@openrig/cli 0.6.11 → 0.6.12

package/daemon/dist/domain/startup-orchestrator.js

@@ -13,19 +13,103 @@ import { resolveReadinessTimeoutMs } from "./readiness-timeout.js";
 import { SettingsStore } from "./user-settings/settings-store.js";
 import { shellQuote } from "../adapters/shell-quote.js";
 import { observeClaudeResumeLaunch } from "./native-process-lineage.js";
+import { CommunityHarnessRuntimeAdapter } from "../adapters/community-harness-runtime-adapter.js";
 // Expanded startup text can put the current input marker above 50 scrollback lines.
 const STARTUP_SUBMIT_CAPTURE_LINES = 200;
 // Claude Code 2.1.289 has taken Enter on a large startup paste after the first look, while the composer
 // still showed that paste collapsed. Only that transient is looked at again, 200 ms apart, up to this many
 // times: about 5 s of waiting per send, plus capture time. Nothing is typed meanwhile.
 const STARTUP_SUBMIT_SETTLE_LOOKS = 25;
+// A prompt still staged after a guarded retry is retried again, up to this many retries in all, each after
+// the 200 ms look. Every retry is guarded: Enter goes in only while the composer holds exactly the text we typed.
+const STARTUP_SUBMIT_RETRIES = 2;
 /** Pending context belongs to this occupant and is consumed before delivery starts. */
-export function hasPendingFreshStartup(db, nodeId, sessionId) {
+export function readPendingStartupContext(db, nodeId, sessionId) {
+    const row = db.prepare("SELECT seq, payload FROM events WHERE node_id = ? AND type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed') ORDER BY seq DESC LIMIT 1").get(nodeId);
+    if (!row)
+        return null;
+    const event = JSON.parse(row.payload);
+    if (event.type !== "node.startup_failed" || event.sessionId !== sessionId)
+        return null;
+    if (event.freshContextPending === true)
+        return { eventSeq: row.seq, mode: "fresh" };
+    const fork = event.forkContextPending;
+    if (typeof fork?.parentToken === "string" && fork.parentToken.trim() && typeof fork.isRestore === "boolean") {
+        return { eventSeq: row.seq, mode: "fork", parentToken: fork.parentToken, isRestore: fork.isRestore };
+    }
+    return null;
+}
+export function hasClaudeResumeIdentityWork(sessionRegistry, sessionId, runtime, resumeToken, resumeType, skipHarnessLaunch, continuityOutcome) {
+    if (skipHarnessLaunch || runtime !== "claude-code" || !resumeToken) {
+        return false;
+    }
+    if (continuityOutcome !== undefined && continuityOutcome !== "resumed") {
+        return false;
+    }
+    if (resumeType !== undefined && resumeType !== null && !isClaudeResumeType(resumeType)) {
+        return true;
+    }
+    const matches = sessionRegistry.resumeTokenMatches(sessionId, "claude_id", resumeToken.trim())
+        || sessionRegistry.claudeResumeRotatedFrom(sessionId, resumeToken);
+    return !matches;
+}
+export function hasPendingStartupWork(db, nodeId, sessionId) {
     const row = db.prepare("SELECT payload FROM events WHERE node_id = ? AND type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed') ORDER BY seq DESC LIMIT 1").get(nodeId);
     if (!row)
+        return true;
+    try {
+        const event = JSON.parse(row.payload);
+        if (event.type !== "node.startup_failed")
+            return true;
+        if (event.sessionId !== sessionId)
+            return true;
+        if (event.freshContextPending === true || event.forkContextPending)
+            return true;
+        if (event.hasPendingWork !== false)
+            return true;
         return false;
-    const event = JSON.parse(row.payload);
-    return event.type === "node.startup_failed" && event.sessionId === sessionId && event.freshContextPending === true;
+    }
+    catch {
+        return true;
+    }
+}
+export function getLatestStartupFailedEvent(db, nodeId, sessionId) {
+    const row = db.prepare("SELECT payload FROM events WHERE node_id = ? AND type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed') ORDER BY seq DESC LIMIT 1").get(nodeId);
+    if (!row)
+        return null;
+    try {
+        const event = JSON.parse(row.payload);
+        if (event.type !== "node.startup_failed")
+            return null;
+        if (!event.sessionId || event.sessionId !== sessionId)
+            return null;
+        return event;
+    }
+    catch {
+        return null;
+    }
+}
+export function isRecoverableStartupFailure(db, nodeId, sessionId) {
+    if (readPendingStartupContext(db, nodeId, sessionId))
+        return false;
+    if (hasPendingStartupWork(db, nodeId, sessionId))
+        return false;
+    const sess = db.prepare("SELECT resume_type, resume_token FROM sessions WHERE id = ?").get(sessionId);
+    if (sess?.resume_token && sess.resume_type !== null && sess.resume_type !== undefined && !isClaudeResumeType(sess.resume_type)) {
+        const node = db.prepare("SELECT runtime FROM nodes WHERE id = ?").get(nodeId);
+        if (node?.runtime === "claude-code")
+            return false;
+    }
+    const event = getLatestStartupFailedEvent(db, nodeId, sessionId);
+    if (!event)
+        return false;
+    if (event.freshContextPending === true || event.forkContextPending)
+        return false;
+    if (event.hasPendingWork !== false)
+        return false;
+    if (event.stage !== "post_delivery_readiness" && event.stage !== "readiness_check")
+        return false;
+    return true;
 }
 /**
  * Drives one node from projected resources to startup_status: ready.
@@ -111,7 +195,7 @@ export class StartupOrchestrator {
             input = { ...input, binding: new NativePermissionStore(this.db).apply(input.binding, input.adapter.runtime) };
         }
         catch (error) {
-            return this.fail(input, "failed", [`Permission selection: ${error.message}`]);
+            return this.fail(input, "failed", [`Permission selection: ${error.message}`], undefined, false, undefined, false, "permission_selection", true);
         }
         // #25: launch, restore replay, relaunch, continue and added members deliver
         // guidance through here, so the rig's managed-block destination is bound once
@@ -132,6 +216,9 @@ export class StartupOrchestrator {
                     ? "rebuilt"
                     : "fresh";
         let appliedLaunch;
+        const forkContext = input.adapter.runtime === "codex"
+            && input.forkSource?.kind === "native_id" && input.forkSource.value?.trim()
+            ? { parentToken: input.forkSource.value.trim(), isRestore: input.isRestore } : undefined;
         const launchGeneration = this.sessionRegistry.currentOccupantTenure(input.nodeId)?.generationUuid;
         // 1. Mark pending
         this.sessionRegistry.updateStartupStatus(input.sessionId, "pending");
@@ -141,7 +228,7 @@ export class StartupOrchestrator {
             startupProof = resolveStartupProof(input.startupActions, context);
         }
         catch (err) {
-            return this.fail(input, "failed", [`Startup proof selection: ${err.message}`]);
+            return this.fail(input, "failed", [`Startup proof selection: ${err.message}`], undefined, false, undefined, false, "proof_selection", true);
         }
         this.eventBus.emit({ type: "node.startup_pending", rigId: input.rigId, nodeId: input.nodeId, startupProof });
         // 2. Project resources. A contained Claude resume has an intentionally empty
@@ -157,12 +244,12 @@ export class StartupOrchestrator {
                     for (const f of projectionResult.failed) {
                         errors.push(`Projection failed for ${f.effectiveId}: ${f.error}`);
                     }
-                    return this.fail(input, "failed", errors);
+                    return this.fail(input, "failed", errors, undefined, false, undefined, false, "projection", true);
                 }
             }
             catch (err) {
                 errors.push(`Projection error: ${err.message}`);
-                return this.fail(input, "failed", errors);
+                return this.fail(input, "failed", errors, undefined, false, undefined, false, "projection", true);
             }
         // 3. Partition startup files by concrete hint: pre-launch (filesystem) vs post-launch (TUI)
         // Note: new file-building paths (NS-T05+) emit only concrete hints. The auto fallback
@@ -198,12 +285,12 @@ export class StartupOrchestrator {
                 for (const f of deliveryResult.failed) {
                     errors.push(`Pre-launch file delivery failed: ${f.path}: ${f.error}`);
                 }
-                return this.fail(input, "failed", errors);
+                return this.fail(input, "failed", errors, undefined, false, undefined, false, "pre_launch_files", true);
             }
         }
         catch (err) {
             errors.push(`Pre-launch delivery error: ${err.message}`);
-            return this.fail(input, "failed", errors);
+            return this.fail(input, "failed", errors, undefined, false, undefined, false, "pre_launch_files", true);
         }
         // 7. Persist startup context for restore replay
         if (!input.preserveStartupContext)
@@ -211,9 +298,20 @@ export class StartupOrchestrator {
                 this.db.prepare("INSERT OR REPLACE INTO node_startup_context (node_id, projection_entries_json, resolved_files_json, startup_actions_json, runtime) VALUES (?, ?, ?, ?, ?)").run(input.nodeId, JSON.stringify(input.plan.entries.map((e) => ({ category: e.category, effectiveId: e.effectiveId, sourceSpec: e.sourceSpec, sourcePath: e.sourcePath, resourcePath: e.resourcePath, absolutePath: e.absolutePath, resourceType: e.resourceType, mergeStrategy: e.mergeStrategy, target: e.target }))), JSON.stringify(input.resolvedStartupFiles), JSON.stringify(input.startupActions), input.adapter.runtime);
             }
             catch (error) {
-                return this.fail(input, "failed", [`Startup context persistence failed: ${String(error)}`]);
+                return this.fail(input, "failed", [`Startup context persistence failed: ${String(error)}`], undefined, false, undefined, false, "persistence", true);
             }
         // 5. Launch harness (unless skipped for legacy nodes)
+        // A community harness's seat: record the selection on this session before the app starts. It's provenance for
+        // later reads (identity, activity, labels, restore), not launch success or identity proof.
+        if (input.adapter instanceof CommunityHarnessRuntimeAdapter) {
+            try {
+                this.sessionRegistry.recordCommunityHarnessSelection(input.sessionId, input.adapter.runtime);
+            }
+            catch (err) {
+                errors.push(`Couldn't record the community harness selection: ${err.message}`);
+                return this.fail(input, "failed", errors);
+            }
+        }
         if (!input.skipHarnessLaunch) {
             try {
                 let launchResumeToken = input.resumeToken;
@@ -283,16 +381,17 @@ export class StartupOrchestrator {
                         }
                         errors.push(`Harness launch requires attention: ${launchResult.error}`);
                         // isRestore selects context, not native continuity: pod-aware exact
-                        // resume also uses false. Only an actual fresh launch may re-prime.
-                        return this.fail(input, "attention_required", errors, launchResult.evidence, continuityOutcome === "fresh");
+                        // resume also uses false. Only an actual fresh launch may re-prime; an
+                        // unverified fork keeps its unsent context for a verified continuation.
+                        return this.fail(input, "attention_required", errors, launchResult.evidence, launchResult.forkIdentityPending ? forkContext ?? false : continuityOutcome === "fresh", undefined, false, "harness_launch", true);
                     }
                     errors.push(`Harness launch failed: ${launchResult.error}`);
-                    return this.fail(input, "failed", errors, undefined, false, launchResult.recovery, launchResult.missingConversation === true);
+                    return this.fail(input, "failed", errors, undefined, false, launchResult.recovery, launchResult.missingConversation === true, "harness_launch", true);
                 }
             }
             catch (err) {
                 errors.push(`Harness launch error: ${err.message}`);
-                return this.fail(input, "failed", errors);
+                return this.fail(input, "failed", errors, undefined, false, undefined, false, "harness_launch", true);
             }
         }
         // A successful new lean launch replaces the occupant's proof boundary even
@@ -307,21 +406,65 @@ export class StartupOrchestrator {
             });
         }
         // 6. Wait for harness readiness within the configured launch window.
+        const getPendingReadinessWork = () => {
+            const hasRemainingIdentityWork = hasClaudeResumeIdentityWork(this.sessionRegistry, input.sessionId, input.adapter.runtime, input.resumeToken, input.resumeType, input.skipHarnessLaunch, continuityOutcome);
+            return postLaunchFiles.length > 0 || (input.startupActions ?? []).some((a) => a.phase === "after_files" || a.phase === "after_ready" || isSessionIdentityAction(a) || a.type === "send_text") || hasRemainingIdentityWork;
+        };
         try {
             const readinessTimeoutMs = resolveReadinessTimeoutMs(input.readinessTimeoutMs, this.readinessSettings);
             const readiness = await this.waitForReady(input.adapter, input.binding, readinessTimeoutMs);
             if (!readiness.ready) {
+                const hasPendingReadinessWork = getPendingReadinessWork();
                 if (isAttentionRequiredReadinessCode(readiness.code)) {
                     errors.push(`Startup requires attention: ${readiness.reason ?? "unknown"}`);
-                    return this.fail(input, "attention_required", errors, undefined, isFreshLaunch);
+                    return this.fail(input, "attention_required", errors, undefined, isFreshLaunch || (forkContext ?? false), undefined, false, "readiness_check", hasPendingReadinessWork);
                 }
                 errors.push(`Readiness timeout after ${readinessTimeoutMs / 1000}s — harness did not become interactive: ${readiness.reason ?? "unknown"}`);
-                return this.fail(input, "failed", errors);
+                return this.fail(input, forkContext ? "attention_required" : "failed", errors, undefined, forkContext ?? false, undefined, false, "readiness_check", hasPendingReadinessWork);
             }
         }
         catch (err) {
             errors.push(`Readiness check error: ${err.message}`);
-            return this.fail(input, "failed", errors);
+            return this.fail(input, "failed", errors, undefined, false, undefined, false, "readiness_check", getPendingReadinessWork());
+        }
+        if (input.skipHarnessLaunch && forkContext) {
+            // Continuing a fork is a read-only identity check, never another fork or
+            // a resume of its parent. Do this after readiness, before any prompt.
+            let identity;
+            let captureError;
+            try {
+                identity = await input.adapter.captureForkIdentity?.(input.binding, forkContext.parentToken);
+            }
+            catch (error) {
+                captureError = String(error);
+            }
+            // Check even a missing/failed observation before publishing a failure.
+            const current = this.db.prepare("SELECT id FROM sessions WHERE node_id = ? ORDER BY id DESC LIMIT 1").get(input.nodeId);
+            const binding = this.sessionRegistry.getBindingForNode(input.nodeId);
+            if (current?.id !== input.sessionId) {
+                // The newer occupant owns the node's startup event stream. Update only
+                // the previous session: a late event here could hide the new pending context.
+                this.sessionRegistry.updateStartupStatus(input.sessionId, "attention_required");
+                return { ok: false, startupStatus: "attention_required", errors: ["The occupant changed during fork verification; no startup context was sent."] };
+            }
+            if (binding?.tmuxPane !== input.binding.tmuxPane || binding?.tmuxSession !== input.binding.tmuxSession) {
+                return this.fail(input, "attention_required", ["The terminal binding changed during fork verification; no startup context was sent."]);
+            }
+            if (captureError !== undefined) {
+                return this.fail(input, "attention_required", [`Fork identity verification failed: ${captureError}; no startup context was sent.`], undefined, forkContext);
+            }
+            if (!identity?.resumeToken || identity.resumeToken === forkContext.parentToken || identity.resumeType !== "codex_id") {
+                return this.fail(input, "attention_required", ["The fork's child identity is not verified yet; no startup context was sent."], undefined, forkContext);
+            }
+            try {
+                this.sessionRegistry.updateResumeToken(input.sessionId, identity.resumeType, identity.resumeToken, "scrape");
+                if (!this.sessionRegistry.resumeTokenMatches(input.sessionId, identity.resumeType, identity.resumeToken)) {
+                    return this.fail(input, "attention_required", ["The verified fork child conflicts with protected session metadata; no startup context was sent."], undefined, forkContext);
+                }
+            }
+            catch (error) {
+                return this.fail(input, "attention_required", [`Fork identity verification failed: ${String(error)}; no startup context was sent.`], undefined, forkContext);
+            }
         }
         // The adapter returned the exact enforcing value it inserted, and readiness
         // proved this managed launch became live. Persistence is deliberately
@@ -347,7 +490,7 @@ export class StartupOrchestrator {
             const initialPrompt = await this.deliverInitialSessionPrompt(deliveryInput, identityAction, postLaunchFiles, challenge?.promptBlock ?? null, input.includeDurableObligations);
             if (!initialPrompt.ok) {
                 errors.push(initialPrompt.error);
-                return this.fail(input, "failed", errors);
+                return this.fail(input, "failed", errors, undefined, false, undefined, false, "initial_prompt", true);
             }
             postLaunchFiles = initialPrompt.remainingFiles;
             if (challenge)
@@ -378,7 +521,7 @@ export class StartupOrchestrator {
                 const preload = await this.deliverRestorePreloadPrompt(deliveryInput, preloadActions, postLaunchFiles);
                 if (!preload.ok) {
                     errors.push(preload.error);
-                    return this.fail(input, "failed", errors);
+                    return this.fail(input, "failed", errors, undefined, false, undefined, false, "restore_preload", true);
                 }
                 postLaunchFiles = preload.remainingFiles;
                 for (const a of preloadActions)
@@ -401,12 +544,12 @@ export class StartupOrchestrator {
                     for (const f of deliveryResult.failed) {
                         errors.push(`Post-launch file delivery failed: ${f.path}: ${f.error}`);
                     }
-                    return this.fail(deliveryInput, "failed", errors);
+                    return this.fail(deliveryInput, "failed", errors, undefined, false, undefined, false, "post_launch_files", true);
                 }
             }
             catch (err) {
                 errors.push(`Post-launch delivery error: ${err.message}`);
-                return this.fail(deliveryInput, "failed", errors);
+                return this.fail(deliveryInput, "failed", errors, undefined, false, undefined, false, "post_launch_files", true);
             }
         }
         // Challenge-only delivery remains best-effort. Staging is reported without
@@ -419,13 +562,13 @@ export class StartupOrchestrator {
         // 8. Execute after_files actions
         const afterFilesResult = await this.executeActions(deliveryInput, "after_files");
         if (!afterFilesResult.ok) {
-            return this.fail(deliveryInput, "failed", afterFilesResult.errors);
+            return this.fail(deliveryInput, "failed", afterFilesResult.errors, undefined, false, undefined, false, "after_files", true);
         }
         // 9. Execute after_ready actions (skipping any preload actions already
         // delivered ahead of role.md by the restore-order bundling above).
         const afterReadyResult = await this.executeActions(deliveryInput, "after_ready", consumedActions);
         if (!afterReadyResult.ok) {
-            return this.fail(deliveryInput, "failed", afterReadyResult.errors);
+            return this.fail(deliveryInput, "failed", afterReadyResult.errors, undefined, false, undefined, false, "after_ready", true);
         }
         // Delivering the first native prompt can reveal a provider refusal or
         // interactive gate. Bundled identity/preload prompts consume their files,
@@ -434,7 +577,8 @@ export class StartupOrchestrator {
             try {
                 const readiness = await input.adapter.checkReady(input.binding);
                 if (!readiness.ready && isAttentionRequiredReadinessCode(readiness.code)) {
-                    return this.fail(deliveryInput, "attention_required", [readiness.reason ?? "The native provider prerequisite failed after context delivery."]);
+                    const hasRemainingIdentityWork = hasClaudeResumeIdentityWork(this.sessionRegistry, input.sessionId, input.adapter.runtime, input.resumeToken, input.resumeType, input.skipHarnessLaunch, continuityOutcome);
+                    return this.fail(deliveryInput, "attention_required", [readiness.reason ?? "The native provider prerequisite failed after context delivery."], undefined, false, undefined, false, "post_delivery_readiness", hasRemainingIdentityWork);
                 }
             }
             catch (error) {
@@ -447,15 +591,10 @@ export class StartupOrchestrator {
         // Check after readiness/actions so a concurrent protected update is included.
         // Omitted type is inferred; claude_name may normalize to a proved claude_id.
         // An explicit type for another runtime is not that supported normalization.
-        if (!input.skipHarnessLaunch && input.adapter.runtime === "claude-code"
-            && continuityOutcome === "resumed" && input.resumeToken
-            && ((input.resumeType !== undefined && !isClaudeResumeType(input.resumeType))
-                || !(this.sessionRegistry.resumeTokenMatches(input.sessionId, "claude_id", input.resumeToken.trim())
-                    // Claude continued this resume under a new id; its current-generation hook said so.
-                    || this.sessionRegistry.claudeResumeRotatedFrom(input.sessionId, input.resumeToken)))) {
+        if (hasClaudeResumeIdentityWork(this.sessionRegistry, input.sessionId, input.adapter.runtime, input.resumeToken, input.resumeType, input.skipHarnessLaunch, continuityOutcome)) {
             return this.fail(deliveryInput, "attention_required", [
                 "Native resume was observed but its requested type or current session metadata conflicts or could not be retained; session preserved.",
-            ]);
+            ], undefined, false, undefined, false, "identity_verification", false);
         }
         // 8. Mark ready
         this.sessionRegistry.updateStartupStatus(input.sessionId, "ready", new Date().toISOString());
@@ -472,8 +611,11 @@ export class StartupOrchestrator {
      * Any newer pending/ready/failure event consumes that permission, including a
      * daemon loss during delivery: uncertain delivery is never blindly replayed.
      */
-    canContinueFresh(nodeId, sessionId) {
-        return hasPendingFreshStartup(this.db, nodeId, sessionId);
+    canContinueStartup(nodeId, sessionId) {
+        return this.pendingStartupContext(nodeId, sessionId) !== null;
+    }
+    pendingStartupContext(nodeId, sessionId) {
+        return readPendingStartupContext(this.db, nodeId, sessionId);
     }
     /**
      * Wait for harness readiness with exponential backoff.
@@ -506,8 +648,12 @@ export class StartupOrchestrator {
             return "";
         }
     }
-    fail(input, status, errors, evidence, freshContextPending = false, recovery, missingConversation = false) {
-        if (status === "attention_required" && freshContextPending && input.binding.tmuxSession) {
+    fail(input, status, errors, evidence, pendingContext = false, recovery, missingConversation = false, stage, hasPendingWork) {
+        if (status === "attention_required" && typeof pendingContext === "object") {
+            // The reasons above stay visible; this only says what the status means for the fork.
+            errors.push("The fork's startup context is waiting to be sent: this attention status doesn't mean the forked conversation is healthy");
+        }
+        if (status === "attention_required" && pendingContext && input.binding.tmuxSession) {
             errors.push(`After resolving it in ${input.binding.tmuxSession}, run: rig seat continue ${shellQuote(input.binding.tmuxSession)}`);
         }
         this.sessionRegistry.updateStartupStatus(input.sessionId, status);
@@ -517,8 +663,13 @@ export class StartupOrchestrator {
             nodeId: input.nodeId,
             error: errors.join("; "),
             sessionId: input.sessionId,
-            ...(freshContextPending ? { freshContextPending: true } : {}),
+            ...(pendingContext === true ? { freshContextPending: true }
+                : pendingContext ? { forkContextPending: pendingContext } : {}),
             ...(input.submissionDiagnostics?.length ? { submissionDiagnostics: input.submissionDiagnostics } : {}),
+            ...(stage ? { stage } : {}),
+            ...(hasPendingWork !== undefined ? { hasPendingWork } : {}),
+            requestedResumeToken: input.resumeToken ?? null,
+            requestedResumeType: input.resumeType ?? null,
         });
         return { ok: false, startupStatus: status, errors, evidence, ...(recovery ? { recovery } : {}),
             ...(missingConversation ? { missingConversation: true } : {}) };
@@ -676,7 +827,7 @@ export class StartupOrchestrator {
             sendOrder, source, ...(actionIndex === undefined ? {} : { actionIndex }), observations: [], retry: "not_run" };
         let phase = "initial";
         const record = (pane, look) => {
-            const evidence = startupSubmissionEvidence(pane, text, STARTUP_SUBMIT_CAPTURE_LINES);
+            const evidence = startupSubmissionEvidence(pane, text, STARTUP_SUBMIT_CAPTURE_LINES, input.adapter.runtime);
             if (evidence)
                 diagnostic.observations.push({ ...evidence, phase, ...(look === undefined ? {} : { look }) });
             return evidence;
@@ -694,7 +845,7 @@ export class StartupOrchestrator {
                 record(first);
                 return unverified("Startup submission capture is unavailable after Enter.");
             }
-            const { pane, state: before, looks } = await this.settleOwnPaste(tmuxSession, first, text);
+            const { pane, state: before, looks } = await this.settleOwnPaste(tmuxSession, first, text, input.adapter.runtime);
             if (before === "clear") {
                 input.lastSubmissionConfirmed = true;
                 return null;
@@ -707,24 +858,31 @@ export class StartupOrchestrator {
                     ? "Startup submission is unverified: the current composer boundary was not recognized."
                     : "Startup submission is unverified: the current composer does not positively match the complete prompt.");
             }
-            phase = "guarded_retry";
-            diagnostic.retry = "threw"; // Replaced when the transport returns normally.
-            const retry = await this.sessionTransport.send(tmuxSession, "", {
-                submitOnly: true,
-                expectedStagedText: text,
-                submitOnlyCaptureLines: STARTUP_SUBMIT_CAPTURE_LINES,
-                requireFullStagedText: true,
-                onStartupMismatch: (evidence) => { diagnostic.observations.push({ ...evidence, phase: "guarded_retry" }); },
-            });
-            diagnostic.retry = retry.ok ? "ok" : "refused_or_failed";
-            phase = "after_retry";
-            await this.sleep(200);
-            const after = await this.tmuxAdapter.capturePaneContent(tmuxSession, STARTUP_SUBMIT_CAPTURE_LINES);
-            if (!after?.trim()) {
-                record(after);
-                return unverified("Startup submission capture is unavailable after the guarded retry.");
-            }
-            const observed = inspectStartupStagedText(after, text);
+            let retry;
+            let after;
+            let observed;
+            let retries = 0;
+            do {
+                phase = "guarded_retry";
+                diagnostic.retry = "threw"; // Replaced when the transport returns normally.
+                retry = await this.sessionTransport.send(tmuxSession, "", {
+                    submitOnly: true,
+                    expectedStagedText: text,
+                    submitOnlyCaptureLines: STARTUP_SUBMIT_CAPTURE_LINES,
+                    requireFullStagedText: true,
+                    onStartupMismatch: (evidence) => { diagnostic.observations.push({ ...evidence, phase: "guarded_retry" }); },
+                });
+                diagnostic.retry = retry.ok ? "ok" : "refused_or_failed";
+                phase = "after_retry";
+                await this.sleep(200);
+                after = await this.tmuxAdapter.capturePaneContent(tmuxSession, STARTUP_SUBMIT_CAPTURE_LINES);
+                if (!after?.trim()) {
+                    record(after);
+                    return unverified("Startup submission capture is unavailable after the guarded retry.");
+                }
+                observed = inspectStartupStagedText(after, text, input.adapter.runtime);
+                // A refused retry is not repeated; only a retry whose Enter went in and was lost again is.
+            } while (observed === "staged" && retry.ok && ++retries < STARTUP_SUBMIT_RETRIES);
             if (observed === "staged") {
                 const warning = `Startup prompt still staged in ${tmuxSession}; press Enter in that pane.`;
                 input.stagedSubmissionWarning = warning;
@@ -761,17 +919,17 @@ export class StartupOrchestrator {
      * Remaining ambiguity: a person who clears a collapsed paste with the same line count inside the window reads
      * as submitted.
      */
-    async settleOwnPaste(tmuxSession, pane, text) {
-        let state = inspectStartupStagedText(pane, text);
+    async settleOwnPaste(tmuxSession, pane, text, runtime) {
+        let state = inspectStartupStagedText(pane, text, runtime);
         let looks = 0;
-        while (state === "unverified" && looks < STARTUP_SUBMIT_SETTLE_LOOKS && startupOwnCollapsedPaste(pane, text)) {
+        while (state === "unverified" && looks < STARTUP_SUBMIT_SETTLE_LOOKS && startupOwnCollapsedPaste(pane, text, runtime)) {
             await this.sleep(200);
             // A failed re-look adds nothing; the last usable observation stands.
             const next = await this.tmuxAdapter.capturePaneContent(tmuxSession, STARTUP_SUBMIT_CAPTURE_LINES).catch(() => null);
             if (!next?.trim())
                 break;
             pane = next;
-            state = inspectStartupStagedText(pane, text);
+            state = inspectStartupStagedText(pane, text, runtime);
             looks++;
         }
         return { pane, state, looks };