Acknowledge a launch only when the harness accepted it

Burn-in run 2 recorded TaskLaunchAcknowledged, opened a pane, and ran nothing
for fifteen minutes. The launch instruction sat in Claude Code's input editor
as "[Pasted text #1 +66 lines]" at zero tokens and zero elapsed. Two separate
bugs produced that.

The transport was wrong for the harness. TmuxBackend.Prompt writes the whole
instruction with send-keys -l and then sends Enter, and the TUI coalesces the
fast multi-line write into a paste that absorbs the following Enter. Launch
transport is now a backend property rather than one universal prompt format:
claude on tmux submits a single line pointing at .orchestra/launch.md, every
other harness keeps the inline path it was verified on. agentctx is unchanged
and the file still holds the exact bytes Orchestra rendered, so what the agent
receives is identical either way. Under the file transport a failed write is
now a failed launch, because there the file is the instruction.

The acknowledgement was also wrong. It meant "Prompt returned nil", not "the
harness accepted the prompt". Backends may now implement ConfirmLaunch, and
the tmux one polls until the input editor clears and the agent is observably
busy, blocked on approval, or at least no longer holding the text. An editor
that still holds the prompt at the deadline is a definite failure. The worker
kills the pane, drops the session so the retry starts clean, and returns
ErrPromptNotSubmitted, which classifies as prompt_not_submitted rather than
launch_uncertain. That class already falls through to TaskReleased, so the
existing retry path takes it and no lease is held on a launch that never
happened.

The confirmation bound is tunable because how fast a terminal harness reacts
is a property of the host. It is not a sleep before the submit: the submit is
deterministic, and this waits for the harness to visibly react to it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/herdr/tmux.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"time"
 )
@@ -25,6 +26,20 @@ type TmuxBackend struct {
 	Command string
 	// Binary is test/packaging override for tmux itself.
 	Binary string
+	// LaunchConfirmTimeout and LaunchConfirmPoll bound ConfirmLaunch. They are
+	// tunable because how fast a terminal harness visibly reacts is a property
+	// of the host, not of this code. Zero values mean 10s and 250ms.
+	LaunchConfirmTimeout time.Duration
+	LaunchConfirmPoll    time.Duration
+	// Now is a test seam for the confirmation deadline.
+	Now func() time.Time
+}
+
+func (b *TmuxBackend) now() time.Time {
+	if b.Now != nil {
+		return b.Now()
+	}
+	return time.Now()
 }
 
 func NewTmuxBackend(socket, command string) *TmuxBackend {
@@ -334,3 +349,79 @@ func (b *TmuxBackend) ReleaseAgent(ctx context.Context, s Session, _ string) err
 }
 
 var _ Backend = (*TmuxBackend)(nil)
+
+// LaunchTransport keeps the file-reference launch scoped to the harness whose
+// paste handling requires it, rather than making it the universal prompt
+// format. Every other harness keeps the inline path it was verified on.
+func (b *TmuxBackend) LaunchTransport(harness string) LaunchTransport {
+	if harness == "claude" {
+		return LaunchFileRef
+	}
+	return LaunchInline
+}
+
+// promptLine matches the harness input editor's own line. Its remainder is
+// what is still sitting unsubmitted, whether that is literal text or the
+// TUI's own "[Pasted text #1 +66 lines]" placeholder.
+var promptLine = regexp.MustCompile(`(?m)^[ \t]*[>❯][ \t]*(.*)$`)
+
+// pendingInput returns whatever the input editor still holds.
+func pendingInput(pane string) string {
+	m := promptLine.FindAllStringSubmatch(pane, -1)
+	if len(m) == 0 {
+		return ""
+	}
+	return strings.TrimSpace(m[len(m)-1][1])
+}
+
+// ConfirmLaunch waits for observable proof that the harness accepted the
+// prompt. An input editor that still holds the submitted text is definite
+// failure, which is the whole point: TaskLaunchAcknowledged previously meant
+// "Prompt returned nil" and so reported a launch that never happened.
+//
+// This is not a timing workaround for the submit itself. The submit is
+// deterministic; this waits for the harness to visibly react to it.
+func (b *TmuxBackend) ConfirmLaunch(ctx context.Context, s Session, submitted string) (string, error) {
+	timeout, poll := b.LaunchConfirmTimeout, b.LaunchConfirmPoll
+	if timeout <= 0 {
+		timeout = 10 * time.Second
+	}
+	if poll <= 0 {
+		poll = 250 * time.Millisecond
+	}
+	deadline := b.now().Add(timeout)
+	var last string
+	for {
+		pane, err := b.PaneCapture(ctx, s, "recent")
+		if err != nil {
+			return "", err
+		}
+		if last = pendingInput(pane); last == "" {
+			status, statusErr := b.AgentStatus(ctx, s)
+			if statusErr != nil {
+				return "", statusErr
+			}
+			switch status {
+			case "exited":
+				return "", fmt.Errorf("%w: pane %s exited before the harness reacted", ErrPromptNotSubmitted, s.PaneID)
+			case "busy":
+				return "input editor cleared, agent busy", nil
+			case "blocked":
+				// A permission dialog is the harness acting on the
+				// instruction, so submission is proven even though the
+				// session now needs an operator.
+				return "input editor cleared, agent awaiting approval", nil
+			default:
+				return "input editor cleared", nil
+			}
+		}
+		if !b.now().Before(deadline) {
+			return "", fmt.Errorf("%w: pane %s still holds %q after %s", ErrPromptNotSubmitted, s.PaneID, last, timeout)
+		}
+		select {
+		case <-ctx.Done():
+			return "", ctx.Err()
+		case <-time.After(poll):
+		}
+	}
+}