fix(sandbox): retry the SRT launch past a transient bridge-socket failure

[tend-agent]

SRT's initializeLinuxNetworkBridge waits for socat to bind the bridge sockets across five probes on an i * 100 ms backoff — sleeps of 0, 100, 200 and 300 ms, so 600 ms in total — and Tend's network config is the branch that spends it fastest. sandbox_runtime.mjs sets httpProxyPort from TEND_PROXY_PORT and leaves socksProxyPort unset, which makes SRT's needLocalProxy true and resolve SOCKS to its own mux port. The two ports then differ, a second socat is spawned, and both sockets have to appear inside that one budget. When a loaded runner misses it, SandboxManager.initialize throws, nothing retries, and the run is spent before the agent exists: zero turns, no comment posted, no session log.

initializeSandbox now retries the launch up to three times, with a growing backoff and an awaited reset() between attempts. Retrying is safe at exactly this point and nowhere later — SRT clears its own state on an initialization error so the call can be re-entered, each attempt names fresh random socket paths so there is no stale-socket collision, and nothing has run inside the sandbox yet, so there is no partial work to reconcile. A sandbox that genuinely cannot come up still fails on SRT's own message and the same exit code, so failure reporting and outage tracking are unchanged; the cost of the retry is at most three seconds.

The reproduction drives the real sandbox_runtime.mjs under a stand-in SandboxManager injected through TEND_SRT_ENTRY, the same variable the action sets, so it exercises the launch path rather than a copy of it. Before the change, one induced initialize failure ends the process at exit 1 with the reported message and the lifecycle never spawned; after it, the lifecycle runs and the process exits 0. Two more tests hold the edges: the retries stay bounded and surface SRT's original diagnosis on exhaustion, and a reset() that itself rejects — which SRT's own error path tolerates by never observing it — is logged rather than allowed to replace the launch error.

On the rule against retries. CLAUDE.md says not to add retries "for rare event shapes or small runner-time savings", and to keep the actions as linear plumbing. What this failure costs is not runner time but the run's entire outward action — the review that never gets posted — and the remedy is three lines of loop in already-tested code rather than a new gate or a second implementation layer. Widening the budget upstream in SRT would be the better fix; it is not one a pin bump reaches, since the loop is byte-identical at v0.0.77 and on main.

Source the analysis was checked against

Read from anthropics/sandbox-runtime at c392e6cf9f8df957c66d9ab1461e2cfa99b1ab5d, the commit tag v0.0.76 resolves to, which is the sandbox_runtime_version both harness actions pin:

• src/sandbox/linux-sandbox-utils.ts — the maxAttempts = 5 / i * 100 loop, its per-call randomBytes(8) socket paths, and the separate Linux bridge process died unexpectedly branch this failure is not.
• src/sandbox/sandbox-manager.ts — needLocalProxy, which puts a consumer that sets only httpProxyPort on the two-socat path.
• sandbox-manager.ts again, at the initialization catch: it clears initializationPromise and managerContext "so initialization can be retried", and calls reset() without awaiting the promise or observing its rejection.

Closes #1326 — automated triage

[tend-agent]

The retry itself checks out against SRT 0.0.76 as installed: initialize's network catch clears initializationPromise and managerContext before throwing, so re-entry is the supported path; the bridge-timeout branch SIGTERMs both socat processes itself, so a retried attempt inherits no orphans; and each attempt derives fresh randomBytes(8) socket paths, so there is no stale-socket collision. The 600 ms figure and the two-socat branch are both as the PR body describes.

One finding, on the tests rather than the change. The three new cases run sandbox_runtime.mjs as a real subprocess, and main()'s first statement is if (process.platform !== "linux") throw new Error("Tend SRT requires Linux") — so off Linux every one of them fails before reaching the retry loop they exist to cover: assert completed.returncode == 0 fails, and counts["initialize"] == LAUNCH_ATTEMPTS raises KeyError against the empty state file. The stand-in lifecycle's /usr/bin/bash is the second non-portable dependency. Nothing else in the suite executes a Linux-only path — test_prepare_agent_workspace.py shells out to git, test_sandbox.py to sys.executable, and generator/tests/__init__.py resolves bash through shutil.which specifically so the suite survives macOS's 3.2 — so this is the first uv run pytest failure a developer off Linux would hit, on a file where the other seven tests still pass.

I'm pushing a skipif for the three cases rather than leaving it as a suggestion, since this is the bot's own PR.