A few edge case fixes for tentacles.

internal/app/tentacle_management.go

@@ -573,8 +573,17 @@ func (runtime *tentacleRuntime) run_managed(ctx context.Context) error {
 			}
 			next, err := change_tentacle_entries(entries, call.request)
 			if err == nil && call.request.Action != "retry" && reflect.DeepEqual(next, entries) {
-				call.result <- nil
-				continue
+				// Saved enablement is intent, not proof of a live session. An
+				// explicit enable/update must recover a failed or starting entry.
+				index := slices.IndexFunc(next, func(entry tentacle.Entry) bool { return entry.ID == call.request.ID })
+				state := tentacle.Stopped
+				if session := sessions[call.request.ID]; session != nil {
+					state, _ = session.Status()
+				}
+				if !next[index].Enabled || state == tentacle.Active {
+					call.result <- nil
+					continue
+				}
 			}
 			if err == nil && call.request.Action != "retry" {
 				err = runtime.registry.Save(next)
@@ -633,7 +642,16 @@ func (runtime *tentacleRuntime) run_managed(ctx context.Context) error {
 				failStartup(session.TentacleID(), "Tentacle could not acquire its keyboard shortcuts; enable it again after resolving the conflict.")
 				continue
 			}
-			if err := session.Activate(); err != nil {
+			// Native binding setup can wait for held keys. Cancellation during
+			// that wait must roll back the new grabs before reporting failure.
+			activationError := ctx.Err()
+			if startup, exists := startups[session.TentacleID()]; exists && activationError == nil {
+				activationError = startup.call.ctx.Err()
+			}
+			if activationError == nil {
+				activationError = session.Activate()
+			}
+			if activationError != nil {
 				session.Disable()
 				if err := runtime.bind(ctx, active); err != nil && ctx.Err() == nil {
 					select {