Codex App Server: strict resume failure leaves a stale ready-for-review state

[karolzlot]

Summary

When strict Codex App Server resume fails before a turn starts, Happier emits a status message but does not materialize a failed turn or runtime issue, so session lists can continue showing a stale ready-for-review state.

What happened (current behavior)

After the app-server process exited during strict resume, the session became inactive with the failure recorded only in the transcript while latestTurnStatus and lastRuntimeIssue did not represent the failure and an older ready event still drove the session-list status.

Expected behavior

A failed strict resume should leave the session in a durable failed or action-required state until the user retries or resolves the failure.

Reproduction steps

1. Start from an existing Codex App Server session that has a previous unread ready event and a provider resume identity.
2. Resume that session through a strict resume path.
3. Make the Codex app-server process exit or reject startOrLoad before a new turn starts.
4. Observe the Failed to resume this Codex app-server session status message and the inactive session.
5. Observe that no failed turn or runtime issue is projected and the session list can still show Ready for review from the older ready event.

Severity

medium

Frequency

always

Happier version

0.2.11-dev.1

Platform

Linux x64 (Debian 13 container), Bun single-file runtime

Server version

0.2.11-dev.1

Deployment type

self-hosted

What changed recently?

No response

Diagnostics ID

No response

Additional context

Sanitized incident evidence and public source boundary

The observed session had a prior unread ready projection. A later strict resume attempt failed while opening the Codex app-server runtime. Happier added a detailed failure message to the transcript, but the relay projection had no failed latest turn and no current runtime issue, so the older ready projection remained the strongest status available to the client.

The complete affected CLI, turn-projection, and server persistence corridor in the observed build is identical to public 0.2.11-dev.1 at 8cf3c40. Both strict failure branches add a status message and throw a resume error without using the existing surfacePrimarySessionRuntimeIssue lifecycle. The second strict path has the same behavior at runCodex.ts#L2573-L2592. The helper already supports allocating and failing a session-owned turn when an issue occurs while idle.

The same omission remains in public dev at 17350d3, inspected on 3 September 2026.

Related issue #309 concerns retry policy after a provider turn has terminally failed. Related issue #327 concerns a provisional provider identity that can make a later resume impossible. This report concerns the separate state-materialization boundary for any strict resume failure before a turn starts.

The canonical fix is to surface the strict resume failure through the existing runtime-issue and turn lifecycle, including idle-turn allocation where required, while keeping the transcript status message as diagnostic detail. The client should not need to classify failure prose or override a valid ready projection heuristically.

[happier-bot]

Thanks for tracking this down. The exact strict-resume branches and the pointer to the existing session runtime-issue owner made the missing lifecycle transition clear.

Confirmed cause: strict Codex app-server resume failures wrote the explanatory transcript status and then threw before publishing a terminal session turn. That left latestTurnStatus and lastRuntimeIssue unchanged, so an older unread ready-for-review event could continue winning in the session list.

The 0.2/default-branch correction is now integrated in commit 948ba60. Both explicit strict resume and local-to-remote strict resume use one shared Codex failure path which:

• preserves the detailed transcript status;
• routes the original provider error through the canonical runtime-issue classifier;
• allocates and fails a session turn when the failure occurs before a turn exists;
• leaves aborts and non-strict resume fallback behavior unchanged.

No UI heuristic was added: the session list already prioritizes a structured failed turn over ready-for-review once the producer records it.

Validation included the full Codex resume-preflight integration file (66/66 passing), including explicit resume and local-to-remote failure coverage. The focused runtime lifecycle and UI attention tests also pass. The package-wide typecheck is currently blocked by unrelated existing errors in startupSideEffects.test.ts.

This is source-only on dev for now; it is not yet evidence of a published dev build. Please retry once the correction reaches the dev channel. The evolved 0.3 implementation has also been adapted and tested locally, but its branch is currently diverged from the remote and still needs safe integration.

cc: @leeroybrun

[karolzlot]

Confirmed fixed on dev at af1b427 (resume-failure regression tests pass). Thanks!