@openrig/cli 0.6.4 → 0.6.6

package/daemon/dist/domain/startup-orchestrator.js

@@ -1,9 +1,31 @@
+import { nonInterruptiveNotice } from "../adapters/non-interruptive.js";
+import { randomUUID } from "node:crypto";
+import { isClaudeResumeType } from "../adapters/claude-resume.js";
 import { isAttentionRequiredReadinessCode, resolveConcreteHint } from "./runtime-adapter.js";
-import { issueStartupChallenge } from "./startup-proof.js";
+import { issueStartupChallenge, STARTUP_PROOF_INSTRUCTION_LINE } from "./startup-proof.js";
 import { resolveStartupProof } from "./startup-resolver.js";
 import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
 import { NativePermissionStore } from "./native-permission-store.js";
 import { RigRepository } from "./rig-repository.js";
+import { SessionTransport, inspectStartupStagedText } from "./session-transport.js";
+import { startupOwnCollapsedPaste, startupSubmissionEvidence } from "./startup-submission-evidence.js";
+import { resolveReadinessTimeoutMs } from "./readiness-timeout.js";
+import { SettingsStore } from "./user-settings/settings-store.js";
+import { shellQuote } from "../adapters/shell-quote.js";
+// Expanded startup text can put the current input marker above 50 scrollback lines.
+const STARTUP_SUBMIT_CAPTURE_LINES = 200;
+// Claude Code 2.1.289 has taken Enter on a large startup paste after the first look, while the composer
+// still showed that paste collapsed. Only that transient is looked at again, 200 ms apart, up to this many
+// times: about 5 s of waiting per send, plus capture time. Nothing is typed meanwhile.
+const STARTUP_SUBMIT_SETTLE_LOOKS = 25;
+/** Pending context belongs to this occupant and is consumed before delivery starts. */
+export function hasPendingFreshStartup(db, nodeId, sessionId) {
+    const row = db.prepare("SELECT payload FROM events WHERE node_id = ? AND type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed') ORDER BY seq DESC LIMIT 1").get(nodeId);
+    if (!row)
+        return false;
+    const event = JSON.parse(row.payload);
+    return event.type === "node.startup_failed" && event.sessionId === sessionId && event.freshContextPending === true;
+}
 /**
  * Drives one node from projected resources to startup_status: ready.
  *
@@ -12,7 +34,7 @@ import { RigRepository } from "./rig-repository.js";
  * 2. Project resources (filesystem)
  * 3. Deliver pre-launch files (guidance_merge, skill_install → filesystem)
  * 4. Launch harness via adapter.launchHarness()
- * 5. Wait for harness ready (retry with exponential backoff, 30s timeout)
+ * 5. Wait for harness ready (retry with exponential backoff, configurable timeout)
  * 6. For fresh sessions, inject the built-in identity anchor as the first prompt
  *    and deliver remaining post-launch files (send_text → TUI)
  * 7. Execute after_files actions
@@ -31,6 +53,8 @@ export class StartupOrchestrator {
     tmuxAdapter;
     sleep;
     appliedLaunchStore;
+    sessionTransport;
+    readinessSettings;
     constructor(deps) {
         if (deps.db !== deps.sessionRegistry.db)
             throw new Error("StartupOrchestrator: sessionRegistry must share the same db handle");
@@ -42,13 +66,26 @@ export class StartupOrchestrator {
         this.tmuxAdapter = deps.tmuxAdapter;
         this.readFile = deps.readFile ?? (() => "");
         this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.readinessSettings = deps.readinessSettings ?? new SettingsStore();
         this.appliedLaunchStore = new AppliedLaunchObservationStore(deps.db);
+        this.sessionTransport = new SessionTransport({
+            db: deps.db,
+            rigRepo: new RigRepository(deps.db),
+            sessionRegistry: deps.sessionRegistry,
+            tmuxAdapter: deps.tmuxAdapter,
+            eventBus: deps.eventBus,
+        });
     }
     readFile;
     async startNode(input) {
+        const warnings = [];
+        const result = await this.startNodeWithWarnings(input, warnings);
+        return { ...result, ...(warnings.length ? { warnings: [...new Set(warnings)] } : {}) };
+    }
+    async startNodeWithWarnings(input, warnings) {
         const guard = this.tmuxAdapter.deliveryGuard;
         if (guard && !guard.ownsLifecycle(input.nodeId)) {
-            return guard.lifecycle([input.nodeId], () => this.startNode(input));
+            return guard.lifecycle([input.nodeId], () => this.startNodeWithWarnings(input, warnings));
         }
         try {
             input = { ...input, binding: new NativePermissionStore(this.db).apply(input.binding, input.adapter.runtime) };
@@ -60,9 +97,12 @@ export class StartupOrchestrator {
         // guidance through here, so the rig's managed-block destination is bound once
         // for the adapter. Handover does not come here: the successor launches directly
         // and reads the file already written in its cwd.
-        const claudeManagedBlockFile = new RigRepository(this.db).getRigClaudeManagedBlockFile(input.rigId);
+        const rigRepo = new RigRepository(this.db);
+        input = { ...input, binding: { ...input.binding, nonInterruptive: rigRepo.getRigNonInterruptive(input.rigId) } };
+        const claudeManagedBlockFile = rigRepo.getRigClaudeManagedBlockFile(input.rigId);
         if (claudeManagedBlockFile)
             input = { ...input, binding: { ...input.binding, claudeManagedBlockFile } };
+        const deliveryInput = { ...input, warnings, submissionWarnings: [], startupAttemptId: randomUUID(), sendOrder: 0, submissionDiagnostics: [] };
         const errors = [];
         let continuityOutcome = input.resumeToken
             ? "resumed"
@@ -84,21 +124,26 @@ export class StartupOrchestrator {
             return this.fail(input, "failed", [`Startup proof selection: ${err.message}`]);
         }
         this.eventBus.emit({ type: "node.startup_pending", rigId: input.rigId, nodeId: input.nodeId, startupProof });
-        // 2. Project resources
+        // 2. Project resources. A contained Claude resume has an intentionally empty
+        // replay plan, not a newly selected profile with activity hooks removed.
+        // RestoreOrchestrator already reconciled the saved activity selection before
+        // native resume. Fresh launches still project empty plans to support removal.
         let projectionResult;
-        try {
-            projectionResult = await input.adapter.project(input.plan, input.binding);
-            if (projectionResult.failed.length > 0) {
-                for (const f of projectionResult.failed) {
-                    errors.push(`Projection failed for ${f.effectiveId}: ${f.error}`);
+        if (!(input.preserveStartupContext && input.adapter.runtime === "claude-code" && input.plan.entries.length === 0))
+            try {
+                projectionResult = await input.adapter.project(input.plan, input.binding);
+                warnings.push(...(projectionResult.warnings ?? []));
+                if (projectionResult.failed.length > 0) {
+                    for (const f of projectionResult.failed) {
+                        errors.push(`Projection failed for ${f.effectiveId}: ${f.error}`);
+                    }
+                    return this.fail(input, "failed", errors);
                 }
+            }
+            catch (err) {
+                errors.push(`Projection error: ${err.message}`);
                 return this.fail(input, "failed", errors);
             }
-        }
-        catch (err) {
-            errors.push(`Projection error: ${err.message}`);
-            return this.fail(input, "failed", errors);
-        }
         // 3. Partition startup files by concrete hint: pre-launch (filesystem) vs post-launch (TUI)
         // Note: new file-building paths (NS-T05+) emit only concrete hints. The auto fallback
         // is compatibility-only for pre-NS-T05 persisted startup contexts in node_startup_context.
@@ -128,6 +173,7 @@ export class StartupOrchestrator {
         // Always call even with empty list so adapters can provision runtime-specific config (e.g. context collectors)
         try {
             const deliveryResult = await input.adapter.deliverStartup(preLaunchFiles, input.binding);
+            warnings.push(...(deliveryResult.warnings ?? []));
             if (deliveryResult.failed.length > 0) {
                 for (const f of deliveryResult.failed) {
                     errors.push(`Pre-launch file delivery failed: ${f.path}: ${f.error}`);
@@ -160,6 +206,9 @@ export class StartupOrchestrator {
                     });
                     if (launchResult.ok) {
                         appliedLaunch = launchResult.appliedLaunch;
+                        const notice = nonInterruptiveNotice(input.adapter.runtime, input.binding);
+                        if (notice)
+                            warnings.push(`${input.sessionName ?? input.nodeId}: ${notice}`);
                         const normalizedResumeToken = launchResult.resumeToken?.trim();
                         if (normalizedResumeToken) {
                             try {
@@ -223,15 +272,16 @@ export class StartupOrchestrator {
                 reason: input.adapter.runtime === "terminal" ? "terminal" : "not_selected",
             });
         }
-        // 6. Wait for harness readiness (retry with exponential backoff, 30s timeout)
+        // 6. Wait for harness readiness within the configured launch window.
         try {
-            const readiness = await this.waitForReady(input.adapter, input.binding, input.readinessTimeoutMs ?? 30_000);
+            const readinessTimeoutMs = resolveReadinessTimeoutMs(input.readinessTimeoutMs, this.readinessSettings);
+            const readiness = await this.waitForReady(input.adapter, input.binding, readinessTimeoutMs);
             if (!readiness.ready) {
                 if (isAttentionRequiredReadinessCode(readiness.code)) {
                     errors.push(`Startup requires attention: ${readiness.reason ?? "unknown"}`);
                     return this.fail(input, "attention_required", errors, undefined, isFreshLaunch);
                 }
-                errors.push(`Readiness timeout after 30s — harness did not become interactive: ${readiness.reason ?? "unknown"}`);
+                errors.push(`Readiness timeout after ${readinessTimeoutMs / 1000}s — harness did not become interactive: ${readiness.reason ?? "unknown"}`);
                 return this.fail(input, "failed", errors);
             }
         }
@@ -260,12 +310,14 @@ export class StartupOrchestrator {
         const consumedActions = new Set();
         let challengeOnlyPrompt = null;
         if (continuityOutcome === "fresh" && identityAction) {
-            const initialPrompt = await this.deliverInitialSessionPrompt(input.binding, identityAction, postLaunchFiles, challenge?.promptBlock ?? null, input.includeDurableObligations);
+            const initialPrompt = await this.deliverInitialSessionPrompt(deliveryInput, identityAction, postLaunchFiles, challenge?.promptBlock ?? null, input.includeDurableObligations);
             if (!initialPrompt.ok) {
                 errors.push(initialPrompt.error);
                 return this.fail(input, "failed", errors);
             }
             postLaunchFiles = initialPrompt.remainingFiles;
+            if (challenge)
+                await this.sendProofInstruction(deliveryInput);
         }
         else if (challenge) {
             challengeOnlyPrompt = challenge.promptBlock;
@@ -289,7 +341,7 @@ export class StartupOrchestrator {
                 a.appliesOn.includes(context) &&
                 !(input.isRestore && !a.idempotent));
             if (preloadActions.length > 0) {
-                const preload = await this.deliverRestorePreloadPrompt(input.binding, preloadActions, postLaunchFiles);
+                const preload = await this.deliverRestorePreloadPrompt(deliveryInput, preloadActions, postLaunchFiles);
                 if (!preload.ok) {
                     errors.push(preload.error);
                     return this.fail(input, "failed", errors);
@@ -302,68 +354,94 @@ export class StartupOrchestrator {
         // 7. Deliver post-launch files (send_text → TUI, now that harness is ready)
         if (postLaunchFiles.length > 0) {
             try {
-                const deliveryResult = await input.adapter.deliverStartup(postLaunchFiles, input.binding);
+                // Keep reads/provisioning and required/optional errors in the adapter. Only Claude's
+                // already-partitioned interactive files use the same bounded check as startup actions.
+                const checkedSend = input.adapter.runtime === "claude-code" ? async (content) => {
+                    const failure = await this.sendInteractiveText(deliveryInput, content, "post_launch_file");
+                    if (failure)
+                        throw new Error(failure.error);
+                } : undefined;
+                const deliveryResult = await input.adapter.deliverStartup(postLaunchFiles, input.binding, checkedSend);
+                warnings.push(...(deliveryResult.warnings ?? []));
                 if (deliveryResult.failed.length > 0) {
                     for (const f of deliveryResult.failed) {
                         errors.push(`Post-launch file delivery failed: ${f.path}: ${f.error}`);
                     }
-                    return this.fail(input, "failed", errors);
+                    return this.fail(deliveryInput, "failed", errors);
                 }
             }
             catch (err) {
                 errors.push(`Post-launch delivery error: ${err.message}`);
-                return this.fail(input, "failed", errors);
+                return this.fail(deliveryInput, "failed", errors);
             }
         }
-        // OPR.0.4.3.06 — deliver the synthesized challenge-only prompt after the
-        // contract files. Best-effort: a failed send leaves oriented `missing`
-        // (honest), it does NOT fail an otherwise-good startup.
+        // Challenge-only delivery remains best-effort. Staging is reported without
+        // turning a recoverable composer into a startup failure/occupant rollback.
         if (challengeOnlyPrompt && input.binding.tmuxSession) {
-            await this.sendInteractiveText(input.binding.tmuxSession, challengeOnlyPrompt);
+            const challengeFailure = await this.sendInteractiveText(deliveryInput, challengeOnlyPrompt, "challenge");
+            if (!challengeFailure)
+                await this.sendProofInstruction(deliveryInput);
         }
         // 8. Execute after_files actions
-        const afterFilesResult = await this.executeActions(input, "after_files");
+        const afterFilesResult = await this.executeActions(deliveryInput, "after_files");
         if (!afterFilesResult.ok) {
-            return this.fail(input, "failed", afterFilesResult.errors);
+            return this.fail(deliveryInput, "failed", afterFilesResult.errors);
         }
         // 9. Execute after_ready actions (skipping any preload actions already
         // delivered ahead of role.md by the restore-order bundling above).
-        const afterReadyResult = await this.executeActions(input, "after_ready", consumedActions);
+        const afterReadyResult = await this.executeActions(deliveryInput, "after_ready", consumedActions);
         if (!afterReadyResult.ok) {
-            return this.fail(input, "failed", afterReadyResult.errors);
+            return this.fail(deliveryInput, "failed", afterReadyResult.errors);
         }
         // Delivering the first native prompt can reveal a provider refusal or
-        // interactive gate. A positive attention requirement is not ready.
-        if (postLaunchFiles.length > 0) {
+        // interactive gate. Bundled identity/preload prompts consume their files,
+        // so the remaining file list alone does not tell us whether context was sent.
+        if (postLaunchFiles.length > 0 || deliveryInput.sendOrder > 0) {
             try {
                 const readiness = await input.adapter.checkReady(input.binding);
                 if (!readiness.ready && isAttentionRequiredReadinessCode(readiness.code)) {
-                    return this.fail(input, "attention_required", [readiness.reason ?? "The native provider prerequisite failed after context delivery."]);
+                    return this.fail(deliveryInput, "attention_required", [readiness.reason ?? "The native provider prerequisite failed after context delivery."]);
                 }
             }
             catch (error) {
-                return this.fail(input, "attention_required", [`Post-delivery runtime state is unavailable: ${error.message}`]);
+                // An unavailable observation is not a positive provider prerequisite.
+                this.recordSubmissionWarning(deliveryInput, `Post-delivery runtime state is unverified: ${error.message}`, `Post-delivery runtime state is unverified in ${input.binding.tmuxSession}: ${error.message}`);
             }
         }
+        // Managed Claude resume needs agreement on the launched row, not a successful
+        // scrape write: an equal hook/operator token may reject that lower-rank write.
+        // Check after readiness/actions so a concurrent protected update is included.
+        // Omitted type is inferred; claude_name may normalize to a proved claude_id.
+        // An explicit type for another runtime is not that supported normalization.
+        if (!input.skipHarnessLaunch && input.adapter.runtime === "claude-code"
+            && continuityOutcome === "resumed" && input.resumeToken
+            && ((input.resumeType !== undefined && !isClaudeResumeType(input.resumeType))
+                || !this.sessionRegistry.resumeTokenMatches(input.sessionId, "claude_id", input.resumeToken.trim()))) {
+            return this.fail(deliveryInput, "attention_required", [
+                "Native resume was observed but its requested type or current session metadata conflicts or could not be retained; session preserved.",
+            ]);
+        }
         // 8. Mark ready
         this.sessionRegistry.updateStartupStatus(input.sessionId, "ready", new Date().toISOString());
-        this.eventBus.emit({ type: "node.startup_ready", rigId: input.rigId, nodeId: input.nodeId });
-        return { ok: true, startupStatus: "ready", continuityOutcome };
+        const submission = deliveryInput.submissionWarnings.length
+            ? { status: deliveryInput.stagedSubmissionWarning ? "staged" : "unverified",
+                reasons: deliveryInput.submissionWarnings,
+                ...(deliveryInput.submissionDiagnostics.length ? { diagnostics: deliveryInput.submissionDiagnostics } : {}),
+                ...(deliveryInput.stagedSubmissionWarning ? { warning: deliveryInput.stagedSubmissionWarning } : {}) }
+            : undefined;
+        this.eventBus.emit({ type: "node.startup_ready", rigId: input.rigId, nodeId: input.nodeId, ...(submission ? { submission } : {}) });
+        return { ok: true, startupStatus: "ready", continuityOutcome, ...(submission ? { submission } : {}) };
     }
     /** A failed attempt can continue only when it stopped before sending context.
      * Any newer pending/ready/failure event consumes that permission, including a
      * daemon loss during delivery: uncertain delivery is never blindly replayed.
      */
     canContinueFresh(nodeId, sessionId) {
-        const row = this.db.prepare("SELECT payload FROM events WHERE node_id = ? AND type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed') ORDER BY seq DESC LIMIT 1").get(nodeId);
-        if (!row)
-            return false;
-        const event = JSON.parse(row.payload);
-        return event.type === "node.startup_failed" && event.sessionId === sessionId && event.freshContextPending === true;
+        return hasPendingFreshStartup(this.db, nodeId, sessionId);
     }
     /**
      * Wait for harness readiness with exponential backoff.
-     * Backoff: 1s → 2s → 4s → 8s → 16s (capped), total timeout default 30s.
+     * Backoff: 1s → 2s → 4s → 8s → 16s (capped); the caller supplies the deadline.
      */
     async waitForReady(adapter, binding, timeoutMs = 30_000) {
         const startTime = Date.now();
@@ -376,15 +454,11 @@ export class StartupOrchestrator {
             if (isAttentionRequiredReadinessCode(result.code)) {
                 return result;
             }
-            const elapsed = Date.now() - startTime;
-            if (elapsed + delay > timeoutMs) {
-                // One final check before timing out
-                const finalResult = await adapter.checkReady(binding);
-                if (finalResult.ready)
-                    return finalResult;
+            const remaining = timeoutMs - (Date.now() - startTime);
+            if (remaining <= 0) {
                 return { ready: false, reason: result.reason ?? "readiness timeout" };
             }
-            await new Promise((resolve) => setTimeout(resolve, delay));
+            await new Promise((resolve) => setTimeout(resolve, Math.min(delay, remaining)));
             delay = Math.min(delay * 2, maxDelay);
         }
     }
@@ -397,6 +471,9 @@ export class StartupOrchestrator {
         }
     }
     fail(input, status, errors, evidence, freshContextPending = false) {
+        if (status === "attention_required" && freshContextPending && input.binding.tmuxSession) {
+            errors.push(`After resolving it in ${input.binding.tmuxSession}, run: rig seat continue ${shellQuote(input.binding.tmuxSession)}`);
+        }
         this.sessionRegistry.updateStartupStatus(input.sessionId, status);
         this.eventBus.emit({
             type: "node.startup_failed",
@@ -405,13 +482,14 @@ export class StartupOrchestrator {
             error: errors.join("; "),
             sessionId: input.sessionId,
             ...(freshContextPending ? { freshContextPending: true } : {}),
+            ...(input.submissionDiagnostics?.length ? { submissionDiagnostics: input.submissionDiagnostics } : {}),
         });
         return { ok: false, startupStatus: status, errors, evidence };
     }
     async executeActions(input, phase, skip) {
         const errors = [];
         const context = input.isRestore ? "restore" : "fresh_start";
-        for (const action of input.startupActions) {
+        for (const [actionIndex, action] of input.startupActions.entries()) {
             if (action.type === "startup_proof")
                 continue; // declaration, never terminal input
             if (isSessionIdentityAction(action))
@@ -433,9 +511,9 @@ export class StartupOrchestrator {
                     errors.push(`No tmux session for action: ${action.value}`);
                     continue;
                 }
-                const sendError = await this.sendInteractiveText(input.binding.tmuxSession, action.value);
+                const sendError = await this.sendInteractiveText(input, action.value, phase, actionIndex);
                 if (sendError) {
-                    errors.push(`Action failed (${action.type}): ${sendError}`);
+                    errors.push(`Action failed (${action.type}): ${sendError.error}`);
                 }
             }
             catch (err) {
@@ -447,7 +525,8 @@ export class StartupOrchestrator {
     extractSessionIdentityAction(actions, context) {
         return actions.find((action) => isSessionIdentityAction(action) && action.appliesOn.includes(context)) ?? null;
     }
-    async deliverInitialSessionPrompt(binding, identityAction, postLaunchFiles, challengeBlock, includeDurableObligations = false) {
+    async deliverInitialSessionPrompt(input, identityAction, postLaunchFiles, challengeBlock, includeDurableObligations = false) {
+        const { binding } = input;
         if (!binding.tmuxSession) {
             return { ok: false, error: "No tmux session for the initial session identity prompt" };
         }
@@ -475,9 +554,9 @@ export class StartupOrchestrator {
         if (challengeBlock) {
             prompt = `${prompt}\n\n${challengeBlock}`;
         }
-        const sendError = await this.sendInteractiveText(binding.tmuxSession, prompt);
+        const sendError = await this.sendInteractiveText(input, prompt, "initial_identity");
         if (sendError) {
-            return { ok: false, error: `Initial session identity prompt failed: ${sendError}` };
+            return { ok: false, error: `Initial session identity prompt failed: ${sendError.error}` };
         }
         return { ok: true, remainingFiles };
     }
@@ -489,7 +568,8 @@ export class StartupOrchestrator {
      * content in one submission. Returns the post-launch files still to deliver
      * normally (role.md removed once bundled).
      */
-    async deliverRestorePreloadPrompt(binding, preloadActions, postLaunchFiles) {
+    async deliverRestorePreloadPrompt(input, preloadActions, postLaunchFiles) {
+        const { binding } = input;
         if (!binding.tmuxSession) {
             return { ok: false, error: "No tmux session for the restore preload prompt" };
         }
@@ -510,23 +590,154 @@ export class StartupOrchestrator {
                 // still leads as its own turn.
             }
         }
-        const sendError = await this.sendInteractiveText(binding.tmuxSession, parts.join("\n\n"));
+        const sendError = await this.sendInteractiveText(input, parts.join("\n\n"), "restore_preload");
         if (sendError) {
-            return { ok: false, error: `Restore preload prompt failed: ${sendError}` };
+            return { ok: false, error: `Restore preload prompt failed: ${sendError.error}` };
         }
         return { ok: true, remainingFiles };
     }
-    async sendInteractiveText(tmuxSession, text) {
+    /**
+     * Claude only: the challenge reached the seat inside a paste, which Claude won't act on alone.
+     * One short line in the person's turn asks it to run the challenge's own command. Best-effort: a
+     * failed send is a submission warning, never a startup failure. It is sent only after the startup
+     * prompt was observed submitted: staged, unverified or unobservable input stays in the composer
+     * for the operator, and nothing is typed on top of it.
+     */
+    async sendProofInstruction(input) {
+        if (input.adapter.runtime !== "claude-code" || !input.binding.tmuxSession)
+            return;
+        if (!input.lastSubmissionConfirmed) {
+            this.recordSubmissionWarning(input, "Startup proof instruction was not sent: the startup prompt was not confirmed submitted.");
+            return;
+        }
+        const failure = await this.sendInteractiveText(input, STARTUP_PROOF_INSTRUCTION_LINE, "startup_proof_instruction");
+        if (failure)
+            this.recordSubmissionWarning(input, `Startup proof instruction was not delivered: ${failure.error}`);
+    }
+    recordSubmissionWarning(input, reason, displayWarning) {
+        input.submissionWarnings.push(reason);
+        // Keep every observation in the ordinary result, including if a later file fails.
+        input.warnings.push(displayWarning ?? (reason === input.stagedSubmissionWarning ? reason
+            : `Startup submission unverified in ${input.binding.tmuxSession}: ${reason}`));
+    }
+    async sendInteractiveText(input, text, source, actionIndex) {
+        const sendOrder = ++input.sendOrder;
+        const tmuxSession = input.binding.tmuxSession;
+        input.lastSubmissionConfirmed = false;
         const textResult = await this.tmuxAdapter.sendText(tmuxSession, text);
         if (!textResult.ok) {
-            return textResult.message ?? "unknown";
+            return { error: textResult.message ?? "unknown" };
         }
         await this.sleep(200);
-        const submitResult = await this.tmuxAdapter.sendKeys(tmuxSession, ["C-m"]);
+        const submitResult = await this.tmuxAdapter.sendKeys(tmuxSession, ["Enter"]);
         if (!submitResult.ok) {
-            return submitResult.message ?? "unknown";
+            return { error: submitResult.message ?? "unknown" };
+        }
+        if (input.adapter.runtime !== "claude-code")
+            return null;
+        const diagnostic = { startupAttemptId: input.startupAttemptId,
+            sendOrder, source, ...(actionIndex === undefined ? {} : { actionIndex }), observations: [], retry: "not_run" };
+        let phase = "initial";
+        const record = (pane, look) => {
+            const evidence = startupSubmissionEvidence(pane, text, STARTUP_SUBMIT_CAPTURE_LINES);
+            if (evidence)
+                diagnostic.observations.push({ ...evidence, phase, ...(look === undefined ? {} : { look }) });
+            return evidence;
+        };
+        const unverified = (reason) => {
+            this.recordSubmissionWarning(input, reason);
+            return null; // An unavailable observation is not a failed delivery.
+        };
+        // tmux accepting Enter does not prove the TUI submitted a large bracketed paste.
+        // Reuse submitOnly's content check and guarded retry; never repaste or resend.
+        try {
+            await this.sleep(200);
+            const first = await this.tmuxAdapter.capturePaneContent(tmuxSession, STARTUP_SUBMIT_CAPTURE_LINES);
+            if (!first?.trim()) {
+                record(first);
+                return unverified("Startup submission capture is unavailable after Enter.");
+            }
+            const { pane, state: before, looks } = await this.settleOwnPaste(tmuxSession, first, text);
+            if (before === "clear") {
+                input.lastSubmissionConfirmed = true;
+                return null;
+            }
+            if (before === "unverified") {
+                if (looks)
+                    record(first, 0);
+                const evidence = record(pane, looks || undefined);
+                return unverified(evidence?.reason === "unrecognized_composer_boundary"
+                    ? "Startup submission is unverified: the current composer boundary was not recognized."
+                    : "Startup submission is unverified: the current composer does not positively match the complete prompt.");
+            }
+            phase = "guarded_retry";
+            diagnostic.retry = "threw"; // Replaced when the transport returns normally.
+            const retry = await this.sessionTransport.send(tmuxSession, "", {
+                submitOnly: true,
+                expectedStagedText: text,
+                submitOnlyCaptureLines: STARTUP_SUBMIT_CAPTURE_LINES,
+                requireFullStagedText: true,
+                onStartupMismatch: (evidence) => { diagnostic.observations.push({ ...evidence, phase: "guarded_retry" }); },
+            });
+            diagnostic.retry = retry.ok ? "ok" : "refused_or_failed";
+            phase = "after_retry";
+            await this.sleep(200);
+            const after = await this.tmuxAdapter.capturePaneContent(tmuxSession, STARTUP_SUBMIT_CAPTURE_LINES);
+            if (!after?.trim()) {
+                record(after);
+                return unverified("Startup submission capture is unavailable after the guarded retry.");
+            }
+            const observed = inspectStartupStagedText(after, text);
+            if (observed === "staged") {
+                const warning = `Startup prompt still staged in ${tmuxSession}; press Enter in that pane.`;
+                input.stagedSubmissionWarning = warning;
+                this.recordSubmissionWarning(input, warning);
+                if (!retry.ok)
+                    this.recordSubmissionWarning(input, `Guarded retry did not submit: ${retry.error ?? retry.reason}`);
+                return null;
+            }
+            if (observed === "unverified") {
+                const evidence = record(after);
+                return unverified(evidence?.reason === "unrecognized_composer_boundary"
+                    ? "Startup submission is unverified after the guarded retry: the current composer boundary was not recognized."
+                    : "Startup submission is unverified after the guarded retry: the current composer is ambiguous.");
+            }
+            if (!retry.ok)
+                return unverified(`Guarded startup retry did not submit: ${retry.error ?? retry.reason}; matching staged text is no longer visible.`);
+            input.lastSubmissionConfirmed = true;
+            return null;
+        }
+        catch (error) {
+            if (!diagnostic.observations.some(observation => observation.phase === phase))
+                record(null);
+            return unverified(`Startup submission observation is unavailable: ${error.message}`);
         }
-        return null;
+        finally {
+            if (diagnostic.observations.length)
+                input.submissionDiagnostics.push(diagnostic);
+        }
+    }
+    /**
+     * Claude can take the startup Enter after the first look while the composer still shows our paste collapsed.
+     * Only that transient is looked at again, until the composer reads clear or staged, shows anything else, or
+     * the looks run out. A draft, ghost text or any other mismatch keeps its first-look verdict. Observation only.
+     * Remaining ambiguity: a person who clears a collapsed paste with the same line count inside the window reads
+     * as submitted.
+     */
+    async settleOwnPaste(tmuxSession, pane, text) {
+        let state = inspectStartupStagedText(pane, text);
+        let looks = 0;
+        while (state === "unverified" && looks < STARTUP_SUBMIT_SETTLE_LOOKS && startupOwnCollapsedPaste(pane, text)) {
+            await this.sleep(200);
+            // A failed re-look adds nothing; the last usable observation stands.
+            const next = await this.tmuxAdapter.capturePaneContent(tmuxSession, STARTUP_SUBMIT_CAPTURE_LINES).catch(() => null);
+            if (!next?.trim())
+                break;
+            pane = next;
+            state = inspectStartupStagedText(pane, text);
+            looks++;
+        }
+        return { pane, state, looks };
     }
 }
 function isSessionIdentityAction(action) {