startTime?: number;
+
+  /**
+   * Returns the environment that an operation of this iteration starts from, before any
+   * `createEnvironmentForOperation` tap. The operation's `dependsOnEnvVars` are hashed from the same environment.
+   * When omitted, every operation starts from `process.env` and hashes the environment of the inputs snapshot.
+   *
+   * @remarks
+   * A long-lived host serves requests from clients whose environments differ from its own, and one iteration can
+   * serve several requests. The host gives each operation the environment of a request that selected it
+   * (see `getWorkspaceRequestOperationEnvironment`).
+   */
+  getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
+
+  /**
+   * False to run every enabled operation of this iteration as a fresh process of a non-incremental command such as
+   * `rush rebuild` would: without skipping unchanged operations, without reading the build cache, and without
+   * passing the last result to the runner (so no runner uses its incremental command). Cache writes are unaffected.
+   * When omitted or true, the graph's own setting (`ICreateOperationsContext.isIncrementalBuildAllowed`) applies.
+   *
+   * @remarks
+   * A long-lived graph created by an incremental command serves a non-incremental request this way. The results
+   * of operations that the iteration does not enable are kept.
+   */
+  isIncrementalBuildAllowed?: boolean;
+
+  /**
+   * Returns the identifier of the request whose environment `getOperationEnvironment` returns for an operation of
+   * this iteration, or `undefined` if there is no such request. When omitted, the iteration serves no identified
+   * request.
+   *
+   * @remarks
+   * A long-lived host can serve several requests in one iteration. A plugin can use this identifier to attribute
+   * each operation to the request that selected it, for example to join per-operation telemetry with that
+   * request's own telemetry entry.
+   */
+  getOperationRequestId?: (operation: Operation) => string | undefined;
+
+  /**
+   * If true, the iteration does not dispatch the operations that none of its enabled operations needs (an operation
+   * that is not enabled, and on which no enabled operation depends, directly or indirectly) until every other
+   * operation has completed. Until then, {@link IOperationGraph.tryExtendCurrentIteration} can still enable them for
+   * a request that joins the iteration.
+   */
+  holdUnneededOperations?: boolean;
+
+  /**
+   * Set only when hooks configure or prepare the operations of an iteration that is already executing, because a
+   * request joined it (see {@link IOperationGraph.tryExtendCurrentIteration}). These operations have already been
+   * dispatched in the iteration: the graph ignores changes to their configuration, and a plugin should not act on
+   * them again.
+   *
+   * @remarks
+   * The graph can still refuse the plan of a `configureIteration` call with this set, after the call returns. A
+   * plugin that keeps state across iterations applies the effects of such a plan in `extendIteration`, which the graph
+   * calls only for a plan that it accepts, with the same options object.
+   */
+  startedOperations?: ReadonlySet<Operation>;
+}
+
+/**
+ * Options for {@link IOperationGraph.tryExtendCurrentIteration}.
+ * @alpha
+ */
+export interface IOperationGraphExtensionOptions {
+  /**
+   * A snapshot of the inputs that was taken after the joining request was received.
+   */
+  readonly inputsSnapshot: IInputsSnapshot;
+
+  /**
+   * The operations that the joining request needs. The operations that they depend on are needed as well. The caller
+   * enables them (see {@link IOperationGraph.setEnabledStates}) before extending the iteration.
+   */
+  readonly neededOperations: Iterable<Operation>;
+
+  /**
+   * Operations whose last results can no longer be used, for example because their outputs changed.
+   */
+  readonly invalidatedOperations?: Iterable<Operation>;
+
+  /**
+   * The reason for invalidating `invalidatedOperations`.
+   */
+  readonly invalidationReason?: string;
+
+  /**
+   * Called once the graph will extend the iteration, before it changes the iteration or dispatches any operation, so
+   * that the joining request starts only if its work is added. If it throws, the iteration is not extended, the graph
+   * is left unchanged, and the error propagates.
+   */
+  readonly beforeCommit?: () => void;
+}
+
+/**
+ * The outcome of {@link IOperationGraph.tryExtendCurrentIteration}.
+ * @alpha
+ */
+export interface IOperationGraphExtensionResult {
+  /**
+   * Whether the iteration was extended.
+   */
+  readonly extended: boolean;
+
+  /**
+   * Why the iteration was not extended, if it was not.
+   */
+  readonly reason?: string;
+
+  /**
+   * The operations whose `enabled` state, runner policy or state hash the extension changed. Empty if the iteration
+   * was not extended.
+   */
+  readonly changedOperations: ReadonlySet<Operation>;
+}
+
+/**
+ * The results of one request for an operation graph's work, passed to
+ * {@link OperationGraphHooks.afterExecuteRequestAsync}.
+ *
+ * @remarks
+ * A native command makes one request for each iteration, so its request has the iteration's results. A long-lived
+ * host such as the Rush daemon can serve several requests with one iteration, and it serves a request whose
+ * operations are all up to date without any iteration. Each of those requests has only its own results.
+ *
+ * @alpha
+ */
+export interface IOperationGraphRequestResult extends IExecutionResult {
+  /**
+   * The results of the operations that the request selected. An operation that was already up to date, so that
+   * the request did not need to run it, has the `Skipped` status, a zero-length stopwatch and no problems.
+   * A request that returned before its iteration finished omits the operations that had not finished.
+   * The map can include silent operations; check `silent` before reporting an operation.
+   */
+  readonly operationResults: ReadonlyMap<Operation, IOperationExecutionResult>;
+
+  /**
+   * The request's overall status, as its caller reports it.
+   */
+  readonly status: OperationStatus;
+
+  /**
+   * The name of the Rush command that made the request, for example `build`.
+   */
+  readonly commandName: string;
+
+  /**
+   * The environment of the request's caller. For a native command, this is `process.env`. A long-lived host passes
+   * the environment of the client that sent the request, which can differ from the host's own `process.env`.
+   */
+  readonly environment: Readonly<Record<string, string | undefined>>;
+
+  /**
+   * The id that a long-lived host gave the request, or `undefined` for a native command.
+   */
+  readonly requestId: string | undefined;
+
+  /**
+   * Writes to the output of the request's caller. A long-lived host shows this output only to the client that sent
+   * the request.
+   */
+  readonly terminal: ITerminal;
 }
 
 /**
@@ -42,7 +203,9 @@ export interface IOperationGraph {
    * A map from each `Operation` in the graph to its current result record.
    * The map is updated in real time as operations execute during an iteration.
    * Only statuses representing a completed execution (e.g. `Success`, `Failure`,
-   * `SuccessWithWarning`) write to this map; statuses such as `Skipped` or `Aborted` —
+   * `SuccessWithWarning`) write to this map, as does `Skipped` for an operation that was
+   * selected to execute and whose outputs a plugin (e.g. change detection) found up to date.
+   * Statuses such as `Aborted`, or `Skipped` for an operation that was not selected —
    * which indicate that an operation did not actually run — do not update it.
    * For operations that have not yet run in the current iteration, the map retains the
    * result from whichever prior iteration the operation last ran in.
@@ -152,6 +315,40 @@ export interface IOperationGraph {
    */
   executeScheduledIterationAsync(): Promise<boolean>;
 
+  /**
+   * Keeps the executing iteration from dispatching the operations that it holds (see
+   * {@link IOperationGraphIterationOptions.holdUnneededOperations}) until the returned function is called, so that a
+   * request can still join the iteration while the inputs are read for it. Aborting the iteration dispatches them
+   * regardless.
+   * @returns A function that ends the retention, or undefined if no iteration is executing with held operations.
+   */
+  retainHeldOperations?(): (() => void) | undefined;
+
+  /**
+   * Adds the work of a request that arrives while an iteration is executing to that iteration, instead of to a later
+   * one. The iteration must hold its unneeded operations (see
+   * {@link IOperationGraphIterationOptions.holdUnneededOperations}).
+   *
+   * @remarks
+   * The caller first enables the operations of all requests that the iteration serves, including the joining one.
+   * The graph then calculates the state hashes of the operations that were not dispatched yet from the newer inputs
+   * snapshot, and plans the iteration again with `configureIteration`. That call receives every operation of the
+   * iteration, and its `startedOperations` names those that were already dispatched. The new plan can only enable
+   * operations that were not dispatched yet: an operation that the iteration already enabled or dispatched keeps its
+   * `enabled` state, its state hash and its configuration.
+   *
+   * The iteration is not extended if it was aborted, is not incremental or has no inputs snapshot, if an operation
+   * that the caller invalidates already ran in it, or if the joining request needs an operation that was dispatched
+   * before its inputs or outputs last changed. Nor is it extended if the new plan enables an operation that the
+   * joining request needs and that was dispatched without running; the graph finds this only after the
+   * `configureIteration` taps ran, and it discards their plan. When the iteration is not extended, the graph is left
+   * unchanged, and the caller restores the enabled states.
+   *
+   * Otherwise, the graph calls {@link IOperationGraphExtensionOptions.beforeCommit}, the operations that changed are
+   * passed to `extendIteration`, and the joining request's operations are dispatched before the others.
+   */
+  tryExtendCurrentIteration?(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult;
+
   /**
    * Invalidates the specified operations, causing them to be re-executed.
    * @param operations - The operations to invalidate, or undefined to invalidate all operations.
diff --git a/libraries/rush-lib/src/logic/operations/IOperationRunner.ts b/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
index f422083d85e..b880671778f 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
@@ -9,6 +9,7 @@ import type { OperationMetadataManager } from './OperationMetadataManager';
 import type { IStopwatchResult } from '../../utilities/Stopwatch';
 import type { IEnvironment } from '../../utilities/Utilities';
 import type { IOperationChildProcessReporter } from './OperationEventSink';
+import type { IIncrementalExecutionGuard, IOperationCommandExecution } from './IncrementalExecutionState';
 
 /**
  * A snapshot of a previous operation execution, passed to runners to inform incremental behavior.
@@ -90,6 +91,38 @@ export interface IOperationRunnerContext {
    */
   getInvalidateCallback(): (reason: string) => void;
 
+  /**
+   * Returns the guard that decides whether this operation may run its incremental command outside watch mode, or
+   * `undefined` if nothing guards incremental commands in this process, for example outside the Rush daemon.
+   *
+   * @remarks
+   * It is optional because older versions of Rush do not have it. A runner that has an incremental command and runs
+   * outside watch mode follows the same steps as Rush's own shell command runner:
+   *
+   * 1. If it has no last state, or there is no guard, it runs its initial command.
+   *
+   * 2. If `getBlockReasonAsync()` returns a reason, it writes
+   * `Not using the incremental command because <reason>.` and runs its initial command.
+   *
+   * 3. Otherwise it runs its incremental command. If that succeeds and `verifyIncrementalResultAsync()` returns a
+   * reason, it writes `Running the initial command, because <reason>.` and runs its initial command.
+   *
+   * If either method rejects, the runner treats the error like a reason. Before it starts each command, the runner
+   * calls {@link IOperationRunnerContext.reportCommandExecution}. The guard never allows the incremental command of an
+   * operation whose runner did not report the command of its last successful run.
+   */
+  getIncrementalExecutionGuard?(): IIncrementalExecutionGuard | undefined;
+
+  /**
+   * Records which command the runner is about to execute for this operation. Call it before starting each command,
+   * so that the outputs of a command that fails or is aborted are attributed to it too.
+   *
+   * @remarks
+   * It is optional because older versions of Rush do not have it. The outputs of an incremental command, and of
+   * operations built against them, are never written to the build cache.
+   */
+  reportCommandExecution?(execution: IOperationCommandExecution): void;
+
   /**
    * Allocates a negotiated reporter channel for a child process, when enabled.
    *
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
new file mode 100644
index 00000000000..78939acc3b9
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -0,0 +1,816 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, type Hash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { FileSystem, InternalError, Path } from '@rushstack/node-core-library';
+
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import type {
+  IOperationGraphContext,
+  IPhasedCommandPlugin,
+  PhasedCommandHooks
+} from '../../pluginFramework/PhasedCommandHooks';
+import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
+import type { IOperationRunnerContext } from './IOperationRunner';
+import type { Operation } from './Operation';
+import { OperationStatus } from './OperationStatus';
+import {
+  getCommandExecution,
+  INPUTS_CHANGED_INVALIDATION_REASON,
+  NATIVE_COMMAND_INVALIDATION_REASON,
+  clearIncrementalExecutionGuard,
+  setIncrementalExecutionGuard,
+  setWatchedCommandCallback,
+  type ICommandExecution,
+  type IIncrementalExecutionGuard,
+  type IIncrementalExecutionGuardOptions
+} from './IncrementalExecutionState';
+import {
+  describeOutputFileChanges,
+  hasContentHashedOutputChange,
+  readOperationOutputManifestAsync,
+  type IOperationOutputManifest
+} from './OperationOutputManifest';
+import { captureInputFilesState, type IInputFilesState } from './InputFilesStatSignature';
+import {
+  createGitPathGetter,
+  getSnapshotStartTimeMs,
+  haveOperationInputFilesChangedAsync
+} from './OperationInputFilesCheck';
+import {
+  areInputFilesChecked,
+  CAPTURE_INPUT_FILES_STAGE,
+  isResultUnverifiable,
+  markResultUnverifiable
+} from './RetainedResultVerification';
+
+const PLUGIN_NAME: 'IncrementalExecutionGuardPlugin' = 'IncrementalExecutionGuardPlugin';
+
+// Runs after the default-stage taps, e.g. the input file checks of this plugin, CacheableOperationPlugin and
+// LegacySkipPlugin, which can mark a result as unverifiable.
+const RECORD_RESULT_STAGE: number = 1;
+// Runs after the taps of CacheableOperationPlugin and LegacySkipPlugin that capture the input files of the operations
+// whose input files they check.
+const CAPTURE_UNCHECKED_INPUT_FILES_STAGE: number = CAPTURE_INPUT_FILES_STAGE + 1;
+
+const MAX_EXAMPLE_PATHS: number = 3;
+
+// Project files that configure a build rather than being built by it.
+const CONFIG_INPUT_FILE_NAME_REGEXP: RegExp =
+  /^(?:package\.json|tsconfig[^/]*\.json|\.eslintrc[^/]*|eslint\.config\.[^/]+|\.eslintignore|\.babelrc[^/]*|babel\.config\.[^/]+|[^/]+\.config\.(?:[cm]?[jt]s|json)|\.npmrc|\.browserslistrc|\.gitignore)$/;
+const CONFIG_INPUT_FOLDER_REGEXP: RegExp = /^(?:config|\.rush)\//;
+// Dependencies that are part of the build toolchain, even when they are production dependencies.
+const TOOLING_PACKAGE_NAME_REGEXP: RegExp =
+  /(?:^|[/-])(?:eslint-(?:config|plugin)|tsconfig|prettier-config|babel-(?:preset|plugin))(?:-|$)/;
+
+/**
+ * The inputs of an operation that decide whether it may run its incremental command, as of one inputs snapshot.
+ */
+export interface IIncrementalInputState {
+  /**
+   * The path of the operation's project folder relative to the root of the inputs snapshot, with a trailing `/`,
+   * or an empty string for a project at the root.
+   */
+  readonly projectPrefix: string;
+  /**
+   * The configuration hash of the operation's runner, e.g. its command line.
+   */
+  readonly configHash: string;
+  /**
+   * The values of the environment variables that the operation depends on.
+   */
+  readonly environment: string;
+  /**
+   * The state hash of each dependency of the operation, including the dependencies that it has through operations
+   * of its own project, by operation name.
+   */
+  readonly dependencyStateHashes: ReadonlyMap<string, string>;
+  /**
+   * Covers the paths of the operation's input files.
+   */
+  readonly inputPathsDigest: string;
+  /**
+   * Covers the paths and hashes of the operation's configuration input files.
+   */
+  readonly configInputsDigest: string;
+  /**
+   * The operation's input files and their hashes, used to name changed files while the snapshot is in memory.
+   */
+  readonly inputFiles: WeakRef<ReadonlyMap<string, string>>;
+}
+
+/**
+ * Captures the inputs of an operation that decide whether it may run its incremental command.
+ *
+ * @param record - The operation's result or execution record in the iteration that uses `inputsSnapshot`
+ * @param inputsSnapshot - The inputs snapshot of the iteration
+ * @param environment - The environment that the operation runs with in the iteration
+ * @param records - The results or execution records of the iteration, by operation
+ */
+export function captureIncrementalInputState(
+  record: IOperationExecutionResult,
+  inputsSnapshot: IInputsSnapshot,
+  environment: Readonly<Record<string, string | undefined>>,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>
+): IIncrementalInputState {
+  const { operation } = record;
+  const { associatedProject: project, associatedPhase: phase, settings } = operation;
+  const { config } = record.getStateHashComponents();
+
+  const inputFiles: ReadonlyMap<string, string> = inputsSnapshot.getTrackedFileHashesForOperation(
+    project,
+    phase.name
+  );
+  const projectPrefix: string = getProjectPrefix(inputsSnapshot, project);
+  const inputPathsHash: Hash = createHash('sha1');
+  const configInputsHash: Hash = createHash('sha1');
+  for (const filePath of Array.from(inputFiles.keys()).sort()) {
+    inputPathsHash.update(`${filePath}\n`);
+    if (isConfigInput(filePath, projectPrefix)) {
+      configInputsHash.update(`${filePath}\0${inputFiles.get(filePath)}\n`);
+    }
+  }
+
+  const dependencyStateHashes: Map<string, string> = new Map();
+  for (const [name, dependency] of getGuardedDependencies(operation)) {
+    const dependencyRecord: IOperationExecutionResult | undefined = records.get(dependency);
+    if (!dependencyRecord) {
+      throw new InternalError(`The iteration has no record of the operation "${name}".`);
+    }
+    dependencyStateHashes.set(name, dependencyRecord.getStateHash());
+  }
+
+  return {
+    projectPrefix,
+    configHash: config,
+    environment: (settings?.dependsOnEnvVars ?? [])
+      .map((name: string) => `${name}=${environment[name] || ''}`)
+      .join('\n'),
+    dependencyStateHashes,
+    inputPathsDigest: inputPathsHash.digest('hex'),
+    configInputsDigest: configInputsHash.digest('hex'),
+    inputFiles: new WeakRef(inputFiles)
+  };
+}
+
+/**
+ * Returns why an operation must not run its incremental command on top of the outputs of its last successful run,
+ * judging by how its inputs changed since that run, or `undefined` if the inputs allow it.
+ *
+ * @remarks
+ * The incremental command is only trusted to handle edits of the files that the operation builds. It may keep the
+ * outputs of deleted or renamed files, and it may not notice a change to the configuration or the tools of the
+ * build. The inputs therefore only allow it if these are unchanged:
+ *
+ * - the operation's command line and the environment variables that it depends on;
+ * - the set of its input files, so that no file was added, deleted or renamed;
+ * - its configuration input files: any file outside of the project folder (e.g. the shrinkwrap file or a global
+ *   additional file), any file in the project's root folder, `config/` or `.rush/` folders, and configuration files
+ *   such as `tsconfig*.json`, `.eslintrc*` or `*.config.js` anywhere in the project;
+ * - the set of its dependencies, and each dependency that belongs to another project and is not a production
+ *   dependency (`dependencies`, `optionalDependencies` or `peerDependencies` in package.json), or that is a build
+ *   tool such as a rig, a Heft plugin or a lint configuration. This includes the dependencies that the operation has
+ *   through operations of its own project, e.g. through a phase without a script that only orders its build after
+ *   the builds of other projects.
+ *
+ * @param operation - The operation
+ * @param lastState - The inputs of the operation's last successful run
+ * @param currentState - The inputs of the run that is about to start
+ */
+export function getIncrementalInputChangeReason(
+  operation: Operation,
+  lastState: IIncrementalInputState,
+  currentState: IIncrementalInputState
+): string | undefined {
+  if (lastState.configHash !== currentState.configHash) {
+    return 'its command line changed';
+  }
+  if (lastState.environment !== currentState.environment) {
+    return 'an environment variable that it depends on changed';
+  }
+  if (lastState.inputPathsDigest !== currentState.inputPathsDigest) {
+    return `input files were added, deleted or renamed${describeInputFileChanges(
+      lastState,
+      currentState,
+      (lastHash: string | undefined, currentHash: string | undefined) =>
+        (lastHash === undefined) !== (currentHash === undefined)
+    )}`;
+  }
+  if (lastState.configInputsDigest !== currentState.configInputsDigest) {
+    return `a configuration file changed${describeInputFileChanges(
+      lastState,
+      currentState,
+      (lastHash: string | undefined, currentHash: string | undefined, filePath: string) =>
+        lastHash !== currentHash && isConfigInput(filePath, currentState.projectPrefix)
+    )}`;
+  }
+
+  const { dependencyStateHashes: lastDependencies } = lastState;
+  const { dependencyStateHashes: currentDependencies } = currentState;
+  if (lastDependencies.size !== currentDependencies.size) {
+    return 'its dependencies changed';
+  }
+  const dependencyByName: ReadonlyMap<string, Operation> = getGuardedDependencies(operation);
+  for (const [name, stateHash] of currentDependencies) {
+    const lastStateHash: string | undefined = lastDependencies.get(name);
+    const dependency: Operation | undefined = dependencyByName.get(name);
+    if (lastStateHash === undefined || !dependency) {
+      return 'its dependencies changed';
+    }
+    if (lastStateHash !== stateHash) {
+      const reason: string | undefined = getToolingDependencyReason(operation, dependency);
+      if (reason) {
+        return reason;
+      }
+    }
+  }
+
+  return undefined;
+}
+
+/**
+ * Lets operations of a long-lived host, such as the Rush daemon, run their `:incremental` command outside watch mode
+ * when doing so builds the same outputs as their initial command.
+ *
+ * @remarks
+ * An operation runs its incremental command only if all of these hold, and its initial command otherwise:
+ *
+ * 1. Its last result in this graph is a success of its own command, not a result restored from the build cache, a
+ *    failure, a success with warnings that fail the build, or a run that was interrupted or whose input files changed
+ *    while it ran. A native Rush command that ran in the workspace since then forgets every such result. The
+ *    incremental command might not report the warnings of files that it does not build again (e.g. a linter that
+ *    caches which files passed), so a build that fails for them could otherwise succeed while they are still there.
+ * 2. Its inputs changed as {@link getIncrementalInputChangeReason} allows.
+ * 3. If that run was in a process that keeps watching the input files, such as a warm worker, none of the folders
+ *    that held its input files was deleted or recreated since that run started. A watcher can miss changes in such a
+ *    folder, e.g. one that a branch switch recreated.
+ * 4. Its declared output folders hold the same files and folders as at the end of that run, and none of the folders
+ *    was recreated or had an entry added, removed or replaced since then.
+ * 5. Its outputs do not include bundles (JavaScript or CSS in a `dist` or `release` folder, or with a content hash in
+ *    the name). A bundler can replace a chunk with a differently named one and leave the old one behind. A runner
+ *    whose incremental runs keep the previous build in memory can accept bundles with `outputsMayBeBundles`.
+ *
+ * When the incremental command succeeds, the operation's output files must be the files that it had before, or the
+ * initial command runs as well. The operation then never runs its incremental command again in this graph, unless
+ * the runner passed `outputsMayBeBundles` and no content-hashed output was added or removed. Results of the
+ * incremental command are never written to the build cache (see `CacheableOperationPlugin`).
+ *
+ * The input files of an operation changed while it ran if they differ from their state right after the inputs snapshot
+ * of the iteration, e.g. because an editor saved a file. This plugin compares them after each command, unless
+ * `CacheableOperationPlugin` or `LegacySkipPlugin` does, so that such a result never becomes a base, and a long-lived
+ * graph runs the operation again instead of skipping it at that state hash, whether or not the build cache is enabled.
+ */
+export class IncrementalExecutionGuardPlugin implements IPhasedCommandPlugin {
+  public apply(hooks: PhasedCommandHooks): void {
+    hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph: IOperationGraph, context: IOperationGraphContext) => {
+      if (context.isIncrementalBuildAllowed && !context.isWatch) {
+        applyToGraph(graph);
+      }
+    });
+  }
+}
+
+interface IOutputState {
+  readonly signature: string;
+  readonly cleanOnlyReason: string | undefined;
+}
+
+interface IIncrementalBase {
+  readonly inputs: IIncrementalInputState;
+  // The identity of each folder that held an input file, if the last run was in a process that keeps watching the
+  // input files. Read before that run started, when its runner reported its command.
+  readonly inputFolders: ReadonlyMap<string, string> | undefined;
+  // Rejects if the output folders could not be read.
+  readonly outputsPromise: Promise<IOutputState>;
+}
+
+interface IRecordState {
+  readonly records: ReadonlyMap<Operation, IOperationExecutionResult>;
+  readonly inputsSnapshot: IInputsSnapshot;
+  // See getSnapshotStartTimeMs
+  readonly snapshotStartTimeMs: number;
+  readonly getOperationEnvironment: IOperationGraphIterationOptions['getOperationEnvironment'];
+  preRunOutputs?: IOperationOutputManifest;
+  verifiedOutputs?: IOutputState;
+  inputFolders?: ReadonlyMap<string, string>;
+  // Captured right before the operation executes, if this plugin checks the operation's input files.
+  inputFilesState?: IInputFilesState;
+}
+
+function applyToGraph(graph: IOperationGraph): void {
+  const baseByOperation: Map<Operation, IIncrementalBase> = new Map();
+  // Operations without a base because the last run of their own command reported warnings that fail the build.
+  const warnedOperations: Set<Operation> = new Set();
+  const forgetBase = (operation: Operation): void => {
+    baseByOperation.delete(operation);
+    warnedOperations.delete(operation);
+  };
+  const forgetAllBases = (): void => {
+    baseByOperation.clear();
+    warnedOperations.clear();
+  };
+  // Callers that pass `outputsMayBeBundles` add an entry only after their incremental command renamed a
+  // content-hashed output. An operation keeps its runner for the life of the graph.
+  const cleanOnlyReasonByOperation: Map<Operation, string> = new Map();
+  const stateByRecord: WeakMap<IOperationExecutionResult, IRecordState> = new WeakMap();
+
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    PLUGIN_NAME,
+    (
+      records: ReadonlyMap<Operation, IOperationExecutionResult>,
+      iterationOptions: IOperationGraphIterationOptions
+    ): void => {
+      const { inputsSnapshot, getOperationEnvironment } = iterationOptions;
+      if (!inputsSnapshot) {
+        // Without a snapshot the inputs of later runs cannot be compared with those of this one.
+        forgetAllBases();
+        return;
+      }
+      const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+      for (const record of records.values()) {
+        prepareRecord(record, { records, inputsSnapshot, snapshotStartTimeMs, getOperationEnvironment });
+      }
+    }
+  );
+
+  graph.hooks.extendIteration.tap(
+    PLUGIN_NAME,
+    (
+      changedRecords: ReadonlyMap<Operation, IOperationExecutionResult>,
+      iterationOptions: IOperationGraphIterationOptions
+    ): void => {
+      const { inputsSnapshot, getOperationEnvironment } = iterationOptions;
+      if (!inputsSnapshot) {
+        return;
+      }
+      const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+      for (const record of changedRecords.values()) {
+        const recordState: IRecordState | undefined = stateByRecord.get(record);
+        if (recordState) {
+          // The record was not dispatched yet, so the tap at CAPTURE_UNCHECKED_INPUT_FILES_STAGE captures its input
+          // files later, for the newer snapshot.
+          prepareRecord(record, {
+            records: recordState.records,
+            inputsSnapshot,
+            snapshotStartTimeMs,
+            getOperationEnvironment
+          });
+        }
+      }
+    }
+  );
+
+  function prepareRecord(record: IOperationExecutionResult, recordState: IRecordState): void {
+    stateByRecord.set(record, recordState);
+    const guard: IIncrementalExecutionGuard = {
+      getBlockReasonAsync: (options?: IIncrementalExecutionGuardOptions) =>
+        getBlockReasonAsync(record, recordState, options),
+      verifyIncrementalResultAsync: (options?: IIncrementalExecutionGuardOptions) =>
+        verifyIncrementalResultAsync(record, recordState, options)
+    };
+    setIncrementalExecutionGuard(record, guard);
+    setWatchedCommandCallback(record, (): void => {
+      // Read before the command starts, so that the next check notices a folder that is recreated while it runs,
+      // e.g. during the first run in a new warm worker, which no check precedes. The check reads them first if its
+      // base has them.
+      recordState.inputFolders ??= readInputFolderIdentities(record.operation, recordState.inputsSnapshot);
+    });
+  }
+
+  const getGitPath: () => string | undefined = createGitPathGetter();
+
+  // Captured in a late tap, after the taps that can skip the operation or restore it from the build cache, so that
+  // the input files of an operation that does not execute are not read.
+  graph.hooks.beforeExecuteOperationAsync.tap(
+    { name: PLUGIN_NAME, stage: CAPTURE_UNCHECKED_INPUT_FILES_STAGE },
+    (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      const { runner, associatedProject: project, associatedPhase: phase } = record.operation;
+      if (recordState && record.enabled && runner && !runner.isNoOp && !areInputFilesChecked(record)) {
+        const { inputsSnapshot, snapshotStartTimeMs } = recordState;
+        recordState.inputFilesState = captureInputFilesState(
+          inputsSnapshot.rootDirectory,
+          inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name).keys(),
+          snapshotStartTimeMs
+        );
+      }
+    }
+  );
+
+  async function getBlockReasonAsync(
+    record: IOperationExecutionResult,
+    recordState: IRecordState,
+    { outputsMayBeBundles = false }: IIncrementalExecutionGuardOptions = {}
+  ): Promise<string | undefined> {
+    const { operation } = record;
+    const cleanOnlyReason: string | undefined = cleanOnlyReasonByOperation.get(operation);
+    if (cleanOnlyReason) {
+      return cleanOnlyReason;
+    }
+    const base: IIncrementalBase | undefined = baseByOperation.get(operation);
+    if (!base) {
+      return warnedOperations.has(operation)
+        ? 'its last run reported warnings, which its incremental command might not report again'
+        : 'its outputs were not built by a successful run of its own command in this process';
+    }
+    let changedFolders: string[] | undefined;
+    if (base.inputFolders) {
+      // Read before the command starts, so that the next check notices a folder that is recreated while it runs.
+      const inputFolders: ReadonlyMap<string, string> = readInputFolderIdentities(
+        operation,
+        recordState.inputsSnapshot
+      );
+      recordState.inputFolders = inputFolders;
+      changedFolders = getChangedFolders(base.inputFolders, inputFolders);
+    }
+
+    const inputChangeReason: string | undefined = getIncrementalInputChangeReason(
+      operation,
+      base.inputs,
+      captureIncrementalInputState(
+        record,
+        recordState.inputsSnapshot,
+        getEnvironment(record, recordState),
+        recordState.records
+      )
+    );
+    if (inputChangeReason) {
+      return inputChangeReason;
+    }
+    if (changedFolders?.length) {
+      return `folders that held its input files were deleted or recreated since its last run${formatExamplePaths(
+        changedFolders
+      )}`;
+    }
+
+    const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+    if (!outputFolderNames?.length) {
+      return 'it declares no output folders';
+    }
+    let baseOutputs: IOutputState;
+    try {
+      baseOutputs = await base.outputsPromise;
+    } catch (error) {
+      return `its output folders could not be read after its last run: ${error}`;
+    }
+    if (baseOutputs.cleanOnlyReason && !outputsMayBeBundles) {
+      cleanOnlyReasonByOperation.set(operation, baseOutputs.cleanOnlyReason);
+      return baseOutputs.cleanOnlyReason;
+    }
+    const outputs: IOperationOutputManifest = await readOperationOutputManifestAsync(
+      operation.associatedProject.projectFolder,
+      outputFolderNames
+    );
+    if (outputs.signature !== baseOutputs.signature) {
+      return 'its output folders changed since its last successful run';
+    }
+    // eslint-disable-next-line require-atomic-updates -- The runner of the execution record calls the guard sequentially.
+    recordState.preRunOutputs = outputs;
+    return undefined;
+  }
+
+  async function verifyIncrementalResultAsync(
+    record: IOperationExecutionResult,
+    recordState: IRecordState,
+    { outputsMayBeBundles = false }: IIncrementalExecutionGuardOptions = {}
+  ): Promise<string | undefined> {
+    const { operation } = record;
+    const { preRunOutputs } = recordState;
+    const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+    if (!preRunOutputs || !outputFolderNames) {
+      return 'the outputs of the incremental command could not be compared with the outputs before it';
+    }
+    const outputs: IOperationOutputManifest = await readOperationOutputManifestAsync(
+      operation.associatedProject.projectFolder,
+      outputFolderNames
+    );
+    if (outputs.cleanOnlyReason && !outputsMayBeBundles) {
+      cleanOnlyReasonByOperation.set(operation, outputs.cleanOnlyReason);
+      return outputs.cleanOnlyReason;
+    }
+    const changes: string | undefined = describeOutputFileChanges(preRunOutputs.files, outputs.files);
+    if (changes) {
+      // Its outputs may be named after their content, so a later incremental run could leave stale files behind. A
+      // runner that keeps its build in memory can run again, unless a content-hashed output was renamed: a bundler
+      // renames it whenever its content changes, so the initial command would run after every incremental run.
+      if (!outputsMayBeBundles || hasContentHashedOutputChange(preRunOutputs.files, outputs.files)) {
+        cleanOnlyReasonByOperation.set(
+          operation,
+          `its incremental command changed which output files it has in an earlier run: ${changes}`
+        );
+      }
+      return `the incremental command changed which output files it has: ${changes}`;
+    }
+    // eslint-disable-next-line require-atomic-updates -- The runner of the execution record calls the guard sequentially.
+    recordState.verifiedOutputs = { signature: outputs.signature, cleanOnlyReason: undefined };
+    return undefined;
+  }
+
+  graph.hooks.afterExecuteOperationAsync.tapPromise(
+    PLUGIN_NAME,
+    async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+      const { status } = record;
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      const inputFilesState: IInputFilesState | undefined = recordState?.inputFilesState;
+      if (!recordState || !inputFilesState) {
+        return;
+      }
+      recordState.inputFilesState = undefined;
+      if (
+        (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) &&
+        !isResultUnverifiable(record) &&
+        (await haveOperationInputFilesChangedAsync(
+          record,
+          recordState.inputsSnapshot,
+          inputFilesState,
+          getGitPath
+        ))
+      ) {
+        markResultUnverifiable(record);
+      }
+    }
+  );
+
+  graph.hooks.afterExecuteOperationAsync.tapPromise(
+    { name: PLUGIN_NAME, stage: RECORD_RESULT_STAGE },
+    async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+      const { operation, status } = record;
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      stateByRecord.delete(record);
+      clearIncrementalExecutionGuard(record);
+
+      const execution: ICommandExecution | undefined = getCommandExecution(record);
+      if (!execution) {
+        switch (status) {
+          case OperationStatus.Skipped:
+          case OperationStatus.NoOp:
+          case OperationStatus.Blocked:
+          case OperationStatus.Aborted:
+            // No command ran, so the outputs are those of the last run.
+            return;
+          default:
+            // E.g. restored from the build cache, or executed by a runner that does not report its command.
+            forgetBase(operation);
+            return;
+        }
+      }
+
+      const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+      if (
+        !recordState ||
+        !execution.hasIncrementalCommand ||
+        !outputFolderNames?.length ||
+        cleanOnlyReasonByOperation.has(operation) ||
+        (status !== OperationStatus.Success && status !== OperationStatus.SuccessWithWarning) ||
+        isResultUnverifiable(record)
+      ) {
+        forgetBase(operation);
+        return;
+      }
+      if (status === OperationStatus.SuccessWithWarning && !operation.runner?.warningsAreAllowed) {
+        // A native `rush build` neither skips nor caches such a result, so its next build fails again. The initial
+        // command keeps that, because it reports the warnings again.
+        forgetBase(operation);
+        warnedOperations.add(operation);
+        return;
+      }
+      warnedOperations.delete(operation);
+
+      const { verifiedOutputs } = recordState;
+      const outputsPromise: Promise<IOutputState> = verifiedOutputs
+        ? Promise.resolve(verifiedOutputs)
+        : readOperationOutputManifestAsync(operation.associatedProject.projectFolder, outputFolderNames).then(
+            ({ signature, cleanOnlyReason }: IOperationOutputManifest) => ({ signature, cleanOnlyReason })
+          );
+      baseByOperation.set(operation, {
+        inputs: captureIncrementalInputState(
+          record,
+          recordState.inputsSnapshot,
+          getEnvironment(record, recordState),
+          recordState.records
+        ),
+        inputFolders: execution.watchesInputs ? recordState.inputFolders : undefined,
+        outputsPromise
+      });
+      // Finish reading the outputs before anything else can change them, e.g. an operation that depends on this one.
+      // A failure is reported by the next check of this operation.
+      await outputsPromise.catch(() => undefined);
+    }
+  );
+
+  graph.hooks.onInvalidateOperations.tap(
+    PLUGIN_NAME,
+    (operations: Iterable<Operation>, reason: string | undefined): void => {
+      if (reason === INPUTS_CHANGED_INVALIDATION_REASON) {
+        return;
+      }
+      if (reason === NATIVE_COMMAND_INVALIDATION_REASON) {
+        forgetAllBases();
+        return;
+      }
+      for (const operation of operations) {
+        forgetBase(operation);
+      }
+    }
+  );
+
+  graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>): void => {
+    for (const operation of operations) {
+      forgetBase(operation);
+    }
+  });
+}
+
+function getEnvironment(
+  record: IOperationExecutionResult,
+  { getOperationEnvironment }: IRecordState
+): Readonly<Record<string, string | undefined>> {
+  return getOperationEnvironment?.(record.operation) ?? process.env;
+}
+
+function getProjectPrefix(inputsSnapshot: IInputsSnapshot, project: RushConfigurationProject): string {
+  const relativePath: string = Path.convertToSlashes(
+    path.relative(inputsSnapshot.rootDirectory, project.projectFolder)
+  );
+  return relativePath === '' ? '' : `${relativePath}/`;
+}
+
+function isConfigInput(filePath: string, projectPrefix: string): boolean {
+  if (!filePath.startsWith(projectPrefix) || path.isAbsolute(filePath)) {
+    return true;
+  }
+  const projectRelativePath: string = filePath.slice(projectPrefix.length);
+  if (!projectRelativePath.includes('/') || CONFIG_INPUT_FOLDER_REGEXP.test(projectRelativePath)) {
+    return true;
+  }
+  return CONFIG_INPUT_FILE_NAME_REGEXP.test(
+    projectRelativePath.slice(projectRelativePath.lastIndexOf('/') + 1)
+  );
+}
+
+function describeInputFileChanges(
+  lastState: IIncrementalInputState,
+  currentState: IIncrementalInputState,
+  isChanged: (lastHash: string | undefined, currentHash: string | undefined, filePath: string) => boolean
+): string {
+  const lastFiles: ReadonlyMap<string, string> | undefined = lastState.inputFiles.deref();
+  const currentFiles: ReadonlyMap<string, string> | undefined = currentState.inputFiles.deref();
+  if (!lastFiles || !currentFiles) {
+    return '';
+  }
+  const changedFiles: string[] = [];
+  for (const filePath of new Set([...lastFiles.keys(), ...currentFiles.keys()])) {
+    if (isChanged(lastFiles.get(filePath), currentFiles.get(filePath), filePath)) {
+      changedFiles.push(filePath);
+    }
+  }
+  if (changedFiles.length === 0) {
+    return '';
+  }
+  return formatExamplePaths(changedFiles);
+}
+
+function formatExamplePaths(paths: string[]): string {
+  paths.sort();
+  const examples: string = paths
+    .slice(0, MAX_EXAMPLE_PATHS)
+    .map((filePath: string) => JSON.stringify(filePath))
+    .join(', ');
+  return ` (${examples}${paths.length > MAX_EXAMPLE_PATHS ? ', ...' : ''})`;
+}
+
+/**
+ * Returns the identity of each folder of the operation's project that holds one of its input files, by the path of
+ * the folder relative to the root of the inputs snapshot.
+ */
+function readInputFolderIdentities(
+  operation: Operation,
+  inputsSnapshot: IInputsSnapshot
+): ReadonlyMap<string, string> {
+  const { associatedProject: project, associatedPhase: phase } = operation;
+  const projectPrefix: string = getProjectPrefix(inputsSnapshot, project);
+  const folderPaths: Set<string> = new Set();
+  for (const filePath of inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name).keys()) {
+    if (filePath.startsWith(projectPrefix) && !path.isAbsolute(filePath)) {
+      folderPaths.add(filePath.slice(0, Math.max(filePath.lastIndexOf('/'), 0)));
+    }
+  }
+  const identities: Map<string, string> = new Map();
+  for (const folderPath of folderPaths) {
+    identities.set(folderPath, getFolderIdentity(path.resolve(inputsSnapshot.rootDirectory, folderPath)));
+  }
+  return identities;
+}
+
+/**
+ * Returns the folders of `lastIdentities` whose identity changed, including folders that no longer hold input files.
+ * A changed folder inside another changed folder is left out, e.g. a recreated "src" is named without its subfolders.
+ */
+function getChangedFolders(
+  lastIdentities: ReadonlyMap<string, string>,
+  currentIdentities: ReadonlyMap<string, string>
+): string[] {
+  const changedFolders: Set<string> = new Set();
+  for (const [folderPath, identity] of lastIdentities) {
+    if (currentIdentities.get(folderPath) !== identity) {
+      changedFolders.add(folderPath);
+    }
+  }
+  const topFolders: string[] = [];
+  for (const folderPath of changedFolders) {
+    if (!hasAncestorFolder(folderPath, changedFolders)) {
+      topFolders.push(folderPath);
+    }
+  }
+  return topFolders;
+}
+
+// Folder paths are relative, with "/" separators, and "" is the root of the inputs snapshot.
+function hasAncestorFolder(folderPath: string, folderPaths: ReadonlySet<string>): boolean {
+  let parentPath: string = folderPath;
+  while (parentPath) {
+    parentPath = parentPath.slice(0, Math.max(parentPath.lastIndexOf('/'), 0));
+    if (folderPaths.has(parentPath)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// A folder that was deleted and recreated has another inode, or at least another birth time. Unlike its modification
+// and status change times, neither changes when an entry of the folder is added, removed or replaced, e.g. by an
+// editor that saves a file by renaming a new file over it.
+function getFolderIdentity(folderPath: string): string {
+  try {
+    const stats: fs.Stats | undefined = fs.lstatSync(folderPath, { throwIfNoEntry: false });
+    return stats ? `${stats.dev}:${stats.ino}:${stats.birthtimeMs}` : 'missing';
+  } catch (error) {
+    // E.g. ENOTDIR, if a folder on its path was replaced by a file
+    return `${(error as NodeJS.ErrnoException).code}`;
+  }
+}
+
+/**
+ * Returns the dependencies of an operation by name, including the dependencies that it has through operations of its
+ * own project, e.g. through a phase without a script that only orders its build after the builds of other projects.
+ */
+function getGuardedDependencies(operation: Operation): ReadonlyMap<string, Operation> {
+  const { associatedProject: project } = operation;
+  const dependencyByName: Map<string, Operation> = new Map();
+  const dependents: Operation[] = [operation];
+  for (let i: number = 0; i < dependents.length; i++) {
+    for (const dependency of dependents[i].dependencies) {
+      if (dependencyByName.has(dependency.name)) {
+        continue;
+      }
+      dependencyByName.set(dependency.name, dependency);
+      if (dependency.associatedProject === project) {
+        dependents.push(dependency);
+      }
+    }
+  }
+  return dependencyByName;
+}
+
+function getToolingDependencyReason(operation: Operation, dependency: Operation): string | undefined {
+  const { associatedProject: project } = operation;
+  const { associatedProject: dependencyProject } = dependency;
+  if (dependencyProject === project) {
+    // Another phase of the same project, e.g. the build that a test operation runs against.
+    return undefined;
+  }
+  const { packageName } = dependencyProject;
+  const { dependencies, optionalDependencies, peerDependencies } = project.packageJson;
+  if (
+    !dependencies?.[packageName] &&
+    !optionalDependencies?.[packageName] &&
+    !peerDependencies?.[packageName]
+  ) {
+    return `its dependency "${packageName}" changed, and it is not a production dependency`;
+  }
+  if (isToolingProject(dependencyProject)) {
+    return `its dependency "${packageName}" changed, and it is a build tool`;
+  }
+  return undefined;
+}
+
+const isToolingProjectByProject: WeakMap<RushConfigurationProject, boolean> = new WeakMap();
+
+function isToolingProject(project: RushConfigurationProject): boolean {
+  let isTooling: boolean | undefined = isToolingProjectByProject.get(project);
+  if (isTooling === undefined) {
+    const { packageName, projectFolder } = project;
+    isTooling =
+      TOOLING_PACKAGE_NAME_REGEXP.test(packageName) ||
+      // A rig package
+      FileSystem.exists(`${projectFolder}/profiles`) ||
+      FileSystem.exists(`${projectFolder}/heft-plugin.json`);
+    isToolingProjectByProject.set(project, isTooling);
+  }
+  return isTooling;
+}
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
new file mode 100644
index 00000000000..1cfd0c813a7
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
@@ -0,0 +1,150 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The reason with which the Rush daemon invalidates operations whose inputs changed. The incremental execution
+ * guard compares the inputs itself, so such an invalidation keeps the last successful run of an operation as the
+ * base for its next run. Every other invalidation forgets the base of the operations that it invalidates.
+ *
+ * @remarks
+ * The Rush daemon only imports types from Rush, so it repeats this value.
+ */
+export const INPUTS_CHANGED_INVALIDATION_REASON: 'workspace-inputs-changed' = 'workspace-inputs-changed';
+
+/**
+ * The reason with which a long-lived host invalidates every operation after a native Rush command ran in the
+ * workspace. That command may have replaced the outputs of any operation, including those that were already
+ * invalidated, so the incremental execution guard forgets every base.
+ */
+export const NATIVE_COMMAND_INVALIDATION_REASON: 'native-command-completed' = 'native-command-completed';
+
+/**
+ * Options that an operation runner passes to its {@link IIncrementalExecutionGuard}.
+ *
+ * @beta
+ */
+export interface IIncrementalExecutionGuardOptions {
+  /**
+   * Set by a runner whose incremental runs keep the previous build in memory, such as a watch-mode bundler in a
+   * warm worker. Outputs that look like bundles then do not require the initial command. If an incremental run
+   * changes which output files exist, that run is still followed by the initial command, but later runs of the
+   * operation may use the incremental command again, unless the run added or removed a content-hashed file.
+   * Defaults to false.
+   */
+  readonly outputsMayBeBundles?: boolean;
+}
+
+/**
+ * Decides whether an operation may run its `:incremental` command outside watch mode.
+ * The Rush daemon registers one for each execution record. Runners get it from
+ * {@link IOperationRunnerContext.getIncrementalExecutionGuard}.
+ *
+ * @beta
+ */
+export interface IIncrementalExecutionGuard {
+  /**
+   * Returns `undefined` if the incremental command may run, otherwise why it may not, as a clause that completes
+   * "Not using the incremental command because ...", e.g. `its command line changed`.
+   */
+  getBlockReasonAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
+  /**
+   * Called after the incremental command succeeded. Returns `undefined` if its outputs can be kept, otherwise why
+   * the initial command must run as well, as a clause that completes "Running the initial command, because ...".
+   */
+  verifyIncrementalResultAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
+}
+
+/**
+ * The name that rush-lib's own runners and plugins use for {@link IOperationCommandExecution}.
+ */
+export type ICommandExecution = IOperationCommandExecution;
+
+/**
+ * Which command an operation runner executed for an operation in one iteration.
+ *
+ * @beta
+ */
+export interface IOperationCommandExecution {
+  /**
+   * The command that produced the final outputs.
+   */
+  readonly kind: 'initial' | 'incremental';
+  /**
+   * Whether the runner has an incremental command that a later iteration could use.
+   */
+  readonly hasIncrementalCommand: boolean;
+  /**
+   * Whether the command ran in a process that keeps watching the operation's input files after the command
+   * completed, to run the incremental command again, such as a warm worker. A watcher can miss changes in a folder
+   * that was deleted and recreated, so the next incremental run then requires that none of the folders that held
+   * input files was deleted or recreated since this run started. Defaults to false.
+   */
+  readonly watchesInputs?: boolean;
+}
+
+// All are keyed by the execution record, which is the runner's context and the hooks' argument.
+const guardByRecord: WeakMap<object, IIncrementalExecutionGuard> = new WeakMap();
+const commandExecutionByRecord: WeakMap<object, ICommandExecution> = new WeakMap();
+const watchedCommandCallbackByRecord: WeakMap<object, () => void> = new WeakMap();
+const recordsWithoutCacheRead: WeakSet<object> = new WeakSet();
+
+export function setIncrementalExecutionGuard(record: object, guard: IIncrementalExecutionGuard): void {
+  guardByRecord.set(record, guard);
+}
+
+export function getIncrementalExecutionGuard(record: object): IIncrementalExecutionGuard | undefined {
+  return guardByRecord.get(record);
+}
+
+export function clearIncrementalExecutionGuard(record: object): void {
+  guardByRecord.delete(record);
+  watchedCommandCallbackByRecord.delete(record);
+}
+
+/**
+ * Sets a function that `setCommandExecution` calls for the execution record each time a runner records a command
+ * that watches the input files, which it does before the command starts.
+ */
+export function setWatchedCommandCallback(record: object, callback: () => void): void {
+  watchedCommandCallbackByRecord.set(record, callback);
+}
+
+/**
+ * Records which command a runner is about to execute for an execution record. Call it before starting the command,
+ * so that the outputs of a command that fails or is aborted are attributed to it too.
+ */
+export function setCommandExecution(record: object, execution: ICommandExecution): void {
+  commandExecutionByRecord.set(record, execution);
+  if (execution.watchesInputs) {
+    watchedCommandCallbackByRecord.get(record)?.();
+  }
+}
+
+export function getCommandExecution(record: object): ICommandExecution | undefined {
+  return commandExecutionByRecord.get(record);
+}
+
+/**
+ * Returns true if the outputs of this execution record were produced by an operation's incremental command.
+ * Such outputs are never written to the build cache or recorded for legacy skip detection, and neither are the
+ * outputs of consumers that were built against them.
+ */
+export function wasExecutedIncrementally(record: object): boolean {
+  return commandExecutionByRecord.get(record)?.kind === 'incremental';
+}
+
+/**
+ * Records that the runner of an execution record will run its incremental command without first trying to restore
+ * the operation from the build cache, e.g. because a restore would replace the outputs that a warm worker built and
+ * keeps in memory. Call it from a `beforeExecuteOperationAsync` tap that runs before `CacheableOperationPlugin`'s.
+ */
+export function skipBuildCacheRead(record: object): void {
+  recordsWithoutCacheRead.add(record);
+}
+
+/**
+ * Returns true if `skipBuildCacheRead` was called for the execution record.
+ */
+export function isBuildCacheReadSkipped(record: object): boolean {
+  return recordsWithoutCacheRead.has(record);
+}
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
index aef3eaff54b..fa13507a8f8 100644
--- a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -6,10 +6,39 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { Executable } from '@rushstack/node-core-library';
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
 
 /**
- * The on-disk state of an operation's tracked input files, captured right after the inputs snapshot
- * (from which the operation's build cache key is derived) was taken.
+ * How far outside of the snapshot window a file time may be and still count as a save during the window.
+ * File times can trail `Date.now()` by a clock tick (about 16 ms on Windows), or by up to 2 seconds on file systems
+ * with coarse time stamps (FAT). A file that is flagged by mistake is usually only read and hashed again
+ * (see `haveSnapshotHashesChangedAsync`).
+ */
+export const FILE_TIME_TOLERANCE_MS: number = 2000;
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1000000);
+
+/**
+ * The largest file that `haveSnapshotHashesChangedAsync` hashes itself. Git hashes larger files, since hashing
+ * them could take longer than starting Git, and would block the event loop.
+ */
+export const MAX_IN_PROCESS_HASH_FILE_SIZE: number = 1024 * 1024;
+
+/**
+ * The algorithm of a Git object hash, by the number of its hexadecimal digits.
+ */
+const GIT_HASH_ALGORITHM_BY_LENGTH: ReadonlyMap<number, string> = new Map([
+  [40, 'sha1'],
+  [64, 'sha256']
+]);
+
+function millisecondsToNanoseconds(timeMs: number): bigint {
+  return BigInt(Math.floor(timeMs)) * NANOSECONDS_PER_MILLISECOND;
+}
+
+/**
+ * The on-disk state of an operation's tracked input files, captured right before the operation executes. The
+ * changes that were made after the inputs snapshot (from which the operation's build cache key is derived) began
+ * reading the working tree, and before this state was captured, are found from file and folder times.
  */
 export interface IInputFilesState {
   /**
@@ -21,14 +50,32 @@ export interface IInputFilesState {
    */
   readonly filePaths: ReadonlyArray<string>;
   /**
-   * Signature of the size, modification time, and inode of each tracked input file.
+   * Signature of the size, modification time, and inode of each tracked input file. For a symbolic link that does
+   * not lead to a regular file, they are those of the link itself.
    */
   readonly statSignature: string;
   /**
-   * For each folder inside the repository that contains a tracked input file, the names of its entries.
-   * Used to detect files (or folders) that were created after the snapshot was taken.
+   * For each folder inside the repository that contains a tracked input file, the names of the entries that it had
+   * when the inputs snapshot read the working tree. Used to detect files (or folders) that were created afterwards.
+   * For a folder that did not change after the snapshot began reading the working tree, these are its entries when
+   * this state was captured. For a folder that did, they are only the names that lead to tracked input files and
+   * the entries whose times are all before that time.
    */
   readonly folderEntries: ReadonlyMap<string, ReadonlySet<string>>;
+  /**
+   * The tracked input file paths, as passed to `captureInputFilesState`, whose modification or status change time
+   * falls between the time that the inputs snapshot began reading the working tree and the time that this state
+   * was captured. Git may have hashed such a file before it was saved, so its hash in the snapshot (from which the
+   * build cache key was derived) may be stale even though its stats do not change again.
+   */
+  readonly filesChangedDuringSnapshot: ReadonlyArray<string>;
+  /**
+   * The tracked input file paths, as passed to `captureInputFilesState`, that were missing when this state was
+   * captured, and whose folder (or, if it is missing, the nearest folder above it) changed after the inputs snapshot
+   * began reading the working tree. The snapshot has a hash of such a file, so the file was deleted after Git read
+   * it, unless Git does not read it from the working tree (e.g. it is marked `skip-worktree`).
+   */
+  readonly filesDeletedDuringSnapshot: ReadonlyArray<string>;
 }
 
 /**
@@ -42,18 +89,83 @@ export type IsNewInputCallback = (newEntryPaths: ReadonlyArray<string>) => boole
  * Missing files are included in the signature, so deleting or creating a listed file also changes it.
  */
 export function getInputFilesStatSignature(filePaths: Iterable<string>): string {
+  return hashInputFilesStats(filePaths);
+}
+
+function hashInputFilesStats(
+  filePaths: Iterable<string>,
+  onStats?: (index: number, stats: fs.BigIntStats | undefined) => void
+): string {
   const hasher: crypto.Hash = crypto.createHash('sha1');
+  let index: number = 0;
   for (const filePath of filePaths) {
-    const stats: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+    const stats: fs.BigIntStats | undefined = tryGetInputFileStats(filePath);
     if (stats) {
       hasher.update(`${filePath}\0${stats.size}\0${stats.mtimeNs}\0${stats.ino}\n`);
     } else {
       hasher.update(`${filePath}\0missing\n`);
     }
+    onStats?.(index, stats);
+    index++;
   }
   return hasher.digest('hex');
 }
 
+/**
+ * Returns the stats of what Git hashes for an input file, or `undefined` if the file is missing: the file, or the
+ * regular file that a symbolic link leads to. For a symbolic link that does not lead to a regular file (e.g. its
+ * target is missing, is a folder, or is a loop of links), Git hashes the text of the link, as the inputs snapshot
+ * does, so the stats are those of the link itself.
+ */
+function tryGetInputFileStats(filePath: string): fs.BigIntStats | undefined {
+  let stats: fs.BigIntStats | undefined;
+  try {
+    stats = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ELOOP') {
+      throw error;
+    }
+  }
+  if (stats?.isFile()) {
+    return stats;
+  }
+  const linkStats: fs.BigIntStats | undefined = tryGetLinkStats(filePath);
+  return linkStats?.isSymbolicLink() ? linkStats : stats;
+}
+
+/**
+ * Returns true if the modification or status change time of the folder is at or after the specified time.
+ * Deleting a folder changes the folder that held it, so a missing folder is judged by the nearest folder above it
+ * that exists.
+ */
+function hasFolderChangedSince(folderPath: string, timeNs: bigint): boolean {
+  let currentPath: string = folderPath;
+  for (;;) {
+    let stats: fs.BigIntStats | undefined;
+    try {
+      stats = fs.statSync(currentPath, { bigint: true, throwIfNoEntry: false });
+    } catch {
+      // E.g. ENOTDIR, if a folder above it was replaced by a file
+    }
+    if (stats) {
+      return stats.mtimeNs >= timeNs || stats.ctimeNs >= timeNs;
+    }
+    const parentPath: string = path.dirname(currentPath);
+    if (parentPath === currentPath) {
+      return true;
+    }
+    currentPath = parentPath;
+  }
+}
+
+function tryGetLinkStats(entryPath: string): fs.BigIntStats | undefined {
+  try {
+    return fs.lstatSync(entryPath, { bigint: true, throwIfNoEntry: false });
+  } catch {
+    return undefined;
+  }
+}
+
 function tryReadFolderEntries(folderPath: string): Set<string> | undefined {
   try {
     return new Set(fs.readdirSync(folderPath));
@@ -63,30 +175,154 @@ function tryReadFolderEntries(folderPath: string): Set<string> | undefined {
 }
 
 /**
- * Captures the on-disk state of an operation's tracked input files.
+ * Captures the on-disk state of an operation's tracked input files. Call it right before the operation executes.
  *
  * @param rootDirectory - The repository root that relative input file paths are resolved against
  * @param inputFilePaths - The tracked input file paths. Relative paths are resolved against `rootDirectory`;
  *   absolute paths (e.g. `dependsOnAdditionalFiles` outside of the repository) are stat'ed but their folders
  *   are not watched for new entries.
+ * @param snapshotStartTimeMs - When the inputs snapshot began reading the working tree
+ *   (`IInputsSnapshot.workingTreeReadStartTimeMs`), if known. Used to compute `filesChangedDuringSnapshot` and
+ *   `filesDeletedDuringSnapshot`, and to find the folders whose entries may have been created after that time.
  */
 export function captureInputFilesState(
   rootDirectory: string,
-  inputFilePaths: Iterable<string>
+  inputFilePaths: Iterable<string>,
+  snapshotStartTimeMs?: number
 ): IInputFilesState {
+  const originalFilePaths: string[] = [];
   const filePaths: string[] = [];
-  const folderEntries: Map<string, ReadonlySet<string>> = new Map();
+  // The absolute paths of the input files whose folders are watched for new entries, and those folders
+  const watchedFilePaths: string[] = [];
+  const folderPaths: Set<string> = new Set();
   for (const inputFilePath of inputFilePaths) {
     const absolutePath: string = path.resolve(rootDirectory, inputFilePath);
+    originalFilePaths.push(inputFilePath);
     filePaths.push(absolutePath);
     if (!path.isAbsolute(inputFilePath)) {
-      const folderPath: string = path.dirname(absolutePath);
-      if (!folderEntries.has(folderPath)) {
-        folderEntries.set(folderPath, tryReadFolderEntries(folderPath) ?? new Set());
+      watchedFilePaths.push(absolutePath);
+      folderPaths.add(path.dirname(absolutePath));
+    }
+  }
+  const windowStartNs: bigint | undefined =
+    snapshotStartTimeMs === undefined
+      ? undefined
+      : millisecondsToNanoseconds(snapshotStartTimeMs - FILE_TIME_TOLERANCE_MS);
+  // For each file with a time at or after the start of the window, the earliest such time
+  const earliestTimeInWindowNsByIndex: Map<number, bigint> = new Map();
+  const missingFileIndexes: number[] = [];
+  // The files are stat'ed before their folders, so that a file that is deleted after its stat changes the signature,
+  // and a file that is deleted before its stat changes the times of its folder.
+  const statSignature: string = hashInputFilesStats(
+    filePaths,
+    (index: number, stats: fs.BigIntStats | undefined) => {
+      if (windowStartNs === undefined) {
+        return;
+      }
+      if (!stats) {
+        missingFileIndexes.push(index);
+        return;
+      }
+      for (const timeNs of [stats.mtimeNs, stats.ctimeNs]) {
+        const earliestTimeNs: bigint | undefined = earliestTimeInWindowNsByIndex.get(index);
+        if (timeNs >= windowStartNs && (earliestTimeNs === undefined || timeNs < earliestTimeNs)) {
+          earliestTimeInWindowNsByIndex.set(index, timeNs);
+        }
+      }
+    }
+  );
+  // The window ends after the files were stat'ed, so that a save during the loop is inside it. A later file time
+  // (e.g. an mtime set in the future) is not a save during the window.
+  const windowEndNs: bigint = millisecondsToNanoseconds(Date.now() + FILE_TIME_TOLERANCE_MS);
+  const filesChangedDuringSnapshot: string[] = [];
+  for (const [index, timeNs] of earliestTimeInWindowNsByIndex) {
+    if (timeNs <= windowEndNs) {
+      filesChangedDuringSnapshot.push(originalFilePaths[index]);
+    }
+  }
+
+  const folderEntries: Map<string, ReadonlySet<string>> = new Map();
+  const hasFolderChangedByPath: Map<string, boolean> = new Map();
+  // The entries that each folder that changed during the window had when it was read
+  let entriesByChangedFolder: Map<string, ReadonlySet<string> | undefined> | undefined;
+  for (const folderPath of folderPaths) {
+    // Read before the folder is stat'ed, so that an entry that is created after it was read either changes the
+    // times of the folder or is missing from the entries that are compared later.
+    const entries: Set<string> | undefined = tryReadFolderEntries(folderPath);
+    const hasFolderChanged: boolean =
+      windowStartNs !== undefined && hasFolderChangedSince(folderPath, windowStartNs);
+    hasFolderChangedByPath.set(folderPath, hasFolderChanged);
+    if (hasFolderChanged) {
+      entriesByChangedFolder ??= new Map();
+      entriesByChangedFolder.set(folderPath, entries);
+    } else {
+      folderEntries.set(folderPath, entries ?? new Set());
+    }
+  }
+  if (entriesByChangedFolder && windowStartNs !== undefined) {
+    // The entries of a folder that changed during the window may include some that were created after the snapshot
+    // read the working tree. Only those that are known to have existed before are compared later: the names that
+    // lead to tracked input files, and the entries that were not created, moved or modified during the window.
+    const originalEntriesByChangedFolder: Map<string, Set<string>> = new Map();
+    for (const folderPath of entriesByChangedFolder.keys()) {
+      const originalEntries: Set<string> = new Set();
+      originalEntriesByChangedFolder.set(folderPath, originalEntries);
+      folderEntries.set(folderPath, originalEntries);
+    }
+    for (const filePath of watchedFilePaths) {
+      originalEntriesByChangedFolder.get(path.dirname(filePath))?.add(path.basename(filePath));
+    }
+    // Each folder on the path from the root to a folder of input files is visited once.
+    const resolvedRootDirectory: string = path.resolve(rootDirectory);
+    const visitedFolderPaths: Set<string> = new Set();
+    for (const folderPath of folderPaths) {
+      let childPath: string = folderPath;
+      while (childPath !== resolvedRootDirectory && !visitedFolderPaths.has(childPath)) {
+        visitedFolderPaths.add(childPath);
+        const parentPath: string = path.dirname(childPath);
+        if (parentPath === childPath) {
+          break;
+        }
+        originalEntriesByChangedFolder.get(parentPath)?.add(path.basename(childPath));
+        childPath = parentPath;
+      }
+    }
+    for (const [folderPath, entries] of entriesByChangedFolder) {
+      const originalEntries: Set<string> = originalEntriesByChangedFolder.get(folderPath)!;
+      for (const entry of entries ?? []) {
+        if (!originalEntries.has(entry)) {
+          // Creating, moving, or modifying an entry changes its status change time, which cannot be set back.
+          const stats: fs.BigIntStats | undefined = tryGetLinkStats(path.join(folderPath, entry));
+          if (stats && stats.ctimeNs < windowStartNs && stats.mtimeNs < windowStartNs) {
+            originalEntries.add(entry);
+          }
+        }
+      }
+    }
+  }
+
+  const filesDeletedDuringSnapshot: string[] = [];
+  if (windowStartNs !== undefined) {
+    for (const index of missingFileIndexes) {
+      const folderPath: string = path.dirname(filePaths[index]);
+      let hasFolderChanged: boolean | undefined = hasFolderChangedByPath.get(folderPath);
+      if (hasFolderChanged === undefined) {
+        hasFolderChanged = hasFolderChangedSince(folderPath, windowStartNs);
+        hasFolderChangedByPath.set(folderPath, hasFolderChanged);
+      }
+      if (hasFolderChanged) {
+        filesDeletedDuringSnapshot.push(originalFilePaths[index]);
       }
     }
   }
-  return { rootDirectory, filePaths, statSignature: getInputFilesStatSignature(filePaths), folderEntries };
+  return {
+    rootDirectory,
+    filePaths,
+    statSignature,
+    folderEntries,
+    filesChangedDuringSnapshot,
+    filesDeletedDuringSnapshot
+  };
 }
 
 /**
@@ -108,17 +344,116 @@ export function getNewFolderEntries(folderEntries: ReadonlyMap<string, ReadonlyS
 }
 
 /**
- * Returns true if any of the operation's tracked input files was modified, deleted, or replaced, or if a
- * potential new input file was created in one of the input folders, since the state was captured.
+ * Returns true if any of the operation's tracked input files was deleted after the inputs snapshot read it and
+ * before the state was captured, or, since the state was captured, if any of them was modified, deleted, or
+ * replaced, or a potential new input file was created in one of the input folders. A file that was created in a
+ * folder that changed during the window can have been created before the state was captured.
  */
 export function haveInputFilesChanged(state: IInputFilesState, isNewInput: IsNewInputCallback): boolean {
+  if (state.filesDeletedDuringSnapshot.length > 0) {
+    return true;
+  }
   if (getInputFilesStatSignature(state.filePaths) !== state.statSignature) {
     return true;
   }
-  const newEntryPaths: string[] = getNewFolderEntries(state.folderEntries);
+  const newEntryPaths: string[] = getNewFolderEntries(state.folderEntries).filter(mayHoldFiles);
   return newEntryPaths.length > 0 && isNewInput(newEntryPaths);
 }
 
+/**
+ * Returns false if the entry is missing, or is a folder that holds no files, not even in its subfolders. Git does
+ * not track folders, so such a folder cannot hold a potential input file.
+ */
+function mayHoldFiles(entryPath: string): boolean {
+  let entries: fs.Dirent[];
+  try {
+    entries = fs.readdirSync(entryPath, { withFileTypes: true });
+  } catch (error) {
+    // E.g. ENOTDIR for a file
+    return (error as NodeJS.ErrnoException).code !== 'ENOENT';
+  }
+  return entries.some(
+    (entry: fs.Dirent) => !entry.isDirectory() || mayHoldFiles(path.join(entryPath, entry.name))
+  );
+}
+
+/**
+ * Returns the Git blob hash of the content that a file has on disk, or of the text of a symbolic link that does not
+ * lead to a regular file, which is what Git hashes for such a link, computed with the algorithm of `expectedHash`.
+ * Returns undefined if it is not hashed in process. Unlike `git hash-object`, it applies no clean filters (e.g. line
+ * ending conversion), so a mismatch does not show that the file changed.
+ */
+function tryGetBlobHash(filePath: string, expectedHash: string): string | undefined {
+  const algorithm: string | undefined = GIT_HASH_ALGORITHM_BY_LENGTH.get(expectedHash.length);
+  if (!algorithm) {
+    return undefined;
+  }
+  let content: Buffer;
+  try {
+    const stats: fs.BigIntStats | undefined = tryGetInputFileStats(filePath);
+    if (stats?.isSymbolicLink()) {
+      content = fs.readlinkSync(filePath, { encoding: 'buffer' });
+    } else if (stats?.isFile() && stats.size <= BigInt(MAX_IN_PROCESS_HASH_FILE_SIZE)) {
+      content = fs.readFileSync(filePath);
+    } else {
+      // A folder or a FIFO cannot be read like a file
+      return undefined;
+    }
+  } catch {
+    return undefined;
+  }
+  return crypto.createHash(algorithm).update(`blob ${content.length}\0`).update(content).digest('hex');
+}
+
+/**
+ * Returns true if the current Git hash of any of the specified files differs from its hash in the inputs
+ * snapshot. If Git was not found or the files cannot be hashed, conservatively returns true.
+ *
+ * @remarks
+ * Each file is hashed in process first, which is much cheaper than starting Git. If the content that a file has on
+ * disk has its snapshot hash, the file is unchanged, since Git's usual clean filters (line ending conversion,
+ * `ident` and Git LFS) leave content that they already cleaned as it is. Only the other files are hashed with
+ * `git hash-object`, which applies the clean filters, as the inputs snapshot did.
+ *
+ * @param gitPath - The path of the Git executable, if it was found
+ * @param rootDirectory - The repository root that the file paths are relative to
+ * @param filePaths - The files to hash, e.g. the `filesChangedDuringSnapshot` of an `IInputFilesState`
+ * @param snapshotHashes - The hashes of the files in the inputs snapshot, by path
+ */
+export async function haveSnapshotHashesChangedAsync(
+  gitPath: string | undefined,
+  rootDirectory: string,
+  filePaths: ReadonlyArray<string>,
+  snapshotHashes: ReadonlyMap<string, string> | undefined
+): Promise<boolean> {
+  if (!gitPath || !snapshotHashes) {
+    return true;
+  }
+  const filePathsToHashWithGit: string[] = [];
+  for (const filePath of filePaths) {
+    const snapshotHash: string | undefined = snapshotHashes.get(filePath);
+    if (snapshotHash === undefined) {
+      return true;
+    }
+    if (tryGetBlobHash(path.resolve(rootDirectory, filePath), snapshotHash) !== snapshotHash) {
+      filePathsToHashWithGit.push(filePath);
+    }
+  }
+  if (filePathsToHashWithGit.length === 0) {
+    return false;
+  }
+  try {
+    for (const [filePath, hash] of await hashFilesAsync(rootDirectory, filePathsToHashWithGit, gitPath)) {
+      if (snapshotHashes.get(filePath) !== hash) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return true;
+  }
+}
+
 function toGitPathspec(rootDirectory: string, absolutePath: string): string {
   return path.relative(rootDirectory, absolutePath).split(path.sep).join('/');
 }
@@ -127,12 +462,17 @@ function toGitPathspec(rootDirectory: string, absolutePath: string): string {
  * Uses Git to determine whether any of the specified paths is, or contains, an untracked file that is not
  * ignored by `.gitignore`, excluding the specified folders (typically the operation's output folders).
  * If Git fails, conservatively returns true.
+ *
+ * @param snapshotHashes - The hashes of the files in the inputs snapshot, by path relative to `rootDirectory`, if
+ *   known. An untracked file that the snapshot hashed existed when the snapshot read the working tree, so it does
+ *   not count.
  */
 export function hasUntrackedGitFiles(
   gitPath: string,
   rootDirectory: string,
   candidatePaths: ReadonlyArray<string>,
-  excludedFolderPaths: ReadonlyArray<string>
+  excludedFolderPaths: ReadonlyArray<string>,
+  snapshotHashes?: ReadonlyMap<string, string>
 ): boolean {
   const args: string[] = ['ls-files', '--others', '--exclude-standard', '-z', '--'];
   for (const candidatePath of candidatePaths) {
@@ -147,5 +487,14 @@ export function hasUntrackedGitFiles(
   if (result.status !== 0) {
     return true;
   }
-  return result.stdout.length > 0;
-}
\ No newline at end of file
+  if (!snapshotHashes) {
+    return result.stdout.length > 0;
+  }
+  // The paths are relative to the root, since Git ran there, and are separated by NUL characters.
+  for (const filePath of result.stdout.split('\0')) {
+    if (filePath && !snapshotHashes.has(filePath)) {
+      return true;
+    }
+  }
+  return false;
+}
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index 2b2ea20896f..10d51eb14aa 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -9,11 +9,37 @@ import { PrintUtilities, Colorize, type ITerminal } from '@rushstack/terminal';
 import type { Operation } from './Operation';
 import { OperationStatus } from './OperationStatus';
 import type { IPhasedCommandPlugin, PhasedCommandHooks } from '../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import type { IOperationGraphIterationOptions } from './IOperationGraph';
 import type { IOperationRunnerContext } from './IOperationRunner';
 import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import { wasExecutedIncrementally } from './IncrementalExecutionState';
+import { captureInputFilesState, type IInputFilesState } from './InputFilesStatSignature';
+import {
+  createGitPathGetter,
+  getSnapshotStartTimeMs,
+  haveOperationInputFilesChangedAsync
+} from './OperationInputFilesCheck';
+import {
+  CAPTURE_INPUT_FILES_STAGE,
+  isResultUnverifiable,
+  markInputFilesChecked,
+  markResultUnverifiable
+} from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'LegacySkipPlugin' = 'LegacySkipPlugin';
+const INVALIDATION_PLUGIN_NAME: 'LegacySkipInvalidationPlugin' = 'LegacySkipInvalidationPlugin';
+
+/**
+ * Returns the path of the file in which {@link LegacySkipPlugin} records the inputs of the last successful
+ * execution of an operation.
+ */
+function _getPackageDepsPath(operation: Operation): string {
+  return path.join(
+    operation.associatedProject.projectRushTempFolder,
+    `package-deps_${operation.logFilenameIdentifier}.json`
+  );
+}
 
 function _areShallowEqual(object1: JsonObject, object2: JsonObject): boolean {
   for (const n in object1) {
@@ -29,15 +55,42 @@ function _areShallowEqual(object1: JsonObject, object2: JsonObject): boolean {
   return true;
 }
 
+// Runs after the default-stage taps that can mark the result of an operation as unverifiable, e.g. the input file
+// check of this plugin, which checks whether the input files changed while the operation executed.
+const RECORD_PACKAGE_DEPS_STAGE: number = 1;
+
 export interface IProjectDeps {
   files: { [filePath: string]: string };
   arguments: string;
 }
 
+interface IInputFilesCheck {
+  readonly inputsSnapshot: IInputsSnapshot;
+  // See getSnapshotStartTimeMs
+  readonly snapshotStartTimeMs: number;
+  // The hashes of the tracked input files in the inputs snapshot
+  readonly fileHashes: ReadonlyMap<string, string>;
+  // Captured right before the operation executes
+  inputFilesState?: IInputFilesState;
+}
+
 interface ILegacySkipRecord {
   allowSkip: boolean;
+  /**
+   * Whether an operation that this operation depends on, directly or indirectly, changed its outputs in this
+   * iteration, so that the outputs of this operation were built against outputs that have since changed.
+   */
+  dependencyChanged: boolean;
+  /**
+   * Whether the record of this operation matched its inputs when it started. If it executes anyway, e.g. in a
+   * rebuild, it reproduces the outputs that it recorded, so the records of its consumers stay valid, unless
+   * its result is unverifiable.
+   */
+  inputsUnchanged: boolean;
   packageDeps: IProjectDeps | undefined;
   packageDepsPath: string;
+  // Set if this plugin checks whether the input files of the operation change until it has executed
+  inputFilesCheck?: IInputFilesCheck;
 }
 
 export interface ILegacySkipPluginOptions {
@@ -64,6 +117,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
       this.#options;
 
     hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph) => {
+      const getGitPath: () => string | undefined = createGitPathGetter();
       graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations) => {
         for (const operation of operations) stateMap.delete(operation);
       });
@@ -75,10 +129,15 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         ): void => {
           let logGitWarning: boolean = false;
           const { inputsSnapshot } = iterationOptions;
+          const allowSkip: boolean =
+            isIncrementalBuildAllowed && iterationOptions.isIncrementalBuildAllowed !== false;
+          const snapshotStartTimeMs: number | undefined = inputsSnapshot
+            ? getSnapshotStartTimeMs(inputsSnapshot)
+            : undefined;
 
           for (const record of operations.values()) {
             const { operation } = record;
-            const { associatedProject, associatedPhase, runner, logFilenameIdentifier } = operation;
+            const { runner } = operation;
             if (!runner) {
               continue;
             }
@@ -86,55 +145,27 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             if (!runner.cacheable) {
               stateMap.set(operation, {
                 allowSkip: true,
+                dependencyChanged: false,
+                inputsUnchanged: false,
                 packageDeps: undefined,
                 packageDepsPath: ''
               });
               continue;
             }
 
-            const packageDepsFilename: string = `package-deps_${logFilenameIdentifier}.json`;
-
-            const packageDepsPath: string = path.join(
-              associatedProject.projectRushTempFolder,
-              packageDepsFilename
-            );
-
-            let packageDeps: IProjectDeps | undefined;
+            const packageDepsPath: string = _getPackageDepsPath(operation);
 
-            try {
-              const fileHashes: ReadonlyMap<string, string> | undefined =
-                inputsSnapshot?.getTrackedFileHashesForOperation(associatedProject, associatedPhase.name);
-
-              if (!fileHashes) {
-                logGitWarning = true;
-                continue;
-              }
-
-              const files: Record<string, string> = {};
-              for (const [filePath, fileHash] of fileHashes) {
-                files[filePath] = fileHash;
-              }
-
-              packageDeps = {
-                files,
-                arguments: runner.getConfigHash()
-              };
-            } catch (error) {
-              // To test this code path:
-              // Delete a project's ".rush/temp/shrinkwrap-deps.json" then run "rush build --verbose"
-              terminal.writeLine(
-                `Unable to calculate incremental state for ${record.operation.name}: ` +
-                  (error as Error).toString()
-              );
-              terminal.writeLine(
-                Colorize.cyan('Rush will proceed without incremental execution and change detection.')
-              );
+            if (!inputsSnapshot || snapshotStartTimeMs === undefined) {
+              logGitWarning = true;
+              continue;
             }
 
             stateMap.set(operation, {
               packageDepsPath,
-              packageDeps,
-              allowSkip: isIncrementalBuildAllowed
+              allowSkip,
+              dependencyChanged: false,
+              inputsUnchanged: false,
+              ...readInputs(record, inputsSnapshot, snapshotStartTimeMs)
             });
           }
 
@@ -153,6 +184,74 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      graph.hooks.extendIteration.tap(
+        PLUGIN_NAME,
+        (
+          changedRecords: ReadonlyMap<Operation, IOperationExecutionResult>,
+          iterationOptions: IOperationGraphIterationOptions
+        ): void => {
+          const { inputsSnapshot } = iterationOptions;
+          if (!inputsSnapshot) {
+            return;
+          }
+          const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+          for (const record of changedRecords.values()) {
+            const skipRecord: ILegacySkipRecord | undefined = stateMap.get(record.operation);
+            if (skipRecord && record.operation.runner?.cacheable) {
+              // What upstream operations recorded in the entry still holds. The record was not dispatched yet, so the
+              // tap at CAPTURE_INPUT_FILES_STAGE captures its input files later, for the newer snapshot.
+              Object.assign(skipRecord, readInputs(record, inputsSnapshot, snapshotStartTimeMs));
+            }
+          }
+        }
+      );
+
+      /**
+       * Reads the inputs of a cacheable operation that its skip record holds from the inputs snapshot.
+       */
+      function readInputs(
+        record: IOperationExecutionResult,
+        inputsSnapshot: IInputsSnapshot,
+        snapshotStartTimeMs: number
+      ): Pick<ILegacySkipRecord, 'packageDeps' | 'inputFilesCheck'> {
+        const { associatedProject, associatedPhase, runner } = record.operation;
+        try {
+          const fileHashes: ReadonlyMap<string, string> = inputsSnapshot.getTrackedFileHashesForOperation(
+            associatedProject,
+            associatedPhase.name
+          );
+
+          const files: Record<string, string> = {};
+          for (const [filePath, fileHash] of fileHashes) {
+            files[filePath] = fileHash;
+          }
+
+          const packageDeps: IProjectDeps = {
+            files,
+            arguments: runner!.getConfigHash()
+          };
+
+          return {
+            packageDeps,
+            inputFilesCheck:
+              record.enabled && !runner!.isNoOp
+                ? { inputsSnapshot, snapshotStartTimeMs, fileHashes }
+                : undefined
+          };
+        } catch (error) {
+          // To test this code path:
+          // Delete a project's ".rush/temp/shrinkwrap-deps.json" then run "rush build --verbose"
+          terminal.writeLine(
+            `Unable to calculate incremental state for ${record.operation.name}: ` +
+              (error as Error).toString()
+          );
+          terminal.writeLine(
+            Colorize.cyan('Rush will proceed without incremental execution and change detection.')
+          );
+          return { packageDeps: undefined, inputFilesCheck: undefined };
+        }
+      }
+
       graph.hooks.beforeExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (
@@ -172,7 +271,14 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           const { associatedProject } = operation;
 
-          const { packageDepsPath, packageDeps, allowSkip } = skipRecord;
+          const { packageDepsPath, packageDeps, allowSkip, dependencyChanged } = skipRecord;
+
+          if (!record.enabled && !dependencyChanged) {
+            // The command doesn't execute this operation, e.g. because of "--only" or because the graph of a
+            // daemon's engine contains every operation in the repo. No dependency changed its outputs in this
+            // iteration either, so the outputs of this operation still match its record.
+            return;
+          }
 
           let lastProjectDeps: IProjectDeps | undefined = undefined;
 
@@ -189,19 +295,19 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             }
           }
 
-          if (allowSkip) {
-            const isPackageUnchanged: boolean = !!(
-              lastProjectDeps &&
-              packageDeps &&
-              packageDeps.arguments === lastProjectDeps.arguments &&
-              _areShallowEqual(packageDeps.files, lastProjectDeps.files)
-            );
+          const isPackageUnchanged: boolean = !!(
+            lastProjectDeps &&
+            packageDeps &&
+            packageDeps.arguments === lastProjectDeps.arguments &&
+            _areShallowEqual(packageDeps.files, lastProjectDeps.files)
+          );
 
-            if (isPackageUnchanged) {
-              return OperationStatus.Skipped;
-            }
+          if (allowSkip && isPackageUnchanged) {
+            return OperationStatus.Skipped;
           }
 
+          skipRecord.inputsUnchanged = isPackageUnchanged;
+
           // TODO: Remove legacyDepsPath with the next major release of Rush
           const legacyDepsPath: string = path.join(associatedProject.projectFolder, 'package-deps.json');
 
@@ -215,8 +321,53 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      // Captured in a late tap, after the taps that can skip the operation, so that the input files of an operation
+      // that does not execute are not read.
+      graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
+        (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+          const inputFilesCheck: IInputFilesCheck | undefined = stateMap.get(
+            record.operation
+          )?.inputFilesCheck;
+          if (!inputFilesCheck || !record.enabled) {
+            return;
+          }
+          // A later command skips the operation if its input files match the recorded ones, so the file is only
+          // written if the input files do not change from the inputs snapshot until the operation has executed.
+          const { inputsSnapshot, snapshotStartTimeMs, fileHashes } = inputFilesCheck;
+          inputFilesCheck.inputFilesState = captureInputFilesState(
+            inputsSnapshot.rootDirectory,
+            fileHashes.keys(),
+            snapshotStartTimeMs
+          );
+          // So that IncrementalExecutionGuardPlugin does not check them as well
+          markInputFilesChecked(record);
+        }
+      );
+
       graph.hooks.afterExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
+        async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+          const skipRecord: ILegacySkipRecord | undefined = stateMap.get(record.operation);
+          if (!skipRecord?.inputFilesCheck) {
+            return;
+          }
+          const { inputsSnapshot, inputFilesState } = skipRecord.inputFilesCheck;
+          skipRecord.inputFilesCheck = undefined;
+          const { status } = record;
+          if (
+            inputFilesState &&
+            (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) &&
+            !isResultUnverifiable(record) &&
+            (await haveOperationInputFilesChangedAsync(record, inputsSnapshot, inputFilesState, getGitPath))
+          ) {
+            markResultUnverifiable(record);
+          }
+        }
+      );
+
+      graph.hooks.afterExecuteOperationAsync.tapPromise(
+        { name: PLUGIN_NAME, stage: RECORD_PACKAGE_DEPS_STAGE },
         async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
           const { status, operation } = record;
 
@@ -225,15 +376,24 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             return;
           }
 
-          const blockSkip: boolean =
-            !skipRecord.allowSkip ||
-            (!changedProjectsOnly &&
-              (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning));
+          // With "--changed-projects-only", consumers ignore changes to the outputs of their dependencies. An
+          // operation that executed although its inputs were unchanged, e.g. in a rebuild, reproduced its
+          // outputs, unless its result is unverifiable, e.g. because its inputs changed while it executed.
+          const outputsChanged: boolean =
+            !changedProjectsOnly &&
+            (!skipRecord.inputsUnchanged || isResultUnverifiable(record)) &&
+            (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning);
+          const blockSkip: boolean = !skipRecord.allowSkip || outputsChanged;
+          // Unlike allowSkip, this doesn't depend on whether the iteration allows skipping, e.g. in a rebuild.
+          const dependencyChanged: boolean = skipRecord.dependencyChanged || outputsChanged;
           if (blockSkip) {
             for (const consumer of operation.consumers) {
               const consumerSkipRecord: ILegacySkipRecord | undefined = stateMap.get(consumer);
               if (consumerSkipRecord) {
                 consumerSkipRecord.allowSkip = false;
+                if (dependencyChanged) {
+                  consumerSkipRecord.dependencyChanged = true;
+                }
               }
             }
           }
@@ -245,6 +405,13 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           const { packageDeps, packageDepsPath } = skipRecord;
 
+          if (wasExecutedIncrementally(record) || isResultUnverifiable(record)) {
+            // The outputs of an incremental command can differ from those of the initial command, and the outputs of
+            // a run whose input files changed while it ran may not match the recorded inputs, so a later command must
+            // not skip the operation.
+            return;
+          }
+
           if (
             status === OperationStatus.NoOp ||
             (packageDeps &&
@@ -263,3 +430,31 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
     });
   }
 }
+
+/**
+ * Core phased command plugin for the incremental strategies other than {@link LegacySkipPlugin}, such as
+ * build cache restoration. Before an operation executes or restores its outputs, it deletes the record of
+ * inputs that {@link LegacySkipPlugin} saved after the operation last succeeded. The outputs may afterwards
+ * belong to other inputs, so a later command without the build cache must execute the operation instead of
+ * skipping it.
+ */
+export class LegacySkipInvalidationPlugin implements IPhasedCommandPlugin {
+  public apply(hooks: PhasedCommandHooks): void {
+    hooks.onGraphCreatedAsync.tap(INVALIDATION_PLUGIN_NAME, (graph) => {
+      graph.hooks.beforeExecuteOperationAsync.tapPromise(
+        // Ahead of every plugin that may restore the outputs and then bail, such as the build cache plugin
+        { name: INVALIDATION_PLUGIN_NAME, stage: -Infinity },
+        async (
+          record: IOperationRunnerContext & IOperationExecutionResult
+        ): Promise<OperationStatus | undefined> => {
+          const { operation } = record;
+          // A disabled operation neither executes nor restores its outputs.
+          if (record.enabled && operation.runner?.cacheable) {
+            await FileSystem.deleteFileAsync(_getPackageDepsPath(operation));
+          }
+          return undefined;
+        }
+      );
+    });
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationEventSink.ts b/libraries/rush-lib/src/logic/operations/OperationEventSink.ts
index d734f764e3c..b94756ea7ac 100644
--- a/libraries/rush-lib/src/logic/operations/OperationEventSink.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationEventSink.ts
@@ -110,6 +110,26 @@ export interface IOperationGraphEventSink {
    */
   onActivity?(text: string, options?: IOperationActivityOptions): void;
 
+  /**
+   * Invoked once when an iteration starts executing, before any of its operations start.
+   *
+   * @remarks
+   * The engine announces an iteration with a `Selected N operations:` listing, which quiet mode omits,
+   * and an `Executing a maximum of N simultaneous processes...` line. A sink that does not implement
+   * this method receives those lines through `onActivity`. A sink that implements it receives them only
+   * through this call, so that a host serving several requests from one iteration can announce each
+   * request's own operations with `_formatIterationStartLines`.
+   *
+   * @param records - Every operation of the iteration, including silent ones.
+   * @param parallelism - The graph's parallelism for the iteration.
+   * @param quietMode - Whether the graph is in quiet mode.
+   */
+  onIterationStarting?(
+    records: ReadonlyArray<IOperationExecutionResult>,
+    parallelism: number,
+    quietMode: boolean
+  ): void;
+
   /**
    * Allocates a reporter channel for a child spawned by the specified operation.
    */
@@ -118,3 +138,35 @@ export interface IOperationGraphEventSink {
     iterationId: number
   ): IOperationChildProcessReporter | undefined;
 }
+
+/**
+ * Renders the lines that announce an iteration: the `Selected N operations:` listing, unless `quietMode`
+ * is set, followed by the `Executing a maximum of N simultaneous processes...` line.
+ *
+ * @param operationNames - The names of the operations to announce, which should not be silent, in any order.
+ * @param parallelism - The graph's parallelism.
+ * @param quietMode - Whether the graph is in quiet mode.
+ * @returns The plain text of each line, in order.
+ *
+ * @internal
+ */
+export function _formatIterationStartLines(
+  operationNames: Iterable<string>,
+  parallelism: number,
+  quietMode: boolean
+): string[] {
+  const sortedNames: string[] = Array.from(operationNames).sort();
+  const lines: string[] = [];
+  if (!quietMode) {
+    const plural: string = sortedNames.length === 1 ? '' : 's';
+    lines.push(`Selected ${sortedNames.length} operation${plural}:`);
+    for (const name of sortedNames) {
+      lines.push(`  ${name}`);
+    }
+    lines.push('');
+  }
+  // For logging purposes, don't confuse the user by suggesting we might run more operations in parallel than are scheduled.
+  const maxSimultaneousProcesses: number = Math.min(sortedNames.length, parallelism);
+  lines.push(`Executing a maximum of ${maxSimultaneousProcesses} simultaneous processes...`);
+  return lines;
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index 129d5c04c5d..3cf1622541d 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -39,6 +39,12 @@ import {
   type ILogFilePaths,
   initializeProjectLogFilesAsync
 } from './ProjectLogWritable';
+import {
+  getIncrementalExecutionGuard,
+  setCommandExecution,
+  type IIncrementalExecutionGuard,
+  type IOperationCommandExecution
+} from './IncrementalExecutionState';
 
 /**
  * @internal
@@ -48,8 +54,18 @@ export interface IOperationExecutionRecordContext {
   streamCollator: StreamCollator | undefined;
   onOperationStateChanged?: (record: OperationExecutionRecord) => void;
   createEnvironment?: (record: OperationExecutionRecord) => IEnvironment;
+  /**
+   * The environment that an operation starts from, before any `createEnvironmentForOperation` tap, when it is not
+   * the environment of the inputs snapshot. The operation's `dependsOnEnvVars` are hashed from it.
+   */
+  getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
   invalidate?: (operations: Iterable<Operation>, reason: string) => void;
   inputsSnapshot: IInputsSnapshot | undefined;
+  /**
+   * The state hash that each operation's record last calculated, kept across iterations. A record reuses its
+   * operation's entry when the entry was calculated from the same inputs, and replaces it otherwise.
+   */
+  stateHashCache?: WeakMap<Operation, IOperationStateHashCacheEntry>;
   maxParallelism: number;
   /** Aborted when the host requests termination of running operations in this iteration. */
   terminateSignal?: AbortSignal;
@@ -64,6 +80,22 @@ export interface IOperationExecutionRecordContext {
   quietMode: boolean;
 }
 
+/**
+ * An operation's state hash and components, with the inputs that they were calculated from.
+ * The state hash is a function of these inputs alone.
+ * @internal
+ */
+export interface IOperationStateHashCacheEntry {
+  readonly local: string;
+  readonly config: string;
+  /**
+   * The name and then the state hash of each dependency record, in the order of the record's dependencies.
+   */
+  readonly dependencyNamesAndHashes: readonly string[];
+  readonly components: IOperationStateHashComponents;
+  readonly hash: string;
+}
+
 /**
  * Context object for the executeAsync() method.
  * @internal
@@ -101,32 +133,32 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
   public shouldRunnerPersist: boolean = true;
 
   /**
-   * This number represents how far away this Operation is from the furthest "root" operation (i.e.
-   * an operation with no consumers). This helps us to calculate the critical path (i.e. the
-   * longest chain of projects which must be executed in order, thereby limiting execution speed
-   * of the entire operation tree.
+   * This number is the total weight of the longest chain of operations from this Operation to a "root"
+   * operation (i.e. an operation with no consumers), including this Operation's own weight. This helps
+   * us to calculate the critical path (i.e. the longest chain of projects which must be executed in
+   * order, thereby limiting execution speed of the entire operation tree.
    *
    * This number is calculated via a memoized depth-first search, and when choosing the next
    * operation to execute, the operation with the highest criticalPathLength is chosen.
    *
-   * Example:
+   * Example, where every operation has a weight of 1:
    * ```
-   *        (0) A
+   *        (1) A
    *             \
-   *          (1) B     C (0)         (applications)
+   *          (2) B     C (1)         (applications)
    *               \   /|\
    *                \ / | \
-   *             (2) D  |  X (1)      (utilities)
+   *             (3) D  |  X (2)      (utilities)
    *                    | / \
    *                    |/   \
-   *                (2) Y     Z (2)   (other utilities)
+   *                (3) Y     Z (3)   (other utilities)
    *
-   * All roots (A & C) have a criticalPathLength of 0.
-   * B has a score of 1, since A depends on it.
-   * D has a score of 2, since we look at the longest chain (e.g D->B->A is longer than D->C)
-   * X has a score of 1, since the only package which depends on it is A
-   * Z has a score of 2, since only X depends on it, and X has a score of 1
-   * Y has a score of 2, since the chain Y->X->C is longer than Y->C
+   * All roots (A & C) have a criticalPathLength of 1, their own weight.
+   * B has a score of 2, since A depends on it.
+   * D has a score of 3, since we look at the longest chain (e.g D->B->A is longer than D->C)
+   * X has a score of 2, since the only package which depends on it is C
+   * Z has a score of 3, since only X depends on it, and X has a score of 2
+   * Y has a score of 3, since the chain Y->X->C is longer than Y->C
    * ```
    *
    * The algorithm is implemented in AsyncOperationQueue.ts as calculateCriticalPathLength()
@@ -174,8 +206,7 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
 
   #collatedWriter: CollatedWriter | undefined = undefined;
   #status: OperationStatus;
-  #stateHash: string | undefined;
-  #stateHashComponents: IOperationStateHashComponents | undefined;
+  #stateHashEntry: IOperationStateHashCacheEntry | undefined;
   #operationStreamClosed: boolean = false;
   #operationCompleted: boolean = false;
 
@@ -202,8 +233,7 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
 
     this.#context = context;
     this.#status = operation.dependencies.size > 0 ? OperationStatus.Waiting : OperationStatus.Ready;
-    this.#stateHash = undefined;
-    this.#stateHashComponents = undefined;
+    this.#stateHashEntry = undefined;
   }
 
   public get name(): string {
@@ -302,6 +332,24 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     return this.#context.eventSink?.createChildProcessReporter?.(this.name, this.iterationId);
   }
 
+  /**
+   * {@inheritdoc IOperationRunnerContext.getIncrementalExecutionGuard}
+   */
+  public getIncrementalExecutionGuard(): IIncrementalExecutionGuard | undefined {
+    return getIncrementalExecutionGuard(this);
+  }
+
+  /**
+   * {@inheritdoc IOperationRunnerContext.reportCommandExecution}
+   */
+  public reportCommandExecution({
+    kind,
+    hasIncrementalCommand,
+    watchesInputs
+  }: IOperationCommandExecution): void {
+    setCommandExecution(this, { kind, hasIncrementalCommand, watchesInputs });
+  }
+
   public get silent(): boolean {
     return !this.enabled || this.runner.silent;
   }
@@ -387,57 +435,82 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
   }
 
   public getStateHash(): string {
-    if (this.#stateHash === undefined) {
-      const { dependencies, local, config } = this.getStateHashComponents();
+    this.#stateHashEntry ??= this.#calculateStateHash();
+    return this.#stateHashEntry.hash;
+  }
 
-      const hasher: crypto.Hash = crypto.createHash('sha1');
-      for (const dep of dependencies) {
-        hasher.update(`${RushConstants.hashDelimiter}${dep}`);
-      }
-      hasher.update(`${RushConstants.hashDelimiter}local=${local}`);
-      hasher.update(`${RushConstants.hashDelimiter}config=${config}`);
+  public getStateHashComponents(): IOperationStateHashComponents {
+    this.#stateHashEntry ??= this.#calculateStateHash();
+    return this.#stateHashEntry.components;
+  }
 
-      const hash: string = hasher.digest('hex');
-      this.#stateHash = hash;
-    }
-    return this.#stateHash;
+  /**
+   * The state hash of this record, with the inputs that it was calculated from.
+   *
+   * @internal
+   */
+  public _getStateHashEntry(): IOperationStateHashCacheEntry {
+    this.#stateHashEntry ??= this.#calculateStateHash();
+    return this.#stateHashEntry;
   }
 
-  public getStateHashComponents(): IOperationStateHashComponents {
-    if (!this.#stateHashComponents) {
-      const { inputsSnapshot } = this.#context;
+  /**
+   * Replaces the state hash of this record before it executes, when the iteration that owns it is extended with
+   * newer inputs (see `IOperationGraph.tryExtendCurrentIteration`).
+   *
+   * @internal
+   */
+  public _setStateHashEntry(entry: IOperationStateHashCacheEntry): void {
+    this.#stateHashEntry = entry;
+  }
 
-      if (!inputsSnapshot) {
-        throw new Error(`Cannot calculate state hash without git.`);
-      }
+  #calculateStateHash(): IOperationStateHashCacheEntry {
+    const { inputsSnapshot, stateHashCache } = this.#context;
 
-      if (this.dependencies.size !== this.operation.dependencies.size) {
-        throw new InternalError(
-          `State hash calculation failed. Dependencies of record do not match the operation.`
-        );
-      }
+    if (!inputsSnapshot) {
+      throw new Error(`Cannot calculate state hash without git.`);
+    }
 
-      // The final state hashes of operation dependencies are factored into the hash to ensure that any
-      // state changes in dependencies will invalidate the cache.
-      const dependencies: string[] = Array.from(this.dependencies, (record) => {
-        return `${record.name}=${record.getStateHash()}`;
-      }).sort();
-
-      const { associatedProject, associatedPhase } = this;
-      // Examples of data in the local state hash:
-      // - Environment variables specified in `dependsOnEnvVars`
-      // - Git hashes of tracked files in the associated project
-      // - Git hash of the shrinkwrap file for the project
-      // - Git hashes of any files specified in `dependsOnAdditionalFiles` (must not be associated with a project)
-      const local: string = inputsSnapshot.getOperationOwnStateHash(associatedProject, associatedPhase.name);
-
-      // Examples of data in the config hash:
-      // - CLI parameters (ShellOperationRunner)
-      const config: string = this.runner.getConfigHash();
-
-      this.#stateHashComponents = { dependencies, local, config };
+    if (this.dependencies.size !== this.operation.dependencies.size) {
+      throw new InternalError(
+        `State hash calculation failed. Dependencies of record do not match the operation.`
+      );
+    }
+
+    // The final state hashes of operation dependencies are factored into the hash to ensure that any
+    // state changes in dependencies will invalidate the cache.
+    const dependencyNamesAndHashes: string[] = [];
+    for (const record of this.dependencies) {
+      dependencyNamesAndHashes.push(record.name, record.getStateHash());
     }
-    return this.#stateHashComponents;
+
+    const { associatedProject, associatedPhase } = this;
+    // Examples of data in the local state hash:
+    // - Environment variables specified in `dependsOnEnvVars`
+    // - Git hashes of tracked files in the associated project
+    // - Git hash of the shrinkwrap file for the project
+    // - Git hashes of any files specified in `dependsOnAdditionalFiles` (must not be associated with a project)
+    const local: string = inputsSnapshot.getOperationOwnStateHash(
+      associatedProject,
+      associatedPhase.name,
+      this.#context.getOperationEnvironment?.(this.operation)
+    );
+
+    // Examples of data in the config hash:
+    // - CLI parameters (ShellOperationRunner)
+    const config: string = this.runner.getConfigHash();
+
+    const previousEntry: IOperationStateHashCacheEntry | undefined = stateHashCache?.get(this.operation);
+    const entry: IOperationStateHashCacheEntry = calculateOperationStateHashEntry(
+      dependencyNamesAndHashes,
+      local,
+      config,
+      previousEntry
+    );
+    if (entry !== previousEntry) {
+      stateHashCache?.set(this.operation, entry);
+    }
+    return entry;
   }
 
   /**
@@ -595,3 +668,60 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     }
   }
 }
+
+/**
+ * Calculates the state hash of an operation from the names and state hashes of its dependencies (in the order of the
+ * operation's dependencies), its local state hash and its configuration hash. Returns `previousEntry` if it was
+ * calculated from the same inputs.
+ *
+ * @internal
+ */
+export function calculateOperationStateHashEntry(
+  dependencyNamesAndHashes: readonly string[],
+  local: string,
+  config: string,
+  previousEntry: IOperationStateHashCacheEntry | undefined
+): IOperationStateHashCacheEntry {
+  if (
+    previousEntry &&
+    previousEntry.local === local &&
+    previousEntry.config === config &&
+    haveSameItems(previousEntry.dependencyNamesAndHashes, dependencyNamesAndHashes)
+  ) {
+    // Nothing else goes into the hash, so the earlier entry is what this calculation would produce
+    return previousEntry;
+  }
+
+  const dependencies: string[] = [];
+  for (let index: number = 0; index < dependencyNamesAndHashes.length; index += 2) {
+    dependencies.push(`${dependencyNamesAndHashes[index]}=${dependencyNamesAndHashes[index + 1]}`);
+  }
+  dependencies.sort();
+
+  const hasher: crypto.Hash = crypto.createHash('sha1');
+  for (const dep of dependencies) {
+    hasher.update(`${RushConstants.hashDelimiter}${dep}`);
+  }
+  hasher.update(`${RushConstants.hashDelimiter}local=${local}`);
+  hasher.update(`${RushConstants.hashDelimiter}config=${config}`);
+
+  return {
+    local,
+    config,
+    dependencyNamesAndHashes,
+    components: { dependencies, local, config },
+    hash: hasher.digest('hex')
+  };
+}
+
+function haveSameItems(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) {
+    return false;
+  }
+  for (let index: number = 0; index < a.length; index++) {
+    if (a[index] !== b[index]) {
+      return false;
+    }
+  }
+  return true;
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index a3ed25bb1c4..4d624a5aa31 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -15,21 +15,33 @@ import { NewlineKind, Async, InternalError, AlreadyReportedError } from '@rushst
 import { AsyncOperationQueue, type IOperationSortFunction } from './AsyncOperationQueue';
 import type { Operation } from './Operation';
 import { OperationStatus, SUCCESS_STATUSES, TERMINAL_STATUSES } from './OperationStatus';
-import type { IOperationGraphEventSink } from './OperationEventSink';
+import { _formatIterationStartLines, type IOperationGraphEventSink } from './OperationEventSink';
 import {
+  calculateOperationStateHashEntry,
   type IOperationExecutionContext,
   type IOperationExecutionRecordContext,
+  type IOperationStateHashCacheEntry,
   OperationExecutionRecord
 } from './OperationExecutionRecord';
-import type { IExecutionResult } from './IOperationExecutionResult';
+import type {
+  IConfigurableOperation,
+  IExecutionResult,
+  IOperationStateHashComponents
+} from './IOperationExecutionResult';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import type { IEnvironment } from '../../utilities/Utilities';
 import type { IStopwatchResult } from '../../utilities/Stopwatch';
-import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
+import type {
+  IOperationGraph,
+  IOperationGraphExtensionOptions,
+  IOperationGraphExtensionResult,
+  IOperationGraphIterationOptions
+} from './IOperationGraph';
 import { OperationGraphHooks } from '../../pluginFramework/OperationGraphHooks';
 import { type Parallelism, coerceParallelism, getNumberOfCores } from './ParseParallelism';
 import { measureAsyncFn, measureFn } from '../../utilities/performance';
-import type { ITelemetryData, ITelemetryOperationResult } from '../Telemetry';
+import type { ITelemetryData } from '../Telemetry';
+import { createPhasedTelemetryData } from './PhasedCommandTelemetry';
 
 export interface IOperationGraphTelemetry {
   initialExtraData: Record<string, unknown>;
@@ -96,6 +108,23 @@ interface IExecutionIterationContext extends IOperationExecutionRecordContext {
 
   startTime?: number;
 
+  /** See `IOperationGraphIterationOptions.isIncrementalBuildAllowed`. */
+  isIncrementalBuildAllowed?: boolean;
+
+  getOperationRequestId?: (operation: Operation) => string | undefined;
+
+  /** See `IOperationGraphIterationOptions.holdUnneededOperations`. */
+  holdUnneededOperations?: boolean;
+
+  /**
+   * The records that the iteration's enabled operations need: their own records, and the records of the operations
+   * that they depend on. Set when the iteration starts, if it holds the others, and grows when requests join it.
+   */
+  neededRecords?: Set<OperationExecutionRecord>;
+
+  /** The queue of the iteration, once the iteration starts. */
+  executionQueue?: AsyncOperationQueue;
+
   completedOperations: number;
   totalOperations: number;
 }
@@ -117,25 +146,6 @@ class OperationRunnerCloseError extends Error {
   }
 }
 
-/**
- * Telemetry data for a phased execution
- */
-interface IPhasedExecutionTelemetry {
-  [key: string]: string | number | boolean;
-  isInitial: boolean;
-  isWatch: boolean;
-
-  countAll: number;
-  countSuccess: number;
-  countSuccessWithWarnings: number;
-  countFailure: number;
-  countBlocked: number;
-  countFromCache: number;
-  countSkipped: number;
-  countNoOp: number;
-  countAborted: number;
-}
-
 const PERF_PREFIX: 'rush:executionManager' = 'rush:executionManager';
 
 /**
@@ -150,6 +160,82 @@ const prioritySort: IOperationSortFunction = (
   return a.criticalPathLength! - b.criticalPathLength!;
 };
 
+function getIterationOptions(iteration: IExecutionIterationContext): IOperationGraphIterationOptions {
+  return {
+    inputsSnapshot: iteration.inputsSnapshot,
+    startTime: iteration.startTime,
+    getOperationEnvironment: iteration.getOperationEnvironment,
+    isIncrementalBuildAllowed: iteration.isIncrementalBuildAllowed,
+    getOperationRequestId: iteration.getOperationRequestId,
+    holdUnneededOperations: iteration.holdUnneededOperations
+  };
+}
+
+function getRecord(
+  records: ReadonlyMap<Operation, OperationExecutionRecord>,
+  operation: Operation
+): OperationExecutionRecord {
+  const record: OperationExecutionRecord | undefined = records.get(operation);
+  if (!record) {
+    throw new InternalError(`The operation "${operation.name}" is not in the iteration.`);
+  }
+  return record;
+}
+
+/**
+ * Returns the given records and the records of the operations that they depend on, directly or indirectly.
+ */
+function collectNeededRecords(
+  records: ReadonlyMap<Operation, OperationExecutionRecord>,
+  roots: Iterable<OperationExecutionRecord>
+): Set<OperationExecutionRecord> {
+  const needed: Set<OperationExecutionRecord> = new Set(roots);
+  for (const record of needed) {
+    for (const dependency of record.operation.dependencies) {
+      needed.add(getRecord(records, dependency));
+    }
+  }
+  return needed;
+}
+
+/**
+ * Whether the queue has not dispatched the record yet.
+ */
+function isUndispatched(record: OperationExecutionRecord): boolean {
+  return record.status === OperationStatus.Waiting || record.status === OperationStatus.Ready;
+}
+
+function refuseExtension(reason: string): IOperationGraphExtensionResult {
+  return { extended: false, reason, changedOperations: new Set() };
+}
+
+/**
+ * A record of the executing iteration as `configureIteration` sees it when the iteration is planned again for a
+ * request that joins it. Changes to it are applied to the record only if the iteration is extended.
+ */
+class ConfigurableOperation implements IConfigurableOperation {
+  public readonly operation: Operation;
+  public readonly metadataFolderPath: string;
+  public enabled: boolean;
+  public shouldRunnerPersist: boolean = true;
+  readonly #stateHashEntry: IOperationStateHashCacheEntry;
+
+  public constructor(record: OperationExecutionRecord, stateHashEntry: IOperationStateHashCacheEntry) {
+    this.operation = record.operation;
+    this.metadataFolderPath = record.metadataFolderPath;
+    this.enabled = !!record.operation.enabled;
+    this.#stateHashEntry = stateHashEntry;
+  }
+
+  public getStateHash(): string {
+    return this.#stateHashEntry.hash;
+  }
+
+  public getStateHashComponents(): IOperationStateHashComponents {
+    return this.#stateHashEntry.components;
+  }
+}
+
 /**
  * Sorts operations lexicographically by their name.
  * @param a - The first operation to compare
@@ -195,6 +281,12 @@ export class OperationGraph implements IOperationGraph {
    */
   readonly #deferredInvalidations: Map<OperationExecutionRecord, string | undefined> = new Map();
 
+  /**
+   * Each operation's last calculated state hash. An iteration reuses an operation's hash when its inputs
+   * are unchanged, rather than hashing every operation of the graph again.
+   */
+  readonly #stateHashCache: WeakMap<Operation, IOperationStateHashCacheEntry> = new WeakMap();
+
   #currentIteration: IExecutionIterationContext | undefined = undefined;
   #scheduledIteration: IExecutionIterationContext | undefined = undefined;
 
@@ -501,6 +593,181 @@ export class OperationGraph implements IOperationGraph {
     }
   }
 
+  /**
+   * {@inheritDoc IOperationGraph.retainHeldOperations}
+   */
+  public retainHeldOperations(): (() => void) | undefined {
+    const iteration: IExecutionIterationContext | undefined = this.#currentIteration;
+    if (
+      !iteration?.executionQueue ||
+      iteration.executionQueue.isDone ||
+      !iteration.neededRecords ||
+      iteration.abortController.signal.aborted
+    ) {
+      return undefined;
+    }
+    return iteration.executionQueue.retainHeldOperations();
+  }
+
+  /**
+   * {@inheritDoc IOperationGraph.tryExtendCurrentIteration}
+   */
+  public tryExtendCurrentIteration(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult {
+    const iteration: IExecutionIterationContext | undefined = this.#currentIteration;
+    const { executionQueue, neededRecords, inputsSnapshot: iterationSnapshot } = iteration ?? {};
+    if (!iteration || !executionQueue?.isDispatching || !neededRecords) {
+      return refuseExtension('No iteration is dispatching operations while it holds the unneeded ones.');
+    }
+    if (iteration.abortController.signal.aborted) {
+      return refuseExtension('The iteration was aborted.');
+    }
+    if (iteration.isIncrementalBuildAllowed === false) {
+      return refuseExtension('The iteration is not incremental.');
+    }
+    if (!iterationSnapshot) {
+      return refuseExtension('The iteration has no inputs snapshot.');
+    }
+
+    const { records } = iteration;
+    const { inputsSnapshot } = options;
+    const joiningRecords: Set<OperationExecutionRecord> = collectNeededRecords(
+      records,
+      Array.from(options.neededOperations, (operation: Operation) => getRecord(records, operation))
+    );
+    const invalidatedOperations: Set<Operation> = new Set(options.invalidatedOperations);
+    for (const operation of invalidatedOperations) {
+      if (this.resultByOperation.get(operation) === records.get(operation)) {
+        // Invalidating it would abort the iteration
+        return refuseExtension(`"${operation.name}" was invalidated after it ran in the iteration.`);
+      }
+    }
+
+    const getLocalStateHash = (record: OperationExecutionRecord): string =>
+      inputsSnapshot.getOperationOwnStateHash(
+        record.associatedProject,
+        record.associatedPhase.name,
+        iteration.getOperationEnvironment?.(record.operation)
+      );
+
+    // An operation that was dispatched before the joining request's inputs changed has no result for it
+    for (const record of joiningRecords) {
+      if (!isUndispatched(record)) {
+        const { local, config } = record._getStateHashEntry();
+        if (
+          invalidatedOperations.has(record.operation) ||
+          getLocalStateHash(record) !== local ||
+          record.runner.getConfigHash() !== config
+        ) {
+          return refuseExtension(`"${record.name}" started before its inputs or outputs changed.`);
+        }
+      }
+    }
+
+    // The state hashes of the operations that were not dispatched yet, under the newer snapshot. Those of the
+    // dispatched operations are unchanged.
+    const stateHashEntries: Map<OperationExecutionRecord, IOperationStateHashCacheEntry> = new Map();
+    function getStateHashEntry(record: OperationExecutionRecord): IOperationStateHashCacheEntry {
+      let entry: IOperationStateHashCacheEntry | undefined = stateHashEntries.get(record);
+      if (!entry) {
+        entry = record._getStateHashEntry();
+        if (isUndispatched(record)) {
+          const dependencyNamesAndHashes: string[] = [];
+          for (const dependency of record.operation.dependencies) {
+            const dependencyRecord: OperationExecutionRecord = getRecord(records, dependency);
+            dependencyNamesAndHashes.push(dependencyRecord.name, getStateHashEntry(dependencyRecord).hash);
+          }
+          entry = calculateOperationStateHashEntry(
+            dependencyNamesAndHashes,
+            getLocalStateHash(record),
+            record.runner.getConfigHash(),
+            entry
+          );
+        }
+        stateHashEntries.set(record, entry);
+      }
+      return entry;
+    }
+
+    // Plan the iteration again, as a new iteration would be planned now
+    const plan: Map<Operation, ConfigurableOperation> = new Map();
+    const startedOperations: Set<Operation> = new Set();
+    for (const [operation, record] of records) {
+      plan.set(operation, new ConfigurableOperation(record, getStateHashEntry(record)));
+      if (!isUndispatched(record)) {
+        startedOperations.add(operation);
+      }
+    }
+    const lastStates: Map<Operation, OperationExecutionRecord> = new Map(this.resultByOperation);
+    for (const operation of invalidatedOperations) {
+      lastStates.delete(operation);
+    }
+    const extensionOptions: IOperationGraphIterationOptions = {
+      ...getIterationOptions(iteration),
+      inputsSnapshot,
+      startedOperations
+    };
+    this.hooks.configureIteration.call(plan, lastStates, extensionOptions);
+
+    const enabledRecords: OperationExecutionRecord[] = [];
+    for (const [operation, record] of records) {
+      if (plan.get(operation)!.enabled && !record.enabled) {
+        if (isUndispatched(record)) {
+          enabledRecords.push(record);
+        } else if (joiningRecords.has(record)) {
+          return refuseExtension(`"${record.name}" needs to run, but was dispatched without running.`);
+        }
+      }
+    }
+    options.beforeCommit?.();
+
+    // Commit
+    if (invalidatedOperations.size > 0) {
+      this.invalidateOperations(invalidatedOperations, options.invalidationReason);
+    }
+    const changedRecords: Map<Operation, OperationExecutionRecord> = new Map();
+    for (const [record, entry] of stateHashEntries) {
+      if (entry !== record._getStateHashEntry()) {
+        record._setStateHashEntry(entry);
+        this.#stateHashCache.set(record.operation, entry);
+        changedRecords.set(record.operation, record);
+      }
+    }
+    for (const record of enabledRecords) {
+      const configuration: ConfigurableOperation = plan.get(record.operation)!;
+      record.enabled = true;
+      record.shouldRunnerPersist = configuration.shouldRunnerPersist;
+      changedRecords.set(record.operation, record);
+    }
+
+    const releasedRecords: OperationExecutionRecord[] = [];
+    for (const record of collectNeededRecords(records, [...joiningRecords, ...enabledRecords])) {
+      if (!neededRecords.has(record)) {
+        neededRecords.add(record);
+        releasedRecords.push(record);
+      }
+    }
+    let totalOperations: number = 0;
+    for (const record of records.values()) {
+      if (!record.silent) {
+        totalOperations++;
+      }
+    }
+    iteration.totalOperations = totalOperations;
+
+    try {
+      this.hooks.extendIteration.call(changedRecords, extensionOptions);
+    } catch (error) {
+      // The records may not be prepared for their new state hashes
+      iteration.abortController.abort();
+      throw error;
+    }
+
+    const changedOperations: Set<Operation> = new Set(changedRecords.keys());
+    executionQueue.prioritizeOperations(Array.from(joiningRecords).filter(isUndispatched));
+    executionQueue.releaseHeldOperations(releasedRecords);
+    return { extended: true, changedOperations };
+  }
+
   public deleteResults(operations: Iterable<Operation>): void {
     if (this.#currentIteration || this.#scheduledIteration) {
       throw new Error('Cannot delete results of an executing or prepared graph.');
@@ -691,9 +958,22 @@ export class OperationGraph implements IOperationGraph {
     const getInputsSnapshotAsync: (() => Promise<IInputsSnapshot | undefined>) | undefined =
       this.#getInputsSnapshotAsync;
 
-    const { startTime = performance.now(), inputsSnapshot = await getInputsSnapshotAsync?.() } =
-      iterationOptions;
-    const iterationOptionsForCallbacks: IOperationGraphIterationOptions = { startTime, inputsSnapshot };
+    const {
+      startTime = performance.now(),
+      inputsSnapshot = await getInputsSnapshotAsync?.(),
+      getOperationEnvironment,
+      isIncrementalBuildAllowed,
+      getOperationRequestId,
+      holdUnneededOperations
+    } = iterationOptions;
+    const iterationOptionsForCallbacks: IOperationGraphIterationOptions = {
+      startTime,
+      inputsSnapshot,
+      getOperationEnvironment,
+      isIncrementalBuildAllowed,
+      getOperationRequestId,
+      holdUnneededOperations
+    };
 
     const { hooks } = this;
 
@@ -719,7 +999,9 @@ export class OperationGraph implements IOperationGraph {
     const graph: OperationGraph = this;
 
     function createEnvironmentForOperation(record: OperationExecutionRecord): IEnvironment {
-      return hooks.createEnvironmentForOperation.call({ ...process.env }, record);
+      const baseEnvironment: Readonly<Record<string, string | undefined>> =
+        getOperationEnvironment?.(record.operation) ?? process.env;
+      return hooks.createEnvironmentForOperation.call({ ...baseEnvironment }, record);
     }
 
     const terminateController: AbortController | undefined = this.#supportsTerminateRunning
@@ -736,9 +1018,14 @@ export class OperationGraph implements IOperationGraph {
       streamCollator,
       terminal,
       inputsSnapshot,
+      isIncrementalBuildAllowed,
+      stateHashCache: this.#stateHashCache,
       maxParallelism: this.#maxParallelism,
       onOperationStateChanged: undefined,
       createEnvironment: createEnvironmentForOperation,
+      getOperationEnvironment,
+      getOperationRequestId,
+      holdUnneededOperations,
       invalidate: graph.invalidateOperations.bind(graph),
       get debugMode(): boolean {
         return graph.debugMode;
@@ -894,19 +1181,39 @@ export class OperationGraph implements IOperationGraph {
     const { hooks } = this;
     const graph: OperationGraph = this;
 
-    const { abortController, records: executionRecords, terminal, totalOperations } = iterationContext;
+    const { abortController, records: executionRecords, terminal } = iterationContext;
 
     const isInitial: boolean = this.resultByOperation.size === 0;
 
-    const iterationOptions: IOperationGraphIterationOptions = {
-      inputsSnapshot: iterationContext.inputsSnapshot,
-      startTime: iterationContext.startTime
-    };
+    const iterationOptions: IOperationGraphIterationOptions = getIterationOptions(iterationContext);
+
+    let heldRecords: OperationExecutionRecord[] | undefined;
+    if (iterationContext.holdUnneededOperations) {
+      const enabledRecords: OperationExecutionRecord[] = [];
+      for (const record of executionRecords.values()) {
+        if (record.operation.enabled !== false) {
+          enabledRecords.push(record);
+        }
+      }
+      const neededRecords: Set<OperationExecutionRecord> = collectNeededRecords(
+        executionRecords,
+        enabledRecords
+      );
+      iterationContext.neededRecords = neededRecords;
+      heldRecords = [];
+      for (const record of executionRecords.values()) {
+        if (!neededRecords.has(record)) {
+          heldRecords.push(record);
+        }
+      }
+    }
 
     const executionQueue: AsyncOperationQueue = new AsyncOperationQueue(
       executionRecords.values(),
-      prioritySort
+      prioritySort,
+      heldRecords
     );
+    iterationContext.executionQueue = executionQueue;
 
     const abortSignal: AbortSignal = abortController.signal;
 
@@ -944,31 +1251,24 @@ export class OperationGraph implements IOperationGraph {
     };
 
     const { eventSink } = this;
-    if (!this.quietMode) {
-      const plural: string = totalOperations === 1 ? '' : 's';
-      const selectedLine: string = `Selected ${totalOperations} operation${plural}:`;
-      terminal.writeStdoutLine(selectedLine);
-      eventSink?.onActivity?.(selectedLine);
-      const nonSilentOperations: string[] = [];
-      for (const record of executionRecords.values()) {
-        if (!record.silent) {
-          nonSilentOperations.push(record.name);
-        }
+    const { parallelism, quietMode } = this;
+    const nonSilentOperations: string[] = [];
+    for (const record of executionRecords.values()) {
+      if (!record.silent) {
+        nonSilentOperations.push(record.name);
       }
-      nonSilentOperations.sort();
-      for (const name of nonSilentOperations) {
-        terminal.writeStdoutLine(`  ${name}`);
-        eventSink?.onActivity?.(`  ${name}`);
+    }
+    // A sink that announces the iteration itself does not also receive the announcement as activity.
+    const sinkAnnouncesIteration: boolean = eventSink?.onIterationStarting !== undefined;
+    for (const line of _formatIterationStartLines(nonSilentOperations, parallelism, quietMode)) {
+      terminal.writeStdoutLine(line);
+      if (!sinkAnnouncesIteration) {
+        eventSink?.onActivity?.(line);
       }
-      terminal.writeStdoutLine('');
-      eventSink?.onActivity?.('');
     }
-
-    const maxSimultaneousProcesses: number = Math.min(totalOperations, this.parallelism);
-    // For logging purposes, don't confuse the user by suggesting we might run more operations in parallel than are scheduled.
-    const parallelismLine: string = `Executing a maximum of ${maxSimultaneousProcesses} simultaneous processes...`;
-    terminal.writeStdoutLine(parallelismLine);
-    eventSink?.onActivity?.(parallelismLine);
+    if (eventSink?.onIterationStarting) {
+      eventSink.onIterationStarting([...executionRecords.values()], parallelism, quietMode);
+    }
 
     let bailStatus: OperationStatus | undefined | void;
     try {
@@ -1010,6 +1310,20 @@ export class OperationGraph implements IOperationGraph {
         }
       }
     } else {
+      // Held operations are dispatched on abort, so that they finish as aborted
+      const releaseHeldOperations = (): void => executionQueue.releaseHeldOperations();
+      abortSignal.addEventListener('abort', releaseHeldOperations, { once: true });
+      if (abortSignal.aborted) {
+        releaseHeldOperations();
+      }
+      try {
+        await dispatchOperationsAsync();
+      } finally {
+        abortSignal.removeEventListener('abort', releaseHeldOperations);
+      }
+    }
+
+    async function dispatchOperationsAsync(): Promise<void> {
       await measureAsyncFn(`${PERF_PREFIX}:executeOperationsAsync`, async () => {
         await Async.forEachAsync(
           executionQueue,
@@ -1021,9 +1335,11 @@ export class OperationGraph implements IOperationGraph {
               state.hasAnyAborted = true;
               executionQueue.complete(record);
             } else {
-              const lastState: OperationExecutionRecord | undefined = state.resultByOperation.get(
-                record.operation
-              );
+              // A non-incremental iteration runs each operation as a fresh `rush rebuild` process would.
+              const lastState: OperationExecutionRecord | undefined =
+                iterationContext.isIncrementalBuildAllowed === false
+                  ? undefined
+                  : state.resultByOperation.get(record.operation);
               await record.executeAsync(lastState, executionContext);
             }
           },
@@ -1031,9 +1347,9 @@ export class OperationGraph implements IOperationGraph {
             // In weighted mode, concurrency represents the total "unit budget", not the max number of tasks.
             // Do not cap by totalOperations, since that would incorrectly shrink the unit budget and
             // reduce parallelism for operations with weight > 1.
-            concurrency: this.parallelism,
+            concurrency: graph.parallelism,
             weighted: true,
-            allowOversubscription: this.allowOversubscription
+            allowOversubscription: graph.allowOversubscription
           }
         );
       });
@@ -1104,28 +1420,6 @@ export class OperationGraph implements IOperationGraph {
     const telemetry: IOperationGraphTelemetry | undefined = this.#telemetry;
     if (telemetry) {
       const logEntry: ITelemetryData = measureFn(`${PERF_PREFIX}:prepareTelemetry`, () => {
-        const isWatch: boolean = this.#isWatch;
-        const jsonOperationResults: Record<string, ITelemetryOperationResult> = {};
-
-        const durationInSeconds: number = (performance.now() - (iterationContext.startTime ?? 0)) / 1000;
-
-        const extraData: IPhasedExecutionTelemetry = {
-          ...telemetry.initialExtraData,
-          isWatch,
-          // Fields specific to the current operation set
-          isInitial,
-
-          countAll: 0,
-          countSuccess: 0,
-          countSuccessWithWarnings: 0,
-          countFailure: 0,
-          countBlocked: 0,
-          countFromCache: 0,
-          countSkipped: 0,
-          countNoOp: 0,
-          countAborted: 0
-        };
-
         let changedProjectsOnly: boolean = false;
         for (const operation of executionRecords.keys()) {
           if (operation.enabled === 'ignore-dependency-changes') {
@@ -1134,93 +1428,23 @@ export class OperationGraph implements IOperationGraph {
           }
         }
 
-        if (telemetry.changedProjectsOnlyKey) {
-          // Overwrite this value since we allow changing it at runtime.
-          extraData[telemetry.changedProjectsOnlyKey] = changedProjectsOnly;
-        }
-
-        const nonSilentDependenciesByOperation: Map<Operation, Set<string>> = new Map();
-        function getNonSilentDependencies(operation: Operation): ReadonlySet<string> {
-          let realDependencies: Set<string> | undefined = nonSilentDependenciesByOperation.get(operation);
-          if (!realDependencies) {
-            realDependencies = new Set();
-            nonSilentDependenciesByOperation.set(operation, realDependencies);
-            for (const dependency of operation.dependencies) {
-              const dependencyRecord: OperationExecutionRecord | undefined = executionRecords.get(dependency);
-              if (dependencyRecord?.silent) {
-                for (const deepDependency of getNonSilentDependencies(dependency)) {
-                  realDependencies.add(deepDependency);
-                }
-              } else {
-                realDependencies.add(dependency.name!);
-              }
-            }
-          }
-          return realDependencies;
-        }
-
-        for (const [operation, operationResult] of executionRecords) {
-          if (operationResult.silent) {
-            // Architectural operation. Ignore.
-            continue;
-          }
-
-          const { _operationMetadataManager: operationMetadataManager } = operationResult;
-
-          const { startTime, endTime } = operationResult.stopwatch;
-          jsonOperationResults[operation.name!] = {
-            startTimestampMs: startTime,
-            endTimestampMs: endTime,
-            nonCachedDurationMs: operationResult.nonCachedDurationMs,
-            wasExecutedOnThisMachine: operationMetadataManager?.wasCobuilt !== true,
-            result: operationResult.status,
-            dependencies: Array.from(getNonSilentDependencies(operation)).sort()
-          };
-
-          extraData.countAll++;
-          switch (operationResult.status) {
-            case OperationStatus.Success:
-              extraData.countSuccess++;
-              break;
-            case OperationStatus.SuccessWithWarning:
-              extraData.countSuccessWithWarnings++;
-              break;
-            case OperationStatus.Failure:
-              extraData.countFailure++;
-              break;
-            case OperationStatus.Blocked:
-              extraData.countBlocked++;
-              break;
-            case OperationStatus.FromCache:
-              extraData.countFromCache++;
-              break;
-            case OperationStatus.Skipped:
-              extraData.countSkipped++;
-              break;
-            case OperationStatus.NoOp:
-              extraData.countNoOp++;
-              break;
-            case OperationStatus.Aborted:
-              extraData.countAborted++;
-              break;
-            default:
-              // Do nothing.
-              break;
-          }
-        }
-
-        const innerLogEntry: ITelemetryData = {
-          name: telemetry.nameForLog,
-          durationInSeconds,
-          result: status === OperationStatus.Success ? 'Succeeded' : 'Failed',
-          extraData,
-          operationResults: jsonOperationResults
-        };
-
-        return innerLogEntry;
+        return createPhasedTelemetryData({
+          nameForLog: telemetry.nameForLog,
+          initialExtraData: telemetry.initialExtraData,
+          changedProjectsOnlyKey: telemetry.changedProjectsOnlyKey,
+          changedProjectsOnly,
+          isWatch: this.#isWatch,
+          isInitial,
+          durationInSeconds: (performance.now() - (iterationContext.startTime ?? 0)) / 1000,
+          succeeded: status === OperationStatus.Success,
+          records: executionRecords
+        });
       });
 
-      measureFn(`${PERF_PREFIX}:beforeLog`, () => this.hooks.beforeLog.call(logEntry));
+      measureFn(`${PERF_PREFIX}:beforeLog`, () => {
+        this.hooks.beforeLogRequest.call(logEntry);
+        this.hooks.beforeLog.call(logEntry);
+      });
       telemetry.log(logEntry);
     }
 
@@ -1390,8 +1614,13 @@ function _handleOperationFromCache(
  * Handle skipped operation.
  */
 function _handleOperationSkipped(record: OperationExecutionRecord, context: IStatefulExecutionContext): void {
-  // Do not set resultByOperation here. "Skipped" means the operation was not executed,
-  // so it should not be considered the last *execution* result.
+  if (record.enabled) {
+    // The operation was selected to execute, and a plugin (e.g. change detection) reported that its outputs are
+    // already up to date for its current state hash. Keep this as its last result, so that a long-lived graph
+    // (e.g. the Rush daemon) can reuse it while the state hash is unchanged instead of checking it again.
+    context.resultByOperation.set(record.operation, record);
+  }
+  // Otherwise, the operation was not executed, so it should not be considered the last *execution* result.
   if (!record.silent) {
     record.eventSink?.onActivity?.(`"${record.name}" was skipped.`, { operationId: record.name });
     record.collatedWriter.terminal.writeStdoutLine(Colorize.green(`"${record.name}" was skipped.`));
diff --git a/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts b/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
new file mode 100644
index 00000000000..820c93738a4
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
@@ -0,0 +1,133 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { Executable, Path } from '@rushstack/node-core-library';
+
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import {
+  haveInputFilesChanged,
+  haveSnapshotHashesChangedAsync,
+  hasUntrackedGitFiles,
+  type IInputFilesState
+} from './InputFilesStatSignature';
+
+/**
+ * Returns a function that returns the path of the Git executable, if it is found. The path is resolved when the
+ * function is first called.
+ */
+export function createGitPathGetter(): () => string | undefined {
+  let gitPath: string | undefined;
+  let isGitPathResolved: boolean = false;
+  return (): string | undefined => {
+    if (!isGitPathResolved) {
+      gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
+      isGitPathResolved = true;
+    }
+    return gitPath;
+  };
+}
+
+/**
+ * Returns the start of the window in which an operation's input files may have changed after the inputs snapshot
+ * read them: when the snapshot began reading the working tree, or, if that is not known, the current time. Call it
+ * when the iteration begins, before any of its operations execute.
+ */
+export function getSnapshotStartTimeMs(inputsSnapshot: IInputsSnapshot): number {
+  return inputsSnapshot.workingTreeReadStartTimeMs ?? Date.now();
+}
+
+/**
+ * Returns the absolute paths of the folders that an operation's command writes in its project: its metadata folder and
+ * its output folders.
+ */
+function getOutputFolderPaths(record: IOperationExecutionResult): string[] {
+  const { operation, metadataFolderPath } = record;
+  const { projectFolder } = operation.associatedProject;
+  return [metadataFolderPath, ...(operation.settings?.outputFolderNames ?? [])].map((folderName: string) =>
+    path.resolve(projectFolder, folderName)
+  );
+}
+
+export interface IInputFilesChangeCheckOptions {
+  readonly inputFilesState: IInputFilesState;
+  readonly snapshotHashes: ReadonlyMap<string, string> | undefined;
+  readonly getGitPath: () => string | undefined;
+  readonly isNewInput: (newEntryPaths: ReadonlyArray<string>) => boolean;
+}
+
+export type InputFilesChangeKind = 'none' | 'snapshot-hashes' | 'file-state';
+
+/**
+ * Returns how an operation's input files changed after the inputs snapshot read them, if they changed.
+ */
+export async function getInputFilesChangeKindSinceSnapshotAsync({
+  inputFilesState,
+  snapshotHashes,
+  getGitPath,
+  isNewInput
+}: IInputFilesChangeCheckOptions): Promise<InputFilesChangeKind> {
+  const { rootDirectory, filesChangedDuringSnapshot } = inputFilesState;
+  if (
+    filesChangedDuringSnapshot.length > 0 &&
+    (await haveSnapshotHashesChangedAsync(
+      getGitPath(),
+      rootDirectory,
+      filesChangedDuringSnapshot,
+      snapshotHashes
+    ))
+  ) {
+    return 'snapshot-hashes';
+  }
+  return haveInputFilesChanged(inputFilesState, isNewInput) ? 'file-state' : 'none';
+}
+
+/**
+ * Returns true if an operation's input files changed after the inputs snapshot read them.
+ */
+export async function haveInputFilesChangedSinceSnapshotAsync(
+  options: IInputFilesChangeCheckOptions
+): Promise<boolean> {
+  return (await getInputFilesChangeKindSinceSnapshotAsync(options)) !== 'none';
+}
+
+/**
+ * Returns true if an operation's input files changed after the inputs snapshot read them: a file was deleted before
+ * their state was captured, or, since then, a file was modified, deleted or replaced, or a potential input file was
+ * created in a folder that holds its input files, or a file was saved after Git hashed it.
+ */
+export async function haveOperationInputFilesChangedAsync(
+  record: IOperationExecutionResult,
+  inputsSnapshot: IInputsSnapshot,
+  inputFilesState: IInputFilesState,
+  getGitPath: () => string | undefined
+): Promise<boolean> {
+  const { rootDirectory } = inputFilesState;
+  const outputFolderPaths: string[] = getOutputFolderPaths(record);
+  const isNewInput = (newEntryPaths: ReadonlyArray<string>): boolean => {
+    // E.g. the output folder that the first run of the operation created
+    const candidatePaths: string[] = newEntryPaths.filter(
+      (entryPath: string) =>
+        !outputFolderPaths.some((folderPath: string) => Path.isUnderOrEqual(entryPath, folderPath))
+    );
+    if (candidatePaths.length === 0) {
+      return false;
+    }
+    const gitPath: string | undefined = getGitPath();
+    // Without Git it cannot be told whether the new entries are ignored, so they count as inputs.
+    return (
+      !gitPath ||
+      hasUntrackedGitFiles(gitPath, rootDirectory, candidatePaths, outputFolderPaths, inputsSnapshot.hashes)
+    );
+  };
+  const { associatedProject: project, associatedPhase: phase } = record.operation;
+  return await haveInputFilesChangedSinceSnapshotAsync({
+    inputFilesState,
+    snapshotHashes: inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name),
+    getGitPath,
+    isNewInput
+  });
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts b/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts
index 51007b65a60..b8ece54487e 100644
--- a/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts
@@ -3,11 +3,18 @@
 
 import * as fs from 'node:fs';
 
-import { Async, FileSystem, type IFileSystemCopyFileOptions } from '@rushstack/node-core-library';
+import {
+  Async,
+  FileSystem,
+  type IFileSystemCopyFileOptions,
+  NewlineKind
+} from '@rushstack/node-core-library';
 import {
   type ITerminalChunk,
   TerminalChunkKind,
   TerminalProviderSeverity,
+  TerminalWritable,
+  TextRewriterTransform,
   type ITerminal,
   type ITerminalProvider
 } from '@rushstack/terminal';
@@ -125,6 +132,10 @@ export class OperationMetadataManager {
         if (!FileSystem.isNotExistError(e)) {
           throw e;
         }
+
+        // This run didn't write the file (a run that writes nothing to stderr has no error log), so delete
+        // the copy an earlier run left. The metadata folder is a cached output and must describe only this run.
+        await FileSystem.deleteFileAsync(options.destinationPath);
       }
     });
   }
@@ -149,6 +160,7 @@ export class OperationMetadataManager {
       this.stateFile.state?.cobuildContextId === cobuildContextId &&
       this.stateFile.state?.cobuildRunnerId !== cobuildRunnerId;
 
+    let errorLogText: string | undefined;
     try {
       const rawLogChunks: string = await FileSystem.readFileAsync(this.#logChunksPath);
       const chunks: ITerminalChunk[] = [];
@@ -164,6 +176,7 @@ export class OperationMetadataManager {
           terminalProvider.write(text, TerminalProviderSeverity.log);
         }
       }
+      errorLogText = getErrorLogText(chunks);
     } catch (e) {
       if (FileSystem.isNotExistError(e)) {
         // Log chunks file doesn't exist, try to restore log file
@@ -173,15 +186,29 @@ export class OperationMetadataManager {
       }
     }
 
-    // Try to restore cached error log as error log file
-    try {
-      await FileSystem.copyFileAsync({
-        sourcePath: this.#errorLogPath,
-        destinationPath: errorLogPath
-      });
-    } catch (e) {
-      if (!FileSystem.isNotExistError(e)) {
-        throw e;
+    // The error log file shows the stderr of the run that produced the cache entry. When the entry has log
+    // chunks, write it from them rather than copying the cached error log: an entry saved before saveAsync
+    // deleted stale files can hold the error log of an earlier run that failed.
+    if (errorLogText !== undefined) {
+      if (errorLogText) {
+        await FileSystem.writeFileAsync(errorLogPath, errorLogText, { ensureFolderExists: true });
+      } else {
+        await FileSystem.deleteFileAsync(errorLogPath);
+      }
+    } else {
+      // Try to restore cached error log as error log file
+      try {
+        await FileSystem.copyFileAsync({
+          sourcePath: this.#errorLogPath,
+          destinationPath: errorLogPath
+        });
+      } catch (e) {
+        if (!FileSystem.isNotExistError(e)) {
+          throw e;
+        }
+
+        // The entry has no error log, so don't leave the one from the last run that executed.
+        await FileSystem.deleteFileAsync(errorLogPath);
       }
     }
   }
@@ -199,6 +226,39 @@ export class OperationMetadataManager {
   }
 }
 
+/**
+ * Collects the text of the stderr chunks written to it.
+ */
+class StderrTextWritable extends TerminalWritable {
+  public text: string = '';
+
+  protected onWriteChunk(chunk: ITerminalChunk): void {
+    if (chunk.kind === TerminalChunkKind.Stderr) {
+      this.text += chunk.text;
+    }
+  }
+}
+
+/**
+ * Returns the error log file text for an operation's log chunks: the stderr chunks, rewritten the same way
+ * as the error log that `initializeProjectLogFilesAsync` writes when the operation runs.
+ */
+function getErrorLogText(chunks: ReadonlyArray<ITerminalChunk>): string {
+  const stderrText: StderrTextWritable = new StderrTextWritable();
+  const textRewriter: TextRewriterTransform = new TextRewriterTransform({
+    destination: stderrText,
+    removeColors: true,
+    normalizeNewlines: NewlineKind.OsDefault
+  });
+  for (const chunk of chunks) {
+    if (chunk.kind === TerminalChunkKind.Stderr) {
+      textRewriter.writeChunk(chunk);
+    }
+  }
+  textRewriter.close();
+  return stderrText.text;
+}
+
 async function restoreFromLogFile(terminal: ITerminal, path: string): Promise<void> {
   let logReadStream: fs.ReadStream | undefined;
 
diff --git a/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
new file mode 100644
index 00000000000..5088e6a0b80
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
@@ -0,0 +1,280 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, type Hash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/**
+ * The files in an operation's declared output folders.
+ */
+export interface IOperationOutputManifest {
+  /**
+   * Covers the path of every file and folder in the output folders, the identity, size and modification time of
+   * every file, and the identity, modification time and status change time of every folder. It changes if an output
+   * is added, deleted, renamed or rewritten, including in place, or if a folder is recreated. It does not change if
+   * a hard link to a file is created or removed elsewhere.
+   */
+  readonly signature: string;
+  /**
+   * Project-relative paths, with `/` separators, of the files and symbolic links in the output folders.
+   */
+  readonly files: ReadonlySet<string>;
+  /**
+   * If defined, the incremental command must never be used for this operation, and this says why.
+   */
+  readonly cleanOnlyReason: string | undefined;
+}
+
+// A content or chunk hash in a JavaScript or CSS file name, e.g. `chunk.main_1a2b3c4d.js` or `0dd8cf755e5195a5.js`.
+// The hash must contain a digit, so that words such as `facade` are not mistaken for one.
+const HASHED_BUNDLE_FILE_REGEXP: RegExp =
+  /(?:^|[._-])([0-9a-f]{8,})(?:\.min)?\.(?:js|mjs|cjs|css)(?:\.map|\.LICENSE\.txt)?$/i;
+const BUNDLE_FILE_REGEXP: RegExp = /\.(?:js|mjs|cjs|css)$/i;
+const BUNDLE_FOLDER_REGEXP: RegExp = /^(?:dist|release)(?:[-_.][^/]*)?(?:\/|$)/i;
+const CACHE_FOLDER_REGEXP: RegExp = /(?:^|\/)(?:temp|\.cache)(?:\/|$)/i;
+// A path with a long hexadecimal run names a cache entry by the hash of its content, e.g. Jest's transform cache
+// `temp/test/jest/jest-transform-cache-<hash>-<hash>/7f/index_<hash>`. A run adds such entries without changing
+// what it builds.
+const CONTENT_ADDRESSED_PATH_REGEXP: RegExp = /[0-9a-f]{16,}/i;
+
+export type OperationOutputFolderEntryKind = 'missing' | 'folder' | 'file' | 'replaced';
+
+export interface IOperationOutputFolderWalkEntry {
+  readonly kind: OperationOutputFolderEntryKind;
+  readonly relativePath: string;
+  readonly stats: fs.Stats | undefined;
+  readonly isOutputFolder: boolean;
+}
+
+/**
+ * Walks the declared output folders of an operation.
+ *
+ * @remarks
+ * A declared output folder that is a symbolic link or Windows junction to a folder is followed. Links that are
+ * found inside an output folder are recorded as links and not followed.
+ */
+export function walkOperationOutputFolders(
+  projectFolder: string,
+  outputFolderNames: ReadonlyArray<string>,
+  onEntry: (entry: IOperationOutputFolderWalkEntry) => void
+): number {
+  let entryCount: number = 0;
+
+  const readFolder = (relativeFolder: string, stats: fs.Stats, isOutputFolder: boolean): void => {
+    onEntry({ kind: 'folder', relativePath: relativeFolder, stats, isOutputFolder });
+    const folderPath: string = path.resolve(projectFolder, relativeFolder);
+    const children: fs.Dirent[] = tryReaddir(folderPath);
+    children.sort((left: fs.Dirent, right: fs.Dirent) =>
+      left.name < right.name ? -1 : left.name > right.name ? 1 : 0
+    );
+    entryCount += children.length;
+    for (const child of children) {
+      const relativePath: string = `${relativeFolder}/${child.name}`;
+      const childPath: string = `${folderPath}${path.sep}${child.name}`;
+      const childStats: fs.Stats | undefined = lstatIfExists(childPath);
+      if (child.isDirectory()) {
+        if (childStats?.isDirectory()) {
+          readFolder(relativePath, childStats, false);
+        } else {
+          onEntry({ kind: 'replaced', relativePath, stats: childStats, isOutputFolder: false });
+        }
+      } else {
+        onEntry({ kind: 'file', relativePath, stats: childStats, isOutputFolder: false });
+      }
+    }
+  };
+
+  for (const folderName of outputFolderNames) {
+    const relativePath: string = folderName.replace(/\\/g, '/').replace(/\/+$/, '');
+    const stats: fs.Stats | undefined = statIfExists(path.resolve(projectFolder, relativePath));
+    if (!stats) {
+      onEntry({ kind: 'missing', relativePath, stats: undefined, isOutputFolder: true });
+    } else if (stats.isDirectory()) {
+      readFolder(relativePath, stats, true);
+    } else {
+      onEntry({ kind: 'file', relativePath, stats, isOutputFolder: true });
+    }
+  }
+
+  return entryCount;
+}
+
+/**
+ * Lists the files in the output folders of an operation.
+ *
+ * @param projectFolder - The absolute path of the project folder
+ * @param outputFolderNames - The project-relative output folders of the operation
+ */
+export async function readOperationOutputManifestAsync(
+  projectFolder: string,
+  outputFolderNames: ReadonlyArray<string>
+): Promise<IOperationOutputManifest> {
+  const entries: string[] = [];
+  const files: Set<string> = new Set();
+
+  walkOperationOutputFolders(
+    projectFolder,
+    outputFolderNames,
+    ({ kind, relativePath, stats }: IOperationOutputFolderWalkEntry): void => {
+      switch (kind) {
+        case 'missing': {
+          entries.push(`missing ${relativePath}`);
+          break;
+        }
+        case 'folder': {
+          entries.push(`${relativePath}/ ${stats!.ino} ${stats!.mtimeMs} ${stats!.ctimeMs}`);
+          break;
+        }
+        case 'replaced': {
+          entries.push(`${relativePath}/ replaced`);
+          break;
+        }
+        case 'file': {
+          entries.push(getFileEntry(relativePath, stats));
+          files.add(relativePath);
+          break;
+        }
+      }
+    }
+  );
+
+  entries.sort();
+  const hash: Hash = createHash('sha1');
+  for (const entry of entries) {
+    hash.update(entry);
+    hash.update('\n');
+  }
+
+  return {
+    signature: hash.digest('hex'),
+    files,
+    cleanOnlyReason: getCleanOnlyReason(files)
+  };
+}
+
+/**
+ * Returns why an operation with these output files must always run its initial command, if it must.
+ *
+ * @remarks
+ * The incremental command does not delete outputs that a run no longer produces. Bundlers name chunks after
+ * their content or their place in the module graph, so an edit can replace a chunk with a differently named one
+ * and leave the old one behind, which a full build would not produce.
+ */
+export function getCleanOnlyReason(files: Iterable<string>): string | undefined {
+  let bundleFile: string | undefined;
+  for (const file of files) {
+    const baseName: string = file.slice(file.lastIndexOf('/') + 1);
+    if (isContentHashedBundleFile(baseName)) {
+      return `its outputs include the content-hashed file "${file}"`;
+    }
+    if (bundleFile === undefined && BUNDLE_FILE_REGEXP.test(baseName) && BUNDLE_FOLDER_REGEXP.test(file)) {
+      bundleFile = file;
+    }
+  }
+  return bundleFile === undefined ? undefined : `its outputs include the bundle "${bundleFile}"`;
+}
+
+function isContentHashedBundleFile(baseName: string): boolean {
+  const match: RegExpExecArray | null = HASHED_BUNDLE_FILE_REGEXP.exec(baseName);
+  return !!match && /\d/.test(match[1]);
+}
+
+// A chunk or asset that a bundler named after its content, which it renames whenever the content changes.
+function isContentHashedOutput(file: string): boolean {
+  return (
+    isContentHashedBundleFile(file.slice(file.lastIndexOf('/') + 1)) ||
+    (CONTENT_ADDRESSED_PATH_REGEXP.test(file) && BUNDLE_FOLDER_REGEXP.test(file))
+  );
+}
+
+// A content-hashed file that a bundler emits is not a cache entry: a full build would not leave an old one behind.
+function isCacheEntry(file: string): boolean {
+  return (
+    CONTENT_ADDRESSED_PATH_REGEXP.test(file) && CACHE_FOLDER_REGEXP.test(file) && !isContentHashedOutput(file)
+  );
+}
+
+/**
+ * Whether a content-hashed chunk or asset, as bundlers emit, is among the files that were added or removed.
+ */
+export function hasContentHashedOutputChange(
+  before: ReadonlySet<string>,
+  after: ReadonlySet<string>
+): boolean {
+  for (const file of after) {
+    if (!before.has(file) && isContentHashedOutput(file)) {
+      return true;
+    }
+  }
+  for (const file of before) {
+    if (!after.has(file) && isContentHashedOutput(file)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Describes how two sets of output files differ, e.g. `2 added ("lib/a.js", ...), 1 removed ("lib/b.js")`.
+ * Cache entries whose paths contain a content hash are ignored. Content-hashed bundles, and files in a `dist` or
+ * `release` folder, are not.
+ */
+export function describeOutputFileChanges(
+  before: ReadonlySet<string>,
+  after: ReadonlySet<string>
+): string | undefined {
+  const added: string[] = [];
+  const removed: string[] = [];
+  for (const file of after) {
+    if (!before.has(file) && !isCacheEntry(file)) {
+      added.push(file);
+    }
+  }
+  for (const file of before) {
+    if (!after.has(file) && !isCacheEntry(file)) {
+      removed.push(file);
+    }
+  }
+  if (added.length === 0 && removed.length === 0) {
+    return undefined;
+  }
+  const describe = (files: string[], verb: string): string =>
+    `${files.length} ${verb} (${files
+      .sort()
+      .slice(0, 3)
+      .map((file: string) => JSON.stringify(file))
+      .join(', ')}${files.length > 3 ? ', ...' : ''})`;
+  return [added.length ? describe(added, 'added') : '', removed.length ? describe(removed, 'removed') : '']
+    .filter(Boolean)
+    .join(', ');
+}
+
+// The status change time of a file is left out, because it also changes when a hard link to the file is created or
+// removed elsewhere, e.g. by a tool that links outputs into another folder.
+function getFileEntry(relativePath: string, stats: fs.Stats | undefined): string {
+  return stats ? `${relativePath} ${stats.ino} ${stats.size} ${stats.mtimeMs}` : `${relativePath} deleted`;
+}
+
+// Synchronous, because every output file is stat'ed and an lstat call takes a few microseconds, far less than a
+// round trip through the thread pool.
+function statIfExists(filePath: string): fs.Stats | undefined {
+  return fs.statSync(filePath, { throwIfNoEntry: false });
+}
+
+function lstatIfExists(filePath: string): fs.Stats | undefined {
+  return fs.lstatSync(filePath, { throwIfNoEntry: false });
+}
+
+function tryReaddir(folderPath: string): fs.Dirent[] {
+  try {
+    return fs.readdirSync(folderPath, { withFileTypes: true });
+  } catch (error) {
+    const { code } = error as NodeJS.ErrnoException;
+    // The folder was deleted or replaced by a file after its parent was read; the signature still changes.
+    if (code === 'ENOENT' || code === 'ENOTDIR') {
+      return [];
+    }
+    throw error;
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts b/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts
index 4fe099a0b94..1d3c77be198 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts
@@ -5,6 +5,7 @@ import { LockFile } from '@rushstack/node-core-library';
 
 import type { IPhasedCommandEngine } from '../../api/PhasedCommandEngine';
 import { PhasedCommandEngineBusyError } from '../../api/PhasedCommandEngineBusyError';
+import { NATIVE_COMMAND_INVALIDATION_REASON } from './IncrementalExecutionState';
 
 /**
  * Owns the native process lock only while a host is reconciling or executing one graph iteration.
@@ -34,7 +35,7 @@ export class PhasedCommandEngineExecution implements AsyncDisposable {
       // Native CLI actions leave their process lock file behind on exit. Their work may have
       // changed ignored outputs, so do not trust the previous in-memory success records.
       if (lock.dirtyWhenAcquired) {
-        this._engine.operationGraph.invalidateOperations(undefined, 'native-command-completed');
+        this._engine.operationGraph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
       }
     } catch (error) {
       lock.release();
diff --git a/libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts b/libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts
new file mode 100644
index 00000000000..d3f0e5d24d2
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts
@@ -0,0 +1,168 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ITelemetryData, ITelemetryOperationResult } from '../Telemetry';
+import type { IStopwatchResult } from '../../utilities/Stopwatch';
+import type { Operation } from './Operation';
+import { OperationStatus } from './OperationStatus';
+
+/**
+ * Telemetry data for a phased execution
+ */
+export interface IPhasedExecutionTelemetry {
+  [key: string]: string | number | boolean;
+  isInitial: boolean;
+  isWatch: boolean;
+
+  countAll: number;
+  countSuccess: number;
+  countSuccessWithWarnings: number;
+  countFailure: number;
+  countBlocked: number;
+  countFromCache: number;
+  countSkipped: number;
+  countNoOp: number;
+  countAborted: number;
+}
+
+/**
+ * The fields of an operation's execution record that phased command telemetry reports.
+ */
+export interface IPhasedTelemetryOperationRecord {
+  readonly status: OperationStatus;
+  readonly silent: boolean;
+  readonly stopwatch: Pick<IStopwatchResult, 'startTime' | 'endTime'>;
+  readonly nonCachedDurationMs: number | undefined;
+  readonly _operationMetadataManager?: { readonly wasCobuilt: boolean } | undefined;
+}
+
+/**
+ * The command-scoped fields of a phased command's telemetry entries.
+ */
+export interface IPhasedCommandTelemetryFields {
+  readonly nameForLog: string;
+  readonly initialExtraData: Record<string, unknown>;
+  readonly changedProjectsOnlyKey: string | undefined;
+  readonly changedProjectsOnly: boolean;
+}
+
+export interface ICreatePhasedTelemetryDataOptions extends IPhasedCommandTelemetryFields {
+  readonly isWatch: boolean;
+  readonly isInitial: boolean;
+  readonly durationInSeconds: number;
+  readonly succeeded: boolean;
+  readonly records: ReadonlyMap<Operation, IPhasedTelemetryOperationRecord>;
+  /**
+   * A `performance.now()` value subtracted from every operation timestamp. Long-lived hosts use it to report
+   * timestamps relative to the request, as a native process reports them relative to its own start.
+   */
+  readonly timeOriginMs?: number;
+}
+
+/**
+ * Builds the telemetry entry that a phased command logs for one set of operation results.
+ */
+export function createPhasedTelemetryData(options: ICreatePhasedTelemetryDataOptions): ITelemetryData {
+  const { records, timeOriginMs = 0 } = options;
+  const jsonOperationResults: Record<string, ITelemetryOperationResult> = {};
+
+  const extraData: IPhasedExecutionTelemetry = {
+    ...options.initialExtraData,
+    isWatch: options.isWatch,
+    // Fields specific to the current operation set
+    isInitial: options.isInitial,
+
+    countAll: 0,
+    countSuccess: 0,
+    countSuccessWithWarnings: 0,
+    countFailure: 0,
+    countBlocked: 0,
+    countFromCache: 0,
+    countSkipped: 0,
+    countNoOp: 0,
+    countAborted: 0
+  };
+
+  if (options.changedProjectsOnlyKey) {
+    // Overwrite this value since we allow changing it at runtime.
+    extraData[options.changedProjectsOnlyKey] = options.changedProjectsOnly;
+  }
+
+  const nonSilentDependenciesByOperation: Map<Operation, Set<string>> = new Map();
+  function getNonSilentDependencies(operation: Operation): ReadonlySet<string> {
+    let realDependencies: Set<string> | undefined = nonSilentDependenciesByOperation.get(operation);
+    if (!realDependencies) {
+      realDependencies = new Set();
+      nonSilentDependenciesByOperation.set(operation, realDependencies);
+      for (const dependency of operation.dependencies) {
+        const dependencyRecord: IPhasedTelemetryOperationRecord | undefined = records.get(dependency);
+        if (dependencyRecord?.silent) {
+          for (const deepDependency of getNonSilentDependencies(dependency)) {
+            realDependencies.add(deepDependency);
+          }
+        } else {
+          realDependencies.add(dependency.name!);
+        }
+      }
+    }
+    return realDependencies;
+  }
+
+  for (const [operation, operationResult] of records) {
+    if (operationResult.silent) {
+      // Architectural operation. Ignore.
+      continue;
+    }
+
+    const { _operationMetadataManager: operationMetadataManager } = operationResult;
+
+    const { startTime, endTime } = operationResult.stopwatch;
+    jsonOperationResults[operation.name!] = {
+      startTimestampMs: startTime === undefined ? undefined : startTime - timeOriginMs,
+      endTimestampMs: endTime === undefined ? undefined : endTime - timeOriginMs,
+      nonCachedDurationMs: operationResult.nonCachedDurationMs,
+      wasExecutedOnThisMachine: operationMetadataManager?.wasCobuilt !== true,
+      result: operationResult.status,
+      dependencies: Array.from(getNonSilentDependencies(operation)).sort()
+    };
+
+    extraData.countAll++;
+    switch (operationResult.status) {
+      case OperationStatus.Success:
+        extraData.countSuccess++;
+        break;
+      case OperationStatus.SuccessWithWarning:
+        extraData.countSuccessWithWarnings++;
+        break;
+      case OperationStatus.Failure:
+        extraData.countFailure++;
+        break;
+      case OperationStatus.Blocked:
+        extraData.countBlocked++;
+        break;
+      case OperationStatus.FromCache:
+        extraData.countFromCache++;
+        break;
+      case OperationStatus.Skipped:
+        extraData.countSkipped++;
+        break;
+      case OperationStatus.NoOp:
+        extraData.countNoOp++;
+        break;
+      case OperationStatus.Aborted:
+        extraData.countAborted++;
+        break;
+      default:
+        // Do nothing.
+        break;
+    }
+  }
+
+  return {
+    name: options.nameForLog,
+    durationInSeconds: options.durationInSeconds,
+    result: options.succeeded ? 'Succeeded' : 'Failed',
+    extraData,
+    operationResults: jsonOperationResults
+  };
+}
diff --git a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
index ac98661fc64..9bd833bdd72 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
@@ -17,10 +17,24 @@ import type {
   IOperationExecutionResult,
   IOperationStateHashComponents
 } from './IOperationExecutionResult';
-import { SUCCESS_STATUSES } from './OperationStatus';
+import { OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import { enableUnverifiedRetainedOperations, isResultUnverifiable } from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'PhasedOperationPlugin' = 'PhasedOperationPlugin';
+// Runs after the default-stage taps (e.g. CacheableOperationPlugin's input file checks), which can mark a result as
+// unverifiable.
+const VERIFY_RESULT_STAGE: number = 1;
+
+/**
+ * The statuses of results retained by an earlier iteration of the graph that are reused while the state hash of the
+ * operation is unchanged. The graph only retains a `Skipped` result for an operation that was selected to execute,
+ * when a plugin (e.g. change detection) found its outputs up to date.
+ */
+const RETAINED_RESULT_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  ...SUCCESS_STATUSES,
+  OperationStatus.Skipped
+]);
 
 /**
  * Core phased command plugin that provides the functionality for generating a base operation graph
@@ -124,6 +138,18 @@ function createOperations(
 }
 
 function configureExecutionManager(graph: IOperationGraph, context: IOperationGraphContext): void {
+  // The state hash at which each operation last produced its outputs, or restored them from the build cache,
+  // in an iteration of this graph in which the outputs of all of its dependencies were verified.
+  const verifiedStateHashByOperation: Map<Operation, string> = new Map();
+  // The records of the executing iteration, if its state hashes are available.
+  let iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+
+  graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>) => {
+    for (const operation of operations) {
+      verifiedStateHashByOperation.delete(operation);
+    }
+  });
+
   graph.hooks.configureIteration.tap(
     PLUGIN_NAME,
     (
@@ -132,8 +158,117 @@ function configureExecutionManager(graph: IOperationGraph, context: IOperationGr
       iterationOptions: IOperationGraphIterationOptions
     ) => {
       configureOperations(currentStates, lastStates, iterationOptions);
+      if (iterationOptions.inputsSnapshot) {
+        // A retained result that is current by state hash can still have been built against outputs of a
+        // dependency that were not current, e.g. by an `--only` request.
+        enableUnverifiedRetainedOperations(
+          currentStates,
+          lastStates,
+          verifiedStateHashByOperation,
+          RETAINED_RESULT_STATUSES
+        );
+      }
+    }
+  );
+
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    PLUGIN_NAME,
+    (
+      records: ReadonlyMap<Operation, IOperationExecutionResult>,
+      iterationOptions: IOperationGraphIterationOptions
+    ): void => {
+      if (iterationOptions.inputsSnapshot) {
+        iterationRecords = records;
+      } else {
+        // Without state hashes, nothing can be verified.
+        iterationRecords = undefined;
+        verifiedStateHashByOperation.clear();
+      }
+    }
+  );
+
+  graph.hooks.afterExecuteOperationAsync.tap(
+    { name: PLUGIN_NAME, stage: VERIFY_RESULT_STAGE },
+    (record: IOperationExecutionResult) => {
+      if (iterationRecords) {
+        updateVerifiedStateHash(record, iterationRecords, verifiedStateHashByOperation);
+      }
     }
   );
+
+  graph.hooks.afterExecuteIterationAsync.tap(PLUGIN_NAME, (status: OperationStatus) => {
+    iterationRecords = undefined;
+    return status;
+  });
+}
+
+function updateVerifiedStateHash(
+  record: IOperationExecutionResult,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>,
+  verifiedStateHashByOperation: Map<Operation, string>
+): void {
+  const { operation } = record;
+  switch (record.status) {
+    case OperationStatus.Skipped: {
+      if (!record.enabled) {
+        // The operation was not selected, so its outputs were left as they were.
+        return;
+      }
+      // A plugin (e.g. change detection) found the outputs of the selected operation up to date for its state
+      // hash, which verifies them in the same way as executing it.
+      if (
+        !isResultUnverifiable(record) &&
+        areDependenciesVerified(operation, records, verifiedStateHashByOperation)
+      ) {
+        verifiedStateHashByOperation.set(operation, record.getStateHash());
+        return;
+      }
+      break;
+    }
+
+    case OperationStatus.FromCache: {
+      // The outputs were restored from the build cache entry for this state hash.
+      verifiedStateHashByOperation.set(operation, record.getStateHash());
+      return;
+    }
+
+    case OperationStatus.Success:
+    case OperationStatus.SuccessWithWarning:
+    case OperationStatus.NoOp: {
+      if (
+        !isResultUnverifiable(record) &&
+        areDependenciesVerified(operation, records, verifiedStateHashByOperation)
+      ) {
+        verifiedStateHashByOperation.set(operation, record.getStateHash());
+        return;
+      }
+      break;
+    }
+
+    default: {
+      // The outputs may be incomplete.
+      break;
+    }
+  }
+
+  verifiedStateHashByOperation.delete(operation);
+}
+
+function areDependenciesVerified(
+  operation: Operation,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>,
+  verifiedStateHashByOperation: ReadonlyMap<Operation, string>
+): boolean {
+  for (const dependency of operation.dependencies) {
+    const dependencyRecord: IOperationExecutionResult | undefined = records.get(dependency);
+    if (
+      !dependencyRecord ||
+      verifiedStateHashByOperation.get(dependency) !== dependencyRecord.getStateHash()
+    ) {
+      return false;
+    }
+  }
+  return true;
 }
 
 function shouldEnableOperation(
@@ -145,7 +280,7 @@ function shouldEnableOperation(
     return true;
   }
 
-  if (!SUCCESS_STATUSES.has(lastState.status)) {
+  if (!RETAINED_RESULT_STATUSES.has(lastState.status)) {
     return true;
   }
 
@@ -185,11 +320,14 @@ function configureOperations(
   lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
   iterationOptions: IOperationGraphIterationOptions
 ): void {
+  // A non-incremental request runs every operation that it enables, like `rush rebuild`.
+  const runAllEnabled: boolean = iterationOptions.isIncrementalBuildAllowed === false;
   for (const [operation, currentState] of currentStates) {
     const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
 
     currentState.enabled =
-      operation.enabled && shouldEnableOperation(currentState, lastState, iterationOptions.inputsSnapshot);
+      operation.enabled &&
+      (runAllEnabled || shouldEnableOperation(currentState, lastState, iterationOptions.inputsSnapshot));
   }
 }
 
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
new file mode 100644
index 00000000000..155e56671a6
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -0,0 +1,179 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { Operation } from './Operation';
+import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
+import { type OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
+
+const unverifiableResults: WeakSet<IOperationExecutionResult> = new WeakSet();
+const resultsWithCheckedInputFiles: WeakSet<IOperationExecutionResult> = new WeakSet();
+const verifiedSkipStateHashByResult: WeakMap<IOperationExecutionResult, string> = new WeakMap();
+const trustedStateHashByResult: WeakMap<IOperationExecutionResult, string> = new WeakMap();
+
+/**
+ * Records that the outputs of a result of the executing iteration may not match its state hash, e.g. because input
+ * files of the operation changed after the inputs snapshot read them, until the operation had executed.
+ * Such a result is never verified at its state hash, so a later iteration of a long-lived graph runs the operation
+ * again, and the consumers that were built against its outputs, instead of skipping them.
+ *
+ * @remarks
+ * Call this from an `afterExecuteOperationAsync` tap with the default stage. The taps that verify results use a
+ * later stage.
+ */
+export function markResultUnverifiable(result: IOperationExecutionResult): void {
+  unverifiableResults.add(result);
+}
+
+/**
+ * Returns true if `markResultUnverifiable` was called for the result.
+ */
+export function isResultUnverifiable(result: IOperationExecutionResult): boolean {
+  return unverifiableResults.has(result);
+}
+
+/**
+ * The stage of the `beforeExecuteOperationAsync` taps that capture the state of the input files of an operation,
+ * to check after it executes whether they changed. It is later than the taps that can return a status instead of
+ * executing the operation (e.g. skip detection or a restore from the build cache), so that the input files of an
+ * operation that does not execute are not read.
+ */
+export const CAPTURE_INPUT_FILES_STAGE: number = Number.MAX_SAFE_INTEGER - 1;
+
+/**
+ * Records that a plugin checks whether the input files of the operation change from the inputs snapshot of the
+ * executing iteration until the operation has executed, and calls `markResultUnverifiable` for the result if they do,
+ * so that `IncrementalExecutionGuardPlugin` does not check them as well.
+ *
+ * @remarks
+ * Call this from a `beforeExecuteOperationAsync` tap with the stage `CAPTURE_INPUT_FILES_STAGE`.
+ * `IncrementalExecutionGuardPlugin` reads it from a tap with a later stage.
+ */
+export function markInputFilesChecked(result: IOperationExecutionResult): void {
+  resultsWithCheckedInputFiles.add(result);
+}
+
+/**
+ * Returns true if `markInputFilesChecked` was called for the result.
+ */
+export function areInputFilesChecked(result: IOperationExecutionResult): boolean {
+  return resultsWithCheckedInputFiles.has(result);
+}
+
+/**
+ * Records that a plugin which reports the result as skipped verified that the outputs of the operation are exactly
+ * those of its build cache entry at the given state hash, e.g. because they were restored from that entry or written
+ * to it, and have not changed since. If that is the state hash of the result, `CacheableOperationPlugin` trusts the
+ * skipped result as it trusts a result restored from the build cache, so it does not block the cache writes of the
+ * consumers of the operation.
+ *
+ * @remarks
+ * Call this from the `beforeExecuteOperationAsync` tap that returns `OperationStatus.Skipped` for the result.
+ */
+export function markSkipVerified(result: IOperationExecutionResult, stateHash: string): void {
+  verifiedSkipStateHashByResult.set(result, stateHash);
+}
+
+/**
+ * Returns the state hash that was passed to `markSkipVerified` for the result, if any.
+ */
+export function getVerifiedSkipStateHash(result: IOperationExecutionResult): string | undefined {
+  return verifiedSkipStateHashByResult.get(result);
+}
+
+/**
+ * Records the state hash at which `CacheableOperationPlugin` trusts the result of the executing iteration as a
+ * complete result that the build cache entries of consumers may be written against.
+ *
+ * @remarks
+ * Only `CacheableOperationPlugin` calls this.
+ */
+export function setTrustedStateHash(result: IOperationExecutionResult, stateHash: string): void {
+  trustedStateHashByResult.set(result, stateHash);
+}
+
+/**
+ * Returns the state hash at which `CacheableOperationPlugin` trusted the result in the executing iteration as a
+ * complete result that the build cache entries of consumers may be written against: its outputs were produced,
+ * restored from the build cache, or verified by the plugin that skipped it, while cache writes were allowed for the
+ * operation, and they are not the outputs of an incremental command. Returns undefined otherwise, including for a
+ * result that a previous iteration of a long-lived graph retained.
+ *
+ * @remarks
+ * Call this from an `afterExecuteOperationAsync` tap with a stage greater than 0, which runs after
+ * `CacheableOperationPlugin` decided whether to trust the result.
+ */
+export function getTrustedStateHash(result: IOperationExecutionResult): string | undefined {
+  return trustedStateHashByResult.get(result);
+}
+
+/**
+ * Re-enables selected operations whose result retained by a previous iteration of a long-lived graph
+ * (e.g. the Rush daemon) is current by state hash, but not verified at that state hash, so that they are restored
+ * from the build cache or executed instead of being skipped. Such a result was produced while the outputs of one
+ * of its dependencies were not verified (e.g. that dependency was not selected and had changed), so its outputs
+ * may not match its state hash. Skipping it would keep outputs that were built against dependency outputs that
+ * have since been rebuilt.
+ *
+ * An operation is only re-enabled if none of its dependencies will remain unverified, since otherwise running it
+ * again would not produce a verified result either. An operation that is disabled for another reason than a
+ * current retained result, e.g. by a plugin that performs the work itself, is left disabled.
+ *
+ * @param records - The records of the iteration that is being configured
+ * @param lastStates - The results retained by previous iterations of the graph
+ * @param verifiedStateHashByOperation - The state hash at which the retained result of each operation is verified
+ * @param retainedResultStatuses - The statuses of retained results that running the operation again can verify
+ */
+export function enableUnverifiedRetainedOperations(
+  records: ReadonlyMap<Operation, IConfigurableOperation>,
+  lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
+  verifiedStateHashByOperation: ReadonlyMap<Operation, string>,
+  retainedResultStatuses: ReadonlySet<OperationStatus> = SUCCESS_STATUSES
+): void {
+  // Whether the result of each operation will still be unverified at the end of this iteration.
+  const remainsUnverifiedByOperation: Map<Operation, boolean> = new Map();
+
+  function remainsUnverified(operation: Operation): boolean {
+    const known: boolean | undefined = remainsUnverifiedByOperation.get(operation);
+    if (known !== undefined) {
+      return known;
+    }
+    // Treat a dependency cycle as unverified; the real value is assigned below.
+    remainsUnverifiedByOperation.set(operation, true);
+
+    let unverified: boolean = false;
+    for (const dependency of operation.dependencies) {
+      if (remainsUnverified(dependency)) {
+        unverified = true;
+        break;
+      }
+    }
+
+    const record: IConfigurableOperation | undefined = records.get(operation);
+    if (!record) {
+      unverified = true;
+    } else if (!unverified && !record.enabled && !operation.isNoOp) {
+      // The operation will be skipped, which only keeps a verified result if it is verified at this state hash.
+      const stateHash: string = record.getStateHash();
+      if (verifiedStateHashByOperation.get(operation) !== stateHash) {
+        const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
+        if (
+          operation.enabled === true &&
+          lastState &&
+          retainedResultStatuses.has(lastState.status) &&
+          lastState.getStateHash() === stateHash
+        ) {
+          record.enabled = true;
+        } else {
+          unverified = true;
+        }
+      }
+    }
+
+    remainsUnverifiedByOperation.set(operation, unverified);
+    return unverified;
+  }
+
+  for (const operation of records.keys()) {
+    remainsUnverified(operation);
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts
index 9be45e9734c..be2df3bb07b 100644
--- a/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts
@@ -123,8 +123,7 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
       const { parameterValues: customParameterValues, ignoredParameterValues } =
         getCustomParameterValues(operation);
 
-      const collatorParameters: string[] = [
-        ...customParameterValues,
+      const collatorArguments: string[] = [
         `--shard-parent-folder="${parentFolder}"`,
         `--shard-count="${shards}"`
       ];
@@ -140,7 +139,8 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
         rushConfiguration,
         initialCommand: commandToRun,
         incrementalCommand: undefined,
-        customParameterValues: collatorParameters,
+        customParameterValues,
+        preformattedArguments: collatorArguments,
         ignoredParameterValues
       });
 
@@ -197,11 +197,7 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
           shard.toString()
         );
 
-        const shardedParameters: string[] = [
-          ...customParameterValues,
-          shardArgument,
-          outputDirectoryArgumentWithShard
-        ];
+        const shardArguments: string[] = [shardArgument, outputDirectoryArgumentWithShard];
 
         const shardDisplayName: string = `${getDisplayName(phase, project)} - shard ${shard}/${shards}`;
 
@@ -210,7 +206,8 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
           project,
           initialCommand: baseCommand,
           incrementalCommand: undefined,
-          customParameterValues: shardedParameters,
+          customParameterValues,
+          preformattedArguments: shardArguments,
           displayName: shardDisplayName,
           rushConfiguration,
           ignoredParameterValues
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
index 627236e23b3..887a0e7c1c9 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
@@ -17,6 +17,12 @@ import type { IOperationChildProcessReporter } from './OperationEventSink';
 import { HeftChildReporterNonFatalError } from './HeftChildProcessReporter';
 import { OperationError } from './OperationError';
 import { OperationStatus } from './OperationStatus';
+import {
+  getIncrementalExecutionGuard,
+  setCommandExecution,
+  type ICommandExecution,
+  type IIncrementalExecutionGuard
+} from './IncrementalExecutionState';
 
 export interface IShellOperationRunnerOptions {
   phase: IPhase;
@@ -24,10 +30,26 @@ export interface IShellOperationRunnerOptions {
   displayName: string;
   initialCommand: string;
   incrementalCommand: string | undefined;
+  /**
+   * If true, the incremental command runs only if a plugin registered an incremental execution guard for the
+   * operation's execution record and the guard allows it, and the guard checks the outputs of the incremental command
+   * afterwards. Otherwise the incremental command runs whenever the operation has a last state, as in watch mode.
+   * Defaults to false.
+   */
+  incrementalCommandRequiresGuard?: boolean;
   commandForHash: string;
   ignoredParameterValues: ReadonlyArray<string>;
 }
 
+/**
+ * The terminals that `ShellOperationRunner.invokeCommandAsync` writes to.
+ */
+export interface ICommandTerminals {
+  readonly terminal: ITerminal;
+  readonly terminalProvider: ITerminalProvider;
+  readonly structuredChildOutputTerminalProvider: ITerminalProvider;
+}
+
 /**
  * An `IOperationRunner` implementation that performs an operation via a shell command.
  * Currently contains the build cache logic, pending extraction as separate operations.
@@ -48,6 +70,7 @@ export class ShellOperationRunner implements IOperationRunner {
   readonly #commandForHash: string;
   readonly #initialCommand: string;
   readonly #incrementalCommand: string | undefined;
+  readonly #incrementalCommandRequiresGuard: boolean;
 
   readonly #rushProject: RushConfigurationProject;
 
@@ -60,6 +83,7 @@ export class ShellOperationRunner implements IOperationRunner {
       rushProject,
       initialCommand,
       incrementalCommand,
+      incrementalCommandRequiresGuard = false,
       commandForHash,
       ignoredParameterValues
     } = options;
@@ -70,6 +94,7 @@ export class ShellOperationRunner implements IOperationRunner {
     this.#rushProject = rushProject;
     this.#initialCommand = initialCommand;
     this.#incrementalCommand = incrementalCommand;
+    this.#incrementalCommandRequiresGuard = incrementalCommandRequiresGuard;
     this.#commandForHash = commandForHash;
     this.#ignoredParameterValues = ignoredParameterValues;
   }
@@ -84,130 +109,53 @@ export class ShellOperationRunner implements IOperationRunner {
         terminalProvider: ITerminalProvider,
         structuredChildOutputTerminalProvider: ITerminalProvider
       ) => {
-        let hasWarningOrError: boolean = false;
-
         // Log any ignored parameters
         if (this.#ignoredParameterValues.length > 0) {
           terminal.writeLine(
             `These parameters were ignored for this operation by project-level configuration: ${this.#ignoredParameterValues.join(' ')}`
           );
         }
-        const incrementalCommand: string | undefined =
-          lastState && this.#incrementalCommand ? this.#incrementalCommand : undefined;
-        const commandToRun: string = incrementalCommand ?? this.#initialCommand;
-
-        // Run the operation
-        terminal.writeLine(
-          `Invoking (${incrementalCommand !== undefined ? 'incremental' : 'initial'}): ${commandToRun}`
-        );
 
-        const { rushConfiguration, projectFolder } = this.#rushProject;
-
-        const { environment: initialEnvironment, abortSignal } = context;
-        const childProcessReporter: IOperationChildProcessReporter | undefined =
-          !IS_WINDOWS && isHeftCommand(commandToRun) ? context.createChildProcessReporter() : undefined;
-
-        const subProcess: child_process.ChildProcess = Utilities.executeLifecycleCommandAsync(commandToRun, {
-          rushConfiguration: rushConfiguration,
-          workingDirectory: projectFolder,
-          initCwd: rushConfiguration.commonTempFolder,
-          handleOutput: true,
-          environmentPathOptions: {
-            includeProjectBin: true
-          },
-          initialEnvironment,
-          additionalEnvironment: childProcessReporter?.environment,
-          stdio: childProcessReporter?.stdio,
-          // Isolate the process tree so that a hard abort can terminate it.
-          connectSubprocessTerminator: abortSignal !== undefined
-        });
-        const terminateProcessTree: () => void = () => {
-          try {
-            if (!IS_WINDOWS && subProcess.pid !== undefined && typeof subProcess.exitCode === 'number') {
-              // The shell already exited, but descendants in its process group may still hold its stdio open.
-              // killProcessTree() is a no-op in that state, so signal the process group directly.
-              killExitedProcessGroup(subProcess.pid);
-            } else {
-              SubprocessTerminator.killProcessTree(subProcess, SubprocessTerminator.RECOMMENDED_OPTIONS);
-            }
-          } catch (error) {
-            terminal.writeErrorLine(`Failed to terminate the operation process tree: ${error}`);
-          }
+        const terminals: ICommandTerminals = {
+          terminal,
+          terminalProvider,
+          structuredChildOutputTerminalProvider
         };
-        if (abortSignal?.aborted) {
-          terminateProcessTree();
-        } else {
-          abortSignal?.addEventListener('abort', terminateProcessTree, { once: true });
+        const incrementalCommand: string | undefined = lastState ? this.#incrementalCommand : undefined;
+        if (incrementalCommand === undefined) {
+          return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
+        }
+        if (!this.#incrementalCommandRequiresGuard) {
+          return await this.#invokeCommandAsync(context, terminals, 'incremental', incrementalCommand);
         }
-        let reporterError: Error | undefined;
-        const reporterDrainPromise: Promise<void> = childProcessReporter
-          ? childProcessReporter
-              .attachAsync(subProcess, structuredChildOutputTerminalProvider)
-              .catch((error) => {
-                reporterError =
-                  error instanceof Error ? error : new Error('The Heft child reporter channel failed.');
-              })
-          : Promise.resolve();
-
-        // Hook into events, in order to get live streaming of the log
-        subProcess.stdout?.on('data', (data: Buffer) => {
-          const text: string = data.toString();
-          terminalProvider.write(text, TerminalProviderSeverity.log);
-        });
-        subProcess.stderr?.on('data', (data: Buffer) => {
-          const text: string = data.toString();
-          terminalProvider.write(text, TerminalProviderSeverity.error);
-          hasWarningOrError = true;
-        });
 
-        const closePromise: Promise<{
-          readonly exitCode: number | null;
-          readonly signal: NodeJS.Signals | null;
-        }> = new Promise(
-          (
-            resolve: (result: {
-              readonly exitCode: number | null;
-              readonly signal: NodeJS.Signals | null;
-            }) => void,
-            reject: (error: OperationError) => void
-          ) => {
-            subProcess.on('close', (exitCode: number | null, signal: NodeJS.Signals | null) => {
-              try {
-                resolve({ exitCode, signal });
-              } catch (error) {
-                context.error = error as OperationError;
-                reject(error as OperationError);
-              }
-            });
-          }
-        );
-        const [{ exitCode, signal }]: [
-          { readonly exitCode: number | null; readonly signal: NodeJS.Signals | null },
-          void
-        ] = await Promise.all([closePromise, reporterDrainPromise]).finally(() => {
-          abortSignal?.removeEventListener('abort', terminateProcessTree);
-        });
+        const guard: IIncrementalExecutionGuard | undefined = getIncrementalExecutionGuard(context);
+        if (!guard) {
+          return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
+        }
+        const blockReason: string | undefined = await getGuardResultAsync(() => guard.getBlockReasonAsync());
+        if (blockReason !== undefined) {
+          terminal.writeLine(`Not using the incremental command because ${blockReason}.`);
+          return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
+        }
 
-        if (abortSignal?.aborted) {
-          terminal.writeLine('Terminated because the operation was aborted.');
-          return OperationStatus.Aborted;
-        } else if (signal) {
-          // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
-          context.error = new OperationError('error', `Terminated by signal: ${signal}`);
-          return OperationStatus.Failure;
-        } else if (exitCode !== 0) {
-          // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
-          context.error = new OperationError('error', `Returned error code: ${exitCode}`);
-          return OperationStatus.Failure;
-        } else if (reporterError && !(reporterError instanceof HeftChildReporterNonFatalError)) {
-          // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
-          context.error = new OperationError('error', reporterError.message);
-          return OperationStatus.Failure;
-        } else if (hasWarningOrError || childProcessReporter?.hasWarningOrError) {
-          return OperationStatus.SuccessWithWarning;
-        } else {
-          return OperationStatus.Success;
+        const status: OperationStatus = await this.#invokeCommandAsync(
+          context,
+          terminals,
+          'incremental',
+          incrementalCommand
+        );
+        if (status !== OperationStatus.Success && status !== OperationStatus.SuccessWithWarning) {
+          return status;
         }
+        const rerunReason: string | undefined = await getGuardResultAsync(() =>
+          guard.verifyIncrementalResultAsync()
+        );
+        if (rerunReason === undefined) {
+          return status;
+        }
+        terminal.writeLine(`Running the initial command, because ${rerunReason}.`);
+        return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
       },
       {
         createLogFile: true
@@ -218,9 +166,164 @@ export class ShellOperationRunner implements IOperationRunner {
   public getConfigHash(): string {
     return this.#commandForHash;
   }
+
+  async #invokeCommandAsync(
+    context: IOperationRunnerContext,
+    terminals: ICommandTerminals,
+    kind: ICommandExecution['kind'],
+    commandToRun: string
+  ): Promise<OperationStatus> {
+    if (this.#incrementalCommandRequiresGuard) {
+      // Recorded before the command starts, so that outputs of a command that fails or is aborted are attributed to it.
+      setCommandExecution(context, { kind, hasIncrementalCommand: this.#incrementalCommand !== undefined });
+    }
+    return await ShellOperationRunner.invokeCommandAsync(
+      context,
+      terminals,
+      this.#rushProject,
+      kind,
+      commandToRun
+    );
+  }
+
+  /**
+   * Runs a command of an operation in a shell, in the folder of its project, and returns the operation's status.
+   * It does not record the command execution for the incremental execution guard; the caller does that.
+   */
+  public static async invokeCommandAsync(
+    context: IOperationRunnerContext,
+    { terminal, terminalProvider, structuredChildOutputTerminalProvider }: ICommandTerminals,
+    rushProject: RushConfigurationProject,
+    kind: ICommandExecution['kind'],
+    commandToRun: string
+  ): Promise<OperationStatus> {
+    let hasWarningOrError: boolean = false;
+
+    // Run the operation
+    terminal.writeLine(`Invoking (${kind}): ${commandToRun}`);
+
+    const { rushConfiguration, projectFolder } = rushProject;
+
+    const { environment: initialEnvironment, abortSignal } = context;
+    const childProcessReporter: IOperationChildProcessReporter | undefined =
+      !IS_WINDOWS && isHeftCommand(commandToRun) ? context.createChildProcessReporter() : undefined;
+
+    const subProcess: child_process.ChildProcess = Utilities.executeLifecycleCommandAsync(commandToRun, {
+      rushConfiguration: rushConfiguration,
+      workingDirectory: projectFolder,
+      initCwd: rushConfiguration.commonTempFolder,
+      handleOutput: true,
+      environmentPathOptions: {
+        includeProjectBin: true
+      },
+      initialEnvironment,
+      additionalEnvironment: childProcessReporter?.environment,
+      stdio: childProcessReporter?.stdio,
+      // Isolate the process tree so that a hard abort can terminate it.
+      connectSubprocessTerminator: abortSignal !== undefined
+    });
+    const terminateProcessTree: () => void = () => {
+      try {
+        if (!IS_WINDOWS && subProcess.pid !== undefined && typeof subProcess.exitCode === 'number') {
+          // The shell already exited, but descendants in its process group may still hold its stdio open.
+          // killProcessTree() is a no-op in that state, so signal the process group directly.
+          killExitedProcessGroup(subProcess.pid);
+        } else {
+          SubprocessTerminator.killProcessTree(subProcess, SubprocessTerminator.RECOMMENDED_OPTIONS);
+        }
+      } catch (error) {
+        terminal.writeErrorLine(`Failed to terminate the operation process tree: ${error}`);
+      }
+    };
+    if (abortSignal?.aborted) {
+      terminateProcessTree();
+    } else {
+      abortSignal?.addEventListener('abort', terminateProcessTree, { once: true });
+    }
+    let reporterError: Error | undefined;
+    const reporterDrainPromise: Promise<void> = childProcessReporter
+      ? childProcessReporter.attachAsync(subProcess, structuredChildOutputTerminalProvider).catch((error) => {
+          reporterError =
+            error instanceof Error ? error : new Error('The Heft child reporter channel failed.');
+        })
+      : Promise.resolve();
+
+    // Hook into events, in order to get live streaming of the log
+    subProcess.stdout?.on('data', (data: Buffer) => {
+      const text: string = data.toString();
+      terminalProvider.write(text, TerminalProviderSeverity.log);
+    });
+    subProcess.stderr?.on('data', (data: Buffer) => {
+      const text: string = data.toString();
+      terminalProvider.write(text, TerminalProviderSeverity.error);
+      hasWarningOrError = true;
+    });
+
+    const closePromise: Promise<{
+      readonly exitCode: number | null;
+      readonly signal: NodeJS.Signals | null;
+    }> = new Promise(
+      (
+        resolve: (result: {
+          readonly exitCode: number | null;
+          readonly signal: NodeJS.Signals | null;
+        }) => void,
+        reject: (error: OperationError) => void
+      ) => {
+        subProcess.on('close', (exitCode: number | null, signal: NodeJS.Signals | null) => {
+          try {
+            resolve({ exitCode, signal });
+          } catch (error) {
+            context.error = error as OperationError;
+            reject(error as OperationError);
+          }
+        });
+      }
+    );
+    const [{ exitCode, signal }]: [
+      { readonly exitCode: number | null; readonly signal: NodeJS.Signals | null },
+      void
+    ] = await Promise.all([closePromise, reporterDrainPromise]).finally(() => {
+      abortSignal?.removeEventListener('abort', terminateProcessTree);
+    });
+
+    if (abortSignal?.aborted) {
+      terminal.writeLine('Terminated because the operation was aborted.');
+      return OperationStatus.Aborted;
+    } else if (signal) {
+      // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
+      context.error = new OperationError('error', `Terminated by signal: ${signal}`);
+      return OperationStatus.Failure;
+    } else if (exitCode !== 0) {
+      // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
+      context.error = new OperationError('error', `Returned error code: ${exitCode}`);
+      return OperationStatus.Failure;
+    } else if (reporterError && !(reporterError instanceof HeftChildReporterNonFatalError)) {
+      // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
+      context.error = new OperationError('error', reporterError.message);
+      return OperationStatus.Failure;
+    } else if (hasWarningOrError || childProcessReporter?.hasWarningOrError) {
+      return OperationStatus.SuccessWithWarning;
+    } else {
+      return OperationStatus.Success;
+    }
+  }
+}
+
+/**
+ * Returns what an incremental execution guard returned, or why it failed.
+ */
+export async function getGuardResultAsync(
+  getResultAsync: () => Promise<string | undefined>
+): Promise<string | undefined> {
+  try {
+    return await getResultAsync();
+  } catch (error) {
+    return `its incremental execution guard failed: ${error}`;
+  }
 }
 
-function killExitedProcessGroup(pid: number): void {
+export function killExitedProcessGroup(pid: number): void {
   try {
     // The process group ID cannot be reused while any member of the group is still alive.
     process.kill(-pid, 'SIGKILL');
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
index 990aedb6177..dc0889a04ac 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
@@ -15,7 +15,7 @@ import type {
 import type { Operation } from './Operation';
 import type { RushConfiguration } from '../../api/RushConfiguration';
 import type { IOperationRunner } from './IOperationRunner';
-import { IS_WINDOWS } from '../../utilities/executionUtilities';
+import { IS_WINDOWS, quoteShellArgumentIfNeeded } from '../../utilities/executionUtilities';
 
 export const PLUGIN_NAME: 'ShellOperationRunnerPlugin' = 'ShellOperationRunnerPlugin';
 
@@ -30,7 +30,7 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
         operations: Set<Operation>,
         context: ICreateOperationsContext
       ): Set<Operation> {
-        const { rushConfiguration, isIncrementalBuildAllowed } = context;
+        const { rushConfiguration, isIncrementalBuildAllowed, isWatch } = context;
 
         const getCustomParameterValues: (operation: Operation) => ICustomParameterValuesForOperation =
           getCustomParameterValuesByOperation();
@@ -52,12 +52,20 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
             // This is the command that will be used to identify the cache entry for this operation
             const commandForHash: string | undefined = shellCommand ?? scripts?.[phaseName];
 
-            // For execution of non-initial iterations, prefer the `:incremental` script if it exists.
+            // For execution of non-initial watch iterations, prefer the `:incremental` script if it exists.
             // However, the `shellCommand` value still takes precedence per the spec for that feature.
+            // Outside watch mode, the `:incremental` script only runs where a long-lived host (rushd) registers an
+            // incremental execution guard for the operation (IncrementalExecutionGuardPlugin). Without one, every
+            // command runs the initial script, as a single `rush build` does: the incremental script may keep the
+            // outputs of deleted inputs, and outside watch mode its results could be written to the build cache.
             const initialCommand: string | undefined = shellCommand ?? scripts?.[phaseName];
-            const incrementalCommand: string | undefined = isIncrementalBuildAllowed
-              ? (shellCommand ?? scripts?.[`${phaseName}:incremental`])
-              : undefined;
+            const incrementalCommand: string | undefined = !isIncrementalBuildAllowed
+              ? undefined
+              : isWatch
+                ? (shellCommand ?? scripts?.[`${phaseName}:incremental`])
+                : shellCommand === undefined
+                  ? scripts?.[`${phaseName}:incremental`]
+                  : undefined;
 
             operation.runner = initializeShellOperationRunner({
               phase,
@@ -66,6 +74,7 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
               commandForHash,
               initialCommand,
               incrementalCommand,
+              incrementalCommandRequiresGuard: !isWatch,
               customParameterValues,
               ignoredParameterValues,
               rushConfiguration
@@ -86,8 +95,20 @@ export function initializeShellOperationRunner(options: {
   rushConfiguration: RushConfiguration;
   initialCommand: string | undefined;
   incrementalCommand: string | undefined;
+  /**
+   * See `IShellOperationRunnerOptions.incrementalCommandRequiresGuard`. Defaults to false.
+   */
+  incrementalCommandRequiresGuard?: boolean;
   commandForHash?: string;
+  /**
+   * The custom parameter values. Each one is quoted for the shell if it needs it.
+   */
   customParameterValues: ReadonlyArray<string>;
+  /**
+   * Arguments that are already written for the shell, such as the sharding arguments.
+   * They are appended after the custom parameter values, without quoting.
+   */
+  preformattedArguments?: ReadonlyArray<string>;
   ignoredParameterValues: ReadonlyArray<string>;
 }): IOperationRunner {
   const {
@@ -95,6 +116,7 @@ export function initializeShellOperationRunner(options: {
     project,
     initialCommand: rawInitialCommand,
     incrementalCommand: rawIncrementalCommand,
+    incrementalCommandRequiresGuard = false,
     displayName,
     ignoredParameterValues
   } = options;
@@ -106,19 +128,28 @@ export function initializeShellOperationRunner(options: {
   }
 
   if (rawInitialCommand) {
-    const { commandForHash: rawCommandForHash, customParameterValues } = options;
+    const { commandForHash: rawCommandForHash, customParameterValues, preformattedArguments } = options;
 
-    const initialCommand: string = formatCommand(rawInitialCommand, customParameterValues);
-    const incrementalCommand: string | undefined = rawIncrementalCommand
-      ? formatCommand(rawIncrementalCommand, customParameterValues)
+    const initialCommand: string = formatCommand(
+      rawInitialCommand,
+      customParameterValues,
+      preformattedArguments
+    );
+    let incrementalCommand: string | undefined = rawIncrementalCommand
+      ? formatCommand(rawIncrementalCommand, customParameterValues, preformattedArguments)
       : undefined;
+    if (incrementalCommandRequiresGuard && incrementalCommand === initialCommand) {
+      // Running it as the incremental command would only prevent its results from being cached.
+      incrementalCommand = undefined;
+    }
     const commandForHash: string = rawCommandForHash
-      ? formatCommand(rawCommandForHash, customParameterValues)
+      ? formatCommand(rawCommandForHash, customParameterValues, preformattedArguments)
       : initialCommand;
 
     return new ShellOperationRunner({
       initialCommand,
       incrementalCommand,
+      incrementalCommandRequiresGuard,
       commandForHash,
       displayName,
       phase,
@@ -233,12 +264,25 @@ export function getCustomParameterValuesByOperation(): (
   return getCustomParameterValuesForOp;
 }
 
-export function formatCommand(rawCommand: string, customParameterValues: ReadonlyArray<string>): string {
+/**
+ * Appends the custom parameter values to a command, each quoted for the shell that runs the command
+ * if it needs it (see `quoteShellArgumentIfNeeded`), and then the preformatted arguments as they are.
+ */
+export function formatCommand(
+  rawCommand: string,
+  customParameterValues: ReadonlyArray<string>,
+  preformattedArguments: ReadonlyArray<string> = [],
+  isWindows: boolean = IS_WINDOWS
+): string {
   if (!rawCommand) {
     return '';
   } else {
-    const fullCommand: string = `${rawCommand} ${customParameterValues.join(' ')}`;
-    return IS_WINDOWS ? convertSlashesForWindows(fullCommand) : fullCommand;
+    const shellArguments: string[] = customParameterValues.map((value: string) =>
+      quoteShellArgumentIfNeeded(value, isWindows)
+    );
+    shellArguments.push(...preformattedArguments);
+    const fullCommand: string = `${rawCommand} ${shellArguments.join(' ')}`;
+    return isWindows ? convertSlashesForWindows(fullCommand) : fullCommand;
   }
 }
 
diff --git a/libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts b/libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts
new file mode 100644
index 00000000000..1cb5ae26cdb
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts
@@ -0,0 +1,769 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+import { StringDecoder } from 'node:string_decoder';
+
+import type {
+  IAfterExecuteEventMessage,
+  IExitCommandMessage,
+  IRequestRunEventMessage,
+  IRunCommandMessage,
+  ISyncEventMessage
+} from '@rushstack/operation-graph';
+import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { TerminalProviderSeverity, type ITerminal, type ITerminalProvider } from '@rushstack/terminal';
+
+import type { IPhase } from '../../api/CommandLineConfiguration';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import { Utilities, type IEnvironment } from '../../utilities/Utilities';
+import { IS_WINDOWS } from '../../utilities/executionUtilities';
+import type { IOperationRunner, IOperationRunnerContext, IOperationLastState } from './IOperationRunner';
+import { OperationError } from './OperationError';
+import { OperationStatus } from './OperationStatus';
+import {
+  getIncrementalExecutionGuard,
+  setCommandExecution,
+  skipBuildCacheRead,
+  type ICommandExecution,
+  type IIncrementalExecutionGuard,
+  type IIncrementalExecutionGuardOptions
+} from './IncrementalExecutionState';
+import {
+  getGuardResultAsync,
+  killExitedProcessGroup,
+  ShellOperationRunner,
+  type ICommandTerminals
+} from './ShellOperationRunner';
+
+const DEFAULT_MAX_RUNS_PER_WORKER: number = 25;
+const DEFAULT_MAX_MEMORY_GROWTH: number = 2;
+const DEFAULT_CHANGE_REPORT_TIMEOUT_MS: number = 1000;
+const EXIT_TIMEOUT_MS: number = 10000;
+const BYTES_PER_MB: number = 1024 * 1024;
+
+// A worker keeps its last build in memory and only writes the outputs that changed, so its outputs may be bundles.
+const GUARD_OPTIONS: IIncrementalExecutionGuardOptions = { outputsMayBeBundles: true };
+const INITIAL_COMMAND_REASON: string = 'the initial command must run';
+const FAILED_OPERATION_REASON: string = 'the operation failed, so its next build runs the initial command';
+
+// On Linux and macOS, TypeScript's default file watcher follows the inode of each file. After a file is replaced (git
+// deletes and recreates each file that it writes), that watcher can lose track of the file for the life of the
+// process, and a worker would then miss every later edit to the file and keep its stale outputs. A watcher on the
+// file's folder sees the new file. TypeScript reads the variable only if the tsconfig.json does not set
+// `watchOptions.watchFile`, and a value in the operation's environment is kept.
+const TYPESCRIPT_WATCH_FILE_VARIABLE: string = 'TSC_WATCHFILE';
+const TYPESCRIPT_WATCH_FILE: string = 'UseFsEventsOnParentDirectory';
+
+/**
+ * @internal
+ */
+export interface IWarmWorkerOperationRunnerOptions {
+  phase: IPhase;
+  rushProject: RushConfigurationProject;
+  displayName: string;
+  /**
+   * The initial command of the operation, which runs in a shell if `initialIpcCommand` is undefined.
+   */
+  initialCommand: string;
+  /**
+   * The `<phase>:ipc` command of the operation, if it has one: a worker that builds from scratch and then waits for
+   * further runs.
+   */
+  initialIpcCommand: string | undefined;
+  /**
+   * The `<phase>:incremental:ipc` command of the operation: a worker that builds on top of the existing outputs and
+   * then waits for further runs.
+   */
+  incrementalIpcCommand: string;
+  commandForHash: string;
+  ignoredParameterValues: ReadonlyArray<string>;
+  /**
+   * A worker is closed after this many runs. Defaults to 25.
+   */
+  maxRunsPerWorker?: number;
+  /**
+   * A worker is closed once its resident memory is more than this multiple of its resident memory after its first
+   * run. Defaults to 2.
+   */
+  maxMemoryGrowth?: number;
+  /**
+   * How long a reused worker may take to report a change that it saw, in milliseconds, before it is told to run
+   * anyway. A worker decides what to rebuild from the changes that its own file watcher reported, so a run that
+   * starts before the watcher saw an edit would not rebuild it. Defaults to 1000.
+   */
+  changeReportTimeoutMs?: number;
+}
+
+interface IRunPlan {
+  readonly kind: ICommandExecution['kind'];
+  // Printed to the operation's log before the command runs.
+  readonly notes: ReadonlyArray<string>;
+}
+
+interface IWorkerRunResult {
+  readonly status: OperationStatus;
+  readonly hasWarningOrError: boolean;
+}
+
+interface IWorkerCommandResult {
+  readonly status: OperationStatus;
+  // Whether the run was sent to a worker that had run before, i.e. one that may keep state from earlier runs.
+  readonly wasWorkerReused: boolean;
+}
+
+function isAfterExecuteEventMessage(message: unknown): message is IAfterExecuteEventMessage {
+  return (
+    !!message &&
+    typeof message === 'object' &&
+    (message as IAfterExecuteEventMessage).event === 'after-execute'
+  );
+}
+
+function isRequestRunEventMessage(message: unknown): message is IRequestRunEventMessage {
+  return (
+    !!message && typeof message === 'object' && (message as IRequestRunEventMessage).event === 'requestRun'
+  );
+}
+
+function isSyncEventMessage(message: unknown): message is ISyncEventMessage {
+  return !!message && typeof message === 'object' && (message as ISyncEventMessage).event === 'sync';
+}
+
+function formatMegabytes(bytes: number): string {
+  return `${Math.round(bytes / BYTES_PER_MB)} MB`;
+}
+
+/**
+ * A long-lived process that runs the operation's command when it receives a "run" message, and keeps the state of
+ * its last build in memory between runs.
+ */
+export class WarmWorker {
+  public readonly process: ChildProcess;
+  public readonly command: string;
+  public readonly closedPromise: Promise<void>;
+  public readyPromise: Promise<void>;
+  /**
+   * True once the process sent "sync", i.e. it supports the IPC protocol.
+   */
+  public isReady: boolean = false;
+  /**
+   * True if the process reported a change since it was last told to run.
+   */
+  public isRunRequested: boolean = false;
+  public runCount: number = 0;
+  public firstResidentMemoryBytes: number | undefined;
+  public residentMemoryBytes: number | undefined;
+
+  #onRunRequested: (() => void) | undefined;
+
+  public constructor(childProcess: ChildProcess, command: string) {
+    this.process = childProcess;
+    this.command = command;
+    this.closedPromise = new Promise<void>((resolve: () => void) => {
+      childProcess.once('close', () => resolve());
+    });
+    let resolveReady!: () => void;
+    this.readyPromise = new Promise<void>((resolve: () => void) => {
+      resolveReady = resolve;
+    });
+    childProcess.on('message', (message: unknown) => {
+      if (isSyncEventMessage(message)) {
+        this.isReady = true;
+        resolveReady();
+      } else if (isRequestRunEventMessage(message)) {
+        this.isRunRequested = true;
+        this.#onRunRequested?.();
+      }
+    });
+    // Without a listener, an 'error' event would be thrown; the 'close' event reports the outcome.
+    childProcess.on('error', () => undefined);
+  }
+
+  public get pid(): number | undefined {
+    return this.process.pid;
+  }
+
+  public get isAlive(): boolean {
+    return this.process.exitCode === null && this.process.signalCode === null;
+  }
+
+  /**
+   * Waits until the process reports a change, for at most `timeoutMs`. Returns false if it did not.
+   */
+  public async waitForRunRequestAsync(
+    timeoutMs: number,
+    abortSignal: AbortSignal | undefined
+  ): Promise<boolean> {
+    if (this.isRunRequested || timeoutMs <= 0) {
+      return this.isRunRequested;
+    }
+    await new Promise<void>((resolve: () => void) => {
+      const timer: { timeout?: NodeJS.Timeout } = {};
+      const finish: () => void = () => {
+        clearTimeout(timer.timeout);
+        this.#onRunRequested = undefined;
+        abortSignal?.removeEventListener('abort', finish);
+        this.process.off('close', finish);
+        resolve();
+      };
+      timer.timeout = setTimeout(finish, timeoutMs);
+      this.#onRunRequested = finish;
+      abortSignal?.addEventListener('abort', finish, { once: true });
+      this.process.once('close', finish);
+    });
+    return this.isRunRequested;
+  }
+
+  public terminate(): void {
+    try {
+      if (!IS_WINDOWS && this.process.pid !== undefined && !this.isAlive) {
+        // It exited, or a signal killed it, but descendants in its process group may still hold its stdio open.
+        killExitedProcessGroup(this.process.pid);
+      } else if (this.isAlive) {
+        SubprocessTerminator.killProcessTree(this.process, SubprocessTerminator.RECOMMENDED_OPTIONS);
+      }
+    } catch {
+      // It exited in the meantime.
+    }
+    if (IS_WINDOWS && !this.isAlive) {
+      for (const stream of this.process.stdio) {
+        stream?.destroy();
+      }
+    }
+  }
+
+  /**
+   * Asks the process to exit and waits until it closed. Terminates it if it cannot be asked, or if it does not
+   * exit in time.
+   */
+  public async closeAsync(): Promise<void> {
+    if (this.isAlive) {
+      if (this.process.connected) {
+        const exitCommand: IExitCommandMessage = { command: 'exit' };
+        try {
+          this.process.send(exitCommand);
+        } catch {
+          this.terminate();
+        }
+      } else {
+        this.terminate();
+      }
+    }
+    // Even after it exited, the stdio of the process or of its descendants may still be draining.
+    const timeout: NodeJS.Timeout = setTimeout(() => this.terminate(), EXIT_TIMEOUT_MS);
+    try {
+      await this.closedPromise;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+}
+
+/**
+ * An `IOperationRunner` for the Rush daemon that runs the incremental builds of an operation in a warm worker: a
+ * long-lived process, started from the project's `<phase>:incremental:ipc` script, that keeps its last build in
+ * memory and rebuilds only what changed when it is told to run again.
+ *
+ * @remarks
+ * Whether a run may build on top of the outputs of the last one is decided by the operation's incremental
+ * execution guard, as for `ShellOperationRunner`, in `prepareAsync`. If the guard allows it and the worker is
+ * running, the build cache is not read, because restoring the outputs would not update the worker's memory. If the
+ * guard does not allow it, the worker is closed, and the initial command runs: in a new worker, if the project has
+ * a `<phase>:ipc` script, or else in a shell. The initial command also runs after a failed run on a reused worker,
+ * or on a worker that exited, so that state that a worker kept from its earlier runs cannot fail an operation that
+ * the initial command passes. The failed first run of a new worker is reported as it stands, because that run had
+ * no earlier state. After a failure, the worker is closed, because the next build runs the initial command. If
+ * `closeAsync` closes a worker between executions, e.g. for the warm set of the Rush daemon, the next execution
+ * says so. Results of incremental runs are never written to the build cache.
+ *
+ * @internal
+ */
+export class WarmWorkerOperationRunner implements IOperationRunner {
+  public readonly name: string;
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean;
+  public readonly isNoOp: boolean = false;
+
+  readonly #rushProject: RushConfigurationProject;
+  readonly #initialCommand: string;
+  readonly #initialIpcCommand: string | undefined;
+  readonly #incrementalIpcCommand: string;
+  readonly #commandForHash: string;
+  readonly #ignoredParameterValues: ReadonlyArray<string>;
+  readonly #maxRunsPerWorker: number;
+  readonly #maxMemoryGrowth: number;
+  readonly #changeReportTimeoutMs: number;
+  readonly #planByContext: WeakMap<object, IRunPlan> = new WeakMap();
+
+  #worker: WarmWorker | undefined;
+  // Resolves when the last worker that was closed has exited.
+  #lastClosePromise: Promise<void> = Promise.resolve();
+  // Set when `closeAsync` closes a worker between executions, e.g. for the warm set of the Rush daemon. The next
+  // plan writes it, because the next execution would otherwise not say why the worker is gone.
+  #closedWorkerNote: string | undefined;
+
+  public constructor(options: IWarmWorkerOperationRunnerOptions) {
+    const {
+      phase,
+      rushProject,
+      displayName,
+      initialCommand,
+      initialIpcCommand,
+      incrementalIpcCommand,
+      commandForHash,
+      ignoredParameterValues,
+      maxRunsPerWorker = DEFAULT_MAX_RUNS_PER_WORKER,
+      maxMemoryGrowth = DEFAULT_MAX_MEMORY_GROWTH,
+      changeReportTimeoutMs = DEFAULT_CHANGE_REPORT_TIMEOUT_MS
+    } = options;
+    this.name = displayName;
+    this.warningsAreAllowed =
+      EnvironmentConfiguration.allowWarningsInSuccessfulBuild || phase.allowWarningsOnSuccess || false;
+    this.#rushProject = rushProject;
+    this.#initialCommand = initialCommand;
+    this.#initialIpcCommand = initialIpcCommand;
+    this.#incrementalIpcCommand = incrementalIpcCommand;
+    this.#commandForHash = commandForHash;
+    this.#ignoredParameterValues = ignoredParameterValues;
+    this.#maxRunsPerWorker = maxRunsPerWorker;
+    this.#maxMemoryGrowth = maxMemoryGrowth;
+    this.#changeReportTimeoutMs = changeReportTimeoutMs;
+  }
+
+  public get isActive(): boolean {
+    return !!this.#worker?.isAlive;
+  }
+
+  public get residentMemoryBytes(): number | undefined {
+    return this.isActive ? this.#worker!.residentMemoryBytes : undefined;
+  }
+
+  /**
+   * The process ID of the worker, if one is running.
+   */
+  public get workerPid(): number | undefined {
+    return this.isActive ? this.#worker!.pid : undefined;
+  }
+
+  /**
+   * Decides how the next execution with this context runs. Call it before the build cache is read, i.e. from a
+   * `beforeExecuteOperationAsync` tap that runs before `CacheableOperationPlugin`'s, and call
+   * `writeUnusedNotesAsync` after the operation executed.
+   *
+   * @param context - The execution record of the operation
+   * @param hasLastState - Whether the operation has a result from an earlier execution in this graph
+   */
+  public async prepareAsync(context: IOperationRunnerContext, hasLastState: boolean): Promise<void> {
+    this.#planByContext.set(context, await this.#planAsync(context, hasLastState));
+  }
+
+  public async executeAsync(
+    context: IOperationRunnerContext,
+    lastState?: IOperationLastState
+  ): Promise<OperationStatus> {
+    const preparedPlan: IRunPlan | undefined = this.#planByContext.get(context);
+    this.#planByContext.delete(context);
+    // Without a last state, e.g. in an iteration that allows no incremental build, the initial command runs.
+    const plan: IRunPlan =
+      preparedPlan && (preparedPlan.kind === 'initial' || lastState)
+        ? preparedPlan
+        : await this.#planAsync(context, !!lastState);
+    return await context.runWithTerminalAsync(
+      async (
+        terminal: ITerminal,
+        terminalProvider: ITerminalProvider,
+        structuredChildOutputTerminalProvider: ITerminalProvider
+      ): Promise<OperationStatus> => {
+        if (this.#ignoredParameterValues.length > 0) {
+          terminal.writeLine(
+            `These parameters were ignored for this operation by project-level configuration: ${this.#ignoredParameterValues.join(' ')}`
+          );
+        }
+        for (const note of plan.notes) {
+          terminal.writeLine(note);
+        }
+        this.#closedWorkerNote = undefined;
+
+        const terminals: ICommandTerminals = {
+          terminal,
+          terminalProvider,
+          structuredChildOutputTerminalProvider
+        };
+        let status: OperationStatus;
+        if (plan.kind === 'initial') {
+          status = await this.#runInitialAsync(context, terminals);
+        } else {
+          const { status: workerStatus, wasWorkerReused } = await this.#runOnWorkerAsync(
+            context,
+            terminals,
+            'incremental',
+            this.#incrementalIpcCommand
+          );
+          status = workerStatus;
+          if (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) {
+            const guard: IIncrementalExecutionGuard | undefined = getIncrementalExecutionGuard(context);
+            const rerunReason: string | undefined = guard
+              ? await getGuardResultAsync(() => guard.verifyIncrementalResultAsync(GUARD_OPTIONS))
+              : undefined;
+            if (rerunReason !== undefined) {
+              terminal.writeLine(`Running the initial command, because ${rerunReason}.`);
+              await this.#closeWorkerAsync(terminal, INITIAL_COMMAND_REASON);
+              status = await this.#runInitialAsync(context, terminals);
+            }
+          } else if (status === OperationStatus.Failure && (wasWorkerReused || !this.isActive)) {
+            // A reused worker can fail where the initial command passes, because of state that it kept from its
+            // earlier runs, and so can a worker that crashed. The initial command then decides whether the
+            // operation fails.
+            if (context.error) {
+              terminal.writeLine(context.error.message);
+              context.error = undefined;
+            }
+            terminal.writeLine('Running the initial command, because the run on the warm worker failed.');
+            await this.#closeWorkerAsync(terminal, INITIAL_COMMAND_REASON);
+            status = await this.#runInitialAsync(context, terminals);
+          }
+        }
+
+        if (!context.shouldRunnerPersist) {
+          await this.#closeWorkerAsync(undefined, '');
+        } else if (status === OperationStatus.Failure) {
+          await this.#closeWorkerAsync(terminal, FAILED_OPERATION_REASON);
+        } else {
+          await this.#recycleWorkerIfNeededAsync(terminal);
+        }
+        return status;
+      },
+      {
+        createLogFile: true
+      }
+    );
+  }
+
+  public getConfigHash(): string {
+    return this.#commandForHash;
+  }
+
+  /**
+   * Writes the notes of the plan that `prepareAsync` made for this context if `executeAsync` did not run, e.g.
+   * because the build cache restored the operation, so that a worker that the plan closed is not closed silently.
+   * Call it after the operation executed.
+   */
+  public async writeUnusedNotesAsync(context: IOperationRunnerContext): Promise<void> {
+    const plan: IRunPlan | undefined = this.#planByContext.get(context);
+    this.#planByContext.delete(context);
+    if (plan) {
+      this.#closedWorkerNote = undefined;
+    }
+    if (plan?.notes.length) {
+      // The log file, if any, is not this runner's, e.g. the one that the build cache restored.
+      await context.runWithTerminalAsync(
+        async (terminal: ITerminal): Promise<void> => {
+          for (const note of plan.notes) {
+            terminal.writeLine(note);
+          }
+        },
+        { createLogFile: false }
+      );
+    }
+  }
+
+  public async closeAsync(): Promise<void> {
+    const worker: WarmWorker | undefined = this.#worker;
+    if (worker?.isAlive) {
+      this.#closedWorkerNote = `The warm worker (pid ${worker.pid}) was closed after the operation last ran.`;
+    }
+    await this.#closeWorkerAsync(undefined, '');
+  }
+
+  async #planAsync(context: IOperationRunnerContext, hasLastState: boolean): Promise<IRunPlan> {
+    // It stays until a plan's notes are written, e.g. if this plan is replaced.
+    const notes: string[] = this.#closedWorkerNote ? [this.#closedWorkerNote] : [];
+    // As in ShellOperationRunner, the guard is not consulted before the first execution in this graph.
+    const guard: IIncrementalExecutionGuard | undefined = hasLastState
+      ? getIncrementalExecutionGuard(context)
+      : undefined;
+    if (guard) {
+      const blockReason: string | undefined = await getGuardResultAsync(() =>
+        guard.getBlockReasonAsync(GUARD_OPTIONS)
+      );
+      if (blockReason === undefined) {
+        if (this.isActive) {
+          skipBuildCacheRead(context);
+        }
+        return { kind: 'incremental', notes };
+      }
+      notes.push(`Not using the incremental command because ${blockReason}.`);
+    }
+    // The initial command must not run on top of what a worker keeps in memory.
+    const closeNote: string | undefined = await this.#closeWorkerAsync(undefined, INITIAL_COMMAND_REASON);
+    if (closeNote) {
+      notes.push(closeNote);
+    }
+    return { kind: 'initial', notes };
+  }
+
+  async #runInitialAsync(
+    context: IOperationRunnerContext,
+    terminals: ICommandTerminals
+  ): Promise<OperationStatus> {
+    if (this.#initialIpcCommand !== undefined) {
+      return (await this.#runOnWorkerAsync(context, terminals, 'initial', this.#initialIpcCommand)).status;
+    }
+    setCommandExecution(context, { kind: 'initial', hasIncrementalCommand: true });
+    return await ShellOperationRunner.invokeCommandAsync(
+      context,
+      terminals,
+      this.#rushProject,
+      'initial',
+      this.#initialCommand
+    );
+  }
+
+  async #runOnWorkerAsync(
+    context: IOperationRunnerContext,
+    { terminal, terminalProvider }: ICommandTerminals,
+    kind: ICommandExecution['kind'],
+    command: string
+  ): Promise<IWorkerCommandResult> {
+    // Recorded before the command starts, so that outputs of a command that fails or is aborted are attributed to it.
+    setCommandExecution(context, { kind, hasIncrementalCommand: true, watchesInputs: true });
+    terminal.writeLine(`Invoking (${kind}): ${command}`);
+
+    const { abortSignal } = context;
+    let worker: WarmWorker | undefined = this.#worker;
+    if (worker?.isAlive && kind === 'initial') {
+      // A build from scratch must not run on top of what a worker keeps in memory.
+      await this.#closeWorkerAsync(terminal, INITIAL_COMMAND_REASON);
+      worker = undefined;
+    }
+    let wasRunRequested: boolean = false;
+    if (worker?.isAlive) {
+      wasRunRequested = await worker.waitForRunRequestAsync(this.#changeReportTimeoutMs, abortSignal);
+    }
+    if (worker && !worker.isAlive) {
+      terminal.writeLine(`The warm worker (pid ${worker.pid}) exited after its last run.`);
+      await this.#closeWorkerAsync(undefined, '');
+      worker = undefined;
+    }
+
+    const wasWorkerReused: boolean = worker !== undefined && worker.runCount > 0;
+    if (!worker) {
+      terminal.writeLine('Starting a warm worker for it.');
+      worker = this.#startWorker(context, command);
+    } else {
+      if (!wasRunRequested) {
+        terminal.writeVerboseLine(
+          `The warm worker did not report a change within ${this.#changeReportTimeoutMs} ms.`
+        );
+      }
+      terminal.writeLine(`Sending run ${worker.runCount + 1} to the warm worker (pid ${worker.pid}).`);
+    }
+
+    const { status, hasWarningOrError } = await this.#runWorkerAsync(
+      context,
+      worker,
+      terminal,
+      terminalProvider
+    );
+    return {
+      status:
+        status === OperationStatus.Success && hasWarningOrError ? OperationStatus.SuccessWithWarning : status,
+      wasWorkerReused
+    };
+  }
+
+  #startWorker(context: IOperationRunnerContext, command: string): WarmWorker {
+    const { rushConfiguration, projectFolder } = this.#rushProject;
+    const environment: IEnvironment | undefined = context.environment;
+    const additionalEnvironment: IEnvironment | undefined =
+      (environment ?? process.env)[TYPESCRIPT_WATCH_FILE_VARIABLE] === undefined
+        ? { [TYPESCRIPT_WATCH_FILE_VARIABLE]: TYPESCRIPT_WATCH_FILE }
+        : undefined;
+    const childProcess: ChildProcess = Utilities.executeLifecycleCommandAsync(command, {
+      rushConfiguration,
+      workingDirectory: projectFolder,
+      initCwd: rushConfiguration.commonTempFolder,
+      handleOutput: true,
+      environmentPathOptions: {
+        includeProjectBin: true
+      },
+      ipc: true,
+      // Isolate the process tree, so that it can be terminated.
+      connectSubprocessTerminator: true,
+      initialEnvironment: environment,
+      additionalEnvironment
+    });
+    const worker: WarmWorker = new WarmWorker(childProcess, command);
+    this.#worker = worker;
+    return worker;
+  }
+
+  async #runWorkerAsync(
+    context: IOperationRunnerContext,
+    worker: WarmWorker,
+    terminal: ITerminal,
+    terminalProvider: ITerminalProvider
+  ): Promise<IWorkerRunResult> {
+    const { process: subProcess } = worker;
+    const { abortSignal } = context;
+    let hasWarningOrError: boolean = false;
+    const stdoutDecoder: StringDecoder = new StringDecoder('utf8');
+    const stderrDecoder: StringDecoder = new StringDecoder('utf8');
+    const onStdout = (data: Buffer): void => {
+      terminalProvider.write(stdoutDecoder.write(data), TerminalProviderSeverity.log);
+    };
+    const onStderr = (data: Buffer): void => {
+      terminalProvider.write(stderrDecoder.write(data), TerminalProviderSeverity.error);
+      hasWarningOrError = true;
+    };
+    subProcess.stdout?.on('data', onStdout);
+    subProcess.stderr?.on('data', onStderr);
+
+    let sentRun: boolean = false;
+    let sendError: Error | undefined;
+    const onAbort = (): void => {
+      worker.terminate();
+    };
+    const status: OperationStatus = await new Promise<OperationStatus>(
+      (resolve: (status: OperationStatus) => void) => {
+        let detach: () => void = () => undefined;
+        const finish = (result: OperationStatus): void => {
+          detach();
+          resolve(result);
+        };
+        const onMessage = (message: unknown): void => {
+          if (sentRun && isAfterExecuteEventMessage(message)) {
+            const memory: number | undefined = message.residentMemoryBytes;
+            worker.residentMemoryBytes =
+              typeof memory === 'number' && Number.isSafeInteger(memory) && memory > 0 ? memory : undefined;
+            if (worker.runCount === 1) {
+              worker.firstResidentMemoryBytes = worker.residentMemoryBytes;
+            }
+            // These types are distinct, but have the same values.
+            finish(message.status as unknown as OperationStatus);
+          }
+        };
+        const onClose = (exitCode: number | null, signal: NodeJS.Signals | null): void => {
+          if (abortSignal?.aborted) {
+            finish(OperationStatus.Aborted);
+          } else if (sendError) {
+            context.error = new OperationError('error', sendError.message);
+            finish(OperationStatus.Failure);
+          } else if (sentRun) {
+            context.error = new OperationError(
+              'error',
+              `The warm worker exited before it reported the result of its run (${
+                signal ? `signal ${signal}` : `exit code ${exitCode}`
+              }).`
+            );
+            finish(OperationStatus.Failure);
+          } else if (signal) {
+            // It exited without using the IPC protocol, so it ran once, like a command in a shell.
+            context.error = new OperationError('error', `Terminated by signal: ${signal}`);
+            finish(OperationStatus.Failure);
+          } else if (exitCode !== 0) {
+            context.error = new OperationError('error', `Returned error code: ${exitCode}`);
+            finish(OperationStatus.Failure);
+          } else {
+            finish(OperationStatus.Success);
+          }
+        };
+
+        detach = () => {
+          subProcess.off('message', onMessage);
+          subProcess.off('close', onClose);
+        };
+        subProcess.on('message', onMessage);
+        subProcess.once('close', onClose);
+        if (abortSignal?.aborted) {
+          onAbort();
+        } else {
+          abortSignal?.addEventListener('abort', onAbort, { once: true });
+        }
+        worker.readyPromise.then(
+          () => {
+            if (!worker.isAlive || abortSignal?.aborted) {
+              return;
+            }
+            const runCommand: IRunCommandMessage = { command: 'run' };
+            worker.isRunRequested = false;
+            worker.runCount++;
+            sentRun = true;
+            try {
+              subProcess.send(runCommand);
+            } catch (error) {
+              sendError = new Error(`Could not send "run" to the warm worker: ${error}`);
+              worker.terminate();
+            }
+          },
+          () => undefined
+        );
+      }
+    );
+    abortSignal?.removeEventListener('abort', onAbort);
+    subProcess.stdout?.off('data', onStdout);
+    subProcess.stderr?.off('data', onStderr);
+    terminalProvider.write(stdoutDecoder.end(), TerminalProviderSeverity.log);
+    terminalProvider.write(stderrDecoder.end(), TerminalProviderSeverity.error);
+
+    if (status === OperationStatus.Aborted) {
+      // The worker was terminated, so the next run starts a new one.
+      await this.#closeWorkerAsync(undefined, '');
+      terminal.writeLine('Terminated because the operation was aborted.');
+    } else if (!worker.isAlive) {
+      await this.#closeWorkerAsync(undefined, '');
+    }
+    return { status, hasWarningOrError };
+  }
+
+  async #recycleWorkerIfNeededAsync(terminal: ITerminal): Promise<void> {
+    const worker: WarmWorker | undefined = this.#worker;
+    if (!worker?.isAlive) {
+      return;
+    }
+    const { runCount, firstResidentMemoryBytes, residentMemoryBytes } = worker;
+    if (runCount >= this.#maxRunsPerWorker) {
+      await this.#closeWorkerAsync(terminal, `it has run ${runCount} times`);
+    } else if (
+      firstResidentMemoryBytes !== undefined &&
+      residentMemoryBytes !== undefined &&
+      residentMemoryBytes > firstResidentMemoryBytes * this.#maxMemoryGrowth
+    ) {
+      await this.#closeWorkerAsync(
+        terminal,
+        `its memory grew from ${formatMegabytes(firstResidentMemoryBytes)} after its first run to ${formatMegabytes(
+          residentMemoryBytes
+        )}`
+      );
+    }
+  }
+
+  /**
+   * Closes the worker, if there is one. Returns the line that says so if it was running, and writes it to the
+   * terminal if one is given.
+   */
+  async #closeWorkerAsync(terminal: ITerminal | undefined, reason: string): Promise<string | undefined> {
+    const worker: WarmWorker | undefined = this.#worker;
+    if (!worker) {
+      // It may still be closing for another caller.
+      await this.#lastClosePromise;
+      return undefined;
+    }
+    this.#worker = undefined;
+    const note: string | undefined =
+      worker.isAlive && reason
+        ? `Closing the warm worker (pid ${worker.pid}), because ${reason}.`
+        : undefined;
+    if (note) {
+      terminal?.writeLine(note);
+    }
+    const closePromise: Promise<void> = worker.closeAsync();
+    this.#lastClosePromise = closePromise;
+    await closePromise;
+    return note;
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
index e93441a49fd..42f98aad596 100644
--- a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
@@ -43,18 +43,85 @@ function getOrCreateProject(name: string): RushConfigurationProject {
   return project;
 }
 
-function createRecord(name: string): OperationExecutionRecord {
+function createRecord(name: string, weight?: number): OperationExecutionRecord {
   return new OperationExecutionRecord(
     new Operation({
       runner: new MockOperationRunner(name),
       logFilenameIdentifier: 'operation',
       phase: mockPhase,
-      project: getOrCreateProject(name)
+      project: getOrCreateProject(name),
+      settings: weight === undefined ? undefined : { operationName: mockPhase.name, weight }
     }),
     { maxParallelism: 10 } as unknown as IOperationExecutionRecordContext
   );
 }
 
+const criticalPathSort: IOperationSortFunction = (
+  a: OperationExecutionRecord,
+  b: OperationExecutionRecord
+): number => {
+  return a.criticalPathLength! - b.criticalPathLength!;
+};
+
+function getPermutations<T>(items: readonly T[]): T[][] {
+  if (items.length <= 1) {
+    return [items.slice()];
+  }
+  const permutations: T[][] = [];
+  for (let i: number = 0; i < items.length; i++) {
+    const rest: T[] = [...items.slice(0, i), ...items.slice(i + 1)];
+    for (const permutation of getPermutations(rest)) {
+      permutations.push([items[i], ...permutation]);
+    }
+  }
+  return permutations;
+}
+
+/**
+ * Creates a record for each entry of `weights`, adds each `[consumer, dependency]` edge, and returns the records.
+ */
+function createGraph(
+  weights: Record<string, number>,
+  edges: readonly [consumer: string, dependency: string][]
+): Map<string, OperationExecutionRecord> {
+  const records: Map<string, OperationExecutionRecord> = new Map();
+  for (const [name, weight] of Object.entries(weights)) {
+    records.set(name, createRecord(name, weight));
+  }
+  for (const [consumer, dependency] of edges) {
+    addDependency(records.get(consumer)!, records.get(dependency)!);
+  }
+  return records;
+}
+
+/**
+ * Returns whether the promise settles before the pending I/O callbacks run, i.e. without waiting for other work.
+ */
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => {
+      settled = true;
+    },
+    () => {
+      settled = true;
+    }
+  );
+  await new Promise((resolve: (value: unknown) => void) => setImmediate(resolve));
+  return settled;
+}
+
+async function completeAsync(
+  queue: AsyncOperationQueue,
+  expected: OperationExecutionRecord
+): Promise<OperationExecutionRecord> {
+  const { value } = await queue.next();
+  expect(value?.name).toBe(expected.name);
+  expected.status = OperationStatus.Success;
+  queue.complete(expected);
+  return expected;
+}
+
 describe(AsyncOperationQueue.name, () => {
   it('iterates operations in topological order', async () => {
     const operations = [createRecord('a'), createRecord('b'), createRecord('c'), createRecord('d')];
@@ -238,4 +305,267 @@ describe(AsyncOperationQueue.name, () => {
     const rEnd: IteratorResult<OperationExecutionRecord> = await queue.next();
     expect(rEnd.done).toBe(true);
   });
+
+  it('keeps the order of the remaining operations when it removes finished operations', async () => {
+    const operations: OperationExecutionRecord[] = [];
+    for (let i: number = 0; i < 10; i++) {
+      operations.push(createRecord(`r${i}`));
+    }
+    const queue: AsyncOperationQueue = new AsyncOperationQueue(operations, nullSort);
+    for (let i: number = 1; i < operations.length; i += 2) {
+      operations[i].status = OperationStatus.Skipped;
+    }
+
+    const actualOrder: string[] = [];
+    for await (const operation of queue) {
+      actualOrder.push(operation.name);
+      operation.status = OperationStatus.Success;
+      queue.complete(operation);
+    }
+
+    // Without a preference, the ready operations are assigned from the end of the queue
+    expect(actualOrder).toEqual(['r8', 'r6', 'r4', 'r2', 'r0']);
+  });
+
+  it('stops scanning the queue once it has found a new operation for each waiting iterator', async () => {
+    const a: OperationExecutionRecord = createRecord('a');
+    const b: OperationExecutionRecord = createRecord('b');
+    const queue: AsyncOperationQueue = new AsyncOperationQueue([a, b], nullSort);
+
+    // The queue is scanned from its end, so "b" is found before "a"
+    let status: OperationStatus = a.status;
+    let isStatusRead: boolean = false;
+    Object.defineProperty(a, 'status', {
+      get: () => {
+        isStatusRead = true;
+        return status;
+      },
+      set: (value: OperationStatus) => {
+        status = value;
+      }
+    });
+
+    expect((await queue.next()).value).toBe(b);
+    expect(isStatusRead).toBe(false);
+
+    expect((await queue.next()).value).toBe(a);
+    expect(isStatusRead).toBe(true);
+  });
+
+  describe('held operations', () => {
+    it('dispatches held operations only after all other operations completed', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const b: OperationExecutionRecord = createRecord('b');
+      const held: OperationExecutionRecord = createRecord('held');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([held, a, b], nullSort, [held]);
+      expect(queue.heldOperations).toEqual(new Set([held]));
+
+      const first: OperationExecutionRecord = (await queue.next()).value;
+      const second: OperationExecutionRecord = (await queue.next()).value;
+      expect(new Set([first, second])).toEqual(new Set([a, b]));
+      const third: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      first.status = OperationStatus.Success;
+      queue.complete(first);
+      expect(await isSettledAsync(third)).toBe(false);
+
+      second.status = OperationStatus.Success;
+      queue.complete(second);
+      expect((await third).value).toBe(held);
+      expect(queue.heldOperations.size).toBe(0);
+      held.status = OperationStatus.Success;
+      queue.complete(held);
+      expect((await queue.next()).done).toBe(true);
+    });
+
+    it('dispatches the operations if all of them are held', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a], nullSort, [a]);
+
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(true);
+      expect((await next).value).toBe(a);
+    });
+
+    it('keeps held operations held while they are retained', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const held: OperationExecutionRecord = createRecord('held');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a, held], nullSort, [held]);
+      const release: () => void = queue.retainHeldOperations();
+      const releaseOther: () => void = queue.retainHeldOperations();
+
+      await completeAsync(queue, a);
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(false);
+      expect(queue.isDone).toBe(false);
+      expect(queue.isDispatching).toBe(true);
+
+      // Each function releases its own retention only
+      release();
+      release();
+      expect(await isSettledAsync(next)).toBe(false);
+
+      releaseOther();
+      expect((await next).value).toBe(held);
+    });
+
+    it('dispatches released operations', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const released: OperationExecutionRecord = createRecord('released');
+      const held: OperationExecutionRecord = createRecord('held');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a, released, held], nullSort, [
+        released,
+        held
+      ]);
+
+      expect((await queue.next()).value).toBe(a);
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(false);
+
+      queue.releaseHeldOperations([released, a]);
+      expect((await next).value).toBe(released);
+      expect(queue.heldOperations).toEqual(new Set([held]));
+      const last: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(last)).toBe(false);
+
+      queue.releaseHeldOperations();
+      expect((await last).value).toBe(held);
+    });
+
+    it('completes a held operation that a failure blocks', async () => {
+      const dependency: OperationExecutionRecord = createRecord('dependency');
+      const other: OperationExecutionRecord = createRecord('other');
+      const consumer: OperationExecutionRecord = createRecord('consumer');
+      const held: OperationExecutionRecord = createRecord('held');
+      addDependency(consumer, dependency);
+      const queue: AsyncOperationQueue = new AsyncOperationQueue(
+        [dependency, other, consumer, held],
+        nullSort,
+        [consumer, held]
+      );
+
+      const first: OperationExecutionRecord = (await queue.next()).value;
+      const second: OperationExecutionRecord = (await queue.next()).value;
+      expect(new Set([first, second])).toEqual(new Set([dependency, other]));
+
+      // As the graph handles a failure
+      dependency.status = OperationStatus.Failure;
+      consumer.status = OperationStatus.Blocked;
+      queue.complete(consumer);
+      expect(queue.heldOperations).toEqual(new Set([held]));
+      queue.complete(dependency);
+
+      // The other operation is still executing
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(false);
+      other.status = OperationStatus.Success;
+      queue.complete(other);
+      expect((await next).value).toBe(held);
+      held.status = OperationStatus.Success;
+      queue.complete(held);
+      expect((await queue.next()).done).toBe(true);
+    });
+
+    it('dispatches prioritized operations first', async () => {
+      const records: OperationExecutionRecord[] = ['a', 'b', 'c', 'd'].map((name: string) =>
+        createRecord(name)
+      );
+      const [a, b, c, d] = records;
+      const queue: AsyncOperationQueue = new AsyncOperationQueue(records, nullSort, [c]);
+
+      queue.prioritizeOperations([a, c]);
+      expect((await queue.next()).value).toBe(a);
+      // A held operation stays held when it is prioritized, and goes first when it is released
+      queue.releaseHeldOperations([c]);
+      expect((await queue.next()).value).toBe(c);
+      // Without a preference, the ready operations are assigned from the end of the queue
+      expect((await queue.next()).value).toBe(d);
+      expect((await queue.next()).value).toBe(b);
+    });
+
+    it('reports whether it is dispatching', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a], nullSort);
+      expect(queue.isDispatching).toBe(false);
+
+      const { value } = await queue.next();
+      expect(queue.isDispatching).toBe(true);
+      value.status = OperationStatus.Success;
+      queue.complete(value);
+      expect(queue.isDone).toBe(true);
+      expect(queue.isDispatching).toBe(false);
+    });
+  });
+
+  describe('critical path length', () => {
+    // An operation's length is the total weight of the longest chain from it to an operation with no consumers,
+    // including its own weight. It must not depend on the order in which the operations are visited.
+    it.each([
+      {
+        title: 'a chain',
+        weights: { a: 1, b: 1, c: 1 },
+        edges: [
+          ['c', 'b'],
+          ['b', 'a']
+        ],
+        expected: { a: 3, b: 2, c: 1 }
+      },
+      {
+        title: 'a diamond',
+        weights: { a: 1, b: 1, c: 1, d: 1 },
+        edges: [
+          ['b', 'a'],
+          ['c', 'a'],
+          ['d', 'b'],
+          ['d', 'c']
+        ],
+        expected: { a: 3, b: 2, c: 2, d: 1 }
+      },
+      {
+        title: 'a weighted fork',
+        weights: { a: 2, b: 3, c: 1, d: 5 },
+        edges: [
+          ['c', 'b'],
+          ['b', 'a'],
+          ['d', 'a']
+        ],
+        expected: { a: 7, b: 4, c: 1, d: 5 }
+      }
+    ] as {
+      title: string;
+      weights: Record<string, number>;
+      edges: [consumer: string, dependency: string][];
+      expected: Record<string, number>;
+    }[])('is the same for every insertion order in $title', ({ weights, edges, expected }) => {
+      for (const order of getPermutations(Object.keys(weights))) {
+        const records: Map<string, OperationExecutionRecord> = createGraph(weights, edges);
+        new AsyncOperationQueue(
+          order.map((name: string) => records.get(name)!),
+          nullSort
+        );
+
+        const lengths: Record<string, number | undefined> = {};
+        for (const [name, record] of records) {
+          lengths[name] = record.criticalPathLength;
+        }
+        expect({ order, lengths }).toEqual({ order, lengths: expected });
+      }
+    });
+
+    it('assigns the operation that starts the longest chain first, whatever the insertion order', async () => {
+      for (const order of getPermutations(['a', 'b', 'c', 'z'])) {
+        // c depends on b, which depends on a. z has no dependencies and no consumers.
+        const records: Map<string, OperationExecutionRecord> = createGraph({ a: 1, b: 1, c: 1, z: 1 }, [
+          ['c', 'b'],
+          ['b', 'a']
+        ]);
+        const queue: AsyncOperationQueue = new AsyncOperationQueue(
+          order.map((name: string) => records.get(name)!),
+          criticalPathSort
+        );
+
+        const first: IteratorResult<OperationExecutionRecord> = await queue.next();
+        expect({ order, first: first.value?.name }).toEqual({ order, first: 'a' });
+      }
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index a9b3ad395a5..90b10ea3084 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -42,24 +42,55 @@ jest.mock('../OperationMetadataManager', () => {
 jest.mock('../../buildCache/OperationBuildCache', () => ({
   OperationBuildCache: { forOperation: jest.fn() }
 }));
+jest.mock('@rushstack/package-deps-hash', () => {
+  const actual: typeof import('@rushstack/package-deps-hash') = jest.requireActual(
+    '@rushstack/package-deps-hash'
+  );
+  return { ...actual, hashFilesAsync: jest.fn(actual.hashFilesAsync) };
+});
+jest.mock('../InputFilesStatSignature', () => {
+  const actual: typeof import('../InputFilesStatSignature') = jest.requireActual(
+    '../InputFilesStatSignature'
+  );
+  return { ...actual, captureInputFilesState: jest.fn(actual.captureInputFilesState) };
+});
+
+import * as child_process from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 
-import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
+import { MockWritable, StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { CobuildConfiguration } from '../../../api/CobuildConfiguration';
 import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
 import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
 import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
 import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
+import type {
+  DeferredCacheEntryWrites,
+  IDeferredCacheEntryWritesReport
+} from '../../buildCache/DeferredCacheEntryWrites';
 import { CacheableOperationPlugin } from '../CacheableOperationPlugin';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
 import { OperationGraph } from '../OperationGraph';
 import { Operation } from '../Operation';
 import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
-import type { IExecutionResult } from '../IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import type { IOperationGraphExtensionResult, IOperationGraphRequestResult } from '../IOperationGraph';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+import {
+  captureInputFilesState,
+  FILE_TIME_TOLERANCE_MS,
+  type IInputFilesState
+} from '../InputFilesStatSignature';
+import { areInputFilesChecked, CAPTURE_INPUT_FILES_STAGE } from '../RetainedResultVerification';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -79,14 +110,17 @@ class CacheableMockRunner implements IOperationRunner {
   public readonly isNoOp: boolean = false;
   public readonly name: string;
   readonly #executions: string[];
+  readonly #onExecute: ((name: string) => void) | undefined;
 
-  public constructor(name: string, executions: string[]) {
+  public constructor(name: string, executions: string[], onExecute?: (name: string) => void) {
     this.name = name;
     this.#executions = executions;
+    this.#onExecute = onExecute;
   }
 
   public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
     this.#executions.push(this.name);
+    this.#onExecute?.(this.name);
     return OperationStatus.Success;
   }
 
@@ -99,32 +133,74 @@ interface ITestGraph {
   graph: OperationGraph;
   operations: Map<string, Operation>;
   localHashes: Map<string, string>;
+  // The tracked input file hashes of each operation in the inputs snapshot, by name
+  trackedFileHashes: Map<string, Map<string, string>>;
+  // The reason that caching is disabled for each operation, by name. Undefined if caching is allowed.
+  cacheDisabledReasons: Map<string, string>;
+  // The names of the operations whose reason that caching is disabled was computed, in order
+  cacheDisabledReasonComputations: string[];
   executions: string[];
   cacheWrites: string[];
-  executeAsync(): Promise<IExecutionResult>;
+  // The names of the operations that are restored from the build cache
+  cacheHits: Set<string>;
+  // The hashes of the inputs snapshot, by path relative to the root directory
+  snapshotHashes: Map<string, string>;
+  // The arguments after the terminal of each cache write, in the order of cacheWrites
+  cacheWriteArguments: [string | undefined, DeferredCacheEntryWrites | undefined][];
+  // Called when an operation executes, e.g. to save one of its input files while it executes
+  onExecute: ((name: string) => void) | undefined;
+  // An inputs snapshot of the current local hashes and tracked file hashes
+  createInputsSnapshot(workingTreeReadStartTimeMs?: number): IInputsSnapshot;
+  executeAsync(
+    workingTreeReadStartTimeMs?: number,
+    holdUnneededOperations?: boolean
+  ): Promise<IExecutionResult>;
 }
 
 /**
  * Creates a linear chain of cacheable operations: names[0] <- names[1] <- ... (each depends on the previous).
  */
-async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
+async function createTestGraphAsync(
+  names: string[],
+  rootDirectory: string = '/repo',
+  cacheWriteEnabled: boolean = true,
+  cobuildConfiguration: CobuildConfiguration | undefined = undefined,
+  deferredCacheEntryWrites: DeferredCacheEntryWrites | undefined = undefined
+): Promise<ITestGraph> {
   const executions: string[] = [];
   const cacheWrites: string[] = [];
+  const cacheHits: Set<string> = new Set();
+  const snapshotHashes: Map<string, string> = new Map();
+  const cacheWriteArguments: [string | undefined, DeferredCacheEntryWrites | undefined][] = [];
   const localHashes: Map<string, string> = new Map();
+  const trackedFileHashes: Map<string, Map<string, string>> = new Map();
+  const cacheDisabledReasons: Map<string, string> = new Map();
+  const cacheDisabledReasonComputations: string[] = [];
   const operations: Map<string, Operation> = new Map();
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+  let onExecute: ((name: string) => void) | undefined;
 
   let previous: Operation | undefined;
   for (const name of names) {
     const project: RushConfigurationProject = {
       packageName: name,
-      projectFolder: `/repo/${name}`
+      projectFolder: `${rootDirectory}/${name}`
     } as unknown as RushConfigurationProject;
     projectConfigurations.set(project, {
-      getCacheDisabledReason: () => undefined
+      getCacheDisabledReason: (trackedFileNames: Iterable<string>) => {
+        cacheDisabledReasonComputations.push(name);
+        // Like RushProjectConfiguration, which disables caching if Git tracks a file in an output folder
+        const trackedOutputFile: string | undefined = [...trackedFileNames].find((file: string) =>
+          file.startsWith(`${name}/lib/`)
+        );
+        return (
+          cacheDisabledReasons.get(name) ??
+          (trackedOutputFile ? `Git tracks the output file "${trackedOutputFile}".` : undefined)
+        );
+      }
     } as unknown as RushProjectConfiguration);
     const operation: Operation = new Operation({
-      runner: new CacheableMockRunner(name, executions),
+      runner: new CacheableMockRunner(name, executions, (executedName: string) => onExecute?.(executedName)),
       logFilenameIdentifier: name,
       phase: mockPhase,
       project
@@ -140,9 +216,14 @@ async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
   jest.mocked(OperationBuildCache.forOperation).mockImplementation(
     (record) =>
       ({
-        tryRestoreFromCacheAsync: async () => false,
-        trySetCacheEntryAsync: async () => {
+        tryRestoreFromCacheAsync: async () => cacheHits.has(record.operation.associatedProject.packageName),
+        trySetCacheEntryAsync: async (
+          buildCacheTerminal: ITerminal,
+          specifiedCacheId?: string,
+          deferredWrites?: DeferredCacheEntryWrites
+        ) => {
           cacheWrites.push(record.operation.associatedProject.packageName);
+          cacheWriteArguments.push([specifiedCacheId, deferredWrites]);
           return true;
         }
       }) as unknown as OperationBuildCache
@@ -155,12 +236,13 @@ async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
     allowWarningsInSuccessfulBuild: false,
     buildCacheConfiguration: {
       buildCacheEnabled: true,
-      cacheWriteEnabled: true
+      cacheWriteEnabled
     } as unknown as BuildCacheConfiguration,
-    cobuildConfiguration: undefined,
+    cobuildConfiguration,
     terminal,
     excludeAppleDoubleFiles: false,
-    useDirectFileTransfersForBuildCache: false
+    useDirectFileTransfersForBuildCache: false,
+    deferredCacheEntryWrites
   }).apply(hooks);
 
   const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
@@ -176,33 +258,74 @@ async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
     projectConfigurations
   } as unknown as IOperationGraphContext);
 
-  const inputsSnapshot: IInputsSnapshot = {
-    hashes: new Map(),
-    rootDirectory: '/repo',
-    hasUncommittedChanges: false,
-    getTrackedFileHashesForOperation: () => new Map(),
-    getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
+  const createInputsSnapshot = (workingTreeReadStartTimeMs?: number): IInputsSnapshot => {
+    const snapshotLocalHashes: Map<string, string> = new Map(localHashes);
+    const snapshotTrackedFileHashes: Map<string, Map<string, string>> = new Map(trackedFileHashes);
+    return {
+      hashes: new Map(snapshotHashes),
+      rootDirectory,
+      hasUncommittedChanges: false,
+      workingTreeReadStartTimeMs,
+      getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
+        snapshotTrackedFileHashes.get(project.packageName) ?? new Map(),
+      getOperationOwnStateHash: (project: RushConfigurationProject) =>
+        snapshotLocalHashes.get(project.packageName)!
+    };
   };
 
   return {
     graph,
     operations,
     localHashes,
+    trackedFileHashes,
+    cacheDisabledReasons,
+    cacheDisabledReasonComputations,
     executions,
     cacheWrites,
-    executeAsync: async () => {
+    cacheHits,
+    snapshotHashes,
+    cacheWriteArguments,
+    get onExecute(): ((name: string) => void) | undefined {
+      return onExecute;
+    },
+    set onExecute(value: ((name: string) => void) | undefined) {
+      onExecute = value;
+    },
+    createInputsSnapshot,
+    executeAsync: async (workingTreeReadStartTimeMs?: number, holdUnneededOperations?: boolean) => {
       executions.length = 0;
       cacheWrites.length = 0;
-      return await graph.executeAsync({ inputsSnapshot });
+      cacheWriteArguments.length = 0;
+      cacheDisabledReasonComputations.length = 0;
+      return await graph.executeAsync({
+        inputsSnapshot: createInputsSnapshot(workingTreeReadStartTimeMs),
+        holdUnneededOperations
+      });
     }
   };
 }
 
+function getGitBlobHash(content: string): string {
+  return crypto
+    .createHash('sha1')
+    .update(`blob ${Buffer.byteLength(content)}\0${content}`)
+    .digest('hex');
+}
+
+function getLatestFileTimeMs(filePath: string): number {
+  const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+  return Number((mtimeNs > ctimeNs ? mtimeNs : ctimeNs) / BigInt(1000000));
+}
+
 function getStatus(testGraph: ITestGraph, result: IExecutionResult, name: string): OperationStatus {
   return (result.operationResults.get(testGraph.operations.get(name)!) as OperationExecutionRecord).status;
 }
 
 describe(CacheableOperationPlugin.name, () => {
+  beforeEach(() => {
+    jest.mocked(hashFilesAsync).mockClear();
+  });
+
   it('writes cache entries for all operations in a cold iteration', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
 
@@ -242,11 +365,26 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.cacheWrites).toEqual(['c']);
   });
 
-  it('does not write a cache entry when a dependency was skipped by the user (e.g. --only)', async () => {
+  it('does not write a cache entry when a dependency that was not selected (e.g. --only) is trusted at its state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+
+    testGraph.operations.get('a')!.enabled = false;
+    testGraph.localHashes.set('b', 'b-v2');
+    const result: IExecutionResult = await testGraph.executeAsync();
+
+    // The outputs of "a" are not part of its state hash, and this iteration did not verify them.
+    expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not write a cache entry when a dependency that was not selected (e.g. --only) has changed', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     await testGraph.executeAsync();
 
     testGraph.operations.get('a')!.enabled = false;
+    testGraph.localHashes.set('a', 'a-v2');
     testGraph.localHashes.set('b', 'b-v2');
     const result: IExecutionResult = await testGraph.executeAsync();
 
@@ -265,7 +403,7 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.cacheWrites).toEqual([]);
   });
 
-  it('does not trust a retained result that was produced while one of its dependencies was skipped', async () => {
+  it('re-executes a retained result that was produced while one of its dependencies was skipped', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
     const a: Operation = testGraph.operations.get('a')!;
 
@@ -280,10 +418,10 @@ describe(CacheableOperationPlugin.name, () => {
     testGraph.localHashes.set('c', 'c-v2');
     const result: IExecutionResult = await testGraph.executeAsync();
 
-    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
-    expect(testGraph.executions).toEqual(['a', 'c']);
-    // "b" was built against an unknown "a", so "c" must not write to the cache.
-    expect(testGraph.cacheWrites).toEqual(['a']);
+    // "b" was built against an unknown "a", so it must not be skipped now that "a" has executed.
+    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Success);
+    expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
   });
 
   it('does not trust results whose state hash changed without re-execution', async () => {
@@ -300,4 +438,756 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.executions).toEqual(['a', 'c']);
     expect(testGraph.cacheWrites).toEqual(['a']);
   });
+
+  describe('input files saved while the inputs snapshot was being taken', () => {
+    const inputFile: string = 'a/src/index.ts';
+    let rootDirectory: string;
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      fs.mkdirSync(path.join(rootDirectory, 'a', 'src'), { recursive: true });
+      fs.writeFileSync(path.join(rootDirectory, inputFile), 'export const a = 2;');
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    it('does not write cache entries if Git hashed the file before it was saved', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 1;')]]));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      // "b" consumed outputs of "a" that do not match the state hash of "a", so it must not write either.
+      expect(testGraph.cacheWrites).toEqual([]);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+      expect(jest.mocked(hashFilesAsync).mock.calls[0].slice(0, 2)).toEqual([rootDirectory, [inputFile]]);
+
+      // The next snapshot hashes the saved content, so the outputs are rebuilt and cached.
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 2;')]]));
+      testGraph.localHashes.set('a', 'a-v2');
+      await testGraph.executeAsync(
+        getLatestFileTimeMs(path.join(rootDirectory, inputFile)) + FILE_TIME_TOLERANCE_MS + 1
+      );
+
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+    });
+
+    it('writes cache entries if Git hashed the file after it was saved', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 2;')]]));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      // The file has its snapshot hash, so Git is not asked about it
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('does not hash files that were saved before the snapshot started', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 2;')]]));
+
+      await testGraph.executeAsync(
+        getLatestFileTimeMs(path.join(rootDirectory, inputFile)) + FILE_TIME_TOLERANCE_MS + 1
+      );
+
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it.each([true, false])(
+      'runs the operations again if a later snapshot has the same state hashes (cache writes enabled: %s)',
+      async (cacheWriteEnabled: boolean) => {
+        const testGraph: ITestGraph = await createTestGraphAsync(
+          ['a', 'b'],
+          rootDirectory,
+          cacheWriteEnabled
+        );
+        const inputFilePath: string = path.join(rootDirectory, inputFile);
+        testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 1;')]]));
+
+        await testGraph.executeAsync(Date.now());
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual([]);
+
+        // Reverting the save gives the next snapshot the same state hashes, but the outputs of "a" and "b" were
+        // built from the saved content.
+        fs.writeFileSync(inputFilePath, 'export const a = 1;');
+        const afterRevertMs: number = getLatestFileTimeMs(inputFilePath) + FILE_TIME_TOLERANCE_MS + 1;
+        await testGraph.executeAsync(afterRevertMs);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual(cacheWriteEnabled ? ['a', 'b'] : []);
+
+        const hotResult: IExecutionResult = await testGraph.executeAsync(afterRevertMs);
+        expect(hotResult.status).toBe(OperationStatus.NoOp);
+        expect(testGraph.executions).toEqual([]);
+      }
+    );
+  });
+
+  describe('input files saved while an operation executes', () => {
+    const inputFile: string = 'a/src/index.ts';
+    let rootDirectory: string;
+    let inputFilePath: string;
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      fs.mkdirSync(path.join(rootDirectory, 'a', 'src'), { recursive: true });
+      inputFilePath = path.join(rootDirectory, inputFile);
+      fs.writeFileSync(inputFilePath, 'export const a = 1;');
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    it.each([true, false])(
+      'runs the operations again if a later snapshot has the same state hashes (cache writes enabled: %s)',
+      async (cacheWriteEnabled: boolean) => {
+        const testGraph: ITestGraph = await createTestGraphAsync(
+          ['a', 'b'],
+          rootDirectory,
+          cacheWriteEnabled
+        );
+        testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 1;')]]));
+        const afterWriteMs: number = getLatestFileTimeMs(inputFilePath) + FILE_TIME_TOLERANCE_MS + 1;
+        testGraph.onExecute = (name: string) => {
+          if (name === 'a') {
+            // A different size, so that the save is detected even if the file time does not change
+            fs.writeFileSync(inputFilePath, 'export const a = 22;');
+          }
+        };
+
+        await testGraph.executeAsync(afterWriteMs);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual([]);
+
+        // Reverting the save gives the next snapshot the same state hashes, but the outputs of "a" and "b" may
+        // have been built from the saved content.
+        testGraph.onExecute = undefined;
+        fs.writeFileSync(inputFilePath, 'export const a = 1;');
+        const afterRevertMs: number = getLatestFileTimeMs(inputFilePath) + FILE_TIME_TOLERANCE_MS + 1;
+        await testGraph.executeAsync(afterRevertMs);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual(cacheWriteEnabled ? ['a', 'b'] : []);
+
+        const hotResult: IExecutionResult = await testGraph.executeAsync(afterRevertMs);
+        expect(hotResult.status).toBe(OperationStatus.NoOp);
+        expect(testGraph.executions).toEqual([]);
+      }
+    );
+  });
+
+  describe('input files that change after the inputs snapshot and before an operation executes', () => {
+    const names: string[] = ['a', 'b', 'c'];
+    let rootDirectory: string;
+
+    function getInputFile(name: string): string {
+      return `${name}/src/index.ts`;
+    }
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      for (const name of names) {
+        fs.mkdirSync(path.join(rootDirectory, name, 'src'), { recursive: true });
+        fs.writeFileSync(path.join(rootDirectory, getInputFile(name)), `export const ${name} = 1;`);
+      }
+      // So that Git can tell which new files are ignored
+      child_process.execFileSync('git', ['init', '-q'], { cwd: rootDirectory, stdio: 'ignore' });
+      fs.writeFileSync(path.join(rootDirectory, '.gitignore'), '*.log\n');
+      jest.mocked(captureInputFilesState).mockClear();
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    async function createGraphWithInputFilesAsync(): Promise<ITestGraph> {
+      const testGraph: ITestGraph = await createTestGraphAsync(names, rootDirectory);
+      for (const name of names) {
+        const hash: string = getGitBlobHash(`export const ${name} = 1;`);
+        testGraph.trackedFileHashes.set(name, new Map([[getInputFile(name), hash]]));
+        testGraph.snapshotHashes.set(getInputFile(name), hash);
+      }
+      return testGraph;
+    }
+
+    // The names of the operations whose input files were captured, in order
+    function getCapturedOperationNames(): string[] {
+      return jest
+        .mocked(captureInputFilesState)
+        .mock.results.map(
+          ({ value }) =>
+            path.relative(rootDirectory, (value as IInputFilesState).filePaths[0]).split(path.sep)[0]
+        );
+    }
+
+    // Like a save after the inputs snapshot read the working tree, and before the operation starts
+    function changeBeforeExecuting(testGraph: ITestGraph, name: string, change: () => void): void {
+      let pendingChange: (() => void) | undefined = change;
+      testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'changeBeforeExecuting', stage: CAPTURE_INPUT_FILES_STAGE - 1 },
+        (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+          if (record.operation.associatedProject.packageName === name) {
+            pendingChange?.();
+            pendingChange = undefined;
+          }
+          return undefined;
+        }
+      );
+    }
+
+    it('captures the input files of only the operations that execute', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      testGraph.cacheHits.add('a');
+      // Like a plugin that skips an operation whose outputs are up to date, if there is no cache entry for it
+      testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'test', stage: 10 },
+        (record: IOperationRunnerContext & IOperationExecutionResult): OperationStatus | undefined =>
+          record.operation.associatedProject.packageName === 'b' ? OperationStatus.Skipped : undefined
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.FromCache);
+      expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
+      expect(testGraph.executions).toEqual(['c']);
+      expect(getCapturedOperationNames()).toEqual(['c']);
+    });
+
+    it('checks the input files of an operation that a plugin made cacheable again after the iteration started', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      const runner: { cacheable: boolean } = testGraph.operations.get('a')!.runner as { cacheable: boolean };
+      // Like a plugin that marks the runner of an operation that it skips as not cacheable, and resets the runner
+      // in a tap that runs after that of CacheableOperationPlugin.
+      let skipsOperation: boolean = true;
+      testGraph.graph.hooks.beforeExecuteIterationAsync.tap('test', (): undefined => {
+        runner.cacheable = true;
+        return undefined;
+      });
+      testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'test', stage: -1000 },
+        (record: IOperationRunnerContext & IOperationExecutionResult): OperationStatus | undefined => {
+          if (skipsOperation && record.operation.associatedProject.packageName === 'a') {
+            runner.cacheable = false;
+            return OperationStatus.Skipped;
+          }
+          return undefined;
+        }
+      );
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b', 'c']);
+      expect(getCapturedOperationNames()).toEqual(['b', 'c']);
+
+      skipsOperation = false;
+      testGraph.localHashes.set('a', 'a-v2');
+      testGraph.onExecute = (name: string) => {
+        if (name === 'a') {
+          fs.writeFileSync(path.join(rootDirectory, getInputFile('a')), 'export const a = 22;');
+        }
+      };
+      jest.mocked(captureInputFilesState).mockClear();
+      await testGraph.executeAsync();
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(getCapturedOperationNames()).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual([]);
+    });
+
+    it('does not write cache entries if an input file was deleted', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      changeBeforeExecuting(testGraph, 'a', () => fs.unlinkSync(path.join(rootDirectory, getInputFile('a'))));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual([]);
+    });
+
+    it.each<[string, string, string[]]>([
+      ['does not write cache entries if a file was created in an input folder', 'a/src/new.ts', []],
+      [
+        'writes cache entries if a file that Git ignores was created in an input folder',
+        'a/src/debug.log',
+        names
+      ]
+    ])('%s', async (title: string, newFile: string, expectedCacheWrites: string[]) => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      changeBeforeExecuting(testGraph, 'a', () =>
+        fs.writeFileSync(path.join(rootDirectory, newFile), 'export const n = 1;')
+      );
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual(expectedCacheWrites);
+    });
+
+    it('writes cache entries if an untracked file that is not an input file was saved before the inputs snapshot hashed it', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      // Like a file that matches `incrementalBuildIgnoredGlobs`
+      const untrackedFile: string = 'a/src/notes.md';
+      const content: string = 'Saved within the tolerance of the file times';
+      fs.writeFileSync(path.join(rootDirectory, untrackedFile), content);
+      testGraph.snapshotHashes.set(untrackedFile, getGitBlobHash(content));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
+    });
+  });
+
+  describe('an operation that joins the iteration', () => {
+    const inputFile: string = 'b/src/index.ts';
+    let rootDirectory: string;
+    let inputFilePath: string;
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      fs.mkdirSync(path.join(rootDirectory, 'b', 'src'), { recursive: true });
+      inputFilePath = path.join(rootDirectory, inputFile);
+      fs.writeFileSync(inputFilePath, 'export const b = 1;');
+      jest.mocked(captureInputFilesState).mockClear();
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    // The name of each case, whether the input file of "b" changes while it executes, when the inputs snapshot of the
+    // joining request began to read the working tree, after the save that it saw, and the cache writes
+    it.each<[string, boolean, number, string[]]>([
+      [
+        'does not write its cache entry if they change while it executes',
+        true,
+        FILE_TIME_TOLERANCE_MS + 1,
+        ['a']
+      ],
+      [
+        'writes its cache entry if they do not change while it executes',
+        false,
+        FILE_TIME_TOLERANCE_MS + 1,
+        ['a', 'b']
+      ],
+      [
+        'writes its cache entry if they do not change while it executes, and it hashed a save within the tolerance of the file times',
+        false,
+        0,
+        ['a', 'b']
+      ]
+    ])(
+      'checks its input files against the inputs snapshot of the joining request, and %s',
+      async (
+        title: string,
+        changesWhileExecuting: boolean,
+        snapshotStartAfterSaveMs: number,
+        expectedCacheWrites: string[]
+      ) => {
+        const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+        const hash: string = getGitBlobHash('export const b = 1;');
+        testGraph.trackedFileHashes.set('b', new Map([[inputFile, hash]]));
+        testGraph.snapshotHashes.set(inputFile, hash);
+        const b: Operation = testGraph.operations.get('b')!;
+        // Like an operation that only a later request needs, which the Rush daemon holds for that request
+        b.enabled = false;
+        const checkedOperations: string[] = [];
+        // Like IncrementalExecutionGuardPlugin, which checks the input files of the other operations that execute
+        testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+          { name: 'test', stage: CAPTURE_INPUT_FILES_STAGE + 1 },
+          (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+            if (areInputFilesChecked(record)) {
+              checkedOperations.push(record.operation.associatedProject.packageName);
+            }
+            return undefined;
+          }
+        );
+        let extension: IOperationGraphExtensionResult | undefined;
+        let joiningSnapshotStartTimeMs: number | undefined;
+        testGraph.onExecute = (name: string) => {
+          if (name === 'a') {
+            // The request that joins while "a" executes saw a save of the input file of "b", which the inputs
+            // snapshot of the iteration did not. Its inputs snapshot hashed the saved file.
+            const savedHash: string = getGitBlobHash('export const b = 2;');
+            fs.writeFileSync(inputFilePath, 'export const b = 2;');
+            testGraph.trackedFileHashes.set('b', new Map([[inputFile, savedHash]]));
+            testGraph.snapshotHashes.set(inputFile, savedHash);
+            testGraph.localHashes.set('b', 'b-v2');
+            b.enabled = true;
+            joiningSnapshotStartTimeMs = getLatestFileTimeMs(inputFilePath) + snapshotStartAfterSaveMs;
+            extension = testGraph.graph.tryExtendCurrentIteration({
+              inputsSnapshot: testGraph.createInputsSnapshot(joiningSnapshotStartTimeMs),
+              neededOperations: [b]
+            });
+          } else if (changesWhileExecuting) {
+            // A different size, so that the save is detected even if the file time does not change
+            fs.writeFileSync(inputFilePath, 'export const b = 22;');
+          }
+        };
+        const iterationSnapshotStartTimeMs: number = Date.now();
+
+        const result: IExecutionResult = await testGraph.executeAsync(iterationSnapshotStartTimeMs, true);
+
+        expect(extension?.extended).toBe(true);
+        expect(result.status).toBe(OperationStatus.Success);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(checkedOperations).toEqual(['a', 'b']);
+        // The input files of "b" were captured for the inputs snapshot of the joining request. The save is in the window
+        // of the inputs snapshot of the iteration, which did not hash it, so that snapshot would stop the cache write.
+        expect(jest.mocked(captureInputFilesState).mock.calls.map((args) => args[2])).toEqual([
+          iterationSnapshotStartTimeMs,
+          joiningSnapshotStartTimeMs
+        ]);
+        expect(testGraph.cacheWrites).toEqual(expectedCacheWrites);
+      }
+    );
+
+    it('reads the reason that caching is disabled from the inputs snapshot of the joining request', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      const hash: string = getGitBlobHash('export const b = 1;');
+      testGraph.trackedFileHashes.set('b', new Map([[inputFile, hash]]));
+      testGraph.snapshotHashes.set(inputFile, hash);
+      const b: Operation = testGraph.operations.get('b')!;
+      // Like an operation that only a later request needs, which the Rush daemon holds for that request
+      b.enabled = false;
+      // An output of an earlier build of "b", which is on disk, so that the input files of "b" would not change if
+      // they were captured and checked
+      const outputFile: string = 'b/lib/index.js';
+      fs.mkdirSync(path.join(rootDirectory, 'b', 'lib'));
+      fs.writeFileSync(path.join(rootDirectory, outputFile), 'exports.b = 1;');
+      let extension: IOperationGraphExtensionResult | undefined;
+      testGraph.onExecute = (name: string) => {
+        if (name === 'a') {
+          // The request that joins while "a" executes saw that Git tracks the output file of "b", which the inputs
+          // snapshot of the iteration did not
+          const outputHash: string = getGitBlobHash('exports.b = 1;');
+          testGraph.trackedFileHashes.set(
+            'b',
+            new Map([
+              [inputFile, hash],
+              [outputFile, outputHash]
+            ])
+          );
+          testGraph.snapshotHashes.set(outputFile, outputHash);
+          testGraph.localHashes.set('b', 'b-v2');
+          b.enabled = true;
+          extension = testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: testGraph.createInputsSnapshot(Date.now()),
+            neededOperations: [b]
+          });
+        }
+      };
+
+      const iterationSnapshotStartTimeMs: number = Date.now();
+
+      const result: IExecutionResult = await testGraph.executeAsync(iterationSnapshotStartTimeMs, true);
+
+      expect(extension?.extended).toBe(true);
+      expect(result.status).toBe(OperationStatus.Success);
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      // Computed for "b" only once it executes, after the request joined
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['a', 'b']);
+      // Caching is disabled for "b", so its input files were not captured
+      expect(jest.mocked(captureInputFilesState).mock.calls.map((args) => args[2])).toEqual([
+        iterationSnapshotStartTimeMs
+      ]);
+      expect(testGraph.cacheWrites).toEqual(['a']);
+    });
+
+    it('leaves an operation that already executes with the inputs snapshot of the iteration', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      const a: Operation = testGraph.operations.get('a')!;
+      const b: Operation = testGraph.operations.get('b')!;
+      // So that the joining request, which needs only "b", does not need "a"
+      b.deleteDependency(a);
+      // Like an operation that only a later request needs, which the Rush daemon holds for that request
+      b.enabled = false;
+      // The inputs snapshot of the iteration hashed the input file of "a" before it was saved
+      const aInputFile: string = 'a/src/index.ts';
+      const aInputFilePath: string = path.join(rootDirectory, aInputFile);
+      fs.mkdirSync(path.dirname(aInputFilePath), { recursive: true });
+      fs.writeFileSync(aInputFilePath, 'export const a = 2;');
+      const iterationHash: string = getGitBlobHash('export const a = 1;');
+      testGraph.trackedFileHashes.set('a', new Map([[aInputFile, iterationHash]]));
+      testGraph.snapshotHashes.set(aInputFile, iterationHash);
+      let extension: IOperationGraphExtensionResult | undefined;
+      testGraph.onExecute = (name: string) => {
+        if (name === 'a') {
+          // The request that joins while "a" executes hashed the saved file
+          const savedHash: string = getGitBlobHash('export const a = 2;');
+          testGraph.trackedFileHashes.set('a', new Map([[aInputFile, savedHash]]));
+          testGraph.snapshotHashes.set(aInputFile, savedHash);
+          testGraph.localHashes.set('a', 'a-v2');
+          b.enabled = true;
+          extension = testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: testGraph.createInputsSnapshot(Date.now()),
+            neededOperations: [b]
+          });
+        }
+      };
+
+      // The inputs snapshot of the iteration began to read the working tree when the file was saved
+      const result: IExecutionResult = await testGraph.executeAsync(
+        getLatestFileTimeMs(aInputFilePath),
+        true
+      );
+
+      expect(extension?.extended).toBe(true);
+      // "a" was dispatched before the request joined, so the join changed only "b"
+      expect(extension?.changedOperations).toEqual(new Set([b]));
+      expect(result.status).toBe(OperationStatus.Success);
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      // "a" was built from the saved file, but its cache key is from the inputs snapshot of the iteration, which did
+      // not hash the save. So Git is asked about the file, and "a" does not write its cache entry.
+      expect(jest.mocked(hashFilesAsync).mock.calls.map((args) => args.slice(0, 2))).toEqual([
+        [rootDirectory, [aInputFile]]
+      ]);
+      expect(testGraph.cacheWrites).toEqual(['b']);
+    });
+  });
+
+  it('tells other plugins which operations it checks the input files of', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c', 'd']);
+    testGraph.cacheDisabledReasons.set('b', 'Caching has been disabled for this project.');
+    // Like a runner whose results are never written to the build cache
+    (testGraph.operations.get('c')!.runner as { cacheable: boolean }).cacheable = false;
+    const checkedOperations: string[] = [];
+    testGraph.graph.hooks.beforeExecuteIterationAsync.tap('test', (): undefined => {
+      checkedOperations.length = 0;
+      return undefined;
+    });
+    // Like IncrementalExecutionGuardPlugin, which checks the input files of the other operations that execute
+    testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+      { name: 'test', stage: CAPTURE_INPUT_FILES_STAGE + 1 },
+      (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+        if (areInputFilesChecked(record)) {
+          checkedOperations.push(record.operation.associatedProject.packageName);
+        }
+        return undefined;
+      }
+    );
+    await testGraph.executeAsync();
+    expect(checkedOperations.sort()).toEqual(['a', 'd']);
+
+    testGraph.localHashes.set('d', 'd-v2');
+    await testGraph.executeAsync();
+    expect(checkedOperations).toEqual(['d']);
+  });
+
+  describe('reason that caching is disabled', () => {
+    const cacheDisabledReason: string = 'Caching has been disabled for this project.';
+
+    it('is only computed for the operations that execute', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+      await testGraph.executeAsync();
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['a', 'b', 'c']);
+
+      testGraph.localHashes.set('c', 'c-v2');
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
+      expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
+      expect(testGraph.executions).toEqual(['c']);
+      expect(testGraph.cacheWrites).toEqual(['c']);
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['c']);
+    });
+
+    it('is computed once for each operation that executes', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+      testGraph.cacheDisabledReasons.set('b', cacheDisabledReason);
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(result.status).toBe(OperationStatus.Success);
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'c']);
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['a', 'b', 'c']);
+    });
+
+    it('is computed for every operation if cobuilds are enabled, to cluster the operations', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c'], '/repo', true, {
+        cobuildFeatureEnabled: true,
+        cobuildContextId: undefined
+      } as unknown as CobuildConfiguration);
+      // Without a build cache, an operation does not acquire a cobuild lock
+      for (const name of ['a', 'b', 'c']) {
+        testGraph.cacheDisabledReasons.set(name, cacheDisabledReason);
+      }
+      await testGraph.executeAsync();
+
+      testGraph.localHashes.set('c', 'c-v2');
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
+      expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
+      expect(testGraph.executions).toEqual(['c']);
+      expect([...testGraph.cacheDisabledReasonComputations].sort()).toEqual(['a', 'b', 'c']);
+    });
+  });
+
+  describe('deferred cache entry writes', () => {
+    const emptyReport: IDeferredCacheEntryWritesReport = {
+      queuedCount: 0,
+      writtenCount: 0,
+      writtenByteCount: 0,
+      failedCount: 0,
+      droppedCount: 0,
+      pendingCount: 0
+    };
+
+    function createDeferredWrites(...reports: IDeferredCacheEntryWritesReport[]): DeferredCacheEntryWrites {
+      return {
+        takeReport: jest.fn(() => reports.shift() ?? emptyReport)
+      } as unknown as DeferredCacheEntryWrites;
+    }
+
+    async function completeRequestAsync(
+      testGraph: ITestGraph,
+      result: IExecutionResult
+    ): Promise<{ output: string; warnings: string }> {
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const request: IOperationGraphRequestResult = {
+        operationResults: result.operationResults,
+        status: result.status,
+        commandName: 'build',
+        environment: {},
+        requestId: 'request-1',
+        terminal: new Terminal(terminalProvider)
+      };
+      await testGraph.graph.hooks.afterExecuteRequestAsync.promise(request);
+      return {
+        output: terminalProvider.getOutput({ normalizeSpecialCharacters: false }),
+        warnings: terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false })
+      };
+    }
+
+    it('passes them to each cache entry write and reports them after each request', async () => {
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites({
+        queuedCount: 2,
+        writtenCount: 1,
+        writtenByteCount: 1.5 * 1024 * 1024,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 1
+      });
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a', 'b'],
+        '/repo',
+        true,
+        undefined,
+        deferredWrites
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(testGraph.cacheWriteArguments).toEqual([
+        [undefined, deferredWrites],
+        [undefined, deferredWrites]
+      ]);
+      expect(await completeRequestAsync(testGraph, result)).toEqual({
+        output:
+          'Build cache entries written in the background since the previous command: ' +
+          '2 queued, 1 written (1.5 MB), 0 failed; 1 pending.\n',
+        warnings: ''
+      });
+      // A request without any activity reports nothing.
+      expect(await completeRequestAsync(testGraph, result)).toEqual({ output: '', warnings: '' });
+      expect(jest.mocked(deferredWrites.takeReport)).toHaveBeenCalledTimes(2);
+    });
+
+    it('that fail are reported as a warning', async () => {
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites({
+        queuedCount: 0,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 1,
+        droppedCount: 0,
+        pendingCount: 0
+      });
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a'],
+        '/repo',
+        true,
+        undefined,
+        deferredWrites
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(await completeRequestAsync(testGraph, result)).toEqual({
+        output: '',
+        warnings:
+          'Build cache entries written in the background since the previous command: ' +
+          '0 queued, 0 written (0.0 MB), 1 failed; 0 pending.\n'
+      });
+    });
+
+    it('that are dropped are reported, but not as a warning', async () => {
+      // An entry that was queued by an earlier command can be dropped during this one.
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites({
+        queuedCount: 0,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 1,
+        pendingCount: 0
+      });
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a'],
+        '/repo',
+        true,
+        undefined,
+        deferredWrites
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(await completeRequestAsync(testGraph, result)).toEqual({
+        output:
+          'Build cache entries written in the background since the previous command: ' +
+          '0 queued, 0 written (0.0 MB), 0 failed, 1 dropped; 0 pending.\n',
+        warnings: ''
+      });
+    });
+
+    it('are not used unless they are specified', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+
+      await testGraph.executeAsync();
+
+      // The writes are equivalent to trySetCacheEntryAsync(terminal).
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(testGraph.cacheWriteArguments).toEqual([
+        [undefined, undefined],
+        [undefined, undefined]
+      ]);
+      expect(testGraph.graph.hooks.afterExecuteRequestAsync.isUsed()).toBe(false);
+    });
+
+    it('are not used for cobuilds', async () => {
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites();
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a'],
+        '/repo',
+        true,
+        { cobuildFeatureEnabled: true, cobuildContextId: undefined } as unknown as CobuildConfiguration,
+        deferredWrites
+      );
+      // Without a build cache, an operation does not acquire a cobuild lock
+      testGraph.cacheDisabledReasons.set('a', 'Caching has been disabled for this project.');
+
+      await testGraph.executeAsync();
+
+      // Another cobuild agent reads an operation's entry as soon as the operation completes, so each entry is
+      // written before then, and the requests have nothing to report.
+      expect(testGraph.graph.hooks.afterExecuteRequestAsync.isUsed()).toBe(false);
+      expect(jest.mocked(deferredWrites.takeReport)).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
new file mode 100644
index 00000000000..3ebfb50b834
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -0,0 +1,1208 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+jest.mock('../OperationMetadataManager', () => {
+  class MockOperationMetadataManager {
+    public readonly logFilenameIdentifier: string;
+    public readonly metadataFolderPath: string = '.rush/temp/operation/mock';
+    public readonly stateFile: { state: undefined } = { state: undefined };
+    public constructor({ operation }: { operation: { logFilenameIdentifier: string } }) {
+      this.logFilenameIdentifier = operation.logFilenameIdentifier;
+    }
+    public async saveAsync(): Promise<void> {
+      /* noop */
+    }
+    public async tryRestoreAsync(): Promise<void> {
+      /* noop */
+    }
+    public tryRestoreStopwatch<T>(originalStopwatch: T): T {
+      return originalStopwatch;
+    }
+  }
+  return { OperationMetadataManager: MockOperationMetadataManager };
+});
+jest.mock('../../buildCache/OperationBuildCache', () => ({
+  OperationBuildCache: { forOperation: jest.fn() }
+}));
+
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { CobuildConfiguration } from '../../../api/CobuildConfiguration';
+import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import type { ICobuildContext, ICobuildLockProvider } from '../../cobuild/ICobuildLockProvider';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
+import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
+import { CacheableOperationPlugin } from '../CacheableOperationPlugin';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { OperationGraph } from '../OperationGraph';
+import { Operation } from '../Operation';
+import { OperationStatus } from '../OperationStatus';
+import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { setCommandExecution, skipBuildCacheRead } from '../IncrementalExecutionState';
+import { getTrustedStateHash, markSkipVerified } from '../RetainedResultVerification';
+import { NullOperationRunner } from '../NullOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+class CacheableMockRunner implements IOperationRunner {
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean = false;
+  public readonly isNoOp: boolean = false;
+  public readonly name: string;
+  readonly #executions: string[];
+  readonly #incrementalNames: ReadonlySet<string>;
+  readonly #failingNames: ReadonlySet<string>;
+
+  public constructor(
+    name: string,
+    executions: string[],
+    incrementalNames: ReadonlySet<string>,
+    failingNames: ReadonlySet<string>
+  ) {
+    this.name = name;
+    this.#executions = executions;
+    this.#incrementalNames = incrementalNames;
+    this.#failingNames = failingNames;
+  }
+
+  public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    if (this.#failingNames.has(this.name)) {
+      this.#executions.push(`${this.name}:failed`);
+      return OperationStatus.Failure;
+    }
+    if (this.#incrementalNames.has(this.name)) {
+      // Like a ShellOperationRunner whose incremental execution guard allowed its incremental command
+      setCommandExecution(context, { kind: 'incremental', hasIncrementalCommand: true });
+      this.#executions.push(`${this.name}:incremental`);
+    } else {
+      this.#executions.push(this.name);
+    }
+    return OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'config';
+  }
+}
+
+interface ITestGraph {
+  graph: OperationGraph;
+  operations: Map<string, Operation>;
+  localHashes: Map<string, string>;
+  executions: string[];
+  cacheWrites: string[];
+  cacheRestores: string[];
+  /**
+   * The operations that acquired a cobuild lock, if enabled by `cobuild`.
+   */
+  cobuildLocks: string[];
+  /**
+   * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
+   */
+  checks: string[];
+  /**
+   * The names of the operations whose runner executes its incremental command
+   */
+  incrementalNames: Set<string>;
+  /**
+   * The names of the operations whose runner fails
+   */
+  failingNames: Set<string>;
+  /**
+   * The names of the operations whose build cache entry cannot be written
+   */
+  failingWrites: Set<string>;
+  /**
+   * What an `afterExecuteOperationAsync` tap with a later stage than `CacheableOperationPlugin` saw for each
+   * operation in the last iteration
+   */
+  results: Map<string, IRecordedResult>;
+  executeAsync(isIncrementalBuildAllowed?: boolean): Promise<IExecutionResult>;
+}
+
+interface IRecordedResult {
+  status: OperationStatus;
+  stateHash: string;
+  trustedStateHash: string | undefined;
+}
+
+interface ITestGraphOptions {
+  /**
+   * The names of the operations that have no script, like a phase whose script is missing
+   */
+  noOpNames?: ReadonlySet<string>;
+  /**
+   * The names of the dependencies of each operation. By default, each operation depends on the previous one.
+   */
+  dependencies?: Record<string, string[]>;
+  cacheWriteEnabled?: boolean;
+  /**
+   * If set, emulates a plugin with its own change detection (e.g. by tracing the files that each operation reads),
+   * which reports a selected operation as skipped if its name is in this set, because its outputs are up to date.
+   */
+  upToDate?: ReadonlySet<string>;
+  /**
+   * If true, enables cobuilds with a lock provider that grants every lock and has no completed states.
+   */
+  cobuild?: boolean;
+  /**
+   * The operations whose skipped results the emulated change detection plugin marks as verified, each with the
+   * state hash that it marks, or undefined for the state hash of the operation in the iteration.
+   */
+  verifiedSkips?: ReadonlyMap<string, string | undefined>;
+  /**
+   * If set, emulates a plugin that reports a selected operation as restored from the build cache if its name is in
+   * this set and the build cache has no entry for it, because the plugin restored its outputs from elsewhere.
+   */
+  pluginFromCache?: ReadonlySet<string>;
+  /**
+   * The build cache entries, to share them with another test graph. By default, each test graph has its own.
+   */
+  cacheEntries?: Set<string>;
+}
+
+/**
+ * Creates a graph of cacheable operations. By default it is a linear chain: names[0] <- names[1] <- ...
+ * The mock build cache stores an entry per operation and state hash, and restores it if it exists.
+ */
+async function createTestGraphAsync(names: string[], options: ITestGraphOptions = {}): Promise<ITestGraph> {
+  const {
+    dependencies,
+    cacheWriteEnabled = true,
+    upToDate,
+    cobuild,
+    verifiedSkips,
+    pluginFromCache,
+    cacheEntries = new Set()
+  } = options;
+  const executions: string[] = [];
+  const checks: string[] = [];
+  const cacheWrites: string[] = [];
+  const cacheRestores: string[] = [];
+  const cobuildLocks: string[] = [];
+  const incrementalNames: Set<string> = new Set();
+  const failingNames: Set<string> = new Set();
+  const failingWrites: Set<string> = new Set();
+  const results: Map<string, IRecordedResult> = new Map();
+  const localHashes: Map<string, string> = new Map();
+  const operations: Map<string, Operation> = new Map();
+  const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+
+  let previous: Operation | undefined;
+  for (const name of names) {
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder: `/repo/${name}`,
+      projectRelativeFolder: name
+    } as unknown as RushConfigurationProject;
+    projectConfigurations.set(project, {
+      getCacheDisabledReason: () => undefined
+    } as unknown as RushProjectConfiguration);
+    const operation: Operation = new Operation({
+      runner: options.noOpNames?.has(name)
+        ? new NullOperationRunner({ name, result: OperationStatus.NoOp, silent: true })
+        : new CacheableMockRunner(name, executions, incrementalNames, failingNames),
+      logFilenameIdentifier: name,
+      phase: mockPhase,
+      project
+    });
+    if (previous && !dependencies) {
+      operation.addDependency(previous);
+    }
+    previous = operation;
+    operations.set(name, operation);
+    localHashes.set(name, `${name}-v1`);
+  }
+  for (const [name, dependencyNames] of Object.entries(dependencies ?? {})) {
+    for (const dependencyName of dependencyNames) {
+      operations.get(name)!.addDependency(operations.get(dependencyName)!);
+    }
+  }
+
+  jest.mocked(OperationBuildCache.forOperation).mockImplementation((record) => {
+    const name: string = record.operation.associatedProject.packageName;
+    const getCacheKey = (): string => `${name}@${record.getStateHash()}`;
+    return {
+      get cacheId(): string {
+        return getCacheKey();
+      },
+      tryRestoreFromCacheAsync: async () => {
+        const restored: boolean = cacheEntries.has(getCacheKey());
+        if (restored) {
+          cacheRestores.push(name);
+        }
+        return restored;
+      },
+      trySetCacheEntryAsync: async () => {
+        if (failingWrites.has(name)) {
+          return false;
+        }
+        cacheWrites.push(name);
+        cacheEntries.add(getCacheKey());
+        return true;
+      }
+    } as unknown as OperationBuildCache;
+  });
+
+  const cobuildLockProvider: Pick<
+    ICobuildLockProvider,
+    'acquireLockAsync' | 'renewLockAsync' | 'getCompletedStateAsync' | 'setCompletedStateAsync'
+  > = {
+    acquireLockAsync: async ({ packageName }: ICobuildContext) => {
+      cobuildLocks.push(packageName);
+      return true;
+    },
+    renewLockAsync: async () => {
+      /* noop */
+    },
+    getCompletedStateAsync: async () => undefined,
+    setCompletedStateAsync: async () => {
+      /* noop */
+    }
+  };
+
+  const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new CacheableOperationPlugin({
+    allowWarningsInSuccessfulBuild: false,
+    buildCacheConfiguration: {
+      buildCacheEnabled: true,
+      cacheWriteEnabled
+    } as unknown as BuildCacheConfiguration,
+    cobuildConfiguration: cobuild
+      ? ({
+          cobuildFeatureEnabled: true,
+          cobuildContextId: 'context',
+          cobuildRunnerId: 'runner',
+          cobuildLeafProjectLogOnlyAllowed: false,
+          getCobuildLockProvider: () => cobuildLockProvider
+        } as unknown as CobuildConfiguration)
+      : undefined,
+    terminal,
+    excludeAppleDoubleFiles: false,
+    useDirectFileTransfersForBuildCache: false
+  }).apply(hooks);
+
+  const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    projectConfigurations
+  } as unknown as IOperationGraphContext);
+  if (upToDate) {
+    graph.hooks.beforeExecuteIterationAsync.tap('TestChangeDetectionPlugin', (records) => {
+      for (const operation of records.keys()) {
+        (operation.runner as CacheableMockRunner).cacheable = true;
+      }
+    });
+    graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      // Before the build cache is read
+      { name: 'TestChangeDetectionPlugin', stage: -200 },
+      async (
+        record: IOperationRunnerContext & IOperationExecutionResult
+      ): Promise<OperationStatus | undefined> => {
+        if (record.silent) {
+          return;
+        }
+        const { name } = record.operation;
+        checks.push(name);
+        if (!upToDate.has(name)) {
+          return;
+        }
+        // The build cache does not handle operations that another plugin skipped.
+        (record.operation.runner as CacheableMockRunner).cacheable = false;
+        if (verifiedSkips?.has(name)) {
+          markSkipVerified(record, verifiedSkips.get(name) ?? record.getStateHash());
+        }
+        return OperationStatus.Skipped;
+      }
+    );
+  }
+  if (pluginFromCache) {
+    graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      // After the build cache is read
+      { name: 'TestRestorePlugin', stage: 10 },
+      async (
+        record: IOperationRunnerContext & IOperationExecutionResult
+      ): Promise<OperationStatus | undefined> => {
+        if (record.silent || !pluginFromCache.has(record.operation.name)) {
+          return;
+        }
+        return OperationStatus.FromCache;
+      }
+    );
+  }
+  graph.hooks.afterExecuteOperationAsync.tap(
+    // After CacheableOperationPlugin decided whether to trust the result
+    { name: 'TestTrustObserverPlugin', stage: 100 },
+    (record: IOperationRunnerContext & IOperationExecutionResult): void => {
+      results.set(record.operation.name, {
+        status: record.status,
+        stateHash: record.getStateHash(),
+        trustedStateHash: getTrustedStateHash(record)
+      });
+    }
+  );
+
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes: new Map(),
+    rootDirectory: '/repo',
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: () => new Map(),
+    getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
+  };
+
+  return {
+    graph,
+    operations,
+    localHashes,
+    executions,
+    cacheWrites,
+    cacheRestores,
+    cobuildLocks,
+    checks,
+    incrementalNames,
+    failingNames,
+    failingWrites,
+    results,
+    executeAsync: async (isIncrementalBuildAllowed?: boolean) => {
+      executions.length = 0;
+      cacheWrites.length = 0;
+      cacheRestores.length = 0;
+      cobuildLocks.length = 0;
+      checks.length = 0;
+      results.clear();
+      return await graph.executeAsync({ inputsSnapshot, isIncrementalBuildAllowed });
+    }
+  };
+}
+
+function getStatus(testGraph: ITestGraph, result: IExecutionResult, name: string): OperationStatus {
+  return (result.operationResults.get(testGraph.operations.get(name)!) as OperationExecutionRecord).status;
+}
+
+// How results retained by earlier iterations of a long-lived graph (e.g. the Rush daemon) are trusted.
+describe(`${CacheableOperationPlugin.name} retained results`, () => {
+  it('resumes cache writes for consumers after an --only request', async () => {
+    // "lib" <- "tool" <- "app", like @rushstack/node-core-library <- @rushstack/ts-command-line <- @rushstack/heft
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app']);
+    const lib: Operation = testGraph.operations.get('lib')!;
+    const app: Operation = testGraph.operations.get('app')!;
+    await testGraph.executeAsync();
+
+    // S1: edit "app", then --to app
+    testGraph.localHashes.set('app', 'app-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['app']);
+
+    // S2: edit "tool", then --only tool. As in a run that does not select "lib", its entry is not written.
+    testGraph.localHashes.set('tool', 'tool-v2');
+    lib.enabled = false;
+    app.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['tool']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // S3: --to app
+    lib.enabled = true;
+    app.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['tool', 'app']);
+    expect(testGraph.cacheWrites).toEqual(['tool', 'app']);
+
+    // S4: edit "app", then --to app
+    testGraph.localHashes.set('app', 'app-v3');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+  });
+
+  it('keeps trusting operations that a request did not select', async () => {
+    // "a" <- "b" <- "c", and "a" <- "tool"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c', 'tool'], {
+      dependencies: { b: ['a'], c: ['b'], tool: ['a'] }
+    });
+    const { operations } = testGraph;
+    await testGraph.executeAsync();
+
+    for (let round: number = 2; round <= 3; round++) {
+      // --to tool
+      testGraph.localHashes.set('tool', `tool-v${round}`);
+      operations.get('b')!.enabled = false;
+      operations.get('c')!.enabled = false;
+      operations.get('tool')!.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['tool']);
+      expect(testGraph.cacheWrites).toEqual(['tool']);
+
+      // --to c
+      testGraph.localHashes.set('c', `c-v${round}`);
+      operations.get('b')!.enabled = true;
+      operations.get('c')!.enabled = true;
+      operations.get('tool')!.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['c']);
+      expect(testGraph.cacheWrites).toEqual(['c']);
+    }
+  });
+
+  it('does not write a result built against a trusted dependency that the request did not select', async () => {
+    // The outputs of "a" are not part of its state hash, so they may have been edited in place since it executed.
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // Edit "b", then --only b: "b" is built against outputs of "a" that this iteration did not verify.
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Repeating the request cannot produce a trusted result for "b", so it is skipped.
+    const repeatedResult: IExecutionResult = await testGraph.executeAsync();
+    expect(repeatedResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+
+    // --to b: "b" has no entry at its state hash, so it executes again.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not acquire a cobuild lock for a result built against a trusted dependency that the request did not select', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cobuild: true });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+    expect(testGraph.cobuildLocks).toEqual(['a', 'b']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    // Edit "b", then --only b: as for a write, a lock is only acquired for a result that can be written.
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cobuildLocks).toEqual([]);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not write a result built against a trusted dependency that the request did not select, through an operation without a script', async () => {
+    // "a" <- "n" <- "b", where "n" has no script
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'n', 'b'], {
+      noOpNames: new Set(['n'])
+    });
+    const { operations } = testGraph;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    // Edit "b", then --only b: "b" is built against outputs of "a" that this iteration did not verify.
+    testGraph.localHashes.set('b', 'b-v2');
+    operations.get('a')!.enabled = false;
+    operations.get('n')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to b
+    operations.get('a')!.enabled = true;
+    operations.get('n')!.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+  });
+
+  it('keeps trusting a skipped consumer of an operation without a script whose dependency the request did not select', async () => {
+    // "a" <- "n" <- "c", where "n" has no script, and "d"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'n', 'c', 'd'], {
+      noOpNames: new Set(['n']),
+      dependencies: { n: ['a'], c: ['n'] }
+    });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // Edit "d", then --impacted-by n --to d: "n" has no outputs, so it keeps its trust, and so does "c", which
+    // is skipped.
+    testGraph.localHashes.set('d', 'd-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['d']);
+    expect(testGraph.cacheWrites).toEqual(['d']);
+
+    // --to c --to d
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('keeps trusting a skipped result whose dependency the request did not select, but does not write its consumers', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // Edit "c", then --impacted-by b: "b" is skipped, and "c" can read the unverified outputs of "a" through it.
+    testGraph.localHashes.set('c', 'c-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to c: "b" was not built in that iteration, so it is still trusted.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual(['c']);
+  });
+
+  it('trusts a result restored from the build cache while its dependency is not selected, but does not write its consumers', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+    testGraph.localHashes.set('b', 'b-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['b', 'c']);
+
+    // Revert "b" and edit "c", then --impacted-by b: "b" has an entry from the first iteration, and "c" can read
+    // the unverified outputs of "a" through it.
+    testGraph.localHashes.set('b', 'b-v1');
+    testGraph.localHashes.set('c', 'c-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['b']);
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to c: the restored outputs of "b" match its state hash.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual(['c']);
+  });
+
+  it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both: "b" is built against the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to b: "b" has the same state hash as its retained result, but "a" is rebuilt.
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Success);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute an untrusted retained result while a dependency that was not selected is untrusted', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    testGraph.operations.get('a')!.enabled = false;
+
+    // Cold --only b: "a" has never executed in this graph.
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Repeating the request cannot produce a trusted result for "b", so it is skipped.
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('restores an untrusted retained result from the build cache when an entry exists', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing "a": "b" is built against the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Revert "a", then --to b: both have entries from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.FromCache);
+    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.FromCache);
+    expect(testGraph.executions).toEqual([]);
+    expect(testGraph.cacheRestores).toEqual(['a', 'b']);
+
+    // Both are trusted again.
+    testGraph.localHashes.set('b', 'b-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+  });
+
+  it('restores nothing from the build cache in a non-incremental iteration, but still writes to it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+    testGraph.localHashes.set('a', 'a-v2');
+    await testGraph.executeAsync();
+
+    // Revert "a", then rebuild --to b: both have entries from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    const result: IExecutionResult = await testGraph.executeAsync(false);
+    expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Success);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+  });
+
+  it('does not re-execute untrusted retained results when cache writes are disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    testGraph.localHashes.set('b', 'b-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('re-executes a retained result that was built against a dependency that has since been rebuilt when cache writes are disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not check results that a plugin found up to date again while their state hashes are unchanged', async () => {
+    const upToDate: Set<string> = new Set(['lib', 'tool', 'app']);
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], { upToDate });
+
+    // The outputs were built before this graph was created.
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['lib', 'tool', 'app']);
+    expect(testGraph.executions).toEqual([]);
+
+    // Checking a skipped result again cannot make it trusted, so it is not re-enabled.
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+
+    // Edit "app": its dependencies are not trusted, so its cache entry is not written.
+    testGraph.localHashes.set('app', 'app-v2');
+    upToDate.delete('app');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    const secondHotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(secondHotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('trusts an incremental result, but writes neither it nor the results built against it to the build cache', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
+
+    // Edit "a", which runs its incremental command.
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Nothing changed, so nothing runs again.
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "c": it is built against the retained outputs of "b", which were built against the incremental result.
+    testGraph.localHashes.set('c', 'c-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    const secondHotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(secondHotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "a", which runs its initial command: every result can be written again.
+    testGraph.localHashes.set('a', 'a-v3');
+    testGraph.incrementalNames.delete('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
+  });
+
+  it('does not write results built against an incremental result that the request did not select', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    const { operations } = testGraph;
+    await testGraph.executeAsync();
+
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --only b: "b" is built against the retained incremental result of "a".
+    testGraph.localHashes.set('b', 'b-v2');
+    operations.get('a')!.enabled = false;
+    operations.get('c')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --only c: "c" is built against "b", which was built against the incremental result of "a".
+    testGraph.localHashes.set('c', 'c-v2');
+    operations.get('b')!.enabled = false;
+    operations.get('c')!.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not write results built against an incremental result through an operation without a script', async () => {
+    // "a" <- "b-lite" <- "b", like the phases of the rushstack repo: the build of a project depends only on a phase of
+    // its own project that has no script and depends on the builds of upstream projects.
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b-lite', 'b'], {
+      noOpNames: new Set(['b-lite'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --only b: "b" is built against the retained incremental result of "a", through the retained "b-lite".
+    testGraph.localHashes.set('b', 'b-v2');
+    testGraph.operations.get('a')!.enabled = false;
+    testGraph.operations.get('b-lite')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('restores a consumer of an incremental result from the build cache and trusts it as a cacheable result', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    await testGraph.executeAsync();
+
+    // Edit "a", which runs its incremental command, and "c".
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('c', 'c-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Revert both: every operation has an entry from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    testGraph.localHashes.set('c', 'c-v1');
+    testGraph.incrementalNames.delete('a');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['a', 'b', 'c']);
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "c": it is built against restored outputs, so its result is written.
+    testGraph.localHashes.set('c', 'c-v3');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual(['c']);
+  });
+
+  it('does not restore an operation whose runner skipped the build cache read, and writes neither it nor its consumers', async () => {
+    // "a" <- "b"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    // Like a warm worker, whose outputs are what it keeps in memory: a restore would not update them.
+    testGraph.graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      { name: 'skip-read', stage: -1 },
+      async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<undefined> => {
+        if (testGraph.incrementalNames.has(record.operation.associatedProject.packageName)) {
+          skipBuildCacheRead(record);
+        }
+        return undefined;
+      }
+    );
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Revert "a": both operations have an entry from the first iteration, but only "b" may be restored.
+    testGraph.localHashes.set('a', 'a-v1');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['b']);
+    expect(testGraph.executions).toEqual(['a:incremental']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not re-enable operations that another plugin disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    // Like a plugin that performs the work itself. This tap runs after PhasedOperationPlugin's.
+    testGraph.graph.hooks.configureIteration.tap('TestPlugin', (records) => {
+      for (const record of records.values()) {
+        record.enabled = false;
+      }
+    });
+
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+});
+
+// Skipped results that a plugin verified, and the state hash at which each result is trusted.
+describe(`${CacheableOperationPlugin.name} verified skipped results`, () => {
+  function expectTrusted(testGraph: ITestGraph, name: string): void {
+    const result: IRecordedResult | undefined = testGraph.results.get(name);
+    expect(result?.trustedStateHash).toBeDefined();
+    expect(result?.trustedStateHash).toBe(result?.stateHash);
+  }
+
+  function expectNotTrusted(testGraph: ITestGraph, name: string): void {
+    expect(testGraph.results.has(name)).toBe(true);
+    expect(testGraph.results.get(name)?.trustedStateHash).toBeUndefined();
+  }
+
+  it('writes the consumers of skipped results that a plugin verified, in the first iteration of a graph', async () => {
+    // "lib" <- "tool" <- "app"
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool']),
+      verifiedSkips: new Map([
+        ['lib', undefined],
+        ['tool', undefined]
+      ])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['lib', 'tool', 'app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+  });
+
+  it('does not write the consumers of a skipped result that a plugin verified at another state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool']),
+      verifiedSkips: new Map([
+        ['lib', undefined],
+        ['tool', 'another-state-hash']
+      ])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not write the consumers of skipped results that no plugin verified', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not trust a verified skipped result whose dependency blocks cache writes', async () => {
+    // "lib" was skipped without verification, so "tool" was verified against outputs that may not match.
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool']),
+      verifiedSkips: new Map([['tool', undefined]])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+    expectNotTrusted(testGraph, 'tool');
+  });
+
+  it('does not trust a verified skipped result whose dependency blocked cache writes after that dependency runs again', async () => {
+    // "lib" was skipped without verification, so "tool" was verified against outputs that may not match.
+    const upToDate: Set<string> = new Set(['lib', 'tool']);
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate,
+      verifiedSkips: new Map([['tool', undefined]])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // The daemon invalidates "lib", which runs again at the same state hash. "tool" keeps the result that was
+    // verified against the unverified outputs of "lib", so "app", which was built against it, is not written.
+    upToDate.delete('lib');
+    testGraph.graph.invalidateOperations([testGraph.operations.get('lib')!], 'daemon graph invalidate');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['lib']);
+    expect(testGraph.executions).toEqual(['lib']);
+    expect(testGraph.cacheWrites).toEqual(['lib']);
+  });
+
+  it('does not write the consumers of a verified skipped result whose dependency the request did not select', async () => {
+    const upToDate: Set<string> = new Set();
+    const verifiedSkips: Map<string, string | undefined> = new Map();
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate,
+      verifiedSkips
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['lib', 'tool', 'app']);
+
+    // Edit "tool", which the plugin verifies, then --impacted-by tool: "app" can read the unverified outputs of
+    // "lib" through "tool".
+    testGraph.localHashes.set('tool', 'tool-v2');
+    upToDate.add('tool');
+    verifiedSkips.set('tool', undefined);
+    testGraph.operations.get('lib')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['tool', 'app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('keeps trusting skipped results that a plugin verified in later iterations of a long-lived graph', async () => {
+    const upToDate: Set<string> = new Set(['lib', 'tool', 'app']);
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate,
+      verifiedSkips: new Map([
+        ['lib', undefined],
+        ['tool', undefined],
+        ['app', undefined]
+      ])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "app": its dependencies are trusted, so its cache entry is written.
+    testGraph.localHashes.set('app', 'app-v2');
+    upToDate.delete('app');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+  });
+
+  it('reports the state hash of results built while cache writes are allowed', async () => {
+    // "a" <- "b"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+    expectTrusted(testGraph, 'a');
+    expectTrusted(testGraph, 'b');
+  });
+
+  it('reports the state hash of results restored from the build cache', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+    testGraph.localHashes.set('a', 'a-v2');
+    await testGraph.executeAsync();
+
+    // Revert "a": both have entries from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['a', 'b']);
+    expectTrusted(testGraph, 'a');
+    expectTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash for a skipped result that no plugin verified, or for its consumers', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { upToDate: new Set(['a']) });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash for a failed result', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    testGraph.failingNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Failure);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for an incremental result, or for the results built against it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+
+    // Edit "a", which runs its incremental command.
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b']);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash when cache writes are disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('reports the state hash of a skipped result that a plugin verified at that state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], {
+      upToDate: new Set(['a']),
+      verifiedSkips: new Map([['a', undefined]])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Skipped);
+    expectTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a skipped result that a plugin verified at another state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], {
+      upToDate: new Set(['a']),
+      verifiedSkips: new Map([['a', 'another-state-hash']])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Skipped);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('reports the state hash of a result that a plugin restored while cache writes are allowed', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a'], { pluginFromCache: new Set(['a']) });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.FromCache);
+    expectTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a result that a plugin restored while a dependency blocks cache writes', async () => {
+    // "x" <- "a"
+    const testGraph: ITestGraph = await createTestGraphAsync(['x', 'a'], {
+      upToDate: new Set(['x']),
+      pluginFromCache: new Set(['a'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.FromCache);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a result restored from the build cache while a dependency blocks cache writes', async () => {
+    // "x" <- "b"
+    const cacheEntries: Set<string> = new Set();
+    const firstGraph: ITestGraph = await createTestGraphAsync(['x', 'b'], { cacheEntries });
+    await firstGraph.executeAsync();
+    expect(firstGraph.cacheWrites).toEqual(['x', 'b']);
+
+    // A new graph with the same build cache, in which a plugin skips "x" without verifying it
+    const testGraph: ITestGraph = await createTestGraphAsync(['x', 'b'], {
+      cacheEntries,
+      upToDate: new Set(['x'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['b']);
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash for a result whose build cache entry could not be written', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a']);
+    testGraph.failingWrites.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.SuccessWithWarning);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a result retained by a previous iteration, or for its consumers', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+
+    // Edit "b", then --only b
+    testGraph.localHashes.set('b', 'b-v2');
+    testGraph.operations.get('a')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Skipped);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
new file mode 100644
index 00000000000..e6ea0d51c65
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -0,0 +1,2082 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/* eslint max-lines: off */
+
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+jest.mock('../OperationMetadataManager', () => {
+  class MockOperationMetadataManager {
+    public readonly logFilenameIdentifier: string;
+    public readonly metadataFolderPath: string = '.rush/temp/operation/mock';
+    public readonly stateFile: { state: undefined } = { state: undefined };
+    public constructor({ operation }: { operation: { logFilenameIdentifier: string } }) {
+      this.logFilenameIdentifier = operation.logFilenameIdentifier;
+    }
+    public async saveAsync(): Promise<void> {
+      /* noop */
+    }
+    public async tryRestoreAsync(): Promise<void> {
+      /* noop */
+    }
+    public tryRestoreStopwatch<T>(originalStopwatch: T): T {
+      return originalStopwatch;
+    }
+  }
+  return { OperationMetadataManager: MockOperationMetadataManager };
+});
+jest.mock('../InputFilesStatSignature', () => {
+  const actual: typeof import('../InputFilesStatSignature') = jest.requireActual(
+    '../InputFilesStatSignature'
+  );
+  return { ...actual, captureInputFilesState: jest.fn(actual.captureInputFilesState) };
+});
+
+import type * as childProcess from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { PassThrough } from 'node:stream';
+
+import { LookupByPath } from '@rushstack/lookup-by-path';
+import { Executable, SubprocessTerminator } from '@rushstack/node-core-library';
+import { type ITerminal, MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import { EnvironmentConfiguration } from '../../../api/EnvironmentConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IOperationSettings, RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import type {
+  IIncrementalExecutionGuard,
+  IOperationCommandExecution,
+  IOperationLastState,
+  IOperationRunner,
+  IOperationRunnerContext
+} from '../../../index';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import { Utilities } from '../../../utilities/Utilities';
+import { InputsSnapshot, type IInputsSnapshotProjectMetadata } from '../../incremental/InputsSnapshot';
+import { IncrementalExecutionGuardPlugin } from '../IncrementalExecutionGuardPlugin';
+import {
+  clearIncrementalExecutionGuard,
+  getCommandExecution,
+  getIncrementalExecutionGuard,
+  INPUTS_CHANGED_INVALIDATION_REASON,
+  NATIVE_COMMAND_INVALIDATION_REASON,
+  setCommandExecution,
+  setIncrementalExecutionGuard,
+  setWatchedCommandCallback,
+  wasExecutedIncrementally,
+  type ICommandExecution,
+  type IIncrementalExecutionGuardOptions
+} from '../IncrementalExecutionState';
+import { captureInputFilesState, type IInputFilesState } from '../InputFilesStatSignature';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import type { IOperationGraphExtensionResult } from '../IOperationGraph';
+import { type ILegacySkipPluginOptions, LegacySkipPlugin } from '../LegacySkipPlugin';
+import { NullOperationRunner } from '../NullOperationRunner';
+import { Operation } from '../Operation';
+import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import {
+  CAPTURE_INPUT_FILES_STAGE,
+  markInputFilesChecked,
+  markResultUnverifiable
+} from '../RetainedResultVerification';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+
+const PHASE_NAME: string = '_phase:build';
+const INITIAL_COMMAND: string = 'node build.js';
+const INCREMENTAL_COMMAND: string = 'node build.js --incremental';
+
+const buildPhase: IPhase = {
+  name: PHASE_NAME,
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: '_phase_build',
+  missingScriptBehavior: 'error'
+};
+
+const liteBuildPhase: IPhase = {
+  ...buildPhase,
+  name: '_phase:lite-build',
+  logFilenameIdentifier: '_phase_lite-build',
+  missingScriptBehavior: 'silent'
+};
+
+interface IProjectSpec {
+  readonly name: string;
+  readonly dependencies?: ReadonlyArray<string>;
+  readonly devDependencies?: ReadonlyArray<string>;
+  /**
+   * If set, the build writes a single bundle `dist/main.js` instead of a `lib` file per source file.
+   */
+  readonly isBundle?: boolean;
+  readonly dependsOnEnvVars?: ReadonlyArray<string>;
+  /**
+   * If set, the project has a `profiles` folder, like a rig package.
+   */
+  readonly isRig?: boolean;
+  /**
+   * Files outside of the project that its build depends on, like `dependsOnAdditionalFiles` in rush-project.json
+   */
+  readonly additionalFiles?: ReadonlyArray<string>;
+  /**
+   * If set, the operation runs in a runner like that of a Rush plugin, which uses only the public API of Rush and runs
+   * the build itself. An `unreported` runner asks the guard, but never reports which command it runs.
+   */
+  readonly pluginRunner?: 'reported' | 'unreported';
+}
+
+interface IWorkspaceOptions {
+  /**
+   * If set, like the phases of the rushstack repo, the build of each project depends only on a `_phase:lite-build`
+   * operation of its own project, which has no script and depends on the builds of the project's dependencies.
+   */
+  readonly hasPassThroughPhase?: boolean;
+  /**
+   * If set, the runners pass these options to the guard, like `WarmWorkerOperationRunner`.
+   */
+  readonly guardOptions?: IIncrementalExecutionGuardOptions;
+  /**
+   * If set, applies the skip detection that Rush uses when the build cache is not enabled.
+   */
+  readonly hasLegacySkipDetection?: boolean;
+  /**
+   * Options of the skip detection of `hasLegacySkipDetection`, e.g. `isIncrementalBuildAllowed: false`, like
+   * `rush rebuild`
+   */
+  readonly legacySkipOptions?: Partial<ILegacySkipPluginOptions>;
+  /**
+   * If false, the guard is not applied, like in `rush build` without the Rush daemon, or in a Rush daemon whose
+   * `daemon.incrementalBuilds` setting is off. Defaults to true.
+   */
+  readonly hasIncrementalExecutionGuard?: boolean;
+  /**
+   * If set, the runners report that each command ran in a process that keeps watching the input files, like
+   * `WarmWorkerOperationRunner`. A function is called for each command. A runner like that of a Rush plugin reports
+   * it before the command starts, as `WarmWorkerOperationRunner` does, and Rush's shell command runner after it ran.
+   */
+  readonly watchesInputs?: boolean | (() => boolean);
+  /**
+   * If set, each inputs snapshot records when it began reading the working tree, like one that Git computes.
+   */
+  readonly recordsWorkingTreeReadStartTime?: boolean;
+  /**
+   * If set, the build phase allows warnings, like `allowWarningsOnSuccess` in command-line.json.
+   */
+  readonly allowWarningsOnSuccess?: boolean;
+}
+
+interface ITestIteration {
+  readonly result: IExecutionResult;
+  /**
+   * Each command that ran, as `<project>:initial` or `<project>:incremental`
+   */
+  readonly commands: ReadonlyArray<string>;
+  readonly output: string;
+  getStatus(name: string): OperationStatus;
+}
+
+interface ITestWorkspace {
+  readonly rootFolder: string;
+  readonly graph: OperationGraph;
+  readonly operations: ReadonlyMap<string, Operation>;
+  writeFile(relativePath: string, content: string): void;
+  deleteFile(relativePath: string): void;
+  /**
+   * Deletes a folder and writes its files again, like a branch switch that removed the folder and restored it.
+   */
+  recreateFolder(relativePath: string): void;
+  executeAsync(
+    environment?: Readonly<Record<string, string>>,
+    isIncrementalBuildAllowed?: boolean,
+    holdUnneededOperations?: boolean
+  ): Promise<ITestIteration>;
+  /**
+   * Takes an inputs snapshot of the workspace, like a request of the Rush daemon. It records that it began to
+   * read the working tree at `startTimeMs`, or now by default if `recordsWorkingTreeReadStartTime` is set.
+   */
+  createInputsSnapshot(environment?: Readonly<Record<string, string>>, startTimeMs?: number): InputsSnapshot;
+  /**
+   * Resolves when the next command that hangs has written its outputs. It runs until it is terminated.
+   */
+  waitForHangAsync(): Promise<void>;
+}
+
+const workspaceFolders: string[] = [];
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  for (const folder of workspaceFolders.splice(0)) {
+    fs.rmSync(folder, { recursive: true, force: true });
+  }
+});
+
+function listFiles(folder: string, exclude: ReadonlySet<string> = new Set()): string[] {
+  const files: string[] = [];
+  const visit = (relativeFolder: string): void => {
+    for (const entry of fs.readdirSync(path.join(folder, relativeFolder), { withFileTypes: true })) {
+      const relativePath: string = relativeFolder ? `${relativeFolder}/${entry.name}` : entry.name;
+      if (exclude.has(relativePath)) {
+        continue;
+      }
+      if (entry.isDirectory()) {
+        visit(relativePath);
+      } else {
+        files.push(relativePath);
+      }
+    }
+  };
+  visit('');
+  return files.sort();
+}
+
+function recreateFolder(folder: string): void {
+  const contentByFile: Map<string, Buffer> = new Map(
+    listFiles(folder).map((file: string) => [file, fs.readFileSync(`${folder}/${file}`)])
+  );
+  fs.rmSync(folder, { recursive: true });
+  for (const [file, content] of contentByFile) {
+    fs.mkdirSync(path.dirname(`${folder}/${file}`), { recursive: true });
+    fs.writeFileSync(`${folder}/${file}`, content);
+  }
+}
+
+// Recreates a folder by moving its entries into a new folder, which keeps the identity, size and times of each file.
+function moveFolder(folder: string): void {
+  const newFolder: string = `${folder}.new`;
+  fs.mkdirSync(newFolder);
+  for (const entry of fs.readdirSync(folder)) {
+    fs.renameSync(`${folder}/${entry}`, `${newFolder}/${entry}`);
+  }
+  fs.rmdirSync(folder);
+  fs.renameSync(newFolder, folder);
+}
+
+// Like a compiler: writes a file per source file, and its incremental mode neither cleans the output folder nor
+// deletes the outputs of deleted source files. A source containing "emit:<name>" also emits "<name>.js", a
+// source containing "recreate:<folder>" deletes and recreates that folder of the project while the build runs, a
+// source containing "move:<folder>" recreates that folder by moving its files while the build runs, a source
+// containing "warning" adds a warning to `warnings`, a source containing "error" fails the build, and after the
+// output of a source containing "hang", the build runs until it is terminated (it returns undefined).
+function build(
+  projectFolder: string,
+  isBundle: boolean,
+  isIncremental: boolean,
+  warnings: string[] = []
+): number | undefined {
+  const outputFolder: string = `${projectFolder}/${isBundle ? 'dist' : 'lib'}`;
+  if (!isIncremental) {
+    fs.rmSync(outputFolder, { recursive: true, force: true });
+  }
+  fs.mkdirSync(outputFolder, { recursive: true });
+  const bundle: string[] = [];
+  for (const sourcePath of listFiles(`${projectFolder}/src`)) {
+    const source: string = fs.readFileSync(`${projectFolder}/src/${sourcePath}`, 'utf8');
+    if (source.includes('error')) {
+      return 1;
+    }
+    if (source.includes('warning')) {
+      warnings.push(`Warning in ${sourcePath}`);
+    }
+    bundle.push(source);
+    if (!isBundle) {
+      const outputPath: string = `${outputFolder}/${sourcePath.replace(/\.ts$/, '.js')}`;
+      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+      fs.writeFileSync(outputPath, source);
+    }
+    const emitted: RegExpExecArray | null = /emit:(\w+)/.exec(source);
+    if (emitted) {
+      fs.writeFileSync(`${outputFolder}/${emitted[1]}.js`, '');
+    }
+    const recreated: RegExpExecArray | null = /recreate:([\w/]+)/.exec(source);
+    if (recreated) {
+      recreateFolder(`${projectFolder}/${recreated[1]}`);
+    }
+    const moved: RegExpExecArray | null = /move:([\w/]+)/.exec(source);
+    if (moved) {
+      moveFolder(`${projectFolder}/${moved[1]}`);
+    }
+    if (source.includes('hang')) {
+      return undefined;
+    }
+  }
+  if (isBundle) {
+    fs.writeFileSync(`${outputFolder}/main.js`, bundle.join('\n'));
+  }
+  return 0;
+}
+
+/**
+ * Runs the build itself, like the runner of a Rush plugin, and uses only the public API of Rush. It follows the steps
+ * that the documentation of `IOperationRunnerContext.getIncrementalExecutionGuard` describes.
+ */
+class PluginOperationRunner implements IOperationRunner {
+  public readonly name: string;
+  public readonly cacheable: boolean = true;
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly warningsAreAllowed: boolean = false;
+  readonly #runBuild: (kind: IOperationCommandExecution['kind']) => number | undefined;
+  readonly #reportsCommandExecutions: boolean;
+  readonly #watchesInputs: () => boolean;
+
+  public constructor(
+    name: string,
+    runBuild: (kind: IOperationCommandExecution['kind']) => number | undefined,
+    reportsCommandExecutions: boolean,
+    watchesInputs: () => boolean
+  ) {
+    this.name = name;
+    this.#runBuild = runBuild;
+    this.#reportsCommandExecutions = reportsCommandExecutions;
+    this.#watchesInputs = watchesInputs;
+  }
+
+  public async executeAsync(
+    context: IOperationRunnerContext,
+    lastState?: IOperationLastState
+  ): Promise<OperationStatus> {
+    return await context.runWithTerminalAsync(
+      async (terminal: ITerminal): Promise<OperationStatus> => {
+        const guard: IIncrementalExecutionGuard | undefined = lastState
+          ? context.getIncrementalExecutionGuard?.()
+          : undefined;
+        if (!guard) {
+          return this.#run(context, 'initial');
+        }
+        const blockReason: string | undefined = await guard.getBlockReasonAsync();
+        if (blockReason !== undefined) {
+          terminal.writeLine(`Not using the incremental command because ${blockReason}.`);
+          return this.#run(context, 'initial');
+        }
+        const status: OperationStatus = this.#run(context, 'incremental');
+        if (status !== OperationStatus.Success) {
+          return status;
+        }
+        const rerunReason: string | undefined = await guard.verifyIncrementalResultAsync();
+        if (rerunReason === undefined) {
+          return status;
+        }
+        terminal.writeLine(`Running the initial command, because ${rerunReason}.`);
+        return this.#run(context, 'initial');
+      },
+      { createLogFile: false }
+    );
+  }
+
+  public getConfigHash(): string {
+    return INITIAL_COMMAND;
+  }
+
+  #run(context: IOperationRunnerContext, kind: IOperationCommandExecution['kind']): OperationStatus {
+    if (this.#reportsCommandExecutions) {
+      const watchesInputs: boolean = this.#watchesInputs();
+      context.reportCommandExecution?.({ kind, hasIncrementalCommand: true, watchesInputs });
+    }
+    return this.#runBuild(kind) === 0 ? OperationStatus.Success : OperationStatus.Failure;
+  }
+}
+
+async function createWorkspaceAsync(
+  projectSpecs: ReadonlyArray<IProjectSpec>,
+  {
+    hasPassThroughPhase,
+    guardOptions,
+    hasLegacySkipDetection,
+    legacySkipOptions,
+    hasIncrementalExecutionGuard = true,
+    watchesInputs,
+    recordsWorkingTreeReadStartTime,
+    allowWarningsOnSuccess
+  }: IWorkspaceOptions = {}
+): Promise<ITestWorkspace> {
+  const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
+  workspaceFolders.push(rootFolder);
+  const phase: IPhase = allowWarningsOnSuccess ? { ...buildPhase, allowWarningsOnSuccess } : buildPhase;
+  const isWatchingInputs: () => boolean =
+    typeof watchesInputs === 'function' ? watchesInputs : () => watchesInputs === true;
+
+  const writeFile = (relativePath: string, content: string): void => {
+    const filePath: string = `${rootFolder}/${relativePath}`;
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  };
+
+  const commands: string[] = [];
+  const hangWaiters: (() => void)[] = [];
+  const specByFolder: Map<string, IProjectSpec> = new Map();
+  const close = (child: childProcess.ChildProcess, exitCode: number | null, signal: string | null): void => {
+    queueMicrotask(() => {
+      (child.stdout as PassThrough).end();
+      (child.stderr as PassThrough).end();
+      child.emit('close', exitCode, signal);
+    });
+  };
+  jest
+    .spyOn(Utilities, 'executeLifecycleCommandAsync')
+    .mockImplementation((command: string, { workingDirectory }: { workingDirectory: string }) => {
+      const spec: IProjectSpec = specByFolder.get(workingDirectory)!;
+      const isIncremental: boolean = command === INCREMENTAL_COMMAND;
+      commands.push(`${spec.name}:${isIncremental ? 'incremental' : 'initial'}`);
+      const warnings: string[] = [];
+      const exitCode: number | undefined = build(workingDirectory, !!spec.isBundle, isIncremental, warnings);
+      const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+        stdout: new PassThrough(),
+        stderr: new PassThrough(),
+        stdio: []
+      }) as unknown as childProcess.ChildProcess;
+      if (exitCode === undefined) {
+        for (const resolve of hangWaiters.splice(0)) {
+          resolve();
+        }
+      } else if (warnings.length > 0) {
+        (child.stderr as PassThrough).write(warnings.join('\n'));
+        // The runner reads the warnings after it starts to listen for output, so the process closes afterwards.
+        setImmediate(() => close(child, exitCode, null));
+      } else {
+        close(child, exitCode, null);
+      }
+      return child;
+    });
+  jest
+    .spyOn(SubprocessTerminator, 'killProcessTree')
+    .mockImplementation((child: childProcess.ChildProcess) => close(child, null, 'SIGTERM'));
+
+  const operations: Map<string, Operation> = new Map();
+  const passThroughOperations: Operation[] = [];
+  const projectMap: Map<RushConfigurationProject, IInputsSnapshotProjectMetadata> = new Map();
+  const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+  const lookupByPath: LookupByPath<RushConfigurationProject> = new LookupByPath();
+  const outputFolderByPrefix: Map<string, string> = new Map();
+  const additionalFiles: Set<string> = new Set();
+  for (const spec of projectSpecs) {
+    const {
+      name,
+      dependencies = [],
+      devDependencies = [],
+      isBundle,
+      dependsOnEnvVars,
+      isRig,
+      additionalFiles: projectAdditionalFiles = []
+    } = spec;
+    const projectFolder: string = `${rootFolder}/${name}`;
+    const toVersions = (names: ReadonlyArray<string>): Record<string, string> =>
+      Object.fromEntries(names.map((dependencyName: string) => [dependencyName, 'workspace:*']));
+    const packageJson: RushConfigurationProject['packageJson'] = {
+      name,
+      version: '1.0.0',
+      dependencies: toVersions(dependencies),
+      devDependencies: toVersions(devDependencies)
+    };
+    writeFile(`${name}/package.json`, JSON.stringify(packageJson));
+    writeFile(`${name}/tsconfig.json`, '{}');
+    writeFile(`${name}/src/one.ts`, 'one');
+    writeFile(`${name}/src/sub/two.ts`, 'two');
+    if (isRig) {
+      writeFile(`${name}/profiles/default/config/heft.json`, '{}');
+    }
+    for (const file of projectAdditionalFiles) {
+      writeFile(file, '{}');
+      additionalFiles.add(file);
+    }
+
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder,
+      projectRelativeFolder: name,
+      // Outside of the project folder, so that its files are not inputs
+      projectRushTempFolder: `${rootFolder}/common/temp/projects/${name}`,
+      packageJson,
+      rushConfiguration: { commonTempFolder: `${rootFolder}/common/temp` }
+    } as unknown as RushConfigurationProject;
+    const outputFolderName: string = isBundle ? 'dist' : 'lib';
+    const settings: IOperationSettings = {
+      operationName: PHASE_NAME,
+      outputFolderNames: [outputFolderName],
+      dependsOnEnvVars: dependsOnEnvVars ? [...dependsOnEnvVars] : undefined
+    };
+    const projectConfiguration: RushProjectConfiguration = {
+      operationSettingsByOperationName: new Map([[PHASE_NAME, settings]]),
+      getCacheDisabledReason: () => undefined
+    } as unknown as RushProjectConfiguration;
+    projectConfigurations.set(project, projectConfiguration);
+    projectMap.set(project, {
+      projectConfig: projectConfiguration,
+      additionalFilesByOperationName: new Map([[PHASE_NAME, new Set(projectAdditionalFiles)]])
+    });
+    lookupByPath.setItem(name, project);
+    outputFolderByPrefix.set(name, outputFolderName);
+    specByFolder.set(projectFolder, spec);
+
+    const runBuild = (kind: IOperationCommandExecution['kind']): number | undefined => {
+      commands.push(`${name}:${kind}`);
+      return build(projectFolder, !!isBundle, kind === 'incremental');
+    };
+    const operation: Operation = new Operation({
+      phase,
+      project,
+      settings,
+      logFilenameIdentifier: '_phase_build',
+      runner: spec.pluginRunner
+        ? new PluginOperationRunner(name, runBuild, spec.pluginRunner === 'reported', isWatchingInputs)
+        : new ShellOperationRunner({
+            phase,
+            rushProject: project,
+            displayName: name,
+            initialCommand: INITIAL_COMMAND,
+            incrementalCommand: INCREMENTAL_COMMAND,
+            incrementalCommandRequiresGuard: true,
+            commandForHash: INITIAL_COMMAND,
+            ignoredParameterValues: []
+          })
+    });
+    let dependent: Operation = operation;
+    if (hasPassThroughPhase) {
+      dependent = new Operation({
+        phase: liteBuildPhase,
+        project,
+        logFilenameIdentifier: liteBuildPhase.logFilenameIdentifier,
+        runner: new NullOperationRunner({
+          name: `${name} (lite-build)`,
+          result: OperationStatus.NoOp,
+          silent: true
+        })
+      });
+      operation.addDependency(dependent);
+      passThroughOperations.push(dependent);
+    }
+    for (const dependencyName of [...dependencies, ...devDependencies]) {
+      dependent.addDependency(operations.get(dependencyName)!);
+    }
+    operations.set(name, operation);
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  if (hasIncrementalExecutionGuard) {
+    new IncrementalExecutionGuardPlugin().apply(hooks);
+  }
+  if (hasLegacySkipDetection) {
+    new LegacySkipPlugin({
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      changedProjectsOnly: false,
+      isIncrementalBuildAllowed: true,
+      ...legacySkipOptions
+    }).apply(hooks);
+  }
+  const destination: MockWritable = new MockWritable();
+  const graphOperations: Set<Operation> = new Set([...operations.values(), ...passThroughOperations]);
+  const graph: OperationGraph = new OperationGraph(graphOperations, {
+    quietMode: false,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [destination],
+    abortController: new AbortController(),
+    // Like the graphs of the Rush daemon
+    supportsTerminateRunning: true
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    isWatch: false,
+    projectConfigurations
+  } as unknown as IOperationGraphContext);
+  if (guardOptions) {
+    // After the guard plugin registered the guards of the iteration.
+    graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'guardOptions', stage: 1 },
+      (records: ReadonlyMap<Operation, IOperationExecutionResult>): void => {
+        for (const record of records.values()) {
+          const guard: IIncrementalExecutionGuard | undefined = getIncrementalExecutionGuard(record);
+          if (guard) {
+            setIncrementalExecutionGuard(record, {
+              getBlockReasonAsync: () => guard.getBlockReasonAsync(guardOptions),
+              verifyIncrementalResultAsync: () => guard.verifyIncrementalResultAsync(guardOptions)
+            });
+          }
+        }
+      }
+    );
+  }
+  if (watchesInputs) {
+    // Before the guard's taps
+    graph.hooks.afterExecuteOperationAsync.tap(
+      { name: 'watchesInputs', stage: -2 },
+      (record: IOperationExecutionResult): void => {
+        const execution: ICommandExecution | undefined = getCommandExecution(record);
+        if (execution && !execution.watchesInputs && isWatchingInputs()) {
+          setCommandExecution(record, { ...execution, watchesInputs: true });
+        }
+      }
+    );
+  }
+
+  // Like `git hash-object` for each file, except the outputs, which are ignored by git.
+  const createInputsSnapshot = (
+    environment: Readonly<Record<string, string>> = {},
+    startTimeMs: number | undefined = recordsWorkingTreeReadStartTime ? Date.now() : undefined
+  ): InputsSnapshot => {
+    const hashes: Map<string, string> = new Map();
+    const hashFile = (file: string): void => {
+      const content: Buffer = fs.readFileSync(`${rootFolder}/${file}`);
+      hashes.set(file, createHash('sha1').update(`blob ${content.length}\0`).update(content).digest('hex'));
+    };
+    for (const [prefix, outputFolderName] of outputFolderByPrefix) {
+      for (const file of listFiles(`${rootFolder}/${prefix}`, new Set([outputFolderName]))) {
+        hashFile(`${prefix}/${file}`);
+      }
+    }
+    for (const file of additionalFiles) {
+      hashFile(file);
+    }
+    return new InputsSnapshot({
+      rootDir: rootFolder,
+      hashes,
+      hasUncommittedChanges: false,
+      lookupByPath,
+      projectMap,
+      environment: { ...environment },
+      workingTreeReadStartTimeMs: startTimeMs
+    });
+  };
+
+  return {
+    rootFolder,
+    graph,
+    operations,
+    writeFile,
+    deleteFile: (relativePath: string) => fs.rmSync(`${rootFolder}/${relativePath}`),
+    recreateFolder: (relativePath: string) => recreateFolder(`${rootFolder}/${relativePath}`),
+    executeAsync: async (
+      environment: Readonly<Record<string, string>> = {},
+      isIncrementalBuildAllowed?: boolean,
+      holdUnneededOperations?: boolean
+    ): Promise<ITestIteration> => {
+      commands.length = 0;
+      destination.reset();
+      const result: IExecutionResult = await graph.executeAsync({
+        inputsSnapshot: createInputsSnapshot(environment),
+        getOperationEnvironment: () => environment,
+        isIncrementalBuildAllowed,
+        holdUnneededOperations
+      });
+      return {
+        result,
+        commands: [...commands],
+        output: destination.getAllOutput(),
+        getStatus: (name: string) =>
+          (result.operationResults.get(operations.get(name)!) as OperationExecutionRecord).status
+      };
+    },
+    createInputsSnapshot,
+    waitForHangAsync: () => new Promise<void>((resolve: () => void) => hangWaiters.push(resolve))
+  };
+}
+
+// Changes the input files once, in a tap at the specified stage that runs before an operation executes. If a project
+// is named, before its operation executes.
+function changeBeforeOperation(
+  workspace: ITestWorkspace,
+  stage: number,
+  change: () => void,
+  projectName?: string
+): void {
+  let pendingChange: (() => void) | undefined = change;
+  workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+    { name: 'changeInputFiles', stage },
+    (record: IOperationExecutionResult): undefined => {
+      if (projectName === undefined || record.operation.associatedProject.packageName === projectName) {
+        pendingChange?.();
+        pendingChange = undefined;
+      }
+      return undefined;
+    }
+  );
+}
+
+// Like an editor that saves a file while the command of the operation reads the input files. If a project is named,
+// while the command of its operation reads them. The taps that capture the input files were registered earlier, at
+// the same or a lower stage, so they run before this one.
+function changeWhileExecuting(workspace: ITestWorkspace, change: () => void, projectName?: string): void {
+  changeBeforeOperation(workspace, Number.MAX_SAFE_INTEGER, change, projectName);
+}
+
+// Like an editor that saves a file after the inputs snapshot read the working tree, and before the operation starts
+function changeBeforeExecuting(workspace: ITestWorkspace, change: () => void): void {
+  changeBeforeOperation(workspace, CAPTURE_INPUT_FILES_STAGE - 1, change);
+}
+
+type ChangeInputFiles = (workspace: ITestWorkspace, change: () => void) => void;
+
+const CHANGE_TIMINGS: ReadonlyArray<[string, ChangeInputFiles]> = [
+  ['while it executed', changeWhileExecuting],
+  ['between the inputs snapshot and its start', changeBeforeExecuting]
+];
+
+// A change of the input files of project "a", a change back, and an output file with its content when the outputs
+// were built from the input files after the change back ("none" if the file does not exist)
+type ChangedBackCase = [
+  string,
+  (workspace: ITestWorkspace) => void,
+  (workspace: ITestWorkspace) => void,
+  string,
+  string
+];
+
+const CHANGED_BACK_CASES: ReadonlyArray<ChangedBackCase> = [
+  [
+    'a file was edited',
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two edited'),
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
+    'a/lib/sub/two.js',
+    'two'
+  ],
+  [
+    'a file was added',
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
+    (workspace: ITestWorkspace) => workspace.deleteFile('a/src/three.ts'),
+    'a/lib/three.js',
+    'none'
+  ],
+  [
+    'a file was deleted',
+    (workspace: ITestWorkspace) => workspace.deleteFile('a/src/sub/two.ts'),
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
+    'a/lib/sub/two.js',
+    'two'
+  ]
+];
+
+// A case of CHANGED_BACK_CASES, after its name: when the change is made, and how
+type TimedChangedBackCase = [
+  string,
+  string,
+  ChangeInputFiles,
+  (workspace: ITestWorkspace) => void,
+  (workspace: ITestWorkspace) => void,
+  string,
+  string
+];
+
+const TIMED_CHANGED_BACK_CASES: ReadonlyArray<TimedChangedBackCase> = CHANGE_TIMINGS.flatMap(
+  ([timing, changeInputFiles]: [string, ChangeInputFiles]) =>
+    CHANGED_BACK_CASES.map(
+      ([name, change, changeBack, outputFile, expectedOutput]: ChangedBackCase): TimedChangedBackCase => [
+        name,
+        timing,
+        changeInputFiles,
+        change,
+        changeBack,
+        outputFile,
+        expectedOutput
+      ]
+    )
+);
+
+// The names of the projects whose input files were captured since the mock was cleared, in order
+function getCapturedProjectNames(workspace: ITestWorkspace): string[] {
+  return jest
+    .mocked(captureInputFilesState)
+    .mock.results.map(
+      ({ value }) =>
+        path.relative(workspace.rootFolder, (value as IInputFilesState).filePaths[0]).split(path.sep)[0]
+    );
+}
+
+// Like a request that joins the iteration of the Rush daemon while the operation of a project executes: it takes an
+// inputs snapshot after the change, and needs the operations of the joining projects. Returns the result.
+function joinWhileExecuting(
+  workspace: ITestWorkspace,
+  projectName: string,
+  change: () => void,
+  joiningProjectNames: ReadonlyArray<string>
+): () => IOperationGraphExtensionResult | undefined {
+  let extension: IOperationGraphExtensionResult | undefined;
+  workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+    'joinWhileExecuting',
+    (record: IOperationExecutionResult): undefined => {
+      if (!extension && record.operation.associatedProject.packageName === projectName) {
+        change();
+        const neededOperations: Operation[] = joiningProjectNames.map(
+          (name: string) => workspace.operations.get(name)!
+        );
+        for (const operation of neededOperations) {
+          // Like the Rush daemon, which enables the operations that the joining request selected
+          operation.enabled = true;
+        }
+        extension = workspace.graph.tryExtendCurrentIteration({
+          // It began to read the working tree in a later millisecond than the iteration began
+          inputsSnapshot: workspace.createInputsSnapshot({}, Date.now() + 1),
+          neededOperations
+        });
+      }
+      return undefined;
+    }
+  );
+  return () => extension;
+}
+
+function readOutput(workspace: ITestWorkspace, relativePath: string): string | undefined {
+  const outputPath: string = `${workspace.rootFolder}/${relativePath}`;
+  return fs.existsSync(outputPath) ? fs.readFileSync(outputPath, 'utf8') : undefined;
+}
+
+describe(clearIncrementalExecutionGuard.name, () => {
+  it('removes a guard and watched-command callback from a record', () => {
+    const record: object = {};
+    const guard: IIncrementalExecutionGuard = {
+      getBlockReasonAsync: async () => undefined,
+      verifyIncrementalResultAsync: async () => undefined
+    };
+    let callbackCount: number = 0;
+
+    setIncrementalExecutionGuard(record, guard);
+    setWatchedCommandCallback(record, () => {
+      callbackCount++;
+    });
+    setCommandExecution(record, { kind: 'initial', hasIncrementalCommand: true, watchesInputs: true });
+    expect(getIncrementalExecutionGuard(record)).toBe(guard);
+    expect(callbackCount).toBe(1);
+
+    clearIncrementalExecutionGuard(record);
+    setCommandExecution(record, { kind: 'incremental', hasIncrementalCommand: true, watchesInputs: true });
+    expect(getIncrementalExecutionGuard(record)).toBeUndefined();
+    expect(callbackCount).toBe(1);
+  });
+});
+
+describe(IncrementalExecutionGuardPlugin.name, () => {
+  it('clears per-record state after an operation finishes', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    const iteration: ITestIteration = await workspace.executeAsync();
+    const record: IOperationExecutionResult = iteration.result.operationResults.get(
+      workspace.operations.get('a')!
+    )!;
+
+    expect(getIncrementalExecutionGuard(record)).toBeUndefined();
+  });
+
+  it('runs the incremental command for edits of built files, and the initial command otherwise', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const edited: ITestIteration = await workspace.executeAsync();
+    expect(edited.commands).toEqual(['a:incremental']);
+    expect(edited.getStatus('a')).toBe(OperationStatus.Success);
+    expect(edited.output).toContain(`Invoking (incremental): ${INCREMENTAL_COMMAND}`);
+
+    // The result of the incremental command is the base of the next one.
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    // An unchanged workspace runs nothing.
+    expect((await workspace.executeAsync()).commands).toEqual([]);
+  });
+
+  it('runs the initial command in an iteration that allows no incremental build, and uses its result as the base', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // Like `rush rebuild`, served by a graph of `rush build`: the runner gets no last result.
+    workspace.writeFile('a/tsconfig.json', '{ "compilerOptions": {} }');
+    const rebuilt: ITestIteration = await workspace.executeAsync({}, false);
+    expect(rebuilt.commands).toEqual(['a:initial']);
+    expect(rebuilt.output).not.toContain('Not using the incremental command');
+    expect((await workspace.executeAsync({}, false)).commands).toEqual(['a:initial']);
+
+    // The configuration file changed after the first iteration, but before the base.
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  interface IInputChangeCase {
+    /**
+     * The project, `{ name: 'a' }` by default
+     */
+    readonly spec?: IProjectSpec;
+    /**
+     * Runs before the first build
+     */
+    readonly prepare?: (workspace: ITestWorkspace) => void;
+    readonly change: (workspace: ITestWorkspace) => void;
+    readonly reason: string;
+    /**
+     * A source file that exists after the change
+     */
+    readonly sourceFile: string;
+  }
+
+  it.each<[string, IInputChangeCase]>([
+    [
+      'a file is added',
+      {
+        change: (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
+        reason: 'input files were added, deleted or renamed ("a/src/three.ts")',
+        sourceFile: 'a/src/three.ts'
+      }
+    ],
+    [
+      'a file is deleted',
+      {
+        change: (workspace: ITestWorkspace) => workspace.deleteFile('a/src/sub/two.ts'),
+        reason: 'input files were added, deleted or renamed ("a/src/sub/two.ts")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file is renamed',
+      {
+        change: (workspace: ITestWorkspace) =>
+          fs.renameSync(`${workspace.rootFolder}/a/src/one.ts`, `${workspace.rootFolder}/a/src/uno.ts`),
+        reason: 'input files were added, deleted or renamed ("a/src/one.ts", "a/src/uno.ts")',
+        sourceFile: 'a/src/uno.ts'
+      }
+    ],
+    [
+      'a configuration file changes',
+      {
+        change: (workspace: ITestWorkspace) => {
+          workspace.writeFile('a/src/one.ts', 'one 2');
+          workspace.writeFile('a/tsconfig.json', '{ "compilerOptions": {} }');
+        },
+        reason: 'a configuration file changed ("a/tsconfig.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a configuration file in a subfolder changes',
+      {
+        prepare: (workspace: ITestWorkspace) => workspace.writeFile('a/test/tsconfig.json', '{}'),
+        change: (workspace: ITestWorkspace) =>
+          workspace.writeFile('a/test/tsconfig.json', '{ "compilerOptions": {} }'),
+        reason: 'a configuration file changed ("a/test/tsconfig.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file in the root folder of the project changes',
+      {
+        prepare: (workspace: ITestWorkspace) => workspace.writeFile('a/build.js', '// build'),
+        change: (workspace: ITestWorkspace) => workspace.writeFile('a/build.js', '// build 2'),
+        reason: 'a configuration file changed ("a/build.js")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file in the config folder of the project changes',
+      {
+        prepare: (workspace: ITestWorkspace) => workspace.writeFile('a/config/heft.json', '{}'),
+        change: (workspace: ITestWorkspace) =>
+          workspace.writeFile('a/config/heft.json', '{ "phasesByName": {} }'),
+        reason: 'a configuration file changed ("a/config/heft.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file outside of the project that it depends on changes',
+      {
+        spec: { name: 'a', additionalFiles: ['tools/shared/data.json'] },
+        change: (workspace: ITestWorkspace) =>
+          workspace.writeFile('tools/shared/data.json', '{ "edited": true }'),
+        reason: 'a configuration file changed ("tools/shared/data.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ]
+  ])(
+    'runs the initial command if %s',
+    async (description: string, { spec = { name: 'a' }, prepare, change, reason, sourceFile }) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([spec]);
+      prepare?.(workspace);
+      await workspace.executeAsync();
+
+      change(workspace);
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:initial']);
+      expect(changed.output).toContain(`Not using the incremental command because ${reason}.`);
+
+      // The result of the initial command is the new base.
+      workspace.writeFile(sourceFile, 'edited');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    }
+  );
+
+  it('runs the initial command if an environment variable that the operation depends on changes', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', dependsOnEnvVars: ['MODE'] }]);
+    await workspace.executeAsync({ MODE: 'debug' });
+
+    const changed: ITestIteration = await workspace.executeAsync({ MODE: 'ship' });
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because an environment variable that it depends on changed.'
+    );
+  });
+
+  it('runs the incremental command of a project whose production dependency changed', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b', dependencies: ['a'] }
+    ]);
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental', 'b:incremental']);
+  });
+
+  it.each([
+    [
+      'a dev dependency',
+      [{ name: 'a' }, { name: 'b', devDependencies: ['a'] }],
+      'its dependency "a" changed, and it is not a production dependency'
+    ],
+    [
+      'a rig',
+      [
+        { name: 'a', isRig: true },
+        { name: 'b', dependencies: ['a'] }
+      ],
+      'its dependency "a" changed, and it is a build tool'
+    ]
+  ])(
+    'runs the initial command of a project if %s changed',
+    async (description, projectSpecs: IProjectSpec[], reason: string) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync(projectSpecs);
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:incremental', 'b:initial']);
+      expect(changed.output).toContain(`Not using the incremental command because ${reason}.`);
+    }
+  );
+
+  it('checks the dependencies that an operation has through a phase of its own project without a script', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync(
+      [{ name: 'a' }, { name: 'b', devDependencies: ['a'] }, { name: 'c', dependencies: ['a'] }],
+      { hasPassThroughPhase: true }
+    );
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual([
+      'a:initial',
+      'b:initial',
+      'c:initial'
+    ]);
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect([...changed.commands].sort()).toEqual(['a:incremental', 'b:initial', 'c:incremental']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because its dependency "a" changed, and it is not a production dependency.'
+    );
+
+    // A change in the project of the phase without a script is judged by the operation's own inputs.
+    workspace.writeFile('b/src/one.ts', 'one 2');
+    workspace.writeFile('c/src/one.ts', 'one 2');
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['b:incremental', 'c:incremental']);
+  });
+
+  it('runs the initial command if the output folders changed since the last run', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // E.g. another tool atomically replaced an output file.
+    workspace.writeFile('a/lib/sub/two.js.tmp', 'tampered');
+    fs.renameSync(`${workspace.rootFolder}/a/lib/sub/two.js.tmp`, `${workspace.rootFolder}/a/lib/sub/two.js`);
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because its output folders changed since its last successful run.'
+    );
+  });
+
+  it('runs the initial command if an output file was rewritten in place since the last run', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // E.g. a debugging edit through the symbolic link to the project in node_modules, which keeps the inode.
+    fs.appendFileSync(`${workspace.rootFolder}/a/lib/sub/two.js`, '\nconsole.log("debug");');
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because its output folders changed since its last successful run.'
+    );
+  });
+
+  it('always runs the initial command of an operation that builds a bundle', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', isBundle: true }]);
+    await workspace.executeAsync();
+
+    for (const content of ['one 2', 'one 3']) {
+      workspace.writeFile('a/src/one.ts', content);
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:initial']);
+      expect(changed.output).toContain(
+        'Not using the incremental command because its outputs include the bundle "dist/main.js".'
+      );
+    }
+  });
+
+  it('runs the initial command after an incremental command that changed which output files exist', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.getStatus('a')).toBe(OperationStatus.Success);
+    expect(changed.output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").'
+    );
+
+    // Its outputs may be named after their content, so it never runs its incremental command again.
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its incremental command changed which output files it has in an earlier run: 1 added ("lib/chunk.js").'
+    );
+  });
+
+  it('runs the incremental command of an operation that builds a bundle for a runner that allows bundles', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', isBundle: true }], {
+      guardOptions: { outputsMayBeBundles: true }
+    });
+    await workspace.executeAsync();
+
+    for (const content of ['one 2', 'one 3']) {
+      workspace.writeFile('a/src/one.ts', content);
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:incremental']);
+      expect(changed.getStatus('a')).toBe(OperationStatus.Success);
+      expect(changed.output).not.toContain('Not using the incremental command');
+    }
+  });
+
+  it('runs only the initial command after an incremental command renamed a content-hashed file, for a runner that allows bundles', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      guardOptions: { outputsMayBeBundles: true }
+    });
+    await workspace.executeAsync();
+
+    // Like a chunk with webpack's default hash length, which a bundler renames whenever its content changes.
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk_0123456789abcdef0123');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk_0123456789abcdef0123.js").'
+    );
+
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its incremental command changed which output files it has in an earlier run: 1 added ("lib/chunk_0123456789abcdef0123.js").'
+    );
+  });
+
+  it('runs the initial command only once after an incremental command that changed which output files exist, for a runner that allows bundles', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      guardOptions: { outputsMayBeBundles: true }
+    });
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").'
+    );
+
+    // The initial command removed any stale outputs, and the runner keeps its build state in memory.
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('runs the initial command after a folder of its input files was recreated, for a runner that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+    await workspace.executeAsync();
+
+    // Unlike an editor that saves a file by renaming a new file over it
+    workspace.writeFile('a/src/sub/two.ts.tmp', 'two 1');
+    fs.renameSync(`${workspace.rootFolder}/a/src/sub/two.ts.tmp`, `${workspace.rootFolder}/a/src/sub/two.ts`);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    // The input files did not change, but a watcher of the old folder misses later edits of its files.
+    workspace.recreateFolder('a/src/sub');
+    expect((await workspace.executeAsync()).commands).toEqual([]);
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+    );
+
+    // The process of the initial command watches the new folder.
+    workspace.writeFile('a/src/sub/two.ts', 'two 3');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('names only the top folder of recreated folders of its input files, for a runner that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+    await workspace.executeAsync();
+
+    // Recreates "a/src/sub" as well
+    workspace.recreateFolder('a/src');
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src").'
+    );
+  });
+
+  it('runs the initial command after a folder of its input files was recreated while it ran, for a runner that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+    await workspace.executeAsync();
+
+    // The input files keep their identity, so the result is the base of the next run.
+    workspace.writeFile('a/src/one.ts', 'one move:src/sub');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+    );
+  });
+
+  it('runs the incremental command after a folder of its input files was recreated, for a runner that does not watch its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    workspace.recreateFolder('a/src/sub');
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('runs the incremental command after a folder of its input files was recreated, if its last run was not in a process that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    let watchesInputs: boolean = true;
+    workspace.graph.hooks.afterExecuteOperationAsync.tap(
+      { name: 'watchesInputs', stage: -2 },
+      (record: IOperationExecutionResult): void => {
+        const execution: ICommandExecution | undefined = getCommandExecution(record);
+        if (execution && watchesInputs) {
+          setCommandExecution(record, { ...execution, watchesInputs: true });
+        }
+      }
+    );
+    await workspace.executeAsync();
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    // E.g. a runner that closed its worker ran the command in a shell. The next process watches the new folder.
+    watchesInputs = false;
+    workspace.writeFile('a/src/sub/two.ts', 'two 3');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    workspace.recreateFolder('a/src/sub');
+    workspace.writeFile('a/src/sub/two.ts', 'two 4');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('runs the initial command after an incremental command that emitted a content-hashed file', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // Like a chunk with webpack's default hash length. Comparing the output files ignores such names.
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk_0123456789abcdef0123');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.getStatus('a')).toBe(OperationStatus.Success);
+    expect(changed.output).toContain(
+      'Running the initial command, because its outputs include the content-hashed file "lib/chunk_0123456789abcdef0123.js".'
+    );
+
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs include the content-hashed file "lib/chunk_0123456789abcdef0123.js".'
+    );
+  });
+
+  it('does not let a later command skip an operation after its incremental command', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      hasLegacySkipDetection: true
+    });
+    const packageDepsPath: string = `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(packageDepsPath)).toBe(true);
+
+    // The outputs of the incremental command can differ from those of the initial command, so a later command,
+    // e.g. one that does not use the Rush daemon, must not skip the operation.
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    expect(fs.existsSync(packageDepsPath)).toBe(false);
+
+    workspace.graph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(packageDepsPath)).toBe(true);
+  });
+
+  it('runs the initial command after a failure', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'error');
+    const failed: ITestIteration = await workspace.executeAsync();
+    expect(failed.commands).toEqual(['a:incremental']);
+    expect(failed.getStatus('a')).toBe(OperationStatus.Failure);
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const fixed: ITestIteration = await workspace.executeAsync();
+    expect(fixed.commands).toEqual(['a:initial']);
+    expect(fixed.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+
+  describe('after a success with warnings', () => {
+    const warningsReason: string =
+      'Not using the incremental command because its last run reported warnings, which its incremental command might not report again.';
+    const noBaseReason: string =
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.';
+
+    it('runs the initial command until a run reports no warnings, if they fail the build', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      const warned: ITestIteration = await workspace.executeAsync();
+      expect(warned.commands).toEqual(['a:incremental']);
+      expect(warned.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+
+      // The incremental command might not report the warnings again, e.g. that of a linter that caches which files
+      // passed, so the build could succeed while they are still there. A native `rush build` would fail again.
+      const unchanged: ITestIteration = await workspace.executeAsync();
+      expect(unchanged.commands).toEqual(['a:initial']);
+      expect(unchanged.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      expect(unchanged.output).toContain(warningsReason);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const fixed: ITestIteration = await workspace.executeAsync();
+      expect(fixed.commands).toEqual(['a:initial']);
+      expect(fixed.getStatus('a')).toBe(OperationStatus.Success);
+      expect(fixed.output).toContain(warningsReason);
+
+      workspace.writeFile('a/src/sub/two.ts', 'two 2');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    });
+
+    it('runs the initial command after its initial command reported warnings, if they fail the build', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      const warned: ITestIteration = await workspace.executeAsync();
+      expect(warned.commands).toEqual(['a:initial']);
+      expect(warned.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+
+      const unchanged: ITestIteration = await workspace.executeAsync();
+      expect(unchanged.commands).toEqual(['a:initial']);
+      expect(unchanged.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      expect(unchanged.output).toContain(warningsReason);
+    });
+
+    it.each<[string, IWorkspaceOptions, boolean]>([
+      ['the phase allows warnings', { allowWarningsOnSuccess: true }, false],
+      ['RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD allows warnings', {}, true]
+    ])(
+      'runs the incremental command if %s',
+      async (name: string, options: IWorkspaceOptions, allowWarningsInSuccessfulBuild: boolean) => {
+        jest
+          .spyOn(EnvironmentConfiguration, 'allowWarningsInSuccessfulBuild', 'get')
+          .mockReturnValue(allowWarningsInSuccessfulBuild);
+        const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], options);
+        await workspace.executeAsync();
+
+        workspace.writeFile('a/src/one.ts', 'one warning');
+        expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+        // The warnings do not fail the build.
+        const unchanged: ITestIteration = await workspace.executeAsync();
+        expect(unchanged.commands).toEqual(['a:incremental']);
+        expect(unchanged.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      }
+    );
+
+    it('forgets that the last run reported warnings after a native command', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      await workspace.executeAsync();
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      await workspace.executeAsync();
+
+      workspace.graph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(noBaseReason);
+      expect(next.output).not.toContain(warningsReason);
+    });
+
+    it('forgets that the last run reported warnings after a failure', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      await workspace.executeAsync();
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'error');
+      const failed: ITestIteration = await workspace.executeAsync();
+      expect(failed.commands).toEqual(['a:initial']);
+      expect(failed.getStatus('a')).toBe(OperationStatus.Failure);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const fixed: ITestIteration = await workspace.executeAsync();
+      expect(fixed.commands).toEqual(['a:initial']);
+      expect(fixed.output).toContain(noBaseReason);
+      expect(fixed.output).not.toContain(warningsReason);
+    });
+  });
+
+  it('runs the initial command after a command that was terminated, but not for operations that did not start', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b', dependencies: ['a'] }
+    ]);
+    await workspace.executeAsync();
+
+    // Its incremental command rewrites "lib/one.js" in place, so its output folders list the same files.
+    workspace.writeFile('a/src/one.ts', 'one hang');
+    const hung: Promise<void> = workspace.waitForHangAsync();
+    const execution: Promise<ITestIteration> = workspace.executeAsync();
+    await hung;
+    await workspace.graph.abortCurrentIterationAsync({ terminateRunning: true });
+    const aborted: ITestIteration = await execution;
+    expect(aborted.commands).toEqual(['a:incremental']);
+    expect(aborted.getStatus('a')).toBe(OperationStatus.Aborted);
+    expect(aborted.getStatus('b')).toBe(OperationStatus.Aborted);
+
+    // An aborted operation keeps its last successful result, but not its base if its command started.
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial', 'b:incremental']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+
+  it('runs the initial command after a run whose input files changed while it ran', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b', dependencies: ['a'] }
+    ]);
+    // Like CacheableOperationPlugin, e.g. when the command of "a" rewrites an API report that is one of its inputs.
+    let unverifiableProjectName: string | undefined = 'a';
+    workspace.graph.hooks.afterExecuteOperationAsync.tap('test', (record: IOperationExecutionResult) => {
+      if (record.operation.associatedProject.packageName === unverifiableProjectName) {
+        markResultUnverifiable(record);
+      }
+    });
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial', 'b:initial']);
+
+    unverifiableProjectName = undefined;
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial', 'b:incremental']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental', 'b:incremental']);
+  });
+
+  describe('with input files that change while the operation executes', () => {
+    it.each(TIMED_CHANGED_BACK_CASES)(
+      'runs the operation again if %s %s and was changed back',
+      async (
+        name: string,
+        timing: string,
+        changeInputFiles: ChangeInputFiles,
+        change: (workspace: ITestWorkspace) => void,
+        changeBack: (workspace: ITestWorkspace) => void,
+        outputFile: string,
+        expectedOutput: string
+      ) => {
+        const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+        changeInputFiles(workspace, () => change(workspace));
+        expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+        expect(readOutput(workspace, outputFile) ?? 'none').not.toBe(expectedOutput);
+
+        // The inputs snapshot is the same as that of the last run, but the outputs were built from other inputs.
+        changeBack(workspace);
+        const next: ITestIteration = await workspace.executeAsync();
+        expect(next.commands).toEqual(['a:initial']);
+        expect(next.output).toContain(
+          'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+        );
+        expect(readOutput(workspace, outputFile) ?? 'none').toBe(expectedOutput);
+
+        expect((await workspace.executeAsync()).commands).toEqual([]);
+      }
+    );
+
+    it('runs the operation again if a file was edited while it executed with warnings and was changed back', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+      const first: ITestIteration = await workspace.executeAsync();
+      expect(first.commands).toEqual(['a:initial']);
+      expect(first.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+    });
+
+    it('counts a file that was added while it executed as an input file if Git is not found', async () => {
+      jest.spyOn(EnvironmentConfiguration, 'gitBinaryPath', 'get').mockReturnValue(undefined);
+      jest.spyOn(Executable, 'tryResolve').mockReturnValue(undefined);
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/three.ts', 'three'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.deleteFile('a/src/three.ts');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, 'a/lib/three.js')).toBeUndefined();
+    });
+
+    it.each<[string, string, ReadonlyArray<string>]>([
+      [
+        'counts a file that was added while it executed as an input file if Git does not ignore it',
+        'a/src/three.ts',
+        ['a:initial']
+      ],
+      [
+        'does not count a file that was added while it executed as an input file if Git ignores it',
+        'a/src/three.log',
+        []
+      ]
+    ])('%s', async (name: string, addedFile: string, expectedCommands: ReadonlyArray<string>) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      expect(
+        Executable.spawnSync('git', ['init', '--quiet'], { currentWorkingDirectory: workspace.rootFolder })
+          .status
+      ).toBe(0);
+      workspace.writeFile('.gitignore', '*.log\n');
+      changeWhileExecuting(workspace, () => workspace.writeFile(addedFile, 'three'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      // The inputs snapshot is the same as that of the last run.
+      workspace.deleteFile(addedFile);
+      expect((await workspace.executeAsync()).commands).toEqual(expectedCommands);
+    });
+
+    it.each([false, true])(
+      'runs the initial command after an incremental command whose input files changed while it ran (watches inputs: %s)',
+      async (watchesInputs: boolean) => {
+        const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs });
+        await workspace.executeAsync();
+
+        workspace.writeFile('a/src/one.ts', 'one 2');
+        changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two 2'));
+        expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+        workspace.writeFile('a/src/one.ts', 'one 3');
+        const next: ITestIteration = await workspace.executeAsync();
+        expect(next.commands).toEqual(['a:initial']);
+        expect(next.output).toContain(
+          'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+        );
+
+        workspace.writeFile('a/src/one.ts', 'one 4');
+        expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+      }
+    );
+
+    it('runs the initial command after a folder of its input files was recreated while its first run ran, for a runner that watches its inputs', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+      // The recreated input files are new files, so the result is unverifiable.
+      workspace.writeFile('a/src/one.ts', 'one recreate:src/sub');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(
+        'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+      );
+    });
+
+    it('runs the initial command after the files of a folder of its input files were moved to a new folder while its first run ran, for a runner that watches its inputs', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync(
+        [{ name: 'a', pluginRunner: 'reported' }],
+        { watchesInputs: true }
+      );
+      // E.g. the initial command in a new warm worker, which no check precedes. The input files keep their identity,
+      // so the result is a base.
+      workspace.writeFile('a/src/one.ts', 'one move:src/sub');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(
+        'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+      );
+    });
+
+    it('runs the initial command after the files of a folder of its input files were moved to a new folder while the first run that watched them ran', async () => {
+      let watchesInputs: boolean = false;
+      const workspace: ITestWorkspace = await createWorkspaceAsync(
+        [{ name: 'a', pluginRunner: 'reported' }],
+        { watchesInputs: () => watchesInputs }
+      );
+      await workspace.executeAsync();
+
+      // E.g. the first run of a new warm worker, after the initial command ran in a shell
+      watchesInputs = true;
+      workspace.writeFile('a/src/one.ts', 'one move:src/sub');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+      workspace.writeFile('a/src/one.ts', 'one 3');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(
+        'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+      );
+    });
+
+    it('runs the operation again if a file was saved while the inputs snapshot was being taken', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+        recordsWorkingTreeReadStartTime: true
+      });
+      // Saved after it was hashed, and before its state was captured, so its state does not change afterwards
+      let isSaved: boolean = false;
+      workspace.graph.hooks.beforeExecuteIterationAsync.tap('saveWhileSnapshotting', (): undefined => {
+        if (!isSaved) {
+          workspace.writeFile('a/src/sub/two.ts', 'two saved');
+          isSaved = true;
+        }
+        return undefined;
+      });
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two saved');
+
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+
+      // The files saved since the last snapshot started have the hashes that it recorded.
+      expect((await workspace.executeAsync()).commands).toEqual([]);
+    });
+
+    it('does not let a later command skip the operation', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+        hasLegacySkipDetection: true
+      });
+      const packageDepsPath: string = `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(packageDepsPath)).toBe(false);
+
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(packageDepsPath)).toBe(true);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+    });
+
+    it('does not let a later command skip the operation if a plugin that is applied later finds the change', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+        hasLegacySkipDetection: true
+      });
+      const packageDepsPath: string = `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+      // After the taps of the plugins of the workspace
+      workspace.graph.hooks.afterExecuteOperationAsync.tap('test', (record: IOperationExecutionResult) =>
+        markResultUnverifiable(record)
+      );
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(packageDepsPath)).toBe(false);
+    });
+
+    it('leaves the check to another plugin that checks the input files', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      // Like CacheableOperationPlugin
+      workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'checksInputFiles', stage: CAPTURE_INPUT_FILES_STAGE },
+        (record: IOperationExecutionResult): undefined => {
+          markInputFilesChecked(record);
+          return undefined;
+        }
+      );
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      // The other plugin did not mark the result as unverifiable.
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      expect((await workspace.executeAsync()).commands).toEqual([]);
+    });
+  });
+
+  it('captures the input files of only the operations that execute', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b' },
+      { name: 'c' }
+    ]);
+    // Like a plugin that skips an operation whose outputs are up to date
+    workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+      { name: 'test', stage: -1000 },
+      (record: IOperationExecutionResult): OperationStatus | undefined =>
+        record.operation.associatedProject.packageName === 'b' ? OperationStatus.Skipped : undefined
+    );
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'c:initial']);
+    expect(getCapturedProjectNames(workspace).sort()).toEqual(['a', 'c']);
+
+    workspace.writeFile('c/src/one.ts', 'one 2');
+    jest.mocked(captureInputFilesState).mockClear();
+    expect((await workspace.executeAsync()).commands).toEqual(['c:incremental']);
+    expect(getCapturedProjectNames(workspace)).toEqual(['c']);
+  });
+
+  describe('with an operation that joins the iteration', () => {
+    it.each<[string, boolean]>([
+      ['that the iteration held', true],
+      ['that waited for its dependency', false]
+    ])(
+      'checks the inputs of an operation %s against the inputs snapshot of the joining request',
+      async (description: string, isHeld: boolean) => {
+        const workspace: ITestWorkspace = await createWorkspaceAsync([
+          { name: 'a' },
+          { name: 'b', dependencies: isHeld ? [] : ['a'] }
+        ]);
+        expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'b:initial']);
+
+        if (isHeld) {
+          // Like an operation that only a later request needs, which the Rush daemon holds for that request
+          workspace.operations.get('b')!.enabled = false;
+        }
+        workspace.writeFile('a/src/one.ts', 'one 2');
+        const getExtension: () => IOperationGraphExtensionResult | undefined = joinWhileExecuting(
+          workspace,
+          'a',
+          () => workspace.writeFile('b/tsconfig.json', '{ "compilerOptions": {} }'),
+          ['b']
+        );
+        changeWhileExecuting(workspace, () => workspace.writeFile('b/src/sub/two.ts', 'two edited'), 'b');
+        jest.mocked(captureInputFilesState).mockClear();
+        const joined: ITestIteration = await workspace.executeAsync({}, undefined, true);
+        expect(getExtension()?.extended).toBe(true);
+        expect(joined.commands).toEqual(['a:incremental', 'b:initial']);
+        expect(joined.output).toContain(
+          'Not using the incremental command because a configuration file changed ("b/tsconfig.json").'
+        );
+        // The input files of "b" were captured from when the inputs snapshot of the joining request began to
+        // read the working tree, not from the earlier start of the iteration, like those of "a".
+        expect(getCapturedProjectNames(workspace)).toEqual(['a', 'b']);
+        const [aStartMs, bStartMs] = jest.mocked(captureInputFilesState).mock.calls.map((args) => args[2]);
+        expect(bStartMs).toBeGreaterThan(aStartMs!);
+
+        // The inputs snapshot is the same as that of the joining request, but the outputs of "b" were built from
+        // other inputs.
+        workspace.writeFile('b/src/sub/two.ts', 'two');
+        const next: ITestIteration = await workspace.executeAsync();
+        expect(next.commands).toEqual(['b:initial']);
+        expect(next.output).toContain(
+          'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+        );
+        expect(readOutput(workspace, 'b/lib/sub/two.js')).toBe('two');
+      }
+    );
+  });
+
+  it('forgets every base after a native command, but not after an input change', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
+    await workspace.executeAsync();
+
+    workspace.graph.invalidateOperations(
+      [workspace.operations.get('a')!],
+      INPUTS_CHANGED_INVALIDATION_REASON
+    );
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    workspace.graph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    workspace.writeFile('b/src/one.ts', 'one 3');
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'b:initial']);
+  });
+
+  it('forgets the base of an operation that is invalidated for another reason', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
+    await workspace.executeAsync();
+
+    // E.g. a client of the Rush daemon that invalidates the operation.
+    workspace.graph.invalidateOperations([workspace.operations.get('a')!], 'daemon graph invalidate');
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    workspace.writeFile('b/src/one.ts', 'one 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect([...next.commands].sort()).toEqual(['a:initial', 'b:incremental']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+
+  describe('with a runner that uses the public API, like that of a Rush plugin', () => {
+    const wasIterationIncremental = (workspace: ITestWorkspace, iteration: ITestIteration): boolean =>
+      wasExecutedIncrementally(iteration.result.operationResults.get(workspace.operations.get('a')!)!);
+
+    it('runs its incremental command when the guard allows it, and its initial command otherwise', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', pluginRunner: 'reported' }]);
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const edited: ITestIteration = await workspace.executeAsync();
+      expect(edited.commands).toEqual(['a:incremental']);
+      expect(edited.getStatus('a')).toBe(OperationStatus.Success);
+      // So the build cache and legacy skip detection ignore its outputs.
+      expect(wasIterationIncremental(workspace, edited)).toBe(true);
+
+      workspace.writeFile('a/src/three.ts', 'three');
+      const added: ITestIteration = await workspace.executeAsync();
+      expect(added.commands).toEqual(['a:initial']);
+      expect(added.output).toContain(
+        'Not using the incremental command because input files were added, deleted or renamed ("a/src/three.ts").'
+      );
+      expect(wasIterationIncremental(workspace, added)).toBe(false);
+
+      workspace.writeFile('a/src/one.ts', 'one emit:chunk');
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+      expect(changed.output).toContain(
+        'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").'
+      );
+      expect(wasIterationIncremental(workspace, changed)).toBe(false);
+    });
+
+    it('never runs its incremental command if it does not report which command it runs', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([
+        { name: 'a', pluginRunner: 'unreported' }
+      ]);
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const edited: ITestIteration = await workspace.executeAsync();
+      expect(edited.commands).toEqual(['a:initial']);
+      expect(edited.output).toContain(
+        'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+      );
+      expect(wasIterationIncremental(workspace, edited)).toBe(false);
+    });
+  });
+});
+
+describe(LegacySkipPlugin.name, () => {
+  // Like `rush build` without the Rush daemon, or a Rush daemon whose `daemon.incrementalBuilds` setting is off
+  const legacyOptions: IWorkspaceOptions = {
+    hasLegacySkipDetection: true,
+    hasIncrementalExecutionGuard: false
+  };
+  const getPackageDepsPath = (workspace: ITestWorkspace): string =>
+    `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+  // Like a later Rush command, which creates a new graph, so that only the package-deps files remain.
+  const startLaterCommand = (workspace: ITestWorkspace): void =>
+    workspace.graph.deleteResults(workspace.graph.operations);
+
+  it('skips the operation in a later command if its input files did not change', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+
+    startLaterCommand(workspace);
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual([]);
+    expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
+  });
+
+  it('does not capture the input files of an operation that it skips', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      hasLegacySkipDetection: true
+    });
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    // Only by LegacySkipPlugin, which checks them for IncrementalExecutionGuardPlugin
+    expect(getCapturedProjectNames(workspace)).toEqual(['a']);
+
+    startLaterCommand(workspace);
+    jest.mocked(captureInputFilesState).mockClear();
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual([]);
+    expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
+    expect(getCapturedProjectNames(workspace)).toEqual([]);
+  });
+
+  it.each(TIMED_CHANGED_BACK_CASES)(
+    'runs the operation in a later command if %s %s and was changed back',
+    async (
+      name: string,
+      timing: string,
+      changeInputFiles: ChangeInputFiles,
+      change: (workspace: ITestWorkspace) => void,
+      changeBack: (workspace: ITestWorkspace) => void,
+      outputFile: string,
+      expectedOutput: string
+    ) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
+      changeInputFiles(workspace, () => change(workspace));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+      // The inputs snapshot is the same as that of the last run, but the outputs were built from other inputs.
+      changeBack(workspace);
+      startLaterCommand(workspace);
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, outputFile) ?? 'none').toBe(expectedOutput);
+      expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+    }
+  );
+
+  it('runs the operation again in a long-lived graph if a file was edited while it executed and was changed back', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+    workspace.writeFile('a/src/sub/two.ts', 'two');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+
+    expect((await workspace.executeAsync()).commands).toEqual([]);
+  });
+
+  it('runs the operation in a later command if a file was saved while the inputs snapshot was being taken', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      ...legacyOptions,
+      recordsWorkingTreeReadStartTime: true
+    });
+    // Saved after it was hashed, and before its state was captured, so its state does not change afterwards
+    let isSaved: boolean = false;
+    workspace.graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'saveWhileSnapshotting', stage: -1 },
+      (): undefined => {
+        if (!isSaved) {
+          workspace.writeFile('a/src/sub/two.ts', 'two saved');
+          isSaved = true;
+        }
+        return undefined;
+      }
+    );
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two saved');
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+    workspace.writeFile('a/src/sub/two.ts', 'two');
+    startLaterCommand(workspace);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+  });
+
+  it('runs the operation in a later command if a file was edited while it executed with allowed warnings', async () => {
+    jest.spyOn(EnvironmentConfiguration, 'allowWarningsInSuccessfulBuild', 'get').mockReturnValue(true);
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      ...legacyOptions,
+      legacySkipOptions: { allowWarningsInSuccessfulBuild: true }
+    });
+    workspace.writeFile('a/src/one.ts', 'one warning');
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+    const first: ITestIteration = await workspace.executeAsync();
+    expect(first.commands).toEqual(['a:initial']);
+    expect(first.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+    workspace.writeFile('a/src/sub/two.ts', 'two');
+    startLaterCommand(workspace);
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+    // The warnings are allowed, so a later command can skip the operation.
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+  });
+
+  it('does not write the package-deps file of a rebuild whose input files changed while it executed', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      ...legacyOptions,
+      legacySkipOptions: { isIncrementalBuildAllowed: false }
+    });
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+    startLaterCommand(workspace);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    // So that a later build can skip the operation
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+  });
+
+  it('records the inputs of an operation that joins the iteration from the inputs snapshot of the joining request', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync(
+      [{ name: 'a' }, { name: 'b' }],
+      legacyOptions
+    );
+    // Like an operation that only a later request needs, which the Rush daemon holds for that request
+    workspace.operations.get('b')!.enabled = false;
+    const getExtension: () => IOperationGraphExtensionResult | undefined = joinWhileExecuting(
+      workspace,
+      'a',
+      () => workspace.writeFile('b/src/one.ts', 'one 2'),
+      ['b']
+    );
+    expect((await workspace.executeAsync({}, undefined, true)).commands).toEqual(['a:initial', 'b:initial']);
+    expect(getExtension()?.extended).toBe(true);
+    expect(readOutput(workspace, 'b/lib/one.js')).toBe('one 2');
+
+    // The outputs of "b" were built from the saved file, so a later command runs it after the save is undone.
+    workspace.writeFile('b/src/one.ts', 'one');
+    startLaterCommand(workspace);
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['b:initial']);
+    expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
+    expect(readOutput(workspace, 'b/lib/one.js')).toBe('one');
+  });
+
+  it('checks the input files of an incremental command for IncrementalExecutionGuardPlugin', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      hasLegacySkipDetection: true
+    });
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two 2'));
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
index 0e0839c2690..cdc0fec88f1 100644
--- a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
@@ -1,19 +1,39 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+jest.mock('@rushstack/package-deps-hash', () => {
+  const actual: typeof import('@rushstack/package-deps-hash') = jest.requireActual(
+    '@rushstack/package-deps-hash'
+  );
+  return { ...actual, hashFilesAsync: jest.fn(actual.hashFilesAsync) };
+});
+
 import * as child_process from 'node:child_process';
+import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
+
 import {
   captureInputFilesState,
+  FILE_TIME_TOLERANCE_MS,
   getNewFolderEntries,
   hasUntrackedGitFiles,
   haveInputFilesChanged,
-  type IInputFilesState
+  haveSnapshotHashesChangedAsync,
+  type IInputFilesState,
+  MAX_IN_PROCESS_HASH_FILE_SIZE
 } from '../InputFilesStatSignature';
 
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1000000);
+
+function getLatestFileTimeMs(filePath: string): number {
+  const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+  return Number((mtimeNs > ctimeNs ? mtimeNs : ctimeNs) / NANOSECONDS_PER_MILLISECOND);
+}
+
 describe('InputFilesStatSignature', () => {
   let tempFolder: string;
   let srcFolder: string;
@@ -21,10 +41,28 @@ describe('InputFilesStatSignature', () => {
   let fileB: string;
   let noNewInputs: jest.Mock<boolean, [ReadonlyArray<string>]>;
 
+  // Returns a snapshot start time whose window starts after the times of every existing file, once the clock of the
+  // file system has passed the start of the window, so that the files saved afterwards are inside the window.
+  function waitForNextWindow(): number {
+    const probeFile: string = path.join(tempFolder, 'probe.txt');
+    fs.writeFileSync(probeFile, '');
+    const windowStartTimeMs: number = getLatestFileTimeMs(probeFile) + 1;
+    const deadlineMs: number = Date.now() + 10000;
+    do {
+      fs.writeFileSync(probeFile, `${Date.now()}`);
+    } while (getLatestFileTimeMs(probeFile) < windowStartTimeMs && Date.now() < deadlineMs);
+    return windowStartTimeMs + FILE_TIME_TOLERANCE_MS;
+  }
+
   function capture(...absolutePaths: string[]): IInputFilesState {
+    return captureAt(undefined, ...absolutePaths);
+  }
+
+  function captureAt(snapshotStartTimeMs: number | undefined, ...absolutePaths: string[]): IInputFilesState {
     return captureInputFilesState(
       tempFolder,
-      absolutePaths.map((filePath: string) => path.relative(tempFolder, filePath))
+      absolutePaths.map((filePath: string) => path.relative(tempFolder, filePath)),
+      snapshotStartTimeMs
     );
   }
 
@@ -103,6 +141,363 @@ describe('InputFilesStatSignature', () => {
       fs.writeFileSync(fileA, 'export const a = 3; // edited during the build');
       expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
     });
+
+    it('does not ask about new folders that hold no files', () => {
+      const state: IInputFilesState = capture(fileA);
+      fs.mkdirSync(path.join(srcFolder, 'empty'));
+      fs.mkdirSync(path.join(srcFolder, 'nested', 'empty'), { recursive: true });
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).not.toHaveBeenCalled();
+
+      fs.writeFileSync(path.join(srcFolder, 'nested', 'empty', 'd.ts'), 'export const d = 1;');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).toHaveBeenCalledWith([path.join(srcFolder, 'nested')]);
+    });
+  });
+
+  describe('filesChangedDuringSnapshot', () => {
+    function getStatusChangeTimeMs(filePath: string): number {
+      return Number(fs.statSync(filePath, { bigint: true }).ctimeNs / NANOSECONDS_PER_MILLISECOND);
+    }
+
+    it('is empty if the snapshot start time is unknown', () => {
+      expect(capture(fileA, fileB).filesChangedDuringSnapshot).toEqual([]);
+    });
+
+    it('lists a file modified at or after the snapshot start, within the tolerance', () => {
+      const fileTimeMs: number = getLatestFileTimeMs(fileA);
+      expect(captureAt(fileTimeMs + FILE_TIME_TOLERANCE_MS, fileA).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileA)
+      ]);
+      expect(captureAt(fileTimeMs + FILE_TIME_TOLERANCE_MS + 1, fileA).filesChangedDuringSnapshot).toEqual(
+        []
+      );
+    });
+
+    it('lists only the files that changed after the snapshot start', () => {
+      const snapshotStartTimeMs: number = getLatestFileTimeMs(fileB) + FILE_TIME_TOLERANCE_MS + 1;
+      // Wait for the file system clock to pass the start of the window
+      const deadlineMs: number = Date.now() + 10000;
+      do {
+        fs.writeFileSync(fileB, `export const b = ${Date.now()}; // saved during the snapshot`);
+      } while (
+        getLatestFileTimeMs(fileB) < snapshotStartTimeMs - FILE_TIME_TOLERANCE_MS &&
+        Date.now() < deadlineMs
+      );
+
+      expect(captureAt(snapshotStartTimeMs, fileA, fileB).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileB)
+      ]);
+    });
+
+    it('uses the status change time if the modification time was set back', () => {
+      const past: Date = new Date(Date.now() - 3600 * 1000);
+      fs.utimesSync(fileA, past, past);
+      const statusChangeTimeMs: number = getStatusChangeTimeMs(fileA);
+      expect(fs.statSync(fileA).mtimeMs).toBeLessThan(statusChangeTimeMs - FILE_TIME_TOLERANCE_MS);
+
+      expect(captureAt(statusChangeTimeMs, fileA).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileA)
+      ]);
+    });
+
+    it('ignores file times after the end of the window', () => {
+      const future: Date = new Date(Date.now() + 3600 * 1000);
+      fs.utimesSync(fileA, future, future);
+      // Only the modification time, which is in the future, is at or after the start of the window
+      const snapshotStartTimeMs: number = getStatusChangeTimeMs(fileA) + FILE_TIME_TOLERANCE_MS + 1;
+
+      expect(captureAt(snapshotStartTimeMs, fileA).filesChangedDuringSnapshot).toEqual([]);
+    });
+
+    it('skips missing files', () => {
+      const missingFile: string = path.join(srcFolder, 'missing.ts');
+      expect(captureAt(0, missingFile, fileA).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileA)
+      ]);
+    });
+  });
+
+  describe('filesDeletedDuringSnapshot', () => {
+    it('is empty if the snapshot start time is unknown', () => {
+      fs.unlinkSync(fileA);
+      expect(capture(fileA, fileB).filesDeletedDuringSnapshot).toEqual([]);
+    });
+
+    it('lists a file that was deleted after the snapshot start, which counts as a change', () => {
+      const snapshotStartTimeMs: number = Date.now();
+      fs.unlinkSync(fileA);
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA, fileB);
+      expect(state.filesDeletedDuringSnapshot).toEqual([path.relative(tempFolder, fileA)]);
+      // Although the file is still missing
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    it('does not list a file that was missing before the snapshot start', () => {
+      fs.unlinkSync(fileA);
+      const snapshotStartTimeMs: number = getLatestFileTimeMs(srcFolder) + FILE_TIME_TOLERANCE_MS + 1;
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA, fileB);
+      expect(state.filesDeletedDuringSnapshot).toEqual([]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+    });
+
+    it('judges a missing folder by the nearest folder above it that exists', () => {
+      const subFolder: string = path.join(srcFolder, 'sub');
+      const fileC: string = path.join(subFolder, 'c.ts');
+      fs.mkdirSync(subFolder);
+      fs.writeFileSync(fileC, 'export const c = 1;');
+      const snapshotStartTimeMs: number = Date.now();
+      fs.rmSync(subFolder, { recursive: true });
+
+      expect(captureAt(snapshotStartTimeMs, fileC).filesDeletedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileC)
+      ]);
+      expect(
+        captureAt(getLatestFileTimeMs(srcFolder) + FILE_TIME_TOLERANCE_MS + 1, fileC)
+          .filesDeletedDuringSnapshot
+      ).toEqual([]);
+    });
+  });
+
+  describe('a symbolic link that does not lead to a regular file', () => {
+    // Git records the text of such a link, so it is signed by the link itself
+    const itUnlessWindows: jest.It = process.platform === 'win32' ? it.skip : it;
+    let linkPath: string;
+
+    beforeEach(() => {
+      linkPath = path.join(srcFolder, 'link.ts');
+    });
+
+    itUnlessWindows('is not deleted during the snapshot when it is dangling and its folder changed', () => {
+      fs.symlinkSync('missing.ts', linkPath);
+      const snapshotStartTimeMs: number = waitForNextWindow();
+      // Like a build that creates its log folder in the project folder
+      fs.mkdirSync(path.join(srcFolder, 'rush-logs'));
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, linkPath, fileA);
+      expect(state.filesDeletedDuringSnapshot).toEqual([]);
+      expect(state.filesChangedDuringSnapshot).toEqual([]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+    });
+
+    itUnlessWindows('changes the signature when a dangling link is re-pointed or removed', () => {
+      fs.symlinkSync('missing.ts', linkPath);
+      let state: IInputFilesState = capture(linkPath);
+      fs.unlinkSync(linkPath);
+      fs.symlinkSync('also-missing.ts', linkPath);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+
+      state = capture(linkPath);
+      fs.unlinkSync(linkPath);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    itUnlessWindows('signs a loop of links by the link, instead of throwing', () => {
+      fs.symlinkSync('link.ts', linkPath);
+      const state: IInputFilesState = capture(linkPath, fileA);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+
+      fs.unlinkSync(linkPath);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    itUnlessWindows(
+      'signs a link to a folder by the link, so a new file in that folder is not a change',
+      () => {
+        const otherFolder: string = path.join(tempFolder, 'other');
+        fs.mkdirSync(otherFolder);
+        fs.symlinkSync('../other', linkPath);
+        // So that creating a file in the folder changes its modification time
+        const pastTime: Date = new Date(Date.now() - 60 * 1000);
+        fs.utimesSync(otherFolder, pastTime, pastTime);
+
+        const state: IInputFilesState = capture(linkPath);
+        fs.writeFileSync(path.join(otherFolder, 'c.ts'), 'export const c = 1;');
+        expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      }
+    );
+
+    itUnlessWindows('changes the signature when the target of a dangling link is created', () => {
+      fs.symlinkSync('missing.ts', linkPath);
+      const state: IInputFilesState = capture(linkPath);
+      fs.writeFileSync(path.join(srcFolder, 'missing.ts'), 'export const m = 1;');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+  });
+
+  describe('folderEntries of a folder that changed after the snapshot start', () => {
+    it('are the entries from before the snapshot start, so that later ones are new', () => {
+      // Not an input file
+      fs.writeFileSync(path.join(srcFolder, 'old.txt'), '');
+      const snapshotStartTimeMs: number = waitForNextWindow();
+      const newFile: string = path.join(srcFolder, 'new.ts');
+      fs.writeFileSync(newFile, 'export const n = 1;');
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA);
+      expect(getNewFolderEntries(state.folderEntries)).toEqual([newFile]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).toHaveBeenCalledWith([newFile]);
+    });
+
+    it('include the names that lead to the input files, even if those entries changed', () => {
+      const subFolder: string = path.join(srcFolder, 'sub');
+      const fileC: string = path.join(subFolder, 'c.ts');
+      fs.mkdirSync(subFolder);
+      fs.writeFileSync(fileC, 'export const c = 1;');
+      const snapshotStartTimeMs: number = waitForNextWindow();
+      // Like an editor that saves a file by renaming a temporary file, which changes both folders
+      for (const filePath of [fileA, fileC]) {
+        fs.writeFileSync(`${filePath}.tmp`, fs.readFileSync(filePath));
+        fs.renameSync(`${filePath}.tmp`, filePath);
+      }
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA, fileC);
+      expect(getNewFolderEntries(state.folderEntries)).toEqual([]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).not.toHaveBeenCalled();
+    });
+  });
+
+  describe(haveSnapshotHashesChangedAsync.name, () => {
+    const gitPath: string = 'git';
+    const pathA: string = 'src/a.ts';
+    const pathB: string = 'src/b.ts';
+
+    function getBlobHash(content: string | Buffer, algorithm: string = 'sha1'): string {
+      return crypto
+        .createHash(algorithm)
+        .update(`blob ${Buffer.byteLength(content)}\0`)
+        .update(content)
+        .digest('hex');
+    }
+
+    function haveHashesChangedAsync(
+      snapshotHashes: ReadonlyMap<string, string>,
+      filePaths: ReadonlyArray<string>
+    ): Promise<boolean> {
+      return haveSnapshotHashesChangedAsync(gitPath, tempFolder, filePaths, snapshotHashes);
+    }
+
+    const hashA: string = getBlobHash('export const a = 1;');
+    const hashB: string = getBlobHash('export const b = 1;');
+
+    beforeEach(() => {
+      jest.mocked(hashFilesAsync).mockClear();
+    });
+
+    it('does not start Git if every file has its snapshot hash', async () => {
+      const snapshotHashes: Map<string, string> = new Map([
+        [pathA, hashA],
+        [pathB, hashB]
+      ]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA, pathB])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('does not start Git for an unchanged file that was saved in the second before the snapshot started', async () => {
+      const { mtimeMs, ctimeMs } = fs.statSync(fileA);
+      const { filesChangedDuringSnapshot } = captureAt(Math.max(mtimeMs, ctimeMs) + 1000, fileA);
+      expect(filesChangedDuringSnapshot).toEqual([path.relative(tempFolder, fileA)]);
+
+      const snapshotHashes: Map<string, string> = new Map([[filesChangedDuringSnapshot[0], hashA]]);
+      expect(await haveHashesChangedAsync(snapshotHashes, filesChangedDuringSnapshot)).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('asks Git only about the files that do not have their snapshot hashes', async () => {
+      fs.writeFileSync(fileB, 'export const b = 2;');
+      const snapshotHashes: Map<string, string> = new Map([
+        [pathA, hashA],
+        [pathB, hashB]
+      ]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA, pathB])).toBe(true);
+      expect(jest.mocked(hashFilesAsync).mock.calls).toEqual([[tempFolder, [pathB], gitPath]]);
+    });
+
+    it('uses the hash from Git, which applies clean filters, for a file that does not have its snapshot hash', async () => {
+      child_process.execFileSync(gitPath, ['init', '-q'], { cwd: tempFolder, stdio: 'ignore' });
+      fs.writeFileSync(path.join(tempFolder, '.gitattributes'), '*.ts text\n');
+      // Git stores the file with LF line endings
+      const snapshotHashes: Map<string, string> = new Map([[pathA, getBlobHash('export const a = 1;\n')]]);
+
+      fs.writeFileSync(fileA, 'export const a = 1;\r\n');
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+
+      fs.writeFileSync(fileA, 'export const a = 2;\r\n');
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA])).toBe(true);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(2);
+    });
+
+    it('reports a change without starting Git if a file has no snapshot hash', async () => {
+      expect(await haveHashesChangedAsync(new Map([[pathA, hashA]]), [pathA, pathB])).toBe(true);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('hashes a file with the algorithm of its snapshot hash', async () => {
+      const snapshotHashes: Map<string, string> = new Map([
+        [pathA, getBlobHash('export const a = 1;', 'sha256')]
+      ]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it(`asks Git about a file larger than ${MAX_IN_PROCESS_HASH_FILE_SIZE} bytes`, async () => {
+      const largestContent: Buffer = Buffer.alloc(MAX_IN_PROCESS_HASH_FILE_SIZE, 'a');
+      fs.writeFileSync(fileA, largestContent);
+      const largestHashes: Map<string, string> = new Map([[pathA, getBlobHash(largestContent)]]);
+      expect(await haveHashesChangedAsync(largestHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+
+      const largerContent: Buffer = Buffer.alloc(MAX_IN_PROCESS_HASH_FILE_SIZE + 1, 'a');
+      fs.writeFileSync(fileA, largerContent);
+      const largerHashes: Map<string, string> = new Map([[pathA, getBlobHash(largerContent)]]);
+      expect(await haveHashesChangedAsync(largerHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+    });
+
+    it('reports a change if a file was deleted', async () => {
+      fs.unlinkSync(fileA);
+      expect(await haveHashesChangedAsync(new Map([[pathA, hashA]]), [pathA])).toBe(true);
+    });
+
+    // E.g. a FIFO, which would block the event loop if it were read in process
+    (process.platform === 'win32' ? it.skip : it)('asks Git about a path that is not a file', async () => {
+      const devicePath: string = '/dev/null';
+      const snapshotHashes: Map<string, string> = new Map([[devicePath, getBlobHash('')]]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [devicePath])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+    });
+
+    // Git records the text of the link, and "git hash-object" cannot follow it
+    (process.platform === 'win32' ? it.skip : it)(
+      'hashes the text of a symbolic link that does not lead to a regular file in process',
+      async () => {
+        const danglingPath: string = 'src/dangling.ts';
+        const folderLinkPath: string = 'src/folder.ts';
+        fs.mkdirSync(path.join(tempFolder, 'other'));
+        fs.symlinkSync('missing.ts', path.join(tempFolder, danglingPath));
+        fs.symlinkSync('../other', path.join(tempFolder, folderLinkPath));
+        const snapshotHashes: Map<string, string> = new Map([
+          [danglingPath, getBlobHash('missing.ts')],
+          [folderLinkPath, getBlobHash('../other')]
+        ]);
+        expect(await haveHashesChangedAsync(snapshotHashes, [danglingPath, folderLinkPath])).toBe(false);
+        expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+
+        fs.unlinkSync(path.join(tempFolder, danglingPath));
+        fs.symlinkSync('also-missing.ts', path.join(tempFolder, danglingPath));
+        expect(await haveHashesChangedAsync(snapshotHashes, [danglingPath])).toBe(true);
+      }
+    );
+
+    it('reports a change if Git was not found', async () => {
+      expect(
+        await haveSnapshotHashesChangedAsync(undefined, tempFolder, [pathA], new Map([[pathA, hashA]]))
+      ).toBe(true);
+    });
   });
 
   describe(hasUntrackedGitFiles.name, () => {
@@ -143,5 +538,21 @@ describe('InputFilesStatSignature', () => {
       expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'c.ts')], [])).toBe(true);
       expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'nested')], [])).toBe(true);
     });
+
+    it('does not count untracked files that the inputs snapshot hashed', () => {
+      fs.writeFileSync(path.join(srcFolder, 'c.ts'), '');
+      fs.mkdirSync(path.join(srcFolder, 'nested'));
+      fs.writeFileSync(path.join(srcFolder, 'nested', 'd.ts'), '');
+      const candidatePaths: string[] = [path.join(srcFolder, 'c.ts'), path.join(srcFolder, 'nested')];
+      const snapshotHashes: Map<string, string> = new Map([
+        ['src/c.ts', 'c'],
+        ['src/nested/d.ts', 'd']
+      ]);
+
+      expect(hasUntrackedGitFiles(gitPath, tempFolder, candidatePaths, [], snapshotHashes)).toBe(false);
+
+      snapshotHashes.delete('src/nested/d.ts');
+      expect(hasUntrackedGitFiles(gitPath, tempFolder, candidatePaths, [], snapshotHashes)).toBe(true);
+    });
   });
-});
\ No newline at end of file
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
new file mode 100644
index 00000000000..0f41034d107
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
@@ -0,0 +1,815 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+jest.mock('../OperationMetadataManager', () => {
+  class MockOperationMetadataManager {
+    public readonly logFilenameIdentifier: string;
+    public readonly metadataFolderPath: string = '.rush/temp/operation/mock';
+    public readonly stateFile: { state: undefined } = { state: undefined };
+    public constructor({ operation }: { operation: { logFilenameIdentifier: string } }) {
+      this.logFilenameIdentifier = operation.logFilenameIdentifier;
+    }
+    public async saveAsync(): Promise<void> {
+      /* noop */
+    }
+    public async tryRestoreAsync(): Promise<void> {
+      /* noop */
+    }
+    public tryRestoreStopwatch<T>(originalStopwatch: T): T {
+      return originalStopwatch;
+    }
+  }
+  return { OperationMetadataManager: MockOperationMetadataManager };
+});
+jest.mock('../../buildCache/OperationBuildCache', () => ({
+  OperationBuildCache: { forOperation: jest.fn() }
+}));
+
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
+import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
+import { CacheableOperationPlugin } from '../CacheableOperationPlugin';
+import { LegacySkipInvalidationPlugin, LegacySkipPlugin } from '../LegacySkipPlugin';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { OperationGraph } from '../OperationGraph';
+import { Operation } from '../Operation';
+import { NullOperationRunner } from '../NullOperationRunner';
+import { OperationStatus } from '../OperationStatus';
+import { markResultUnverifiable } from '../RetainedResultVerification';
+import type { IOperationRunner } from '../IOperationRunner';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+/**
+ * The strategy of a command: legacy skip detection (the build cache is off), the build cache, or neither
+ * (a command that disables the build cache).
+ */
+type Strategy = 'legacy-skip' | 'build-cache' | 'none';
+
+/**
+ * A checkout of projects, each with one operation.
+ */
+interface ICheckout {
+  readonly folder: string;
+  /**
+   * The names of the projects that each project depends on
+   */
+  readonly dependencies: Map<string, string[]>;
+  /**
+   * The names of the projects that have no script for the phase, so that their operations are no-ops
+   */
+  readonly scriptlessNames: Set<string>;
+  /**
+   * The names of the projects whose operations don't support skip detection, like those of IPC runners
+   */
+  readonly nonCacheableNames: Set<string>;
+  /**
+   * The names of the projects whose operations succeed with warnings
+   */
+  readonly warningNames: Set<string>;
+  /**
+   * The hash of the configuration of each project's operation, such as its command line, if it isn't "config"
+   */
+  readonly configHashes: Map<string, string>;
+  /**
+   * The version of the input files of each project
+   */
+  readonly inputs: Map<string, string>;
+  /**
+   * The version of the input files that each project's outputs were built from
+   */
+  readonly outputs: Map<string, string>;
+  /**
+   * The outputs in the build cache, by project name and state hash
+   */
+  readonly cacheEntries: Map<string, string>;
+  /**
+   * The names of the projects that the last command executed
+   */
+  readonly executions: string[];
+}
+
+class MockRunner implements IOperationRunner {
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean;
+  public readonly warningsAreAllowed: boolean = false;
+  public readonly isNoOp: boolean = false;
+  public readonly name: string;
+  readonly #checkout: ICheckout;
+
+  public constructor(name: string, checkout: ICheckout) {
+    this.name = name;
+    this.cacheable = !checkout.nonCacheableNames.has(name);
+    this.#checkout = checkout;
+  }
+
+  public async executeAsync(): Promise<OperationStatus> {
+    this.#checkout.executions.push(this.name);
+    this.#checkout.outputs.set(this.name, this.#checkout.inputs.get(this.name)!);
+    return this.#checkout.warningNames.has(this.name)
+      ? OperationStatus.SuccessWithWarning
+      : OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return this.#checkout.configHashes.get(this.name) ?? 'config';
+  }
+}
+
+/**
+ * Options of a command
+ */
+interface ICommandOptions {
+  /**
+   * The names of the projects whose operations the command doesn't execute, e.g. because of `--only` or because
+   * the graph of a daemon's engine contains every operation in the repo
+   */
+  readonly disabledNames?: ReadonlySet<string>;
+  /**
+   * Whether the command may skip operations. It is false for `rush rebuild`.
+   */
+  readonly isIncrementalBuildAllowed?: boolean;
+  /**
+   * Whether the command ignores changes to the dependencies of an operation, as `--changed-projects-only` does
+   */
+  readonly changedProjectsOnly?: boolean;
+  /**
+   * The version that the input files of each of these projects change to while its operation executes. Like
+   * IncrementalExecutionGuardPlugin, the command then marks the result of the operation unverifiable.
+   */
+  readonly inputsChangedWhileExecuting?: ReadonlyMap<string, string>;
+}
+
+/**
+ * Runs a command in a new process, e.g. `rush build`, and returns the status of each project's operation.
+ */
+async function runCommandAsync(
+  checkout: ICheckout,
+  strategy: Strategy,
+  options: ICommandOptions = {}
+): Promise<Record<string, OperationStatus>> {
+  const {
+    disabledNames = new Set(),
+    isIncrementalBuildAllowed = true,
+    changedProjectsOnly = false,
+    inputsChangedWhileExecuting = new Map()
+  } = options;
+  const { folder, dependencies, scriptlessNames, inputs, outputs, cacheEntries, executions } = checkout;
+  const operations: Map<string, Operation> = new Map();
+  const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+  for (const name of inputs.keys()) {
+    const projectFolder: string = path.join(folder, name);
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder,
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp')
+    } as unknown as RushConfigurationProject;
+    projectConfigurations.set(project, {
+      getCacheDisabledReason: () => undefined
+    } as unknown as RushProjectConfiguration);
+    operations.set(
+      name,
+      new Operation({
+        runner: scriptlessNames.has(name)
+          ? new NullOperationRunner({ name, result: OperationStatus.NoOp, silent: false })
+          : new MockRunner(name, checkout),
+        logFilenameIdentifier: name,
+        phase: mockPhase,
+        project,
+        enabled: !disabledNames.has(name)
+      })
+    );
+  }
+  for (const [name, dependencyNames] of dependencies) {
+    for (const dependencyName of dependencyNames) {
+      operations.get(name)!.addDependency(operations.get(dependencyName)!);
+    }
+  }
+
+  jest.mocked(OperationBuildCache.forOperation).mockImplementation((record) => {
+    const { packageName } = record.operation.associatedProject;
+    const getCacheKey = (): string => `${packageName}@${record.getStateHash()}`;
+    return {
+      tryRestoreFromCacheAsync: async () => {
+        const cachedOutputs: string | undefined = cacheEntries.get(getCacheKey());
+        if (cachedOutputs !== undefined) {
+          outputs.set(packageName, cachedOutputs);
+        }
+        return cachedOutputs !== undefined;
+      },
+      trySetCacheEntryAsync: async () => {
+        cacheEntries.set(getCacheKey(), outputs.get(packageName)!);
+        return true;
+      }
+    } as unknown as OperationBuildCache;
+  });
+
+  const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  if (strategy === 'legacy-skip') {
+    new LegacySkipPlugin({
+      allowWarningsInSuccessfulBuild: false,
+      terminal,
+      changedProjectsOnly,
+      isIncrementalBuildAllowed
+    }).apply(hooks);
+  } else {
+    if (strategy === 'build-cache') {
+      new CacheableOperationPlugin({
+        allowWarningsInSuccessfulBuild: false,
+        buildCacheConfiguration: {
+          buildCacheEnabled: true,
+          cacheWriteEnabled: true
+        } as unknown as BuildCacheConfiguration,
+        cobuildConfiguration: undefined,
+        terminal,
+        excludeAppleDoubleFiles: false,
+        useDirectFileTransfersForBuildCache: false
+      }).apply(hooks);
+    }
+    // Applied after the build cache plugin, which must not restore outputs before this plugin runs.
+    new LegacySkipInvalidationPlugin().apply(hooks);
+  }
+
+  const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed,
+    projectConfigurations
+  } as unknown as IOperationGraphContext);
+  graph.hooks.afterExecuteOperationAsync.tap('TestPlugin', (record: IOperationExecutionResult) => {
+    const { packageName } = record.operation.associatedProject;
+    const changedInputs: string | undefined = inputsChangedWhileExecuting.get(packageName);
+    if (changedInputs !== undefined) {
+      inputs.set(packageName, changedInputs);
+      markResultUnverifiable(record);
+    }
+  });
+
+  // A snapshot only lists files that are in the working tree, so each project's input file is written with its
+  // version as its content, and hashed as `git hash-object` does.
+  const hashes: Map<string, string> = new Map();
+  for (const [name, version] of inputs) {
+    const inputFilePath: string = `${name}/src/index.ts`;
+    fs.mkdirSync(path.join(folder, name, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(folder, inputFilePath), version);
+    hashes.set(
+      inputFilePath,
+      createHash('sha1')
+        .update(`blob ${Buffer.byteLength(version)}\0${version}`)
+        .digest('hex')
+    );
+  }
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes,
+    rootDirectory: folder,
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: (project: RushConfigurationProject) => {
+      const inputFilePath: string = `${project.packageName}/src/index.ts`;
+      return new Map([[inputFilePath, hashes.get(inputFilePath)!]]);
+    },
+    getOperationOwnStateHash: (project: RushConfigurationProject) => inputs.get(project.packageName)!
+  };
+
+  executions.length = 0;
+  const result: IExecutionResult = await graph.executeAsync({ inputsSnapshot });
+  const statuses: Record<string, OperationStatus> = {};
+  for (const [name, operation] of operations) {
+    statuses[name] = result.operationResults.get(operation)!.status;
+  }
+  return statuses;
+}
+
+describe(LegacySkipPlugin.name, () => {
+  let checkout: ICheckout;
+
+  beforeEach(() => {
+    checkout = {
+      folder: fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-legacy-skip-')),
+      dependencies: new Map(),
+      scriptlessNames: new Set(),
+      nonCacheableNames: new Set(),
+      warningNames: new Set(),
+      configHashes: new Map(),
+      inputs: new Map([['a', 'A']]),
+      outputs: new Map(),
+      cacheEntries: new Map(),
+      executions: []
+    };
+  });
+
+  afterEach(() => {
+    fs.rmSync(checkout.folder, { recursive: true, force: true });
+  });
+
+  it('skips an operation whose inputs are unchanged since it last succeeded', async () => {
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Skipped });
+    expect(checkout.executions).toEqual([]);
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('B');
+  });
+
+  it('executes an operation whose outputs the build cache restored for other inputs since then', async () => {
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache')).toEqual({ a: OperationStatus.Success });
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache')).toEqual({ a: OperationStatus.FromCache });
+    expect(checkout.outputs.get('a')).toBe('B');
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Skipped });
+  });
+
+  it('executes an operation that the build cache plugin executed for other inputs since then', async () => {
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('A');
+  });
+
+  it('executes an operation that a command without the build cache executed for other inputs since then', async () => {
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'none')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('A');
+  });
+
+  it('still skips an operation that a command with the build cache did not execute', async () => {
+    checkout.inputs.set('b', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Success
+    });
+
+    // --only a
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache', { disabledNames: new Set(['b']) })).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped
+    });
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped
+    });
+    expect(checkout.executions).toEqual(['a']);
+  });
+
+  describe('with dependencies between projects', () => {
+    beforeEach(() => {
+      checkout.inputs.set('b', 'A');
+      checkout.dependencies.set('b', ['a']);
+    });
+
+    it('keeps the record of a dependency that a rebuild does not execute', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only b
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['a']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Skipped, b: OperationStatus.Success });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('keeps the records of operations that a rebuild does not execute, if none of their dependencies executes', async () => {
+      // b depends on a through n, which has no script.
+      checkout.inputs.set('n', 'A');
+      checkout.scriptlessNames.add('n');
+      checkout.dependencies.set('n', ['a']);
+      checkout.dependencies.set('b', ['n']);
+      checkout.inputs.set('x', 'A');
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        n: OperationStatus.NoOp,
+        x: OperationStatus.Success
+      });
+
+      // rush rebuild --only x, on the graph of a daemon's engine
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['a', 'b', 'n']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        n: OperationStatus.NoOp,
+        x: OperationStatus.Success
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        n: OperationStatus.NoOp,
+        x: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('deletes the records of consumers that a rebuild does not execute after their dependency changed', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine
+      checkout.inputs.set('a', 'B');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b', 'c']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped, c: OperationStatus.Skipped });
+
+      // rush build --only c: its outputs were built against outputs of b, which were built against outputs of a
+      // that have since changed.
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a', 'b']) })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b', 'c']);
+    });
+
+    it('keeps the records of consumers that a rebuild does not execute, if the inputs of their dependency are unchanged', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine. Like the same command in a process of its own,
+      // whose graph doesn't contain b and c, it leaves their records as they were.
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b', 'c']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped, c: OperationStatus.Skipped });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('deletes the record of a consumer that a rebuild does not execute, after a dependency of its dependency changed', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush rebuild --only a --only b, on the graph of a daemon's engine: the inputs of b are unchanged, but it was
+      // built again against outputs of a that changed.
+      checkout.inputs.set('a', 'B');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['c']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Success, c: OperationStatus.Skipped });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['c']);
+    });
+
+    it.each(['b', 'c'])(
+      'deletes the record of a consumer that a rebuild does not execute, after %s, one of its two dependencies, changed',
+      async (changedName: string) => {
+        // d depends on b and c, which both depend on a. One case changes b and the other changes c, so that in one of
+        // them the dependency that changed finishes before the one that didn't, whatever order the two execute in.
+        checkout.inputs.set('c', 'A');
+        checkout.inputs.set('d', 'A');
+        checkout.dependencies.set('c', ['a']);
+        checkout.dependencies.set('d', ['b', 'c']);
+        expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+          a: OperationStatus.Success,
+          b: OperationStatus.Success,
+          c: OperationStatus.Success,
+          d: OperationStatus.Success
+        });
+
+        // rush rebuild --only b --only c, on the graph of a daemon's engine
+        checkout.inputs.set(changedName, 'B');
+        expect(
+          await runCommandAsync(checkout, 'legacy-skip', {
+            disabledNames: new Set(['a', 'd']),
+            isIncrementalBuildAllowed: false
+          })
+        ).toEqual({
+          a: OperationStatus.Skipped,
+          b: OperationStatus.Success,
+          c: OperationStatus.Success,
+          d: OperationStatus.Skipped
+        });
+
+        expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+          a: OperationStatus.Skipped,
+          b: OperationStatus.Skipped,
+          c: OperationStatus.Skipped,
+          d: OperationStatus.Success
+        });
+        expect(checkout.executions).toEqual(['d']);
+      }
+    );
+
+    it.each([
+      { kind: 'has no script', setName: 'scriptlessNames', statusOfN: OperationStatus.NoOp },
+      {
+        kind: 'does not support skip detection',
+        setName: 'nonCacheableNames',
+        statusOfN: OperationStatus.Skipped
+      }
+    ] as const)(
+      'deletes the record of a consumer that a rebuild does not execute, through an operation that $kind, after their dependency changed',
+      async ({ setName, statusOfN }) => {
+        // b depends on a through n, which the commands below don't execute.
+        checkout.inputs.set('n', 'A');
+        checkout[setName].add('n');
+        checkout.dependencies.set('n', ['a']);
+        checkout.dependencies.set('b', ['n']);
+        await runCommandAsync(checkout, 'legacy-skip');
+
+        // rush rebuild --only a, on the graph of a daemon's engine
+        checkout.inputs.set('a', 'B');
+        expect(
+          await runCommandAsync(checkout, 'legacy-skip', {
+            disabledNames: new Set(['n', 'b']),
+            isIncrementalBuildAllowed: false
+          })
+        ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped, n: statusOfN });
+
+        // rush build --only b
+        expect(
+          await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a', 'n']) })
+        ).toEqual({
+          a: OperationStatus.Skipped,
+          b: OperationStatus.Success,
+          n: statusOfN
+        });
+        expect(checkout.executions).toEqual(['b']);
+      }
+    );
+
+    it('deletes the record of a consumer that a rebuild does not execute, after its dependency was built with another configuration', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine, with a parameter that changes the command line of
+      // a: the files of a are unchanged, but its outputs aren't.
+      checkout.configHashes.set('a', 'other-parameters');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped });
+
+      // rush build, with the same parameter
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('deletes the record of a consumer that a rebuild does not execute, after its dependency succeeded with warnings', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine
+      checkout.inputs.set('a', 'B');
+      checkout.warningNames.add('a');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.SuccessWithWarning, b: OperationStatus.Skipped });
+
+      // rush build --only b
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a']) })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('deletes the record of a consumer that a rebuild does not execute, after the input files of its dependency changed while it executed', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine. The inputs of a match its record when it
+      // starts but change while it executes, so its outputs may differ from those that b was built against.
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          isIncrementalBuildAllowed: false,
+          inputsChangedWhileExecuting: new Map([['a', 'B']])
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped });
+
+      // rush build --only b
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a']) })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('executes the consumers of an operation that executed only because its dependency changed', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      checkout.inputs.set('a', 'B');
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['a', 'b', 'c']);
+    });
+
+    it('executes the consumers of an operation that does not support skip detection', async () => {
+      checkout.nonCacheableNames.add('a');
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['a', 'b']);
+    });
+
+    it('deletes the record of a consumer that a build does not execute after its dependency', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush build --only a, on the graph of a daemon's engine
+      checkout.inputs.set('a', 'B');
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['b']) })).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Skipped
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('keeps the record of a consumer that a build with changedProjectsOnly does not execute', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush build --changed-projects-only --only a, on the graph of a daemon's engine. Like the same command in
+      // a process of its own, whose graph doesn't contain b, it leaves the record of b as it was.
+      checkout.inputs.set('a', 'B');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          changedProjectsOnly: true
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip', { changedProjectsOnly: true })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('executes a consumer whose dependency executed, through an operation that the command does not execute', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush build --only a --only c
+      checkout.inputs.set('a', 'B');
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['b']) })).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['a', 'c']);
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
index 6919cc704bf..dde4910f43c 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
@@ -4,8 +4,20 @@
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { IOperationSettings } from '../../../api/RushProjectConfiguration';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type { IOperationStateHashComponents } from '../IOperationExecutionResult';
 import { Operation } from '../Operation';
-import { type IOperationExecutionRecordContext, OperationExecutionRecord } from '../OperationExecutionRecord';
+import {
+  type IOperationExecutionRecordContext,
+  type IOperationStateHashCacheEntry,
+  OperationExecutionRecord
+} from '../OperationExecutionRecord';
+import {
+  getCommandExecution,
+  setIncrementalExecutionGuard,
+  wasExecutedIncrementally,
+  type IIncrementalExecutionGuard
+} from '../IncrementalExecutionState';
 import { MockOperationRunner } from './MockOperationRunner';
 
 const MOCK_PHASE: IPhase = {
@@ -48,6 +60,124 @@ function createRecord(operation: Operation, maxParallelism: number = 8): Operati
   } as unknown as IOperationExecutionRecordContext);
 }
 
+class ConfigurableRunner extends MockOperationRunner {
+  public configHash: string = 'config';
+  public configHashRequests: number = 0;
+
+  public override getConfigHash(): string {
+    this.configHashRequests++;
+    return this.configHash;
+  }
+}
+
+/**
+ * Operations a, b, c and d, where b depends on a, and c depends on a and b. The own state hash of each operation is
+ * its entry in `localHashes`, and its config hash is its runner's `configHash`.
+ */
+class StateHashFixture {
+  public readonly operations: Map<string, Operation> = new Map();
+  public readonly runners: Map<string, ConfigurableRunner> = new Map();
+  public readonly localHashes: Map<string, string> = new Map();
+  public readonly ownStateHashRequests: string[] = [];
+  public readonly inputsSnapshot: IInputsSnapshot;
+
+  public constructor() {
+    for (const name of ['a', 'b', 'c', 'd']) {
+      const runner: ConfigurableRunner = new ConfigurableRunner(name);
+      this.runners.set(name, runner);
+      this.operations.set(
+        name,
+        new Operation({
+          phase: MOCK_PHASE,
+          project: createProject(name),
+          runner,
+          logFilenameIdentifier: name
+        })
+      );
+      this.localHashes.set(name, `local-${name}`);
+    }
+    this.getOperation('b').addDependency(this.getOperation('a'));
+    this.getOperation('c').addDependency(this.getOperation('a'));
+    this.getOperation('c').addDependency(this.getOperation('b'));
+
+    this.inputsSnapshot = {
+      hashes: new Map(),
+      rootDirectory: '/repo',
+      hasUncommittedChanges: false,
+      getTrackedFileHashesForOperation: () => new Map(),
+      getOperationOwnStateHash: (project: IRushConfigurationProjectForSnapshot) => {
+        const { packageName } = project as RushConfigurationProject;
+        this.ownStateHashRequests.push(packageName);
+        return this.localHashes.get(packageName)!;
+      }
+    };
+  }
+
+  public getOperation(name: string): Operation {
+    return this.operations.get(name)!;
+  }
+
+  public getConfigHashRequests(): number[] {
+    return Array.from(this.runners.values(), (runner: ConfigurableRunner) => runner.configHashRequests);
+  }
+
+  /**
+   * Creates the records of one iteration the way that the graph does, and calculates every state hash.
+   */
+  public calculate(
+    stateHashCache: WeakMap<Operation, IOperationStateHashCacheEntry> | undefined
+  ): Map<string, OperationExecutionRecord> {
+    const context: IOperationExecutionRecordContext = {
+      maxParallelism: 1,
+      inputsSnapshot: this.inputsSnapshot,
+      stateHashCache
+    } as unknown as IOperationExecutionRecordContext;
+    const recordByOperation: Map<Operation, OperationExecutionRecord> = new Map();
+    for (const operation of this.operations.values()) {
+      recordByOperation.set(operation, new OperationExecutionRecord(operation, context));
+    }
+    for (const [operation, record] of recordByOperation) {
+      for (const dependency of operation.dependencies) {
+        record.dependencies.add(recordByOperation.get(dependency)!);
+      }
+    }
+    const records: Map<string, OperationExecutionRecord> = new Map();
+    for (const record of recordByOperation.values()) {
+      record.getStateHash();
+      records.set(record.name, record);
+    }
+    return records;
+  }
+}
+
+function getHashes(records: ReadonlyMap<string, OperationExecutionRecord>): Record<string, string> {
+  return Object.fromEntries(Array.from(records, ([name, record]) => [name, record.getStateHash()]));
+}
+
+function getComponents(
+  records: ReadonlyMap<string, OperationExecutionRecord>
+): Record<string, IOperationStateHashComponents> {
+  return Object.fromEntries(Array.from(records, ([name, record]) => [name, record.getStateHashComponents()]));
+}
+
+/**
+ * Checks that the records' hashes are the ones that records without a cache calculate, and returns the names of
+ * the records that reused the components of `previous`.
+ */
+function getReusedNames(
+  fixture: StateHashFixture,
+  previous: ReadonlyMap<string, OperationExecutionRecord>,
+  current: ReadonlyMap<string, OperationExecutionRecord>
+): string[] {
+  const uncached: Map<string, OperationExecutionRecord> = fixture.calculate(undefined);
+  expect(getHashes(current)).toEqual(getHashes(uncached));
+  expect(getComponents(current)).toEqual(getComponents(uncached));
+  return Array.from(current.keys()).filter(
+    (name: string) =>
+      current.get(name)!.getStateHashComponents() === previous.get(name)!.getStateHashComponents()
+  );
+}
+
 describe(OperationExecutionRecord.name, () => {
   describe('weight', () => {
     it('snapshots numeric operation weight for a normal (non-no-op) operation', () => {
@@ -125,4 +255,152 @@ describe(OperationExecutionRecord.name, () => {
       expect(record.weight).toBe(2);
     });
   });
+
+  describe('incremental execution', () => {
+    it('returns the incremental execution guard that a plugin registered for the record', () => {
+      const operation: Operation = createOperation({ project: createProject('project-guarded') });
+      const record: OperationExecutionRecord = createRecord(operation);
+      expect(record.getIncrementalExecutionGuard()).toBeUndefined();
+
+      const guard: IIncrementalExecutionGuard = {
+        getBlockReasonAsync: async () => undefined,
+        verifyIncrementalResultAsync: async () => undefined
+      };
+      setIncrementalExecutionGuard(record, guard);
+      expect(record.getIncrementalExecutionGuard()).toBe(guard);
+      // The guard belongs to the record of one iteration, not to the operation.
+      expect(createRecord(operation).getIncrementalExecutionGuard()).toBeUndefined();
+    });
+
+    it('records the command execution that the runner reports', () => {
+      const record: OperationExecutionRecord = createRecord(
+        createOperation({ project: createProject('project-reported') })
+      );
+      expect(getCommandExecution(record)).toBeUndefined();
+
+      record.reportCommandExecution({ kind: 'incremental', hasIncrementalCommand: true });
+      expect(getCommandExecution(record)).toEqual({ kind: 'incremental', hasIncrementalCommand: true });
+      expect(wasExecutedIncrementally(record)).toBe(true);
+
+      // The last report counts, e.g. when the guard made the runner run its initial command after the incremental one.
+      record.reportCommandExecution({ kind: 'initial', hasIncrementalCommand: true });
+      expect(wasExecutedIncrementally(record)).toBe(false);
+    });
+
+    it('records whether the runner reports that the command ran in a process that watches the input files', () => {
+      const record: OperationExecutionRecord = createRecord(
+        createOperation({ project: createProject('project-watching') })
+      );
+
+      record.reportCommandExecution({
+        kind: 'incremental',
+        hasIncrementalCommand: true,
+        watchesInputs: true
+      });
+      expect(getCommandExecution(record)?.watchesInputs).toBe(true);
+
+      record.reportCommandExecution({ kind: 'initial', hasIncrementalCommand: true });
+      expect(getCommandExecution(record)?.watchesInputs).toBeUndefined();
+    });
+  });
+
+  describe('state hash', () => {
+    let fixture: StateHashFixture;
+    let cache: WeakMap<Operation, IOperationStateHashCacheEntry>;
+
+    beforeEach(() => {
+      fixture = new StateHashFixture();
+      cache = new WeakMap();
+    });
+
+    it('reuses the last state hash of every operation whose inputs did not change', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(fixture.ownStateHashRequests).toEqual(['a', 'b', 'c', 'd']);
+      expect(fixture.getConfigHashRequests()).toEqual([1, 1, 1, 1]);
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      // Every record still reads its own inputs to check the cached entry
+      expect(fixture.ownStateHashRequests).toEqual(['a', 'b', 'c', 'd', 'a', 'b', 'c', 'd']);
+      expect(fixture.getConfigHashRequests()).toEqual([2, 2, 2, 2]);
+      expect(getHashes(second)).toEqual(getHashes(first));
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'b', 'c', 'd']);
+    });
+
+    it("calculates the state hashes again when an operation's own state hash changes, for it and its consumers", () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.localHashes.set('a', 'local-a-edited');
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['d']);
+      for (const name of ['a', 'b', 'c']) {
+        expect(second.get(name)!.getStateHash()).not.toBe(first.get(name)!.getStateHash());
+      }
+    });
+
+    it("calculates the state hashes again when an operation's config hash changes, for it and its consumers", () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.runners.get('b')!.configHash = 'config-edited';
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'd']);
+      expect(second.get('b')!.getStateHashComponents().config).toBe('config-edited');
+    });
+
+    it('calculates the state hash again when an operation gains or loses a dependency', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.getOperation('d').addDependency(fixture.getOperation('a'));
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'b', 'c']);
+      expect(second.get('d')!.getStateHashComponents().dependencies).toEqual([
+        `a=${second.get('a')!.getStateHash()}`
+      ]);
+
+      // c keeps its first dependency, a, and loses its last one, b
+      fixture.getOperation('c').deleteDependency(fixture.getOperation('b'));
+      const third: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, second, third)).toEqual(['a', 'b', 'd']);
+      expect(third.get('c')!.getStateHashComponents().dependencies).toEqual([
+        `a=${third.get('a')!.getStateHash()}`
+      ]);
+    });
+
+    it('calculates the state hash again when a dependency is replaced by one with the same state hash', () => {
+      // a and d have the same inputs and no dependencies, so they have the same state hash
+      fixture.localHashes.set('d', 'local-a');
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(first.get('d')!.getStateHash()).toBe(first.get('a')!.getStateHash());
+      fixture.getOperation('b').deleteDependency(fixture.getOperation('a'));
+      fixture.getOperation('b').addDependency(fixture.getOperation('d'));
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'd']);
+      expect(second.get('b')!.getStateHashComponents().dependencies).toEqual([
+        `d=${second.get('d')!.getStateHash()}`
+      ]);
+    });
+
+    it('keeps the newest state hash, so that a later iteration without changes reuses it', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.localHashes.set('b', 'local-b-edited');
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'd']);
+
+      const third: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, second, third)).toEqual(['a', 'b', 'c', 'd']);
+
+      // Going back to the first inputs calculates the first hashes again
+      fixture.localHashes.set('b', 'local-b');
+      const fourth: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, third, fourth)).toEqual(['a', 'd']);
+      expect(getHashes(fourth)).toEqual(getHashes(first));
+    });
+
+    it('calculates every state hash when the context has no cache', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(undefined);
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(undefined);
+      expect(getReusedNames(fixture, first, second)).toEqual([]);
+      expect(getHashes(second)).toEqual(getHashes(first));
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts
index b43da0d7431..33fa10201cd 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts
@@ -46,7 +46,7 @@ import type { CollatedTerminal } from '@rushstack/stream-collator';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
-import type { IOperationGraphEventSink } from '../OperationEventSink';
+import { _formatIterationStartLines, type IOperationGraphEventSink } from '../OperationEventSink';
 import type { IOperationExecutionResult } from '../IOperationExecutionResult';
 import { OperationGraph, type IOperationGraphOptions } from '../OperationGraph';
 import { OperationStatus } from '../OperationStatus';
@@ -326,6 +326,94 @@ describe('OperationGraph event sink (dual-emit)', () => {
     expect(tappedWritable.chunks).toEqual(plainWritable.chunks);
   });
 
+  it('announces an iteration only through onIterationStarting to a sink that implements it', async () => {
+    class AnnouncingSink extends RecordingSink {
+      public readonly announcements: [string[], number, boolean][] = [];
+      public onIterationStarting(
+        records: ReadonlyArray<IOperationExecutionResult>,
+        parallelism: number,
+        quietMode: boolean
+      ): void {
+        const names: string[] = records.map(
+          (record: IOperationExecutionResult) => `${record.operation.name}${record.silent ? ' (silent)' : ''}`
+        );
+        this.announcements.push([names.sort(), parallelism, quietMode]);
+      }
+    }
+    const silentRunner: IOperationRunner = {
+      name: 'gamma',
+      reportTiming: false,
+      silent: true,
+      cacheable: false,
+      warningsAreAllowed: false,
+      isNoOp: false,
+      executeAsync: async () => OperationStatus.Success,
+      getConfigHash: () => 'gamma'
+    };
+    const createOperations: () => Set<Operation> = () =>
+      new Set([
+        createOperation('beta', new MockOperationRunner('beta', async () => OperationStatus.Success)),
+        createOperation('alpha', new MockOperationRunner('alpha', async () => OperationStatus.Success)),
+        createOperation('gamma', silentRunner)
+      ]);
+    const plainWritable: MockWritable = new MockWritable();
+    await new OperationGraph(createOperations(), {
+      ...createGraphOptions(plainWritable, false),
+      parallelism: 4,
+      maxParallelism: 8
+    }).executeAsync({});
+    const sink: AnnouncingSink = new AnnouncingSink();
+    const graph: OperationGraph = new OperationGraph(createOperations(), {
+      ...createGraphOptions(mockWritable, false),
+      parallelism: 4,
+      maxParallelism: 8
+    });
+    graph.eventSink = sink;
+
+    await graph.executeAsync({});
+
+    expect(sink.announcements).toEqual([[['alpha', 'beta', 'gamma (silent)'], 4, false]]);
+    expect(sink.activities.some((line: string) => line.startsWith('Selected '))).toBe(false);
+    expect(sink.activities).not.toContain('  alpha');
+    expect(sink.activities.some((line: string) => line.includes('simultaneous processes'))).toBe(false);
+    expect(sink.activities.some((line: string) => line.includes('"alpha" completed successfully'))).toBe(
+      true
+    );
+    // The terminal still announces the iteration, byte for byte as it does without a sink.
+    const output: string = mockWritable.getAllOutput().replace(/\r\n/g, '\n');
+    expect(output).toContain(
+      'Selected 2 operations:\n  alpha\n  beta\n\nExecuting a maximum of 2 simultaneous processes...\n'
+    );
+    expect(mockWritable.chunks).toEqual(plainWritable.chunks);
+  });
+
+  it('passes quiet mode and the current parallelism to onIterationStarting', async () => {
+    const announcements: [number, boolean][] = [];
+    const sink: RecordingSink & IOperationGraphEventSink = Object.assign(new RecordingSink(), {
+      onIterationStarting: (
+        records: ReadonlyArray<IOperationExecutionResult>,
+        parallelism: number,
+        quietMode: boolean
+      ) => {
+        announcements.push([parallelism, quietMode]);
+      }
+    });
+    const graph: OperationGraph = new OperationGraph(
+      new Set([
+        createOperation('alpha', new MockOperationRunner('alpha', async () => OperationStatus.Success))
+      ]),
+      { ...createGraphOptions(mockWritable, true), maxParallelism: 8 }
+    );
+    graph.eventSink = sink;
+    graph.parallelism = 3;
+
+    await graph.executeAsync({});
+
+    expect(announcements).toEqual([[3, true]]);
+    expect(sink.activities.some((line: string) => line.includes('simultaneous processes'))).toBe(false);
+    expect(mockWritable.getAllOutput()).toContain('Executing a maximum of 1 simultaneous processes...');
+  });
+
   it('emits phase-aware status and diagnostic events without routing operation chunks', async () => {
     const reporterSink: CapturingReporterSink = new CapturingReporterSink();
     const rushSession: RushSession = new RushSession({
@@ -1122,3 +1210,34 @@ describe('OperationGraph event sink (dual-emit)', () => {
     expect(reporterSink.inputs.some(({ type }) => type === 'externalOutput')).toBe(false);
   });
 });
+
+describe(_formatIterationStartLines.name, () => {
+  it('lists the operations in order, then caps the simultaneous processes at their count', () => {
+    expect(_formatIterationStartLines(['beta', 'alpha', 'gamma'], 8, false)).toEqual([
+      'Selected 3 operations:',
+      '  alpha',
+      '  beta',
+      '  gamma',
+      '',
+      'Executing a maximum of 3 simultaneous processes...'
+    ]);
+  });
+
+  it('uses the singular for one operation and caps the simultaneous processes at the parallelism', () => {
+    expect(_formatIterationStartLines(['alpha'], 4, false)).toEqual([
+      'Selected 1 operation:',
+      '  alpha',
+      '',
+      'Executing a maximum of 1 simultaneous processes...'
+    ]);
+    expect(_formatIterationStartLines(new Set(['alpha', 'beta', 'gamma']), 2, false).slice(-1)).toEqual([
+      'Executing a maximum of 2 simultaneous processes...'
+    ]);
+  });
+
+  it('omits the listing in quiet mode', () => {
+    expect(_formatIterationStartLines(['beta', 'alpha'], 8, true)).toEqual([
+      'Executing a maximum of 2 simultaneous processes...'
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
new file mode 100644
index 00000000000..1af100454b2
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
@@ -0,0 +1,739 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import type { CollatedTerminal } from '@rushstack/stream-collator';
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type {
+  IConfigurableOperation,
+  IExecutionResult,
+  IOperationExecutionResult
+} from '../IOperationExecutionResult';
+import type { IOperationGraphExtensionResult, IOperationGraphIterationOptions } from '../IOperationGraph';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+function createSnapshot(localHashes: Record<string, string>): IInputsSnapshot {
+  return {
+    hashes: new Map(),
+    rootDirectory: '/repo',
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: () => new Map(),
+    getOperationOwnStateHash: (project: IRushConfigurationProjectForSnapshot) =>
+      localHashes[(project as RushConfigurationProject).packageName]
+  };
+}
+
+/**
+ * Lets the graph dispatch and complete whatever it can.
+ */
+async function settleAsync(): Promise<void> {
+  for (let i: number = 0; i < 20; i++) {
+    await new Promise((resolve: (value: unknown) => void) => setImmediate(resolve));
+  }
+}
+
+async function waitForAsync(condition: () => boolean): Promise<void> {
+  for (let i: number = 0; i < 100; i++) {
+    if (condition()) {
+      return;
+    }
+    await new Promise((resolve: (value: unknown) => void) => setImmediate(resolve));
+  }
+  throw new Error('The condition was not met');
+}
+
+interface IGraphOptions {
+  readonly edges?: readonly [consumer: string, dependency: string][];
+  readonly enabled?: readonly string[];
+  readonly parallelism?: number;
+  readonly weights?: Readonly<Record<string, number>>;
+}
+
+/**
+ * A graph of operations whose runners run until the test finishes them.
+ */
+class TestGraph {
+  public readonly graph: OperationGraph;
+  public readonly started: string[] = [];
+  public records: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+  readonly #operations: Map<string, Operation> = new Map();
+  readonly #finishers: Map<string, () => void> = new Map();
+  readonly #finished: Set<string> = new Set();
+
+  public constructor(names: readonly string[], options: IGraphOptions = {}) {
+    const { edges = [], enabled = names, parallelism = 4, weights = {} } = options;
+    for (const name of names) {
+      const weight: number | undefined = weights[name];
+      this.#operations.set(
+        name,
+        new Operation({
+          runner: new MockOperationRunner(name, async (terminal: CollatedTerminal) => {
+            this.started.push(name);
+            terminal.writeStdoutLine(`${name} started`);
+            if (!this.#finished.has(name)) {
+              await new Promise<void>((resolve: () => void) => this.#finishers.set(name, resolve));
+            }
+            return OperationStatus.Success;
+          }),
+          logFilenameIdentifier: name,
+          phase: mockPhase,
+          project: { packageName: name } as unknown as RushConfigurationProject,
+          settings: weight === undefined ? undefined : { operationName: mockPhase.name, weight },
+          enabled: enabled.includes(name)
+        })
+      );
+    }
+    for (const [consumer, dependency] of edges) {
+      this.operation(consumer).addDependency(this.operation(dependency));
+    }
+
+    this.graph = new OperationGraph(new Set(this.#operations.values()), {
+      quietMode: true,
+      debugMode: false,
+      parallelism,
+      allowOversubscription: false,
+      destinations: [new MockWritable()],
+      abortController: new AbortController()
+    });
+    this.graph.hooks.beforeExecuteIterationAsync.tap('test', (records) => {
+      this.records = records;
+    });
+  }
+
+  public operation(name: string): Operation {
+    return this.#operations.get(name)!;
+  }
+
+  public record(name: string): IOperationExecutionResult {
+    return this.records!.get(this.operation(name))!;
+  }
+
+  public async startedAsync(name: string): Promise<void> {
+    await waitForAsync(() => this.started.includes(name));
+  }
+
+  public finish(name: string): void {
+    this.#finished.add(name);
+    this.#finishers.get(name)?.();
+  }
+
+  public block(name: string): void {
+    this.#finished.delete(name);
+  }
+
+  public finishAll(): void {
+    for (const name of this.#operations.keys()) {
+      this.finish(name);
+    }
+  }
+
+  public getStatuses(result: IExecutionResult): Record<string, OperationStatus> {
+    const statuses: Record<string, OperationStatus> = {};
+    for (const [operation, record] of result.operationResults) {
+      statuses[operation.name] = record.status;
+    }
+    return statuses;
+  }
+}
+
+async function getStateHashesAsync(
+  names: readonly string[],
+  edges: IGraphOptions['edges'],
+  inputsSnapshot: IInputsSnapshot
+): Promise<Record<string, string>> {
+  const testGraph: TestGraph = new TestGraph(names, { edges });
+  testGraph.finishAll();
+  const result: IExecutionResult = await testGraph.graph.executeAsync({ inputsSnapshot });
+  expect(result.status).toBe(OperationStatus.Success);
+  const hashes: Record<string, string> = {};
+  for (const [operation, record] of result.operationResults) {
+    hashes[operation.name] = record.getStateHash();
+  }
+  return hashes;
+}
+
+describe('OperationGraph iteration extension', () => {
+  const snapshotB: IInputsSnapshot = createSnapshot({ a: 'a1', b: 'b1', c: 'c1', d: 'd1', e: 'e1', x: 'x1' });
+
+  it('holds the operations that no enabled operation needs until the others complete', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'b', 'c'], { edges: [['b', 'a']], enabled: ['a'] });
+    const resultPromise: Promise<IExecutionResult> = testGraph.graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+
+    await testGraph.startedAsync('a');
+    await settleAsync();
+    expect(testGraph.record('c').status).toBe(OperationStatus.Ready);
+
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped,
+      c: OperationStatus.Skipped
+    });
+  });
+
+  it('dispatches the held operations when a retained iteration is aborted', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const resultPromise: Promise<IExecutionResult> = testGraph.graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+    expect(testGraph.graph.retainHeldOperations()).toBeInstanceOf(Function);
+
+    const abortPromise: Promise<void> = testGraph.graph.abortCurrentIterationAsync();
+    expect(testGraph.graph.retainHeldOperations()).toBeUndefined();
+    testGraph.finish('a');
+    await abortPromise;
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Aborted
+    });
+  });
+
+  it('extends the iteration with the operations that a joining request needs', async () => {
+    const names: string[] = ['a', 'b', 'c', 'd'];
+    const edges: [string, string][] = [
+      ['b', 'a'],
+      ['d', 'c']
+    ];
+    const testGraph: TestGraph = new TestGraph(names, { edges, enabled: ['a'] });
+    const { graph } = testGraph;
+    const plans: IOperationGraphIterationOptions[] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastStates, iterationOptions) => {
+      plans.push(iterationOptions);
+    });
+    const extensions: [string[], IOperationGraphIterationOptions][] = [];
+    graph.hooks.extendIteration.tap('test', (records, iterationOptions) => {
+      extensions.push([
+        Array.from(records.keys(), (operation: Operation) => operation.name),
+        iterationOptions
+      ]);
+    });
+    const totalOperationsByName: Record<string, number> = {};
+    graph.eventSink = {
+      onOperationHeader: (name: string, completedOperations: number, totalOperations: number) => {
+        totalOperationsByName[name] = totalOperations;
+      }
+    };
+
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+    const hashesBefore: Record<string, string> = {};
+    for (const name of names) {
+      hashesBefore[name] = testGraph.record(name).getStateHash();
+    }
+
+    // The own inputs of "a", which is executing, and "c" changed
+    const snapshotA: IInputsSnapshot = createSnapshot({ a: 'a2', b: 'b1', c: 'c2', d: 'd1' });
+    testGraph.operation('c').enabled = true;
+    testGraph.operation('d').enabled = true;
+    const extension: IOperationGraphExtensionResult = graph.tryExtendCurrentIteration({
+      inputsSnapshot: snapshotA,
+      neededOperations: [testGraph.operation('d')]
+    });
+    expect(extension).toEqual({
+      extended: true,
+      changedOperations: new Set([testGraph.operation('c'), testGraph.operation('d')])
+    });
+
+    expect(plans).toHaveLength(2);
+    expect(plans[1].inputsSnapshot).toBe(snapshotA);
+    expect(plans[1].startedOperations).toEqual(new Set([testGraph.operation('a')]));
+    expect(extensions).toHaveLength(1);
+    expect(extensions[0][0].sort()).toEqual(['c', 'd']);
+    expect(extensions[0][1].inputsSnapshot).toBe(snapshotA);
+
+    // The executing operation keeps its state hash, and so does its held consumer, whose own inputs did not change
+    expect(testGraph.record('a').getStateHash()).toBe(hashesBefore.a);
+    expect(testGraph.record('b').getStateHash()).toBe(hashesBefore.b);
+    // The others are hashed as a new iteration would hash them
+    const expectedHashes: Record<string, string> = await getStateHashesAsync(names, edges, snapshotA);
+    expect(testGraph.record('c').getStateHash()).toBe(expectedHashes.c);
+    expect(testGraph.record('d').getStateHash()).toBe(expectedHashes.d);
+    expect(expectedHashes.c).not.toBe(hashesBefore.c);
+
+    await testGraph.startedAsync('c');
+    testGraph.finish('c');
+    await testGraph.startedAsync('d');
+    testGraph.finish('d');
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped,
+      c: OperationStatus.Success,
+      d: OperationStatus.Success
+    });
+    expect(graph.resultByOperation.get(testGraph.operation('d'))?.getStateHash()).toBe(expectedHashes.d);
+    // The operations that joined count towards the total
+    expect(totalOperationsByName).toEqual({ a: 1, c: 3, d: 3 });
+  });
+
+  it('plans the extension without the results that the request invalidates', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c']);
+    const { graph } = testGraph;
+    testGraph.finishAll();
+    await graph.executeAsync({ inputsSnapshot: snapshotB });
+    const lastResultOfC: IOperationExecutionResult = graph.resultByOperation.get(testGraph.operation('c'))!;
+
+    const lastStatesOfPlans: ReadonlyMap<Operation, IOperationExecutionResult>[] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastStates) => {
+      lastStatesOfPlans.push(new Map(lastStates));
+    });
+    const invalidated: string[] = [];
+    graph.hooks.onInvalidateOperations.tap('test', (operations: Iterable<Operation>, reason?: string) => {
+      invalidated.push(...Array.from(operations, (operation: Operation) => `${operation.name}: ${reason}`));
+    });
+    testGraph.block('a');
+    testGraph.operation('c').enabled = false;
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await waitForAsync(() => testGraph.started.length === 3);
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')],
+        invalidatedOperations: [testGraph.operation('c')],
+        invalidationReason: 'the request changed it'
+      }).extended
+    ).toBe(true);
+
+    expect(lastStatesOfPlans).toHaveLength(2);
+    expect(lastStatesOfPlans[1].has(testGraph.operation('a'))).toBe(true);
+    expect(lastStatesOfPlans[1].has(testGraph.operation('c'))).toBe(false);
+    expect(invalidated).toEqual(['c: the request changed it']);
+    expect(lastResultOfC.status).toBe(OperationStatus.Ready);
+
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({ a: OperationStatus.Success, c: OperationStatus.Success });
+  });
+
+  it('dispatches the operations of the joining request first', async () => {
+    // Without a preference, "e" would go first, since it starts the longer chain
+    const testGraph: TestGraph = new TestGraph(['a', 'c', 'e'], {
+      edges: [['e', 'a']],
+      enabled: ['a', 'e'],
+      parallelism: 1,
+      weights: { e: 10 }
+    });
+    const { graph } = testGraph;
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')]
+      }).extended
+    ).toBe(true);
+
+    testGraph.finishAll();
+    expect((await resultPromise).status).toBe(OperationStatus.Success);
+    expect(testGraph.started).toEqual(['a', 'c', 'e']);
+  });
+
+  it('does not disable operations that the iteration enabled', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c', 'e'], {
+      edges: [['e', 'a']],
+      enabled: ['a', 'e']
+    });
+    const { graph } = testGraph;
+    graph.hooks.configureIteration.tap(
+      'test',
+      (
+        records: ReadonlyMap<Operation, IConfigurableOperation>,
+        lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
+        iterationOptions: IOperationGraphIterationOptions
+      ) => {
+        if (iterationOptions.startedOperations) {
+          // The plan of the extension would not run the operations of the iteration
+          for (const record of records.values()) {
+            record.enabled = record.operation.name === 'c';
+          }
+        }
+      }
+    );
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')]
+      }).extended
+    ).toBe(true);
+    testGraph.finishAll();
+    expect(testGraph.getStatuses(await resultPromise)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Success,
+      e: OperationStatus.Success
+    });
+  });
+
+  it('aborts the iteration if an extendIteration tap throws', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const { graph } = testGraph;
+    graph.hooks.extendIteration.tap('test', () => {
+      throw new Error('The tap failed');
+    });
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(() =>
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')]
+      })
+    ).toThrow('The tap failed');
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.started).toEqual(['a']);
+    expect(testGraph.getStatuses(result).c).toBe(OperationStatus.Aborted);
+  });
+
+  it('calls beforeCommit once, after it plans the extension and before it changes the iteration', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const { graph } = testGraph;
+    const calls: string[] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastStates, iterationOptions) => {
+      calls.push(iterationOptions.startedOperations ? 'plan the extension' : 'plan the iteration');
+    });
+    graph.hooks.extendIteration.tap('test', () => {
+      calls.push('extend');
+    });
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')],
+        beforeCommit: () => {
+          const { enabled, status } = testGraph.record('c');
+          calls.push(`before commit: c is ${enabled ? 'enabled' : 'disabled'} and ${status}`);
+        }
+      }).extended
+    ).toBe(true);
+    expect(calls).toEqual([
+      'plan the iteration',
+      'plan the extension',
+      `before commit: c is disabled and ${OperationStatus.Ready}`,
+      'extend'
+    ]);
+
+    testGraph.finishAll();
+    expect(testGraph.getStatuses(await resultPromise)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Success
+    });
+  });
+
+  it('leaves the iteration unchanged if beforeCommit throws', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const { graph } = testGraph;
+    const extensions: unknown[] = [];
+    graph.hooks.extendIteration.tap('test', (records) => {
+      extensions.push(records);
+    });
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+    const getStateHashes = (): string[] =>
+      Array.from(testGraph.records!.values(), (record: IOperationExecutionResult) => record.getStateHash());
+    const hashes: string[] = getStateHashes();
+
+    testGraph.operation('c').enabled = true;
+    expect(() =>
+      graph.tryExtendCurrentIteration({
+        // The own inputs of "c" changed, so an extension would change its state hash
+        inputsSnapshot: createSnapshot({ a: 'a1', c: 'c2' }),
+        neededOperations: [testGraph.operation('c')],
+        beforeCommit: () => {
+          throw new Error('The request cannot start');
+        }
+      })
+    ).toThrow('The request cannot start');
+    expect(extensions).toHaveLength(0);
+    expect(testGraph.record('c').enabled).toBe(false);
+    expect(getStateHashes()).toEqual(hashes);
+
+    // As the caller restores the enabled states
+    testGraph.operation('c').enabled = false;
+    testGraph.finishAll();
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.started).toEqual(['a']);
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Skipped
+    });
+  });
+
+  describe('refuses', () => {
+    async function expectRefusalAsync(
+      testGraph: TestGraph,
+      iterationOptions: IOperationGraphIterationOptions,
+      getExtensionAsync: (beforeCommit: () => void) => Promise<IOperationGraphExtensionResult>,
+      reason: RegExp
+    ): Promise<void> {
+      const { graph } = testGraph;
+      const extensions: unknown[] = [];
+      graph.hooks.extendIteration.tap('test', (records) => {
+        extensions.push(records);
+      });
+      const resultPromise: Promise<IExecutionResult> = graph.executeAsync(iterationOptions);
+      await testGraph.startedAsync('a');
+      const getStateHashes = (): string[] =>
+        iterationOptions.inputsSnapshot
+          ? Array.from(testGraph.records!.values(), (record: IOperationExecutionResult) =>
+              record.getStateHash()
+            )
+          : [];
+      const hashes: string[] = getStateHashes();
+
+      const beforeCommit: jest.Mock<void, []> = jest.fn();
+      const extension: IOperationGraphExtensionResult = await getExtensionAsync(beforeCommit);
+      expect(extension.extended).toBe(false);
+      expect(extension.reason).toMatch(reason);
+      expect(beforeCommit).not.toHaveBeenCalled();
+      expect(extensions).toHaveLength(0);
+      expect(getStateHashes()).toEqual(hashes);
+
+      testGraph.finishAll();
+      expect((await resultPromise).status).toBe(OperationStatus.Success);
+    }
+
+    it('when no iteration executes', () => {
+      const testGraph: TestGraph = new TestGraph(['a']);
+      expect(
+        testGraph.graph.tryExtendCurrentIteration({
+          inputsSnapshot: snapshotB,
+          neededOperations: [testGraph.operation('a')]
+        }).reason
+      ).toMatch(/No iteration is dispatching/);
+    });
+
+    it('before the iteration dispatches operations', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      const extensions: IOperationGraphExtensionResult[] = [];
+      testGraph.graph.hooks.beforeExecuteIterationAsync.tap('test', () => {
+        extensions.push(
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')]
+          })
+        );
+      });
+      testGraph.finishAll();
+      await testGraph.graph.executeAsync({ inputsSnapshot: snapshotB, holdUnneededOperations: true });
+      expect(extensions).toHaveLength(1);
+      expect(extensions[0].reason).toMatch(/No iteration is dispatching/);
+    });
+
+    it('if the iteration does not hold operations', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB },
+        async (beforeCommit: () => void) =>
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')],
+            beforeCommit
+          }),
+        /No iteration is dispatching/
+      );
+    });
+
+    it('if the iteration was aborted', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      const { graph } = testGraph;
+      const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+        inputsSnapshot: snapshotB,
+        holdUnneededOperations: true
+      });
+      await testGraph.startedAsync('a');
+      const abortPromise: Promise<void> = graph.abortCurrentIterationAsync();
+      expect(
+        graph.tryExtendCurrentIteration({
+          inputsSnapshot: snapshotB,
+          neededOperations: [testGraph.operation('c')]
+        }).reason
+      ).toMatch(/aborted/);
+      testGraph.finishAll();
+      await abortPromise;
+      await resultPromise;
+    });
+
+    it('if the iteration is not incremental', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true, isIncrementalBuildAllowed: false },
+        async (beforeCommit: () => void) =>
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')],
+            beforeCommit
+          }),
+        /not incremental/
+      );
+    });
+
+    it('if the iteration has no inputs snapshot', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { holdUnneededOperations: true },
+        async (beforeCommit: () => void) =>
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')],
+            beforeCommit
+          }),
+        /no inputs snapshot/
+      );
+    });
+
+    it('if the inputs of a started operation that the request needs changed', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'b'], { edges: [['b', 'a']], enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async (beforeCommit: () => void) => {
+          testGraph.operation('b').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: createSnapshot({ a: 'a2', b: 'b1' }),
+            neededOperations: [testGraph.operation('b')],
+            beforeCommit
+          });
+        },
+        /"a" started before its inputs or outputs changed/
+      );
+    });
+
+    it('if the request invalidates a started operation that it needs', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'b'], { edges: [['b', 'a']], enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async (beforeCommit: () => void) => {
+          testGraph.operation('b').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('b')],
+            invalidatedOperations: [testGraph.operation('a')],
+            beforeCommit
+          });
+        },
+        /"a" started before its inputs or outputs changed/
+      );
+    });
+
+    it('if the request invalidates an operation that ran in the iteration', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c', 'x'], { enabled: ['a', 'x'] });
+      testGraph.finish('x');
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async (beforeCommit: () => void) => {
+          await waitForAsync(() => testGraph.record('x').status === OperationStatus.Success);
+          testGraph.operation('c').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')],
+            invalidatedOperations: [testGraph.operation('x')],
+            beforeCommit
+          });
+        },
+        /"x" was invalidated after it ran in the iteration/
+      );
+    });
+
+    it('if an operation that the request needs to run was dispatched without running', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'x'], { edges: [['a', 'x']], enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async (beforeCommit: () => void) => {
+          expect(testGraph.record('x').status).toBe(OperationStatus.Skipped);
+          testGraph.operation('x').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('x')],
+            beforeCommit
+          });
+        },
+        /"x" needs to run, but was dispatched without running/
+      );
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
new file mode 100644
index 00000000000..1cd94685df4
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
@@ -0,0 +1,228 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IEnvironment } from '../../../utilities/Utilities';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type { IOperationGraphIterationOptions } from '../IOperationGraph';
+import type { IOperationRunnerContext } from '../IOperationRunner';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const SESSION_VARIABLE: string = 'RUSH_TEST_OPERATION_ENVIRONMENT_SESSION';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+class EnvironmentRecordingRunner extends MockOperationRunner {
+  public readonly sessions: (string | undefined)[] = [];
+
+  public override async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    this.sessions.push(context.environment?.[SESSION_VARIABLE]);
+    return await super.executeAsync(context);
+  }
+}
+
+function createGraph(runners: ReadonlyArray<EnvironmentRecordingRunner>): OperationGraph {
+  const operations: Operation[] = runners.map(
+    (runner: EnvironmentRecordingRunner) =>
+      new Operation({
+        runner,
+        logFilenameIdentifier: runner.name,
+        phase: mockPhase,
+        project: { packageName: runner.name } as unknown as RushConfigurationProject
+      })
+  );
+  return new OperationGraph(new Set(operations), {
+    quietMode: false,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+}
+
+describe('OperationGraph operation environment', () => {
+  afterEach(() => {
+    delete process.env[SESSION_VARIABLE];
+  });
+
+  it('starts operations from process.env by default', async () => {
+    process.env[SESSION_VARIABLE] = 'host';
+    const runner: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('operation');
+    const graph: OperationGraph = createGraph([runner]);
+
+    expect((await graph.executeAsync({})).status).toBe(OperationStatus.Success);
+    expect(runner.sessions).toEqual(['host']);
+  });
+
+  it('starts each operation from the environment that the iteration chooses for it, before plugin taps', async () => {
+    process.env[SESSION_VARIABLE] = 'host';
+    const first: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('first');
+    const second: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('second');
+    const graph: OperationGraph = createGraph([first, second]);
+    const tapSessions: (string | undefined)[] = [];
+    graph.hooks.createEnvironmentForOperation.tap('test', (environment: IEnvironment) => {
+      tapSessions.push(environment[SESSION_VARIABLE]);
+      // A tap edits its own copy, never the environment that the iteration supplied.
+      environment[SESSION_VARIABLE] = `${environment[SESSION_VARIABLE]}+tap`;
+      return environment;
+    });
+    const sessionA: Readonly<Record<string, string>> = { [SESSION_VARIABLE]: 'A' };
+    const sessionB: Readonly<Record<string, string>> = { [SESSION_VARIABLE]: 'B' };
+
+    const iterations: (IOperationGraphIterationOptions['getOperationEnvironment'] | undefined)[] = [
+      (operation: Operation) => (operation.runner === first ? sessionA : sessionB),
+      () => sessionB,
+      undefined
+    ];
+    for (const getOperationEnvironment of iterations) {
+      expect((await graph.executeAsync({ getOperationEnvironment })).status).toBe(OperationStatus.Success);
+    }
+
+    expect(first.sessions).toEqual(['A+tap', 'B+tap', 'host+tap']);
+    expect(second.sessions).toEqual(['B+tap', 'B+tap', 'host+tap']);
+    expect(tapSessions.sort()).toEqual(['A', 'B', 'B', 'B', 'host', 'host']);
+    expect([sessionA, sessionB, process.env[SESSION_VARIABLE]]).toEqual([
+      { [SESSION_VARIABLE]: 'A' },
+      { [SESSION_VARIABLE]: 'B' },
+      'host'
+    ]);
+  });
+
+  it("hashes each operation's inputs with the environment that it starts from", async () => {
+    const first: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('first');
+    const second: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('second');
+    const graph: OperationGraph = createGraph([first, second]);
+    const hashedEnvironments: Map<string, Readonly<Record<string, string | undefined>> | undefined> =
+      new Map();
+    const inputsSnapshot: IInputsSnapshot = {
+      hashes: new Map(),
+      rootDirectory: '/repo',
+      hasUncommittedChanges: false,
+      getTrackedFileHashesForOperation: () => new Map(),
+      getOperationOwnStateHash: (
+        project: IRushConfigurationProjectForSnapshot,
+        operationName?: string,
+        environment?: Readonly<Record<string, string | undefined>>
+      ) => {
+        hashedEnvironments.set((project as RushConfigurationProject).packageName, environment);
+        return 'local';
+      }
+    };
+    const sessionA: Readonly<Record<string, string>> = { [SESSION_VARIABLE]: 'A' };
+
+    await graph.executeAsync({
+      inputsSnapshot,
+      getOperationEnvironment: (operation: Operation) => (operation.runner === first ? sessionA : {})
+    });
+    expect(hashedEnvironments).toEqual(
+      new Map([
+        ['first', sessionA],
+        ['second', {}]
+      ])
+    );
+
+    hashedEnvironments.clear();
+    await graph.executeAsync({ inputsSnapshot });
+    expect(hashedEnvironments).toEqual(
+      new Map([
+        ['first', undefined],
+        ['second', undefined]
+      ])
+    );
+  });
+
+  it('gives every iteration hook the environment lookup that the iteration was scheduled with', async () => {
+    const graph: OperationGraph = createGraph([new EnvironmentRecordingRunner('operation')]);
+    type GetOperationEnvironment = IOperationGraphIterationOptions['getOperationEnvironment'];
+    const received: [string, GetOperationEnvironment][] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastResults, options) => {
+      received.push(['configureIteration', options.getOperationEnvironment]);
+    });
+    graph.hooks.beforeExecuteIterationAsync.tapPromise('test', async (records, options) => {
+      received.push(['beforeExecuteIterationAsync', options.getOperationEnvironment]);
+    });
+    graph.hooks.afterExecuteIterationAsync.tapPromise('test', async (status, records, options) => {
+      received.push(['afterExecuteIterationAsync', options.getOperationEnvironment]);
+      return status;
+    });
+    const getOperationEnvironment: GetOperationEnvironment = () => ({ [SESSION_VARIABLE]: 'A' });
+
+    expect((await graph.executeAsync({ getOperationEnvironment })).status).toBe(OperationStatus.Success);
+    expect((await graph.executeAsync({})).status).toBe(OperationStatus.Success);
+
+    expect(received).toEqual([
+      ['configureIteration', getOperationEnvironment],
+      ['beforeExecuteIterationAsync', getOperationEnvironment],
+      ['afterExecuteIterationAsync', getOperationEnvironment],
+      ['configureIteration', undefined],
+      ['beforeExecuteIterationAsync', undefined],
+      ['afterExecuteIterationAsync', undefined]
+    ]);
+  });
+
+  it('gives every iteration hook the request id lookup that the iteration was scheduled with', async () => {
+    const graph: OperationGraph = createGraph([new EnvironmentRecordingRunner('operation')]);
+    type GetOperationRequestId = IOperationGraphIterationOptions['getOperationRequestId'];
+    const received: [string, GetOperationRequestId][] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastResults, options) => {
+      received.push(['configureIteration', options.getOperationRequestId]);
+    });
+    graph.hooks.beforeExecuteIterationAsync.tapPromise('test', async (records, options) => {
+      received.push(['beforeExecuteIterationAsync', options.getOperationRequestId]);
+    });
+    graph.hooks.afterExecuteIterationAsync.tapPromise('test', async (status, records, options) => {
+      received.push(['afterExecuteIterationAsync', options.getOperationRequestId]);
+      return status;
+    });
+    const getOperationRequestId: GetOperationRequestId = () => 'request-A';
+
+    expect((await graph.executeAsync({ getOperationRequestId })).status).toBe(OperationStatus.Success);
+    expect((await graph.executeAsync({})).status).toBe(OperationStatus.Success);
+
+    expect(received).toEqual([
+      ['configureIteration', getOperationRequestId],
+      ['beforeExecuteIterationAsync', getOperationRequestId],
+      ['afterExecuteIterationAsync', getOperationRequestId],
+      ['configureIteration', undefined],
+      ['beforeExecuteIterationAsync', undefined],
+      ['afterExecuteIterationAsync', undefined]
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
new file mode 100644
index 00000000000..92c1bf617bf
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
@@ -0,0 +1,191 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type { IOperationStateHashComponents } from '../IOperationExecutionResult';
+import { Operation } from '../Operation';
+import { calculateOperationStateHashEntry } from '../OperationExecutionRecord';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+interface IStateHashes {
+  readonly components: ReadonlyMap<string, IOperationStateHashComponents>;
+  readonly hashes: ReadonlyMap<string, string>;
+}
+
+/**
+ * A graph of operations a, b and c, where b depends on a. Each iteration hashes the own inputs of each operation as
+ * its entry in `localHashes`.
+ */
+class StateHashGraph {
+  public readonly iterations: IStateHashes[] = [];
+  public readonly graph: OperationGraph;
+  readonly #inputsSnapshot: IInputsSnapshot;
+
+  public constructor(localHashes: ReadonlyMap<string, string>) {
+    const operations: Map<string, Operation> = new Map();
+    for (const name of ['a', 'b', 'c']) {
+      operations.set(
+        name,
+        new Operation({
+          runner: new MockOperationRunner(name),
+          logFilenameIdentifier: name,
+          phase: mockPhase,
+          project: { packageName: name } as unknown as RushConfigurationProject
+        })
+      );
+    }
+    operations.get('b')!.addDependency(operations.get('a')!);
+
+    this.graph = new OperationGraph(new Set(operations.values()), {
+      quietMode: false,
+      debugMode: false,
+      parallelism: 1,
+      allowOversubscription: true,
+      destinations: [new MockWritable()],
+      abortController: new AbortController()
+    });
+    this.graph.hooks.configureIteration.tap('test', (records) => {
+      const components: Map<string, IOperationStateHashComponents> = new Map();
+      const hashes: Map<string, string> = new Map();
+      for (const [operation, record] of records) {
+        components.set(operation.name, record.getStateHashComponents());
+        hashes.set(operation.name, record.getStateHash());
+      }
+      this.iterations.push({ components, hashes });
+    });
+
+    this.#inputsSnapshot = {
+      hashes: new Map(),
+      rootDirectory: '/repo',
+      hasUncommittedChanges: false,
+      getTrackedFileHashesForOperation: () => new Map(),
+      getOperationOwnStateHash: (project: IRushConfigurationProjectForSnapshot) =>
+        localHashes.get((project as RushConfigurationProject).packageName)!
+    };
+  }
+
+  public async executeAsync(): Promise<IStateHashes> {
+    expect((await this.graph.executeAsync({ inputsSnapshot: this.#inputsSnapshot })).status).toBe(
+      OperationStatus.Success
+    );
+    return this.iterations[this.iterations.length - 1];
+  }
+}
+
+function getReusedNames(previous: IStateHashes, current: IStateHashes): string[] {
+  return Array.from(current.components.keys()).filter(
+    (name: string) => current.components.get(name) === previous.components.get(name)
+  );
+}
+
+describe('OperationGraph state hashes', () => {
+  it('reuses the state hash of each operation whose inputs did not change since the previous iteration', async () => {
+    const localHashes: Map<string, string> = new Map([
+      ['a', 'local-a'],
+      ['b', 'local-b'],
+      ['c', 'local-c']
+    ]);
+    const graph: StateHashGraph = new StateHashGraph(localHashes);
+
+    const first: IStateHashes = await graph.executeAsync();
+    const second: IStateHashes = await graph.executeAsync();
+    expect(getReusedNames(first, second)).toEqual(['a', 'b', 'c']);
+    expect(second.hashes).toEqual(first.hashes);
+
+    localHashes.set('a', 'local-a-edited');
+    const third: IStateHashes = await graph.executeAsync();
+    expect(getReusedNames(second, third)).toEqual(['c']);
+    expect(third.hashes.get('a')).not.toBe(second.hashes.get('a'));
+    expect(third.hashes.get('b')).not.toBe(second.hashes.get('b'));
+
+    // A new graph has nothing to reuse, and calculates the same state hashes
+    const uncached: IStateHashes = await new StateHashGraph(localHashes).executeAsync();
+    expect(third.hashes).toEqual(uncached.hashes);
+    expect(third.components).toEqual(uncached.components);
+  });
+});
+
+describe(calculateOperationStateHashEntry.name, () => {
+  it('returns the previous entry if it was calculated from the same inputs', () => {
+    const entry: ReturnType<typeof calculateOperationStateHashEntry> = calculateOperationStateHashEntry(
+      ['a', 'hash-a', 'b', 'hash-b'],
+      'local',
+      'config',
+      undefined
+    );
+    expect(calculateOperationStateHashEntry(['a', 'hash-a', 'b', 'hash-b'], 'local', 'config', entry)).toBe(
+      entry
+    );
+
+    for (const [dependencies, local, config] of [
+      [['a', 'hash-a', 'b', 'hash-b2'], 'local', 'config'],
+      [['a', 'hash-a'], 'local', 'config'],
+      [['a', 'hash-a', 'b', 'hash-b'], 'local2', 'config'],
+      [['a', 'hash-a', 'b', 'hash-b'], 'local', 'config2']
+    ] as [string[], string, string][]) {
+      const changed: ReturnType<typeof calculateOperationStateHashEntry> = calculateOperationStateHashEntry(
+        dependencies,
+        local,
+        config,
+        entry
+      );
+      expect(changed).toEqual(calculateOperationStateHashEntry(dependencies, local, config, undefined));
+      expect(changed.hash).not.toBe(entry.hash);
+    }
+  });
+
+  it('does not depend on the order of the dependencies', () => {
+    expect(
+      calculateOperationStateHashEntry(['b', 'hash-b', 'a', 'hash-a'], 'local', 'config', undefined).hash
+    ).toBe(
+      calculateOperationStateHashEntry(['a', 'hash-a', 'b', 'hash-b'], 'local', 'config', undefined).hash
+    );
+  });
+
+  it('calculates an entry without a previous entry whatever the local state hash is', () => {
+    const local: string = undefined as unknown as string;
+    expect(calculateOperationStateHashEntry([], local, 'config', undefined).components).toEqual({
+      dependencies: [],
+      local,
+      config: 'config'
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts
new file mode 100644
index 00000000000..d8d6a118936
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts
@@ -0,0 +1,88 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { ITelemetryData } from '../../Telemetry';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+describe('OperationGraph telemetry', () => {
+  it("runs beforeLogRequest taps, then beforeLog taps, before it logs an iteration's entry", async () => {
+    const events: string[] = [];
+    const operation: Operation = new Operation({
+      runner: new MockOperationRunner('logged'),
+      logFilenameIdentifier: 'logged',
+      phase: mockPhase,
+      project: { packageName: 'logged' } as unknown as RushConfigurationProject
+    });
+    const graph: OperationGraph = new OperationGraph(new Set([operation]), {
+      quietMode: true,
+      debugMode: false,
+      parallelism: 1,
+      allowOversubscription: true,
+      destinations: [new MockWritable()],
+      abortController: new AbortController(),
+      telemetry: {
+        initialExtraData: {},
+        changedProjectsOnlyKey: undefined,
+        nameForLog: 'build',
+        log: ({ extraData }: ITelemetryData) => {
+          events.push(`log ${JSON.stringify(extraData)}`);
+        }
+      }
+    });
+    // Tapped first, to show that the hook, not the tap order, runs beforeLogRequest taps first.
+    graph.hooks.beforeLog.tap('iteration report', (data: ITelemetryData) => {
+      events.push(`beforeLog, pluginActive ${data.extraData!.pluginActive}`);
+      data.extraData!.iterationAuthSeconds = 2;
+    });
+    graph.hooks.beforeLogRequest.tap('plugin flag', (data: ITelemetryData) => {
+      events.push('beforeLogRequest');
+      data.extraData!.pluginActive = true;
+    });
+
+    await graph.executeAsync({});
+
+    expect(events).toEqual([
+      'beforeLogRequest',
+      'beforeLog, pluginActive true',
+      expect.stringMatching(/^log \{.*"pluginActive":true,"iterationAuthSeconds":2\}$/)
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationInputFilesCheck.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationInputFilesCheck.test.ts
new file mode 100644
index 00000000000..e2a29286423
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationInputFilesCheck.test.ts
@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+const mockCalls: string[] = [];
+
+jest.mock('../InputFilesStatSignature', () => ({
+  haveInputFilesChanged: jest.fn(() => {
+    mockCalls.push('stat');
+    return false;
+  }),
+  haveSnapshotHashesChangedAsync: jest.fn(async () => {
+    mockCalls.push('hash');
+    return false;
+  })
+}));
+
+import {
+  haveInputFilesChanged,
+  haveSnapshotHashesChangedAsync,
+  type IInputFilesState
+} from '../InputFilesStatSignature';
+import { getInputFilesChangeKindSinceSnapshotAsync } from '../OperationInputFilesCheck';
+
+describe(getInputFilesChangeKindSinceSnapshotAsync.name, () => {
+  const inputFilesState: IInputFilesState = {
+    rootDirectory: 'repo',
+    filePaths: [],
+    statSignature: '',
+    folderEntries: new Map(),
+    filesChangedDuringSnapshot: ['src/index.ts'],
+    filesDeletedDuringSnapshot: []
+  };
+
+  beforeEach(() => {
+    mockCalls.length = 0;
+    jest.mocked(haveInputFilesChanged).mockClear();
+    jest.mocked(haveSnapshotHashesChangedAsync).mockClear();
+  });
+
+  it('re-hashes snapshot-window files before comparing stats', async () => {
+    await expect(
+      getInputFilesChangeKindSinceSnapshotAsync({
+        inputFilesState,
+        snapshotHashes: new Map([['src/index.ts', 'hash']]),
+        getGitPath: () => 'git',
+        isNewInput: () => false
+      })
+    ).resolves.toBe('none');
+
+    expect(mockCalls).toEqual(['hash', 'stat']);
+  });
+
+  it('does not compare stats after a snapshot-window hash changes', async () => {
+    jest.mocked(haveSnapshotHashesChangedAsync).mockImplementationOnce(async () => {
+      mockCalls.push('hash');
+      return true;
+    });
+
+    await expect(
+      getInputFilesChangeKindSinceSnapshotAsync({
+        inputFilesState,
+        snapshotHashes: new Map([['src/index.ts', 'hash']]),
+        getGitPath: () => 'git',
+        isNewInput: () => false
+      })
+    ).resolves.toBe('snapshot-hashes');
+
+    expect(mockCalls).toEqual(['hash']);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts
index 6443e873d67..19025b70400 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts
@@ -7,10 +7,10 @@ jest.mock('node:fs');
 import { MockWritable, StringBufferTerminalProvider, Terminal, TerminalChunkKind } from '@rushstack/terminal';
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
-import { OperationMetadataManager } from '../OperationMetadataManager';
+import { type IOperationMetaData, OperationMetadataManager } from '../OperationMetadataManager';
 import { CollatedTerminalProvider } from '../../../utilities/CollatedTerminalProvider';
 import { CollatedTerminal } from '@rushstack/stream-collator';
-import { FileSystem } from '@rushstack/node-core-library';
+import { FileSystem, type IFileSystemCopyFileOptions, NewlineKind, Text } from '@rushstack/node-core-library';
 import * as fs from 'node:fs';
 import { Readable } from 'node:stream';
 import { Operation } from '../Operation';
@@ -32,11 +32,24 @@ const manager: OperationMetadataManager = new OperationMetadataManager({
   operation
 });
 
+const cachedErrorLogPath: string = '/path/to/project/.rush/temp/operation/identifier/error.log';
+
+function createNotExistError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('ENOENT: no such file or directory'), {
+    code: 'ENOENT',
+    errno: -2,
+    syscall: 'copyfile',
+    path: '/path/to/file'
+  });
+}
+
 describe(OperationMetadataManager.name, () => {
   let mockTerminalProvider: StringBufferTerminalProvider;
   beforeEach(() => {
     mockTerminalProvider = new StringBufferTerminalProvider(false);
     jest.spyOn(FileSystem, 'copyFileAsync').mockResolvedValue();
+    jest.spyOn(FileSystem, 'deleteFileAsync').mockResolvedValue();
+    jest.spyOn(FileSystem, 'writeFileAsync').mockResolvedValue();
   });
 
   function toJsonLines(data: object[]): string {
@@ -134,4 +147,149 @@ describe(OperationMetadataManager.name, () => {
     expect(mockClose).toHaveBeenCalledTimes(1);
     expect(mockWritable.chunks).toMatchSnapshot();
   });
+
+  it('should write the error log from the stderr chunks instead of copying the cached error log', async () => {
+    const data = [
+      {
+        text: 'logged to stdout\n',
+        kind: TerminalChunkKind.Stdout
+      },
+      {
+        text: '\u001b[31merror TS2345: first\u001b[39m\r\n',
+        kind: TerminalChunkKind.Stderr
+      },
+      {
+        text: 'more stdout\n',
+        kind: TerminalChunkKind.Stdout
+      },
+      {
+        text: 'error TS2304: second\n',
+        kind: TerminalChunkKind.Stderr
+      }
+    ];
+
+    jest.spyOn(FileSystem, 'readFileAsync').mockResolvedValue(toJsonLines(data));
+
+    await manager.tryRestoreAsync({
+      terminal: mockTerminal,
+      terminalProvider: mockTerminalProvider,
+      errorLogPath: '/path/to/errorLog'
+    });
+
+    expect(FileSystem.writeFileAsync).toHaveBeenCalledTimes(1);
+    expect(FileSystem.writeFileAsync).toHaveBeenCalledWith(
+      '/path/to/errorLog',
+      Text.convertTo('error TS2345: first\nerror TS2304: second\n', NewlineKind.OsDefault),
+      { ensureFolderExists: true }
+    );
+    expect(FileSystem.copyFileAsync).not.toHaveBeenCalled();
+    expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+  });
+
+  it('should delete the error log when the chunks have no stderr, even if the cache entry has an error log', async () => {
+    // An entry saved after a failed run could hold that run's error log, even though its own run wrote no stderr
+    const data = [
+      {
+        text: 'built without errors\n',
+        kind: TerminalChunkKind.Stdout
+      }
+    ];
+
+    jest.spyOn(FileSystem, 'readFileAsync').mockResolvedValue(toJsonLines(data));
+
+    await manager.tryRestoreAsync({
+      terminal: mockTerminal,
+      terminalProvider: mockTerminalProvider,
+      errorLogPath: '/path/to/errorLog'
+    });
+
+    expect(FileSystem.deleteFileAsync).toHaveBeenCalledTimes(1);
+    expect(FileSystem.deleteFileAsync).toHaveBeenCalledWith('/path/to/errorLog');
+    expect(FileSystem.copyFileAsync).not.toHaveBeenCalled();
+    expect(FileSystem.writeFileAsync).not.toHaveBeenCalled();
+  });
+
+  describe('without log chunks', () => {
+    beforeEach(() => {
+      jest.spyOn(FileSystem, 'readFileAsync').mockRejectedValue(createNotExistError());
+      const mockReadStream: fs.ReadStream = Readable.from([]) as fs.ReadStream;
+      mockReadStream.close = jest.fn();
+      jest.spyOn(fs, 'createReadStream').mockReturnValue(mockReadStream);
+    });
+
+    it('should copy the cached error log', async () => {
+      await manager.tryRestoreAsync({
+        terminal: mockTerminal,
+        terminalProvider: mockTerminalProvider,
+        errorLogPath: '/path/to/errorLog'
+      });
+
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledTimes(1);
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledWith({
+        sourcePath: cachedErrorLogPath,
+        destinationPath: '/path/to/errorLog'
+      });
+      expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+      expect(FileSystem.writeFileAsync).not.toHaveBeenCalled();
+    });
+
+    it('should delete the error log when the cache entry has none', async () => {
+      jest.spyOn(FileSystem, 'copyFileAsync').mockRejectedValue(createNotExistError());
+
+      await manager.tryRestoreAsync({
+        terminal: mockTerminal,
+        terminalProvider: mockTerminalProvider,
+        errorLogPath: '/path/to/errorLog'
+      });
+
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledTimes(1);
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledWith('/path/to/errorLog');
+    });
+  });
+
+  describe('saveAsync', () => {
+    const metadata: IOperationMetaData = {
+      durationInSeconds: 1,
+      cobuildContextId: undefined,
+      cobuildRunnerId: undefined,
+      logPath: '/path/to/rush-logs/project.identifier.log',
+      errorLogPath: '/path/to/rush-logs/project.identifier.error.log',
+      logChunksPath: '/path/to/project/.rush/temp/chunked-rush-logs/project.identifier.chunks.jsonl'
+    };
+
+    it('should copy the log files of the run', async () => {
+      await manager.saveAsync(metadata);
+
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledTimes(3);
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledWith({
+        sourcePath: metadata.errorLogPath,
+        destinationPath: cachedErrorLogPath
+      });
+      expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+    });
+
+    it('should delete the copy an earlier run left when the run did not write an error log', async () => {
+      jest
+        .spyOn(FileSystem, 'copyFileAsync')
+        .mockImplementation(async ({ sourcePath }: IFileSystemCopyFileOptions) => {
+          if (sourcePath === metadata.errorLogPath) {
+            throw createNotExistError();
+          }
+        });
+
+      await manager.saveAsync(metadata);
+
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledTimes(3);
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledTimes(1);
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledWith(cachedErrorLogPath);
+    });
+
+    it('should rethrow other errors', async () => {
+      const error: Error = new Error('EACCES: permission denied');
+      jest.spyOn(FileSystem, 'copyFileAsync').mockRejectedValue(error);
+
+      await expect(manager.saveAsync(metadata)).rejects.toThrow(error);
+      expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
new file mode 100644
index 00000000000..709d03aded5
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
@@ -0,0 +1,227 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  describeOutputFileChanges,
+  getCleanOnlyReason,
+  hasContentHashedOutputChange,
+  readOperationOutputManifestAsync,
+  type IOperationOutputManifest
+} from '../OperationOutputManifest';
+
+describe(getCleanOnlyReason.name, () => {
+  it.each([
+    [
+      'lib/chunk.main_1a2b3c4d.js',
+      'its outputs include the content-hashed file "lib/chunk.main_1a2b3c4d.js"'
+    ],
+    ['lib/0dd8cf755e5195a5.js', 'its outputs include the content-hashed file "lib/0dd8cf755e5195a5.js"'],
+    ['lib/app-3f9a1c7b.min.css', 'its outputs include the content-hashed file "lib/app-3f9a1c7b.min.css"'],
+    [
+      'lib/vendor.4e5f6a7b.js.map',
+      'its outputs include the content-hashed file "lib/vendor.4e5f6a7b.js.map"'
+    ],
+    ['dist/main.js', 'its outputs include the bundle "dist/main.js"'],
+    ['dist-cjs/index.cjs', 'its outputs include the bundle "dist-cjs/index.cjs"'],
+    ['release/styles.css', 'its outputs include the bundle "release/styles.css"']
+  ])('treats %s as a clean-only output', (file: string, reason: string) => {
+    expect(getCleanOnlyReason(['lib/index.js', file])).toBe(reason);
+  });
+
+  it.each(['lib/index.js', 'lib/facade.js', 'lib/deadbeefcafe.js', 'lib-commonjs/a.js', 'dist/index.d.ts'])(
+    'allows incremental builds of %s',
+    (file: string) => {
+      expect(getCleanOnlyReason([file])).toBeUndefined();
+    }
+  );
+});
+
+describe(describeOutputFileChanges.name, () => {
+  it('describes added and removed files, and ignores content-addressed files', () => {
+    expect(describeOutputFileChanges(new Set(['lib/a.js']), new Set(['lib/a.js']))).toBeUndefined();
+    expect(
+      describeOutputFileChanges(
+        new Set(['lib/a.js', 'lib/b.js']),
+        new Set(['lib/a.js', 'lib/e.js', 'lib/d.js', 'lib/c.js', 'lib/f.js'])
+      )
+    ).toBe('4 added ("lib/c.js", "lib/d.js", "lib/e.js", ...), 1 removed ("lib/b.js")');
+    expect(
+      describeOutputFileChanges(
+        new Set(['temp/jest-transform-cache-0123456789abcdef-0123456789abcdef/7f/a_1']),
+        new Set(['temp/jest-transform-cache-0123456789abcdef-0123456789abcdef/8e/b_2'])
+      )
+    ).toBeUndefined();
+  });
+
+  it.each([
+    ['lib/0dd8cf755e5195a5.js', 'lib/7c1e0b4f9a2d3e6f.js'],
+    ['lib/2d0bb124b0ce1c65888f.png', 'lib/5c7a3e9f1b2d4068ace1.png'],
+    ['dist/app.0123456789abcdef0123.js', 'dist/app.3210fedcba9876543210.js'],
+    ['dist/2d0bb124b0ce1c65888f.png', 'dist/5c7a3e9f1b2d4068ace1.png']
+  ])(
+    'describes a content-hashed output that a bundler renamed from %s to %s',
+    (before: string, after: string) => {
+      expect(describeOutputFileChanges(new Set([before]), new Set([after]))).toBe(
+        `1 added (${JSON.stringify(after)}), 1 removed (${JSON.stringify(before)})`
+      );
+    }
+  );
+});
+
+describe(hasContentHashedOutputChange.name, () => {
+  it.each<[string[], string[], boolean]>([
+    [['lib/a.js'], ['lib/a.js', 'lib/chunk_0123456789abcdef0123.js'], true],
+    [['lib/a.js', 'lib/chunk.main_1a2b3c4d.js'], ['lib/a.js'], true],
+    [['dist/2d0bb124b0ce1c65888f.png'], ['dist/5c7a3e9f1b2d4068ace1.png'], true],
+    [['lib/a.js'], ['lib/a.js', 'lib/b.js'], false],
+    [['dist/a.js'], ['dist/a.js', 'dist/b.js'], false],
+    [['lib/chunk.main_1a2b3c4d.js'], ['lib/chunk.main_1a2b3c4d.js', 'lib/b.js'], false],
+    [['lib/a.js'], ['lib/a.js', 'temp/jest-transform-cache-0123456789abcdef-0123456789abcdef/7f/a_1'], false]
+  ])('for %j before and %j after, returns %s', (before: string[], after: string[], expected: boolean) => {
+    expect(hasContentHashedOutputChange(new Set(before), new Set(after))).toBe(expected);
+  });
+});
+
+describe(readOperationOutputManifestAsync.name, () => {
+  // Whole seconds, so that the time is set exactly
+  const KEPT_MODIFICATION_TIME_SECONDS: number = 1_700_000_000;
+  let projectFolder: string;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-manifest-'));
+    fs.mkdirSync(`${projectFolder}/lib/sub`, { recursive: true });
+    fs.writeFileSync(`${projectFolder}/lib/index.js`, 'index');
+    fs.writeFileSync(`${projectFolder}/lib/sub/util.js`, 'util');
+    fs.writeFileSync(`${projectFolder}/tsconfig.tsbuildinfo`, '{}');
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  function symlinkDirectory(targetPath: string, linkPath: string): void {
+    fs.symlinkSync(targetPath, linkPath, process.platform === 'win32' ? 'junction' : 'dir');
+  }
+
+  async function readAsync(): Promise<IOperationOutputManifest> {
+    return await readOperationOutputManifestAsync(projectFolder, ['lib/', 'tsconfig.tsbuildinfo', 'lib-esm']);
+  }
+
+  it('lists the output files', async () => {
+    const manifest: IOperationOutputManifest = await readAsync();
+    expect(Array.from(manifest.files).sort()).toEqual([
+      'lib/index.js',
+      'lib/sub/util.js',
+      'tsconfig.tsbuildinfo'
+    ]);
+    expect(manifest.cleanOnlyReason).toBeUndefined();
+    expect((await readAsync()).signature).toBe(manifest.signature);
+  });
+
+  it('follows a declared output folder link', async () => {
+    fs.rmSync(`${projectFolder}/lib`, { recursive: true });
+    fs.mkdirSync(`${projectFolder}/real-lib`);
+    fs.writeFileSync(`${projectFolder}/real-lib/index.js`, 'index');
+    symlinkDirectory(`${projectFolder}/real-lib`, `${projectFolder}/lib`);
+    const manifest: IOperationOutputManifest = await readOperationOutputManifestAsync(projectFolder, ['lib']);
+
+    expect(Array.from(manifest.files)).toEqual(['lib/index.js']);
+    fs.rmSync(`${projectFolder}/real-lib/index.js`);
+    expect((await readOperationOutputManifestAsync(projectFolder, ['lib'])).signature).not.toBe(
+      manifest.signature
+    );
+  });
+
+  it.each([
+    ['with the same size', (filePath: string) => fs.writeFileSync(filePath, 'utiL')],
+    ['by an append', (filePath: string) => fs.appendFileSync(filePath, ' 2')]
+  ])(
+    'changes if a file is rewritten in place %s',
+    async (description: string, rewrite: (filePath: string) => void) => {
+      const filePath: string = `${projectFolder}/lib/sub/util.js`;
+      const { ino } = fs.statSync(filePath);
+      const { signature } = await readAsync();
+      // File modification times can have a coarse resolution.
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      rewrite(filePath);
+      expect(fs.statSync(filePath).ino).toBe(ino);
+      expect((await readAsync()).signature).not.toBe(signature);
+    }
+  );
+
+  it('does not change if a hard link to a file is created elsewhere', async () => {
+    const { signature } = await readAsync();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    fs.linkSync(`${projectFolder}/lib/sub/util.js`, `${projectFolder}/util.js`);
+    fs.linkSync(`${projectFolder}/tsconfig.tsbuildinfo`, `${projectFolder}/tsbuildinfo.json`);
+    expect((await readAsync()).signature).toBe(signature);
+  });
+
+  // E.g. `cp -p`, `rsync -t` or `tar -x`, which give the files that they write the modification time of their source.
+  it.each([
+    [
+      'a file is rewritten in place by an append',
+      (folder: string) => fs.appendFileSync(`${folder}/lib/sub/util.js`, ' 2')
+    ],
+    [
+      'an output file that is not in a folder is replaced by a rename with the same size',
+      (folder: string) => {
+        fs.writeFileSync(`${folder}/tsconfig.tsbuildinfo.tmp`, '[]');
+        fs.renameSync(`${folder}/tsconfig.tsbuildinfo.tmp`, `${folder}/tsconfig.tsbuildinfo`);
+      }
+    ]
+  ])(
+    'changes if %s and its modification time is kept',
+    async (description: string, change: (folder: string) => void) => {
+      const files: string[] = [`${projectFolder}/lib/sub/util.js`, `${projectFolder}/tsconfig.tsbuildinfo`];
+      const keepModificationTimes = (): void => {
+        for (const file of files) {
+          fs.utimesSync(file, KEPT_MODIFICATION_TIME_SECONDS, KEPT_MODIFICATION_TIME_SECONDS);
+        }
+      };
+      keepModificationTimes();
+      const { signature } = await readAsync();
+      change(projectFolder);
+      keepModificationTimes();
+      expect((await readAsync()).signature).not.toBe(signature);
+    }
+  );
+
+  it.each([
+    [
+      'a file is added to a subfolder',
+      (folder: string) => fs.writeFileSync(`${folder}/lib/sub/new.js`, 'new')
+    ],
+    ['a file is deleted', (folder: string) => fs.rmSync(`${folder}/lib/sub/util.js`)],
+    [
+      'an output file that is not in a folder is rewritten in place',
+      (folder: string) => fs.appendFileSync(`${folder}/tsconfig.tsbuildinfo`, ' ')
+    ],
+    [
+      'a file in a subfolder is replaced by a rename',
+      (folder: string) => {
+        fs.writeFileSync(`${folder}/lib/sub/util.js.tmp`, 'util 2');
+        fs.renameSync(`${folder}/lib/sub/util.js.tmp`, `${folder}/lib/sub/util.js`);
+      }
+    ],
+    [
+      'a folder is recreated',
+      (folder: string) => {
+        fs.rmSync(`${folder}/lib/sub`, { recursive: true });
+        fs.mkdirSync(`${folder}/lib/sub`);
+        fs.writeFileSync(`${folder}/lib/sub/util.js`, 'util');
+      }
+    ],
+    ['a missing output folder is created', (folder: string) => fs.mkdirSync(`${folder}/lib-esm`)]
+  ])('changes if %s', async (description: string, change: (folder: string) => void) => {
+    const { signature } = await readAsync();
+    // Folder modification times can have a coarse resolution.
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    change(projectFolder);
+    expect((await readAsync()).signature).not.toBe(signature);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
new file mode 100644
index 00000000000..8e68e931807
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
@@ -0,0 +1,740 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
+import { LegacySkipPlugin } from '../LegacySkipPlugin';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { OperationGraph } from '../OperationGraph';
+import { Operation } from '../Operation';
+import { OperationStatus } from '../OperationStatus';
+import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import { markResultUnverifiable } from '../RetainedResultVerification';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+class MockRunner implements IOperationRunner {
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean = false;
+  public readonly name: string;
+  public readonly isNoOp: boolean;
+  readonly #executions: string[];
+  readonly #incrementalExecutions: string[];
+
+  public constructor(name: string, isNoOp: boolean, executions: string[], incrementalExecutions: string[]) {
+    this.name = name;
+    this.isNoOp = isNoOp;
+    this.#executions = executions;
+    this.#incrementalExecutions = incrementalExecutions;
+  }
+
+  public async executeAsync(
+    context: IOperationRunnerContext,
+    lastState?: IOperationExecutionResult
+  ): Promise<OperationStatus> {
+    if (this.isNoOp) {
+      return OperationStatus.NoOp;
+    }
+    this.#executions.push(this.name);
+    if (lastState) {
+      this.#incrementalExecutions.push(this.name);
+    }
+    return OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'config';
+  }
+}
+
+interface ITestGraph {
+  graph: OperationGraph;
+  operations: Map<string, Operation>;
+  localHashes: Map<string, string>;
+  executions: string[];
+  /** The executions that were given the result of the previous execution. */
+  incrementalExecutions: string[];
+  /**
+   * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
+   */
+  checks: string[];
+  executeAsync(isIncrementalBuildAllowed?: boolean): Promise<IExecutionResult>;
+}
+
+interface ITestGraphOptions {
+  /**
+   * Operations that have no work.
+   */
+  noOps?: ReadonlySet<string>;
+  /**
+   * If set, the incremental state files of the legacy skip detection are stored in this folder.
+   */
+  legacySkipFolder?: string;
+  /**
+   * If set, emulates a plugin with its own change detection (e.g. by tracing the files that each operation reads),
+   * which reports a selected operation as skipped if its name is in this set, because its outputs are up to date.
+   */
+  upToDate?: ReadonlySet<string>;
+  /**
+   * Whether the command may skip operations. It is false for `rush rebuild`. Defaults to true.
+   */
+  isIncrementalBuildAllowed?: boolean;
+}
+
+/**
+ * Creates a graph from the names of the dependencies of each operation, without the build cache.
+ */
+async function createTestGraphAsync(
+  dependencies: Record<string, string[]>,
+  options: ITestGraphOptions = {}
+): Promise<ITestGraph> {
+  const {
+    noOps,
+    legacySkipFolder,
+    upToDate,
+    isIncrementalBuildAllowed: isIncrementalCommand = true
+  } = options;
+  const executions: string[] = [];
+  const incrementalExecutions: string[] = [];
+  const checks: string[] = [];
+  const localHashes: Map<string, string> = new Map();
+  const operations: Map<string, Operation> = new Map();
+
+  for (const name of Object.keys(dependencies)) {
+    const projectFolder: string = path.join(legacySkipFolder ?? '/repo', name);
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder,
+      projectRushTempFolder: projectFolder
+    } as unknown as RushConfigurationProject;
+    const operation: Operation = new Operation({
+      runner: new MockRunner(name, !!noOps?.has(name), executions, incrementalExecutions),
+      logFilenameIdentifier: name,
+      phase: mockPhase,
+      project
+    });
+    operations.set(name, operation);
+    localHashes.set(name, `${name}-v1`);
+  }
+  for (const [name, dependencyNames] of Object.entries(dependencies)) {
+    for (const dependencyName of dependencyNames) {
+      operations.get(name)!.addDependency(operations.get(dependencyName)!);
+    }
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  if (legacySkipFolder) {
+    new LegacySkipPlugin({
+      allowWarningsInSuccessfulBuild: false,
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      changedProjectsOnly: false,
+      isIncrementalBuildAllowed: isIncrementalCommand
+    }).apply(hooks);
+  }
+
+  const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: isIncrementalCommand,
+    projectConfigurations: new Map()
+  } as unknown as IOperationGraphContext);
+  if (upToDate) {
+    graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      { name: 'TestChangeDetectionPlugin', stage: -200 },
+      async (
+        record: IOperationRunnerContext & IOperationExecutionResult
+      ): Promise<OperationStatus | undefined> => {
+        if (record.silent) {
+          return;
+        }
+        const { name } = record.operation;
+        checks.push(name);
+        return upToDate.has(name) ? OperationStatus.Skipped : undefined;
+      }
+    );
+  }
+
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes: new Map(),
+    rootDirectory: '/repo',
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
+      new Map([[`${project.packageName}/src/index.ts`, localHashes.get(project.packageName)!]]),
+    getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
+  };
+
+  return {
+    graph,
+    operations,
+    localHashes,
+    executions,
+    incrementalExecutions,
+    checks,
+    executeAsync: async (isIncrementalBuildAllowed?: boolean) => {
+      executions.length = 0;
+      incrementalExecutions.length = 0;
+      checks.length = 0;
+      return await graph.executeAsync({ inputsSnapshot, isIncrementalBuildAllowed });
+    }
+  };
+}
+
+/**
+ * Returns the status of each operation in the result of an iteration, or "silent" if it was not selected.
+ */
+function getStatuses(testGraph: ITestGraph, result: IExecutionResult): Record<string, string> {
+  const statuses: Record<string, string> = {};
+  for (const [name, operation] of testGraph.operations) {
+    const record: IOperationExecutionResult = result.operationResults.get(operation)!;
+    statuses[name] = record.silent ? 'silent' : record.status;
+  }
+  return statuses;
+}
+
+// How results retained by earlier iterations of a long-lived graph (e.g. the Rush daemon) are verified,
+// whether or not the build cache is in use.
+describe(`${PhasedOperationPlugin.name} retained results`, () => {
+  it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both: "b" is built against the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b: "b" has the same state hash as its retained result, but "a" is rebuilt.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('re-executes every retained result in a chain that was built against unverified outputs', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'], c: ['b'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    const b: Operation = testGraph.operations.get('b')!;
+    const c: Operation = testGraph.operations.get('c')!;
+    await testGraph.executeAsync();
+
+    // --only b, then --only c, after editing "a" and "b"
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    c.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    b.enabled = false;
+    c.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+
+    // --to c
+    a.enabled = true;
+    b.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+  });
+
+  it('verifies results through operations without work', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(
+      { a: [], n: ['a'], b: ['n'] },
+      { noOps: new Set(['n']) }
+    );
+    const a: Operation = testGraph.operations.get('a')!;
+    const n: Operation = testGraph.operations.get('n')!;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    // --only b, after editing "a" and "b"
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    n.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b
+    a.enabled = true;
+    n.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute a retained result that was built against unchanged dependencies that were not selected', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing "b"
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute a retained result while a dependency that was not selected is unverified', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    testGraph.operations.get('a')!.enabled = false;
+
+    // Cold --only b: "a" has never executed in this graph.
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // Repeating the request cannot produce a verified result for "b", so it is skipped.
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('re-executes a consumer whose dependency was rebuilt by a request that did not select it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ b: [], c: ['b'] });
+    const c: Operation = testGraph.operations.get('c')!;
+    await testGraph.executeAsync();
+
+    // --to b, after editing "b"
+    testGraph.localHashes.set('b', 'b-v2');
+    c.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to c
+    c.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+  });
+
+  it('re-executes a result that a plugin marked unverifiable, and the results built against it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    let isMarkingA: boolean = true;
+    // Like CacheableOperationPlugin when input files of "a" changed while "a" was executing
+    testGraph.graph.hooks.afterExecuteOperationAsync.tap(
+      'TestPlugin',
+      (record: IOperationExecutionResult) => {
+        if (isMarkingA && record.operation === a) {
+          markResultUnverifiable(record);
+        }
+      }
+    );
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    // The same state hashes
+    isMarkingA = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute retained results of operations that ignore dependency changes', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    const b: Operation = testGraph.operations.get('b')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b --changed-projects-only
+    a.enabled = 'ignore-dependency-changes';
+    b.enabled = 'ignore-dependency-changes';
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a']);
+  });
+
+  it('does not re-enable operations that a later configureIteration tap disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // Like a plugin that performs the work itself.
+    testGraph.graph.hooks.configureIteration.tap({ name: 'TestPlugin', stage: 1 }, (records) => {
+      for (const record of records.values()) {
+        record.enabled = false;
+      }
+    });
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('runs every selected operation of a non-incremental iteration without its previous result', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const b: Operation = testGraph.operations.get('b')!;
+    await testGraph.executeAsync();
+
+    // rebuild --to b
+    await testGraph.executeAsync(false);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.incrementalExecutions).toEqual([]);
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+
+    // rebuild --only a: "a" has the same state hash, so "b" stays verified.
+    b.enabled = false;
+    await testGraph.executeAsync(false);
+    expect(testGraph.executions).toEqual(['a']);
+    b.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual([]);
+
+    // An incremental iteration gives each operation its previous result.
+    testGraph.localHashes.set('a', 'a-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.incrementalExecutions).toEqual(['a', 'b']);
+  });
+
+  it('reuses the result of a selected operation that a plugin found up to date while its state hash is unchanged', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+
+    // The outputs were built before this graph was created.
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+
+    // Edit "b"
+    testGraph.localHashes.set('b', 'b-v2');
+    upToDate.delete('b');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['b']);
+    expect(testGraph.executions).toEqual(['b']);
+
+    const secondHotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(secondHotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('checks a result that a plugin found up to date against outputs of a dependency that were not current again', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+
+    // --only b, after editing "a": "b" is found up to date with the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    upToDate.delete('a');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['b']);
+    expect(testGraph.executions).toEqual([]);
+
+    // --to b: "b" has the same state hash as its retained result, but "a" is rebuilt, which changes the inputs of "b".
+    a.enabled = true;
+    upToDate.delete('b');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+  });
+
+  it('checks a result that a plugin found up to date again if it was marked unverifiable, and the results checked against it', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+    const a: Operation = testGraph.operations.get('a')!;
+    let isMarkingA: boolean = true;
+    // Like CacheableOperationPlugin when input files of "a" changed during the iteration
+    testGraph.graph.hooks.afterExecuteOperationAsync.tap(
+      'TestPlugin',
+      (record: IOperationExecutionResult) => {
+        if (isMarkingA && record.operation === a) {
+          markResultUnverifiable(record);
+        }
+      }
+    );
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+
+    // The same state hashes
+    isMarkingA = false;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+  });
+
+  it('enables every selected operation of a non-incremental iteration, even with a result that a plugin found up to date', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual([]);
+
+    // rebuild --to b: the retained results are current, but each operation is checked again.
+    await testGraph.executeAsync(false);
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual([]);
+
+    // The plugin no longer finds "b" up to date, so it runs without its previous result.
+    upToDate.delete('b');
+    await testGraph.executeAsync(false);
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.incrementalExecutions).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+  });
+
+  describe('with legacy skip detection', () => {
+    let legacySkipFolder: string;
+
+    beforeEach(() => {
+      legacySkipFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-legacy-skip-'));
+    });
+
+    afterEach(() => {
+      fs.rmSync(legacySkipFolder, { recursive: true, force: true });
+    });
+
+    it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      const a: Operation = testGraph.operations.get('a')!;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['a', 'b']);
+
+      // --only b, after editing both
+      testGraph.localHashes.set('a', 'a-v2');
+      testGraph.localHashes.set('b', 'b-v2');
+      a.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+
+      // --to b
+      a.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['a', 'b']);
+
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+      expect(testGraph.executions).toEqual([]);
+    });
+
+    it('re-executes a consumer whose dependency was rebuilt by a request that did not select it', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync({ b: [], c: ['b'] }, { legacySkipFolder });
+      const c: Operation = testGraph.operations.get('c')!;
+      await testGraph.executeAsync();
+
+      // --to b, after editing "b"
+      testGraph.localHashes.set('b', 'b-v2');
+      c.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+
+      // --to c: the files of "c" did not change, and "b" does not execute.
+      c.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['c']);
+    });
+
+    it('skips no operation of a non-incremental iteration', async () => {
+      // Build once in another process, then start a long-lived graph.
+      await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      await testGraph.executeAsync(false);
+      expect(testGraph.executions).toEqual(['a', 'b']);
+
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+      expect(testGraph.executions).toEqual([]);
+    });
+
+    it('still skips an unverified retained result if no dependency executes', async () => {
+      // Build once in another process, then start a long-lived graph.
+      await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      const a: Operation = testGraph.operations.get('a')!;
+
+      // --only b, after editing "b": "a" is not selected, so it is not verified in this graph.
+      testGraph.localHashes.set('b', 'b-v2');
+      a.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+
+      // --to b: the legacy skip detection skips "a", and still skips "b".
+      a.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual([]);
+
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+      expect(testGraph.executions).toEqual([]);
+    });
+
+    it('reuses results that the legacy skip detection found up to date while their state hashes are unchanged', async () => {
+      // Build once in another process, then start a long-lived graph.
+      await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      const result: IExecutionResult = await testGraph.executeAsync();
+      expect(getStatuses(testGraph, result)).toEqual({ a: 'SKIPPED', b: 'SKIPPED' });
+      expect(testGraph.executions).toEqual([]);
+
+      // No iteration is scheduled.
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+
+      // Edit "b": "a" is not checked again.
+      testGraph.localHashes.set('b', 'b-v2');
+      const changedResult: IExecutionResult = await testGraph.executeAsync();
+      expect(getStatuses(testGraph, changedResult)).toEqual({ a: 'silent', b: 'SUCCESS' });
+      expect(testGraph.executions).toEqual(['b']);
+    });
+
+    it("forgets a dependency's change after the iteration, so a later rebuild keeps the records of consumers that it doesn't execute", async () => {
+      // Like the engine of a daemon for "rush rebuild"
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        { a: [], b: ['a'], x: [] },
+        { legacySkipFolder, isIncrementalBuildAllowed: false }
+      );
+      const a: Operation = testGraph.operations.get('a')!;
+      const b: Operation = testGraph.operations.get('b')!;
+      const x: Operation = testGraph.operations.get('x')!;
+      const recordPathOfB: string = path.join(legacySkipFolder, 'b', 'package-deps_b.json');
+      await testGraph.executeAsync();
+      expect([...testGraph.executions].sort()).toEqual(['a', 'b', 'x']);
+
+      // --only a, after editing "a": "b" was built against the old outputs of "a", so its record is deleted.
+      testGraph.localHashes.set('a', 'a-v2');
+      b.enabled = false;
+      x.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['a']);
+      expect(fs.existsSync(recordPathOfB)).toBe(false);
+
+      // --only b
+      a.enabled = false;
+      b.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+      expect(fs.existsSync(recordPathOfB)).toBe(true);
+
+      // --only x, after editing "x": nothing that "b" depends on changed since "b" was built.
+      testGraph.localHashes.set('x', 'x-v2');
+      b.enabled = false;
+      x.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['x']);
+      expect(fs.existsSync(recordPathOfB)).toBe(true);
+    });
+
+    it('keeps the records of operations that a rebuild iteration of a build engine does not execute, until a dependency changes', async () => {
+      // Like the engine of a daemon for "rush build", which also runs "rush rebuild"
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        { a: [], b: ['a'], x: [] },
+        { legacySkipFolder }
+      );
+      const b: Operation = testGraph.operations.get('b')!;
+      const x: Operation = testGraph.operations.get('x')!;
+      const getRecordPath = (name: string): string =>
+        path.join(legacySkipFolder, name, `package-deps_${name}.json`);
+      await testGraph.executeAsync();
+      expect([...testGraph.executions].sort()).toEqual(['a', 'b', 'x']);
+
+      // rush rebuild --only a: "a" reproduces its outputs.
+      b.enabled = false;
+      x.enabled = false;
+      await testGraph.executeAsync(false);
+      expect(testGraph.executions).toEqual(['a']);
+      expect(fs.existsSync(getRecordPath('b'))).toBe(true);
+      expect(fs.existsSync(getRecordPath('x'))).toBe(true);
+
+      // rush rebuild --only a, after editing "a": "b" was built against the old outputs of "a".
+      testGraph.localHashes.set('a', 'a-v2');
+      await testGraph.executeAsync(false);
+      expect(testGraph.executions).toEqual(['a']);
+      expect(fs.existsSync(getRecordPath('b'))).toBe(false);
+      expect(fs.existsSync(getRecordPath('x'))).toBe(true);
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts
new file mode 100644
index 00000000000..dbcd1a8a04c
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts
@@ -0,0 +1,167 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import path from 'node:path';
+
+import { JsonFile } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { CommandLineAction, CommandLineParser, type CommandLineParameter } from '@rushstack/ts-command-line';
+
+import { RushConfiguration } from '../../../api/RushConfiguration';
+import {
+  CommandLineConfiguration,
+  type IPhasedCommandConfig,
+  type IParameterJson,
+  type IPhase
+} from '../../../api/CommandLineConfiguration';
+import type { ICommandLineJson } from '../../../api/CommandLineJson';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import { defineCustomParameters } from '../../../cli/parsing/defineCustomParameters';
+import { associateParametersByPhase } from '../../../cli/parsing/associateParametersByPhase';
+import {
+  type ICreateOperationsContext,
+  PhasedCommandHooks
+} from '../../../pluginFramework/PhasedCommandHooks';
+import { IS_WINDOWS } from '../../../utilities/executionUtilities';
+import type { Operation } from '../Operation';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { ShardedPhasedOperationPlugin } from '../ShardedPhaseOperationPlugin';
+import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
+
+class TestCommandLineAction extends CommandLineAction {
+  protected async onExecuteAsync(): Promise<void> {
+    // No-op for testing
+  }
+}
+
+class TestCommandLineParser extends CommandLineParser {
+  public constructor() {
+    super({
+      toolFilename: 'test-tool',
+      toolDescription: 'Test tool for parameter parsing'
+    });
+  }
+}
+
+const PARENT_FOLDER_ARGUMENT: string = '--shard-parent-folder=".rush/operations/build/shards/"';
+const SHARD_COUNT_ARGUMENT: string = '--shard-count="2"';
+
+/**
+ * Creates the operations of shardedParameterRepo's `build` command for the given command line, and returns
+ * the command of each operation, by its log filename identifier.
+ */
+async function getCommandsByLogFilenameIdentifierAsync(argv: string[]): Promise<Map<string, string>> {
+  const repoFolder: string = path.resolve(__dirname, '../../test/shardedParameterRepo');
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    `${repoFolder}/rush.json`
+  );
+  const commandLineJson: ICommandLineJson = JsonFile.load(
+    `${repoFolder}/common/config/rush/command-line.json`
+  );
+  const buildCommand: IPhasedCommandConfig = new CommandLineConfiguration(commandLineJson).commands.get(
+    'build'
+  )! as IPhasedCommandConfig;
+
+  const projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+    await RushProjectConfiguration.tryLoadForProjectsAsync(
+      rushConfiguration.projects,
+      new Terminal(new StringBufferTerminalProvider())
+    );
+
+  const parser: TestCommandLineParser = new TestCommandLineParser();
+  const action: TestCommandLineAction = new TestCommandLineAction({
+    actionName: 'build',
+    summary: 'Test build action',
+    documentation: 'Test'
+  });
+  parser.addAction(action);
+  const customParametersMap: Map<IParameterJson, CommandLineParameter> = new Map();
+  defineCustomParameters(action, buildCommand.associatedParameters, customParametersMap);
+  await parser.executeWithoutErrorHandlingAsync(argv);
+
+  const phasesMap: Map<string, IPhase> = new Map();
+  for (const phase of buildCommand.phases) {
+    phasesMap.set(phase.name, phase);
+  }
+  associateParametersByPhase(customParametersMap, phasesMap);
+
+  const customParameters: Map<string, CommandLineParameter> = new Map();
+  for (const [parameterJson, parameter] of customParametersMap) {
+    customParameters.set(parameterJson.longName, parameter);
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new ShardedPhasedOperationPlugin().apply(hooks);
+  new ShellOperationRunnerPlugin().apply(hooks);
+  const context: Pick<
+    ICreateOperationsContext,
+    'phaseSelection' | 'projectSelection' | 'projectConfigurations' | 'rushConfiguration' | 'customParameters'
+  > = {
+    phaseSelection: buildCommand.phases,
+    projectSelection: new Set(rushConfiguration.projects),
+    projectConfigurations,
+    rushConfiguration,
+    customParameters
+  };
+  const operations: Set<Operation> = await hooks.createOperationsAsync.promise(
+    new Set(),
+    context as unknown as ICreateOperationsContext
+  );
+
+  const commandsByLogFilenameIdentifier: Map<string, string> = new Map();
+  for (const operation of operations) {
+    commandsByLogFilenameIdentifier.set(operation.logFilenameIdentifier, operation.runner!.getConfigHash());
+  }
+  return commandsByLogFilenameIdentifier;
+}
+
+describe(ShardedPhasedOperationPlugin.name, () => {
+  it('S1: leaves the commands of a value that needs no quoting as they were', async () => {
+    const commands: Map<string, string> = await getCommandsByLogFilenameIdentifierAsync([
+      'build',
+      '--pattern',
+      'abc'
+    ]);
+
+    expect(commands).toEqual(
+      new Map([
+        ['build_pre-shard', ''],
+        ['build_collate', `echo collate a --pattern abc ${PARENT_FOLDER_ARGUMENT} ${SHARD_COUNT_ARGUMENT}`],
+        [
+          'build_shard_1',
+          'echo shard a --pattern abc --shard=1/2 --shard-output-directory=.rush/operations/build/shards/1'
+        ],
+        [
+          'build_shard_2',
+          'echo shard a --pattern abc --shard=2/2 --shard-output-directory=.rush/operations/build/shards/2'
+        ]
+      ])
+    );
+  });
+
+  describe('with a value that the shell would parse', () => {
+    const quotedPattern: string = IS_WINDOWS ? '"a|b"' : "'a|b'";
+    let commands: Map<string, string>;
+
+    beforeAll(async () => {
+      commands = await getCommandsByLogFilenameIdentifierAsync(['build', '--pattern', 'a|b']);
+    });
+
+    it("S2: quotes the value in the collator's command, but not the collator's arguments", () => {
+      expect(commands.get('build_collate')).toEqual(
+        `echo collate a --pattern ${quotedPattern} ${PARENT_FOLDER_ARGUMENT} ${SHARD_COUNT_ARGUMENT}`
+      );
+    });
+
+    it.each([1, 2])(
+      "S3: quotes the value in shard %s's command, but not the shard's arguments",
+      (shard: number) => {
+        expect(commands.get(`build_shard_${shard}`)).toEqual(
+          `echo shard a --pattern ${quotedPattern} --shard=${shard}/2 --shard-output-directory=.rush/operations/build/shards/${shard}`
+        );
+      }
+    );
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts
new file mode 100644
index 00000000000..2ad766f703d
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts
@@ -0,0 +1,213 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import { PassThrough } from 'node:stream';
+
+import {
+  StringBufferTerminalProvider,
+  Terminal,
+  type ITerminal,
+  type ITerminalProvider
+} from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { Utilities } from '../../../utilities/Utilities';
+import type { IOperationRunnerContext } from '../IOperationRunner';
+import { OperationStatus } from '../OperationStatus';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+import {
+  getCommandExecution,
+  setIncrementalExecutionGuard,
+  type IIncrementalExecutionGuard
+} from '../IncrementalExecutionState';
+
+const INITIAL_COMMAND: string = 'node build.js';
+const INCREMENTAL_COMMAND: string = 'node build.js --incremental';
+
+interface ITestRun {
+  readonly status: OperationStatus;
+  readonly commands: ReadonlyArray<string>;
+  readonly output: string;
+  readonly context: IOperationRunnerContext;
+}
+
+interface ITestRunOptions {
+  readonly requiresGuard: boolean;
+  readonly guard?: IIncrementalExecutionGuard;
+  readonly hasLastState?: boolean;
+  readonly exitCodeByCommand?: Readonly<Record<string, number>>;
+}
+
+async function runAsync(options: ITestRunOptions): Promise<ITestRun> {
+  const { requiresGuard, guard, hasLastState = true, exitCodeByCommand = {} } = options;
+  const commands: string[] = [];
+  const executeSpy: jest.SpyInstance = jest
+    .spyOn(Utilities, 'executeLifecycleCommandAsync')
+    .mockImplementation((command: string) => {
+      commands.push(command);
+      const stdout: PassThrough = new PassThrough();
+      const stderr: PassThrough = new PassThrough();
+      const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+        stdout,
+        stderr,
+        stdio: []
+      }) as unknown as childProcess.ChildProcess;
+      queueMicrotask(() => {
+        stdout.end();
+        stderr.end();
+        child.emit('close', exitCodeByCommand[command] ?? 0, null);
+      });
+      return child;
+    });
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const context: IOperationRunnerContext = {
+    environment: undefined,
+    createChildProcessReporter: jest.fn(),
+    async runWithTerminalAsync<T>(
+      callback: (
+        terminal: ITerminal,
+        operationTerminalProvider: ITerminalProvider,
+        structuredChildOutputTerminalProvider: ITerminalProvider
+      ) => Promise<T>
+    ): Promise<T> {
+      return await callback(new Terminal(terminalProvider), terminalProvider, terminalProvider);
+    }
+  } as unknown as IOperationRunnerContext;
+  if (guard) {
+    setIncrementalExecutionGuard(context, guard);
+  }
+  const runner: ShellOperationRunner = new ShellOperationRunner({
+    phase: { allowWarningsOnSuccess: false } as IPhase,
+    rushProject: {
+      projectFolder: process.cwd(),
+      rushConfiguration: { commonTempFolder: process.cwd() }
+    } as RushConfigurationProject,
+    displayName: 'a (build)',
+    initialCommand: INITIAL_COMMAND,
+    incrementalCommand: INCREMENTAL_COMMAND,
+    incrementalCommandRequiresGuard: requiresGuard,
+    commandForHash: INITIAL_COMMAND,
+    ignoredParameterValues: []
+  });
+  try {
+    const status: OperationStatus = await runner.executeAsync(
+      context,
+      hasLastState ? { status: OperationStatus.Success } : undefined
+    );
+    return { status, commands, output: terminalProvider.getOutput(), context };
+  } finally {
+    executeSpy.mockRestore();
+  }
+}
+
+function createGuard(
+  blockReason: string | undefined,
+  rerunReason: string | undefined = undefined
+): IIncrementalExecutionGuard & {
+  getBlockReasonAsync: jest.Mock;
+  verifyIncrementalResultAsync: jest.Mock;
+} {
+  return {
+    getBlockReasonAsync: jest.fn(async () => blockReason),
+    verifyIncrementalResultAsync: jest.fn(async () => rerunReason)
+  };
+}
+
+describe(`${ShellOperationRunner.name} with an incremental command that requires a guard`, () => {
+  it('runs the initial command if no guard is registered', async () => {
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(output).toContain(`Invoking (initial): ${INITIAL_COMMAND}`);
+    expect(getCommandExecution(context)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+  });
+
+  it('runs the initial command without asking the guard if the operation has no last state', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(undefined);
+    const { commands } = await runAsync({ requiresGuard: true, guard, hasLastState: false });
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(guard.getBlockReasonAsync).not.toHaveBeenCalled();
+  });
+
+  it('runs the initial command and says why if the guard blocks the incremental command', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard('input files were added, deleted or renamed');
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(output).toContain(
+      'Not using the incremental command because input files were added, deleted or renamed.'
+    );
+    expect(guard.verifyIncrementalResultAsync).not.toHaveBeenCalled();
+    expect(getCommandExecution(context)?.kind).toBe('initial');
+  });
+
+  it('runs only the incremental command if the guard allows it and its outputs are verified', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(undefined);
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INCREMENTAL_COMMAND]);
+    expect(output).toContain(`Invoking (incremental): ${INCREMENTAL_COMMAND}`);
+    expect(guard.verifyIncrementalResultAsync).toHaveBeenCalledTimes(1);
+    expect(getCommandExecution(context)).toEqual({ kind: 'incremental', hasIncrementalCommand: true });
+  });
+
+  it('runs the initial command after the incremental command if its outputs are not verified', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(
+      undefined,
+      'the incremental command changed which output files it has: added "lib/b.js"'
+    );
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INCREMENTAL_COMMAND, INITIAL_COMMAND]);
+    expect(output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: added "lib/b.js".'
+    );
+    expect(getCommandExecution(context)?.kind).toBe('initial');
+  });
+
+  it('does not verify or repeat a failed incremental command', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(undefined);
+    const { status, commands, context } = await runAsync({
+      requiresGuard: true,
+      guard,
+      exitCodeByCommand: { [INCREMENTAL_COMMAND]: 1 }
+    });
+    expect(status).toBe(OperationStatus.Failure);
+    expect(commands).toEqual([INCREMENTAL_COMMAND]);
+    expect(guard.verifyIncrementalResultAsync).not.toHaveBeenCalled();
+    expect(getCommandExecution(context)?.kind).toBe('incremental');
+  });
+
+  it('runs the initial command if the guard fails', async () => {
+    const guard: IIncrementalExecutionGuard = {
+      getBlockReasonAsync: async () => {
+        throw new Error('EACCES: permission denied');
+      },
+      verifyIncrementalResultAsync: async () => undefined
+    };
+    const { status, commands, output } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(output).toContain(
+      'Not using the incremental command because its incremental execution guard failed: Error: EACCES: permission denied.'
+    );
+  });
+});
+
+describe(`${ShellOperationRunner.name} with an incremental command that does not require a guard`, () => {
+  it('runs the incremental command for an operation with a last state, as in watch mode, without recording it', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard('its command line changed');
+    const { commands, context } = await runAsync({ requiresGuard: false, guard });
+    expect(commands).toEqual([INCREMENTAL_COMMAND]);
+    expect(guard.getBlockReasonAsync).not.toHaveBeenCalled();
+    expect(getCommandExecution(context)).toBeUndefined();
+  });
+
+  it('runs the initial command for an operation without a last state', async () => {
+    const { commands } = await runAsync({ requiresGuard: false, hasLastState: false });
+    expect(commands).toEqual([INITIAL_COMMAND]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
index 3e558acc906..8ef04c5d8a0 100644
--- a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
@@ -1,9 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type * as childProcess from 'node:child_process';
+import { EventEmitter } from 'node:events';
 import path from 'node:path';
+import { PassThrough } from 'node:stream';
+
 import { JsonFile } from '@rushstack/node-core-library';
-import { ConsoleTerminalProvider, Terminal } from '@rushstack/terminal';
+import {
+  ConsoleTerminalProvider,
+  StringBufferTerminalProvider,
+  Terminal,
+  type ITerminal,
+  type ITerminalProvider
+} from '@rushstack/terminal';
 import { CommandLineAction, CommandLineParser, type CommandLineParameter } from '@rushstack/ts-command-line';
 
 import { RushConfiguration } from '../../../api/RushConfiguration';
@@ -13,10 +23,14 @@ import {
   type IParameterJson,
   type IPhase
 } from '../../../api/CommandLineConfiguration';
-import type { Operation } from '../Operation';
+import { Operation } from '../Operation';
+import type { IOperationRunnerContext } from '../IOperationRunner';
+import { OperationStatus } from '../OperationStatus';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { Utilities } from '../../../utilities/Utilities';
 import type { ICommandLineJson } from '../../../api/CommandLineJson';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
-import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
+import { formatCommand, ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
 import {
   type ICreateOperationsContext,
   PhasedCommandHooks
@@ -24,6 +38,8 @@ import {
 import { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
 import { defineCustomParameters } from '../../../cli/parsing/defineCustomParameters';
 import { associateParametersByPhase } from '../../../cli/parsing/associateParametersByPhase';
+import { getCommandExecution, setIncrementalExecutionGuard } from '../IncrementalExecutionState';
+import { IS_WINDOWS } from '../../../utilities/executionUtilities';
 
 interface ISerializedOperation {
   name: string;
@@ -58,6 +74,65 @@ class TestCommandLineParser extends CommandLineParser {
   }
 }
 
+/**
+ * Creates the operations of parameterIgnoringRepo's `build` command, for the given command line.
+ */
+async function createParameterIgnoringRepoOperationsAsync(argv: string[]): Promise<Set<Operation>> {
+  const repoFolder: string = path.resolve(__dirname, '../../test/parameterIgnoringRepo');
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    `${repoFolder}/rush.json`
+  );
+  const commandLineJson: ICommandLineJson = JsonFile.load(
+    `${repoFolder}/common/config/rush/command-line.json`
+  );
+  const buildCommand: IPhasedCommandConfig = new CommandLineConfiguration(commandLineJson).commands.get(
+    'build'
+  )! as IPhasedCommandConfig;
+
+  const projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+    await RushProjectConfiguration.tryLoadForProjectsAsync(
+      rushConfiguration.projects,
+      new Terminal(new StringBufferTerminalProvider())
+    );
+
+  const parser: TestCommandLineParser = new TestCommandLineParser();
+  const action: TestCommandLineAction = new TestCommandLineAction({
+    actionName: 'build',
+    summary: 'Test build action',
+    documentation: 'Test'
+  });
+  parser.addAction(action);
+  const customParametersMap: Map<IParameterJson, CommandLineParameter> = new Map();
+  defineCustomParameters(action, buildCommand.associatedParameters, customParametersMap);
+  await parser.executeWithoutErrorHandlingAsync(argv);
+
+  const phasesMap: Map<string, IPhase> = new Map();
+  for (const phase of buildCommand.phases) {
+    phasesMap.set(phase.name, phase);
+  }
+  associateParametersByPhase(customParametersMap, phasesMap);
+
+  const customParameters: Map<string, CommandLineParameter> = new Map();
+  for (const [parameterJson, parameter] of customParametersMap) {
+    customParameters.set(parameterJson.longName, parameter);
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new ShellOperationRunnerPlugin().apply(hooks);
+  const context: Pick<
+    ICreateOperationsContext,
+    'phaseSelection' | 'projectSelection' | 'projectConfigurations' | 'rushConfiguration' | 'customParameters'
+  > = {
+    phaseSelection: buildCommand.phases,
+    projectSelection: new Set(rushConfiguration.projects),
+    projectConfigurations,
+    rushConfiguration,
+    customParameters
+  };
+  return await hooks.createOperationsAsync.promise(new Set(), context as unknown as ICreateOperationsContext);
+}
+
 describe(ShellOperationRunnerPlugin.name, () => {
   it('shellCommand "echo custom shellCommand" should be set to commandToRun', async () => {
     const rushJsonFile: string = path.resolve(__dirname, `../../test/customShellCommandinBulkRepo/rush.json`);
@@ -259,4 +334,303 @@ describe(ShellOperationRunnerPlugin.name, () => {
     // All projects snapshot
     expect(Array.from(operations, serializeOperation)).toMatchSnapshot();
   });
+
+  it('I2: quotes the parameter values that the shell would parse', async () => {
+    const operations: Set<Operation> = await createParameterIgnoringRepoOperationsAsync([
+      'build',
+      '--production',
+      '--verbose',
+      '--config',
+      'cfg dir/a|b.json',
+      '--mode',
+      'prod',
+      '--tags',
+      '$HOME',
+      '--tags',
+      'x(y'
+    ]);
+
+    expect(Array.from(operations, serializeOperation)).toEqual([
+      {
+        name: 'a',
+        commandToRun: IS_WINDOWS
+          ? 'echo building a --verbose --config "cfg dir/a|b.json" --mode prod --tags $HOME --tags "x(y"'
+          : "echo building a --verbose --config 'cfg dir/a|b.json' --mode prod --tags '$HOME' --tags 'x(y'"
+      },
+      {
+        name: 'b',
+        commandToRun: 'echo building b --production'
+      }
+    ]);
+  });
+
+  it.each([
+    [false, ['node build.js', 'node build.js']],
+    [true, ['node build.js', 'node build.js --incremental']]
+  ])(
+    'runs the :incremental script for a repeated operation only in watch mode (isWatch: %s)',
+    async (isWatch: boolean, expectedCommands: string[]) => {
+      const phase: IPhase = {
+        name: '_phase:build',
+        isSynthetic: false,
+        missingScriptBehavior: 'error',
+        allowWarningsOnSuccess: false,
+        associatedParameters: new Set()
+      } as unknown as IPhase;
+      const project: RushConfigurationProject = {
+        packageName: 'a',
+        projectFolder: process.cwd(),
+        packageJson: {
+          scripts: {
+            '_phase:build': 'node build.js',
+            '_phase:build:incremental': 'node build.js --incremental'
+          }
+        },
+        rushConfiguration: { commonTempFolder: process.cwd() }
+      } as unknown as RushConfigurationProject;
+      const operation: Operation = new Operation({ phase, project, logFilenameIdentifier: 'a' });
+      const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+      new ShellOperationRunnerPlugin().apply(hooks);
+      await hooks.createOperationsAsync.promise(new Set([operation]), {
+        isIncrementalBuildAllowed: true,
+        isWatch
+      } as unknown as ICreateOperationsContext);
+
+      const commands: string[] = [];
+      const executeSpy = jest
+        .spyOn(Utilities, 'executeLifecycleCommandAsync')
+        .mockImplementation((command) => {
+          commands.push(command.trim());
+          const stdout: PassThrough = new PassThrough();
+          const stderr: PassThrough = new PassThrough();
+          const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+            stdout,
+            stderr,
+            stdio: []
+          }) as unknown as childProcess.ChildProcess;
+          queueMicrotask(() => {
+            stdout.end();
+            stderr.end();
+            child.emit('close', 0, null);
+          });
+          return child;
+        });
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const context: IOperationRunnerContext = {
+        environment: undefined,
+        async runWithTerminalAsync<T>(
+          callback: (
+            terminal: ITerminal,
+            operationTerminalProvider: ITerminalProvider,
+            structuredChildOutputTerminalProvider: ITerminalProvider
+          ) => Promise<T>
+        ): Promise<T> {
+          return await callback(new Terminal(terminalProvider), terminalProvider, terminalProvider);
+        }
+      } as unknown as IOperationRunnerContext;
+      try {
+        await expect(operation.runner!.executeAsync(context)).resolves.toBe(OperationStatus.Success);
+        await expect(
+          operation.runner!.executeAsync(context, { status: OperationStatus.Success })
+        ).resolves.toBe(OperationStatus.Success);
+      } finally {
+        executeSpy.mockRestore();
+      }
+      expect(commands).toEqual(expectedCommands);
+    }
+  );
+
+  describe('outside watch mode', () => {
+    async function runTwiceAsync(options: {
+      scripts: Record<string, string>;
+      shellCommand?: string;
+      guarded: boolean;
+    }): Promise<{ commands: string[]; hasIncrementalCommand: boolean | undefined }> {
+      const phase: IPhase = {
+        name: '_phase:build',
+        isSynthetic: false,
+        missingScriptBehavior: 'error',
+        allowWarningsOnSuccess: false,
+        associatedParameters: new Set(),
+        shellCommand: options.shellCommand
+      } as unknown as IPhase;
+      const project: RushConfigurationProject = {
+        packageName: 'a',
+        projectFolder: process.cwd(),
+        packageJson: { scripts: options.scripts },
+        rushConfiguration: { commonTempFolder: process.cwd() }
+      } as unknown as RushConfigurationProject;
+      const operation: Operation = new Operation({ phase, project, logFilenameIdentifier: 'a' });
+      const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+      new ShellOperationRunnerPlugin().apply(hooks);
+      await hooks.createOperationsAsync.promise(new Set([operation]), {
+        isIncrementalBuildAllowed: true,
+        isWatch: false
+      } as unknown as ICreateOperationsContext);
+
+      const commands: string[] = [];
+      const executeSpy = jest
+        .spyOn(Utilities, 'executeLifecycleCommandAsync')
+        .mockImplementation((command) => {
+          commands.push(command.trim());
+          const stdout: PassThrough = new PassThrough();
+          const stderr: PassThrough = new PassThrough();
+          const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+            stdout,
+            stderr,
+            stdio: []
+          }) as unknown as childProcess.ChildProcess;
+          queueMicrotask(() => {
+            stdout.end();
+            stderr.end();
+            child.emit('close', 0, null);
+          });
+          return child;
+        });
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const context: IOperationRunnerContext = {
+        environment: undefined,
+        async runWithTerminalAsync<T>(
+          callback: (
+            terminal: ITerminal,
+            operationTerminalProvider: ITerminalProvider,
+            structuredChildOutputTerminalProvider: ITerminalProvider
+          ) => Promise<T>
+        ): Promise<T> {
+          return await callback(new Terminal(terminalProvider), terminalProvider, terminalProvider);
+        }
+      } as unknown as IOperationRunnerContext;
+      if (options.guarded) {
+        setIncrementalExecutionGuard(context, {
+          getBlockReasonAsync: async () => undefined,
+          verifyIncrementalResultAsync: async () => undefined
+        });
+      }
+      try {
+        await expect(operation.runner!.executeAsync(context)).resolves.toBe(OperationStatus.Success);
+        await expect(
+          operation.runner!.executeAsync(context, { status: OperationStatus.Success })
+        ).resolves.toBe(OperationStatus.Success);
+      } finally {
+        executeSpy.mockRestore();
+      }
+      return { commands, hasIncrementalCommand: getCommandExecution(context)?.hasIncrementalCommand };
+    }
+
+    it('runs the :incremental script for a repeated operation when its guard allows it', async () => {
+      const { commands, hasIncrementalCommand } = await runTwiceAsync({
+        scripts: {
+          '_phase:build': 'node build.js',
+          '_phase:build:incremental': 'node build.js --incremental'
+        },
+        guarded: true
+      });
+      expect(commands).toEqual(['node build.js', 'node build.js --incremental']);
+      expect(hasIncrementalCommand).toBe(true);
+    });
+
+    it('does not treat an :incremental script that equals the initial script as an incremental command', async () => {
+      const { commands, hasIncrementalCommand } = await runTwiceAsync({
+        scripts: {
+          '_phase:build': 'node build.js',
+          '_phase:build:incremental': 'node build.js'
+        },
+        guarded: true
+      });
+      expect(commands).toEqual(['node build.js', 'node build.js']);
+      expect(hasIncrementalCommand).toBe(false);
+    });
+
+    it('does not use the :incremental script of an operation with a shellCommand', async () => {
+      const { commands, hasIncrementalCommand } = await runTwiceAsync({
+        scripts: {
+          '_phase:build': 'node build.js',
+          '_phase:build:incremental': 'node build.js --incremental'
+        },
+        shellCommand: 'node custom.js',
+        guarded: true
+      });
+      expect(commands).toEqual(['node custom.js', 'node custom.js']);
+      expect(hasIncrementalCommand).toBe(false);
+    });
+  });
+});
+
+describe(formatCommand.name, () => {
+  const bValues: string[] = [
+    '--verbose',
+    '--config',
+    '/path/to/config.json',
+    '--mode',
+    'prod',
+    '--tags',
+    'tag1',
+    '--tags',
+    'tag2'
+  ];
+
+  it('F1: quotes a value for sh', () => {
+    expect(formatCommand('heft test', ['--test-path-pattern', 'bump|x'], [], false)).toEqual(
+      "heft test --test-path-pattern 'bump|x'"
+    );
+  });
+
+  it('F2: quotes a value for cmd.exe', () => {
+    expect(formatCommand('heft test', ['--test-path-pattern', 'bump|x'], [], true)).toEqual(
+      'heft test --test-path-pattern "bump|x"'
+    );
+  });
+
+  it.each([false, true])(
+    'F3: leaves values that need no quoting as they were (isWindows: %s)',
+    (isWindows: boolean) => {
+      expect(formatCommand('echo building a', bValues, [], isWindows)).toEqual(
+        `echo building a ${bValues.join(' ')}`
+      );
+    }
+  );
+
+  it.each([false, true])(
+    'F4: keeps the trailing space when there are no values (isWindows: %s)',
+    (isWindows: boolean) => {
+      expect(formatCommand('echo custom shellCommand', [], [], isWindows)).toEqual(
+        'echo custom shellCommand '
+      );
+    }
+  );
+
+  it('F5: appends the preformatted arguments after the quoted values', () => {
+    expect(
+      formatCommand(
+        'heft test',
+        ['--p', 'a b'],
+        ['--shard=1/3', '--shard-output-directory=.rush/operations/x/shards/1'],
+        false
+      )
+    ).toEqual("heft test --p 'a b' --shard=1/3 --shard-output-directory=.rush/operations/x/shards/1");
+  });
+
+  it('F6: does not quote the preformatted arguments', () => {
+    expect(
+      formatCommand(
+        'heft test',
+        ['--p', 'x'],
+        ['--shard-parent-folder=".rush/operations/x/shards/"', '--shard-count="3"'],
+        false
+      )
+    ).toEqual('heft test --p x --shard-parent-folder=".rush/operations/x/shards/" --shard-count="3"');
+  });
+
+  it("F7: still converts the slashes of the command's first token on Windows", () => {
+    expect(formatCommand('node_modules/.bin/heft test', ['--p', 'a b'], [], true)).toEqual(
+      'node_modules\\.bin\\heft test --p "a b"'
+    );
+  });
+
+  it.each([false, true])(
+    'F8: returns an empty string for an empty command (isWindows: %s)',
+    (isWindows: boolean) => {
+      expect(formatCommand('', ['--p', 'x'], [], isWindows)).toEqual('');
+    }
+  );
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts
index e5877cb9a19..b59fb31037e 100644
--- a/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts
@@ -85,6 +85,7 @@ describe(TrimRushEnvironmentVariablesPlugin.name, () => {
       RUSH_TEMP_FOLDER: 'some-temp-folder',
       rush_someMixedCaseVar: 'should also be trimmed',
       RUSHSTACK_FILE_ERROR_BASE_FOLDER: 'should be preserved',
+      RUSHD_OPERATION_GROUPS: 'should be preserved',
       PATH: process.env.PATH,
       SOME_OTHER_VAR: 'should be preserved'
     };
@@ -94,6 +95,7 @@ describe(TrimRushEnvironmentVariablesPlugin.name, () => {
     expect(env.RUSH_TEMP_FOLDER).toBeUndefined();
     expect(env.rush_someMixedCaseVar).toBeUndefined();
     expect(env.RUSHSTACK_FILE_ERROR_BASE_FOLDER).toBe('should be preserved');
+    expect(env.RUSHD_OPERATION_GROUPS).toBe('should be preserved');
     expect(env.SOME_OTHER_VAR).toBe('should be preserved');
   });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts b/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
new file mode 100644
index 00000000000..ecdb2aae229
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
@@ -0,0 +1,1019 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { MockWritable } = jest.requireActual('@rushstack/terminal');
+  return { ...actual, initializeProjectLogFilesAsync: jest.fn(async () => new MockWritable()) };
+});
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { EventEmitter, once } from 'node:events';
+import { performance } from 'node:perf_hooks';
+import { PassThrough } from 'node:stream';
+
+import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IOperationSettings } from '../../../api/RushProjectConfiguration';
+import {
+  PhasedCommandHooks,
+  type ICreateOperationsContext,
+  type IOperationGraphContext
+} from '../../../pluginFramework/PhasedCommandHooks';
+import { Utilities, type IEnvironment, type ILifecycleCommandOptions } from '../../../utilities/Utilities';
+import { DaemonWarmWorkerPlugin } from '../DaemonWarmWorkerPlugin';
+import {
+  getCommandExecution,
+  isBuildCacheReadSkipped,
+  setIncrementalExecutionGuard,
+  type IIncrementalExecutionGuard,
+  type IIncrementalExecutionGuardOptions
+} from '../IncrementalExecutionState';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import { NullOperationRunner } from '../NullOperationRunner';
+import { Operation } from '../Operation';
+import { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
+import {
+  WarmWorker,
+  WarmWorkerOperationRunner,
+  type IWarmWorkerOperationRunnerOptions
+} from '../WarmWorkerOperationRunner';
+
+const INITIAL_COMMAND: string = 'node build.js';
+const INITIAL_IPC_COMMAND: string = 'node build.js --watch --clean';
+const INCREMENTAL_IPC_COMMAND: string = 'node build.js --watch';
+const EXIT_TIMEOUT_MS: number = 10000;
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+
+type WorkerBehavior = 'crash' | 'fail' | 'fail-reused' | 'hang' | 'grow' | 'request';
+
+// Like `heft run-watch` with IPC: it sends "sync" when it starts, and answers each "run" with "after-execute". It
+// prints the number of each run, and answers 20 ms later, so that the line arrives first. Its behavior:
+// - crash: it exits when it receives a run;
+// - fail: it prints an error and reports that each run failed, like a build with a compiler error;
+// - fail-reused: like fail, but only from its second run on, like a worker that kept an error from an earlier run;
+// - hang: it never answers a run;
+// - grow: it reports 100 MB more resident memory after each run, instead of 100 MB;
+// - request: it reports a change 50 ms after each run, like its file watcher would.
+const WORKER_SCRIPT: string = `
+  const behavior = process.env.WARM_WORKER_TEST_BEHAVIOR;
+  let runs = 0;
+  process.on('message', (message) => {
+    if (message.command === 'exit') {
+      process.exit(0);
+    } else if (message.command === 'run') {
+      runs++;
+      if (behavior === 'crash') {
+        process.exit(3);
+      }
+      console.log('worker run ' + runs);
+      if (behavior === 'hang') {
+        return;
+      }
+      const fails = behavior === 'fail' || (behavior === 'fail-reused' && runs > 1);
+      if (fails) {
+        console.error('worker error ' + runs);
+      }
+      setTimeout(() => {
+        const residentMemoryBytes = 100000000 * (behavior === 'grow' ? runs : 1);
+        const status = fails ? 'FAILURE' : 'SUCCESS';
+        process.send({ event: 'after-execute', status, residentMemoryBytes });
+        if (behavior === 'request') {
+          setTimeout(() => process.send({ event: 'requestRun', requestor: 'watcher' }), 50);
+        }
+      }, 20);
+    }
+  });
+  process.send({ event: 'sync' });
+`;
+
+const phase: IPhase = {
+  name: '_phase:build',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: '_phase_build',
+  missingScriptBehavior: 'silent'
+};
+
+function createProject(
+  packageName: string,
+  scripts: Record<string, string> | undefined
+): RushConfigurationProject {
+  return {
+    packageName,
+    projectFolder: __dirname,
+    packageJson: { name: packageName, version: '1.0.0', scripts },
+    rushConfiguration: { commonTempFolder: __dirname }
+  } as unknown as RushConfigurationProject;
+}
+
+interface ITestIteration {
+  readonly result: IExecutionResult;
+  readonly record: IOperationExecutionResult;
+  readonly output: string;
+  /**
+   * The commands that started a process in this iteration, in order.
+   */
+  readonly commands: ReadonlyArray<string>;
+  /**
+   * The environment of each process in `commands`, merged from the options as Utilities merges it.
+   */
+  readonly environments: ReadonlyArray<IEnvironment>;
+}
+
+interface ITestHarness {
+  readonly runner: WarmWorkerOperationRunner;
+  readonly graph: OperationGraph;
+  /**
+   * The guard of the next iterations, or undefined for none.
+   */
+  guard: IIncrementalExecutionGuard | undefined;
+  /**
+   * The options that the runner passed to the guard, in order.
+   */
+  readonly guardOptions: IIncrementalExecutionGuardOptions[];
+  blockReason: string | undefined;
+  rerunReason: string | undefined;
+  /**
+   * The behavior of the workers that start from now on.
+   */
+  workerBehavior: WorkerBehavior | undefined;
+  /**
+   * The exit code of the initial commands that run in a shell from now on.
+   */
+  initialExitCode: number;
+  shouldRunnerPersist: boolean;
+  /**
+   * The status that a tap at the default stage of `beforeExecuteOperationAsync` returns, e.g. `FromCache` for a
+   * build cache hit, so that the runner does not execute.
+   */
+  earlyReturnStatus: OperationStatus | undefined;
+  /**
+   * For each iteration, whether the build cache read was skipped when a tap at the default stage of
+   * `beforeExecuteOperationAsync`, like `CacheableOperationPlugin`'s, ran.
+   */
+  readonly isReadSkippedAtCacheStage: boolean[];
+  executeAsync(): Promise<ITestIteration>;
+  /**
+   * Resolves when a worker printed the number of its next run.
+   */
+  waitForWorkerRunAsync(): Promise<void>;
+}
+
+const children: ChildProcess[] = [];
+const graphs: OperationGraph[] = [];
+
+beforeEach(() => {
+  // Each test process is its own process tree.
+  jest.spyOn(SubprocessTerminator, 'killProcessTree').mockImplementation((child: ChildProcess) => {
+    child.kill('SIGTERM');
+  });
+});
+
+afterEach(async () => {
+  for (const graph of graphs.splice(0)) {
+    await graph.closeRunnersAsync();
+    graph.abortController.abort();
+  }
+  for (const child of children.splice(0)) {
+    if (child.exitCode === null && child.signalCode === null) {
+      const closed: Promise<unknown> = once(child, 'close');
+      child.kill();
+      await closed;
+    }
+  }
+  jest.mocked(Utilities.executeLifecycleCommandAsync).mockReset();
+  jest.restoreAllMocks();
+});
+
+async function createHarnessAsync(
+  options: Partial<IWarmWorkerOperationRunnerOptions> = {},
+  otherOperations: Operation[] = []
+): Promise<ITestHarness> {
+  const project: RushConfigurationProject = createProject('a', undefined);
+  const runner: WarmWorkerOperationRunner = new WarmWorkerOperationRunner({
+    phase,
+    rushProject: project,
+    displayName: 'a',
+    initialCommand: INITIAL_COMMAND,
+    initialIpcCommand: undefined,
+    incrementalIpcCommand: INCREMENTAL_IPC_COMMAND,
+    commandForHash: INITIAL_COMMAND,
+    ignoredParameterValues: [],
+    // Only the test of this wait waits.
+    changeReportTimeoutMs: 0,
+    ...options
+  });
+  const operation: Operation = new Operation({ phase, project, runner, logFilenameIdentifier: 'a' });
+  const destination: MockWritable = new MockWritable();
+  const graph: OperationGraph = new OperationGraph(new Set([operation, ...otherOperations]), {
+    quietMode: false,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [destination],
+    abortController: new AbortController(),
+    // Like the graphs of the Rush daemon
+    supportsTerminateRunning: true
+  });
+  graphs.push(graph);
+
+  const commands: string[] = [];
+  const environments: IEnvironment[] = [];
+  const runWaiters: (() => void)[] = [];
+  const harness: ITestHarness = {
+    runner,
+    graph,
+    guard: undefined,
+    guardOptions: [],
+    blockReason: undefined,
+    rerunReason: undefined,
+    workerBehavior: undefined,
+    initialExitCode: 0,
+    shouldRunnerPersist: true,
+    earlyReturnStatus: undefined,
+    isReadSkippedAtCacheStage: [],
+    executeAsync: async (): Promise<ITestIteration> => {
+      commands.length = 0;
+      environments.length = 0;
+      destination.reset();
+      const result: IExecutionResult = await graph.executeAsync({});
+      return {
+        result,
+        record: result.operationResults.get(operation)!,
+        output: destination.getAllOutput(),
+        commands: [...commands],
+        environments: [...environments]
+      };
+    },
+    waitForWorkerRunAsync: () => new Promise<void>((resolve: () => void) => runWaiters.push(resolve))
+  };
+  harness.guard = {
+    getBlockReasonAsync: async (guardOptions?: IIncrementalExecutionGuardOptions) => {
+      harness.guardOptions.push({ ...guardOptions });
+      return harness.blockReason;
+    },
+    verifyIncrementalResultAsync: async (guardOptions?: IIncrementalExecutionGuardOptions) => {
+      harness.guardOptions.push({ ...guardOptions });
+      return harness.rerunReason;
+    }
+  };
+
+  jest
+    .mocked(Utilities.executeLifecycleCommandAsync)
+    .mockImplementation((command: string, lifecycleOptions: ILifecycleCommandOptions) => {
+      const { ipc, initialEnvironment, additionalEnvironment } = lifecycleOptions;
+      commands.push(command);
+      environments.push({ ...(initialEnvironment ?? process.env), ...additionalEnvironment });
+      let child: ChildProcess;
+      if (ipc) {
+        child = spawn(process.execPath, ['-e', WORKER_SCRIPT], {
+          stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+          env: { ...process.env, WARM_WORKER_TEST_BEHAVIOR: harness.workerBehavior ?? '' }
+        });
+        child.stdout!.on('data', (data: Buffer) => {
+          if (data.toString().includes('worker run')) {
+            for (const resolve of runWaiters.splice(0)) {
+              resolve();
+            }
+          }
+        });
+      } else {
+        child = spawn(
+          process.execPath,
+          ['-e', `console.log("one-shot"); process.exitCode = ${harness.initialExitCode};`],
+          {
+            stdio: ['ignore', 'pipe', 'pipe']
+          }
+        );
+      }
+      children.push(child);
+      return child;
+    });
+
+  // Like IncrementalExecutionGuardPlugin, which registers a guard for each record of an iteration.
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    'test',
+    (records: ReadonlyMap<Operation, IOperationExecutionResult>): void => {
+      for (const record of records.values()) {
+        if (harness.guard) {
+          setIncrementalExecutionGuard(record, harness.guard);
+        }
+        (record as OperationExecutionRecord).shouldRunnerPersist = harness.shouldRunnerPersist;
+      }
+    }
+  );
+  // Registered before the plugin's tap, so that only the stages order them.
+  graph.hooks.beforeExecuteOperationAsync.tapPromise(
+    'test',
+    async (record: IOperationExecutionResult): Promise<OperationStatus | undefined> => {
+      harness.isReadSkippedAtCacheStage.push(isBuildCacheReadSkipped(record));
+      return harness.earlyReturnStatus;
+    }
+  );
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new DaemonWarmWorkerPlugin().apply(hooks);
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    isWatch: false
+  } as unknown as IOperationGraphContext);
+  return harness;
+}
+
+/**
+ * The `TSC_WATCHFILE` variable of each process that started in the iteration, in order.
+ */
+function getTypeScriptWatchFiles(iteration: ITestIteration): (string | undefined)[] {
+  return iteration.environments.map((environment: IEnvironment) => environment.TSC_WATCHFILE);
+}
+
+function expectLinesInOrder(output: string, lines: ReadonlyArray<string>): void {
+  let index: number = -1;
+  for (const line of lines) {
+    const next: number = output.indexOf(line, index + 1);
+    if (next < 0) {
+      throw new Error(`Expected ${JSON.stringify(line)} after offset ${index} in:\n${output}`);
+    }
+    index = next;
+  }
+}
+
+describe(WarmWorkerOperationRunner.name, () => {
+  async function closeWorkerWhoseProcessEndedAsync(
+    exitCode: number | null,
+    signalCode: NodeJS.Signals | null
+  ): Promise<void> {
+    jest.useFakeTimers();
+    const pid: number = 1234567;
+    const child: ChildProcess = Object.assign(new EventEmitter(), {
+      connected: false,
+      exitCode,
+      killed: false,
+      pid,
+      send: jest.fn(),
+      signalCode,
+      stdio: [null, new PassThrough(), new PassThrough(), null]
+    }) as unknown as ChildProcess;
+    const killSpy: jest.SpiedFunction<typeof process.kill> = jest.spyOn(process, 'kill').mockImplementation(((
+      target: number | string,
+      signal?: NodeJS.Signals | number
+    ): true => {
+      expect([target, signal]).toEqual([-pid, 'SIGKILL']);
+      process.nextTick(() => child.emit('close'));
+      return true;
+    }) as typeof process.kill);
+
+    try {
+      const worker: WarmWorker = new WarmWorker(child, 'node worker.js');
+      const closePromise: Promise<void> = worker.closeAsync();
+      jest.advanceTimersByTime(EXIT_TIMEOUT_MS);
+      await closePromise;
+      expect(killSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      killSpy.mockRestore();
+      jest.useRealTimers();
+    }
+  }
+
+  posixIt('closes a worker whose process exited before its streams', async () => {
+    await closeWorkerWhoseProcessEndedAsync(0, null);
+  });
+
+  posixIt('closes a worker whose process a signal killed before its streams', async () => {
+    await closeWorkerWhoseProcessEndedAsync(null, 'SIGKILL');
+  });
+
+  it('runs the initial command first, then starts a worker for an allowed incremental run, and sends it the next one', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+
+    // As for ShellOperationRunner, the first run is the initial command in a shell, and the guard is not asked.
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.result.status).toBe(OperationStatus.Success);
+    expect(first.commands).toEqual([INITIAL_COMMAND]);
+    expect(first.output).toContain(`Invoking (initial): ${INITIAL_COMMAND}`);
+    expect(first.output).not.toContain('warm worker');
+    expect(getCommandExecution(first.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.guardOptions).toEqual([]);
+    expect(harness.runner.isActive).toBe(false);
+
+    const second: ITestIteration = await harness.executeAsync();
+    expect(second.result.status).toBe(OperationStatus.Success);
+    expect(second.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expectLinesInOrder(second.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1'
+    ]);
+    expect(getCommandExecution(second.record)).toEqual({
+      kind: 'incremental',
+      hasIncrementalCommand: true,
+      watchesInputs: true
+    });
+    expect(harness.runner.isActive).toBe(true);
+    const pid: number = harness.runner.workerPid!;
+
+    const third: ITestIteration = await harness.executeAsync();
+    expect(third.result.status).toBe(OperationStatus.Success);
+    expect(third.commands).toEqual([]);
+    expectLinesInOrder(third.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      `Sending run 2 to the warm worker (pid ${pid}).`,
+      'worker run 2'
+    ]);
+    expect(third.output).not.toContain('Starting a warm worker');
+    expect(getCommandExecution(third.record)).toEqual({
+      kind: 'incremental',
+      hasIncrementalCommand: true,
+      watchesInputs: true
+    });
+    expect(harness.runner.workerPid).toBe(pid);
+    expect(harness.runner.residentMemoryBytes).toBe(100000000);
+
+    // The build cache may restore an operation without a worker, but a restore would not update what a running
+    // worker keeps in memory.
+    expect(harness.isReadSkippedAtCacheStage).toEqual([false, false, true]);
+    // Each allowed run asks the guard twice: before it runs and after it succeeded.
+    expect(harness.guardOptions).toEqual(new Array(4).fill({ outputsMayBeBundles: true }));
+
+    const worker: ChildProcess = children[1];
+    await harness.graph.closeRunnersAsync();
+    expect(harness.runner.isActive).toBe(false);
+    expect(worker.exitCode).toBe(0);
+  });
+
+  it('starts each worker with a TypeScript file watcher that sees replaced files', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    harness.graph.hooks.createEnvironmentForOperation.tap('test', (environment: IEnvironment) => {
+      delete environment.TSC_WATCHFILE;
+      return environment;
+    });
+
+    // The initial command in a shell does not watch files, and keeps the environment of the operation.
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.commands).toEqual([INITIAL_COMMAND]);
+    expect(getTypeScriptWatchFiles(first)).toEqual([undefined]);
+
+    const second: ITestIteration = await harness.executeAsync();
+    expect(second.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(getTypeScriptWatchFiles(second)).toEqual(['UseFsEventsOnParentDirectory']);
+  });
+
+  it('keeps the TypeScript file watcher that the environment of the operation chooses', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ initialIpcCommand: INITIAL_IPC_COMMAND });
+    harness.graph.hooks.createEnvironmentForOperation.tap('test', (environment: IEnvironment) => {
+      environment.TSC_WATCHFILE = 'PriorityPollingInterval';
+      return environment;
+    });
+
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.commands).toEqual([INITIAL_IPC_COMMAND]);
+    expect(getTypeScriptWatchFiles(first)).toEqual(['PriorityPollingInterval']);
+  });
+
+  it('closes the worker before the initial command if the guard does not allow an incremental run', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    harness.blockReason = 'its command line changed';
+    const blocked: ITestIteration = await harness.executeAsync();
+    expect(blocked.result.status).toBe(OperationStatus.Success);
+    expect(blocked.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(blocked.output, [
+      'Not using the incremental command because its command line changed.',
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    // It exited before the build cache could restore the operation.
+    expect(worker.exitCode).toBe(0);
+    expect(harness.isReadSkippedAtCacheStage[2]).toBe(false);
+    expect(getCommandExecution(blocked.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.runner.isActive).toBe(false);
+
+    harness.blockReason = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).toContain('Starting a warm worker for it.');
+  });
+
+  it('writes why it closed the worker if the build cache restores the operation', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    harness.blockReason = 'its command line changed';
+    harness.earlyReturnStatus = OperationStatus.FromCache;
+    const restored: ITestIteration = await harness.executeAsync();
+    expect(restored.record.status).toBe(OperationStatus.FromCache);
+    expect(restored.commands).toEqual([]);
+    expectLinesInOrder(restored.output, [
+      'Not using the incremental command because its command line changed.',
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`
+    ]);
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+
+    // If the runner executes, its notes are written once.
+    harness.earlyReturnStatus = undefined;
+    const blocked: ITestIteration = await harness.executeAsync();
+    expect(blocked.commands).toEqual([INITIAL_COMMAND]);
+    expect(blocked.output.split('Not using the incremental command because').length).toBe(2);
+  });
+
+  it('closes the worker before the initial command if the operation has no guard, e.g. in a rebuild', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    harness.guard = undefined;
+    const rebuilt: ITestIteration = await harness.executeAsync();
+    expect(rebuilt.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(rebuilt.output, [
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(rebuilt.output).not.toContain('Not using the incremental command');
+    expect(worker.exitCode).toBe(0);
+  });
+
+  it('closes the worker before the initial command if the operation has no last state, even if it has a guard', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    // Like a graph whose iteration allows no incremental build: it keeps the results, but passes no last state.
+    const { executeAsync } = OperationExecutionRecord.prototype;
+    jest.spyOn(OperationExecutionRecord.prototype, 'executeAsync').mockImplementation(function (
+      this: OperationExecutionRecord,
+      lastState: OperationExecutionRecord | undefined,
+      executeContext: Parameters<OperationExecutionRecord['executeAsync']>[1]
+    ): Promise<void> {
+      return executeAsync.call(this, undefined, executeContext);
+    });
+    const rebuilt: ITestIteration = await harness.executeAsync();
+    expect(rebuilt.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(rebuilt.output, [
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(rebuilt.output).not.toContain('Not using the incremental command');
+    expect(getCommandExecution(rebuilt.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(worker.exitCode).toBe(0);
+  });
+
+  it('writes that a worker was closed between builds, e.g. by the warm set of the Rush daemon, once', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    // Like the warm set of the Rush daemon, which closes the runners of a project and drops its results.
+    const operations: Operation[] = [...harness.graph.operations];
+    await harness.graph.closeRunnersAsync(operations);
+    harness.graph.deleteResults(operations);
+    expect(worker.exitCode).toBe(0);
+
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(next.output, [
+      `The warm worker (pid ${worker.pid}) was closed after the operation last ran.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+
+    // Closing a runner without a worker writes nothing.
+    await harness.runner.closeAsync();
+    const again: ITestIteration = await harness.executeAsync();
+    expect(again.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(again.output).not.toContain('was closed after the operation last ran');
+  });
+
+  it('writes that a worker was closed between builds if the build cache restores the operation, once', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    await harness.runner.closeAsync();
+    harness.earlyReturnStatus = OperationStatus.FromCache;
+    const restored: ITestIteration = await harness.executeAsync();
+    expect(restored.record.status).toBe(OperationStatus.FromCache);
+    expect(restored.output).toContain(
+      `The warm worker (pid ${worker.pid}) was closed after the operation last ran.`
+    );
+
+    harness.earlyReturnStatus = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).not.toContain('was closed after the operation last ran');
+  });
+
+  it('runs the initial command after an incremental run whose outputs the guard does not accept', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+
+    harness.rerunReason =
+      'the incremental command changed which output files it has: 1 added ("lib/chunk.js")';
+    const rerun: ITestIteration = await harness.executeAsync();
+    expect(rerun.result.status).toBe(OperationStatus.Success);
+    expect(rerun.commands).toEqual([INCREMENTAL_IPC_COMMAND, INITIAL_COMMAND]);
+    expectLinesInOrder(rerun.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1',
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").',
+      `Closing the warm worker (pid ${children[1].pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(getCommandExecution(rerun.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('runs the initial command after a failed run on a reused worker, and reports the status of the initial command', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    // E.g. a worker whose module resolution kept an error from an earlier run.
+    harness.workerBehavior = 'fail-reused';
+    expect((await harness.executeAsync()).result.status).toBe(OperationStatus.Success);
+    const worker: ChildProcess = children[1];
+    const pid: number = harness.runner.workerPid!;
+
+    const recovered: ITestIteration = await harness.executeAsync();
+    expect(recovered.result.status).toBe(OperationStatus.Success);
+    expect(recovered.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(recovered.output, [
+      `Sending run 2 to the warm worker (pid ${pid}).`,
+      'worker error 2',
+      'Running the initial command, because the run on the warm worker failed.',
+      `Closing the warm worker (pid ${pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`,
+      'one-shot'
+    ]);
+    expect(recovered.record.error).toBeUndefined();
+    expect(getCommandExecution(recovered.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+
+    // A genuine error fails the initial command too.
+    expect((await harness.executeAsync()).output).toContain('Starting a warm worker for it.');
+    harness.initialExitCode = 2;
+    const failed: ITestIteration = await harness.executeAsync();
+    expect(failed.result.status).toBe(OperationStatus.Failure);
+    expect(failed.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(failed.output, [
+      'worker error 2',
+      'Running the initial command, because the run on the warm worker failed.',
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(failed.record.error?.message).toContain('Returned error code: 2');
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('reports a failed first run of a new worker as it stands, and closes the worker', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.workerBehavior = 'fail';
+    const failed: ITestIteration = await harness.executeAsync();
+    expect(failed.result.status).toBe(OperationStatus.Failure);
+    expect(failed.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    const worker: ChildProcess = children[1];
+    expectLinesInOrder(failed.output, [
+      'Starting a warm worker for it.',
+      'worker error 1',
+      `Closing the warm worker (pid ${worker.pid}), because the operation failed, so its next build runs the initial command.`
+    ]);
+    expect(failed.output).not.toContain('Running the initial command');
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('closes a worker whose initial run failed', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ initialIpcCommand: INITIAL_IPC_COMMAND });
+    harness.workerBehavior = 'fail';
+    const failed: ITestIteration = await harness.executeAsync();
+    expect(failed.result.status).toBe(OperationStatus.Failure);
+    expect(failed.commands).toEqual([INITIAL_IPC_COMMAND]);
+    const worker: ChildProcess = children[0];
+    expectLinesInOrder(failed.output, [
+      `Invoking (initial): ${INITIAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker error 1',
+      `Closing the warm worker (pid ${worker.pid}), because the operation failed, so its next build runs the initial command.`
+    ]);
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('runs the initial command in a new worker if the project has an ipc script, and reuses that worker', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ initialIpcCommand: INITIAL_IPC_COMMAND });
+
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.result.status).toBe(OperationStatus.Success);
+    expect(first.commands).toEqual([INITIAL_IPC_COMMAND]);
+    expectLinesInOrder(first.output, [
+      `Invoking (initial): ${INITIAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1'
+    ]);
+    expect(getCommandExecution(first.record)).toEqual({
+      kind: 'initial',
+      hasIncrementalCommand: true,
+      watchesInputs: true
+    });
+    const firstPid: number = harness.runner.workerPid!;
+
+    const second: ITestIteration = await harness.executeAsync();
+    expect(second.commands).toEqual([]);
+    expectLinesInOrder(second.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      `Sending run 2 to the warm worker (pid ${firstPid}).`,
+      'worker run 2'
+    ]);
+    expect(harness.isReadSkippedAtCacheStage).toEqual([false, true]);
+
+    // A build from scratch must not run on top of what the worker keeps in memory.
+    harness.blockReason = 'its dependencies changed';
+    const blocked: ITestIteration = await harness.executeAsync();
+    expect(blocked.commands).toEqual([INITIAL_IPC_COMMAND]);
+    expectLinesInOrder(blocked.output, [
+      'Not using the incremental command because its dependencies changed.',
+      `Closing the warm worker (pid ${firstPid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1'
+    ]);
+    expect(harness.runner.workerPid).not.toBe(firstPid);
+  });
+
+  it('closes a worker after its maximum number of runs', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ maxRunsPerWorker: 2 });
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const pid: number = harness.runner.workerPid!;
+
+    const last: ITestIteration = await harness.executeAsync();
+    expectLinesInOrder(last.output, [
+      `Sending run 2 to the warm worker (pid ${pid}).`,
+      'worker run 2',
+      `Closing the warm worker (pid ${pid}), because it has run 2 times.`
+    ]);
+    expect(last.result.status).toBe(OperationStatus.Success);
+    expect(harness.runner.isActive).toBe(false);
+    expect((await harness.executeAsync()).output).toContain('Starting a warm worker for it.');
+  });
+
+  it('closes a worker once its memory grew too much', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ maxMemoryGrowth: 1.5 });
+    harness.workerBehavior = 'grow';
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const pid: number = harness.runner.workerPid!;
+    expect(harness.runner.residentMemoryBytes).toBe(100000000);
+
+    const grown: ITestIteration = await harness.executeAsync();
+    expect(grown.output).toContain(
+      `Closing the warm worker (pid ${pid}), because its memory grew from 95 MB after its first run to 191 MB.`
+    );
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('waits for a reused worker to report a change before it sends the next run, for at most the timeout', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ changeReportTimeoutMs: 500 });
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const unreportedStart: number = performance.now();
+    const unreported: ITestIteration = await harness.executeAsync();
+    expect(performance.now() - unreportedStart).toBeGreaterThanOrEqual(450);
+    expect(unreported.output).toContain('Sending run 2 to the warm worker');
+
+    const reporting: ITestHarness = await createHarnessAsync({ changeReportTimeoutMs: 10000 });
+    reporting.workerBehavior = 'request';
+    await reporting.executeAsync();
+    await reporting.executeAsync();
+    const reportedStart: number = performance.now();
+    const reported: ITestIteration = await reporting.executeAsync();
+    expect(performance.now() - reportedStart).toBeLessThan(2000);
+    expect(reported.output).toContain('Sending run 2 to the warm worker');
+  });
+
+  it('runs the initial command if the worker exits during a run, and starts a new worker for the next one', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.workerBehavior = 'crash';
+    const crashed: ITestIteration = await harness.executeAsync();
+    expect(crashed.result.status).toBe(OperationStatus.Success);
+    expect(crashed.commands).toEqual([INCREMENTAL_IPC_COMMAND, INITIAL_COMMAND]);
+    expectLinesInOrder(crashed.output, [
+      'Starting a warm worker for it.',
+      'The warm worker exited before it reported the result of its run (exit code 3).',
+      'Running the initial command, because the run on the warm worker failed.',
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(crashed.record.error).toBeUndefined();
+    expect(getCommandExecution(crashed.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.runner.isActive).toBe(false);
+
+    harness.workerBehavior = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.result.status).toBe(OperationStatus.Success);
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).toContain('Starting a warm worker for it.');
+  });
+
+  it('terminates the worker if the operation is aborted, and starts a new worker for the next run', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.workerBehavior = 'hang';
+    const running: Promise<void> = harness.waitForWorkerRunAsync();
+    const execution: Promise<ITestIteration> = harness.executeAsync();
+    await running;
+    const worker: ChildProcess = children[1];
+    await harness.graph.abortCurrentIterationAsync({ terminateRunning: true });
+    const aborted: ITestIteration = await execution;
+    expect(aborted.result.status).toBe(OperationStatus.Aborted);
+    // An aborted run is not a failure, so the initial command does not run.
+    expect(aborted.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(aborted.output).toContain('Terminated because the operation was aborted.');
+    expect(worker.signalCode).toBe('SIGTERM');
+    expect(harness.runner.isActive).toBe(false);
+
+    harness.workerBehavior = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.result.status).toBe(OperationStatus.Success);
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).toContain('Starting a warm worker for it.');
+  });
+
+  it('closes the worker after its run if the runner should not persist', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.shouldRunnerPersist = false;
+    const closed: ITestIteration = await harness.executeAsync();
+    expect(closed.result.status).toBe(OperationStatus.Success);
+    expect(closed.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(harness.runner.isActive).toBe(false);
+    expect(children[1].exitCode).toBe(0);
+  });
+
+  it('waits for the worker to exit in each concurrent close', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+    const exitCodes: (number | null)[] = [];
+    await Promise.all(
+      [harness.runner.closeAsync(), harness.runner.closeAsync()].map(async (promise: Promise<void>) => {
+        await promise;
+        exitCodes.push(worker.exitCode);
+      })
+    );
+    expect(exitCodes).toEqual([0, 0]);
+    await harness.runner.closeAsync();
+  });
+});
+
+describe(DaemonWarmWorkerPlugin.name, () => {
+  it('creates warm worker runners only for opted-in operations with an incremental ipc script and no other runner', async () => {
+    const scripts: Record<string, string> = {
+      '_phase:build': 'heft run --only build -- --clean',
+      '_phase:build:incremental:ipc': 'heft run-watch --only build --'
+    };
+    const optedIn: IOperationSettings = { operationName: phase.name, allowDaemonWarmWorker: true };
+    const createOperation = (
+      name: string,
+      projectScripts: Record<string, string> | undefined,
+      runner?: NullOperationRunner,
+      settings: IOperationSettings | false = optedIn
+    ): Operation =>
+      new Operation({
+        phase,
+        project: createProject(name, projectScripts),
+        runner,
+        settings: settings || undefined,
+        logFilenameIdentifier: name
+      });
+    const warm: Operation = createOperation('warm', scripts);
+    const warmWithIpc: Operation = createOperation('warm-with-ipc', {
+      ...scripts,
+      '_phase:build:ipc': 'heft run-watch --only build -- --clean'
+    });
+    // `rush start` runs the same script in watch mode, so the script alone does not opt in.
+    const withoutSettings: Operation = createOperation('without-settings', scripts, undefined, false);
+    const withoutField: Operation = createOperation('without-field', scripts, undefined, {
+      operationName: phase.name
+    });
+    const optedOut: Operation = createOperation('opted-out', scripts, undefined, {
+      operationName: phase.name,
+      allowDaemonWarmWorker: false
+    });
+    const withoutIpcScript: Operation = createOperation('without-ipc-script', {
+      '_phase:build': scripts['_phase:build']
+    });
+    const withoutScript: Operation = createOperation('without-script', {
+      '_phase:build:incremental:ipc': scripts['_phase:build:incremental:ipc']
+    });
+    const existingRunner: NullOperationRunner = new NullOperationRunner({
+      name: 'existing',
+      result: OperationStatus.NoOp,
+      silent: true
+    });
+    const withRunner: Operation = createOperation('with-runner', scripts, existingRunner);
+
+    // Like PhasedScriptAction, which applies the plugin after ShellOperationRunnerPlugin.
+    const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+    new ShellOperationRunnerPlugin().apply(hooks);
+    new DaemonWarmWorkerPlugin().apply(hooks);
+    const context: ICreateOperationsContext = {
+      isIncrementalBuildAllowed: true,
+      isWatch: false
+    } as unknown as ICreateOperationsContext;
+    await hooks.createOperationsAsync.promise(
+      new Set([
+        warm,
+        warmWithIpc,
+        withoutSettings,
+        withoutField,
+        optedOut,
+        withoutIpcScript,
+        withoutScript,
+        withRunner
+      ]),
+      context
+    );
+
+    expect(warm.runner).toBeInstanceOf(WarmWorkerOperationRunner);
+    expect(warmWithIpc.runner).toBeInstanceOf(WarmWorkerOperationRunner);
+    expect(withoutSettings.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(withoutField.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(optedOut.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(withoutIpcScript.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(withoutScript.runner).toBeInstanceOf(NullOperationRunner);
+    expect(withRunner.runner).toBe(existingRunner);
+
+    // Its build cache entries are those of ShellOperationRunner.
+    const shellHooks: PhasedCommandHooks = new PhasedCommandHooks();
+    new ShellOperationRunnerPlugin().apply(shellHooks);
+    const shellTwin: Operation = createOperation('shell-twin', scripts);
+    await shellHooks.createOperationsAsync.promise(new Set([shellTwin]), context);
+    expect(shellTwin.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(warm.runner!.getConfigHash()).toBe(shellTwin.runner!.getConfigHash());
+
+    // Watch mode has its own IPC runners, and a command that allows no incremental run does not need workers.
+    for (const otherContext of [
+      { ...context, isWatch: true },
+      { ...context, isIncrementalBuildAllowed: false }
+    ]) {
+      const operation: Operation = createOperation('other', scripts);
+      await hooks.createOperationsAsync.promise(new Set([operation]), otherContext);
+      expect(operation.runner).toBeInstanceOf(ShellOperationRunner);
+    }
+  });
+
+  it('does not prepare the worker of an operation that an iteration does not run', async () => {
+    // An iteration in which no operation is enabled does not run at all, so another operation runs in each one.
+    const other: Operation = new Operation({
+      phase,
+      project: createProject('other', undefined),
+      runner: new NullOperationRunner({ name: 'other', result: OperationStatus.Success, silent: false }),
+      logFilenameIdentifier: 'other'
+    });
+    const harness: ITestHarness = await createHarnessAsync({}, [other]);
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+    const operation: Operation = [...harness.graph.operations].find(
+      ({ runner }: Operation) => runner === harness.runner
+    )!;
+
+    // If the operation ran, the guard would make the runner close the worker before the initial command.
+    harness.blockReason = 'its command line changed';
+    const guardCallCount: number = harness.guardOptions.length;
+    harness.graph.setEnabledStates([operation], false, 'unsafe');
+    const skipped: ITestIteration = await harness.executeAsync();
+    expect(skipped.record.status).toBe(OperationStatus.Skipped);
+    expect(skipped.commands).toEqual([]);
+    expect(harness.runner.isActive).toBe(true);
+    expect(worker.exitCode).toBeNull();
+    expect(harness.guardOptions).toHaveLength(guardCallCount);
+
+    harness.blockReason = undefined;
+    harness.graph.setEnabledStates([operation], true, 'unsafe');
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([]);
+    expect(next.output).toContain(`Sending run 2 to the warm worker (pid ${worker.pid}).`);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts b/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
index e974122307f..9f6eda0d499 100644
--- a/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
+++ b/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
@@ -1,12 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { type IPackageJson, JsonFile } from '@rushstack/node-core-library';
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem, type IPackageJson, JsonFile, LockFile } from '@rushstack/node-core-library';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import { TestUtilities } from '@rushstack/heft-config-file';
 
 import { InstallHelpers } from '../installManager/InstallHelpers';
 import { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushGlobalFolder } from '../../api/RushGlobalFolder';
+import { Utilities } from '../../utilities/Utilities';
 import type { PnpmWorkspaceFile } from '../pnpm/PnpmWorkspaceFile';
 
 describe(InstallHelpers.name, () => {
@@ -70,6 +77,169 @@ describe(InstallHelpers.name, () => {
     });
   });
 
+  describe(InstallHelpers.ensureLocalPackageManagerAsync.name, () => {
+    const packageManagerVersion: string = '8.14.0';
+    const lockResourceName: string = `pnpm-${packageManagerVersion}`;
+    let tempFolder: string;
+    let rushConfiguration: RushConfiguration;
+    let rushGlobalFolder: RushGlobalFolder;
+    let toolFolder: string;
+    let flagPath: string;
+    let installPackageMock: jest.SpyInstance;
+    let acquireLockSpy: jest.SpyInstance<Promise<LockFile>>;
+
+    beforeEach(() => {
+      tempFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-ensure-local-package-manager-'));
+      rushConfiguration = {
+        packageManager: 'pnpm',
+        packageManagerToolVersion: packageManagerVersion,
+        commonRushConfigFolder: `${tempFolder}/repo/common/config/rush`,
+        commonTempFolder: `${tempFolder}/repo/common/temp`
+      } as unknown as RushConfiguration;
+      rushGlobalFolder = { nodeSpecificPath: `${tempFolder}/rush-home` } as unknown as RushGlobalFolder;
+      toolFolder = `${rushGlobalFolder.nodeSpecificPath}/${lockResourceName}`;
+      flagPath = `${toolFolder}/last-install.flag`;
+      installPackageMock = jest
+        .spyOn(Utilities, 'installPackageInDirectoryAsync')
+        .mockRejectedValue(new Error('Unexpected package manager install'));
+      acquireLockSpy = jest.spyOn(LockFile, 'acquireAsync');
+    });
+
+    afterEach(() => {
+      installPackageMock.mockRestore();
+      acquireLockSpy.mockRestore();
+      fs.rmSync(tempFolder, { recursive: true, force: true });
+    });
+
+    function getLockFileNames(): string[] {
+      return fs
+        .readdirSync(rushGlobalFolder.nodeSpecificPath)
+        .filter((name: string) => name.startsWith(lockResourceName) && name.endsWith('.lock'));
+    }
+
+    // Like a Rush process that is killed while it holds the lock: a child process takes the lock
+    // and exits without releasing it.
+    function leaveStaleLock(): void {
+      fs.mkdirSync(rushGlobalFolder.nodeSpecificPath, { recursive: true });
+      const script: string =
+        `require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))})` +
+        `.LockFile.tryAcquire(${JSON.stringify(rushGlobalFolder.nodeSpecificPath)}, ` +
+        `${JSON.stringify(lockResourceName)}) || process.exit(1);`;
+      execFileSync(process.execPath, ['-e', script]);
+      expect(getLockFileNames()).toHaveLength(1);
+    }
+
+    async function wasAcquiredLockDirtyAsync(): Promise<boolean> {
+      expect(acquireLockSpy).toHaveBeenCalledTimes(1);
+      const lock: LockFile = await acquireLockSpy.mock.results[0].value;
+      return lock.dirtyWhenAcquired;
+    }
+
+    it('does not reinstall when it removes a stale lock and the last-install flag is valid', async () => {
+      // Not the format that LastInstallFlag writes, so that a rewrite would show.
+      const flagContents: string = JSON.stringify({ node: process.versions.node });
+      await FileSystem.writeFileAsync(flagPath, flagContents, { ensureFolderExists: true });
+      await FileSystem.writeFileAsync(`${toolFolder}/node_modules/.bin/pnpm`, 'the installed tool', {
+        ensureFolderExists: true
+      });
+      leaveStaleLock();
+
+      await InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true);
+
+      await expect(wasAcquiredLockDirtyAsync()).resolves.toBe(true);
+      expect(installPackageMock).not.toHaveBeenCalled();
+      await expect(FileSystem.readFileAsync(`${toolFolder}/node_modules/.bin/pnpm`)).resolves.toBe(
+        'the installed tool'
+      );
+      await expect(FileSystem.readFileAsync(flagPath)).resolves.toBe(flagContents);
+      await expect(
+        FileSystem.getLinkStatisticsAsync(`${rushConfiguration.commonTempFolder}/pnpm-local`)
+      ).resolves.toBeDefined();
+      expect(getLockFileNames()).toEqual([]);
+    });
+
+    it.each([
+      ['missing, as after an interrupted install', undefined],
+      ['empty, as after an interrupted write', ''],
+      ['for another Node.js version', JSON.stringify({ node: '0.0.1' })]
+    ])(
+      'reinstalls when the last-install flag is %s, deleting the flag before the install',
+      async (description: string, flagContents: string | undefined) => {
+        // What an interrupted install leaves: a partly installed folder and a stale lock.
+        await FileSystem.writeFileAsync(`${toolFolder}/package.json`, '{}', { ensureFolderExists: true });
+        if (flagContents !== undefined) {
+          await FileSystem.writeFileAsync(flagPath, flagContents);
+        }
+        leaveStaleLock();
+        let flagExistedDuringInstall: boolean | undefined;
+        installPackageMock.mockImplementationOnce(async () => {
+          flagExistedDuringInstall = await FileSystem.existsAsync(flagPath);
+        });
+
+        await InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true);
+
+        await expect(wasAcquiredLockDirtyAsync()).resolves.toBe(true);
+        expect(installPackageMock).toHaveBeenCalledTimes(1);
+        expect(installPackageMock.mock.calls[0][0]).toMatchObject({
+          directory: toolFolder,
+          packageName: 'pnpm',
+          version: packageManagerVersion
+        });
+        expect(flagExistedDuringInstall).toBe(false);
+        await expect(JsonFile.loadAsync(flagPath)).resolves.toEqual({ node: process.versions.node });
+        await expect(
+          FileSystem.getLinkStatisticsAsync(`${rushConfiguration.commonTempFolder}/pnpm-local`)
+        ).resolves.toBeDefined();
+        expect(getLockFileNames()).toEqual([]);
+      }
+    );
+
+    it('leaves no last-install flag when the install fails', async () => {
+      await FileSystem.writeFileAsync(flagPath, JSON.stringify({ node: '0.0.1' }), {
+        ensureFolderExists: true
+      });
+      installPackageMock.mockRejectedValueOnce(new Error('npm error code E401'));
+
+      await expect(
+        InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true)
+      ).rejects.toThrow('npm error code E401');
+
+      await expect(FileSystem.existsAsync(flagPath)).resolves.toBe(false);
+    });
+
+    it('releases the package manager lock when the install fails, so the same process can retry', async () => {
+      installPackageMock
+        .mockRejectedValueOnce(new Error('npm error code E401'))
+        .mockResolvedValueOnce(undefined);
+
+      await expect(
+        InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true)
+      ).rejects.toThrow('npm error code E401');
+
+      // A Rush daemon calls this again in the same process. If the failed call still held the lock,
+      // tryAcquire would return undefined here and the retry below would wait forever.
+      const lockAfterFailure: LockFile | undefined = LockFile.tryAcquire(
+        rushGlobalFolder.nodeSpecificPath,
+        lockResourceName
+      );
+      expect(lockAfterFailure).toBeDefined();
+      lockAfterFailure?.release();
+
+      await InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true);
+
+      expect(installPackageMock).toHaveBeenCalledTimes(2);
+      await expect(
+        FileSystem.getLinkStatisticsAsync(`${rushConfiguration.commonTempFolder}/pnpm-local`)
+      ).resolves.toBeDefined();
+      const lockAfterSuccess: LockFile | undefined = LockFile.tryAcquire(
+        rushGlobalFolder.nodeSpecificPath,
+        lockResourceName
+      );
+      expect(lockAfterSuccess).toBeDefined();
+      lockAfterSuccess?.release();
+    });
+  });
+
   describe(InstallHelpers.generateCommonPackageJsonAsync.name, () => {
     let mockJsonFileSaveAsync: jest.SpyInstance;
     let terminal: Terminal;
diff --git a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
index c9138b3c851..618bd4c6948 100644
--- a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
+++ b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
@@ -25,6 +25,16 @@ const mockHashes: Map<string, string> = new Map([
 // Mock function for customizing repo changes in each test
 const mockGetRepoChanges: jest.MockedFunction<typeof import('@rushstack/package-deps-hash').getRepoChanges> =
   jest.fn();
+const mockOnGetDetailedRepoState: jest.Mock<void, []> = jest.fn();
+const mockHashFilesAsync: jest.Mock<ReadonlyMap<string, string>, [string, Iterable<string>]> = jest.fn(
+  (rootDirectory: string, filePaths: Iterable<string>) =>
+    new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]))
+);
+const mockCreateRepoStateCache: jest.Mock<void, [IRepoStateCacheOptions]> = jest.fn();
+const mockGetCachedRepoStateAsync: jest.Mock<
+  Promise<IDetailedRepoState>,
+  [ReadonlyArray<string> | undefined, ReadonlyArray<string> | undefined]
+> = jest.fn();
 
 jest.mock(`@rushstack/package-deps-hash`, () => {
   return {
@@ -32,6 +42,7 @@ jest.mock(`@rushstack/package-deps-hash`, () => {
       return dir;
     },
     getDetailedRepoStateAsync(): IDetailedRepoState {
+      mockOnGetDetailedRepoState();
       return {
         hasSubmodules: false,
         hasUncommittedChanges: false,
@@ -46,7 +57,19 @@ jest.mock(`@rushstack/package-deps-hash`, () => {
       return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
     },
     hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): ReadonlyMap<string, string> {
-      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+      return mockHashFilesAsync(rootDirectory, filePaths);
+    },
+    RepoStateCache: class MockRepoStateCache {
+      public constructor(options: IRepoStateCacheOptions) {
+        mockCreateRepoStateCache(options);
+      }
+
+      public async getDetailedRepoStateAsync(
+        additionalRelativePathsToHash?: ReadonlyArray<string>,
+        filterPath?: ReadonlyArray<string>
+      ): Promise<IDetailedRepoState> {
+        return await mockGetCachedRepoStateAsync(additionalRelativePathsToHash, filterPath);
+      }
     },
     getRepoChanges(
       currentWorkingDirectory: string,
@@ -112,17 +135,25 @@ jest.mock('../incremental/InputsSnapshot', () => {
   };
 });
 
+import * as fs from 'node:fs';
 import { resolve } from 'node:path';
 
-import type { IDetailedRepoState, IFileDiffStatus } from '@rushstack/package-deps-hash';
+import type {
+  IDetailedRepoState,
+  IFileDiffStatus,
+  IRepoStateCacheOptions
+} from '@rushstack/package-deps-hash';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import {
   ProjectChangeAnalyzer,
   isPackageJsonVersionBumpChange,
-  isPackageJsonVersionOnlyChange
+  isPackageJsonVersionOnlyChange,
+  tryGetMissingProjectShrinkwrapFileErrorAsync
 } from '../ProjectChangeAnalyzer';
 import { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import type { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
 import type {
   IInputsSnapshot,
   GetInputsSnapshotAsyncFn,
@@ -152,8 +183,17 @@ describe(ProjectChangeAnalyzer.name, () => {
       const terminal: Terminal = new Terminal(terminalProvider);
       const mockSnapshotValue: {} = {};
       mockSnapshot.mockImplementation(() => mockSnapshotValue);
+      let repoStateReadTimeMs: number | undefined;
+      mockOnGetDetailedRepoState.mockImplementationOnce(() => {
+        repoStateReadTimeMs = Date.now();
+        // Make sure that a time recorded after the working tree was read is later than this one
+        while (Date.now() <= repoStateReadTimeMs + 1) {
+          // Busy wait
+        }
+      });
       const snapshotProvider: GetInputsSnapshotAsyncFn | undefined =
         await projectChangeAnalyzer._tryGetSnapshotProviderAsync(new Map(), terminal);
+      const beforeSnapshotTimeMs: number = Date.now();
       const snapshot: IInputsSnapshot | undefined = await snapshotProvider?.();
 
       expect(snapshot).toBe(mockSnapshotValue);
@@ -167,6 +207,291 @@ describe(ProjectChangeAnalyzer.name, () => {
       expect(mockInput.hashes).toEqual(mockHashes);
       expect(mockInput.rootDir).toEqual(rootDir);
       expect(mockInput.additionalHashes).toEqual(new Map());
+      // The start time is recorded before Git reads the working tree
+      expect(mockInput.workingTreeReadStartTimeMs).toBeGreaterThanOrEqual(beforeSnapshotTimeMs);
+      expect(mockInput.workingTreeReadStartTimeMs).toBeLessThanOrEqual(repoStateReadTimeMs!);
+    });
+
+    describe('with PNPM project dependency files', () => {
+      let folder: string;
+      let rushConfiguration: RushConfiguration;
+      let terminalProvider: StringBufferTerminalProvider;
+      let terminal: Terminal;
+      // As Rush builds the path: the project's temp folder, then a slash and the file name
+      const dependencyFile = (name: string): string =>
+        `${resolve(folder, name, '.rush/temp')}/shrinkwrap-deps.json`;
+      const instruction = (name: string): string =>
+        `A project dependency file (${dependencyFile(name)}) is missing. ` +
+        'You may need to run "rush install" or "rush update".';
+      const gitFailure: () => never = () => {
+        throw new Error('git hash-object failed');
+      };
+      const hostOptions: { throwOnMissingProjectShrinkwrapFile: boolean } = {
+        throwOnMissingProjectShrinkwrapFile: true
+      };
+
+      beforeEach(() => {
+        // Change detection requires a Git working tree, which contains this folder.
+        folder = fs.mkdtempSync(resolve(__dirname, 'shrinkwrap-deps-'));
+        fs.writeFileSync(
+          resolve(folder, 'rush.json'),
+          JSON.stringify({
+            rushVersion: '5.162.0',
+            pnpmVersion: '9.15.9',
+            projects: ['a', 'b'].map((name) => ({ packageName: name, projectFolder: name }))
+          })
+        );
+        for (const name of ['a', 'b']) {
+          fs.mkdirSync(resolve(folder, name, '.rush/temp'), { recursive: true });
+          fs.writeFileSync(resolve(folder, name, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));
+          fs.writeFileSync(dependencyFile(name), '{}');
+        }
+        rushConfiguration = RushConfiguration.loadFromConfigurationFile(resolve(folder, 'rush.json'));
+        terminalProvider = new StringBufferTerminalProvider();
+        terminal = new Terminal(terminalProvider);
+      });
+
+      afterEach(() => {
+        fs.rmSync(folder, { recursive: true, force: true });
+      });
+
+      it('warns and continues without a snapshot provider if a file is missing', async () => {
+        fs.rmSync(dependencyFile('b'));
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        await expect(analyzer._tryGetSnapshotProviderAsync(new Map(), terminal)).resolves.toBeUndefined();
+        expect(terminalProvider.getWarningOutput()).toContain(instruction('b'));
+      });
+
+      it('throws the error of a missing file for a host that requires a snapshot', async () => {
+        fs.rmSync(dependencyFile('b'));
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        await expect(
+          analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, hostOptions)
+        ).rejects.toThrow(new Error(instruction('b')));
+        expect(terminalProvider.getWarningOutput()).toBe('');
+      });
+
+      it('reports a file that was removed after the provider was created instead of the Git failure', async () => {
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        const nativeProvider: GetInputsSnapshotAsyncFn | undefined =
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal);
+        const hostProvider: GetInputsSnapshotAsyncFn | undefined =
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, hostOptions);
+        fs.rmSync(dependencyFile('a'));
+        mockOnGetDetailedRepoState.mockImplementationOnce(gitFailure).mockImplementationOnce(gitFailure);
+
+        await expect(nativeProvider!()).resolves.toBeUndefined();
+        expect(terminalProvider.getWarningOutput()).toContain(instruction('a'));
+        expect(terminalProvider.getWarningOutput()).not.toContain('git hash-object failed');
+        await expect(hostProvider!()).rejects.toThrow(new Error(instruction('a')));
+      });
+
+      it('continues without a snapshot after other failures, even for a host that requires one', async () => {
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        const hostProvider: GetInputsSnapshotAsyncFn | undefined =
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, hostOptions);
+        mockOnGetDetailedRepoState.mockImplementationOnce(gitFailure);
+
+        await expect(hostProvider!()).resolves.toBeUndefined();
+        expect(terminalProvider.getWarningOutput()).toContain('git hash-object failed');
+      });
+
+      describe('when reusing unchanged inputs', () => {
+        const reuseOptions: { reuseUnchangedInputs: boolean } = { reuseUnchangedInputs: true };
+        let stateCount: number;
+
+        function createRepoState(): IDetailedRepoState {
+          stateCount++;
+          return {
+            hasSubmodules: false,
+            hasUncommittedChanges: false,
+            files: new Map([['a/package.json', `hash${stateCount}`]]),
+            symlinks: new Map()
+          };
+        }
+
+        function getProjectConfigurations(
+          dependsOnAdditionalFiles: string[]
+        ): Map<RushConfigurationProject, RushProjectConfiguration> {
+          const projectConfiguration: RushProjectConfiguration = {
+            operationSettingsByOperationName: new Map([
+              ['_phase:build', { operationName: '_phase:build', dependsOnAdditionalFiles }]
+            ])
+          } as unknown as RushProjectConfiguration;
+          return new Map([[rushConfiguration.getProjectByName('a')!, projectConfiguration]]);
+        }
+
+        beforeEach(() => {
+          stateCount = 0;
+          mockSnapshot.mockImplementation(() => ({}));
+          mockGetCachedRepoStateAsync.mockResolvedValue(createRepoState());
+        });
+
+        afterEach(() => {
+          mockGetCachedRepoStateAsync.mockReset();
+          delete process.env.PROJECT_CHANGE_ANALYZER_TEST;
+        });
+
+        it('returns the previous snapshot while its inputs are unchanged', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          expect(snapshot).toBeDefined();
+          await expect(provider!()).resolves.toBe(snapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(1);
+          expect(mockOnGetDetailedRepoState).not.toHaveBeenCalled();
+          expect(mockGetCachedRepoStateAsync).toHaveBeenCalledTimes(2);
+          const [additionalRelativePathsToHash, filterPath] = mockGetCachedRepoStateAsync.mock.calls[1];
+          expect(Array.from(additionalRelativePathsToHash!).sort()).toEqual([
+            'a/.rush/temp/shrinkwrap-deps.json',
+            'b/.rush/temp/shrinkwrap-deps.json'
+          ]);
+          expect(filterPath).toEqual([]);
+          // There are no additional files to hash
+          expect(mockHashFilesAsync).not.toHaveBeenCalled();
+
+          // The state of the repository changed
+          mockGetCachedRepoStateAsync.mockResolvedValue(createRepoState());
+          const nextSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(nextSnapshot).not.toBe(snapshot);
+          await expect(provider!()).resolves.toBe(nextSnapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(2);
+          expect(mockSnapshot.mock.calls[1][0].hashes).toBe(
+            (await mockGetCachedRepoStateAsync.mock.results[2].value).files
+          );
+          // The new snapshot can reuse the state of the projects whose inputs did not change
+          expect(mockSnapshot.mock.calls[0][0].previousSnapshot).toBeUndefined();
+          expect(mockSnapshot.mock.calls[1][0].previousSnapshot).toBe(snapshot);
+        });
+
+        it('takes a new snapshot when the environment changes', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          expect(mockSnapshot.mock.calls[0][0].environment).toEqual(process.env);
+
+          process.env.PROJECT_CHANGE_ANALYZER_TEST = '1';
+          const nextSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(nextSnapshot).not.toBe(snapshot);
+          expect(mockSnapshot.mock.calls[1][0].environment).toEqual(process.env);
+          await expect(provider!()).resolves.toBe(nextSnapshot);
+
+          process.env.PROJECT_CHANGE_ANALYZER_TEST = '2';
+          await expect(provider!()).resolves.not.toBe(nextSnapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(3);
+          // The snapshot decides for itself which state of the previous one it can still use
+          expect(mockSnapshot.mock.calls[1][0].previousSnapshot).toBe(snapshot);
+          expect(mockSnapshot.mock.calls[2][0].previousSnapshot).toBe(nextSnapshot);
+        });
+
+        it('takes a new snapshot when the additional files or their hashes change', async () => {
+          fs.writeFileSync(resolve(folder, 'a/extra.txt'), 'extra');
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            getProjectConfigurations(['*.txt']),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          expect(mockSnapshot.mock.calls[0][0].additionalHashes).toEqual(
+            new Map([['a/extra.txt', 'a/extra.txt']])
+          );
+          await expect(provider!()).resolves.toBe(snapshot);
+
+          mockHashFilesAsync.mockImplementationOnce(() => new Map([['a/extra.txt', 'changed']]));
+          const changedHashSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(changedHashSnapshot).not.toBe(snapshot);
+
+          fs.writeFileSync(resolve(folder, 'a/other.txt'), 'other');
+          const addedFileSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(addedFileSnapshot).not.toBe(changedHashSnapshot);
+          await expect(provider!()).resolves.toBe(addedFileSnapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(3);
+        });
+
+        it('takes a new snapshot when an operation depends on another tracked file', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            getProjectConfigurations(['*.md']),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+
+          // A tracked file is hashed with the rest of the repository, not as an additional file
+          fs.writeFileSync(resolve(folder, 'a/README.md'), 'readme');
+          mockGetCachedRepoStateAsync.mockImplementation(async () => {
+            const state: IDetailedRepoState = await mockGetCachedRepoStateAsync.mock.results[0].value;
+            state.files.set('a/README.md', 'readme');
+            return state;
+          });
+          await expect(provider!()).resolves.not.toBe(snapshot);
+          expect(mockHashFilesAsync).not.toHaveBeenCalled();
+          expect(mockSnapshot).toHaveBeenCalledTimes(2);
+        });
+
+        it('shares the cache of the repository between providers', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, reuseOptions);
+          await new ProjectChangeAnalyzer(rushConfiguration)._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          expect(mockCreateRepoStateCache).toHaveBeenCalledTimes(1);
+          expect(mockCreateRepoStateCache).toHaveBeenCalledWith({
+            rootDirectory: folder,
+            gitPath: expect.any(String),
+            temporaryFolderPath: rushConfiguration.commonTempFolder
+          });
+        });
+
+        it('takes a new snapshot each time without the option', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          await expect(provider!()).resolves.not.toBe(snapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(2);
+          expect(mockSnapshot.mock.calls[1][0].previousSnapshot).toBeUndefined();
+          expect(mockOnGetDetailedRepoState).toHaveBeenCalledTimes(2);
+          expect(mockGetCachedRepoStateAsync).not.toHaveBeenCalled();
+          expect(mockCreateRepoStateCache).not.toHaveBeenCalled();
+        });
+      });
+
+      it('finds the first missing file in project order', async () => {
+        await expect(
+          tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)
+        ).resolves.toBeUndefined();
+        fs.rmSync(dependencyFile('b'));
+        fs.rmSync(dependencyFile('a'));
+        await expect(tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)).resolves.toEqual(
+          new Error(instruction('a'))
+        );
+      });
+    });
+
+    it('never reports a missing project dependency file for a package manager that has none', async () => {
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        resolve(__dirname, 'repo', 'rush.json')
+      );
+      await expect(tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)).resolves.toBeUndefined();
     });
   });
 
diff --git a/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts b/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
new file mode 100644
index 00000000000..0943e7a0e2d
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
@@ -0,0 +1,859 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+type MockFsListener = (eventType: string, fileName: string) => void;
+
+// The listeners of the watcher's open file system watchers, so that tests can simulate file changes.
+const mockFsListeners: Set<MockFsListener> = new Set();
+
+jest.mock('node:fs', () => {
+  const actual: typeof import('node:fs') = jest.requireActual('node:fs');
+  const { EventEmitter } = jest.requireActual<typeof import('node:events')>('node:events');
+  class MockFsWatcher extends EventEmitter {
+    readonly #listener: MockFsListener;
+    public constructor(listener: MockFsListener) {
+      super();
+      this.#listener = listener;
+      mockFsListeners.add(listener);
+    }
+    public close(): void {
+      mockFsListeners.delete(this.#listener);
+      this.emit('close');
+    }
+    public unref(): this {
+      return this;
+    }
+  }
+  return {
+    ...actual,
+    watch: jest.fn(
+      (watchedPath: string, options: unknown, listener: MockFsListener) => new MockFsWatcher(listener)
+    )
+  };
+});
+jest.mock('@rushstack/package-deps-hash', () => {
+  const actual: typeof import('@rushstack/package-deps-hash') = jest.requireActual(
+    '@rushstack/package-deps-hash'
+  );
+  return { ...actual, getRepoRoot: () => '/repo' };
+});
+jest.mock('../Git', () => ({
+  Git: class {
+    public getGitPathOrThrow(): string {
+      return 'git';
+    }
+  }
+}));
+jest.mock('../operations/OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../operations/ProjectLogWritable', () => {
+  const actual: typeof import('../operations/ProjectLogWritable') = jest.requireActual(
+    '../operations/ProjectLogWritable'
+  );
+  const { TerminalWritable } =
+    jest.requireActual<typeof import('@rushstack/terminal')>('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { setTimeout as sleepAsync } from 'node:timers/promises';
+
+import { AnsiEscape, MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../api/CommandLineConfiguration';
+import type { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import type { IOperationRunner, IOperationRunnerContext } from '../operations/IOperationRunner';
+import type { IOperationExecutionResult } from '../operations/IOperationExecutionResult';
+import { Operation } from '../operations/Operation';
+import { OperationGraph } from '../operations/OperationGraph';
+import { OperationStatus } from '../operations/OperationStatus';
+import { ProjectWatcher } from '../ProjectWatcher';
+
+const DEBOUNCE_MS: number = 10;
+const REQUESTOR: string = 'test-requestor';
+
+// The statuses of a result that PhasedOperationPlugin keeps if the operation's inputs did not change.
+const RETAINED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Success,
+  OperationStatus.FromCache,
+  OperationStatus.NoOp,
+  OperationStatus.Skipped
+]);
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+type TestRunnerAction = (runCount: number) => Promise<OperationStatus | void> | OperationStatus | void;
+
+/**
+ * Like an IPC runner, keeps the invalidate callback of its first run to request more runs.
+ */
+class TestRunner implements IOperationRunner {
+  public readonly name: string;
+  public readonly cacheable: boolean = false;
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly warningsAreAllowed: boolean = false;
+  public runCount: number = 0;
+  public action: TestRunnerAction | undefined;
+  #invalidate: ((reason: string) => void) | undefined;
+
+  public constructor(name: string) {
+    this.name = name;
+  }
+
+  public requestRun(): void {
+    if (!this.#invalidate) {
+      throw new Error(`${this.name} has not run yet`);
+    }
+    this.#invalidate(REQUESTOR);
+  }
+
+  public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    this.runCount++;
+    this.#invalidate ??= context.getInvalidateCallback();
+    return (await this.action?.(this.runCount)) || OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'test';
+  }
+}
+
+interface ITestOperation {
+  operation: Operation;
+  runner: TestRunner;
+}
+
+function createOperation(name: string): ITestOperation {
+  const runner: TestRunner = new TestRunner(name);
+  const operation: Operation = new Operation({
+    runner,
+    phase: mockPhase,
+    project: { packageName: name, projectFolder: `/repo/${name}` } as unknown as RushConfigurationProject,
+    logFilenameIdentifier: name
+  });
+  return { operation, runner };
+}
+
+interface IWatchSession {
+  readonly graph: OperationGraph;
+  readonly abortController: AbortController;
+  readonly terminalProvider: StringBufferTerminalProvider;
+  /**
+   * The session has settled when nothing changes for this long.
+   */
+  readonly settleMs: number;
+  /**
+   * The names of the operations that each executed iteration enabled.
+   */
+  readonly iterations: string[][];
+  /**
+   * Operations to run in the next iteration even if their last result is current, as if their files changed.
+   */
+  readonly dirty: Set<Operation>;
+  /**
+   * The inputs snapshots that the graph and the watcher take, if the session has them.
+   */
+  readonly snapshots: IMockInputsSnapshots;
+  idleCount: number;
+  watcher?: ProjectWatcher;
+}
+
+interface IMockInputsSnapshots {
+  /**
+   * The version of the inputs of each operation, as if in the working tree. An inputs snapshot copies it.
+   */
+  readonly inputVersions: Map<Operation, number>;
+  /**
+   * Takes the inputs snapshots of the graph.
+   */
+  getGraphSnapshotAsync: () => Promise<IInputsSnapshot | undefined>;
+  /**
+   * Takes the inputs snapshots of the watcher.
+   */
+  getWatcherSnapshotAsync: () => Promise<IInputsSnapshot | undefined>;
+  /**
+   * How many inputs snapshots the watcher has asked for.
+   */
+  watcherSnapshotCount: number;
+}
+
+interface IWatchSessionOptions {
+  debounceMs?: number;
+  /**
+   * Whether the graph and the watcher take inputs snapshots, as they do in a Git repository.
+   */
+  hasInputsSnapshots?: boolean;
+}
+
+const sessions: IWatchSession[] = [];
+
+/**
+ * Like a Git-backed inputs snapshot. The own state hash of an operation is the version of its inputs when the
+ * snapshot was taken.
+ */
+function createInputsSnapshot(inputVersions: ReadonlyMap<Operation, number>): IInputsSnapshot {
+  const hashByOperationKey: Map<string, string> = new Map();
+  for (const [{ name, associatedProject, associatedPhase }, version] of inputVersions) {
+    hashByOperationKey.set(`${associatedProject.packageName}#${associatedPhase.name}`, `${name}@${version}`);
+  }
+  return {
+    // The edits in these tests change inputs that only the operation's phase depends on, like its additional
+    // files, so the hash of the project alone does not change.
+    getOperationOwnStateHash: (project: RushConfigurationProject, operationName?: string) =>
+      hashByOperationKey.get(`${project.packageName}#${operationName}`) ?? project.packageName,
+    getTrackedFileHashesForOperation: () => undefined
+  } as unknown as IInputsSnapshot;
+}
+
+function editInputs(session: IWatchSession, operation: Operation): void {
+  const { inputVersions } = session.snapshots;
+  inputVersions.set(operation, (inputVersions.get(operation) ?? 0) + 1);
+}
+
+function createWatchSession(operations: Operation[], options: IWatchSessionOptions = {}): IWatchSession {
+  const { debounceMs = DEBOUNCE_MS, hasInputsSnapshots = false } = options;
+  const inputVersions: Map<Operation, number> = new Map(operations.map((operation) => [operation, 0]));
+  const snapshots: IMockInputsSnapshots = {
+    inputVersions,
+    getGraphSnapshotAsync: async () => createInputsSnapshot(inputVersions),
+    getWatcherSnapshotAsync: async () => createInputsSnapshot(inputVersions),
+    watcherSnapshotCount: 0
+  };
+  const abortController: AbortController = new AbortController();
+  const graph: OperationGraph = new OperationGraph(new Set(operations), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 2,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController,
+    isWatch: true,
+    getInputsSnapshotAsync: hasInputsSnapshots ? () => snapshots.getGraphSnapshotAsync() : undefined
+  });
+  const session: IWatchSession = {
+    graph,
+    abortController,
+    terminalProvider: new StringBufferTerminalProvider(),
+    settleMs: debounceMs * 10,
+    iterations: [],
+    dirty: new Set(),
+    snapshots,
+    idleCount: 0
+  };
+  sessions.push(session);
+
+  // Like PhasedOperationPlugin, runs the operations whose last result is not current.
+  graph.hooks.configureIteration.tap('test', (currentStates, lastStates, iterationOptions) => {
+    for (const [operation, currentState] of currentStates) {
+      const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
+      currentState.enabled =
+        !lastState ||
+        !RETAINED_STATUSES.has(lastState.status) ||
+        session.dirty.has(operation) ||
+        (!!iterationOptions.inputsSnapshot &&
+          currentState.getStateHashComponents().local !== lastState.getStateHashComponents().local);
+    }
+    session.dirty.clear();
+  });
+  graph.hooks.beforeExecuteIterationAsync.tap('test', (records) => {
+    const enabled: string[] = [];
+    for (const [operation, record] of records) {
+      if (record.enabled) {
+        enabled.push(operation.name);
+      }
+    }
+    session.iterations.push(enabled);
+  });
+  graph.hooks.onIdle.tap('test', () => {
+    session.idleCount++;
+  });
+
+  session.watcher = new ProjectWatcher({
+    graph,
+    debounceMs,
+    rushConfiguration: {
+      rushJsonFolder: '/repo',
+      commonRushConfigFolder: '/repo/common/config/rush'
+    } as unknown as RushConfiguration,
+    terminal: new Terminal(session.terminalProvider),
+    renderStatusInPlace: false,
+    initialSnapshot: createInputsSnapshot(inputVersions),
+    getInputsSnapshotAsync: hasInputsSnapshots
+      ? () => {
+          snapshots.watcherSnapshotCount++;
+          return snapshots.getWatcherSnapshotAsync();
+        }
+      : undefined
+  });
+  return session;
+}
+
+function getSessionState(session: IWatchSession): string {
+  const { graph, iterations, idleCount } = session;
+  return `${iterations.length}/${idleCount}/${graph.status}/${graph.hasScheduledIteration}`;
+}
+
+/**
+ * Waits until the session is idle and stays unchanged, including any debounced iteration.
+ */
+async function settleAsync(session: IWatchSession): Promise<void> {
+  let lastState: string | undefined;
+  for (let i: number = 0; i < 30; i++) {
+    await sleepAsync(session.settleMs);
+    const state: string = getSessionState(session);
+    if (
+      state === lastState &&
+      session.graph.status !== OperationStatus.Executing &&
+      !session.graph.hasScheduledIteration
+    ) {
+      return;
+    }
+    lastState = state;
+  }
+  throw new Error(`The watch session did not settle; it ran ${session.iterations.length} iterations`);
+}
+
+async function startWatchSessionAsync(session: IWatchSession): Promise<void> {
+  await session.graph.executeAsync({});
+  await settleAsync(session);
+}
+
+function simulateFileChange(): void {
+  for (const listener of mockFsListeners) {
+    listener('change', 'index.ts');
+  }
+}
+
+/**
+ * Returns the statuses that the watcher printed, without the mode label.
+ */
+function getStatuses(session: IWatchSession): string[] {
+  const output: string = AnsiEscape.removeCodes(
+    session.terminalProvider.getOutput({ normalizeSpecialCharacters: false })
+  );
+  const statuses: string[] = [];
+  for (const line of output.split('\n')) {
+    const index: number = line.indexOf('Watch Status: ');
+    if (index >= 0) {
+      statuses.push(line.slice(index + 'Watch Status: '.length));
+    }
+  }
+  return statuses;
+}
+
+function getRequestStatus(...names: string[]): string {
+  return `Run requested by ${names.map((name) => `${name} [${REQUESTOR}]`).join(', ')}. Queuing new iteration...`;
+}
+
+describe(ProjectWatcher.name, () => {
+  afterEach(() => {
+    for (const session of sessions.splice(0)) {
+      session.abortController.abort();
+    }
+    mockFsListeners.clear();
+  });
+
+  it('queues an iteration when an operation requests a run while the graph is idle', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+    // Without a request or a file change, nothing else runs.
+    expect(session.iterations).toEqual([['a', 'b']]);
+
+    a.runner.requestRun();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+    expect(b.runner.runCount).toBe(1);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      getRequestStatus('a'),
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('reruns an operation that requests a run after it completed in the executing iteration', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // b is still running when a's result is written and a requests another run.
+    b.runner.action = async (runCount: number) => {
+      if (runCount === 1) {
+        while (session.graph.resultByOperation.get(a.operation)?.status !== OperationStatus.Success) {
+          await sleepAsync(1);
+        }
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+    expect(b.runner.runCount).toBe(1);
+  });
+
+  it('reruns an operation that requests a run while it is executing', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    a.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a'], ['a'], ['a']]);
+    expect(a.runner.runCount).toBe(3);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      'File change detected. Queuing new iteration...',
+      'Waiting for changes...',
+      getRequestStatus('a'),
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('reruns an operation that requests a run after it executed but before its result is written', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    session.graph.hooks.afterExecuteOperationAsync.tap('test', (record) => {
+      if (record.operation === a.operation && a.runner.runCount === 2) {
+        a.runner.requestRun();
+      }
+    });
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a'], ['a'], ['a']]);
+    expect(a.runner.runCount).toBe(3);
+  });
+
+  it('does not rerun an operation that requests a run before it starts in the executing iteration', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // a waits for b, so it starts after the request.
+    b.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    session.dirty.add(b.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+    expect(a.runner.runCount).toBe(2);
+  });
+
+  it('reruns an operation that requests a run during an iteration that does not include it', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // a is not part of the second iteration, and has not been skipped yet when it requests a run.
+    b.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(b.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['b'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+    expect(b.runner.runCount).toBe(2);
+  });
+
+  it('does not rerun an operation that a failed dependency blocked after its request', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+
+    b.runner.action = () => OperationStatus.Failure;
+    session.dirty.add(b.operation);
+    a.runner.requestRun();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+    expect(a.runner.runCount).toBe(1);
+    expect(b.runner.runCount).toBe(2);
+  });
+
+  it('queues one iteration for the requests and file changes within the debounce interval', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+
+    a.runner.requestRun();
+    b.runner.requestRun();
+    await settleAsync(session);
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+
+    a.runner.requestRun();
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a', 'b'], ['a']]);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      getRequestStatus('a', 'b'),
+      'Waiting for changes...',
+      'File change detected. Queuing new iteration...',
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('does not rerun an operation whose request an earlier iteration served', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // a waits for b, so it starts after the request.
+    b.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    // Queues a third iteration, which does not include a. It starts without the graph going idle in between.
+    session.graph.hooks.afterExecuteIterationAsync.tapPromise('test', async (status: OperationStatus) => {
+      if (session.iterations.length === 2 && !session.graph.hasScheduledIteration) {
+        session.dirty.add(b.operation);
+        await session.graph.scheduleIterationAsync({});
+      }
+      return status;
+    });
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    session.dirty.add(b.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a', 'b'], ['b']]);
+    expect(session.idleCount).toBe(2);
+    expect(a.runner.runCount).toBe(2);
+  });
+
+  it('serves a pending request with an iteration that starts before the debounce interval ends', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation], {
+      debounceMs: DEBOUNCE_MS * 5
+    });
+    await startWatchSessionAsync(session);
+
+    a.runner.requestRun();
+    // Like the build keybind.
+    await session.graph.scheduleIterationAsync({});
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a', 'b'], ['a']]);
+
+    b.runner.requestRun();
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a', 'b'], ['a'], ['b']]);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      'Waiting for changes...',
+      getRequestStatus('b'),
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('queues one iteration for a request while the watch is paused', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    await startWatchSessionAsync(session);
+
+    session.graph.pauseNextIteration = true;
+    a.runner.requestRun();
+    await sleepAsync(session.settleMs * 2);
+    expect(session.graph.hasScheduledIteration).toBe(true);
+    expect(session.iterations).toEqual([['a']]);
+    expect(getStatuses(session)).toEqual(['Waiting for changes...', getRequestStatus('a')]);
+
+    session.graph.pauseNextIteration = false;
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+  });
+
+  it('does not queue an iteration for a manual invalidation', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+
+    session.graph.invalidateOperations(undefined, 'manual-invalidation');
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a', 'b']]);
+
+    // The invalidated operations run in the next iteration.
+    simulateFileChange();
+    await settleAsync(session);
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+  });
+
+  it('does not queue an iteration for a request after the watch session ends', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    await startWatchSessionAsync(session);
+
+    session.abortController.abort();
+    a.runner.requestRun();
+    await sleepAsync(session.settleMs);
+
+    expect(session.graph.hasScheduledIteration).toBe(false);
+    expect(getStatuses(session)).toEqual(['Waiting for changes...']);
+  });
+
+  it('does not queue an iteration for a pending request when the watch session ends', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    await startWatchSessionAsync(session);
+
+    a.runner.requestRun();
+    session.abortController.abort();
+    await sleepAsync(session.settleMs);
+
+    expect(session.graph.hasScheduledIteration).toBe(false);
+    expect(getStatuses(session)).toEqual(['Waiting for changes...']);
+  });
+
+  describe('inputs that change during an iteration', () => {
+    it('queues an iteration for inputs that changed while an iteration ran', async () => {
+      const a: ITestOperation = createOperation('a');
+      const b: ITestOperation = createOperation('b');
+      const session: IWatchSession = createWatchSession([a.operation, b.operation], {
+        hasInputsSnapshots: true
+      });
+      a.runner.action = (runCount: number) => {
+        if (runCount === 1) {
+          editInputs(session, b.operation);
+          // The watchers are closed while an iteration runs, so this raises no event.
+          simulateFileChange();
+        }
+      };
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a', 'b'], ['b']]);
+      expect(a.runner.runCount).toBe(1);
+      expect(b.runner.runCount).toBe(2);
+      expect(getStatuses(session)).toEqual([
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...'
+      ]);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('does not queue an iteration if no inputs changed, even after a failure', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      a.runner.action = () => OperationStatus.Failure;
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(1);
+
+      // A file change still reruns the failed operation.
+      simulateFileChange();
+      await settleAsync(session);
+
+      expect(session.iterations).toEqual([['a'], ['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(2);
+      expect(a.runner.runCount).toBe(2);
+    });
+
+    it('compares the inputs with the snapshot of the iteration that ran last', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      await startWatchSessionAsync(session);
+
+      editInputs(session, a.operation);
+      simulateFileChange();
+      await settleAsync(session);
+
+      // The second iteration saw the edit, so the check after it finds no change.
+      expect(session.iterations).toEqual([['a'], ['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(2);
+      expect(getStatuses(session)).toEqual([
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...'
+      ]);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('ignores a check that completes after the next iteration starts', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      let releaseChecks: () => void = () => undefined;
+      const checksReleased: Promise<void> = new Promise((resolve) => {
+        releaseChecks = resolve;
+      });
+      session.snapshots.getWatcherSnapshotAsync = async () => {
+        await checksReleased;
+        return createInputsSnapshot(session.snapshots.inputVersions);
+      };
+      a.runner.action = async (runCount: number) => {
+        if (runCount === 2) {
+          // The check from before this iteration now sees the edit that this iteration serves.
+          releaseChecks();
+          await sleepAsync(DEBOUNCE_MS * 5);
+        }
+      };
+      await startWatchSessionAsync(session);
+
+      editInputs(session, a.operation);
+      simulateFileChange();
+      await settleAsync(session);
+
+      expect(session.iterations).toEqual([['a'], ['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(2);
+      expect(a.runner.runCount).toBe(2);
+    });
+
+    it('reports a check that fails and queues nothing', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      session.snapshots.getWatcherSnapshotAsync = async () => {
+        throw new Error('mock snapshot failure');
+      };
+      a.runner.action = () => editInputs(session, a.operation);
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a']]);
+      expect(session.terminalProvider.getErrorOutput()).toContain(
+        'Failed to check for file changes made during the iteration: mock snapshot failure'
+      );
+    });
+
+    it('does not report a check that fails after the watch session ends', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      let failCheck: () => void = () => undefined;
+      session.snapshots.getWatcherSnapshotAsync = () =>
+        new Promise((resolve, reject) => {
+          failCheck = () => reject(new Error('mock snapshot failure'));
+        });
+      await startWatchSessionAsync(session);
+
+      session.abortController.abort();
+      failCheck();
+      await sleepAsync(session.settleMs);
+
+      expect(session.snapshots.watcherSnapshotCount).toBe(1);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('does not check the inputs after an iteration without a snapshot', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      session.snapshots.getGraphSnapshotAsync = async () => undefined;
+      a.runner.action = () => editInputs(session, a.operation);
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(0);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('opens the watchers before it takes the snapshot for the check', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      const openWatcherCounts: number[] = [];
+      session.snapshots.getWatcherSnapshotAsync = async () => {
+        openWatcherCounts.push(mockFsListeners.size);
+        return createInputsSnapshot(session.snapshots.inputVersions);
+      };
+      await startWatchSessionAsync(session);
+
+      // The repository root, the common configuration folder and the project folder.
+      expect(openWatcherCounts).toEqual([3]);
+    });
+
+    it('queues one iteration for a run request and an edit from the same iteration', async () => {
+      const a: ITestOperation = createOperation('a');
+      const b: ITestOperation = createOperation('b');
+      const session: IWatchSession = createWatchSession([a.operation, b.operation], {
+        hasInputsSnapshots: true
+      });
+      a.runner.action = (runCount: number) => {
+        if (runCount === 2) {
+          // Both wait for the graph to go idle, then share the debounce.
+          a.runner.requestRun();
+          editInputs(session, b.operation);
+        }
+      };
+      await startWatchSessionAsync(session);
+
+      editInputs(session, a.operation);
+      simulateFileChange();
+      await settleAsync(session);
+
+      expect(session.iterations).toEqual([['a', 'b'], ['a'], ['a', 'b']]);
+      expect(a.runner.runCount).toBe(3);
+      expect(b.runner.runCount).toBe(2);
+      expect(getStatuses(session)).toEqual([
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...'
+      ]);
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts b/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
new file mode 100644
index 00000000000..2ecce772c6c
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
@@ -0,0 +1,236 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { FileSystem, type LockFile } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
+import {
+  acquireRepositoryLockAsync,
+  consumeRepositoryLockWait,
+  describeRepositoryLockHolder,
+  type IRepositoryLockResult,
+  type IRepositoryLockWait
+} from '../RepositoryLockWait';
+
+const TEMP_FOLDER: string = path.resolve(__dirname, '../../../temp/test/RepositoryLockWait');
+const DEADLINE: string = EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE;
+const DAEMON_PID: string = EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID;
+const OWN_PID: number = 100;
+const DAEMON: number = 4242;
+const HELD_LOCK: LockFile = { release: () => undefined } as unknown as LockFile;
+
+function writeLockFile(folder: string, name: string, content: string, writtenAtSeconds: number): void {
+  const filePath: string = path.join(folder, name);
+  FileSystem.writeFile(filePath, content, { ensureFolderExists: true });
+  fs.utimesSync(filePath, writtenAtSeconds, writtenAtSeconds);
+}
+
+function createLockFolder(name: string): string {
+  const folder: string = path.join(TEMP_FOLDER, name);
+  FileSystem.ensureEmptyFolder(folder);
+  return folder;
+}
+
+describe(consumeRepositoryLockWait.name, () => {
+  it('returns undefined when rush-client asked for no wait', () => {
+    const environment: NodeJS.ProcessEnv = { PATH: '/bin' };
+    expect(consumeRepositoryLockWait(environment)).toBeUndefined();
+    expect(environment).toEqual({ PATH: '/bin' });
+  });
+
+  it('reads the deadline and the daemon PID, and removes both variables', () => {
+    const environment: NodeJS.ProcessEnv = {
+      PATH: '/bin',
+      [DEADLINE]: '1700000030000',
+      [DAEMON_PID]: '4242'
+    };
+    expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 1700000030000, daemonPid: 4242 });
+    expect(environment).toEqual({ PATH: '/bin' });
+  });
+
+  it('reads a deadline without a daemon PID', () => {
+    const environment: NodeJS.ProcessEnv = { [DEADLINE]: '0' };
+    expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 0 });
+    expect(environment).toEqual({});
+  });
+
+  it.each(['', 'soon', '-1', '1.5', '1e12', ' 17', '1234567890123456'])(
+    'ignores the deadline %p, and still removes both variables',
+    (deadline: string) => {
+      const environment: NodeJS.ProcessEnv = { [DEADLINE]: deadline, [DAEMON_PID]: '4242' };
+      expect(consumeRepositoryLockWait(environment)).toBeUndefined();
+      expect(environment).toEqual({});
+    }
+  );
+
+  it.each(['0', 'daemon', '-4242', '42.5'])('drops the daemon PID %p', (daemonPid: string) => {
+    const environment: NodeJS.ProcessEnv = { [DEADLINE]: '5000', [DAEMON_PID]: daemonPid };
+    expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 5000 });
+    expect(environment).toEqual({});
+  });
+});
+
+describe(describeRepositoryLockHolder.name, () => {
+  it('names the daemon when its lock file holds the lock', () => {
+    const folder: string = createLockFolder('daemon');
+    writeLockFile(folder, `rush#${DAEMON}.lock`, 'start time', 1000);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('the Rush daemon (PID 4242)');
+  });
+
+  it('names another process when the daemon does not hold the lock', () => {
+    const folder: string = createLockFolder('other');
+    writeLockFile(folder, 'rush#17.lock', 'start time', 1000);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('another Rush process (PID 17)');
+    expect(describeRepositoryLockHolder(folder, undefined, OWN_PID)).toBe('another Rush process (PID 17)');
+  });
+
+  it('names the process with the oldest lock file, and ignores empty files, its own, and other locks', () => {
+    const folder: string = createLockFolder('several');
+    writeLockFile(folder, `rush#${OWN_PID}.lock`, 'start time', 500);
+    writeLockFile(folder, 'rush#20.lock', '', 600);
+    writeLockFile(folder, 'autoinstaller#21.lock', 'start time', 700);
+    writeLockFile(folder, 'rush#22.lock', 'start time', 2000);
+    writeLockFile(folder, `rush#${DAEMON}.lock`, 'start time', 1000);
+    writeLockFile(folder, 'rush.lock', 'start time', 400);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('the Rush daemon (PID 4242)');
+  });
+
+  it('names no PID when no lock file names the holder', () => {
+    const folder: string = createLockFolder('windows');
+    writeLockFile(folder, 'rush.lock', '', 1000);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('another Rush process');
+    expect(describeRepositoryLockHolder(path.join(folder, 'missing'), DAEMON, OWN_PID)).toBe(
+      'another Rush process'
+    );
+  });
+});
+
+describe(acquireRepositoryLockAsync.name, () => {
+  interface IAttempt {
+    readonly result: IRepositoryLockResult;
+    readonly attempts: number;
+    readonly sleeps: number[];
+    readonly warnings: string;
+  }
+
+  // Far more than any wait below needs; the longest takes 14 attempts.
+  const MAX_ATTEMPTS: number = 1000;
+
+  let folder: string;
+
+  beforeAll(() => {
+    folder = createLockFolder('acquire');
+    writeLockFile(folder, `rush#${DAEMON}.lock`, 'start time', 1000);
+  });
+
+  /** Tries to take the lock with a clock that starts at 0 and that only sleeping advances. */
+  async function acquireAsync(
+    wait: IRepositoryLockWait | undefined,
+    freeAfterAttempts: number = Infinity
+  ): Promise<IAttempt> {
+    let nowMs: number = 0;
+    let attempts: number = 0;
+    const sleeps: number[] = [];
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const result: IRepositoryLockResult = await acquireRepositoryLockAsync({
+      lockFolder: folder,
+      wait,
+      terminal: new Terminal(terminalProvider),
+      tryAcquire: (lockFolder: string) => {
+        expect(lockFolder).toBe(folder);
+        // The fake sleep never yields to a timer, so a wait that never ended would hang Jest instead of failing.
+        if (++attempts > MAX_ATTEMPTS) {
+          throw new Error(`tryAcquire was called ${attempts} times`);
+        }
+        return attempts > freeAfterAttempts ? HELD_LOCK : undefined;
+      },
+      now: () => nowMs,
+      sleepAsync: async (ms: number) => {
+        sleeps.push(ms);
+        nowMs += ms;
+      },
+      ownPid: OWN_PID
+    });
+    return { result, attempts, sleeps, warnings: terminalProvider.getWarningOutput() };
+  }
+
+  it('tries once without a wait', async () => {
+    expect(await acquireAsync(undefined)).toEqual({
+      result: { lock: undefined },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+    expect(await acquireAsync(undefined, 0)).toEqual({
+      result: { lock: HELD_LOCK },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+  });
+
+  it('does not wait when the lock is free', async () => {
+    expect(await acquireAsync({ deadlineMs: 30000, daemonPid: DAEMON }, 0)).toEqual({
+      result: { lock: HELD_LOCK },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+  });
+
+  it('tries once and names the holder when the deadline has passed', async () => {
+    expect(await acquireAsync({ deadlineMs: 0, daemonPid: DAEMON })).toEqual({
+      result: {
+        lock: undefined,
+        holderSentence: "The Rush daemon (PID 4242) holds this repository's lock."
+      },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+  });
+
+  it('waits until the holder releases the lock', async () => {
+    const { result, attempts, sleeps, warnings } = await acquireAsync(
+      { deadlineMs: 30000, daemonPid: DAEMON },
+      3
+    );
+    expect(result).toEqual({ lock: HELD_LOCK });
+    expect(attempts).toBe(4);
+    expect(sleeps).toEqual([100, 100, 100]);
+    expect(warnings).toBe(
+      "Waiting up to 30 s for the Rush daemon (PID 4242) to release this repository's lock.[n]"
+    );
+  });
+
+  it('stops at the deadline and says that the holder still holds the lock', async () => {
+    const { result, attempts, sleeps, warnings } = await acquireAsync({ deadlineMs: 1250, daemonPid: 17 });
+    expect(result).toEqual({
+      lock: undefined,
+      holderSentence: "Another Rush process (PID 4242) still holds this repository's lock."
+    });
+    expect(attempts).toBe(14);
+    expect(sleeps).toEqual([...Array(12).fill(100), 50]);
+    expect(warnings).toBe(
+      "Waiting up to 2 s for another Rush process (PID 4242) to release this repository's lock.[n]"
+    );
+  });
+
+  it('passes on an error from an attempt', async () => {
+    const error: Error = new Error('EACCES');
+    await expect(
+      acquireRepositoryLockAsync({
+        lockFolder: folder,
+        wait: { deadlineMs: Date.now() + 30000 },
+        terminal: new Terminal(new StringBufferTerminalProvider()),
+        tryAcquire: () => {
+          throw error;
+        }
+      })
+    ).rejects.toBe(error);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/test/Telemetry.test.ts b/libraries/rush-lib/src/logic/test/Telemetry.test.ts
index 977d3b9d3cc..92d53f927b0 100644
--- a/libraries/rush-lib/src/logic/test/Telemetry.test.ts
+++ b/libraries/rush-lib/src/logic/test/Telemetry.test.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { JsonFile } from '@rushstack/node-core-library';
+import * as path from 'node:path';
+
+import { FileSystem, JsonFile } from '@rushstack/node-core-library';
 import type { IReporterEmitEventInput, IReporterEventSink } from '@rushstack/rush-reporter';
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
@@ -131,6 +133,49 @@ describe(Telemetry.name, () => {
     expect(telemetry.store).toEqual([]);
   });
 
+  it('gives entries flushed within one millisecond distinct file names', () => {
+    const filename: string = `${__dirname}/telemetry/telemetryEnabled.json`;
+    const rushConfig: RushConfiguration = RushConfiguration.loadFromConfigurationFile(filename);
+    const rushSession: RushSession = new RushSession({
+      terminalProvider: new ConsoleTerminalProvider(),
+      getIsDebugMode: () => false
+    });
+    const telemetry: Telemetry = new Telemetry(rushConfig, rushSession);
+    const nowMs: number = Date.UTC(2026, 8, 28, 13, 0, 0, 5);
+    const dateNowSpy: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(nowMs);
+    const existingPaths: Set<string> = new Set();
+    const existsSpy: jest.SpyInstance = jest
+      .spyOn(FileSystem, 'exists')
+      .mockImplementation((filePath: string) => existingPaths.has(path.basename(filePath)));
+    existingPaths.add('telemetry_2026_09_28T13_00_00_007Z.json');
+    const logData: ITelemetryData = {
+      name: 'testData1',
+      durationInSeconds: 1,
+      result: 'Succeeded',
+      timestampMs: nowMs,
+      platform: process.platform,
+      rushVersion: Rush.version,
+      machineInfo: {} as ITelemetryMachineInfo,
+      performanceEntries: []
+    };
+
+    try {
+      for (let i: number = 0; i < 3; i++) {
+        telemetry.log(logData);
+        telemetry.flush();
+      }
+    } finally {
+      dateNowSpy.mockRestore();
+      existsSpy.mockRestore();
+    }
+
+    expect(mockedJsonFileSave.mock.calls.map((call) => path.basename(call[1]))).toEqual([
+      'telemetry_2026_09_28T13_00_00_005Z.json',
+      'telemetry_2026_09_28T13_00_00_006Z.json',
+      'telemetry_2026_09_28T13_00_00_008Z.json'
+    ]);
+  });
+
   it('populates default fields', () => {
     const filename: string = `${__dirname}/telemetry/telemetryEnabled.json`;
     const rushConfig: RushConfiguration = RushConfiguration.loadFromConfigurationFile(filename);
diff --git a/libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts b/libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts
new file mode 100644
index 00000000000..eb1ac109711
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts
@@ -0,0 +1,105 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('node:os', () => {
+  const actual: typeof import('node:os') = jest.requireActual('node:os');
+  function createCpu(model: string): import('node:os').CpuInfo {
+    return { model, speed: 3000, times: { user: 0, nice: 0, sys: 0, idle: 0, irq: 0 } };
+  }
+  // Node.js sometimes pads the model. The models differ, so the test can tell which CPU's model is reported.
+  const cpus: import('node:os').CpuInfo[] = [
+    createCpu('Test CPU @ 3.00GHz   '),
+    createCpu('Second CPU'),
+    createCpu('Third CPU')
+  ];
+  return {
+    ...actual,
+    cpus: jest.fn(() => cpus),
+    freemem: jest.fn(actual.freemem),
+    totalmem: jest.fn(actual.totalmem)
+  };
+});
+
+import * as os from 'node:os';
+
+import { ConsoleTerminalProvider } from '@rushstack/terminal';
+
+import { RushConfiguration } from '../../api/RushConfiguration';
+import { RushSession } from '../../pluginFramework/RushSession';
+import { Telemetry, type ITelemetryData, type ITelemetryMachineInfo } from '../Telemetry';
+
+const ONE_MEBIBYTE: number = 1024 * 1024;
+
+const mockedCpus: jest.MockedFunction<typeof os.cpus> = jest.mocked(os.cpus);
+const mockedFreemem: jest.MockedFunction<typeof os.freemem> = jest.mocked(os.freemem);
+const mockedTotalmem: jest.MockedFunction<typeof os.totalmem> = jest.mocked(os.totalmem);
+
+const logData: ITelemetryData = {
+  name: 'build',
+  durationInSeconds: 1,
+  result: 'Succeeded'
+};
+
+function createTelemetry(): Telemetry {
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    `${__dirname}/telemetry/telemetryEnabled.json`
+  );
+  const rushSession: RushSession = new RushSession({
+    terminalProvider: new ConsoleTerminalProvider(),
+    getIsDebugMode: () => false
+  });
+  return new Telemetry(rushConfiguration, rushSession);
+}
+
+describe(`${Telemetry.name} machine info`, () => {
+  // Telemetry keeps the CPU values for the rest of the process, and each test file gets its own module
+  // registry, so one test covers both the first read and the later entries.
+  it('reads the CPUs once per process, and the total and free memory for each entry', () => {
+    const telemetry: Telemetry = createTelemetry();
+    const secondTelemetry: Telemetry = createTelemetry();
+    // Other modules can read the CPUs while they load, so count only the reads from here on.
+    mockedCpus.mockClear();
+    mockedTotalmem
+      .mockReturnValueOnce(1000 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(2000 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(3000 * ONE_MEBIBYTE);
+    mockedFreemem
+      .mockReturnValueOnce(100 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(200 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(300 * ONE_MEBIBYTE);
+
+    const suppliedMachineInfo: ITelemetryMachineInfo = {
+      machineArchitecture: 'arm64',
+      machineCpu: 'Supplied CPU',
+      machineCores: 1,
+      machineTotalMemoryMiB: 1,
+      machineFreeMemoryMiB: 1
+    };
+    telemetry.log({ ...logData, machineInfo: suppliedMachineInfo });
+    expect(mockedCpus).not.toHaveBeenCalled();
+
+    telemetry.log(logData);
+    telemetry.log(logData);
+    secondTelemetry.log(logData);
+    expect(mockedCpus).toHaveBeenCalledTimes(1);
+
+    const expectedCpuInfo: Pick<
+      ITelemetryMachineInfo,
+      'machineArchitecture' | 'machineCpu' | 'machineCores'
+    > = {
+      machineArchitecture: os.arch(),
+      machineCpu: 'Test CPU @ 3.00GHz',
+      machineCores: 3
+    };
+    expect(telemetry.store.map((data: ITelemetryData) => data.machineInfo)).toEqual([
+      suppliedMachineInfo,
+      { ...expectedCpuInfo, machineTotalMemoryMiB: 1000, machineFreeMemoryMiB: 100 },
+      { ...expectedCpuInfo, machineTotalMemoryMiB: 2000, machineFreeMemoryMiB: 200 }
+    ]);
+    expect(secondTelemetry.store[0].machineInfo).toEqual({
+      ...expectedCpuInfo,
+      machineTotalMemoryMiB: 3000,
+      machineFreeMemoryMiB: 300
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json
new file mode 100644
index 00000000000..3be56ee0acf
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush-project.schema.json",
+  "operationSettings": [
+    {
+      "operationName": "build",
+      "sharding": {
+        "count": 2
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json
new file mode 100644
index 00000000000..969cbe63492
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "a",
+  "version": "1.0.0",
+  "scripts": {
+    "build": "echo collate a",
+    "build:shard": "echo shard a"
+  }
+}
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json
new file mode 100644
index 00000000000..a54e2a58c34
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [],
+  "parameters": [
+    {
+      "longName": "--pattern",
+      "description": "A pattern",
+      "parameterKind": "string",
+      "argumentName": "PATTERN",
+      "associatedCommands": ["build"]
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json
new file mode 100644
index 00000000000..e0f439d0632
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush.schema.json",
+  "rushVersion": "5.162.0",
+  "pnpmVersion": "8.15.9",
+  "nodeSupportedVersionRange": ">=20.0.0",
+  "projects": [
+    {
+      "packageName": "a",
+      "projectFolder": "a"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
index d372e354e6f..e282b924195 100644
--- a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
+++ b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
@@ -18,7 +18,11 @@ import type { OperationStatus } from '../logic/operations/OperationStatus';
 import type { IOperationRunnerContext } from '../logic/operations/IOperationRunner';
 import type { ITelemetryData } from '../logic/Telemetry';
 import type { IEnvironment } from '../utilities/Utilities';
-import type { IOperationGraph, IOperationGraphIterationOptions } from '../logic/operations/IOperationGraph';
+import type {
+  IOperationGraph,
+  IOperationGraphIterationOptions,
+  IOperationGraphRequestResult
+} from '../logic/operations/IOperationGraph';
 
 /**
  * Hooks into the execution process for operations within the graph.
@@ -27,9 +31,13 @@ import type { IOperationGraph, IOperationGraphIterationOptions } from '../logic/
  * 1. `configureIteration` - Synchronously decide which operations to enable for the next iteration.
  * 2. `onIterationScheduled` - Fires after the iteration is prepared but before execution begins, if it has any enabled operations.
  * 3. `beforeExecuteIterationAsync` - Async hook that can bail out the iteration entirely.
- * 4. Operations execute (status changes reported via `onExecutionStatesUpdated`).
+ * 4. Operations execute (status changes reported via `onExecutionStatesUpdated`). If another request joins the
+ *    iteration, `configureIteration` plans the iteration again, with `startedOperations` naming the operations that
+ *    were already dispatched. If the graph accepts the new plan, `extendIteration` prepares the operations that
+ *    changed.
  * 5. `afterExecuteIterationAsync` - Fires after all operations in the iteration have settled.
- * 6. `onIdle` - Fires when the graph enters idle state awaiting changes (watch mode only).
+ * 6. `afterExecuteRequestAsync` - Fires once for each request that the iteration served.
+ * 7. `onIdle` - Fires when the graph enters idle state awaiting changes (watch mode only).
  *
  * Additional hooks:
  * - `onEnableStatesChanged` - Fires when `setEnabledStates` mutates operation enabled flags.
@@ -52,6 +60,11 @@ export class OperationGraphHooks {
    *
    * If no operations are marked for execution, the iteration will not be scheduled.
    * If there is an existing scheduled iteration, it will remain.
+   *
+   * When `context.startedOperations` is set, the call plans an iteration that is already executing again, for the
+   * work of a request that joins it (see {@link IOperationGraph.tryExtendCurrentIteration}). The graph can still
+   * refuse that plan after this hook returns, and then discards it. A plugin that keeps state across iterations
+   * applies the effects of such a plan in `extendIteration`, which is called only for an accepted plan.
    */
   public readonly configureIteration: SyncHook<
     [
@@ -61,6 +74,20 @@ export class OperationGraphHooks {
     ]
   > = new SyncHook(['initialRecords', 'lastExecutedRecords', 'context'], 'configureIteration');
 
+  /**
+   * Hook invoked when the work of another request is added to an iteration that is already executing (see
+   * {@link IOperationGraph.tryExtendCurrentIteration}), before any of the given records is dispatched. It receives the
+   * records whose `enabled` state, runner policy or state hash changed, and the options of the extension, whose
+   * `inputsSnapshot` is the newer snapshot that the state hashes of these records were calculated from. A plugin that
+   * prepares state for each operation in `beforeExecuteIterationAsync` prepares it again here for these records.
+   *
+   * The options are the same object that the `configureIteration` call of the accepted plan received. A tap that
+   * throws aborts the iteration.
+   */
+  public readonly extendIteration: SyncHook<
+    [ReadonlyMap<Operation, IOperationExecutionResult>, IOperationGraphIterationOptions]
+  > = new SyncHook(['records', 'context'], 'extendIteration');
+
   /**
    * Hook invoked before operation start for an iteration. Allows a plugin to perform side-effects or
    * short-circuit the entire iteration.
@@ -147,12 +174,57 @@ export class OperationGraphHooks {
     [OperationStatus, ReadonlyMap<Operation, IOperationExecutionResult>, IOperationGraphIterationOptions]
   > = new AsyncSeriesWaterfallHook(['status', 'results', 'context'], 'afterExecuteIterationAsync');
 
+  /**
+   * Hook invoked once for each request for this graph's work, after the operations that the request selected have
+   * settled and before the request's result is reported. Use it instead of `afterExecuteIterationAsync` for work that
+   * describes one command's results, such as a build summary.
+   *
+   * @remarks
+   * A native command makes one request for each iteration, and invokes this hook after
+   * `afterExecuteIterationAsync`, with the iteration's final status and results.
+   *
+   * A long-lived host such as the Rush daemon can serve several requests with one iteration, and it serves a request
+   * whose operations are all up to date without any iteration, so the iteration hooks never fire for that request.
+   * The host invokes this hook once for each request it serves, including those, with only that request's
+   * results. Several requests can be in this hook at the same time.
+   *
+   * A host can also return a failed request as soon as nothing that still runs can change its result. It then
+   * invokes this hook while the iteration runs, and the request's results omit the operations that have not
+   * finished.
+   *
+   * The hook is not invoked for a request that ends without results: one whose iteration throws, or one that a
+   * long-lived host stops serving because its client cancelled the request or disconnected.
+   *
+   * If a tap throws, the request fails with that error.
+   */
+  public readonly afterExecuteRequestAsync: AsyncSeriesHook<[IOperationGraphRequestResult]> =
+    new AsyncSeriesHook(['request'], 'afterExecuteRequestAsync');
+
   /**
    * Hook invoked after executing an iteration, before the telemetry entry is written.
    * Allows the caller to augment or modify the log entry.
+   *
+   * @remarks
+   * Taps describe the iteration that just ran. A long-lived host such as the Rush daemon logs one entry for each
+   * request, and skips this hook for a request that it served without an iteration. Use `beforeLogRequest` for data
+   * that every entry needs.
    */
   public readonly beforeLog: SyncHook<ITelemetryData, void> = new SyncHook(['telemetryData'], 'beforeLog');
 
+  /**
+   * Hook invoked before any telemetry entry for this graph's work is written, including the entry of a request that
+   * a long-lived host such as the Rush daemon served without an iteration. Use it instead of `beforeLog` for data
+   * that does not describe an iteration, such as a flag that says that a plugin is active.
+   *
+   * @remarks
+   * A native command invokes this hook for each iteration's entry, before `beforeLog`. A long-lived host invokes it
+   * once for each request that it logs, and invokes `beforeLog` after it only if an iteration served the request.
+   */
+  public readonly beforeLogRequest: SyncHook<ITelemetryData, void> = new SyncHook(
+    ['telemetryData'],
+    'beforeLogRequest'
+  );
+
   /**
    * Hook invoked before executing a operation.
    */
diff --git a/libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts b/libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts
new file mode 100644
index 00000000000..485282fd32e
--- /dev/null
+++ b/libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { AsyncSeriesHook } from 'tapable';
+
+import type { IPhasedCommand, IRushCommand } from './RushLifeCycle';
+
+/** The plugin whose `apply()` added a tap to the `runAnyPhasedCommand` hook. */
+export interface IPhasedCommandHookTapOwner {
+  readonly pluginName: string;
+  readonly packageName: string;
+  /** Whether the plugin's manifest or the repository declares the plugin command-agnostic. */
+  readonly isCommandAgnostic: boolean;
+}
+
+type RushCommandHook = AsyncSeriesHook<IRushCommand>;
+type PhasedCommandHook = AsyncSeriesHook<IPhasedCommand>;
+type CommandHook = RushCommandHook | PhasedCommandHook;
+type CommandHookTap = CommandHook['taps'][number];
+
+// tapable keeps each tap object in `hook.taps` unless a register interceptor replaces it, and an intercepted
+// hook prevents sharing anyway.
+const tapOwners: WeakMap<object, IPhasedCommandHookTapOwner> = new WeakMap();
+
+/** Calls `apply` and records `owner` as the owner of every tap that it adds to `hook`. */
+export function applyAndAttributeTaps(
+  hook: CommandHook,
+  owner: IPhasedCommandHookTapOwner,
+  apply: () => void
+): void {
+  const previousTaps: ReadonlySet<CommandHookTap> = new Set(hook.taps);
+  try {
+    apply();
+  } finally {
+    for (const tap of hook.taps) {
+      if (!previousTaps.has(tap)) {
+        tapOwners.set(tap as object, owner);
+      }
+    }
+  }
+}
+
+/**
+ * Explains why the `runAnyPhasedCommand` hook prevents a daemon engine that one phased command created from
+ * serving another phased command, or returns undefined if it does not.
+ *
+ * @remarks
+ * Rush calls the hook once per engine, with the command that created the engine. The hook prevents sharing unless
+ * every tap was added by the `apply()` of a plugin that is declared command-agnostic. An interceptor, or a tap
+ * that no plugin's `apply()` added, prevents sharing.
+ */
+export function getCommandHookBlocker(hook: CommandHook, hookName: string): string | undefined {
+  if (!hook.isUsed()) {
+    return undefined;
+  }
+  // tapable doesn't declare the `interceptors` array that `isUsed()` reads.
+  const { interceptors } = hook as unknown as { interceptors?: ReadonlyArray<unknown> };
+  if (interceptors?.length !== 0) {
+    return `a plugin intercepts the ${hookName} hook`;
+  }
+  for (const tap of hook.taps) {
+    const owner: IPhasedCommandHookTapOwner | undefined = tapOwners.get(tap as object);
+    if (!owner) {
+      return `a plugin taps the ${hookName} hook outside its apply() (the tap "${tap.name}")`;
+    }
+    if (!owner.isCommandAgnostic) {
+      return (
+        `the plugin "${owner.pluginName}" (${owner.packageName}) taps the ${hookName} hook and is not ` +
+        'declared command-agnostic'
+      );
+    }
+  }
+  return undefined;
+}
+
+export function getRunAnyPhasedCommandBlocker(hook: PhasedCommandHook): string | undefined {
+  return getCommandHookBlocker(hook, 'runAnyPhasedCommand');
+}
diff --git a/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts b/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts
index 7528fe72ea7..fb4ed3a4383 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts
@@ -4,6 +4,7 @@
 import * as path from 'node:path';
 
 import {
+  FileConstants,
   FileSystem,
   JsonFile,
   NewlineKind,
@@ -13,6 +14,7 @@ import {
 } from '@rushstack/node-core-library';
 
 import type { IRushPluginConfiguration } from '../../api/RushPluginsConfiguration';
+import type { RushConfiguration } from '../../api/RushConfiguration';
 import { Autoinstaller } from '../../logic/Autoinstaller';
 import { RushConstants } from '../../logic/RushConstants';
 import {
@@ -53,7 +55,41 @@ export class AutoinstallerPluginLoader extends PluginLoaderBase<IRushPluginConfi
    * Example: `C:\MyRepo\common\autoinstallers\<autoinstaller_name>\rush-plugins`
    */
   public static getPluginAutoinstallerStorePath(autoinstaller: Autoinstaller): string {
-    return path.join(autoinstaller.folderFullPath, 'rush-plugins');
+    return getStorePath(autoinstaller.folderFullPath);
+  }
+
+  /**
+   * Files outside `common/config` from which Rush reads a configured plugin's manifest and command-line
+   * shape without loading the plugin: the autoinstaller package.json, and the cached manifest and
+   * command-line.json that `rush update` copies into the autoinstaller's store.
+   */
+  public static getPluginShapeFilePaths(
+    rushConfiguration: RushConfiguration,
+    pluginConfiguration: IRushPluginConfiguration
+  ): string[] {
+    const { autoinstallerName, packageName, pluginName } = pluginConfiguration;
+    const autoinstallerFolder: string = path.join(
+      rushConfiguration.commonAutoinstallersFolder,
+      autoinstallerName
+    );
+    const storePath: string = getStorePath(autoinstallerFolder);
+    return [
+      path.join(autoinstallerFolder, FileConstants.PackageJson),
+      getCachedManifestPath(storePath, packageName),
+      getCachedCommandLineJsonFilePath(storePath, packageName, pluginName)
+    ];
+  }
+
+  /**
+   * The installed package folder from which Rush loads a configured plugin's implementation
+   * (`common/autoinstallers/<name>/node_modules/<packageName>`). It may be a link to a folder elsewhere.
+   */
+  public static getPluginPackageFolder(
+    rushConfiguration: RushConfiguration,
+    pluginConfiguration: IRushPluginConfiguration
+  ): string {
+    const { autoinstallerName, packageName } = pluginConfiguration;
+    return path.join(rushConfiguration.commonAutoinstallersFolder, autoinstallerName, 'node_modules', packageName);
   }
 
   public update(): void {
@@ -155,19 +191,33 @@ export class AutoinstallerPluginLoader extends PluginLoaderBase<IRushPluginConfi
   }
 
   protected override _getManifestPath(): string {
-    return path.join(
+    return getCachedManifestPath(
       AutoinstallerPluginLoader.getPluginAutoinstallerStorePath(this.autoinstaller),
-      this.packageName,
-      RushConstants.rushPluginManifestFilename
+      this.packageName
     );
   }
 
   protected override _getCommandLineJsonFilePath(): string {
-    return path.join(
+    return getCachedCommandLineJsonFilePath(
       AutoinstallerPluginLoader.getPluginAutoinstallerStorePath(this.autoinstaller),
       this.packageName,
-      this.pluginName,
-      RushConstants.commandLineFilename
+      this.pluginName
     );
   }
 }
+
+function getStorePath(autoinstallerFolder: string): string {
+  return path.join(autoinstallerFolder, 'rush-plugins');
+}
+
+function getCachedManifestPath(storePath: string, packageName: string): string {
+  return path.join(storePath, packageName, RushConstants.rushPluginManifestFilename);
+}
+
+function getCachedCommandLineJsonFilePath(
+  storePath: string,
+  packageName: string,
+  pluginName: string
+): string {
+  return path.join(storePath, packageName, pluginName, RushConstants.commandLineFilename);
+}
diff --git a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
index d9fd335af06..bfdfd9003f3 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
@@ -18,6 +18,7 @@ import { CommandLineConfiguration } from '../../api/CommandLineConfiguration';
 import type { RushConfiguration } from '../../api/RushConfiguration';
 import type { IRushPluginConfigurationBase } from '../../api/RushPluginsConfiguration';
 import { RushConstants } from '../../logic/RushConstants';
+import { type JsonFileLoadCache, loadJsonFile } from '../../utilities/JsonFileLoadCache';
 import type { IRushPlugin } from '../IRushPlugin';
 import { RushSdk } from './RushSdk';
 import schemaJson from '../../schemas/rush-plugin-manifest.schema.json';
@@ -30,6 +31,13 @@ export interface IRushPluginManifest {
   associatedCommands?: string[];
   commandLineJsonFilePath?: string;
   rushVersionRange?: string;
+  /** Declares that the plugin honors the long-lived daemon engine lifecycle. */
+  daemonCompatible?: boolean;
+  /**
+   * Declares that what the plugin does from the `initialize` and `runAnyPhasedCommand` hooks doesn't depend on the
+   * command, so its taps there don't stop one daemon engine from serving several phased commands.
+   */
+  daemonCommandAgnostic?: boolean;
 }
 
 export interface IRushPluginManifestJson {
@@ -40,6 +48,8 @@ export interface IPluginLoaderOptions<TPluginConfiguration extends IRushPluginCo
   pluginConfiguration: TPluginConfiguration;
   rushConfiguration: RushConfiguration;
   terminal: ITerminal;
+  /** The cache of a long-lived engine host, through which the loader reads the plugin's JSON files. */
+  jsonFileLoadCache?: JsonFileLoadCache;
 }
 
 export abstract class PluginLoaderBase<
@@ -54,6 +64,7 @@ export abstract class PluginLoaderBase<
 
   protected _manifestCache: Readonly<IRushPluginManifest> | undefined;
   #packageVersionCache: string | undefined;
+  readonly #jsonFileLoadCache: JsonFileLoadCache | undefined;
 
   /**
    * The folder that should be used for resolving the plugin's NPM package.
@@ -63,12 +74,14 @@ export abstract class PluginLoaderBase<
   public constructor({
     pluginConfiguration,
     rushConfiguration,
-    terminal
+    terminal,
+    jsonFileLoadCache
   }: IPluginLoaderOptions<TPluginConfiguration>) {
     this.packageName = pluginConfiguration.packageName;
     this.pluginName = pluginConfiguration.pluginName;
     this._rushConfiguration = rushConfiguration;
     this._terminal = terminal;
+    this.#jsonFileLoadCache = jsonFileLoadCache;
   }
 
   public load(): IRushPlugin | undefined {
@@ -107,7 +120,7 @@ export abstract class PluginLoaderBase<
       return undefined;
     }
     const commandLineConfiguration: CommandLineConfiguration | undefined =
-      CommandLineConfiguration.tryLoadFromFile(commandLineJsonFilePath);
+      CommandLineConfiguration.tryLoadFromFile(commandLineJsonFilePath, this.#jsonFileLoadCache);
     if (!commandLineConfiguration) {
       return undefined;
     }
@@ -228,9 +241,13 @@ export abstract class PluginLoaderBase<
         );
       }
 
-      const rushPluginManifestJson: IRushPluginManifestJson = JsonFile.loadAndValidate(
+      const rushPluginManifestJson: IRushPluginManifestJson = loadJsonFile(
+        this.#jsonFileLoadCache,
         manifestPath,
-        PluginLoaderBase._jsonSchema
+        (json) => {
+          PluginLoaderBase._jsonSchema.validateObject(json, manifestPath);
+          return json as IRushPluginManifestJson;
+        }
       );
 
       const pluginManifest: IRushPluginManifest | undefined = rushPluginManifestJson.plugins.find(
diff --git a/libraries/rush-lib/src/pluginFramework/PluginManager.ts b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
index 38d3b69cf41..eff700af5f1 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginManager.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { FileSystem, Import, InternalError } from '@rushstack/node-core-library';
+import { FileSystem, Import, InternalError, type IPackageJson } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
 
 import type { CommandLineConfiguration } from '../api/CommandLineConfiguration';
@@ -9,10 +9,14 @@ import type { RushConfiguration } from '../api/RushConfiguration';
 import { BuiltInPluginLoader, type IBuiltInPluginConfiguration } from './PluginLoader/BuiltInPluginLoader';
 import type { IRushPlugin } from './IRushPlugin';
 import { AutoinstallerPluginLoader } from './PluginLoader/AutoinstallerPluginLoader';
+import { applyAndAttributeTaps, type IPhasedCommandHookTapOwner } from './PhasedCommandHookTaps';
 import { _createRushSessionForPlugin, type RushSession } from './RushSession';
-import type { PluginLoaderBase } from './PluginLoader/PluginLoaderBase';
+import type { PluginLoaderBase, IRushPluginManifest } from './PluginLoader/PluginLoaderBase';
 import { Rush } from '../api/Rush';
 import type { RushGlobalFolder } from '../api/RushGlobalFolder';
+import { findNodeModulesPackageFolder } from '../utilities/RushLibPathHandoff';
+import { rushLibPathHandoff } from '../utilities/SetRushLibPath';
+import type { JsonFileLoadCache } from '../utilities/JsonFileLoadCache';
 
 export interface IPluginManagerOptions {
   terminal: ITerminal;
@@ -21,6 +25,8 @@ export interface IPluginManagerOptions {
   builtInPluginConfigurations: IBuiltInPluginConfiguration[];
   restrictConsoleOutput: boolean;
   rushGlobalFolder: RushGlobalFolder;
+  /** The cache of a long-lived engine host, through which plugin loaders read the plugins' JSON files. */
+  jsonFileLoadCache?: JsonFileLoadCache;
 }
 
 export interface ICustomCommandLineConfigurationInfo {
@@ -61,19 +67,42 @@ export class PluginManager {
     // "publishOnlyDependencies" which gets moved into "dependencies" during publishing.
     const builtInPluginConfigurations: IBuiltInPluginConfiguration[] = options.builtInPluginConfigurations;
 
-    const ownPackageJsonDependencies: Record<string, string> = Rush._rushLibPackageJson.dependencies || {};
+    const ownPackageJson: IPackageJson & { publishOnlyDependencies?: Record<string, string> } =
+      Rush._rushLibPackageJson;
+    const ownPackageJsonDependencies: Record<string, string> = ownPackageJson.dependencies || {};
+    const publishOnlyDependencies: Record<string, string> = ownPackageJson.publishOnlyDependencies || {};
     function tryAddBuiltInPlugin(builtInPluginName: string, pluginPackageName?: string): void {
       if (!pluginPackageName) {
         pluginPackageName = `@rushstack/${builtInPluginName}`;
       }
+      if (
+        builtInPluginConfigurations.some(
+          ({ packageName, pluginName }) =>
+            packageName === pluginPackageName && pluginName === builtInPluginName
+        )
+      ) {
+        // The host already provides this plugin, as apps/rush/src/start-dev.ts does.
+        return;
+      }
+      let pluginPackageFolder: string | undefined;
       if (ownPackageJsonDependencies[pluginPackageName]) {
+        pluginPackageFolder = Import.resolvePackage({
+          packageName: pluginPackageName,
+          baseFolderPath: __dirname
+        });
+      } else if (publishOnlyDependencies[pluginPackageName] && rushLibPathHandoff) {
+        // An unpublished rush-lib, such as one in a "rush deploy" output, uses the plugins that its host
+        // installed next to the rush-lib link that _RUSH_LIB_PATH goes through.
+        pluginPackageFolder = findNodeModulesPackageFolder(
+          rushLibPathHandoff.packageFolder,
+          pluginPackageName
+        );
+      }
+      if (pluginPackageFolder) {
         builtInPluginConfigurations.push({
           packageName: pluginPackageName,
           pluginName: builtInPluginName,
-          pluginPackageFolder: Import.resolvePackage({
-            packageName: pluginPackageName,
-            baseFolderPath: __dirname
-          })
+          pluginPackageFolder
         });
       }
     }
@@ -93,7 +122,8 @@ export class PluginManager {
       return new BuiltInPluginLoader({
         pluginConfiguration,
         rushConfiguration: this.#rushConfiguration,
-        terminal: this.#terminal
+        terminal: this.#terminal,
+        jsonFileLoadCache: options.jsonFileLoadCache
       });
     });
 
@@ -105,7 +135,8 @@ export class PluginManager {
         rushConfiguration: this.#rushConfiguration,
         terminal: this.#terminal,
         restrictConsoleOutput: this.#restrictConsoleOutput,
-        rushGlobalFolder: this.#rushGlobalFolder
+        rushGlobalFolder: this.#rushGlobalFolder,
+        jsonFileLoadCache: options.jsonFileLoadCache
       });
     });
   }
@@ -123,6 +154,11 @@ export class PluginManager {
     return this.#loadedPluginNames;
   }
 
+  /** The `pluginName` of every plugin configured in rush-plugins.json, whether or not it has been loaded. */
+  public get configuredPluginNames(): ReadonlySet<string> {
+    return new Set(this.#autoinstallerPluginLoaders.map((pluginLoader) => pluginLoader.pluginName));
+  }
+
   public async updateAsync(): Promise<void> {
     await this._preparePluginAutoinstallersAsync(this.#autoinstallerPluginLoaders);
     const preparedAutoinstallerNames: Set<string> = new Set<string>();
@@ -200,6 +236,92 @@ export class PluginManager {
     return commandLineConfigurationInfos;
   }
 
+  /**
+   * Explains why configured autoinstaller plugins prevent a long-lived engine from serving the specified
+   * phased command.
+   *
+   * @remarks
+   * A plugin is compatible with a long-lived engine if its manifest sets `daemonCompatible` or its name is in
+   * `compatiblePluginNames`. Any other plugin is inert for the command only if Rush will neither initialize it
+   * (it is associated with specific commands, none of which is this command) nor use its command-line.json to
+   * define the command, a phase of the command, or a parameter associated with either. A manifest or
+   * command-line file that cannot be read is reported rather than assumed to be compatible or inert.
+   *
+   * @returns An empty array if every configured autoinstaller plugin is compatible with, or inert for, the command.
+   */
+  public getPluginsIncompatibleWithEngine(
+    commandName: string,
+    phaseNames: ReadonlySet<string>,
+    compatiblePluginNames: ReadonlySet<string>
+  ): ReadonlyArray<string> {
+    const reasons: string[] = [];
+    for (const pluginLoader of this.#autoinstallerPluginLoaders) {
+      const pluginLabel: string = `"${pluginLoader.pluginName}" (${pluginLoader.packageName})`;
+      let manifest: IRushPluginManifest;
+      try {
+        manifest = pluginLoader.pluginManifest;
+      } catch (error) {
+        reasons.push(`${pluginLabel}: its manifest could not be read: ${(error as Error).message}`);
+        continue;
+      }
+
+      let commandLineConfiguration: CommandLineConfiguration | undefined;
+      try {
+        commandLineConfiguration = pluginLoader.getCommandLineConfiguration();
+      } catch (error) {
+        reasons.push(`${pluginLabel}: its command-line.json could not be read: ${(error as Error).message}`);
+        continue;
+      }
+      if (manifest.daemonCompatible || compatiblePluginNames.has(pluginLoader.pluginName)) {
+        continue;
+      }
+
+      const { associatedCommands } = manifest;
+      if (!associatedCommands) {
+        reasons.push(`${pluginLabel} is initialized for every command`);
+      } else if (associatedCommands.includes(commandName)) {
+        reasons.push(`${pluginLabel} is associated with "${commandName}"`);
+      }
+      if (!commandLineConfiguration) {
+        continue;
+      }
+      if (commandLineConfiguration.commands.has(commandName)) {
+        reasons.push(`${pluginLabel} defines the "${commandName}" command`);
+      }
+      for (const phaseName of commandLineConfiguration.phases.keys()) {
+        if (phaseNames.has(phaseName)) {
+          reasons.push(`${pluginLabel} defines the "${phaseName}" phase`);
+        }
+      }
+      for (const parameter of commandLineConfiguration.parameters) {
+        const { longName, associatedPhases } = parameter;
+        if (parameter.associatedCommands?.includes(commandName)) {
+          reasons.push(`${pluginLabel} associates "${longName}" with "${commandName}"`);
+        }
+        for (const phaseName of associatedPhases ?? []) {
+          if (phaseNames.has(phaseName)) {
+            reasons.push(`${pluginLabel} associates "${longName}" with the "${phaseName}" phase`);
+          }
+        }
+      }
+    }
+    return reasons;
+  }
+
+  /**
+   * The configured plugins that Rush initializes for the specified command because their manifests associate them
+   * with it, as sorted `packageName:pluginName` keys. Plugins that are not associated with specific commands are
+   * initialized for every command, and are not included.
+   */
+  public getPluginsAssociatedWithCommand(commandName: string): ReadonlyArray<string> {
+    return [
+      ...this.#getPluginLoadersForCommand(commandName, this.#builtInPluginLoaders),
+      ...this.#getPluginLoadersForCommand(commandName, this.#autoinstallerPluginLoaders)
+    ]
+      .map(({ packageName, pluginName }) => `${packageName}:${pluginName}`)
+      .sort();
+  }
+
   #initializePlugins(pluginLoaders: PluginLoaderBase[]): void {
     for (const pluginLoader of pluginLoaders) {
       const pluginName: string = pluginLoader.pluginName;
@@ -239,9 +361,29 @@ export class PluginManager {
         packageVersion: pluginLoader.packageVersion,
         component: pluginName
       }));
-      plugin.apply(pluginSession, this.#rushConfiguration);
+      const tapOwner: IPhasedCommandHookTapOwner = {
+        pluginName,
+        packageName,
+        isCommandAgnostic: this.#isCommandAgnostic(pluginLoader)
+      };
+      applyAndAttributeTaps(this.#rushSession.hooks.initialize, tapOwner, () =>
+        applyAndAttributeTaps(this.#rushSession.hooks.runAnyPhasedCommand, tapOwner, () =>
+          plugin.apply(pluginSession, this.#rushConfiguration)
+        )
+      );
     } catch (e) {
       throw new InternalError(`Error applying "${pluginName}": ${e}`);
     }
   }
+
+  #isCommandAgnostic(pluginLoader: PluginLoaderBase): boolean {
+    if (pluginLoader.pluginManifest.daemonCommandAgnostic === true) {
+      return true;
+    }
+    // Like daemon.compatiblePlugins, the repository's list names plugins that rush-plugins.json configures.
+    return (
+      pluginLoader instanceof AutoinstallerPluginLoader &&
+      this.#rushConfiguration.daemon.commandAgnosticPlugins.includes(pluginLoader.pluginName)
+    );
+  }
 }
diff --git a/libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts b/libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts
new file mode 100644
index 00000000000..f51911b2380
--- /dev/null
+++ b/libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts
@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { AsyncSeriesHook } from 'tapable';
+
+import {
+  applyAndAttributeTaps,
+  getRunAnyPhasedCommandBlocker,
+  type IPhasedCommandHookTapOwner
+} from '../PhasedCommandHookTaps';
+import type { IPhasedCommand } from '../RushLifeCycle';
+
+function createHook(): AsyncSeriesHook<IPhasedCommand> {
+  return new AsyncSeriesHook<IPhasedCommand>(['command'], 'runAnyPhasedCommand');
+}
+
+function createOwner(pluginName: string, isCommandAgnostic: boolean): IPhasedCommandHookTapOwner {
+  return { pluginName, packageName: `@example/${pluginName}`, isCommandAgnostic };
+}
+
+describe('PhasedCommandHookTaps', () => {
+  it('does not block a hook that nothing taps or intercepts', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', false), () => {});
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBeUndefined();
+  });
+
+  it('attributes only the taps that apply() adds, including taps with options', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', true), () => {
+      hook.tapPromise('a', async () => {});
+      hook.withOptions({ stage: -1 }).tap('a-early', () => {});
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBeUndefined();
+
+    applyAndAttributeTaps(hook, createOwner('rush-b-plugin', false), () => {
+      hook.tap({ name: 'b', before: 'a' }, () => {});
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe(
+      'the plugin "rush-b-plugin" (@example/rush-b-plugin) taps the runAnyPhasedCommand hook and is not ' +
+        'declared command-agnostic'
+    );
+  });
+
+  it('blocks a tap that no apply() added', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    hook.tap('before', () => {});
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', true), () => {
+      hook.tap('a', () => {});
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe(
+      'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "before")'
+    );
+
+    const later: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(later, createOwner('rush-a-plugin', true), () => {
+      later.tap('a', () => {});
+    });
+    later.tap('after', () => {});
+    expect(getRunAnyPhasedCommandBlocker(later)).toBe(
+      'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "after")'
+    );
+  });
+
+  it('attributes the taps of an apply() that throws', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    expect(() =>
+      applyAndAttributeTaps(hook, createOwner('rush-a-plugin', false), () => {
+        hook.tap('a', () => {});
+        throw new Error('apply failed');
+      })
+    ).toThrow('apply failed');
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe(
+      'the plugin "rush-a-plugin" (@example/rush-a-plugin) taps the runAnyPhasedCommand hook and is not ' +
+        'declared command-agnostic'
+    );
+  });
+
+  it('blocks an intercepted hook, even without taps', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', true), () => {
+      hook.intercept({ call: () => {} });
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe('a plugin intercepts the runAnyPhasedCommand hook');
+  });
+});
diff --git a/libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts b/libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts
new file mode 100644
index 00000000000..443e90a2937
--- /dev/null
+++ b/libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts
@@ -0,0 +1,129 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+let mockRushLibPathHandoff: IRushLibPathHandoff | undefined;
+jest.mock('../../utilities/SetRushLibPath', () => ({
+  get rushLibPathHandoff(): IRushLibPathHandoff | undefined {
+    return mockRushLibPathHandoff;
+  }
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IPackageJson } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { Rush } from '../../api/Rush';
+import type { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushGlobalFolder } from '../../api/RushGlobalFolder';
+import type { IRushLibPathHandoff } from '../../utilities/RushLibPathHandoff';
+import type { IBuiltInPluginConfiguration } from '../PluginLoader/BuiltInPluginLoader';
+import { PluginManager } from '../PluginManager';
+import type { RushSession } from '../RushSession';
+
+const S3_PACKAGE: string = '@rushstack/rush-amazon-s3-build-cache-plugin';
+const AZURE_PACKAGE: string = '@rushstack/rush-azure-storage-build-cache-plugin';
+const HTTP_PACKAGE: string = '@rushstack/rush-http-build-cache-plugin';
+
+describe(PluginManager.name, () => {
+  let folder: string;
+  let hostNodeModules: string;
+
+  function addBuiltInPlugins(
+    builtInPluginConfigurations: IBuiltInPluginConfiguration[]
+  ): IBuiltInPluginConfiguration[] {
+    // The constructor adds Rush's own built-in plugins to the host's list.
+    new PluginManager({
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      rushConfiguration: undefined as unknown as RushConfiguration,
+      rushSession: {} as RushSession,
+      builtInPluginConfigurations,
+      restrictConsoleOutput: false,
+      rushGlobalFolder: {} as RushGlobalFolder
+    });
+    return builtInPluginConfigurations;
+  }
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-plugin-manager-')));
+    hostNodeModules = path.join(folder, 'deploy', 'apps', 'host', 'node_modules');
+    const rushLibLink: string = path.join(hostNodeModules, '@microsoft', 'rush-lib');
+    fs.mkdirSync(rushLibLink, { recursive: true });
+    fs.writeFileSync(path.join(rushLibLink, 'package.json'), '{}');
+    for (const packageName of [S3_PACKAGE, AZURE_PACKAGE]) {
+      fs.mkdirSync(path.join(hostNodeModules, packageName), { recursive: true });
+      fs.writeFileSync(path.join(hostNodeModules, packageName, 'package.json'), '{}');
+    }
+    mockRushLibPathHandoff = {
+      entryPoint: path.join(rushLibLink, 'lib-commonjs', 'index.js'),
+      packageFolder: rushLibLink
+    };
+    jest.spyOn(Rush, '_rushLibPackageJson', 'get').mockReturnValue({
+      name: '@microsoft/rush-lib',
+      version: '1.0.0',
+      dependencies: {},
+      publishOnlyDependencies: {
+        [S3_PACKAGE]: 'workspace:*',
+        [AZURE_PACKAGE]: 'workspace:*',
+        [HTTP_PACKAGE]: 'workspace:*'
+      }
+    } as IPackageJson);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('registers publish-only built-in plugins that the host installed next to its rush-lib link', () => {
+    expect(addBuiltInPlugins([])).toEqual([
+      {
+        packageName: S3_PACKAGE,
+        pluginName: 'rush-amazon-s3-build-cache-plugin',
+        pluginPackageFolder: path.join(hostNodeModules, S3_PACKAGE)
+      },
+      {
+        packageName: AZURE_PACKAGE,
+        pluginName: 'rush-azure-storage-build-cache-plugin',
+        pluginPackageFolder: path.join(hostNodeModules, AZURE_PACKAGE)
+      },
+      {
+        packageName: AZURE_PACKAGE,
+        pluginName: 'rush-azure-interactive-auth-plugin',
+        pluginPackageFolder: path.join(hostNodeModules, AZURE_PACKAGE)
+      }
+    ]);
+  });
+
+  it('does not add a built-in plugin that the host already provides', () => {
+    const hostAzurePlugin: IBuiltInPluginConfiguration = {
+      packageName: AZURE_PACKAGE,
+      pluginName: 'rush-azure-storage-build-cache-plugin',
+      pluginPackageFolder: path.join(folder, 'dev', AZURE_PACKAGE)
+    };
+
+    expect(
+      addBuiltInPlugins([hostAzurePlugin]).map(({ pluginName, pluginPackageFolder }) => [
+        pluginName,
+        pluginPackageFolder
+      ])
+    ).toEqual([
+      ['rush-azure-storage-build-cache-plugin', path.join(folder, 'dev', AZURE_PACKAGE)],
+      ['rush-amazon-s3-build-cache-plugin', path.join(hostNodeModules, S3_PACKAGE)],
+      ['rush-azure-interactive-auth-plugin', path.join(hostNodeModules, AZURE_PACKAGE)]
+    ]);
+  });
+
+  it('registers no publish-only plugin when rush-lib is not linked next to it', () => {
+    const localRushLib: string = path.join(folder, 'deploy', 'libraries', 'rush-lib');
+    fs.mkdirSync(localRushLib, { recursive: true });
+    mockRushLibPathHandoff = {
+      entryPoint: path.join(localRushLib, 'lib-commonjs', 'index.js'),
+      packageFolder: localRushLib
+    };
+
+    expect(addBuiltInPlugins([])).toEqual([]);
+  });
+});
diff --git a/libraries/rush-lib/src/schemas/build-cache.schema.json b/libraries/rush-lib/src/schemas/build-cache.schema.json
index 2c7e8fd6967..6eb4fe08550 100644
--- a/libraries/rush-lib/src/schemas/build-cache.schema.json
+++ b/libraries/rush-lib/src/schemas/build-cache.schema.json
@@ -71,6 +71,12 @@
               "description": "The Azure environment the storage account exists in. Defaults to AzurePublicCloud.",
               "enum": ["AzurePublicCloud", "AzureChina", "AzureGermany", "AzureGovernment"]
             },
+            "storageEndpoint": {
+              "type": "string",
+              "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. The URL must start with \"http://\" or \"https://\". A credential saved by \"rush update-cloud-credentials\" is used only with the endpoint that it was saved for. An Azure login (\"rush update-cloud-credentials --interactive\") needs an \"https://\" endpoint. For an \"http://\" endpoint, such as Azurite, provide a SAS token with \"rush update-cloud-credentials --credential\" or the RUSH_BUILD_CACHE_CREDENTIAL environment variable, or read without a credential. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
+              "format": "uri",
+              "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://"
+            },
             "loginFlow": {
               "$ref": "#/definitions/entraLoginFlow"
             },
diff --git a/libraries/rush-lib/src/schemas/command-line.schema.json b/libraries/rush-lib/src/schemas/command-line.schema.json
index 195235d8e7f..399e6fd2f9d 100644
--- a/libraries/rush-lib/src/schemas/command-line.schema.json
+++ b/libraries/rush-lib/src/schemas/command-line.schema.json
@@ -300,6 +300,7 @@
             "allowOversubscription": { "$ref": "#/definitions/anything" },
             "incremental": { "$ref": "#/definitions/anything" },
             "phases": { "$ref": "#/definitions/anything" },
+            "disableBuildCache": { "$ref": "#/definitions/anything" },
             "watchOptions": { "$ref": "#/definitions/anything" },
             "installOptions": { "$ref": "#/definitions/anything" }
           }
diff --git a/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json b/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
index 43cfaf13b74..8fe1a7bb19e 100644
--- a/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
+++ b/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
@@ -46,6 +46,14 @@
             "description": "Specifies the semver range of Rush versions supported by this plugin.",
             "type": "string",
             "minLength": 1
+          },
+          "daemonCompatible": {
+            "description": "If true, the plugin declares that it works in a long-lived Rush daemon engine, where one applied instance serves many requests: its session hooks and createOperationsAsync run once per engine (with isWatch false), and its operation graph hooks run for each iteration. Such a plugin does not change process globals (such as process.env, process.exitCode, the working directory or global timers), keeps no per-request state in the process, never prompts, reads the operation environment rather than the daemon's process.env, and releases its resources when the engine is disposed. Without it, the daemon runs commands that the plugin participates in with in-process Rush, unless the repository lists the plugin in the rush.json \"daemon.compatiblePlugins\" setting.",
+            "type": "boolean"
+          },
+          "daemonCommandAgnostic": {
+            "description": "If true, the plugin declares that what it does from the initialize and runAnyPhasedCommand hooks doesn't depend on the command: the callbacks that its apply() taps there, and the command hooks that those callbacks tap in turn (such as createOperationsAsync and onGraphCreatedAsync), don't read the command's name, its parameters, its phase selection or isIncrementalBuildAllowed. Rush calls initialize and runAnyPhasedCommand once per daemon engine, with the command that created the engine, so without this declaration an engine serves no other command while the plugin taps either hook, unless the repository lists the plugin in the rush.json \"daemon.commandAgnosticPlugins\" setting. Taps of runPhasedCommand still prevent sharing, because Rush calls them for one command only.",
+            "type": "boolean"
           }
         }
       }
diff --git a/libraries/rush-lib/src/schemas/rush-project.schema.json b/libraries/rush-lib/src/schemas/rush-project.schema.json
index e45130007ce..67173fd2c9e 100644
--- a/libraries/rush-lib/src/schemas/rush-project.schema.json
+++ b/libraries/rush-lib/src/schemas/rush-project.schema.json
@@ -60,6 +60,11 @@
             }
           },
 
+          "allowDaemonWarmWorker": {
+            "type": "boolean",
+            "description": "If true, and daemon.warmWorkers is enabled, the Rush daemon keeps the operation's \"<phase>:incremental:ipc\" script running as a warm worker between builds, and sends it the incremental runs that the incremental execution guard allows. Set this only if that script, run in watch mode, runs every task and check that the \"<phase>\" script runs, because the daemon reports a run on the worker as if the \"<phase>\" script had run. For Heft, that means the \"lintInWatchMode\" option of heft-lint-plugin and the \"runInWatchMode\" setting of API Extractor, which both default to skipping their task in watch mode."
+          },
+
           "outputFolderNames": {
             "type": "array",
             "description": "Specify the folders where this operation writes its output files. If enabled, the Rush build cache will restore these folders from the cache. The strings are folder names under the project root folder. These folders should not be tracked by Git. They must not contain symlinks.",
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 801ccdafc3b..9a2025bd038 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -277,6 +277,31 @@
           "default": false,
           "description": "Enable explicit operationSettings[].daemonIpc Node launchers for incremental daemon builds. Never enables watch mode or unrequested execution. RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS overrides."
         },
+        "incrementalBuilds": {
+          "type": "boolean",
+          "default": true,
+          "description": "Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited since then and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. Results of an incremental script are not written to the build cache. RUSH_DAEMON_INCREMENTAL_BUILDS overrides."
+        },
+        "warmWorkers": {
+          "type": "boolean",
+          "default": false,
+          "description": "Keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose rush-project.json operation settings set `allowDaemonWarmWorker`, and send it the next incremental run when incrementalBuilds allows one. Otherwise the worker is closed and the initial script runs. Requires incrementalBuilds. RUSH_DAEMON_WARM_WORKERS overrides."
+        },
+        "joinRunningBatch": {
+          "type": "boolean",
+          "default": false,
+          "description": "Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Experimental. RUSH_DAEMON_JOIN_RUNNING_BATCH overrides."
+        },
+        "deferCacheWrites": {
+          "type": "boolean",
+          "default": false,
+          "description": "Let an operation of a daemon build complete before its build cache entry is written. The daemon clones the operation's output files, on a file system that can clone files (such as Btrfs, XFS or APFS), and writes the entry from the clones in the background, so that the operations that depend on it and the command don't wait for the entry. An operation waits at most half a second for its clones. Slower clones finish in the background, and the entry is dropped if an output file changes before it is cloned. Otherwise, and in cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be written in the background doesn't change the operation's status, and the daemon drops the entries that it hasn't written when it stops. RUSH_DAEMON_DEFER_CACHE_WRITES overrides."
+        },
+        "backgroundPrepare": {
+          "type": "boolean",
+          "default": false,
+          "description": "Let an idle daemon load the next workspace graph and create its engine once the workspace inputs change in a way that the next request would otherwise reload for, so that the next request with the same command line as the last one starts on a bound engine. It never runs an operation, and a request that it cannot serve stops it. Experimental. RUSH_DAEMON_BACKGROUND_PREPARE overrides."
+        },
         "queueTimeoutSeconds": {
           "type": "number",
           "minimum": 0,
@@ -290,7 +315,7 @@
           "exclusiveMinimum": true,
           "maximum": 2147483.647,
           "default": 300,
-          "description": "Idle resource expiration for an attached warm set in seconds, at most 2147483.647 (the signed 32-bit millisecond limit of setTimeout). RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS overrides."
+          "description": "Idle resource expiration for an attached warm set in seconds, at most 2147483.647 (the signed 32-bit millisecond limit of setTimeout). Retained results of resource-free projects do not expire. RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS overrides."
         },
         "warmMemoryBudgetMB": {
           "type": "number",
@@ -298,7 +323,7 @@
           "exclusiveMinimum": true,
           "maximum": 9007199254740991,
           "default": 512,
-          "description": "Best-effort sampled RSS budget in MiB, not a hard process/tree memory ceiling. At most 9007199254740991 (Number.MAX_SAFE_INTEGER). Active/protected work is exempt. RUSH_DAEMON_WARM_MEMORY_BUDGET_MB overrides."
+          "description": "Best-effort sampled RSS budget in MiB, not a hard process/tree memory ceiling. At most 9007199254740991 (Number.MAX_SAFE_INTEGER). Active/protected work and retained results of resource-free projects are exempt. RUSH_DAEMON_WARM_MEMORY_BUDGET_MB overrides."
         },
         "warmSetMaxProjects": {
           "type": "integer",
@@ -311,6 +336,24 @@
           "type": "boolean",
           "default": false,
           "description": "Prefer measured time-saved * frequency / resident-memory retention over LRU. Never starts unrequested scripts. RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY overrides."
+        },
+        "compatiblePlugins": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[^\\s,](?:[^,]*[^\\s,])?$"
+          },
+          "default": [],
+          "description": "Names of configured Rush plugins (their pluginName in rush-plugins.json) that this repository has verified for long-lived daemon engines, in addition to plugins whose manifest sets daemonCompatible. A daemon request for a command that any other configured plugin participates in runs with in-process Rush. RUSH_DAEMON_COMPATIBLE_PLUGINS (a comma-separated list) overrides."
+        },
+        "commandAgnosticPlugins": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[^\\s,](?:[^,]*[^\\s,])?$"
+          },
+          "default": [],
+          "description": "Names of configured Rush plugins (their pluginName in rush-plugins.json) that this repository has verified to be command-agnostic, in addition to plugins whose manifest sets daemonCommandAgnostic. What such a plugin does from the initialize and runAnyPhasedCommand hooks doesn't depend on the command: it doesn't read the command's name, its parameters, its phase selection or isIncrementalBuildAllowed. A daemon engine created by one command serves another command only if every plugin that taps initialize or runAnyPhasedCommand is command-agnostic. RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS (a comma-separated list) overrides."
         }
       }
     },
diff --git a/libraries/rush-lib/src/utilities/FileContentStamp.ts b/libraries/rush-lib/src/utilities/FileContentStamp.ts
new file mode 100644
index 00000000000..646ed7b6278
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/FileContentStamp.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+/**
+ * A file whose ctime or mtime is newer than this many milliseconds must not be memoized by its stamp.
+ *
+ * @remarks
+ * Every write updates a file's ctime, and userspace can't set it. A stamp recorded for a file whose last change
+ * was already this old can't hide a later write, because that write gets a newer ctime even on a filesystem
+ * whose timestamps have a coarse granularity (a jiffy on Linux, 2 seconds on FAT). The argument assumes that the
+ * filesystem's clock agrees with this process's clock to within this margin, as a local filesystem's does.
+ */
+export const SETTLED_FILE_AGE_MS: number = 3000;
+
+/** The stamp recorded for a path that doesn't exist. */
+export const MISSING_FILE_STAMP: string = 'missing';
+
+/**
+ * The ctime and mtime a file must be older than for its stamp to be memoized. Take it before examining any of
+ * the files, so that a write made after a file's examination gets a later ctime.
+ */
+export function getSettledBeforeNs(): bigint {
+  return BigInt(Date.now() - SETTLED_FILE_AGE_MS) * BigInt(1e6);
+}
+
+/** Identifies a file's content by the identity, size, nanosecond mtime and ctime of the file it reaches. */
+export function getFileStamp(stat: fs.BigIntStats): string {
+  return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+}
+
+/** Whether a file examined after `settledBeforeNs` was taken may be memoized by its stamp. */
+export function isFileStatSettled(stat: fs.BigIntStats, settledBeforeNs: bigint): boolean {
+  return stat.ctimeNs < settledBeforeNs && stat.mtimeNs < settledBeforeNs;
+}
diff --git a/libraries/rush-lib/src/utilities/JsonFileLoadCache.ts b/libraries/rush-lib/src/utilities/JsonFileLoadCache.ts
new file mode 100644
index 00000000000..75814c86a26
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/JsonFileLoadCache.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { FileSystem, JsonFile, type JsonObject } from '@rushstack/node-core-library';
+
+import type { RushConfiguration } from '../api/RushConfiguration';
+
+interface ICacheEntry {
+  readonly text: string;
+  readonly value: unknown;
+}
+
+/**
+ * Memoizes what a long-lived engine host derives from each JSON configuration file, keyed by the file's text.
+ *
+ * @remarks
+ * The host parses a command line for every request, and each parse loads the same files: command-line.json, each
+ * plugin's manifest and command-line.json, and the package.json of each autoinstaller that a command names. Parsing
+ * and validating them costs several times what reading them does. A load through this cache still reads the file,
+ * so it sees the file as it is now, but it parses the text and derives the value again only if the text differs from
+ * the text of the file's last successful load. Each load returns its own copy of the value.
+ */
+export class JsonFileLoadCache {
+  readonly #entries: Map<string, ICacheEntry> = new Map();
+
+  /**
+   * Returns `deriveValue(JsonFile.load(filePath))`, and throws the errors that it would throw.
+   *
+   * @param deriveValue - Validates and transforms the file's contents. Its result must depend only on its argument
+   * (and on values that never change, such as the file path), and it must not keep a reference to its result.
+   */
+  public load<T>(filePath: string, deriveValue: (json: JsonObject) => T): T {
+    let text: string;
+    let value: T;
+    try {
+      text = FileSystem.readFile(filePath);
+      const entry: ICacheEntry | undefined = this.#entries.get(filePath);
+      if (entry?.text === text) {
+        return structuredClone(entry.value) as T;
+      }
+      value = deriveValue(JsonFile.parseString(text));
+    } catch (error) {
+      if (FileSystem.isNotExistError(error as Error)) {
+        // JsonFile.load throws this error as it is.
+        throw error;
+      }
+      // Load the file as a caller without this cache does, so that the error and its message are the same.
+      return deriveValue(JsonFile.load(filePath));
+    }
+    this.#entries.set(filePath, { text, value: structuredClone(value) });
+    return value;
+  }
+}
+
+/**
+ * Returns `deriveValue(JsonFile.load(filePath))`, through the cache if there is one.
+ */
+export function loadJsonFile<T>(
+  cache: JsonFileLoadCache | undefined,
+  filePath: string,
+  deriveValue: (json: JsonObject) => T
+): T {
+  return cache ? cache.load(filePath, deriveValue) : deriveValue(JsonFile.load(filePath));
+}
+
+const cachesByRushConfiguration: WeakMap<RushConfiguration, JsonFileLoadCache> = new WeakMap();
+
+/**
+ * The cache that every command line which a long-lived engine host parses for one workspace configuration shares.
+ */
+export function getEngineJsonFileLoadCache(rushConfiguration: RushConfiguration): JsonFileLoadCache {
+  let cache: JsonFileLoadCache | undefined = cachesByRushConfiguration.get(rushConfiguration);
+  if (!cache) {
+    cache = new JsonFileLoadCache();
+    cachesByRushConfiguration.set(rushConfiguration, cache);
+  }
+  return cache;
+}
diff --git a/libraries/rush-lib/src/utilities/RushLibPathHandoff.ts b/libraries/rush-lib/src/utilities/RushLibPathHandoff.ts
new file mode 100644
index 00000000000..60136347c81
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/RushLibPathHandoff.ts
@@ -0,0 +1,106 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library';
+
+const RUSH_LIB_PACKAGE_NAME: string = '@microsoft/rush-lib';
+
+/**
+ * The rush-lib entry point that Rush hands to plugins and child processes as `_RUSH_LIB_PATH`.
+ */
+export interface IRushLibPathHandoff {
+  /** The entry point handed off as `_RUSH_LIB_PATH`. */
+  readonly entryPoint: string;
+  /** The rush-lib package folder, spelled the same way as `entryPoint`. */
+  readonly packageFolder: string;
+}
+
+export interface IGetRushLibPathHandoffOptions {
+  /** The folder of the loaded rush-lib package. */
+  readonly packageFolder: string;
+  /** The loaded rush-lib entry point, inside `packageFolder`. */
+  readonly entryPoint: string;
+  /** Scripts whose own `node_modules` folders may link rush-lib, such as `process.argv[1]`. */
+  readonly hostScriptPaths: ReadonlyArray<string | undefined>;
+  /** The inherited `_RUSH_LIB_PATH` value, if any. */
+  readonly inheritedEntryPoint: string | undefined;
+}
+
+/**
+ * Returns the first `node_modules/<packageName>` folder that Node.js module lookup finds from `startFolder`.
+ * Symbolic links are not followed, so the result keeps the spelling of `startFolder`.
+ */
+export function findNodeModulesPackageFolder(startFolder: string, packageName: string): string | undefined {
+  let folder: string = path.resolve(startFolder);
+  for (;;) {
+    if (path.basename(folder) !== 'node_modules') {
+      const packageFolder: string = path.join(folder, 'node_modules', packageName);
+      if (FileSystem.exists(path.join(packageFolder, 'package.json'))) {
+        return packageFolder;
+      }
+    }
+    const parentFolder: string = path.dirname(folder);
+    if (parentFolder === folder) {
+      return undefined;
+    }
+    folder = parentFolder;
+  }
+}
+
+/**
+ * Chooses how to spell the rush-lib entry point in `_RUSH_LIB_PATH`.
+ *
+ * @remarks
+ * Plugins resolve `@microsoft/rush-lib` and its dependencies by name from `_RUSH_LIB_PATH`. That needs a
+ * `node_modules/@microsoft/rush-lib` folder above the path. Installed packages always have one, so their real
+ * path is used unchanged. A local project folder, such as one in a `rush deploy` output, doesn't. Its entry
+ * point is spelled through the `node_modules` link of the host script that loaded it, or else of an inherited
+ * `_RUSH_LIB_PATH` that points at the same file.
+ */
+export function getRushLibPathHandoff(options: IGetRushLibPathHandoffOptions): IRushLibPathHandoff {
+  const { packageFolder, entryPoint, hostScriptPaths, inheritedEntryPoint } = options;
+  const realPackageFolder: string | undefined = tryGetRealPath(packageFolder);
+  const findRushLibLink: (fromPath: string) => string | undefined = (fromPath: string) => {
+    const linkFolder: string | undefined = findNodeModulesPackageFolder(
+      path.dirname(fromPath),
+      RUSH_LIB_PACKAGE_NAME
+    );
+    return linkFolder !== undefined && tryGetRealPath(linkFolder) === realPackageFolder
+      ? linkFolder
+      : undefined;
+  };
+
+  if (realPackageFolder === undefined || findRushLibLink(entryPoint) !== undefined) {
+    return { entryPoint, packageFolder };
+  }
+
+  const relativeEntryPoint: string = path.relative(packageFolder, entryPoint);
+  for (const hostScriptPath of hostScriptPaths) {
+    const realHostScriptPath: string | undefined = hostScriptPath ? tryGetRealPath(hostScriptPath) : undefined;
+    const linkFolder: string | undefined = realHostScriptPath ? findRushLibLink(realHostScriptPath) : undefined;
+    if (linkFolder !== undefined) {
+      return { entryPoint: path.join(linkFolder, relativeEntryPoint), packageFolder: linkFolder };
+    }
+  }
+
+  if (inheritedEntryPoint && tryGetRealPath(inheritedEntryPoint) === tryGetRealPath(entryPoint)) {
+    const linkFolder: string | undefined = findRushLibLink(inheritedEntryPoint);
+    const spelledEntryPoint: string | undefined =
+      linkFolder !== undefined ? path.join(linkFolder, relativeEntryPoint) : undefined;
+    if (linkFolder !== undefined && spelledEntryPoint === path.resolve(inheritedEntryPoint)) {
+      return { entryPoint: spelledEntryPoint, packageFolder: linkFolder };
+    }
+  }
+
+  return { entryPoint, packageFolder };
+}
+
+function tryGetRealPath(fileOrFolderPath: string): string | undefined {
+  try {
+    return FileSystem.getRealPath(fileOrFolderPath);
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-lib/src/utilities/SetRushLibPath.ts b/libraries/rush-lib/src/utilities/SetRushLibPath.ts
index ffc527ff22e..f032e043fd3 100644
--- a/libraries/rush-lib/src/utilities/SetRushLibPath.ts
+++ b/libraries/rush-lib/src/utilities/SetRushLibPath.ts
@@ -4,10 +4,26 @@
 import { PackageJsonLookup } from '@rushstack/node-core-library';
 
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
+import { getRushLibPathHandoff, type IRushLibPathHandoff } from './RushLibPathHandoff';
 
-const rootDir: string | undefined = PackageJsonLookup.instance.tryGetPackageFolderFor(__dirname);
-if (rootDir) {
+function setRushLibPath(): IRushLibPathHandoff | undefined {
+  const rootDir: string | undefined = PackageJsonLookup.instance.tryGetPackageFolderFor(__dirname);
+  if (!rootDir) {
+    return undefined;
+  }
   // Route to the 'main' field of package.json
   const rushLibIndex: string = require.resolve(rootDir, { paths: [] });
-  process.env[EnvironmentVariableNames._RUSH_LIB_PATH] = rushLibIndex;
+  const handoff: IRushLibPathHandoff = getRushLibPathHandoff({
+    packageFolder: rootDir,
+    entryPoint: rushLibIndex,
+    hostScriptPaths: [process.argv[1]],
+    inheritedEntryPoint: process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
+  });
+  process.env[EnvironmentVariableNames._RUSH_LIB_PATH] = handoff.entryPoint;
+  return handoff;
 }
+
+/**
+ * The `_RUSH_LIB_PATH` value that this rush-lib set when it was loaded.
+ */
+export const rushLibPathHandoff: IRushLibPathHandoff | undefined = setRushLibPath();
diff --git a/libraries/rush-lib/src/utilities/StandardOutputClosure.ts b/libraries/rush-lib/src/utilities/StandardOutputClosure.ts
new file mode 100644
index 00000000000..23171aa3078
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/StandardOutputClosure.ts
@@ -0,0 +1,162 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+
+/**
+ * The exit code of a command that stopped because the process reading its output exited: 128 + SIGPIPE, which a
+ * shell reports for a writer that SIGPIPE ended, as in `make | head`. Windows has no SIGPIPE; the code is the same.
+ */
+export const CLOSED_OUTPUT_EXIT_CODE: number = 128 + (os.constants.signals.SIGPIPE ?? 13);
+
+export type StandardOutputStreamName = 'stdout' | 'stderr';
+
+/**
+ * A standard output stream whose reader exited.
+ */
+export interface IClosedStandardOutput {
+  readonly streamName: StandardOutputStreamName;
+  /** The code of the error that showed it: EPIPE for a pipe, or ECONNRESET for a socket. */
+  readonly code: string;
+}
+
+/**
+ * The part of a stream that {@link StandardOutputClosure} uses.
+ */
+export interface IStandardOutputClosureStream {
+  on(event: 'error', listener: (error: Error) => void): unknown;
+  listenerCount(event: 'error'): number;
+}
+
+/**
+ * The part of `process` that {@link StandardOutputClosure} uses.
+ */
+export interface IStandardOutputClosureProcess {
+  readonly stdout: IStandardOutputClosureStream;
+  readonly stderr: IStandardOutputClosureStream;
+  exitCode?: number | string | undefined;
+  on(event: 'exit', listener: () => void): unknown;
+  on(event: 'uncaughtExceptionMonitor', listener: () => void): unknown;
+}
+
+/**
+ * Returns the error code when a write failed because nothing reads the stream any more, for example after
+ * `| head` exits: EPIPE for a pipe, or ECONNRESET for a socket.
+ */
+export function getClosedOutputCode(error: unknown): string | undefined {
+  const code: unknown =
+    typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+  return code === 'EPIPE' || code === 'ECONNRESET' ? code : undefined;
+}
+
+/**
+ * Formats the stderr line of a command that stops because the process reading its output exited, for example
+ * `rush: build cancelled, because the process reading its stdout exited (EPIPE).`
+ */
+export function formatClosedOutputNotice(
+  commandName: string,
+  closed: IClosedStandardOutput,
+  operationsRunning: boolean
+): string {
+  const notice: string = `rush: ${commandName} cancelled, because the process reading its ${closed.streamName} exited (${closed.code}).`;
+  return operationsRunning ? `${notice} Operations that already started will finish first.\n` : `${notice}\n`;
+}
+
+const installedClosures: WeakMap<IStandardOutputClosureProcess, StandardOutputClosure> = new WeakMap();
+
+/**
+ * Keeps a reader of the Rush CLI's stdout or stderr that exits early, for example `head` in
+ * `rush build | head -5`, from failing the process.
+ *
+ * @remarks
+ * Node.js ignores SIGPIPE, so each write to a stream whose reader exited fails with EPIPE, and the stream emits the
+ * error as an 'error' event. With no listener, that event ends the process with a stack trace and exit code 1. Once
+ * this class is installed, those errors are expected: the first one on each stream is recorded and reported to the
+ * {@link StandardOutputClosure.onClosed} listeners, and later ones are ignored. The process then exits with code
+ * 141, as a shell reports for a writer that SIGPIPE ended, unless it crashes with an uncaught exception or an
+ * unhandled rejection. Any other stream error still fails the process.
+ *
+ * Only the Rush CLI (`Rush.launch`) installs it. The automation API and the daemon's engine leave the process's
+ * streams to their host.
+ */
+export class StandardOutputClosure {
+  readonly #target: IStandardOutputClosureProcess;
+  readonly #closed: IClosedStandardOutput[] = [];
+  readonly #listeners: Set<(closed: IClosedStandardOutput) => void> = new Set();
+
+  private constructor(target: IStandardOutputClosureProcess) {
+    this.#target = target;
+  }
+
+  /**
+   * Installs the listeners on `target`'s stdout and stderr and its 'exit' and 'uncaughtExceptionMonitor' events,
+   * once for each target.
+   */
+  public static install(target: IStandardOutputClosureProcess = process): StandardOutputClosure {
+    let closure: StandardOutputClosure | undefined = installedClosures.get(target);
+    if (!closure) {
+      const installed: StandardOutputClosure = new StandardOutputClosure(target);
+      closure = installed;
+      installedClosures.set(target, installed);
+      installed.#guard('stdout', target.stdout);
+      installed.#guard('stderr', target.stderr);
+      let crashed: boolean = false;
+      target.on('uncaughtExceptionMonitor', () => {
+        crashed = true;
+      });
+      target.on('exit', () => {
+        // Node.js reads exitCode again after the 'exit' listeners, including after process.exit(code). A crash keeps
+        // the exit code that Node.js gives it, so that it doesn't look like a reader that exited.
+        if (installed.#closed.length && !crashed) {
+          target.exitCode = CLOSED_OUTPUT_EXIT_CODE;
+        }
+      });
+    }
+    return closure;
+  }
+
+  /**
+   * The first stream whose reader exited, if one has.
+   */
+  public get firstClosed(): IClosedStandardOutput | undefined {
+    return this.#closed[0];
+  }
+
+  /**
+   * Calls `listener` for each stream whose reader exits, and at once for each one whose reader already has.
+   * Returns a function that removes the listener.
+   */
+  public onClosed(listener: (closed: IClosedStandardOutput) => void): () => void {
+    this.#listeners.add(listener);
+    for (const closed of [...this.#closed]) {
+      if (this.#listeners.has(listener)) {
+        listener(closed);
+      }
+    }
+    return () => {
+      this.#listeners.delete(listener);
+    };
+  }
+
+  #guard(streamName: StandardOutputStreamName, stream: IStandardOutputClosureStream): void {
+    stream.on('error', (error: Error) => {
+      const code: string | undefined = getClosedOutputCode(error);
+      if (code === undefined) {
+        if (stream.listenerCount('error') === 1) {
+          // No one else handles this error, so it fails the process, as it would without this listener.
+          throw error;
+        }
+        return;
+      }
+      if (this.#closed.some((closed: IClosedStandardOutput) => closed.streamName === streamName)) {
+        return;
+      }
+      const closed: IClosedStandardOutput = { streamName, code };
+      this.#closed.push(closed);
+      this.#target.exitCode = CLOSED_OUTPUT_EXIT_CODE;
+      for (const listener of [...this.#listeners]) {
+        listener(closed);
+      }
+    });
+  }
+}
diff --git a/libraries/rush-lib/src/utilities/TarExecutable.ts b/libraries/rush-lib/src/utilities/TarExecutable.ts
index db58cc902de..cfad7649f2f 100644
--- a/libraries/rush-lib/src/utilities/TarExecutable.ts
+++ b/libraries/rush-lib/src/utilities/TarExecutable.ts
@@ -25,6 +25,13 @@ export interface ICreateArchiveOptions extends ITarOptionsBase {
   archivePath: string;
   paths: string[];
   project: RushConfigurationProject;
+  /**
+   * The folder that `paths` are relative to, and that the archive's members are named from. Defaults to the
+   * project folder.
+   */
+  baseFolderPath?: string;
+  /** When aborted, kills the tar process, which then exits with a nonzero code. */
+  abortSignal?: AbortSignal;
 }
 
 export class TarExecutable {
@@ -73,7 +80,7 @@ export class TarExecutable {
    * The "tar" exit code
    */
   public async tryCreateArchiveFromProjectPathsAsync(options: ICreateArchiveOptions): Promise<number> {
-    const { project, archivePath, paths, logFilePath } = options;
+    const { project, archivePath, paths, logFilePath, baseFolderPath, abortSignal } = options;
 
     const tarInput: string = paths.join('\n');
 
@@ -81,7 +88,6 @@ export class TarExecutable {
     // does not exist (GitHub #2622)
     await FileSystem.ensureFolderAsync(path.dirname(archivePath));
 
-    const projectFolderPath: string = project.projectFolder;
     const tarExitCode: number = await this.#spawnTarWithLoggingAsync(
       // These parameters are chosen for compatibility with the very primitive bsdtar 3.3.2 shipped with Windows 10.
       [
@@ -97,9 +103,10 @@ export class TarExecutable {
         // Windows bsdtar does not document this parameter, but seems to accept it.
         '--files-from=-'
       ],
-      projectFolderPath,
+      baseFolderPath ?? project.projectFolder,
       logFilePath,
-      tarInput
+      tarInput,
+      abortSignal
     );
 
     return tarExitCode;
@@ -109,7 +116,8 @@ export class TarExecutable {
     args: string[],
     currentWorkingDirectory: string,
     logFilePath: string,
-    input?: string
+    input?: string,
+    abortSignal?: AbortSignal
   ): Promise<number> {
     // Runs "tar" with the specified args and logs its output to the specified location.
     // The log file looks like this:
@@ -154,24 +162,43 @@ export class TarExecutable {
     const childProcess: ChildProcess = Executable.spawn(this.#tarExecutablePath, args, {
       currentWorkingDirectory: currentWorkingDirectory
     });
+    const kill: () => void = () => childProcess.kill();
+    if (abortSignal?.aborted) {
+      kill();
+    } else {
+      abortSignal?.addEventListener('abort', kill, { once: true });
+    }
 
     childProcess.stdout!.on('data', (chunk) => fileWriter.write(`[stdout] ${chunk}`));
     childProcess.stderr!.on('data', (chunk) => fileWriter.write(`[stderr] ${chunk}`));
 
     if (input !== undefined) {
+      if (abortSignal) {
+        // A tar process that was killed may have closed its end of the pipe already; its exit code reports that.
+        childProcess.stdin!.on('error', () => undefined);
+      }
       childProcess.stdin!.write(input, 'utf-8');
       childProcess.stdin!.end();
     }
 
     // Wait for process to exit and all streams to close
-    const [tarExitCode] = await events.once(childProcess, 'close');
+    let tarExitCode: number | null;
+    let tarSignal: NodeJS.Signals | null;
+    try {
+      [tarExitCode, tarSignal] = await events.once(childProcess, 'close');
+    } finally {
+      abortSignal?.removeEventListener('abort', kill);
+    }
 
     fileWriter.write(
-      ['======== END PROCESS OUTPUT ========', '', `Exited with code "${tarExitCode}"`].join('\n')
+      ['======== END PROCESS OUTPUT ========', '', `Exited with code "${tarExitCode ?? tarSignal}"`].join(
+        '\n'
+      )
     );
     fileWriter.close();
 
-    return tarExitCode;
+    // A tar process that was killed has no exit code.
+    return tarExitCode ?? 1;
   }
 }
 
diff --git a/libraries/rush-lib/src/utilities/Utilities.ts b/libraries/rush-lib/src/utilities/Utilities.ts
index 8c7a4b60784..35059c6e212 100644
--- a/libraries/rush-lib/src/utilities/Utilities.ts
+++ b/libraries/rush-lib/src/utilities/Utilities.ts
@@ -513,10 +513,17 @@ export class Utilities {
     if (result.status !== null) {
       return result.status;
     } else {
-      throw result.error || new Error('An unknown error occurred.');
+      throw result.error || new Error(Utilities.describeLifecycleCommandSignal(result.signal ?? undefined));
     }
   }
 
+  /**
+   * Describes a lifecycle command that ended without an exit code.
+   */
+  public static describeLifecycleCommandSignal(signal: NodeJS.Signals | undefined): string {
+    return signal ? `The script was ended by ${signal}.` : 'An unknown error occurred.';
+  }
+
   /**
    * Executes the command using cmd if running on windows, or using sh if running on a non-windows OS.
    * @param command - the command to run on shell
@@ -820,6 +827,13 @@ function _createEnvironmentForRushCommand(options: ICreateEnvironmentForRushComm
       continue;
     }
 
+    // RUSH_DAEMON* variables only route a client to the daemon and configure the daemon host. Project
+    // tooling never reads them, and a Rush release that predates the daemon rejects them as unknown
+    // RUSH_* variables, which breaks tools that start their own copy of Rush.
+    if (normalizedKey.startsWith('RUSH_DAEMON')) {
+      continue;
+    }
+
     // Use the uppercased environment variable name on Windows because environment variable names
     // are case-insensitive on Windows
     environment[normalizedKey] = options.initialEnvironment[key];
diff --git a/libraries/rush-lib/src/utilities/executionUtilities.ts b/libraries/rush-lib/src/utilities/executionUtilities.ts
index 18bc33229ce..0b170cfa994 100644
--- a/libraries/rush-lib/src/utilities/executionUtilities.ts
+++ b/libraries/rush-lib/src/utilities/executionUtilities.ts
@@ -3,6 +3,44 @@
 
 export const IS_WINDOWS: boolean = process.platform === 'win32';
 
+// The characters that Python's shlex.quote() leaves unquoted.
+const POSIX_SAFE_ARGUMENT_REGEXP: RegExp = /^[A-Za-z0-9_@%+=:,./-]+$/;
+// Whitespace, and the characters that cmd.exe or the MSVC argument parser treat specially.
+const WINDOWS_UNSAFE_ARGUMENT_REGEXP: RegExp = /[\s"&|<>()^]/;
+// A run of backslashes, followed by a double quote or the end of the value.
+const WINDOWS_BACKSLASHES_BEFORE_QUOTE_REGEXP: RegExp = /(\\*)("|$)/g;
+
+/**
+ * Quotes an argument so that the shell that runs a lifecycle command (`sh -c` on POSIX,
+ * `cmd.exe /d /s /c` on Windows) passes it to the command as one literal argument.
+ * An argument that needs no quoting is returned unchanged.
+ *
+ * @remarks
+ * On Windows, the argument is wrapped in double quotes. An embedded double quote is written as `""`,
+ * which keeps cmd.exe's quote state in step with the argument parser's, and the backslashes before it,
+ * or before the closing quote, are doubled. cmd.exe still expands `%NAME%` inside double quotes.
+ */
+export function quoteShellArgumentIfNeeded(argument: string, isWindows: boolean = IS_WINDOWS): string {
+  if (isWindows) {
+    if (argument && !WINDOWS_UNSAFE_ARGUMENT_REGEXP.test(argument)) {
+      return argument;
+    }
+
+    const escapedArgument: string = argument.replace(
+      WINDOWS_BACKSLASHES_BEFORE_QUOTE_REGEXP,
+      (match: string, backslashes: string, quote: string) =>
+        `${backslashes}${backslashes}${quote ? '""' : ''}`
+    );
+    return `"${escapedArgument}"`;
+  } else {
+    if (POSIX_SAFE_ARGUMENT_REGEXP.test(argument)) {
+      return argument;
+    }
+
+    return `'${argument.replace(/'/g, `'\\''`)}'`;
+  }
+}
+
 export function escapeArgumentIfNeeded(command: string, isWindows: boolean = IS_WINDOWS): string {
   if (command.includes(' ')) {
     if (isWindows) {
diff --git a/libraries/rush-lib/src/utilities/runDuringChecksAsync.ts b/libraries/rush-lib/src/utilities/runDuringChecksAsync.ts
new file mode 100644
index 00000000000..4ef6196704a
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/runDuringChecksAsync.ts
@@ -0,0 +1,29 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+function noop(): void {}
+
+/**
+ * Starts an operation, then runs the checks that decide whether its result may be used, so that both run at the
+ * same time. Returns the result of the operation if the checks pass.
+ *
+ * @remarks
+ * If the checks fail, this waits for the operation to finish, so that no work continues after the call, and throws
+ * the error of the checks, whether or not the operation failed too.
+ */
+export async function runDuringChecksAsync<T>(
+  runAsync: () => Promise<T>,
+  checkAsync: () => Promise<void>
+): Promise<T> {
+  const resultPromise: Promise<T> = runAsync();
+  // The operation may fail before the checks finish, which must not be reported as an unhandled rejection
+  const settledPromise: Promise<void> = resultPromise.then(noop, noop);
+  try {
+    await checkAsync();
+  } catch (error) {
+    await settledPromise;
+    throw error;
+  }
+
+  return await resultPromise;
+}
diff --git a/libraries/rush-lib/src/utilities/streamUtilities.ts b/libraries/rush-lib/src/utilities/streamUtilities.ts
new file mode 100644
index 00000000000..34852864bd2
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/streamUtilities.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The members of a writable stream that {@link waitForStreamsToFlushAsync} uses.
+ */
+export interface IFlushableStream {
+  readonly writable: boolean;
+  readonly writableLength: number;
+  write(chunk: string, callback: () => void): boolean;
+  once(event: 'error', listener: () => void): unknown;
+  removeListener(event: 'error', listener: () => void): unknown;
+}
+
+/**
+ * Resolves once each stream has handed the output already written to it to the operating system,
+ * or has failed.
+ *
+ * @remarks
+ * On POSIX, Node.js writes to a pipe asynchronously, and `process.exit()` discards the output that
+ * is still queued. Call this before `process.exit()`, or a reader that reads more slowly than the
+ * process writes loses the end of the output, for example the summary of a failed build.
+ *
+ * A stream can fail while this waits, for example with EPIPE when its reader closes the pipe. This
+ * handles the stream's `error` event, which would otherwise end the process as an uncaught exception
+ * instead of letting the caller exit with its own exit code.
+ */
+export async function waitForStreamsToFlushAsync(streams: Iterable<IFlushableStream>): Promise<void> {
+  const pendingWrites: Promise<void>[] = [];
+  for (const stream of streams) {
+    if (stream.writable && stream.writableLength > 0) {
+      pendingWrites.push(
+        new Promise<void>((resolve: () => void) => {
+          const onError = (): void => resolve();
+          stream.once('error', onError);
+          // A stream finishes its writes in order, so the callback of this empty write runs after the
+          // output queued before it has been written. If the stream fails, the callback runs before the
+          // stream emits `error`, so a stream that can no longer be written keeps the listener.
+          stream.write('', () => {
+            if (stream.writable) {
+              stream.removeListener('error', onError);
+            }
+            resolve();
+          });
+        })
+      );
+    }
+  }
+
+  await Promise.all(pendingWrites);
+}
diff --git a/libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts b/libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts
new file mode 100644
index 00000000000..cd2a3288a45
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts
@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+import {
+  getFileStamp,
+  getSettledBeforeNs,
+  isFileStatSettled,
+  SETTLED_FILE_AGE_MS
+} from '../FileContentStamp';
+
+const MS: bigint = BigInt(1e6);
+
+function createStat(mtimeMs: number, ctimeMs: number): fs.BigIntStats {
+  return {
+    dev: BigInt(1),
+    ino: BigInt(2),
+    size: BigInt(3),
+    mtimeNs: BigInt(mtimeMs) * MS + BigInt(4),
+    ctimeNs: BigInt(ctimeMs) * MS + BigInt(5)
+  } as fs.BigIntStats;
+}
+
+describe('FileContentStamp', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('identifies a file by identity, size and nanosecond times', () => {
+    expect(getFileStamp(createStat(10, 20))).toBe('1:2:3:10000004:20000005');
+  });
+
+  it('settles files whose ctime and mtime are both older than the margin', () => {
+    jest.spyOn(Date, 'now').mockReturnValue(100_000);
+    const settledBeforeNs: bigint = getSettledBeforeNs();
+    expect(settledBeforeNs).toBe(BigInt(100_000 - SETTLED_FILE_AGE_MS) * MS);
+
+    const boundaryMs: number = 100_000 - SETTLED_FILE_AGE_MS;
+    expect(isFileStatSettled(createStat(boundaryMs - 1, boundaryMs - 1), settledBeforeNs)).toBe(true);
+    // Any time in the same millisecond as the bound is too recent.
+    expect(isFileStatSettled(createStat(boundaryMs - 1, boundaryMs), settledBeforeNs)).toBe(false);
+    // A future mtime set with utimes() doesn't settle a file whose ctime is old.
+    expect(isFileStatSettled(createStat(200_000, boundaryMs - 1), settledBeforeNs)).toBe(false);
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts b/libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts
new file mode 100644
index 00000000000..e45310d5016
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts
@@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem, JsonFile, type JsonObject } from '@rushstack/node-core-library';
+
+import type { RushConfiguration } from '../../api/RushConfiguration';
+import { getEngineJsonFileLoadCache, JsonFileLoadCache, loadJsonFile } from '../JsonFileLoadCache';
+
+interface IExample {
+  items: number[];
+}
+
+function deriveExample(json: JsonObject): IExample {
+  if (!Array.isArray(json.items)) {
+    throw new Error('"items" must be an array');
+  }
+  return { items: json.items };
+}
+
+function getError(fn: () => unknown): Error {
+  try {
+    fn();
+  } catch (error) {
+    return error as Error;
+  }
+  throw new Error('Expected an error');
+}
+
+describe(JsonFileLoadCache.name, () => {
+  let folder: string;
+  let filePath: string;
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-json-file-load-cache-'));
+    filePath = path.join(folder, 'example.json');
+  });
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+    jest.restoreAllMocks();
+  });
+
+  it('derives the value once while the text is unchanged, and returns a copy for each load', () => {
+    fs.writeFileSync(filePath, '{ "items": [1, 2] }');
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+    const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+
+    const first: IExample = cache.load(filePath, derive);
+    first.items.push(3);
+    const second: IExample = cache.load(filePath, derive);
+    second.items.push(4);
+
+    expect(cache.load(filePath, derive)).toEqual({ items: [1, 2] });
+    expect(second).not.toBe(first);
+    expect(derive).toHaveBeenCalledTimes(1);
+  });
+
+  it('reads the file for every load, and derives the value again when the text changes', () => {
+    fs.writeFileSync(filePath, '{ "items": [1] }');
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+    const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+    const { mtime } = fs.statSync(filePath);
+
+    expect(cache.load(filePath, derive)).toEqual({ items: [1] });
+    // The same size and modification time, which a cache keyed by file stamps could miss.
+    fs.writeFileSync(filePath, '{ "items": [2] }');
+    fs.utimesSync(filePath, mtime, mtime);
+    expect(cache.load(filePath, derive)).toEqual({ items: [2] });
+    expect(derive).toHaveBeenCalledTimes(2);
+  });
+
+  it('throws the errors that JsonFile.load and the derivation throw, and caches no failed load', () => {
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+
+    const expectedMissingError: Error = getError(() => JsonFile.load(filePath));
+    const readFileSpy: jest.SpyInstance = jest.spyOn(FileSystem, 'readFile');
+    const missingError: Error = getError(() => cache.load(filePath, deriveExample));
+    expect(FileSystem.isNotExistError(missingError)).toBe(true);
+    expect(missingError.message).toBe(expectedMissingError.message);
+    // The cache does not read a missing file twice.
+    expect(readFileSpy).toHaveBeenCalledTimes(1);
+
+    const expectedFolderError: Error = getError(() => JsonFile.load(folder));
+    expect(expectedFolderError.message).toContain('Error reading');
+    expect(() => cache.load(folder, deriveExample)).toThrow(expectedFolderError.message);
+
+    fs.writeFileSync(filePath, '{ "items": [1] ');
+    const expectedParseError: Error = getError(() => JsonFile.load(filePath));
+    expect(expectedParseError.message).toContain('Error reading');
+    expect(() => cache.load(filePath, deriveExample)).toThrow(expectedParseError.message);
+
+    fs.writeFileSync(filePath, '{ "items": 1 }');
+    for (let i: number = 0; i < 2; i++) {
+      expect(() => cache.load(filePath, deriveExample)).toThrow('"items" must be an array');
+    }
+
+    fs.writeFileSync(filePath, '{ "items": [1] }');
+    expect(cache.load(filePath, deriveExample)).toEqual({ items: [1] });
+  });
+
+  it('keeps an entry for each file', () => {
+    const otherFilePath: string = path.join(folder, 'other.json');
+    fs.writeFileSync(filePath, '{ "items": [1] }');
+    fs.writeFileSync(otherFilePath, '{ "items": [2] }');
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+    const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+
+    for (let i: number = 0; i < 2; i++) {
+      expect(cache.load(filePath, derive)).toEqual({ items: [1] });
+      expect(cache.load(otherFilePath, derive)).toEqual({ items: [2] });
+    }
+    expect(derive).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe(loadJsonFile.name, () => {
+  it('loads and derives the value for every call without a cache', () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-json-file-load-cache-'));
+    try {
+      const filePath: string = path.join(folder, 'example.json');
+      fs.writeFileSync(filePath, '{ "items": [1] }');
+      const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+      expect(loadJsonFile(undefined, filePath, derive)).toEqual({ items: [1] });
+      expect(loadJsonFile(undefined, filePath, derive)).toEqual({ items: [1] });
+      expect(derive).toHaveBeenCalledTimes(2);
+
+      const cache: JsonFileLoadCache = new JsonFileLoadCache();
+      expect(loadJsonFile(cache, filePath, derive)).toEqual({ items: [1] });
+      expect(loadJsonFile(cache, filePath, derive)).toEqual({ items: [1] });
+      expect(derive).toHaveBeenCalledTimes(3);
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+});
+
+describe(getEngineJsonFileLoadCache.name, () => {
+  it('shares one cache for each workspace configuration', () => {
+    const configuration: RushConfiguration = {} as RushConfiguration;
+    const otherConfiguration: RushConfiguration = {} as RushConfiguration;
+    const cache: JsonFileLoadCache = getEngineJsonFileLoadCache(configuration);
+    expect(getEngineJsonFileLoadCache(configuration)).toBe(cache);
+    expect(getEngineJsonFileLoadCache(otherConfiguration)).not.toBe(cache);
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts b/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
new file mode 100644
index 00000000000..82bc08b203f
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
@@ -0,0 +1,228 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  findNodeModulesPackageFolder,
+  getRushLibPathHandoff,
+  type IRushLibPathHandoff
+} from '../RushLibPathHandoff';
+
+const ENTRY_POINT_SUBPATH: string = path.join('lib-commonjs', 'index.js');
+
+describe(getRushLibPathHandoff.name, () => {
+  let folder: string;
+  let localRushLib: string;
+  let hostScript: string;
+  let hostLink: string;
+
+  function writePackage(packageFolder: string, name: string): void {
+    fs.mkdirSync(path.join(packageFolder, 'lib-commonjs'), { recursive: true });
+    fs.writeFileSync(
+      path.join(packageFolder, 'package.json'),
+      JSON.stringify({ name, version: '1.0.0', main: './lib-commonjs/index.js' })
+    );
+    fs.writeFileSync(path.join(packageFolder, ENTRY_POINT_SUBPATH), 'module.exports = {};');
+  }
+
+  function link(target: string, newLinkPath: string): void {
+    fs.mkdirSync(path.dirname(newLinkPath), { recursive: true });
+    fs.symlinkSync(target, newLinkPath, 'junction');
+  }
+
+  // Resolves the way plugins do, from a process outside of any rush-lib package scope.
+  function resolveByName(request: string, fromPath: string): string {
+    return childProcess
+      .execFileSync(
+        process.execPath,
+        ['-e', 'process.stdout.write(require.resolve(process.argv[1], { paths: [process.argv[2]] }))'].concat(
+          request,
+          fromPath
+        ),
+        { cwd: folder, encoding: 'utf8' }
+      )
+      .toString();
+  }
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-path-handoff-')));
+    // A "rush deploy" layout: rush-lib is a local project folder, and each host links it.
+    localRushLib = path.join(folder, 'deploy', 'libraries', 'rush-lib');
+    writePackage(localRushLib, '@microsoft/rush-lib');
+    writePackage(
+      path.join(folder, 'deploy', 'libraries', 'node-core-library'),
+      '@rushstack/node-core-library'
+    );
+    link(
+      path.join(folder, 'deploy', 'libraries', 'node-core-library'),
+      path.join(localRushLib, 'node_modules', '@rushstack', 'node-core-library')
+    );
+    hostScript = path.join(folder, 'deploy', 'apps', 'host', 'bin', 'host');
+    fs.mkdirSync(path.dirname(hostScript), { recursive: true });
+    fs.writeFileSync(hostScript, '');
+    hostLink = path.join(folder, 'deploy', 'apps', 'host', 'node_modules', '@microsoft', 'rush-lib');
+    link(localRushLib, hostLink);
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('keeps the real path of an installed rush-lib', () => {
+    const installedRushLib: string = path.join(folder, 'install', 'node_modules', '@microsoft', 'rush-lib');
+    writePackage(installedRushLib, '@microsoft/rush-lib');
+    const entryPoint: string = path.join(installedRushLib, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: installedRushLib,
+        entryPoint,
+        hostScriptPaths: [hostScript],
+        inheritedEntryPoint: path.join(hostLink, ENTRY_POINT_SUBPATH)
+      })
+    ).toEqual({ entryPoint, packageFolder: installedRushLib });
+  });
+
+  it('keeps the real path of an installed rush-lib that the host script also links', () => {
+    const installedRushLib: string = path.join(folder, 'install', 'node_modules', '@microsoft', 'rush-lib');
+    writePackage(installedRushLib, '@microsoft/rush-lib');
+    const entryPoint: string = path.join(installedRushLib, ENTRY_POINT_SUBPATH);
+    // A pnpm-style host, whose own node_modules links the same installed package.
+    const linkingHostScript: string = path.join(folder, 'linking-host', 'bin', 'host');
+    fs.mkdirSync(path.dirname(linkingHostScript), { recursive: true });
+    fs.writeFileSync(linkingHostScript, '');
+    link(installedRushLib, path.join(folder, 'linking-host', 'node_modules', '@microsoft', 'rush-lib'));
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: installedRushLib,
+        entryPoint,
+        hostScriptPaths: [linkingHostScript],
+        inheritedEntryPoint: undefined
+      })
+    ).toEqual({ entryPoint, packageFolder: installedRushLib });
+  });
+
+  it('spells a local rush-lib through the node_modules link of the host script', () => {
+    const handoff: IRushLibPathHandoff = getRushLibPathHandoff({
+      packageFolder: localRushLib,
+      entryPoint: path.join(localRushLib, ENTRY_POINT_SUBPATH),
+      hostScriptPaths: [undefined, hostScript],
+      inheritedEntryPoint: undefined
+    });
+
+    expect(handoff).toEqual({
+      entryPoint: path.join(hostLink, ENTRY_POINT_SUBPATH),
+      packageFolder: hostLink
+    });
+    // This is how plugins find rush-lib and its dependencies from _RUSH_LIB_PATH.
+    expect(
+      fs.realpathSync.native(resolveByName('@microsoft/rush-lib/package.json', handoff.entryPoint))
+    ).toBe(path.join(localRushLib, 'package.json'));
+    expect(
+      fs.realpathSync.native(
+        resolveByName('@rushstack/node-core-library/package.json', handoff.packageFolder)
+      )
+    ).toBe(path.join(folder, 'deploy', 'libraries', 'node-core-library', 'package.json'));
+  });
+
+  it('follows a symbolic link to the host script before looking for its node_modules folder', () => {
+    const scriptAlias: string = path.join(folder, 'bin', 'host');
+    fs.mkdirSync(path.dirname(scriptAlias), { recursive: true });
+    fs.symlinkSync(hostScript, scriptAlias);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint: path.join(localRushLib, ENTRY_POINT_SUBPATH),
+        hostScriptPaths: [scriptAlias],
+        inheritedEntryPoint: undefined
+      }).packageFolder
+    ).toBe(hostLink);
+  });
+
+  it('ignores a host whose own rush-lib is a different package', () => {
+    const otherHostScript: string = path.join(folder, 'other', 'bin', 'host');
+    fs.mkdirSync(path.dirname(otherHostScript), { recursive: true });
+    fs.writeFileSync(otherHostScript, '');
+    writePackage(path.join(folder, 'other', 'node_modules', '@microsoft', 'rush-lib'), '@microsoft/rush-lib');
+    // A link further up would be shadowed by the host's own rush-lib, so it must not be used either.
+    link(localRushLib, path.join(folder, 'node_modules', '@microsoft', 'rush-lib'));
+    const entryPoint: string = path.join(localRushLib, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint,
+        hostScriptPaths: [otherHostScript, path.join(folder, 'missing', 'script')],
+        inheritedEntryPoint: undefined
+      })
+    ).toEqual({ entryPoint, packageFolder: localRushLib });
+  });
+
+  it('keeps an inherited spelling of the same entry point', () => {
+    const inheritedEntryPoint: string = path.join(hostLink, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint: path.join(localRushLib, ENTRY_POINT_SUBPATH),
+        hostScriptPaths: [path.join(folder, 'missing', 'script')],
+        inheritedEntryPoint
+      })
+    ).toEqual({ entryPoint: inheritedEntryPoint, packageFolder: hostLink });
+  });
+
+  it('replaces an inherited path that names a different engine', () => {
+    const otherRushLib: string = path.join(folder, 'other', 'node_modules', '@microsoft', 'rush-lib');
+    writePackage(otherRushLib, '@microsoft/rush-lib');
+    const entryPoint: string = path.join(localRushLib, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint,
+        hostScriptPaths: [],
+        inheritedEntryPoint: path.join(otherRushLib, ENTRY_POINT_SUBPATH)
+      })
+    ).toEqual({ entryPoint, packageFolder: localRushLib });
+  });
+});
+
+describe(findNodeModulesPackageFolder.name, () => {
+  let folder: string;
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-node-modules-lookup-')));
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('finds a package next to a linked package without following the link', () => {
+    const target: string = path.join(folder, 'target');
+    fs.mkdirSync(target, { recursive: true });
+    fs.writeFileSync(path.join(target, 'package.json'), '{}');
+    const plugin: string = path.join(folder, 'host', 'node_modules', '@scope', 'plugin');
+    fs.mkdirSync(plugin, { recursive: true });
+    fs.writeFileSync(path.join(plugin, 'package.json'), '{}');
+    const linkedPackage: string = path.join(folder, 'host', 'node_modules', '@scope', 'linked');
+    fs.symlinkSync(target, linkedPackage, 'junction');
+
+    expect(findNodeModulesPackageFolder(linkedPackage, '@scope/plugin')).toBe(plugin);
+    expect(findNodeModulesPackageFolder(target, '@scope/plugin')).toBeUndefined();
+  });
+
+  it('does not look for node_modules inside a node_modules folder', () => {
+    const nested: string = path.join(folder, 'node_modules', 'node_modules', 'pkg');
+    fs.mkdirSync(nested, { recursive: true });
+    fs.writeFileSync(path.join(nested, 'package.json'), '{}');
+
+    expect(findNodeModulesPackageFolder(path.join(folder, 'node_modules', 'a'), 'pkg')).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts b/libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts
new file mode 100644
index 00000000000..5484d836679
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts
@@ -0,0 +1,131 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { EventEmitter } from 'node:events';
+
+import {
+  CLOSED_OUTPUT_EXIT_CODE,
+  formatClosedOutputNotice,
+  type IClosedStandardOutput,
+  type IStandardOutputClosureProcess,
+  StandardOutputClosure
+} from '../StandardOutputClosure';
+
+class FakeProcess extends EventEmitter implements IStandardOutputClosureProcess {
+  public readonly stdout: EventEmitter = new EventEmitter();
+  public readonly stderr: EventEmitter = new EventEmitter();
+  public exitCode: number | string | undefined = undefined;
+
+  /** Mirrors process.exit(): Node.js reads exitCode again after the 'exit' listeners. */
+  public exit(code: number): number | string | undefined {
+    this.exitCode = code;
+    this.emit('exit', code);
+    return this.exitCode;
+  }
+}
+
+function createError(code: string): NodeJS.ErrnoException {
+  const error: NodeJS.ErrnoException = new Error(`write ${code}`);
+  error.code = code;
+  return error;
+}
+
+describe(StandardOutputClosure.name, () => {
+  it('records the first EPIPE of each stream once and exits with 141', () => {
+    const target: FakeProcess = new FakeProcess();
+    const closure: StandardOutputClosure = StandardOutputClosure.install(target);
+    const closures: IClosedStandardOutput[] = [];
+    closure.onClosed((closed: IClosedStandardOutput) => closures.push(closed));
+
+    expect(closure.firstClosed).toBeUndefined();
+    target.stdout.emit('error', createError('EPIPE'));
+    target.stdout.emit('error', createError('EPIPE'));
+    target.stderr.emit('error', createError('ECONNRESET'));
+
+    expect(closures).toEqual([
+      { streamName: 'stdout', code: 'EPIPE' },
+      { streamName: 'stderr', code: 'ECONNRESET' }
+    ]);
+    expect(closure.firstClosed).toEqual({ streamName: 'stdout', code: 'EPIPE' });
+    expect(target.exitCode).toBe(CLOSED_OUTPUT_EXIT_CODE);
+    expect(CLOSED_OUTPUT_EXIT_CODE).toBe(141);
+  });
+
+  it('keeps exit code 141 when the process later exits with another code', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+    target.stdout.emit('error', createError('EPIPE'));
+    target.exitCode = 0;
+
+    expect(target.exit(1)).toBe(141);
+  });
+
+  it('keeps the exit code of a crash after a reader exited', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+    target.stdout.emit('error', createError('EPIPE'));
+    // Node.js emits this for an uncaught exception or an unhandled rejection, then exits with code 1.
+    target.emit('uncaughtExceptionMonitor', new Error('crash'), 'uncaughtException');
+
+    expect(target.exit(1)).toBe(1);
+  });
+
+  it('leaves the exit code alone when no reader exited', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+
+    expect(target.exit(1)).toBe(1);
+    expect(target.exit(0)).toBe(0);
+  });
+
+  it('tells a listener at once about a stream that closed before it subscribed, until it unsubscribes', () => {
+    const target: FakeProcess = new FakeProcess();
+    const closure: StandardOutputClosure = StandardOutputClosure.install(target);
+    target.stderr.emit('error', createError('EPIPE'));
+
+    const closures: IClosedStandardOutput[] = [];
+    const stop: () => void = closure.onClosed((closed: IClosedStandardOutput) => closures.push(closed));
+    expect(closures).toEqual([{ streamName: 'stderr', code: 'EPIPE' }]);
+
+    stop();
+    target.stdout.emit('error', createError('EPIPE'));
+    expect(closures).toHaveLength(1);
+  });
+
+  it('still fails the process for another stream error that nothing else handles', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+    const error: NodeJS.ErrnoException = createError('EBADF');
+
+    expect(() => target.stdout.emit('error', error)).toThrow(error);
+    expect(target.exitCode).toBeUndefined();
+
+    const handled: Error[] = [];
+    target.stderr.on('error', (otherError: Error) => handled.push(otherError));
+    expect(() => target.stderr.emit('error', error)).not.toThrow();
+    expect(handled).toEqual([error]);
+  });
+
+  it('installs its listeners once for each process', () => {
+    const target: FakeProcess = new FakeProcess();
+    const closure: StandardOutputClosure = StandardOutputClosure.install(target);
+
+    expect(StandardOutputClosure.install(target)).toBe(closure);
+    expect(target.stdout.listenerCount('error')).toBe(1);
+    expect(target.stderr.listenerCount('error')).toBe(1);
+    expect(target.listenerCount('exit')).toBe(1);
+    expect(target.listenerCount('uncaughtExceptionMonitor')).toBe(1);
+  });
+});
+
+describe(formatClosedOutputNotice.name, () => {
+  it('names the command, the stream and the error code', () => {
+    expect(formatClosedOutputNotice('build', { streamName: 'stdout', code: 'EPIPE' }, false)).toBe(
+      'rush: build cancelled, because the process reading its stdout exited (EPIPE).\n'
+    );
+    expect(formatClosedOutputNotice('test', { streamName: 'stderr', code: 'ECONNRESET' }, true)).toBe(
+      'rush: test cancelled, because the process reading its stderr exited (ECONNRESET).' +
+        ' Operations that already started will finish first.\n'
+    );
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/TarExecutable.test.ts b/libraries/rush-lib/src/utilities/test/TarExecutable.test.ts
new file mode 100644
index 00000000000..78d6568bddb
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/TarExecutable.test.ts
@@ -0,0 +1,113 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import { TarExecutable } from '../TarExecutable';
+
+// Archives are created from the base folder, so this folder is never used.
+const project: RushConfigurationProject = {
+  projectFolder: path.join(os.tmpdir(), 'rush-tar-executable-missing-project')
+} as RushConfigurationProject;
+
+describe(TarExecutable.name, () => {
+  let tar: TarExecutable;
+  let folderPath: string;
+  let baseFolderPath: string;
+
+  beforeAll(async () => {
+    const found: TarExecutable | undefined = await TarExecutable.tryInitializeAsync(
+      new Terminal(new StringBufferTerminalProvider())
+    );
+    if (!found) {
+      throw new Error('"tar" was not found on the PATH');
+    }
+    tar = found;
+  });
+
+  beforeEach(() => {
+    folderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-tar-executable-'));
+    baseFolderPath = path.join(folderPath, 'base');
+    fs.mkdirSync(path.join(baseFolderPath, 'lib'), { recursive: true });
+    fs.writeFileSync(path.join(baseFolderPath, 'lib', 'index.js'), 'index');
+  });
+
+  afterEach(() => {
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  });
+
+  it('names the members of an archive from its base folder', async () => {
+    const archivePath: string = path.join(folderPath, 'entry.tar.gz');
+    const exitCode: number = await tar.tryCreateArchiveFromProjectPathsAsync({
+      archivePath,
+      paths: ['lib/index.js'],
+      project,
+      baseFolderPath,
+      logFilePath: path.join(folderPath, 'create.log')
+    });
+    expect(exitCode).toBe(0);
+
+    const outputFolderPath: string = path.join(folderPath, 'output');
+    fs.mkdirSync(outputFolderPath);
+    expect(
+      await tar.tryUntarAsync({
+        archivePath,
+        outputFolderPath,
+        logFilePath: path.join(folderPath, 'untar.log')
+      })
+    ).toBe(0);
+    expect(fs.readdirSync(outputFolderPath)).toEqual(['lib']);
+    expect(fs.readFileSync(path.join(outputFolderPath, 'lib', 'index.js'), 'utf8')).toBe('index');
+  });
+
+  it('kills tar at once when its signal was aborted before it started', async () => {
+    const logFilePath: string = path.join(folderPath, 'create.log');
+    const exitCode: number = await tar.tryCreateArchiveFromProjectPathsAsync({
+      archivePath: path.join(folderPath, 'entry.tar.gz'),
+      paths: ['lib/index.js'],
+      project,
+      baseFolderPath,
+      logFilePath,
+      abortSignal: AbortSignal.abort()
+    });
+
+    expect(exitCode).toBe(1);
+    expect(fs.readFileSync(logFilePath, 'utf8')).toContain('Exited with code "SIGTERM"');
+  });
+
+  it('kills tar when its signal aborts while it runs', async () => {
+    // A sparse file takes no space, but tar reads 2 GB of zeros from it and gzip compresses them, which takes
+    // seconds.
+    const fd: number = fs.openSync(path.join(baseFolderPath, 'large.bin'), 'w');
+    try {
+      fs.ftruncateSync(fd, 2 * 1024 * 1024 * 1024);
+    } finally {
+      fs.closeSync(fd);
+    }
+    const logFilePath: string = path.join(folderPath, 'create.log');
+    const abortController: AbortController = new AbortController();
+    const exitCodePromise: Promise<number> = tar.tryCreateArchiveFromProjectPathsAsync({
+      archivePath: path.join(folderPath, 'entry.tar.gz'),
+      paths: ['lib/index.js', 'large.bin'],
+      project,
+      baseFolderPath,
+      logFilePath,
+      abortSignal: abortController.signal
+    });
+    await delayAsync(200);
+    abortController.abort();
+    const abortedAtMs: number = performance.now();
+
+    expect(await exitCodePromise).toBe(1);
+    expect(fs.readFileSync(logFilePath, 'utf8')).toContain('Exited with code "SIGTERM"');
+    // Unless it was killed, tar would have run for seconds after the abort.
+    expect(performance.now() - abortedAtMs).toBeLessThan(1000);
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/Utilities.test.ts b/libraries/rush-lib/src/utilities/test/Utilities.test.ts
index 5ab24d3ab64..7ab68d6f0af 100644
--- a/libraries/rush-lib/src/utilities/test/Utilities.test.ts
+++ b/libraries/rush-lib/src/utilities/test/Utilities.test.ts
@@ -349,6 +349,56 @@ describe(Utilities.name, () => {
           expect(options.shell).toBeUndefined();
         }
       });
+
+      it('does not pass the daemon routing and host settings to lifecycle commands', () => {
+        const spawn = jest
+          .fn<ChildProcess, [string, ReadonlyArray<string>, SpawnOptions]>()
+          .mockReturnValue(new ChildProcess());
+        Utilities.executeLifecycleCommandAsync('echo request', {
+          rushConfiguration: undefined,
+          workingDirectory: process.cwd(),
+          initCwd: process.cwd(),
+          handleOutput: false,
+          environmentPathOptions: {},
+          initialEnvironment: {
+            RUSH_DAEMON: '1',
+            RUSH_DAEMON_AUTO_START: '0',
+            RUSH_DAEMON_EXPERIMENTAL: '1',
+            RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+            RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: '65536',
+            RUSH_BUILD_CACHE_ENABLED: '1',
+            RUSH_PREVIEW_VERSION: '5.0.0',
+            REQUEST_VALUE: 'request'
+          },
+          stdio: 'pipe',
+          spawn
+        });
+        const environment: NodeJS.ProcessEnv = spawn.mock.calls[0][2].env!;
+        expect(Object.keys(environment).filter((name: string) => /^RUSH_DAEMON/i.test(name))).toEqual([]);
+        expect(environment).toMatchObject({
+          RUSH_BUILD_CACHE_ENABLED: '1',
+          RUSH_PREVIEW_VERSION: '5.0.0',
+          REQUEST_VALUE: 'request'
+        });
+      });
+
+      it("passes the daemon's marker of the processes that it starts to lifecycle commands", () => {
+        const spawn = jest
+          .fn<ChildProcess, [string, ReadonlyArray<string>, SpawnOptions]>()
+          .mockReturnValue(new ChildProcess());
+        const marker: string = '/tmp/rushd-1000/workspace.lock.groups-42';
+        Utilities.executeLifecycleCommandAsync('echo request', {
+          rushConfiguration: undefined,
+          workingDirectory: process.cwd(),
+          initCwd: process.cwd(),
+          handleOutput: false,
+          environmentPathOptions: {},
+          initialEnvironment: { RUSH_DAEMON: '1', RUSHD_OPERATION_GROUPS: marker },
+          stdio: 'pipe',
+          spawn
+        });
+        expect(spawn.mock.calls[0][2].env).toMatchObject({ RUSHD_OPERATION_GROUPS: marker });
+      });
     });
   });
 });
diff --git a/libraries/rush-lib/src/utilities/test/executionUtilities.test.ts b/libraries/rush-lib/src/utilities/test/executionUtilities.test.ts
new file mode 100644
index 00000000000..00731b2fb51
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/executionUtilities.test.ts
@@ -0,0 +1,93 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+
+import { IS_WINDOWS, quoteShellArgumentIfNeeded } from '../executionUtilities';
+
+const POSIX_SAFE_ARGUMENTS: string[] = [
+  '--test-path-pattern',
+  'bump',
+  'src/logic/foo.test.ts',
+  '@scope/pkg',
+  'a=b,c:d+e%',
+  '1.2.3',
+  '_x-Y'
+];
+
+const POSIX_QUOTED_ARGUMENTS: [string, string, string][] = [
+  ['QP2', 'bump|x', "'bump|x'"],
+  ['QP3', 'debarrel-(a|b)', "'debarrel-(a|b)'"],
+  ['QP4', 'a b', "'a b'"],
+  ['QP5', '$HOME', "'$HOME'"],
+  ['QP6', '`id`', "'`id`'"],
+  ['QP7', "it's", "'it'\\''s'"],
+  ['QP8', 'say "hi"', '\'say "hi"\''],
+  ['QP9', '*.ts', "'*.ts'"],
+  ['QP9', '~/x', "'~/x'"],
+  ['QP9', 'a;b&c>d<e', "'a;b&c>d<e'"],
+  ['QP9', 'back\\slash', "'back\\slash'"],
+  ['QP10', '', "''"],
+  ['QP11', 'line1\nline2', "'line1\nline2'"]
+];
+
+const WINDOWS_SAFE_ARGUMENTS: string[] = [
+  '--test-path-pattern',
+  'bump',
+  'C:\\repo\\src\\',
+  '50%',
+  '$HOME',
+  "it's",
+  '*.ts',
+  'a;b,c=d'
+];
+
+const WINDOWS_QUOTED_ARGUMENTS: [string, string, string][] = [
+  ['QW2', 'bump|x', '"bump|x"'],
+  ['QW3', 'debarrel-(a|b)', '"debarrel-(a|b)"'],
+  ['QW4', 'a b', '"a b"'],
+  ['QW4', 'a&b', '"a&b"'],
+  ['QW4', 'a^b', '"a^b"'],
+  ['QW4', 'a<b>c', '"a<b>c"'],
+  ['QW5', 'say "hi"', '"say ""hi"""'],
+  ['QW6', 'C:\\dir with space\\', '"C:\\dir with space\\\\"'],
+  ['QW7', 'a\\"b', '"a\\\\""b"'],
+  ['QW8', '', '""'],
+  ['A2', 'a\tb', '"a\tb"']
+];
+
+describe(quoteShellArgumentIfNeeded.name, () => {
+  describe('POSIX', () => {
+    it.each(POSIX_SAFE_ARGUMENTS)('QP1: leaves %j unchanged', (argument: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, false)).toEqual(argument);
+    });
+
+    it.each(POSIX_QUOTED_ARGUMENTS)('%s: quotes %j', (row: string, argument: string, expected: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, false)).toEqual(expected);
+    });
+
+    (IS_WINDOWS ? it.skip : it).each([
+      ...POSIX_SAFE_ARGUMENTS,
+      ...POSIX_QUOTED_ARGUMENTS.map(([, argument]) => argument)
+    ])('R1: sh passes %j through as one literal argument', (argument: string) => {
+      const result: childProcess.SpawnSyncReturns<string> = childProcess.spawnSync(
+        'sh',
+        ['-c', `set -- ${quoteShellArgumentIfNeeded(argument, false)}; printf '%s:%s' "$#" "$1"`],
+        { encoding: 'utf8' }
+      );
+      expect(result.stderr).toEqual('');
+      expect(result.status).toEqual(0);
+      expect(result.stdout).toEqual(`1:${argument}`);
+    });
+  });
+
+  describe('Windows', () => {
+    it.each(WINDOWS_SAFE_ARGUMENTS)('QW1: leaves %j unchanged', (argument: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, true)).toEqual(argument);
+    });
+
+    it.each(WINDOWS_QUOTED_ARGUMENTS)('%s: quotes %j', (row: string, argument: string, expected: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, true)).toEqual(expected);
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts b/libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts
new file mode 100644
index 00000000000..e7570b28a01
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts
@@ -0,0 +1,103 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { runDuringChecksAsync } from '../runDuringChecksAsync';
+
+interface IDeferred<T> {
+  readonly promise: Promise<T>;
+  resolve(value: T): void;
+  reject(error: Error): void;
+}
+
+function createDeferred<T>(): IDeferred<T> {
+  let resolveDeferred!: (value: T) => void;
+  let rejectDeferred!: (error: Error) => void;
+  const promise: Promise<T> = new Promise<T>((resolve, reject) => {
+    resolveDeferred = resolve;
+    rejectDeferred = reject;
+  });
+  return { promise, resolve: resolveDeferred, reject: rejectDeferred };
+}
+
+// Lets every pending callback run, including those of timers and of I/O
+function waitForTurnsAsync(): Promise<void> {
+  return new Promise((resolve: () => void) => setTimeout(resolve, 10));
+}
+
+describe(runDuringChecksAsync.name, () => {
+  it('starts the operation before the checks, and returns its result once both finish', async () => {
+    const events: string[] = [];
+    const operation: IDeferred<number> = createDeferred();
+    const resultPromise: Promise<number> = runDuringChecksAsync(
+      async () => {
+        events.push('operation started');
+        return await operation.promise;
+      },
+      async () => {
+        events.push('checks started');
+        await waitForTurnsAsync();
+        events.push('checks passed');
+      }
+    );
+    let result: number | undefined;
+    void resultPromise.then((value: number) => {
+      result = value;
+    });
+
+    expect(events).toEqual(['operation started', 'checks started']);
+    await waitForTurnsAsync();
+    await waitForTurnsAsync();
+    expect(events).toEqual(['operation started', 'checks started', 'checks passed']);
+    expect(result).toBeUndefined();
+    operation.resolve(3);
+    expect(await resultPromise).toBe(3);
+  });
+
+  it('throws the error of the operation if the checks pass', async () => {
+    const error: Error = new Error('The operation failed');
+
+    await expect(runDuringChecksAsync(() => Promise.reject(error), async () => {})).rejects.toBe(error);
+  });
+
+  it('waits for the operation if the checks fail, and throws the error of the checks', async () => {
+    const operation: IDeferred<number> = createDeferred();
+    const checkError: Error = new Error('The checks failed');
+    const resultPromise: Promise<number> = runDuringChecksAsync(
+      () => operation.promise,
+      async () => {
+        throw checkError;
+      }
+    );
+    let isSettled: boolean = false;
+    void resultPromise.then(
+      () => {
+        isSettled = true;
+      },
+      () => {
+        isSettled = true;
+      }
+    );
+
+    await waitForTurnsAsync();
+    expect(isSettled).toBe(false);
+    operation.reject(new Error('The operation failed too'));
+    await expect(resultPromise).rejects.toBe(checkError);
+  });
+
+  it('handles a failure of the operation while the checks run', async () => {
+    const onUnhandledRejection: jest.Mock = jest.fn();
+    process.on('unhandledRejection', onUnhandledRejection);
+    try {
+      const error: Error = new Error('The operation failed');
+      const resultPromise: Promise<number> = runDuringChecksAsync(
+        () => Promise.reject(error),
+        waitForTurnsAsync
+      );
+
+      await expect(resultPromise).rejects.toBe(error);
+      expect(onUnhandledRejection).not.toHaveBeenCalled();
+    } finally {
+      process.off('unhandledRejection', onUnhandledRejection);
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/test/streamUtilities.test.ts b/libraries/rush-lib/src/utilities/test/streamUtilities.test.ts
new file mode 100644
index 00000000000..e6875ff087d
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/streamUtilities.test.ts
@@ -0,0 +1,132 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { EventEmitter } from 'node:events';
+import { Writable } from 'node:stream';
+
+import { type IFlushableStream, waitForStreamsToFlushAsync } from '../streamUtilities';
+
+class FakeStream extends EventEmitter implements IFlushableStream {
+  public writable: boolean = true;
+  public writableLength: number;
+  public readonly writeCallbacks: (() => void)[] = [];
+
+  public constructor(writableLength: number) {
+    super();
+    this.writableLength = writableLength;
+  }
+
+  public write(chunk: string, callback: () => void): boolean {
+    this.writeCallbacks.push(callback);
+    return true;
+  }
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => {
+      settled = true;
+    },
+    () => {
+      settled = true;
+    }
+  );
+  await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+  return settled;
+}
+
+describe(waitForStreamsToFlushAsync.name, () => {
+  it('does not write to a stream that has nothing queued', async () => {
+    const stream: FakeStream = new FakeStream(0);
+
+    await expect(waitForStreamsToFlushAsync([stream])).resolves.toBeUndefined();
+
+    expect(stream.writeCallbacks).toHaveLength(0);
+  });
+
+  it('does not write to a stream that can no longer be written', async () => {
+    const stream: FakeStream = new FakeStream(100);
+    stream.writable = false;
+
+    await expect(waitForStreamsToFlushAsync([stream])).resolves.toBeUndefined();
+
+    expect(stream.writeCallbacks).toHaveLength(0);
+  });
+
+  it('waits until each stream with queued output has written it', async () => {
+    const stdout: FakeStream = new FakeStream(100);
+    const stderr: FakeStream = new FakeStream(20);
+    const idle: FakeStream = new FakeStream(0);
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stdout, stderr, idle]);
+
+    expect(stdout.writeCallbacks).toHaveLength(1);
+    expect(stderr.writeCallbacks).toHaveLength(1);
+    expect(idle.writeCallbacks).toHaveLength(0);
+    stdout.writeCallbacks[0]();
+    await expect(isSettledAsync(flush)).resolves.toBe(false);
+    stderr.writeCallbacks[0]();
+    await expect(flush).resolves.toBeUndefined();
+    expect(stdout.listenerCount('error')).toBe(0);
+    expect(stderr.listenerCount('error')).toBe(0);
+  });
+
+  it('handles the error event of a stream that fails while it waits', async () => {
+    const stream: FakeStream = new FakeStream(100);
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stream]);
+    // A Node.js stream that fails runs its pending write callbacks first, then emits 'error'.
+    stream.writable = false;
+    stream.writeCallbacks[0]();
+
+    await expect(flush).resolves.toBeUndefined();
+    expect(() => stream.emit('error', new Error('write EPIPE'))).not.toThrow();
+    expect(stream.listenerCount('error')).toBe(0);
+  });
+
+  it('waits for the writes that a Node.js stream has not finished', async () => {
+    const written: string[] = [];
+    const finishWrites: (() => void)[] = [];
+    const stream: Writable = new Writable({
+      write(chunk: Buffer, encoding: BufferEncoding, callback: () => void): void {
+        written.push(chunk.toString());
+        finishWrites.push(() => callback());
+      }
+    });
+    stream.write('first');
+    stream.write('second');
+    expect(stream.writableLength).toBe('firstsecond'.length);
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stream]);
+
+    finishWrites.shift()!();
+    await expect(isSettledAsync(flush)).resolves.toBe(false);
+    finishWrites.shift()!();
+    await expect(isSettledAsync(flush)).resolves.toBe(false);
+    expect(written).toEqual(['first', 'second', '']);
+    finishWrites.shift()!();
+    await expect(flush).resolves.toBeUndefined();
+    expect(stream.writableLength).toBe(0);
+    expect(stream.listenerCount('error')).toBe(0);
+  });
+
+  it('handles the error that a Node.js stream emits after it fails a queued write', async () => {
+    const finishWrites: ((error?: Error) => void)[] = [];
+    const stream: Writable = new Writable({
+      write(chunk: Buffer, encoding: BufferEncoding, callback: (error?: Error) => void): void {
+        finishWrites.push(callback);
+      }
+    });
+    stream.write('queued');
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stream]);
+    finishWrites.shift()!(new Error('write EPIPE'));
+
+    await expect(flush).resolves.toBeUndefined();
+    // The stream emits 'error' on a later tick. Without a listener, that is an uncaught exception.
+    await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+    expect(stream.destroyed).toBe(true);
+    expect(stream.listenerCount('error')).toBe(0);
+  });
+});
diff --git a/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap b/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
index e6cb906e490..ac25f219ff5 100644
--- a/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
+++ b/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
@@ -41,6 +41,8 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   'PhasedCommandEngine',
   'PhasedCommandEngineBusyError',
   'PhasedCommandEngineConfigurationChangedError',
+  'PhasedCommandEngineProjectConfigurationError',
+  'PhasedCommandEngineUsageError',
   'PhasedCommandHooks',
   'PnpmOptionsConfiguration',
   'ProjectChangeAnalyzer',
@@ -69,6 +71,7 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   '_OperationStateFile',
   '_RushGlobalFolder',
   '_RushInternals',
+  '_formatIterationStartLines',
   '_printOperationStatus',
   '_rushSdk_loadInternalModule',
   'captureProjectConfigurationFingerprintAsync',
@@ -77,9 +80,12 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   'createRushDiagnostic',
   'daemonEnvironmentVariables',
   'getWorkspaceFingerprintEnvironmentEntries',
+  'getWorkspaceHostEnvironment',
+  'getWorkspaceRequestOperationEnvironment',
   'parseReporterExtensionEventName',
   'resolveDaemonConfiguration',
-  'workspaceFingerprintIgnoredEnvironmentVariables'
+  'workspaceFingerprintIgnoredEnvironmentVariables',
+  'workspaceRequestScopedEnvironmentVariables'
 ]"
 `;
 
diff --git a/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts b/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts
index 2fe89023a36..e19e4c3a82b 100644
--- a/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts
+++ b/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts
@@ -525,10 +525,13 @@ export abstract class CommandLineParameterProvider {
 
     // First, loop through all parameters with short names. If there are any duplicates, disable the short names
     // since we can't prefix scopes to short names in order to deduplicate them. The duplicate short names will
-    // be reported as errors if the user attempts to use them.
+    // be reported as errors if the user attempts to use them. A short name that the parent action or tool also
+    // defines is a duplicate too. Disabling it here gives it its own parser key, so the parameter can still be
+    // used by its long name.
+    const { parentParameterNames } = state;
     const parametersWithDuplicateShortNames: Set<CommandLineParameterBase> = new Set();
     for (const [shortName, shortNameParameters] of this.#parametersByShortName.entries()) {
-      if (shortNameParameters.length > 1) {
+      if (shortNameParameters.length > 1 || parentParameterNames.has(shortName)) {
         for (const parameter of shortNameParameters) {
           this._defineAmbiguousParameter(shortName);
           parametersWithDuplicateShortNames.add(parameter);
@@ -559,7 +562,6 @@ export abstract class CommandLineParameterProvider {
 
     // Register the existing parameters as ambiguous parameters. These are generally provided by the
     // parent action.
-    const { parentParameterNames } = state;
     for (const parentParameterName of parentParameterNames) {
       this._defineAmbiguousParameter(parentParameterName);
     }
@@ -631,16 +633,21 @@ export abstract class CommandLineParameterProvider {
     // Search for any ambiguous parameters and throw an error if any are found
     for (const [parameterName, parserKey] of this._ambiguousParameterParserKeysByName) {
       if (data[parserKey]) {
+        const duplicateShortNameParameters: CommandLineParameterBase[] | undefined =
+          this.#parametersByShortName.get(parameterName);
+
         // When the parser key matches the actually registered parameter, we know that this is an ambiguous
-        // parameter sourced from the parent action or tool
-        if (this._registeredParameterParserKeysByName.get(parameterName) === parserKey) {
+        // parameter sourced from the parent action or tool. The same is true for a short name that only one
+        // parameter here uses, since one parameter can't make its own short name ambiguous.
+        if (
+          this._registeredParameterParserKeysByName.get(parameterName) === parserKey ||
+          duplicateShortNameParameters?.length === 1
+        ) {
           this.#throwParserExitError(parserOptions, data, 1, `Ambiguous option: "${parameterName}".`);
         }
 
         // Determine if the ambiguous parameter is a short name or a long name, since the process of finding
         // the non-ambiguous name is different for each.
-        const duplicateShortNameParameters: CommandLineParameterBase[] | undefined =
-          this.#parametersByShortName.get(parameterName);
         if (duplicateShortNameParameters) {
           // We also need to make sure we get the non-ambiguous long name for the parameter, since it is
           // possible for that the long name is ambiguous as well.
diff --git a/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts b/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts
index c6445201fc1..1aeb6d734b0 100644
--- a/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts
+++ b/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts
@@ -102,6 +102,37 @@ class AbbreviationAction extends CommandLineAction {
   }
 }
 
+class ShortNameAction extends CommandLineAction {
+  public done: boolean = false;
+  public deleteFlag: CommandLineFlagParameter;
+
+  public constructor() {
+    super({
+      actionName: 'do:the-job',
+      summary: 'does the job',
+      documentation: 'a longer description'
+    });
+
+    this.deleteFlag = this.defineFlagParameter({
+      parameterLongName: '--delete',
+      parameterShortName: '-d',
+      description: 'A flag whose short name the tool also declares'
+    });
+  }
+
+  protected override async onExecuteAsync(): Promise<void> {
+    this.done = true;
+  }
+}
+
+function defineToolDebugFlag(commandLineParser: CommandLineParser): CommandLineFlagParameter {
+  return commandLineParser.defineFlagParameter({
+    parameterLongName: '--debug',
+    parameterShortName: '-d',
+    description: 'A flag whose short name the action also declares'
+  });
+}
+
 class AliasAction extends AliasCommandLineAction {
   public constructor(targetActionClass: new () => CommandLineAction) {
     super({
@@ -250,6 +281,38 @@ class AbbreviationScopedAction extends ScopedCommandLineAction {
   }
 }
 
+class ShortNameScopedAction extends ScopedCommandLineAction {
+  public done: boolean = false;
+  public deleteFlag: CommandLineFlagParameter | undefined;
+
+  public constructor() {
+    super({
+      actionName: 'scoped-action',
+      summary: 'does the scoped action',
+      documentation: 'a longer description'
+    });
+
+    // At least one scoping parameter is required to be defined on a scoped action
+    this.defineFlagParameter({
+      parameterLongName: '--scoping',
+      description: 'The scoping parameter',
+      parameterGroup: SCOPING_PARAMETER_GROUP
+    });
+  }
+
+  protected override async onExecuteAsync(): Promise<void> {
+    this.done = true;
+  }
+
+  protected onDefineScopedParameters(scopedParameterProvider: CommandLineParameterProvider): void {
+    this.deleteFlag = scopedParameterProvider.defineFlagParameter({
+      parameterLongName: '--delete',
+      parameterShortName: '-d',
+      description: 'A flag whose short name the tool also declares'
+    });
+  }
+}
+
 describe(`Ambiguous ${CommandLineParser.name}`, () => {
   it('renders help text', () => {
     const commandLineParser: GenericCommandLine = new GenericCommandLine(
@@ -357,6 +420,47 @@ describe(`Ambiguous ${CommandLineParser.name}`, () => {
     expect(action.abbreviationFlag.value).toBe(true);
     expect(toolAbbreviationFlag.value).toBe(false);
   });
+
+  it('can execute a parameter by its long name when the tool also declares its short name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameAction);
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+
+    await commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job', '--delete']);
+
+    expect(commandLineParser.selectedAction).toBeDefined();
+    expect(commandLineParser.selectedAction!.actionName).toEqual('do:the-job');
+
+    const action: ShortNameAction = commandLineParser.selectedAction as ShortNameAction;
+    expect(action.done).toBe(true);
+    expect(action.deleteFlag.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(false);
+
+    // The action's help doesn't offer the short name, since it can't be used after the action name
+    const helpText: string = action.renderHelpText();
+    expect(helpText).toContain('  --delete ');
+    expect(helpText).not.toContain('-d, --delete');
+  });
+
+  it('can use a short name declared in both the tool and the action before the action name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameAction);
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+
+    await commandLineParser.executeWithoutErrorHandlingAsync(['-d', 'do:the-job', '--delete']);
+
+    const action: ShortNameAction = commandLineParser.selectedAction as ShortNameAction;
+    expect(action.done).toBe(true);
+    expect(action.deleteFlag.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(true);
+  });
+
+  it('fails when providing a short name to an action that was also declared in the tool', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameAction);
+    defineToolDebugFlag(commandLineParser);
+
+    await expect(commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job', '-d'])).rejects.toThrow(
+      'Error: example do:the-job: error: Ambiguous option: "-d".\n'
+    );
+  });
 });
 
 describe(`Ambiguous aliased ${CommandLineParser.name}`, () => {
@@ -478,6 +582,37 @@ describe(`Ambiguous aliased ${CommandLineParser.name}`, () => {
     expect(action.abbreviationFlag.value).toBe(true);
     expect(toolAbbreviationFlag.value).toBe(false);
   });
+
+  it('can execute a parameter by its long name when the tool also declares its short name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(AliasAction, ShortNameAction);
+    commandLineParser.addAction(
+      (commandLineParser.getAction('do:the-job-alias')! as AliasAction).targetAction
+    );
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+
+    await commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job-alias', '--delete']);
+
+    expect(commandLineParser.selectedAction).toBeDefined();
+    expect(commandLineParser.selectedAction!.actionName).toEqual('do:the-job-alias');
+
+    const action: ShortNameAction = (commandLineParser.selectedAction as AliasAction)
+      .targetAction as ShortNameAction;
+    expect(action.done).toBe(true);
+    expect(action.deleteFlag.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(false);
+  });
+
+  it('fails when providing a short name to an action that was also declared in the tool', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(AliasAction, ShortNameAction);
+    commandLineParser.addAction(
+      (commandLineParser.getAction('do:the-job-alias')! as AliasAction).targetAction
+    );
+    defineToolDebugFlag(commandLineParser);
+
+    await expect(
+      commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job-alias', '-d'])
+    ).rejects.toThrow('Error: example do:the-job-alias: error: Ambiguous option: "-d".\n');
+  });
 });
 
 describe(`Ambiguous scoping ${CommandLineParser.name}`, () => {
@@ -676,4 +811,34 @@ describe(`Ambiguous scoping ${CommandLineParser.name}`, () => {
     expect(targetAction.scopedAbbreviationFlag?.value).toBe(true);
     expect(targetAction.unscopedAbbreviationFlag?.value).toBe(false);
   });
+
+  it('can execute a scoped parameter by its long name when the tool also declares its short name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameScopedAction);
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+    const targetAction: ShortNameScopedAction = commandLineParser.getAction(
+      'scoped-action'
+    ) as ShortNameScopedAction;
+
+    await commandLineParser.executeWithoutErrorHandlingAsync([
+      'scoped-action',
+      '--scoping',
+      '--',
+      '--delete'
+    ]);
+
+    expect(commandLineParser.selectedAction).toBeDefined();
+    expect(commandLineParser.selectedAction!.actionName).toEqual('scoped-action');
+    expect(targetAction.done).toBe(true);
+    expect(targetAction.deleteFlag?.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(false);
+  });
+
+  it('fails when providing a short name to a scoped action that was also declared in the tool', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameScopedAction);
+    defineToolDebugFlag(commandLineParser);
+
+    await expect(
+      commandLineParser.executeWithoutErrorHandlingAsync(['scoped-action', '--scoping', '--', '-d'])
+    ).rejects.toThrow('Error: example scoped-action --scoping --: error: Ambiguous option: "-d".\n');
+  });
 });
diff --git a/rush-plugins/rush-amazon-s3-build-cache-plugin/rush-plugin-manifest.json b/rush-plugins/rush-amazon-s3-build-cache-plugin/rush-plugin-manifest.json
index bf2fa9de952..397cf222c64 100644
--- a/rush-plugins/rush-amazon-s3-build-cache-plugin/rush-plugin-manifest.json
+++ b/rush-plugins/rush-amazon-s3-build-cache-plugin/rush-plugin-manifest.json
@@ -5,7 +5,8 @@
       "pluginName": "rush-amazon-s3-build-cache-plugin",
       "description": "Rush plugin for Amazon S3 cloud build cache",
       "entryPoint": "./lib-commonjs/index.js",
-      "optionsSchema": "./lib-commonjs/schemas/amazon-s3-config.schema.json"
+      "optionsSchema": "./lib-commonjs/schemas/amazon-s3-config.schema.json",
+      "daemonCommandAgnostic": true
     }
   ]
 }
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/rush-plugin-manifest.json b/rush-plugins/rush-azure-storage-build-cache-plugin/rush-plugin-manifest.json
index bfd4ef894a6..5d33b3f5d41 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/rush-plugin-manifest.json
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/rush-plugin-manifest.json
@@ -5,7 +5,8 @@
       "pluginName": "rush-azure-storage-build-cache-plugin",
       "description": "Rush plugin for Azure storage cloud build cache",
       "entryPoint": "./lib-commonjs/index.js",
-      "optionsSchema": "./lib-commonjs/schemas/azure-blob-storage-config.schema.json"
+      "optionsSchema": "./lib-commonjs/schemas/azure-blob-storage-config.schema.json",
+      "daemonCommandAgnostic": true
     },
     {
       "pluginName": "rush-azure-interactive-auth-plugin",
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts
index 892cb0897bf..62008d89a67 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts
@@ -30,6 +30,10 @@ export interface IAzureStorageAuthenticationOptions extends IAzureAuthentication
 
 const SAS_TTL_MILLISECONDS: number = 7 * 24 * 60 * 60 * 1000; // Seven days
 
+function getDefaultStorageAccountUrl(storageAccountName: string): string {
+  return `https://${storageAccountName}.blob.core.windows.net/`;
+}
+
 /**
  * @public
  */
@@ -52,12 +56,18 @@ export class AzureStorageAuthentication extends AzureAuthenticationBase {
       ? storageEndpoint.endsWith('/')
         ? storageEndpoint
         : storageEndpoint + '/'
-      : `https://${storageAccountName}.blob.core.windows.net/`;
+      : getDefaultStorageAccountUrl(storageAccountName);
   }
 
   protected _getCacheIdParts(): string[] {
     const cacheIdParts: string[] = [this._storageAccountName, this._storageContainerName];
 
+    // A saved credential is sent to the endpoint that it was saved for, and to no other. The default
+    // endpoint keeps the ID that it had before storageEndpoint existed.
+    if (this._storageAccountUrl !== getDefaultStorageAccountUrl(this._storageAccountName)) {
+      cacheIdParts.push(this._storageAccountUrl);
+    }
+
     if (this._isCacheWriteAllowedByConfiguration) {
       cacheIdParts.push('cacheWriteAllowed');
     }
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts
index c31205778ec..18186b9e734 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts
@@ -42,6 +42,11 @@ interface IBlobError extends Error {
   };
 }
 
+interface IKeptContainerClient {
+  client: ContainerClient;
+  isAnonymous: boolean;
+}
+
 export class AzureStorageBuildCacheProvider
   extends AzureStorageAuthentication
   implements ICloudBuildCacheProvider
@@ -54,7 +59,10 @@ export class AzureStorageBuildCacheProvider
     return EnvironmentConfiguration.buildCacheWriteAllowed ?? this._isCacheWriteAllowedByConfiguration;
   }
 
-  #containerClient: ContainerClient | undefined;
+  // A long-lived process, such as the Rush daemon, keeps this provider across builds. So a client made
+  // from a credential is kept only until Azure Storage rejects it, and an anonymous client only until
+  // a credential is cached.
+  #keptContainerClient: IKeptContainerClient | undefined;
 
   public constructor(options: IAzureStorageBuildCacheProviderOptions) {
     super({
@@ -131,7 +139,8 @@ export class AzureStorageBuildCacheProvider
     cacheId: string,
     getBlobDataAsync: (blobClient: BlobClient) => Promise<T>
   ): Promise<T | undefined> {
-    const blobClient: BlobClient = await this.#getBlobClientForCacheIdAsync(cacheId, terminal);
+    const containerClient: ContainerClient = await this.#getContainerClientAsync(terminal);
+    const blobClient: BlobClient = this.#getBlobClient(containerClient, cacheId);
 
     try {
       const blobExists: boolean = await blobClient.exists();
@@ -142,6 +151,7 @@ export class AzureStorageBuildCacheProvider
       }
     } catch (err) {
       this.#logBlobError(terminal, err, 'Error getting cache entry from Azure Storage: ');
+      this.#forgetRejectedClient(containerClient, err);
       return undefined;
     }
   }
@@ -163,7 +173,8 @@ export class AzureStorageBuildCacheProvider
       return false;
     }
 
-    const blobClient: BlobClient = await this.#getBlobClientForCacheIdAsync(cacheId, terminal);
+    const containerClient: ContainerClient = await this.#getContainerClientAsync(terminal);
+    const blobClient: BlobClient = this.#getBlobClient(containerClient, cacheId);
     const blockBlobClient: BlockBlobClient = blobClient.getBlockBlobClient();
     let blobAlreadyExists: boolean = false;
 
@@ -183,6 +194,7 @@ export class AzureStorageBuildCacheProvider
           .join(' ');
 
       terminal.writeWarningLine(errorMessage);
+      this.#forgetRejectedClient(containerClient, err);
     }
 
     if (blobAlreadyExists) {
@@ -204,16 +216,32 @@ export class AzureStorageBuildCacheProvider
           return true;
         } else {
           terminal.writeWarningLine(`Error uploading cache entry to Azure Storage: ${e}`);
+          this.#forgetRejectedClient(containerClient, e);
           return false;
         }
       }
     }
   }
 
-  async #getBlobClientForCacheIdAsync(cacheId: string, terminal: ITerminal): Promise<BlobClient> {
-    const client: ContainerClient = await this.#getContainerClientAsync(terminal);
+  #getBlobClient(containerClient: ContainerClient, cacheId: string): BlobClient {
     const blobName: string = this.#blobPrefix ? `${this.#blobPrefix}/${cacheId}` : cacheId;
-    return client.getBlobClient(blobName);
+    return containerClient.getBlobClient(blobName);
+  }
+
+  /**
+   * Azure Storage answers 401 or 403 when it rejects a credential, for example once it has expired.
+   * Forget the client that was made from it, so that the next request reads the cached credential again.
+   */
+  #forgetRejectedClient(containerClient: ContainerClient, error: unknown): void {
+    const statusCode: number | undefined = (error as IBlobError | undefined)?.statusCode;
+    const keptClient: IKeptContainerClient | undefined = this.#keptContainerClient;
+    if (
+      (statusCode === 401 || statusCode === 403) &&
+      keptClient?.client === containerClient &&
+      !keptClient.isAnonymous
+    ) {
+      this.#keptContainerClient = undefined;
+    }
   }
 
   #logBlobError(terminal: ITerminal, err: unknown, prefix: string): void {
@@ -253,37 +281,58 @@ export class AzureStorageBuildCacheProvider
   }
 
   async #getContainerClientAsync(terminal: ITerminal): Promise<ContainerClient> {
-    if (!this.#containerClient) {
-      let sasString: string | undefined = this.#environmentCredential;
-      if (!sasString) {
-        const credentialEntry: ICredentialCacheEntry | undefined = await this.tryGetCachedCredentialAsync({
+    const keptClient: IKeptContainerClient | undefined = this.#keptContainerClient;
+    if (keptClient && !keptClient.isAnonymous) {
+      return keptClient.client;
+    }
+
+    let sasString: string | undefined = this.#environmentCredential;
+    if (!sasString) {
+      let credentialEntry: ICredentialCacheEntry | undefined;
+      if (keptClient) {
+        // While the kept client is anonymous, look for a credential on each request, and don't repeat
+        // the warning about an expired one. If the file can't be read, for example while it is being
+        // written, keep using the anonymous client rather than failing the request.
+        try {
+          credentialEntry = await this.tryGetCachedCredentialAsync({ expiredCredentialBehavior: 'ignore' });
+        } catch {
+          terminal.writeVerboseLine(
+            "Couldn't read the cached Azure Storage credentials. Using the build cache without them."
+          );
+        }
+      } else {
+        credentialEntry = await this.tryGetCachedCredentialAsync({
           expiredCredentialBehavior: 'logWarning',
           terminal
         });
-
-        sasString = credentialEntry?.credential;
       }
 
-      let blobServiceClient: BlobServiceClient;
-      if (sasString) {
-        const connectionString: string = this.#getConnectionString(sasString);
-        blobServiceClient = BlobServiceClient.fromConnectionString(connectionString);
-      } else if (!this.#readRequiresAuthentication && !this._isCacheWriteAllowedByConfiguration) {
-        // If we don't have a credential and read doesn't require authentication, we can still read from the cache.
-        blobServiceClient = new BlobServiceClient(this._storageAccountUrl);
-      } else {
-        throw new Error(
-          "An Azure Storage SAS credential hasn't been provided, or has expired. " +
-            `Update the credentials by running "rush ${RushConstants.updateCloudCredentialsCommandName}", ` +
-            `or provide a SAS in the ` +
-            `${EnvironmentVariableNames.RUSH_BUILD_CACHE_CREDENTIAL} environment variable`
-        );
-      }
+      sasString = credentialEntry?.credential;
+    }
+
+    if (keptClient && !sasString) {
+      return keptClient.client;
+    }
 
-      this.#containerClient = blobServiceClient.getContainerClient(this._storageContainerName);
+    let blobServiceClient: BlobServiceClient;
+    if (sasString) {
+      const connectionString: string = this.#getConnectionString(sasString);
+      blobServiceClient = BlobServiceClient.fromConnectionString(connectionString);
+    } else if (!this.#readRequiresAuthentication && !this._isCacheWriteAllowedByConfiguration) {
+      // If we don't have a credential and read doesn't require authentication, we can still read from the cache.
+      blobServiceClient = new BlobServiceClient(this._storageAccountUrl);
+    } else {
+      throw new Error(
+        "An Azure Storage SAS credential hasn't been provided, or has expired. " +
+          `Update the credentials by running "rush ${RushConstants.updateCloudCredentialsCommandName}", ` +
+          `or provide a SAS in the ` +
+          `${EnvironmentVariableNames.RUSH_BUILD_CACHE_CREDENTIAL} environment variable`
+      );
     }
 
-    return this.#containerClient;
+    const containerClient: ContainerClient = blobServiceClient.getContainerClient(this._storageContainerName);
+    this.#keptContainerClient = { client: containerClient, isAnonymous: !sasString };
+    return containerClient;
   }
 
   #getConnectionString(sasString: string | undefined): string {
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts
index 4955f96f27b..298483de098 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts
@@ -41,6 +41,13 @@ interface IAzureBlobStorageConfigurationJson {
    * An optional custom endpoint URL for the Azure Blob Storage account.
    * Use this to connect to Azurite, private endpoints, or storage emulators.
    * Overrides the default endpoint derived from storageAccountName.
+   *
+   * @remarks
+   * A credential saved by `rush update-cloud-credentials` is used only with the endpoint that it was
+   * saved for. An Azure login (`rush update-cloud-credentials --interactive`) needs an `https://` endpoint.
+   * For an `http://` endpoint, such as Azurite, provide a SAS token with
+   * `rush update-cloud-credentials --credential` or the `RUSH_BUILD_CACHE_CREDENTIAL` environment variable,
+   * or read without a credential.
    */
   readonly storageEndpoint?: string;
 
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json b/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json
index 2ffcd58e4ba..4d8efdc56d9 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json
@@ -97,8 +97,9 @@
 
     "storageEndpoint": {
       "type": "string",
-      "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
-      "format": "uri"
+      "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. The URL must start with \"http://\" or \"https://\". A credential saved by \"rush update-cloud-credentials\" is used only with the endpoint that it was saved for. An Azure login (\"rush update-cloud-credentials --interactive\") needs an \"https://\" endpoint. For an \"http://\" endpoint, such as Azurite, provide a SAS token with \"rush update-cloud-credentials --credential\" or the RUSH_BUILD_CACHE_CREDENTIAL environment variable, or read without a credential. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
+      "format": "uri",
+      "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://"
     },
 
     "isCacheWriteAllowed": {
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts
new file mode 100644
index 00000000000..17bcb5cda60
--- /dev/null
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { JsonFile, JsonSchema, type JsonObject } from '@rushstack/node-core-library';
+
+const PACKAGE_FOLDER: string = path.resolve(__dirname, '../..');
+const PLUGIN_NAME: string = 'rush-azure-storage-build-cache-plugin';
+const OPTIONS_FILE_PATH: string = `common/config/rush-plugins/${PLUGIN_NAME}.json`;
+const PATTERN_ERROR: RegExp =
+  /#\/storageEndpoint\s+must match pattern "\^\[Hh\]\[Tt\]\[Tt\]\[Pp\]\[Ss\]\?:\/\/"/;
+
+interface IRushPluginManifestJson {
+  plugins: { pluginName: string; optionsSchema?: string }[];
+}
+
+// Rush validates common/config/rush-plugins/<plugin>.json with the schema that the plugin's manifest names.
+function loadOptionsSchema(): JsonSchema {
+  const manifest: IRushPluginManifestJson = JsonFile.load(`${PACKAGE_FOLDER}/rush-plugin-manifest.json`);
+  const optionsSchema: string | undefined = manifest.plugins.find(
+    (plugin) => plugin.pluginName === PLUGIN_NAME
+  )?.optionsSchema;
+  if (!optionsSchema) {
+    throw new Error(`The manifest names no optionsSchema for ${PLUGIN_NAME}`);
+  }
+
+  return JsonSchema.fromFile(path.join(PACKAGE_FOLDER, optionsSchema));
+}
+
+describe('the options schema of rush-azure-storage-build-cache-plugin', () => {
+  let schema: JsonSchema;
+
+  beforeAll(() => {
+    schema = loadOptionsSchema();
+  });
+
+  function validate(storageEndpoint: string | undefined): void {
+    const options: JsonObject = { storageAccountName: 'example', storageContainerName: 'build-cache' };
+    if (storageEndpoint !== undefined) {
+      options.storageEndpoint = storageEndpoint;
+    }
+
+    schema.validateObject(options, OPTIONS_FILE_PATH);
+  }
+
+  it.each([
+    // "localhost:" parses as a URI scheme, so only the pattern catches this common mistake.
+    { kind: 'no scheme', storageEndpoint: 'localhost:10000/devstoreaccount1' },
+    { kind: 'another scheme', storageEndpoint: 'ftp://example.com/devstoreaccount1' },
+    { kind: 'a scheme that only ends in https', storageEndpoint: 'git+https://example.com/devstoreaccount1' }
+  ])('rejects a storageEndpoint with $kind', ({ storageEndpoint }) => {
+    expect(() => validate(storageEndpoint)).toThrow(PATTERN_ERROR);
+  });
+
+  it('rejects a storageEndpoint that is not a URI', () => {
+    expect(() => validate('http://127.0.0.1 port 10000')).toThrow(
+      /#\/storageEndpoint\s+must match format "uri"/
+    );
+  });
+
+  it.each([
+    { kind: 'no storageEndpoint', storageEndpoint: undefined },
+    { kind: 'an http storageEndpoint', storageEndpoint: 'http://127.0.0.1:10000/devstoreaccount1' },
+    { kind: 'an https storageEndpoint', storageEndpoint: 'https://my-proxy.example.com/devstoreaccount1' },
+    // URI schemes are case-insensitive, and Rush accepted this before the pattern existed.
+    { kind: 'a storageEndpoint with an uppercase scheme', storageEndpoint: 'HTTP://127.0.0.1:10000/x' },
+    { kind: 'a storageEndpoint with a mixed-case scheme', storageEndpoint: 'hTtPs://example.com/x' }
+  ])('accepts $kind', ({ storageEndpoint }) => {
+    expect(() => validate(storageEndpoint)).not.toThrow();
+  });
+});
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
index 25cb7d50bc1..6dc03c12f7b 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
@@ -1,7 +1,13 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { CredentialCache } from '@rushstack/credential-cache';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { BlobServiceClient, type BlockBlobClient, type ContainerClient } from '@azure/storage-blob';
+
+import { CredentialCache, type ICredentialCacheEntry } from '@rushstack/credential-cache';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import { EnvironmentConfiguration, RushUserConfiguration } from '@rushstack/rush-sdk';
 
@@ -65,6 +71,78 @@ describe(AzureStorageBuildCacheProvider.name, () => {
     });
   });
 
+  describe('a saved credential', () => {
+    const EMULATOR_ENDPOINT: string = 'http://127.0.0.1:10000/devstoreaccount1';
+    const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+    let cacheFolder: string;
+
+    beforeEach(() => {
+      cacheFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'azure-storage-credentials-'));
+      const usingAsync: typeof CredentialCache.usingAsync = CredentialCache.usingAsync.bind(CredentialCache);
+      jest
+        .spyOn(CredentialCache, 'usingAsync')
+        .mockImplementation((options, doActionAsync) =>
+          usingAsync({ ...options, cacheFilePath: `${cacheFolder}/credentials.json` }, doActionAsync)
+        );
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+      fs.rmSync(cacheFolder, { recursive: true, force: true });
+    });
+
+    function createProvider(storageEndpoint?: string): AzureStorageBuildCacheProvider {
+      return new AzureStorageBuildCacheProvider({
+        storageAccountName: 'storage-account',
+        storageContainerName: 'container-name',
+        storageEndpoint,
+        isCacheWriteAllowed: true
+      });
+    }
+
+    async function tryGetSavedCredentialAsync(storageEndpoint?: string): Promise<string | undefined> {
+      return (await createProvider(storageEndpoint).tryGetCachedCredentialAsync())?.credential;
+    }
+
+    it('is used only with the endpoint that it was saved for', async () => {
+      await createProvider().updateCachedCredentialAsync(terminal, 'account-sas');
+      expect(await tryGetSavedCredentialAsync()).toBe('account-sas');
+      expect(await tryGetSavedCredentialAsync(EMULATOR_ENDPOINT)).toBeUndefined();
+
+      await createProvider(EMULATOR_ENDPOINT).updateCachedCredentialAsync(terminal, 'emulator-sas');
+      expect(await tryGetSavedCredentialAsync(EMULATOR_ENDPOINT)).toBe('emulator-sas');
+      expect(await tryGetSavedCredentialAsync(`${EMULATOR_ENDPOINT}/`)).toBe('emulator-sas');
+      expect(await tryGetSavedCredentialAsync('https://proxy.example.com/devstoreaccount1')).toBeUndefined();
+      expect(await tryGetSavedCredentialAsync()).toBe('account-sas');
+
+      const savedJson: { cacheEntries: Record<string, unknown> } = JSON.parse(
+        fs.readFileSync(`${cacheFolder}/credentials.json`, 'utf8')
+      );
+      expect(Object.keys(savedJson.cacheEntries).sort()).toEqual([
+        'azure-blob-storage|AzurePublicCloud|storage-account|container-name|cacheWriteAllowed',
+        `azure-blob-storage|AzurePublicCloud|storage-account|container-name|${EMULATOR_ENDPOINT}/|cacheWriteAllowed`
+      ]);
+    });
+
+    it("is shared with a storageEndpoint that names the account's default endpoint", async () => {
+      await createProvider().updateCachedCredentialAsync(terminal, 'account-sas');
+      expect(await tryGetSavedCredentialAsync('https://storage-account.blob.core.windows.net')).toBe(
+        'account-sas'
+      );
+      expect(await tryGetSavedCredentialAsync('https://storage-account.blob.core.windows.net/')).toBe(
+        'account-sas'
+      );
+    });
+
+    it('is deleted only for the configured endpoint', async () => {
+      await createProvider().updateCachedCredentialAsync(terminal, 'account-sas');
+      await createProvider(EMULATOR_ENDPOINT).updateCachedCredentialAsync(terminal, 'emulator-sas');
+      await createProvider(EMULATOR_ENDPOINT).deleteCachedCredentialsAsync(terminal);
+      expect(await tryGetSavedCredentialAsync(EMULATOR_ENDPOINT)).toBeUndefined();
+      expect(await tryGetSavedCredentialAsync()).toBe('account-sas');
+    });
+  });
+
   describe('isCacheWriteAllowed', () => {
     function prepareSubject(
       optionValue: boolean,
@@ -133,4 +211,265 @@ describe(AzureStorageBuildCacheProvider.name, () => {
   it('Has an expected cached credential name (write allowed)', async () => {
     await testCredentialCache(true);
   });
+
+  describe('a credential that changes while the provider is in use', () => {
+    const FIRST_SAS: string = 'sv=2025-01-05&sp=rcw&sig=first-secret-signature';
+    const SECOND_SAS: string = 'sv=2025-01-05&sp=rcw&sig=second-secret-signature';
+    const SECRETS: string[] = ['first-secret-signature', 'second-secret-signature'];
+
+    type BlobOperation = 'exists' | 'download' | 'upload';
+    // 'hit' and 'miss' answer an existence check; a number is the status code of an error
+    type FakeResponse = 'hit' | 'miss' | 'ok' | number;
+
+    let cachedCredential: ICredentialCacheEntry | undefined;
+    let credentialReads: number;
+    let requests: string[];
+    let respond: (credentialName: string, operation: BlobOperation) => FakeResponse | Promise<FakeResponse>;
+    let terminalProvider: StringBufferTerminalProvider;
+    let terminal: Terminal;
+
+    function getCredentialName(sasString: string | undefined): string {
+      return sasString === FIRST_SAS ? 'first' : sasString === SECOND_SAS ? 'second' : 'anonymous';
+    }
+
+    function createBlobError(statusCode: number): Error {
+      const errorCode: string = `Status${statusCode}ErrorCode`;
+      return Object.assign(new Error(`The request failed with status ${statusCode}.`), {
+        name: 'RestError',
+        statusCode,
+        code: errorCode,
+        response: { status: statusCode, parsedHeaders: { errorCode } }
+      });
+    }
+
+    function createFakeContainerClient(sasString: string | undefined): ContainerClient {
+      const credentialName: string = getCredentialName(sasString);
+      async function requestAsync(operation: BlobOperation): Promise<FakeResponse> {
+        requests.push(`${operation} ${credentialName}`);
+        const response: FakeResponse = await respond(credentialName, operation);
+        if (typeof response === 'number') {
+          throw createBlobError(response);
+        }
+        return response;
+      }
+
+      const blobClient: Partial<BlockBlobClient> = {
+        exists: () => requestAsync('exists').then((response: FakeResponse) => response === 'hit'),
+        downloadToBuffer: (async () => {
+          await requestAsync('download');
+          return Buffer.from(`read with ${credentialName}`);
+        }) as BlockBlobClient['downloadToBuffer'],
+        upload: (async () => {
+          await requestAsync('upload');
+        }) as unknown as BlockBlobClient['upload'],
+        getBlockBlobClient: () => blobClient as BlockBlobClient
+      };
+      return { getBlobClient: () => blobClient } as unknown as ContainerClient;
+    }
+
+    function createSubject(isCacheWriteAllowed: boolean = false): AzureStorageBuildCacheProvider {
+      return new AzureStorageBuildCacheProvider({
+        storageAccountName: 'storage-account',
+        storageContainerName: 'container-name',
+        isCacheWriteAllowed
+      });
+    }
+
+    beforeEach(() => {
+      cachedCredential = undefined;
+      credentialReads = 0;
+      requests = [];
+      terminalProvider = new StringBufferTerminalProvider();
+      terminal = new Terminal(terminalProvider);
+
+      jest.spyOn(CredentialCache, 'usingAsync').mockImplementation(async (options, doActionAsync) => {
+        credentialReads++;
+        await doActionAsync({ tryGetCacheEntry: () => cachedCredential } as unknown as CredentialCache);
+      });
+      jest.spyOn(BlobServiceClient, 'fromConnectionString').mockImplementation(
+        (connectionString: string) =>
+          ({
+            getContainerClient: () =>
+              createFakeContainerClient(connectionString.split('SharedAccessSignature=')[1])
+          }) as unknown as BlobServiceClient
+      );
+      jest
+        .spyOn(BlobServiceClient.prototype, 'getContainerClient')
+        .mockImplementation(() => createFakeContainerClient(undefined));
+    });
+
+    afterEach(() => {
+      const allOutput: string = JSON.stringify(terminalProvider.getAllOutput());
+      for (const secret of SECRETS) {
+        expect(allOutput).not.toContain(secret);
+      }
+
+      jest.restoreAllMocks();
+    });
+
+    it.each([
+      { anonymousResult: 'a miss', anonymousResponse: 'miss' as const },
+      { anonymousResult: '401', anonymousResponse: 401 }
+    ])(
+      'uses a credential that was cached after an anonymous read got $anonymousResult',
+      async ({ anonymousResponse }) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject();
+        respond = (credentialName: string) => (credentialName === 'anonymous' ? anonymousResponse : 'hit');
+
+        expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+        cachedCredential = { credential: FIRST_SAS };
+        const entry: Buffer | undefined = await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+        expect(entry?.toString()).toBe('read with first');
+        expect(requests).toEqual(['exists anonymous', 'exists first', 'download first']);
+        expect(credentialReads).toBe(2);
+      }
+    );
+
+    it.each([
+      { anonymousResult: 'a miss', anonymousResponse: 'miss' as const },
+      { anonymousResult: '401', anonymousResponse: 401 }
+    ])(
+      'reuses the anonymous client and warns once about an expired credential when reads get $anonymousResult',
+      async ({ anonymousResponse }) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject();
+        respond = () => anonymousResponse;
+        cachedCredential = { credential: FIRST_SAS, expires: new Date(Date.now() - 60_000) };
+
+        await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+        await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+        expect(requests).toEqual(['exists anonymous', 'exists anonymous']);
+        expect(credentialReads).toBe(2);
+        expect(BlobServiceClient.prototype.getContainerClient).toHaveBeenCalledTimes(1);
+        expect(terminalProvider.getWarningOutput().match(/have expired/g)).toHaveLength(1);
+      }
+    );
+
+    it("keeps using the anonymous client when the cached credentials can't be read", async () => {
+      const subject: AzureStorageBuildCacheProvider = createSubject();
+      respond = () => 'miss';
+
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+      jest.mocked(CredentialCache.usingAsync).mockRejectedValueOnce(new Error('Unexpected end of input'));
+      expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+      cachedCredential = { credential: FIRST_SAS };
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+      expect(requests).toEqual(['exists anonymous', 'exists anonymous', 'exists first']);
+      expect(BlobServiceClient.prototype.getContainerClient).toHaveBeenCalledTimes(1);
+      expect(terminalProvider.getWarningOutput()).toBe('');
+      expect(terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('keeps a newer client when an older one is rejected late', async () => {
+      const subject: AzureStorageBuildCacheProvider = createSubject();
+      let onLateRequest!: () => void;
+      const lateRequestSent: Promise<void> = new Promise<void>((resolve) => {
+        onLateRequest = resolve;
+      });
+      let answerLateRequest!: () => void;
+      const lateResponse: Promise<FakeResponse> = new Promise<FakeResponse>((resolve) => {
+        answerLateRequest = () => resolve(403);
+      });
+      let firstRequests: number = 0;
+      respond = (credentialName: string) => {
+        if (credentialName !== 'first') {
+          return 'hit';
+        } else if (firstRequests++ === 0) {
+          onLateRequest();
+          return lateResponse;
+        } else {
+          return 403;
+        }
+      };
+      cachedCredential = { credential: FIRST_SAS };
+
+      const lateRead: Promise<Buffer | undefined> = subject.tryGetCacheEntryBufferByIdAsync(
+        terminal,
+        'cache-id'
+      );
+      await lateRequestSent;
+      expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+      cachedCredential = { credential: SECOND_SAS };
+      expect((await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id'))?.toString()).toBe(
+        'read with second'
+      );
+      answerLateRequest();
+      expect(await lateRead).toBeUndefined();
+      expect((await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id'))?.toString()).toBe(
+        'read with second'
+      );
+
+      expect(credentialReads).toBe(2);
+    });
+
+    it('keeps a client made from a credential while Azure Storage accepts it, or fails with another status', async () => {
+      const subject: AzureStorageBuildCacheProvider = createSubject();
+      let failNextRequest: boolean = false;
+      respond = () => (failNextRequest ? 500 : 'hit');
+      cachedCredential = { credential: FIRST_SAS };
+
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+      failNextRequest = true;
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+      failNextRequest = false;
+      cachedCredential = { credential: SECOND_SAS };
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+      expect(requests).toEqual([
+        'exists first',
+        'download first',
+        'exists first',
+        'exists first',
+        'download first'
+      ]);
+      expect(credentialReads).toBe(1);
+    });
+
+    it.each([401, 403])(
+      'reads the cached credential again after a read was rejected with %i',
+      async (statusCode: number) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject();
+        respond = (credentialName: string) => (credentialName === 'first' ? statusCode : 'hit');
+        cachedCredential = { credential: FIRST_SAS };
+
+        expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+        cachedCredential = { credential: SECOND_SAS };
+        const entry: Buffer | undefined = await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+        expect(entry?.toString()).toBe('read with second');
+        expect(requests).toEqual(['exists first', 'exists second', 'download second']);
+        expect(credentialReads).toBe(2);
+      }
+    );
+
+    it.each([
+      { rejectedOperation: 'upload' as const, expectedResult: false },
+      { rejectedOperation: 'exists' as const, expectedResult: true }
+    ])(
+      'reads the cached credential again after the $rejectedOperation request of a write was rejected',
+      async ({ rejectedOperation, expectedResult }) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject(true);
+        respond = (credentialName: string, operation: BlobOperation) =>
+          credentialName === 'first' && operation === rejectedOperation
+            ? 403
+            : operation === 'exists'
+              ? 'miss'
+              : 'ok';
+        cachedCredential = { credential: FIRST_SAS };
+
+        expect(await subject.trySetCacheEntryBufferAsync(terminal, 'cache-id', Buffer.from('entry'))).toBe(
+          expectedResult
+        );
+        cachedCredential = { credential: SECOND_SAS };
+        expect(await subject.trySetCacheEntryBufferAsync(terminal, 'cache-id', Buffer.from('entry'))).toBe(
+          true
+        );
+
+        expect(requests).toEqual(['exists first', 'upload first', 'exists second', 'upload second']);
+        expect(credentialReads).toBe(2);
+      }
+    );
+  });
 });
diff --git a/rush-plugins/rush-bridge-cache-plugin/README.md b/rush-plugins/rush-bridge-cache-plugin/README.md
index 8643f2db143..751d34a6759 100644
--- a/rush-plugins/rush-bridge-cache-plugin/README.md
+++ b/rush-plugins/rush-bridge-cache-plugin/README.md
@@ -81,3 +81,6 @@ That will populate the cache for `your-packageX` and all of its dependencies.
 **Write whatever outputs are on disk for this command to the cache, but only if all output folders are present**
 `rush build --to your-packageX --bridge-cache-action=write --require-output-folders`
 That will populate the cache for `your-packageX` and all of its dependencies, skipping any that don't have all output folders present.
+
+The plugin only reads or writes cache entries for the operations that the command selects. For example,
+`rush build --only your-packageX --bridge-cache-action=read` restores only `your-packageX`, and not its dependencies.
diff --git a/rush-plugins/rush-bridge-cache-plugin/package.json b/rush-plugins/rush-bridge-cache-plugin/package.json
index 79c3bde81e6..0703818b831 100644
--- a/rush-plugins/rush-bridge-cache-plugin/package.json
+++ b/rush-plugins/rush-bridge-cache-plugin/package.json
@@ -43,6 +43,7 @@
     "build": "heft test --clean",
     "start": "heft test --clean --watch",
     "_phase:build": "heft run --only build -- --clean",
+    "_phase:test": "heft run --only test -- --clean",
     "_phase:pack": "rush-pnpm pack"
   },
   "dependencies": {
diff --git a/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts b/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts
index 6dce64863c0..809cf0f2534 100644
--- a/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts
+++ b/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts
@@ -80,7 +80,12 @@ export class BridgeCachePlugin implements IRushPlugin {
             ): Promise<OperationStatus | undefined> => {
               const filteredOperations: IBaseOperationExecutionResult[] = [];
               for (const record of operationRecords.values()) {
-                if (!record.operation.isNoOp) {
+                const { operation } = record;
+                // The graph can also hold operations outside the command's selection, such as the
+                // dependencies of a project selected with `--only`, or every project's operations in
+                // a Rush daemon engine. Those operations are disabled, so leave their outputs and
+                // cache entries alone.
+                if (operation.enabled !== false && !operation.isNoOp) {
                   filteredOperations.push(record);
                 }
               }
diff --git a/rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts b/rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts
new file mode 100644
index 00000000000..32be5ed3226
--- /dev/null
+++ b/rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts
@@ -0,0 +1,217 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@rushstack/rush-sdk', () => ({
+  _OperationBuildCache: { forOperation: jest.fn() },
+  OperationStatus: { FromCache: 'FROM CACHE', Success: 'SUCCESS' }
+}));
+
+import {
+  _OperationBuildCache as OperationBuildCache,
+  OperationStatus,
+  type IOperationExecutionResult,
+  type Operation,
+  type RushSession
+} from '@rushstack/rush-sdk';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { CommandLineParameterKind } from '@rushstack/ts-command-line';
+
+import { BridgeCachePlugin } from '../BridgeCachePlugin';
+
+type BeforeExecuteIteration = (
+  records: ReadonlyMap<Operation, IOperationExecutionResult>,
+  iterationOptions: object
+) => Promise<OperationStatus | undefined>;
+
+interface ICacheEntryMock {
+  cacheId: string;
+  tryRestoreFromCacheAsync: jest.Mock;
+  trySetCacheEntryAsync: jest.Mock;
+}
+
+const ACTION_PARAMETER_NAME: string = '--bridge-cache-action';
+
+function createOperation(name: string, enabled: Operation['enabled'], isNoOp: boolean = false): Operation {
+  return { name, enabled, isNoOp, settings: undefined } as unknown as Operation;
+}
+
+function createRecords(operations: Operation[]): ReadonlyMap<Operation, IOperationExecutionResult> {
+  return new Map(
+    operations.map((operation: Operation) => [
+      operation,
+      { operation } as unknown as IOperationExecutionResult
+    ])
+  );
+}
+
+async function applyPluginAsync(
+  cacheAction: 'read' | 'write',
+  terminal: Terminal
+): Promise<BeforeExecuteIteration> {
+  const pendingTaps: Promise<void>[] = [];
+  let beforeExecuteIteration: BeforeExecuteIteration | undefined;
+  const graph: object = {
+    parallelism: 1,
+    hooks: {
+      beforeExecuteIterationAsync: {
+        tapPromise: (name: string, fn: BeforeExecuteIteration) => (beforeExecuteIteration = fn)
+      }
+    }
+  };
+  const context: object = {
+    customParameters: new Map([
+      [
+        ACTION_PARAMETER_NAME,
+        {
+          kind: CommandLineParameterKind.Choice,
+          alternatives: new Set(['read', 'write']),
+          value: cacheAction
+        }
+      ]
+    ]),
+    buildCacheConfiguration: { buildCacheEnabled: true },
+    rushConfiguration: { experimentsConfiguration: { configuration: {} } }
+  };
+  const command: object = {
+    hooks: {
+      onGraphCreatedAsync: {
+        tap: (name: string, fn: (g: object, c: object) => Promise<void>) =>
+          pendingTaps.push(fn(graph, context))
+      }
+    }
+  };
+  const session: object = {
+    getLogger: () => ({ terminal }),
+    hooks: {
+      runAnyPhasedCommand: {
+        tapPromise: (name: string, fn: (c: object) => Promise<void>) => pendingTaps.push(fn(command))
+      }
+    }
+  };
+
+  new BridgeCachePlugin({
+    actionParameterName: ACTION_PARAMETER_NAME,
+    requireOutputFoldersParameterName: undefined
+  }).apply(session as RushSession);
+  await Promise.all(pendingTaps);
+
+  if (!beforeExecuteIteration) {
+    throw new Error('The plugin did not tap beforeExecuteIterationAsync.');
+  }
+  return beforeExecuteIteration;
+}
+
+describe(BridgeCachePlugin.name, () => {
+  // A graph can hold operations outside the command's selection, such as the dependencies of a project
+  // selected with `--only`, or every project's operations in a Rush daemon engine. Those are disabled.
+  const selected: Operation = createOperation('selected (build)', true);
+  const selectedChangedOnly: Operation = createOperation(
+    'selected-changed-only (build)',
+    'ignore-dependency-changes'
+  );
+  const unselected: Operation = createOperation('unselected-dependency (build)', false);
+  const noOp: Operation = createOperation('selected-no-op (build)', true, true);
+
+  let terminalProvider: StringBufferTerminalProvider;
+  let terminal: Terminal;
+  let cacheEntryByOperationName: Map<string, ICacheEntryMock>;
+
+  beforeEach(() => {
+    terminalProvider = new StringBufferTerminalProvider();
+    terminal = new Terminal(terminalProvider);
+    cacheEntryByOperationName = new Map();
+    jest
+      .mocked(OperationBuildCache.forOperation)
+      .mockImplementation((record: { operation: Operation }): OperationBuildCache => {
+        const entry: ICacheEntryMock = {
+          cacheId: `cache-id-${record.operation.name}`,
+          tryRestoreFromCacheAsync: jest.fn().mockResolvedValue(true),
+          trySetCacheEntryAsync: jest.fn().mockResolvedValue(true)
+        };
+        cacheEntryByOperationName.set(record.operation.name, entry);
+        return entry as unknown as OperationBuildCache;
+      });
+  });
+
+  afterEach(() => {
+    jest.mocked(OperationBuildCache.forOperation).mockReset();
+  });
+
+  it('restores only the operations in the selection', async () => {
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('read', terminal);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(
+      createRecords([selected, selectedChangedOnly, unselected, noOp]),
+      {}
+    );
+
+    expect(status).toBe(OperationStatus.FromCache);
+    expect([...cacheEntryByOperationName.keys()].sort()).toEqual([
+      'selected (build)',
+      'selected-changed-only (build)'
+    ]);
+    for (const entry of cacheEntryByOperationName.values()) {
+      expect(entry.tryRestoreFromCacheAsync).toHaveBeenCalledTimes(1);
+      expect(entry.trySetCacheEntryAsync).not.toHaveBeenCalled();
+    }
+    expect(terminalProvider.getOutput()).toContain(
+      'Cache operation "read" completed successfully for 2 out of 2 operations.'
+    );
+  });
+
+  it('writes only the operations in the selection', async () => {
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('write', terminal);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(
+      createRecords([selected, selectedChangedOnly, unselected, noOp]),
+      {}
+    );
+
+    expect(status).toBe(OperationStatus.Success);
+    expect([...cacheEntryByOperationName.keys()].sort()).toEqual([
+      'selected (build)',
+      'selected-changed-only (build)'
+    ]);
+    for (const entry of cacheEntryByOperationName.values()) {
+      expect(entry.trySetCacheEntryAsync).toHaveBeenCalledTimes(1);
+      expect(entry.tryRestoreFromCacheAsync).not.toHaveBeenCalled();
+    }
+    expect(terminalProvider.getOutput()).toContain(
+      'Cache operation "write" completed successfully for 2 out of 2 operations.'
+    );
+  });
+
+  it('restores a selected operation whose record is disabled because it is up to date', async () => {
+    // In a long-lived graph, such as a Rush daemon engine, a selected operation whose inputs did not change
+    // since its last successful iteration gets a disabled record. A read still covers the whole selection,
+    // as it does in a fresh native run, so the plugin checks the operation's enabled state, not the record's.
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('read', terminal);
+    const records: ReadonlyMap<Operation, IOperationExecutionResult> = new Map([
+      [selected, { operation: selected, enabled: false } as unknown as IOperationExecutionResult],
+      [unselected, { operation: unselected, enabled: false } as unknown as IOperationExecutionResult]
+    ]);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(records, {});
+
+    expect(status).toBe(OperationStatus.FromCache);
+    expect([...cacheEntryByOperationName.keys()]).toEqual(['selected (build)']);
+    for (const entry of cacheEntryByOperationName.values()) {
+      expect(entry.tryRestoreFromCacheAsync).toHaveBeenCalledTimes(1);
+    }
+    expect(terminalProvider.getOutput()).toContain(
+      'Cache operation "read" completed successfully for 1 out of 1 operations.'
+    );
+  });
+
+  it('continues normal execution when no selected operation has work', async () => {
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('read', terminal);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(
+      createRecords([unselected, noOp]),
+      {}
+    );
+
+    expect(status).toBeUndefined();
+    expect(OperationBuildCache.forOperation).not.toHaveBeenCalled();
+  });
+});
diff --git a/rush-plugins/rush-http-build-cache-plugin/rush-plugin-manifest.json b/rush-plugins/rush-http-build-cache-plugin/rush-plugin-manifest.json
index 08518e643e5..c1150cbb203 100644
--- a/rush-plugins/rush-http-build-cache-plugin/rush-plugin-manifest.json
+++ b/rush-plugins/rush-http-build-cache-plugin/rush-plugin-manifest.json
@@ -5,7 +5,8 @@
       "pluginName": "rush-http-build-cache-plugin",
       "description": "Rush plugin for generic HTTP build cache",
       "entryPoint": "./lib-commonjs/index.js",
-      "optionsSchema": "./lib-commonjs/schemas/http-config.schema.json"
+      "optionsSchema": "./lib-commonjs/schemas/http-config.schema.json",
+      "daemonCommandAgnostic": true
     }
   ]
 }