@@ -61,7 +61,7 @@ import { SyncProvider, useSync } from "./context/sync"
 import { DataProvider } from "./context/data"
 // altimate_change — fixes #1301 (Codex review, P2): `ALTIMATE_BASE_MIGRATION_DECLINED_KEY` moved
 // to local.tsx so `local.model.hasUsableFreeDefault()` can read the same kv key.
-import { LocalProvider, useLocal, ALTIMATE_BASE_MIGRATION_DECLINED_KEY, shouldSkipOnboardingAtStartup } from "./context/local"
+import { LocalProvider, useLocal, ALTIMATE_BASE_MIGRATION_DECLINED_KEY, shouldSkipOnboardingAtStartup, shouldFireFirstRunFunnelAtStartup } from "./context/local"
 import { DialogModel } from "./component/dialog-model"
 import { useConnected } from "./component/use-connected"
 import { DialogMcp } from "./component/dialog-mcp"
@@ -790,7 +790,7 @@ function App(props: { onSnapshot?: () => Promise<string[]>; pluginHost: TuiPlugi
       // altimate-onboarding.tsx) is required alongside it, same as the branch above: true only
       // when the first-run picker itself actually opened THIS launch (this effect's own
       // fallthrough below, or the prompt gate's equivalent).
-      if (setupComplete() && firstRunOpenedThisLaunch()) {
+      if (shouldFireFirstRunFunnelAtStartup(setupComplete(), firstRunOpenedThisLaunch())) {
         // Deliberately NOT markFirstRunActive() again here: it was already latched at the point
         // the picker opened (this branch only reaches telemetry when `firstRunOpenedThisLaunch()`
         // is already true), and `markSetupComplete()` has already run on this branch and will not
@@ -822,7 +822,6 @@ function App(props: { onSnapshot?: () => Promise<string[]>; pluginHost: TuiPlugi
     startupDecisionHandled = true
     // altimate_change end
   })
-  // altimate_change end
 
   // altimate_change start — Part 2 scan gate: fire EXACTLY once, when the user has actually
   // finished picking a model during a first run.
 
@@ -199,6 +199,15 @@ export function shouldSkipOnboardingAtStartup(
 ): boolean {
   return (hasExistingLegacySelection || hasUsableFreeDefault) && !setupCompleteThisLaunch
 }
+
+// The onboardingReady() branch's own discriminator (app.tsx), extracted like its sibling above so
+// the test exercises the SAME predicate app.tsx calls rather than re-deriving the expression
+// (review of #1302, round 10). `setupComplete` alone is a GLOBAL flag set by any model pick; a
+// returning user's routine `/model` switch racing the startup effect must not read as a first-run
+// completion — only a first-run picker that actually opened THIS launch qualifies.
+export function shouldFireFirstRunFunnelAtStartup(setupComplete: boolean, firstRunOpenedThisLaunch: boolean): boolean {
+  return setupComplete && firstRunOpenedThisLaunch
+}
 // altimate_change end
 
 // altimate_change start — fixes #1301 (Codex review round 2, P1): an older picker-written Zen
 
@@ -10,9 +10,12 @@ import { createEffect, createSignal, on, onCleanup, type Accessor } from "solid-
 // reimplementation of this exact shape, which meant reverting the real fix in prompt/index.tsx
 // left the test passing regardless, since it never touched production code at all.
 //
-// `options.getRevision`, if given, is called ONCE at `.defer()` time (capturing whatever it
-// returns) and again right before `retry()` would fire — if the two differ (by JSON equality),
-// `retry()` is skipped entirely rather than fired against stale state. This is what
+// `options.getRevision`, if given, is called ONCE at `.defer()` time and again right before
+// `retry()` would fire — if the two differ (by JSON equality), `retry()` is skipped entirely
+// rather than fired against stale state. The defer-time value is captured SERIALIZED, never as a
+// reference: Solid's `unwrap` hands back the store's raw underlying object, the very one later
+// edits mutate in place, so holding it and stringifying both sides at retry time compared the
+// object to itself and could never see an edit (cursor 3987286236 / cubic 3987320771). This is what
 // component/prompt/index.tsx's submit gate uses to snapshot the prompt (text + attachments) at
 // the moment a submission defers: without it, a user who deferred prompt A, then edited the box
 // to B WITHOUT pressing Enter again, would have B silently auto-submitted the instant readiness
@@ -23,17 +26,18 @@ export function createDeferredRetry<T = void>(
   options?: { getRevision?: () => T },
 ) {
   let deferred = false
-  let capturedRevision: T | undefined
+  let capturedRevision: string | undefined
+  const snapshot = () => (options?.getRevision ? JSON.stringify(options.getRevision()) : undefined)
   createEffect(() => {
     if (pending() || !deferred) return
     deferred = false
-    if (options?.getRevision && JSON.stringify(options.getRevision()) !== JSON.stringify(capturedRevision)) return
+    if (options?.getRevision && snapshot() !== capturedRevision) return
     retry()
   })
   return {
     defer() {
       deferred = true
-      capturedRevision = options?.getRevision?.()
+      capturedRevision = snapshot()
     },
   }
 }
 
@@ -26,6 +26,7 @@ import {
   // altimate_change end
   // altimate_change start — Kilo review round 6: app.tsx startup onboarding-skip discriminator
   shouldSkipOnboardingAtStartup,
+  shouldFireFirstRunFunnelAtStartup,
   // altimate_change end
   // altimate_change start — fixes #1301 (Codex review round 2, P1): migration correctness
   isOwnPastPickOfFreeDefault,
@@ -467,9 +468,9 @@ test("onboardingReady() branch: a returning user's /model switch to a paid model
     expect(setupComplete()).toBe(true)
     expect(firstRunOpenedThisLaunch()).toBe(false)
 
-    // Mirrors app.tsx's actual condition at the onboardingReady() branch exactly — must be false,
-    // or onboarding telemetry and the scan gate fire for a routine provider switch.
-    expect(setupComplete() && firstRunOpenedThisLaunch()).toBe(false)
+    // The SAME predicate app.tsx's onboardingReady() branch calls — must be false, or onboarding
+    // telemetry and the scan gate fire for a routine provider switch.
+    expect(shouldFireFirstRunFunnelAtStartup(setupComplete(), firstRunOpenedThisLaunch())).toBe(false)
   } finally {
     resetSetupComplete()
   }
@@ -487,7 +488,7 @@ test("onboardingReady() branch: a genuine first-run completion (the picker opene
     expect(setupComplete()).toBe(true)
     expect(firstRunOpenedThisLaunch()).toBe(true)
 
-    expect(setupComplete() && firstRunOpenedThisLaunch()).toBe(true)
+    expect(shouldFireFirstRunFunnelAtStartup(setupComplete(), firstRunOpenedThisLaunch())).toBe(true)
   } finally {
     resetSetupComplete()
   }
 
@@ -60,6 +60,9 @@ function DeferThenRetryHarness(props: {
   pending: () => boolean
   promptText: () => string
   setPromptText: (value: string) => void
+  /** The SAME object on every call, mutated in place by `setPromptText` — exactly what
+   *  `unwrap(store.prompt)` hands component/prompt/index.tsx (cursor 3987286236). */
+  livePrompt: () => { input: string }
   onSend: (value: string) => void
   onDiscard: () => void
   exposeSubmit: (fn: () => boolean) => void
@@ -79,12 +82,14 @@ function DeferThenRetryHarness(props: {
     props.setPromptText("")
     return true
   }
-  // altimate_change — Codex re-review round 9: `getRevision` mirrors component/prompt/index.tsx's
-  // real usage (a snapshot of the prompt at defer time, compared against the live prompt right
-  // before retrying) — here the "prompt" is just `promptText()` itself, so the revision IS the
-  // text.
+  // altimate_change — Codex re-review round 9 / cursor 3987286236: `getRevision` mirrors
+  // component/prompt/index.tsx's real usage exactly — it returns the store's LIVE raw object (the
+  // same reference every call, mutated in place by edits), not a fresh string. A primitive that
+  // merely held that reference and stringified both sides at retry time compared the object to
+  // itself and never saw an edit; this harness shape is what makes the edited-while-deferred test
+  // below fail on that bug.
   const deferredSubmit = createDeferredRetry(props.pending, () => void attemptSubmit(), {
-    getRevision: () => props.promptText(),
+    getRevision: () => props.livePrompt(),
   })
   props.exposeSubmit(attemptSubmit)
   return null
@@ -93,7 +98,13 @@ function DeferThenRetryHarness(props: {
 async function mountHarness(options: { initialPending: boolean; willBeReady: boolean; promptText?: string }) {
   const [pending, setPending] = createSignal(options.initialPending)
   const ready = () => !pending() && options.willBeReady
-  const [promptText, setPromptText] = createSignal(options.promptText ?? "hello from before kv.ready")
+  const [promptText, setPromptTextSignal] = createSignal(options.promptText ?? "hello from before kv.ready")
+  // One object, mutated in place — see `livePrompt` on the harness props.
+  const livePrompt = { input: promptText() }
+  const setPromptText = (value: string) => {
+    livePrompt.input = value
+    setPromptTextSignal(value)
+  }
   const submitSpy: string[] = []
   let discarded = false
   let submit: (() => boolean) | undefined
@@ -104,6 +115,7 @@ async function mountHarness(options: { initialPending: boolean; willBeReady: boo
       pending={pending}
       promptText={promptText}
       setPromptText={setPromptText}
+      livePrompt={() => livePrompt}
       onSend={(value) => submitSpy.push(value)}
       onDiscard={() => {
         discarded = true
@@ -205,12 +217,17 @@ test.serial(
   "defer-then-retry: a submission that is deferred and then re-deferred unchanged still sends once pending clears",
   async () => {
     // Guards against an overzealous fix: identical text at defer-time and retry-time (nothing
-    // edited) must still send normally.
+    // edited) must still send normally — and pressing Enter TWICE while pending (Kilo 3987319604:
+    // two `.defer()` calls, the revision re-captured each time) must still yield exactly one send.
     const h = await mountHarness({ initialPending: true, willBeReady: true, promptText: "unchanged" })
     try {
       expect(h.attemptSubmit()).toBe(false)
+      expect(h.attemptSubmit()).toBe(false)
+      expect(h.submitSpy).toEqual([])
       h.setPending(false)
       await waitUntil(() => h.submitSpy.length > 0)
+      // Bounded settle so a second (duplicate) retry would have had time to show up.
+      await Bun.sleep(50)
       expect(h.submitSpy).toEqual(["unchanged"])
       expect(h.promptText()).toBe("")
     } finally {