Files
orca/src
Brennan Benson 4d70b189de Harden the Codex app-server session against partial acquisition
Six findings from the review of the structured Codex session, all of them
about a session that is live in the map while the thing it names is not:

- A prompt is addressed by its own approval id, not by the tool item it is
  about. A shell bridge re-asks per command under one parent item, and the
  second ask used to evict the first, leaving that turn blocked on a request
  nobody could answer.
- A subagent runs its own thread over the same connection. Its `turn/started`
  no longer satisfies the root thread's waiter, and every event now carries the
  thread it actually came from.
- Publication is one step at the end of acquire: the process identity is in
  hand, the child is still alive, and the attempt still owns the session. A
  failure reaps only its own child, so a replacement already published keeps
  running.
- Codex talks before its thread is named. Those events wait in the acquisition
  window and are delivered in arrival order once the session is published,
  instead of being dropped.
- A broken stdin pipe ends the transport rather than one write: the child is
  reaped and the owner learns its lease is worthless.
- A death that reaches us through several listeners reports once, keeping the
  first cause rather than the generic exit that follows it.
2026-08-09 16:48:51 -07:00
..