@danceiny/gotry 0.2.0-rc.32 → 0.2.0-rc.33

package/dist/capabilities/session/gui-hotel.js

@@ -6,7 +6,7 @@
  * 与机票 GUI 车道(gui-flight.ts)同构:动作闭集 + 提交件黑名单 + readback 硬闸 +
  * 可注入 driver;复用 ctrip-hotel 适配器的三态分类器(classifyCtripHotelList:
  * parsed/recognized-empty/unrecognized——只有显式空列表才算 miss,绝不猜)。
- * 证据链 [会话:ctrip-hotel-gui@ts],恒标 anonymous。
+ * 证据链 [会话:ctrip-hotel-gui@ts];anonymous 标注(登录态配对后为 false)。
  */
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -16,6 +16,8 @@ import { HOTEL_NETWORK_HINTS, looksLikeHotelListBody, classifyCtripHotelList } f
 export const HOTEL_GUI_HOME = 'https://hotels.ctrip.com/';
 const YMD = /^\d{4}-\d{2}-\d{2}$/;
 const GUI_CHALLENGE_RE = /验证|校验|拖动滑块|请输入验证码/;
+/** 登录票据 cookie 名单(与 bridge 车道 LOGIN_COOKIE_NAMES 同源;只读名字) */
+const TICKET_COOKIE_NAMES = ['cticket', 'uid', 'uname', 'passport'];
 /** 纯函数:查询 → 动作序列(离线测试锚点) */
 export function planHotelGuiActions(q) {
     return [
@@ -77,10 +79,12 @@ export function __setHotelDriverForTest(factory) {
 export async function runHotelGuiSearch(q) {
     const started = Date.now();
     const ts = new Date().toISOString();
+    let humanLoggedIn = false;
     const fail = (error, verdict = 'error') => ({
         ok: false, via: 'session-ctrip-hotel-gui-error', latencyMs: Date.now() - started, verdict, error,
-        evidence: `[会话:ctrip-hotel-gui@error@${ts}] ${error.slice(0, 120)}`, anonymous: true,
+        evidence: `[会话:ctrip-hotel-gui@error@${ts}] ${error.slice(0, 120)}`, anonymous: !humanLoggedIn,
     });
+    const needsLoginMessage = () => '酒店列表需登录态:匿名窗口被重定向到携程登录页(红线:不自动登录)——interactiveLogin=true 可在窗口内本人登录后自动重查,或 gotry_session_login 后走 bridge 车道';
     if (!(q.checkIn < q.checkOut))
         return fail(`退房日期(${q.checkOut})须晚于入住(${q.checkIn})`);
     const plan = planHotelGuiActions(q);
@@ -99,11 +103,17 @@ export async function runHotelGuiSearch(q) {
     }
     let api = null;
     let listUrl = '';
-    try {
+    class HotelFlowAbort {
+        result;
+        constructor(result) {
+            this.result = result;
+        }
+    }
+    const driveOnce = async () => {
         for (const a of plan) {
             const remain = budget - (Date.now() - started);
             if (remain <= 0)
-                return fail(`GUI 预算耗尽(${budget}ms)`);
+                throw new HotelFlowAbort(fail(`GUI 预算耗尽(${budget}ms)`));
             const step = (p, what) => withDeadline(p, Math.min(remain, 20_000), `GUI 步骤失败(${what})`);
             switch (a.t) {
                 case 'goto':
@@ -128,7 +138,7 @@ export async function runHotelGuiSearch(q) {
                     {
                         const after = await page.currentUrl().catch(() => '');
                         if (/passport\.ctrip\.com\/.*login/i.test(after)) {
-                            return fail('酒店列表需登录态:匿名窗口被重定向到携程登录页(红线:不自动登录)——gotry_session_login 为用户打开官方登录入口后走 bridge 车道(ui 默认),或登录后重试', 'needs-login');
+                            throw new HotelFlowAbort(fail('__NEEDS_LOGIN__', 'needs-login'));
                         }
                     }
                     break;
@@ -136,7 +146,7 @@ export async function runHotelGuiSearch(q) {
                     const dest = await step(page.destFieldValue(), '读回目的地框');
                     const form = await step(page.visibleFormText(), '读回表单');
                     if (!dest.includes(a.expect.to)) {
-                        return fail(`readback 硬闸:目的地框未确认「${a.expect.to}」(实际「${dest.slice(0, 30)}」)——已终止,未发起搜索`);
+                        throw new HotelFlowAbort(fail(`readback 硬闸:目的地框未确认「${a.expect.to}」(实际「${dest.slice(0, 30)}」)——已终止,未发起搜索`));
                     }
                     // live 校准:酒店表单日期显示为本地化格式(如 11月13日(周五))而非 YMD——双格式核对
                     const dateShown = (ymd) => {
@@ -145,7 +155,7 @@ export async function runHotelGuiSearch(q) {
                     };
                     for (const [label, value] of [['入住日期', a.expect.checkIn], ['退房日期', a.expect.checkOut]]) {
                         if (!dateShown(value)) {
-                            return fail(`readback 硬闸:${label}「${value}」未在表单确认(表单摘要:${form.slice(0, 200)})——已终止,未发起搜索`);
+                            throw new HotelFlowAbort(fail(`readback 硬闸:${label}「${value}」未在表单确认(表单摘要:${form.slice(0, 200)})——已终止,未发起搜索`));
                         }
                     }
                     break;
@@ -153,34 +163,70 @@ export async function runHotelGuiSearch(q) {
                 case 'awaitApi': {
                     const text = await step(page.pageText(), '检查页面');
                     if (GUI_CHALLENGE_RE.test(text)) {
-                        return fail('风控/验证码命中;按红线不重试不绕过,交还用户', 'challenged');
+                        throw new HotelFlowAbort(fail('风控/验证码命中;按红线不重试不绕过,交还用户', 'challenged'));
                     }
                     api = await step(page.waitForApiBody(Math.min(remain - 500, 18_000)), '等待酒店列表回包');
                     if (!api) {
                         const recent = page.recentApiUrls ? (await page.recentApiUrls().catch(() => [])) : [];
                         const nowUrl = await page.currentUrl().catch(() => '?');
                         if (/passport\.ctrip\.com\/.*login/i.test(nowUrl)) {
-                            return fail('酒店列表需登录态:匿名窗口被重定向到携程登录页(红线:不自动登录)——gotry_session_login 为用户打开官方登录入口后走 bridge 车道,或登录后重试', 'needs-login');
+                            throw new HotelFlowAbort(fail('__NEEDS_LOGIN__', 'needs-login'));
                         }
-                        return fail(`酒店列表回包嗅探超时(href=${nowUrl.slice(0, 120)})${recent.length ? ` ‖recent-apis: ${recent.slice(-8).join(' ; ').slice(0, 500)}` : ''}`);
+                        throw new HotelFlowAbort(fail(`酒店列表回包嗅探超时(href=${nowUrl.slice(0, 120)})${recent.length ? ` ‖recent-apis: ${recent.slice(-8).join(' ; ').slice(0, 500)}` : ''}`));
                     }
                     break;
                 }
             }
         }
-        listUrl = await page.currentUrl().catch(() => '');
+        return;
+    };
+    try {
+        await driveOnce();
     }
     catch (e) {
-        return fail(e.message.slice(0, 400));
+        // 登录态配对(#664 余尾,2026-10-15):needs-login 且调用方授权等待时,窗口停在官方
+        // 登录页等用户本人完成登录(cookie 只读名字),随后原窗重驾一次拿登录态真实价。
+        if (e instanceof HotelFlowAbort && e.result.verdict === 'needs-login' && q.interactiveLoginMs && q.interactiveLoginMs > 0) {
+            const loggedIn = await withDeadline(page.waitForHumanLogin(q.interactiveLoginMs), q.interactiveLoginMs + 5_000, '等待人工登录').catch(() => false);
+            if (!loggedIn) {
+                return fail(`登录等待超时(${q.interactiveLoginMs}ms):用户未在 GUI 窗口完成登录——可稍后带 interactiveLogin 重试,或登录后走 bridge 车道`, 'needs-login');
+            }
+            humanLoggedIn = true;
+            api = null;
+            try {
+                await driveOnce();
+            }
+            catch (e2) {
+                if (e2 instanceof HotelFlowAbort) {
+                    return e2.result.error === '__NEEDS_LOGIN__'
+                        ? fail(needsLoginMessage(), 'needs-login')
+                        : e2.result;
+                }
+                return fail(e2.message.slice(0, 400));
+            }
+        }
+        else if (e instanceof HotelFlowAbort) {
+            return e.result.error === '__NEEDS_LOGIN__'
+                ? fail(needsLoginMessage(), 'needs-login')
+                : e.result;
+        }
+        else {
+            return fail(e.message.slice(0, 400));
+        }
     }
     finally {
         await driver.close().catch(() => { });
     }
-    if (!api)
+    try {
+        listUrl = await page.currentUrl().catch(() => '');
+    }
+    catch { /* 已关窗口 */ }
+    const captured = api;
+    if (captured === null)
         return fail('内部不变量失败:api 未结算(awaitApi 已过)');
-    const classified = classifyCtripHotelList(api.body);
+    const classified = classifyCtripHotelList(captured.body);
     if (classified.shape === 'unrecognized') {
-        return fail(`酒店列表回包形状未识别(body头:${api.body.replace(/\s+/g, ' ').slice(0, 240)})`);
+        return fail(`酒店列表回包形状未识别(body头:${captured.body.replace(/\s+/g, ' ').slice(0, 240)})`);
     }
     if (classified.shape === 'malformed') {
         return fail('酒店列表回包非 JSON(接口改版?)');
@@ -191,8 +237,8 @@ export async function runHotelGuiSearch(q) {
         ok: verdict === 'hit', via: 'session-ctrip-hotel-gui', latencyMs: Date.now() - started, verdict,
         ...(hotels.length > 0 ? { hotels: hotels.slice(0, 20) } : {}),
         ...(listUrl ? { listUrl } : {}),
-        evidence: `[会话:ctrip-hotel-gui@${ts}] 匿名 GUI 面检索:${hotels.length} 家(shape=${classified.shape};匿名公开价,非登录态价)`,
-        anonymous: true,
+        evidence: `[会话:ctrip-hotel-gui@${ts}] GUI 面检索:${hotels.length} 家(shape=${classified.shape};${humanLoggedIn ? '用户本人已在本窗口官方页登录,登录态真实价' : '匿名公开价,非登录态价'})`,
+        anonymous: !humanLoggedIn,
     };
 }
 async function withDeadline(p, ms, what) {
@@ -393,6 +439,17 @@ async function createHotelPlaywrightDriver() {
                     return title + text;
                 },
                 async currentUrl() { return page.url(); },
+                async waitForHumanLogin(timeoutMs) {
+                    // 红线:人自己完成登录;只轮询票据 cookie 名字(值即弃)。窗口此刻通常已在 passport 页。
+                    const deadline = Date.now() + timeoutMs;
+                    while (Date.now() < deadline) {
+                        const names = await ctx.cookies().then(cs => cs.map(c => c.name)).catch(() => []);
+                        if (names.some(n => TICKET_COOKIE_NAMES.includes(n)))
+                            return true;
+                        await page.waitForTimeout(5_000);
+                    }
+                    return false;
+                },
                 async recentApiUrls() { return [...recentUrls]; },
                 async waitForApiBody(timeoutMs) {
                     return new Promise(resolve => {

package/dist/capabilities/session-search.js

@@ -115,7 +115,7 @@ export async function sessionHotelGuiSearch(q) {
     if (!q.checkIn || !q.checkOut) {
         return err('error', 'GUI 车道需要 checkIn/checkOut(YYYY-MM-DD,成对)');
     }
-    const r = await runHotelGuiSearch({ to: q.to, checkIn: q.checkIn, checkOut: q.checkOut, ...(q.timeoutMs ? { timeoutMs: q.timeoutMs } : {}) });
+    const r = await runHotelGuiSearch({ to: q.to, checkIn: q.checkIn, checkOut: q.checkOut, ...(q.interactiveLoginMs ? { interactiveLoginMs: q.interactiveLoginMs } : {}), ...(q.timeoutMs ? { timeoutMs: Math.max(q.timeoutMs, q.interactiveLoginMs ? q.interactiveLoginMs + 120_000 : 0) } : {}) });
     return {
         ok: r.ok, via: r.via, evidence: r.evidence, latencyMs: r.latencyMs, verdict: r.verdict,
         ...(r.hotels ? { hotels: r.hotels } : {}),
@@ -307,12 +307,13 @@ export async function sessionDidaSearch(q) {
     const err = (verdict, error) => ({
         ok: false, via: 'session-dida-portal-error', evidence: `[会话:${site}@error@${ts}] ${error}`, latencyMs: Date.now() - started, verdict, error,
     });
-    // 节律闸:超间隔即拒,不发起导航
-    const last = lastCallAt.get(site) ?? 0;
+    // 节律闸:超间隔即拒,不发起导航。键缺省是站点;多组织形态按组织分键(见 SessionDidaQuery.pacingKey)
+    const paceKey = q.pacingKey ?? site;
+    const last = lastCallAt.get(paceKey) ?? 0;
     if (Date.now() - last < MIN_INTERVAL_MS) {
         return err('cooldown', `rate limit: last call ${Date.now() - last}ms ago, min ${MIN_INTERVAL_MS}ms`);
     }
-    lastCallAt.set(site, Date.now());
+    lastCallAt.set(paceKey, Date.now());
     const entry = buildDidaEntryUrl({ entryUrl: q.entryUrl });
     if (!entry.ok || !entry.url) {
         return err('error', 'entry URL 必须落在 https://portal.dida.com/ 域内');
@@ -761,7 +762,7 @@ export async function sessionFlightGuiSearch(q) {
     if (q.backDate && !(q.date < q.backDate)) {
         return err('error', `回程日期(${q.backDate})须晚于去程(${q.date})`);
     }
-    const r = await runFlightGuiSearch({ from: q.from, to: q.to, date: q.date, ...(q.backDate ? { backDate: q.backDate } : {}), ...(q.timeoutMs ? { timeoutMs: q.timeoutMs } : {}) });
+    const r = await runFlightGuiSearch({ from: q.from, to: q.to, date: q.date, ...(q.backDate ? { backDate: q.backDate } : {}), ...(q.legs ? { legs: q.legs } : {}), ...(q.interactiveLoginMs ? { interactiveLoginMs: q.interactiveLoginMs } : {}), ...(q.timeoutMs ? { timeoutMs: Math.max(q.timeoutMs, q.interactiveLoginMs ? q.interactiveLoginMs + 120_000 : 0) } : {}) });
     return {
         ok: r.ok, via: r.via, evidence: r.evidence, latencyMs: r.latencyMs,
         verdict: r.verdict,

package/dist/scripts/booking-copilot-dsh-planner-proof-tests.js

@@ -782,6 +782,54 @@ const invalidThenValidDecision = await invalidThenValid.plannerFactory(task).nex
 });
 assertRuntimeMaterializedOperation(invalidThenValidDecision, 'search.run', {}, task, 'a schema-rejected call may be superseded by the later unique typed success in the same run');
 await invalidThenValid.close();
+let schemaRepairRuns = 0;
+const schemaRejectedThenRepaired = await createDshEmbeddedBookingPlanner({
+    runPort: {
+        async run() {
+            schemaRepairRuns += 1;
+            if (schemaRepairRuns === 1) {
+                return {
+                    finalResponse: '',
+                    events: [
+                        toolCall('booking_search_hotels', invalidCallArguments, 'call-schema-rejected'),
+                        toolResult('call-schema-rejected', true, 'INVALID_ARGS'),
+                    ],
+                };
+            }
+            return { finalResponse: '', events: successfulToolEvents('booking_search_hotels', JSON.stringify({ decision: { kind: 'operation', action: searchRun, intent: { target: 'search.results' } } }), 'call-schema-repaired') };
+        },
+        async close() { },
+    },
+});
+const schemaRepairedDecision = await schemaRejectedThenRepaired.plannerFactory(task).next({
+    task,
+    turn: { schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId: 'dsh-schema-repair', workspace, request: { text: 'Find hotels' } },
+});
+assertRuntimeMaterializedOperation(schemaRepairedDecision, 'search.run', {}, task, 'one schema-shaped rejection is retried once and the repaired call is accepted');
+assert.equal(schemaRepairRuns, 2, 'schema rejection consumes a bounded retry attempt');
+await schemaRejectedThenRepaired.close();
+let repeatedSchemaRejectionRuns = 0;
+const repeatedSchemaRejections = await createDshEmbeddedBookingPlanner({
+    runPort: {
+        async run() {
+            repeatedSchemaRejectionRuns += 1;
+            return {
+                finalResponse: '',
+                events: [
+                    toolCall('booking_search_hotels', invalidCallArguments, 'call-repeated-schema-rejection'),
+                    toolResult('call-repeated-schema-rejection', true, 'INVALID_ARGS'),
+                ],
+            };
+        },
+        async close() { },
+    },
+});
+await assert.rejects(repeatedSchemaRejections.plannerFactory(task).next({
+    task,
+    turn: { schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId: 'dsh-repeated-schema-rejection', workspace, request: { text: 'Find hotels' } },
+}), /planner_invalid_typed_decision/, 'a schema-invalid repair must fail closed');
+assert.equal(repeatedSchemaRejectionRuns, 2, 'a turn gets only one schema repair retry even if the repair is rejected again');
+await repeatedSchemaRejections.close();
 const invalidWithoutSchemaRejection = await createDshEmbeddedBookingPlanner({
     runPort: {
         async run() {
@@ -1718,8 +1766,8 @@ const invalidCrossRun = await createDshEmbeddedBookingPlanner({
 await assert.rejects(invalidCrossRun.plannerFactory(task).next({
     task,
     turn: { schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId: 'dsh-cross-run-invalid', workspace, request: { text: 'Find hotels' } },
-}), /planner_invalid_tool_arguments/, 'a schema-invalid call cannot be washed into a valid action by a later provider run');
-assert.equal(invalidCrossRunRuns, 1, 'event-authority schema errors fail closed without a correction run');
+}), /planner_booking_intent_required/, 'a schema-invalid call gets one repair run, but a still-invalid repaired payload cannot become a valid action');
+assert.equal(invalidCrossRunRuns, 2, 'one bounded schema-repair retry, not an unbounded correction loop');
 await invalidCrossRun.close();
 const confirmedTask = {
     ...task,
@@ -2179,6 +2227,85 @@ assert.notDeepEqual(bootRejectResult, { testDeadline: true }, 'an expired handsh
 assert.equal(bootRejectResult[0]?.error?.code, 'PLANNER_BOOT_TIMEOUT', 'an expired local handshake is typed as a boot timeout');
 assert.equal(bootRejectPortClosed, 1, 'an expired handshake closes its owned run port');
 await bootRejectPlanner.close();
+// A cold first boot that exceeds the local handshake budget must not fail the
+// turn while deadline headroom remains: the failed boot warmed the OS page
+// cache, so one fresh-port retry converges (Danceiny/gotry#660). The retry
+// must not consume a provider attempt, and the failed port must be closed.
+let bootRetryFirstClosed = 0;
+let bootRetrySecondRuns = 0;
+let bootRetrySecondClosed = 0;
+let bootRetryPortIndex = 0;
+const bootRetryPlanner = await createDshEmbeddedBookingPlanner({
+    runPortFactory: () => {
+        bootRetryPortIndex += 1;
+        if (bootRetryPortIndex === 1) {
+            return {
+                run: () => Promise.reject(new Error('HARNESS_BOOT_TIMEOUT')),
+                async close() { bootRetryFirstClosed += 1; },
+                bootObservation: () => undefined,
+            };
+        }
+        return {
+            async run() {
+                bootRetrySecondRuns += 1;
+                return {
+                    finalResponse: '',
+                    events: successfulToolEvents('booking_search_hotels', JSON.stringify({ kind: 'search.run', input: {}, intent: { target: 'search.results' } }), 'call-boot-retry'),
+                };
+            },
+            async close() { bootRetrySecondClosed += 1; },
+        };
+    },
+    turnTimeoutMs: 30_000,
+});
+const bootRetryResult = await resolveWithin(bootRetryPlanner.plannerFactory(bootTimeoutTask).next({ task: bootTimeoutTask, turn: bootTimeoutTurn }), 250);
+assert.notDeepEqual(bootRetryResult, { testDeadline: true }, 'a retried boot stays inside the turn deadline');
+assert.equal(bootRetryResult[0]?.kind, 'operation', 'a fresh-port retry after a cold boot timeout produces the operation decision');
+assert.equal(bootRetryResult[0]?.action?.kind, 'search.run', 'the retried decision carries the capability action');
+assert.equal(bootRetryFirstClosed, 1, 'the failed boot port is closed by the retry');
+assert.ok(bootRetrySecondRuns >= 1, 'the fresh port actually ran the provider request');
+await bootRetryPlanner.close();
+// A fresh-port retry must never run on the port it just retired. A factory
+// that returns one shared instance hands the closed port back, and running it
+// rejects untyped out of next() (the #669 readiness-proof crash). Such a retry
+// cannot be funded, so each retry branch settles exactly as it does when the
+// deadline cannot fund one. These fakes reject like the real port once closed.
+let sharedBootFactoryCalls = 0;
+let sharedBootCloses = 0;
+const sharedBootPort = {
+    run: () => Promise.reject(new Error(sharedBootCloses > 0 ? 'booking_planner_run_port_closed' : 'HARNESS_BOOT_TIMEOUT')),
+    async close() { sharedBootCloses += 1; },
+    bootObservation: () => undefined,
+};
+const sharedBootPlanner = await createDshEmbeddedBookingPlanner({
+    runPortFactory: () => { sharedBootFactoryCalls += 1; return sharedBootPort; },
+    turnTimeoutMs: 30_000,
+});
+const sharedBootResult = await resolveWithin(sharedBootPlanner.plannerFactory(bootTimeoutTask).next({ task: bootTimeoutTask, turn: bootTimeoutTurn }), 250);
+assert.notDeepEqual(sharedBootResult, { testDeadline: true }, 'a refused boot retry settles inside the turn deadline');
+assert.equal(sharedBootResult[0]?.error?.code, 'PLANNER_BOOT_TIMEOUT', 'a boot retry handed its own retired port settles as the typed boot timeout');
+assert.equal(sharedBootFactoryCalls, 2, 'the boot retry asked the factory for a fresh port once');
+assert.equal(sharedBootCloses, 1, 'the retired port is closed exactly once and never run again');
+await sharedBootPlanner.close();
+let sharedStallFactoryCalls = 0;
+let sharedStallCloses = 0;
+const sharedStallPort = {
+    run: () => sharedStallCloses > 0
+        ? Promise.reject(new Error('booking_planner_run_port_closed'))
+        : new Promise((_resolve) => undefined),
+    async close() { sharedStallCloses += 1; },
+};
+const sharedStallPlanner = await createDshEmbeddedBookingPlanner({
+    runPortFactory: () => { sharedStallFactoryCalls += 1; return sharedStallPort; },
+    turnTimeoutMs: 30_000,
+    stallSoftBudgetMs: 20,
+});
+const sharedStallResult = await resolveWithin(sharedStallPlanner.plannerFactory(bootTimeoutTask).next({ task: bootTimeoutTask, turn: bootTimeoutTurn }), 500);
+assert.notDeepEqual(sharedStallResult, { testDeadline: true }, 'a refused stall retry settles inside the turn deadline');
+assert.equal(sharedStallResult[0]?.error?.code, 'PLANNER_PROVIDER_TIMEOUT', 'a stall retry handed its own retired port settles as the typed provider timeout');
+assert.equal(sharedStallFactoryCalls, 2, 'the stall retry asked the factory for a fresh port once');
+assert.equal(sharedStallCloses, 1, 'the stalled port is closed exactly once and never run again');
+await sharedStallPlanner.close();
 let taskAClosed = 0;
 let taskARuns = 0;
 let taskBRuns = 0;

package/dist/scripts/booking-copilot-dsh-readiness-proof.js

@@ -157,11 +157,15 @@ try {
     // The local boot budget must govern its own phase. With a model-stall budget
     // wider than the boot budget, only the explicit initialize deadline can
     // settle this turn inside the asserted window; the SDK's 10s fallback or the
-    // 13.3s stall budget would both land later and fail the bound below.
+    // 16s stall budget would both land later and fail the bound below.
+    // The 24s deadline funds the fresh-port boot retry (#669) with margin, but
+    // this factory hands back its one shared port, which the boot timeout has
+    // just retired: the planner must refuse to run on it and settle typed.
     phase = 'boot_budget_bound';
     const budgetGate = gate('boot-budget');
     port = await createRealRunPort({ stateRoot: root, env, dshBin: budgetGate.dshBin, maxTokens: 512 });
-    planner = await createDshEmbeddedBookingPlanner({ runPortFactory: () => port, turnTimeoutMs: 20_000 });
+    let budgetPortRequests = 0;
+    planner = await createDshEmbeddedBookingPlanner({ runPortFactory: () => { budgetPortRequests += 1; return port; }, turnTimeoutMs: 24_000 });
     const budgetAt = Date.now();
     const budgetResultPromise = planner.plannerFactory(task).next({ turn, task });
     await until(() => existsSync(budgetGate.marker), 3_000, 'boot-budget runtime never entered startup gate');
@@ -169,14 +173,15 @@ try {
     const budgetResult = await bounded(budgetResultPromise, 15_000, 'boot budget did not settle the turn');
     const budgetElapsedMs = Date.now() - budgetAt;
     assert.equal(budgetResult[0]?.kind === 'error' && budgetResult[0].error.code, 'PLANNER_BOOT_TIMEOUT');
+    assert.equal(budgetPortRequests, 2, 'the funded boot retry asked for a fresh port and was handed back the retired one');
     assert.ok(budgetElapsedMs >= PLANNER_BOOT_BUDGET_MS, `the boot budget must be consumed before it fires (${budgetElapsedMs}ms)`);
-    assert.ok(budgetElapsedMs < PLANNER_BOOT_BUDGET_MS + 6_000, `the local boot budget, not the 13.3s stall budget, must settle this turn (${budgetElapsedMs}ms)`);
+    assert.ok(budgetElapsedMs < PLANNER_BOOT_BUDGET_MS + 6_000, `the local boot budget, not the 16s stall budget, must settle this turn (${budgetElapsedMs}ms)`);
     assert.equal(requests.length, 1, 'a blocked handshake makes no provider request');
     await bounded(planner.close(), 3_000, 'boot-budget tree cleanup exceeded budget');
     planner = undefined;
     port = undefined;
     assert.ok(!alive(budgetPids.pid) && !alive(budgetPids.workerPid), 'boot-budget runtime and worker both reaped');
-    console.log('DSH READINESS BOOT BUDGET:', JSON.stringify({ budgetMs: PLANNER_BOOT_BUDGET_MS, elapsedMs: budgetElapsedMs, code: 'PLANNER_BOOT_TIMEOUT', providerRequests: 0, treeReaped: true }));
+    console.log('DSH READINESS BOOT BUDGET:', JSON.stringify({ budgetMs: PLANNER_BOOT_BUDGET_MS, elapsedMs: budgetElapsedMs, code: 'PLANNER_BOOT_TIMEOUT', providerRequests: 0, retryRefused: true, treeReaped: true }));
     phase = 'initialize_failure';
     const failedMarker = join(root, 'failed-start.json');
     const failedBin = join(root, 'failed-dsh.mjs');
@@ -191,6 +196,49 @@ try {
     port = undefined;
     assert.ok(!alive(failed.pid) && !alive(failed.workerPid), 'failed runtime and worker both reaped');
     console.log('DSH READINESS FAILURE CLASSIFICATION:', JSON.stringify({ exitCode: failed.exitCode, signal: failed.signal, error: 'HARNESS_START_FAILED', rawStderrExposed: false, providerRequests: 0, treeReaped: true }));
+    // A cold first boot that exceeds the local budget is retried on a fresh
+    // runtime while the deadline still funds a viable run (#669). The first
+    // runtime stays blocked before initialize; the second is released up front,
+    // so it completes initialize and reaches the provider, which never answers.
+    // The 24s deadline funds the retry with margin on a slow host, and the 9s
+    // stall budget ends the stalled second run before a third boot fits.
+    phase = 'boot_retry_fresh_port';
+    const retryCold = gate('retry-cold');
+    const retryWarm = gate('retry-warm');
+    writeFileSync(retryWarm.release, 'release');
+    const retryPorts = [];
+    planner = await createDshEmbeddedBookingPlanner({
+        runPortFactory: async () => {
+            const dshBin = (retryPorts.length === 0 ? retryCold : retryWarm).dshBin;
+            const created = await createRealRunPort({ stateRoot: root, env, dshBin, maxTokens: 512 });
+            retryPorts.push(created);
+            return created;
+        },
+        turnTimeoutMs: 24_000,
+        stallSoftBudgetMs: 9_000,
+    });
+    const requestsBeforeRetry = requests.length;
+    const retryAt = Date.now();
+    const retryResultPromise = planner.plannerFactory(task).next({ turn, task });
+    await until(() => existsSync(retryCold.marker), 3_000, 'cold retry runtime never entered startup gate');
+    const coldRetryPids = retryCold.pids();
+    evidence = { ...coldRetryPids, providerRequests: requests.length };
+    await until(() => existsSync(retryWarm.marker), 15_000, 'the boot timeout never retried on a fresh runtime');
+    const retriedAfterMs = Date.now() - retryAt;
+    const warmRetryPids = retryWarm.pids();
+    assert.ok(retriedAfterMs >= PLANNER_BOOT_BUDGET_MS, `the retry waits for the local boot budget (${retriedAfterMs}ms)`);
+    assert.ok(retriedAfterMs < PLANNER_BOOT_BUDGET_MS + 6_000, `the local boot budget, not the SDK fallback, triggers the retry (${retriedAfterMs}ms)`);
+    assert.ok(!alive(coldRetryPids.pid) && !alive(coldRetryPids.workerPid), 'the timed-out runtime is reaped before the fresh one starts');
+    await until(() => requests.length === requestsBeforeRetry + 1, 10_000, 'the fresh runtime never reached the provider');
+    const retryResult = await bounded(retryResultPromise, 20_000, 'the retried turn did not settle');
+    const retryElapsedMs = Date.now() - retryAt;
+    assert.equal(retryResult[0]?.kind === 'error' && retryResult[0].error.code, 'PLANNER_PROVIDER_TIMEOUT', 'a retried boot that reached a stalled provider is a provider timeout, not a boot timeout');
+    assert.equal(retryPorts.length, 2, 'exactly one fresh-port retry');
+    assert.equal(requests.length, requestsBeforeRetry + 1, 'only the fresh runtime made a provider request');
+    await bounded(planner.close(), 3_000, 'boot-retry tree cleanup exceeded budget');
+    planner = undefined;
+    assert.ok(!alive(warmRetryPids.pid) && !alive(warmRetryPids.workerPid), 'the fresh runtime and worker are reaped on close');
+    console.log('DSH READINESS BOOT RETRY:', JSON.stringify({ budgetMs: PLANNER_BOOT_BUDGET_MS, retriedAfterMs, elapsedMs: retryElapsedMs, code: 'PLANNER_PROVIDER_TIMEOUT', ports: retryPorts.length, providerRequests: 1, treeReaped: true }));
     // Opt-in distribution run: boot fresh runtimes back to back so the local
     // initialize budget can be set from measured percentiles instead of a guess.
     // Each sample is a new worker plus a new dsh home, so the page cache is the
@@ -235,4 +283,4 @@ finally {
     if (failedCleanup?.status === 'rejected')
         throw failedCleanup.reason;
 }
-console.log('BOOKING COPILOT DSH READINESS PROOF: real initialize, provider stall, cold timeout and process cleanup OK');
+console.log('BOOKING COPILOT DSH READINESS PROOF: real initialize, provider stall, cold timeout, boot retry and process cleanup OK');