cueline 0.4.1 → 0.4.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cueline",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Use a ChatGPT web conversation as the text controller for durable local advice or explicitly claimed work executed by the current Codex.",
   "author": {
     "name": "CueLine contributors"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cueline",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Use a ChatGPT web conversation as the text controller for durable local advice or explicitly claimed work executed by the current Codex.",
   "author": {
     "name": "CueLine contributors"

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.4.3 - 2026-07-19
+
+### Fixed
+
+- Reject injected browser objects before any durable continuation write unless
+  `sendTurn` is callable and split `submitTurn` / `observeTurn` methods are
+  supplied as a callable pair. The stable `BROWSER_ADAPTER_INVALID` error lists
+  only missing method names. A narrow legacy recovery recognizes only the exact
+  pre-submission `browser.sendTurn is not a function` event shape, requires a
+  fresh idle Pro observation of the exact conversation with the request absent,
+  and then abandons the old request for one round-preserving retry.
+- Capture child stdin/stdout/stderr stream errors in the process runner. An
+  early-exiting worker can emit `EPIPE` while CueLine is still writing a large
+  stdin task; the stream error is now bounded into job evidence while the real
+  child exit status remains authoritative, instead of crashing the controller
+  loop and concurrent jobs.
+
+### Verification
+
+- Release candidate preflight passes all 649 tests plus metadata agreement,
+  typecheck, plugin validation, shell install tests, package contents, and diff
+  hygiene.
+- Runtime regression proves an invalid built-in IAB module object returns
+  `BROWSER_ADAPTER_INVALID` with round, pending turns, and event sequence
+  unchanged; the legacy recovery fixture abandons and retries exactly once.
+- A 5 MB stdin regression against an immediately exiting child completes
+  without an uncaught `EPIPE`.
+
+## 0.4.2 - 2026-07-18
+
+### Fixed
+
+- Reuse CueLine's own leftover attachment when retrying an operator-confirmed
+  not-sent turn. A long controller prompt is auto-converted by ChatGPT into a
+  composer attachment; when the submit click was ambiguous and the operator
+  confirmed the prompt was not sent, that attachment stays in the composer. The
+  pre-existing-attachment guard previously refused it as foreign
+  (`CONTROLLER_PROMPT_NOT_READY`), deadlocking the run at `prompt_not_sent` /
+  `safeNextAction=retry`. The retry now reuses the single leftover attachment
+  only when it is provably CueLine's own — `notSentRecovery` is set,
+  `attachmentPromptExpected` is true, exactly one attachment is present, and
+  undoing the retry request-id swap reproduces the operator-confirmed
+  `promptHash` — skipping the re-fill instead of refusing. Any other
+  pre-existing attachment is still refused, so a user's own attachment is never
+  mixed in or cleared.
+
+### Verification
+
+- Red/green regression: a new unit test reuses the leftover attachment without
+  re-filling and clicks send exactly once; it failed against the old guard and
+  passes after the fix.
+- Full suite green: unit 250/250, integration 304/304, smoke 6/6, `tsc
+  --noEmit` clean.
+
 ## 0.4.1 - 2026-07-18
 
 ### Fixed

package/README.ja.md

@@ -22,11 +22,11 @@
 
 CueLine は独立した実装で、**ランタイムの npm 依存はゼロ**です。Omnilane のラッパーではありません。
 
-## 最新リリース：0.4.1
+## 最新リリース：0.4.3
 
 - 再起動後、完了済みの添付型 ChatGPT Pro 応答を受理できない問題を修正しました。新しいページのハイドレーションで永続 baseline より少ない履歴 assistant ノードしかマウントされない場合でも、正確な run／round／request envelope で応答を受理できます。exact URL、二重の Pro 証拠、user count、ハイドレーション、idle の安全チェックは fail-closed のままです。実際の round 35 は再送ゼロ・重複 job ゼロで復旧し、559/559 テストに合格しました。
 
-詳細は [changelog](CHANGELOG.md#041---2026-07-18) またはバージョン指定の [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1) を参照してください。
+詳細は [changelog](CHANGELOG.md#043---2026-07-19) またはバージョン指定の [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3) を参照してください。
 
 ## 1 回の実行は実際にどう進むか
 
@@ -67,15 +67,15 @@ ChatGPT Pro のサブスクリプションと、選択された Pro モデルは
 npm レジストリからインストールします。
 
 ```bash
-npm install -g cueline@0.4.1
+npm install -g cueline@0.4.3
 cueline install
 cueline doctor
 ```
 
-フォールバックとして、[v0.4.1 リリース](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1) のパッケージ済み tarball をインストールすることもできます。同じリリースに `.sha256` チェックサムも置いてあります。
+フォールバックとして、[v0.4.3 リリース](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3) のパッケージ済み tarball をインストールすることもできます。同じリリースに `.sha256` チェックサムも置いてあります。
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.1/cueline-0.4.1.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.3/cueline-0.4.3.tgz
 cueline install
 cueline doctor
 ```
@@ -182,7 +182,7 @@ CLI はブラウザーを駆動しません。状態を書き込むコマンド
 
 ```console
 $ cueline doctor
-CueLine 0.4.1
+CueLine 0.4.3
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.ko.md

@@ -22,11 +22,11 @@
 
 CueLine은 독립적인 구현이며 **런타임 npm 의존성이 전혀 없습니다**. Omnilane을 감싼 래퍼가 아닙니다.
 
-## 최신 릴리스: 0.4.1
+## 최신 릴리스: 0.4.3
 
 - 재시작 후 완료된 첨부형 ChatGPT Pro 응답을 수락하지 못하는 문제를 수정했습니다. 새 페이지 하이드레이션에서 영속 baseline보다 적은 과거 assistant 노드만 마운트되어도 정확한 run／round／request envelope로 응답을 수락합니다. exact URL, 이중 Pro 증거, user count, 하이드레이션, idle 안전 검사는 fail-closed 상태로 유지됩니다. 실제 round 35는 재전송과 중복 job 없이 복구되었고 559/559 테스트를 통과했습니다.
 
-전체 내용은 [changelog](CHANGELOG.md#041---2026-07-18) 또는 버전이 지정된 [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1)에서 확인할 수 있습니다.
+전체 내용은 [changelog](CHANGELOG.md#043---2026-07-19) 또는 버전이 지정된 [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3)에서 확인할 수 있습니다.
 
 ## 실행 한 번은 실제로 이렇게 흘러갑니다
 
@@ -67,15 +67,15 @@ ChatGPT Pro 구독과 선택된 Pro 모델은 서로 다른 것입니다. 계정
 npm 레지스트리에서 설치합니다:
 
 ```bash
-npm install -g cueline@0.4.1
+npm install -g cueline@0.4.3
 cueline install
 cueline doctor
 ```
 
-대안으로, [v0.4.1 릴리스](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1)의 패키지 tarball을 설치할 수도 있습니다. 같은 릴리스에 `.sha256` 체크섬도 함께 있습니다.
+대안으로, [v0.4.3 릴리스](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3)의 패키지 tarball을 설치할 수도 있습니다. 같은 릴리스에 `.sha256` 체크섬도 함께 있습니다.
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.1/cueline-0.4.1.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.3/cueline-0.4.3.tgz
 cueline install
 cueline doctor
 ```
@@ -182,7 +182,7 @@ CLI는 브라우저를 구동하지 않습니다. 상태를 쓰는 명령 전에
 
 ```console
 $ cueline doctor
-CueLine 0.4.1
+CueLine 0.4.3
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.md

@@ -22,11 +22,15 @@ The web page never touches your machine and has no local tools. It only emits on
 
 CueLine is a standalone implementation with **no runtime npm dependencies**. It is not a wrapper around Omnilane.
 
-## Latest release: 0.4.1
+## Latest release: 0.4.3
 
-- Fixed reboot recovery for an already completed attachment-backed ChatGPT Pro response. CueLine now accepts an exact run/round/request envelope even when fresh page hydration mounts fewer historical assistant nodes than the durable baseline, while keeping exact URL, dual Pro evidence, user-count, hydration, and idle checks fail-closed. The real round 35 response was recovered with zero resend and no duplicate job; 559/559 tests passed.
+- Rejects malformed injected browser adapters before any durable continuation
+  write and safely recovers the exact legacy pre-submission missing-method
+  failure only after fresh idle Pro evidence proves the request absent. Process
+  runners also contain child stdio `EPIPE` errors so one early-exiting worker
+  cannot crash the whole CueLine process.
 
-Read the complete [changelog](CHANGELOG.md#041---2026-07-18) or the versioned [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1).
+Read the complete [changelog](CHANGELOG.md#043---2026-07-19) or the versioned [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3).
 
 ## How a run actually goes
 
@@ -69,15 +73,15 @@ You need Node.js 22+, Codex with its built-in Browser, and — for the bundled d
 Install from the npm registry:
 
 ```bash
-npm install -g cueline@0.4.1
+npm install -g cueline@0.4.3
 cueline install
 cueline doctor
 ```
 
-As a fallback, install the packaged tarball from the [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1), which also carries its `.sha256` checksum:
+As a fallback, install the packaged tarball from the [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3), which also carries its `.sha256` checksum:
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.1/cueline-0.4.1.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.3/cueline-0.4.3.tgz
 cueline install
 cueline doctor
 ```
@@ -210,7 +214,7 @@ The CLI does not drive the browser. Run `cueline help` for every positional argu
 
 ```console
 $ cueline doctor
-CueLine 0.4.1
+CueLine 0.4.3
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.zh-CN.md

@@ -22,11 +22,11 @@
 
 CueLine 是独立实现，**没有任何运行时 npm 依赖**，也不是 Omnilane 的包装层。
 
-## 最新版本：0.4.1
+## 最新版本：0.4.3
 
 - 修复重启后无法接收已完成附件型 ChatGPT Pro 回复的问题。即使全新页面水合后挂载的历史 assistant 节点少于持久 baseline，CueLine 也能用精确的 run／round／request envelope 接受回复；exact URL、双 Pro 证据、user count、水合与 idle 安全门仍保持 fail-closed。真实 round 35 已零重发、零重复 job 恢复；559/559 测试通过。
 
-完整内容请查看 [changelog](CHANGELOG.md#041---2026-07-18) 或版本化的 [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1)。
+完整内容请查看 [changelog](CHANGELOG.md#043---2026-07-19) 或版本化的 [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3)。
 
 ## 一次运行实际是怎么走的
 
@@ -67,15 +67,15 @@ ChatGPT Pro 订阅套餐与“选定的 Pro 模型”是两回事。账号或个
 从 npm registry 安装：
 
 ```bash
-npm install -g cueline@0.4.1
+npm install -g cueline@0.4.3
 cueline install
 cueline doctor
 ```
 
-作为后备，也可以安装 [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1) 上的打包 tarball，该 release 同时附带它的 `.sha256` 校验值：
+作为后备，也可以安装 [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3) 上的打包 tarball，该 release 同时附带它的 `.sha256` 校验值：
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.1/cueline-0.4.1.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.3/cueline-0.4.3.tgz
 cueline install
 cueline doctor
 ```
@@ -184,7 +184,7 @@ CLI 不驱动浏览器。执行写入状态的命令前，先用 `cueline help`
 
 ```console
 $ cueline doctor
-CueLine 0.4.1
+CueLine 0.4.3
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.zh-TW.md

@@ -22,11 +22,11 @@
 
 CueLine 是獨立實作，**沒有任何 runtime npm 相依套件**，也不是 Omnilane 的包裝層。
 
-## 最新版本：0.4.1
+## 最新版本：0.4.3
 
 - 修復重開機後無法接收已完成附件型 ChatGPT Pro 回覆的問題。即使全新頁面水合後掛載的歷史 assistant 節點少於持久 baseline，CueLine 也能用精確的 run／round／request envelope 接受回覆；exact URL、雙 Pro 證據、user count、水合與 idle 安全閘門仍維持 fail-closed。真實 round 35 已零重送、零重複 job 復原；559/559 測試通過。
 
-完整內容請看 [changelog](CHANGELOG.md#041---2026-07-18) 或版本化的 [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1)。
+完整內容請看 [changelog](CHANGELOG.md#043---2026-07-19) 或版本化的 [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3)。
 
 ## 一次執行實際上怎麼跑
 
@@ -67,15 +67,15 @@ ChatGPT Pro 訂閱方案與「選定的 Pro 模型」是兩回事。帳號或個
 從 npm registry 安裝：
 
 ```bash
-npm install -g cueline@0.4.1
+npm install -g cueline@0.4.3
 cueline install
 cueline doctor
 ```
 
-作為備援，也可以安裝 [v0.4.1 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.1) 上的打包 tarball，該 release 同時附上它的 `.sha256` 校驗碼：
+作為備援，也可以安裝 [v0.4.3 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.3) 上的打包 tarball，該 release 同時附上它的 `.sha256` 校驗碼：
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.1/cueline-0.4.1.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.3/cueline-0.4.3.tgz
 cueline install
 cueline doctor
 ```
@@ -193,7 +193,7 @@ CLI 不驅動瀏覽器。執行寫入狀態的命令前，先用 `cueline help`
 
 ```console
 $ cueline doctor
-CueLine 0.4.1
+CueLine 0.4.3
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/config/routing.multimodel.example.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "./routing.schema.json",
+  "version": 1,
+  "lanes": {
+    "default": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "codex-default",
+          "argv": [
+            "codex",
+            "exec",
+            "--ignore-user-config",
+            "--skip-git-repo-check",
+            "--ephemeral",
+            "--color",
+            "never",
+            "-C",
+            "{workdir}",
+            "-s",
+            "{sandbox}",
+            "-"
+          ],
+          "task_input": "stdin"
+        }
+      ]
+    },
+    "live-search": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "grok-advise-search",
+          "argv": [
+            "grok",
+            "--no-memory",
+            "--no-subagents",
+            "--no-plan",
+            "--no-alt-screen",
+            "--output-format",
+            "plain",
+            "--verbatim",
+            "--permission-mode",
+            "plan",
+            "-p",
+            "{task}"
+          ],
+          "task_input": "argv"
+        }
+      ]
+    },
+    "taste-final": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "claude-opus-4-8-advise",
+          "argv": [
+            "claude",
+            "--disable-slash-commands",
+            "--model",
+            "claude-opus-4-8",
+            "--output-format",
+            "text",
+            "--effort",
+            "high",
+            "--tools",
+            "Read",
+            "Glob",
+            "Grep",
+            "-p",
+            "{task}"
+          ],
+          "task_input": "argv"
+        }
+      ]
+    }
+  }
+}

package/dist/src/api-controller-handoff.js

@@ -8,7 +8,74 @@ import { JobStatusStore } from "./jobs/status.js";
 import { defaultCueLineHome } from "./state/paths.js";
 import { readRuntimeLease, retireDeadRuntimeLease, RuntimeLease, } from "./state/runtime-lease.js";
 import { readAuthoritativeRunEvents } from "./state/store.js";
+import { readCancellationObservation } from "./state/cancellation.js";
 import { isDefinitelyNotSentObservation, isSubmittedTurnRecoveryCandidate, } from "./core/submitted-turn-recovery.js";
+function eventPayload(event) {
+    return typeof event.payload === "object" &&
+        event.payload !== null &&
+        !Array.isArray(event.payload)
+        ? event.payload
+        : {};
+}
+function isLegacyPreSubmissionAdapterFailure(events, turn) {
+    if (turn.submissionState !== "possibly_sent" ||
+        turn.selectedModelLabel !== null ||
+        turn.baselineUserMessageCount !== null ||
+        turn.baselineAssistantMessageCount !== null ||
+        turn.baselineLastUserMessageHash !== null ||
+        turn.composerPromptState !== null ||
+        turn.submissionCheckpointContract !== null) {
+        return false;
+    }
+    const requestedIndexes = events.flatMap((event, index) => {
+        const payload = eventPayload(event);
+        return event.type === "controller_turn_requested" &&
+            payload.request_id === turn.requestId &&
+            payload.round === turn.round
+            ? [index]
+            : [];
+    });
+    if (requestedIndexes.length !== 1)
+        return false;
+    const requestedIndex = requestedIndexes[0];
+    const immediateFailure = events[requestedIndex + 1];
+    if (immediateFailure?.type !== "run_failed")
+        return false;
+    const failure = eventPayload(immediateFailure);
+    if (failure.code !== "CUELINE_INTERNAL" ||
+        failure.message !== "browser.sendTurn is not a function" ||
+        failure.request_id !== turn.requestId ||
+        failure.stage !== "controller_turn" ||
+        failure.submission_state !== "requested") {
+        return false;
+    }
+    return !events.slice(requestedIndex + 1).some((event) => {
+        const payload = eventPayload(event);
+        if ((event.type === "controller_turn_submission_started" ||
+            event.type === "controller_turn_submitted" ||
+            event.type === "controller_response_received") &&
+            payload.request_id === turn.requestId) {
+            return true;
+        }
+        if (event.type !== "controller_command_accepted")
+            return false;
+        const command = typeof payload.command === "object" &&
+            payload.command !== null &&
+            !Array.isArray(payload.command)
+            ? payload.command
+            : {};
+        return (command.request_id === turn.requestId ||
+            (typeof command.round === "number" && command.round >= turn.round));
+    });
+}
+function isLegacyDefinitelyNotSentObservation(evidence, conversationUrl) {
+    return (sameChatGptConversationUrl(evidence.conversationUrl, conversationUrl) &&
+        /^Pro(?:\s|$)/i.test(evidence.selectedModelLabel ?? "") &&
+        evidence.hydrated === true &&
+        evidence.requestMessageFound === false &&
+        evidence.isAnswering === false &&
+        evidence.observedUserMessageCount !== null);
+}
 export async function confirmManualControllerSubmission(runId, options) {
     const environment = options.environment ?? runtimeEnvironment();
     const home = options.home ?? defaultCueLineHome(environment);
@@ -149,6 +216,11 @@ export async function confirmControllerTurnNotSent(runId, options) {
         if ((state.pendingControllerTurns ?? []).length !== 1) {
             throw new CueLineError("OTHER_CONTROLLER_TURNS_PENDING", "Operator-confirmed not-sent recovery requires exactly one pending controller turn.");
         }
+        const cancellation = await readCancellationObservation(home, runId);
+        if (cancellation.runRequested || cancellation.jobRequests.length > 0) {
+            throw new CueLineError("CONTROLLER_NOT_SENT_STATE_INVALID", "Not-sent recovery is forbidden while run or job cancellation is pending.");
+        }
+        const events = await readAuthoritativeRunEvents(home, runId);
         const exactAmbiguousFailure = turn.submissionState !== "possibly_sent" ||
             state.lastFailure?.code !== "CONTROLLER_SUBMISSION_AMBIGUOUS" ||
             state.lastFailure.requestId !== turn.requestId
@@ -160,7 +232,12 @@ export async function confirmControllerTurnNotSent(runId, options) {
         const evidenceGatedSubmittedTurn = options.browser !== undefined &&
             candidateConversationUrl !== undefined &&
             isSubmittedTurnRecoveryCandidate(turn, candidateConversationUrl);
-        if (!exactAmbiguousFailure && !evidenceGatedSubmittedTurn) {
+        const legacyPreSubmissionFailure = options.browser !== undefined &&
+            candidateConversationUrl !== undefined &&
+            isLegacyPreSubmissionAdapterFailure(events, turn);
+        if (!exactAmbiguousFailure &&
+            !evidenceGatedSubmittedTurn &&
+            !legacyPreSubmissionFailure) {
             throw new CueLineError("CONTROLLER_NOT_SENT_STATE_INVALID", "Not-sent recovery requires either the exact ambiguous submission failure or a fresh evidence-gated submitted turn.");
         }
         if (turn.retryOfRequestId !== undefined && turn.retryOfRequestId !== null) {
@@ -181,19 +258,15 @@ export async function confirmControllerTurnNotSent(runId, options) {
         if (!isExactChatGptConversationUrl(conversationUrl)) {
             throw new CueLineError("CONTROLLER_RECONCILIATION_CONVERSATION_MISMATCH", "Operator-confirmed not-sent recovery requires an exact ChatGPT conversation URL.");
         }
-        if (turn.selectedModelLabel === null || !/^Pro(?:\s|$)/i.test(turn.selectedModelLabel)) {
+        if (!legacyPreSubmissionFailure &&
+            (turn.selectedModelLabel === null || !/^Pro(?:\s|$)/i.test(turn.selectedModelLabel))) {
             throw new CueLineError("CONTROLLER_RECONCILIATION_MODEL_UNVERIFIED", "The pending turn lacks exact Pro composer model evidence.");
         }
         if (!/^[0-9a-f]{64}$/.test(turn.promptHash)) {
             throw new CueLineError("CONTROLLER_RECONCILIATION_PROMPT_HASH_INVALID", "The pending turn lacks a valid prompt hash.");
         }
-        const events = await readAuthoritativeRunEvents(home, runId);
         for (const event of events) {
-            const payload = typeof event.payload === "object" &&
-                event.payload !== null &&
-                !Array.isArray(event.payload)
-                ? event.payload
-                : {};
+            const payload = eventPayload(event);
             if (event.type === "controller_response_received" &&
                 payload.request_id === options.requestId) {
                 throw new CueLineError("CONTROLLER_RECONCILIATION_SUPERSEDED", "A controller response for this request was already received; refusing not-sent recovery.");
@@ -211,7 +284,7 @@ export async function confirmControllerTurnNotSent(runId, options) {
             }
         }
         let submittedEvidence;
-        if (evidenceGatedSubmittedTurn) {
+        if (evidenceGatedSubmittedTurn || legacyPreSubmissionFailure) {
             const browser = options.browser;
             if (browser.observeSubmittedTurn === undefined) {
                 throw new CueLineError("CONTROLLER_NOT_SENT_EVIDENCE_REQUIRED", "The normally submitted turn requires a fresh read-only Browser observation before it can be confirmed not sent.");
@@ -221,16 +294,23 @@ export async function confirmControllerTurnNotSent(runId, options) {
                 round: turn.round,
                 requestId: turn.requestId,
                 prompt: turn.prompt,
-                baselineUserMessageCount: turn.baselineUserMessageCount,
-                ...(turn.baselineAssistantMessageCount === null
-                    ? {}
-                    : { baselineAssistantMessageCount: turn.baselineAssistantMessageCount }),
+                ...(typeof turn.baselineUserMessageCount === "number"
+                    ? { baselineUserMessageCount: turn.baselineUserMessageCount }
+                    : {}),
+                ...(typeof turn.baselineAssistantMessageCount === "number"
+                    ? { baselineAssistantMessageCount: turn.baselineAssistantMessageCount }
+                    : {}),
                 ...(turn.composerPromptState === "attachment_ready"
                     ? { attachmentPromptExpected: true }
                     : {}),
+                ...(legacyPreSubmissionFailure
+                    ? { legacyPreSubmissionRecovery: true }
+                    : {}),
             });
             if (observation.status !== "definitely_not_sent" ||
-                !isDefinitelyNotSentObservation(turn, conversationUrl, observation.evidence)) {
+                !(legacyPreSubmissionFailure
+                    ? isLegacyDefinitelyNotSentObservation(observation.evidence, conversationUrl)
+                    : isDefinitelyNotSentObservation(turn, conversationUrl, observation.evidence))) {
                 throw new CueLineError("CONTROLLER_NOT_SENT_EVIDENCE_INSUFFICIENT", "The fresh conversation observation did not prove baseline-equal, request-absent, Pro-idle not-sent evidence.");
             }
             submittedEvidence = observation.evidence;
@@ -246,14 +326,19 @@ export async function confirmControllerTurnNotSent(runId, options) {
                     : {};
                 return typeof payload.round === "number" && payload.round < turn.round;
             }).length;
+        const selectedModelLabel = submittedEvidence?.selectedModelLabel ?? turn.selectedModelLabel;
+        if (selectedModelLabel === null) {
+            throw new CueLineError("CONTROLLER_RECONCILIATION_MODEL_UNVERIFIED", "Not-sent recovery lacks exact Pro composer model evidence.");
+        }
+        const recoveryBaselineUserMessageCount = submittedEvidence?.baselineUserMessageCount ?? derivedBaselineUserMessageCount;
         if (existingRecovery === null) {
             await store.append("controller_turn_not_sent_confirmed", {
                 round: turn.round,
                 request_id: turn.requestId,
                 prompt_hash: turn.promptHash,
                 conversation_url: conversationUrl,
-                selected_model_label: turn.selectedModelLabel,
-                baseline_user_message_count: derivedBaselineUserMessageCount,
+                selected_model_label: selectedModelLabel,
+                baseline_user_message_count: recoveryBaselineUserMessageCount,
                 ...(submittedEvidence === undefined
                     ? { operator_confirmation: true }
                     : {
@@ -262,8 +347,10 @@ export async function confirmControllerTurnNotSent(runId, options) {
                         is_answering: false,
                         page_hydrated: true,
                         submission_state: "definitely_not_sent",
-                        confirmation_source: "fresh_read_only_observation",
-                        operator_confirmation: true,
+                        confirmation_source: legacyPreSubmissionFailure
+                            ? "legacy_pre_submission_adapter_failure"
+                            : "fresh_read_only_observation",
+                        operator_confirmation: !legacyPreSubmissionFailure,
                     }),
             });
         }
@@ -271,12 +358,14 @@ export async function confirmControllerTurnNotSent(runId, options) {
             await store.append("controller_turn_abandoned", {
                 round: turn.round,
                 request_id: turn.requestId,
-                reason: "operator_confirmed_not_sent",
+                reason: legacyPreSubmissionFailure
+                    ? "legacy_pre_submission_adapter_failure"
+                    : "operator_confirmed_not_sent",
                 round_not_consumed: true,
                 prompt_hash: turn.promptHash,
                 conversation_url: conversationUrl,
-                selected_model_label: turn.selectedModelLabel,
-                baseline_user_message_count: derivedBaselineUserMessageCount,
+                selected_model_label: selectedModelLabel,
+                baseline_user_message_count: recoveryBaselineUserMessageCount,
                 ...(submittedEvidence === undefined
                     ? { operator_confirmation: true }
                     : {
@@ -285,8 +374,10 @@ export async function confirmControllerTurnNotSent(runId, options) {
                         is_answering: false,
                         page_hydrated: true,
                         submission_state: "definitely_not_sent",
-                        confirmation_source: "fresh_read_only_observation",
-                        operator_confirmation: true,
+                        confirmation_source: legacyPreSubmissionFailure
+                            ? "legacy_pre_submission_adapter_failure"
+                            : "fresh_read_only_observation",
+                        operator_confirmation: !legacyPreSubmissionFailure,
                     }),
             });
         }