Stop an unrendered editor from confirming a launch

ConfirmInput's first poll can run before the TUI renders the pasted text. It
then finds an empty editor, falls through to the idle branch, and reports
confirmation=editor_cleared. The launch text sits unsent for the whole lease
while the coordinator believes the agent is working.

Run 5 died on exactly that: first_submit_at 21:13:19.570, confirmed_at
21:13:19.577. Seven milliseconds. The two launches that worked took ~500ms and
a second Enter, so the difference was scheduling luck.

An empty editor is only proof once it has held the text, or once it has stayed
empty past a settle window. Text seen and then gone still confirms at once, and
so do busy, blocked and queued. Waiting only happens in the never-observed
case, which is the one that cannot be told apart from a slow render.

With this, the failing case reaches the existing resubmit path instead: the
text appears, is recognised as unsubmitted, and Enter is resent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011xsXyr5J1RACo71YeKG3Pu

internal/herdr/tmux.go

@@ -461,6 +461,18 @@ func (b *TmuxBackend) PaneProgress(ctx context.Context, s Session) (string, erro
 // first: three exact-editor resubmits, then observation only.
 const launchResubmitLimit = 3
 
+// launchSettle is how long an empty editor must stay empty before it counts as
+// proof of submission. A TUI takes tens of milliseconds to render pasted text,
+// and the first poll can run inside that gap. F33: a poll 7ms after the submit
+// found nothing in the editor, reported confirmation=editor_cleared, and the
+// launch text then sat unsent in the input box for the rest of the lease. The
+// two launches that actually worked took ~500ms and a second Enter, so the
+// difference between success and this false positive was scheduling luck.
+//
+// Only the never-observed case waits. Text seen and then gone is real
+// evidence, and busy, blocked or queued still confirm immediately.
+const launchSettle = time.Second
+
 // ConfirmInput drives the submit to a decision instead of assuming one Enter
 // landed. Burn-in run 3 proved the submit is not deterministic: the text
 // reached the editor on all three attempts and the following Enter never took
@@ -487,12 +499,18 @@ func (b *TmuxBackend) ConfirmInput(ctx context.Context, s Session, submitted str
 			kind, attempts, first.UTC().Format(time.RFC3339Nano), b.now().UTC().Format(time.RFC3339Nano))
 	}
 	var last InputState
+	// Whether the editor was ever observed holding what we submitted. Without
+	// it, "empty" is indistinguishable from "not rendered yet".
+	seen := false
 	for {
 		state, err := b.inputState(ctx, s)
 		if err != nil {
 			return "", err
 		}
 		last = state
+		if state.Active && sameInput(state.Text, submitted) {
+			seen = true
+		}
 		switch {
 		case state.Active && sameInput(state.Text, submitted):
 			// Exactly what was submitted still owns the cursor, so the submit
@@ -529,6 +547,12 @@ func (b *TmuxBackend) ConfirmInput(ctx context.Context, s Session, submitted str
 				// session now needs an operator.
 				return evidence("blocked"), nil
 			default:
+				// An editor that never held the text may simply not have
+				// rendered it yet. Give it the settle window before calling an
+				// empty box proof that the harness took the prompt.
+				if !seen && b.now().Sub(first) < launchSettle {
+					break
+				}
 				return evidence("editor_cleared"), nil
 			}
 		}