[markus41]

Problem

When the shared Codex app-server exits, pending requests can fail while the session event stream stays open. The session manager can retain the dead runtime, leaving turns stuck and later requests reusing it.

Change

Propagate child termination through the client and adapter event stream so the existing session manager can release the runtime and replace it on the next turn. Bound output draining and record child lifecycle diagnostics with lifecycle-specific trace redaction, preserving caller failures, cancellation, and unrelated error visibility.

Scope and approval

This is a fork-local review boundary, not a new submission to pingdotgg/t3code. Upstream recovery PRs #21759 and #18764 overlap; no upstream maintainer approval or distinct contribution eligibility is claimed.

Frozen head: 44ccaab8eae39ad8e006bf0971772ff79ae22b4b. Review baseline: 401b01747c1f7b331fb00b573e405a38f646fde8 (chore(release): prepare v0.1.3), the source checkout's exact baseline. A dedicated baseline branch keeps this review to the 13 candidate paths and excludes the upstream history missing from fork main. No source edits, dependency declaration changes, or lockfile changes were made during delivery.

Verification

Windows, pinned Node 26.12.1, repository Vite+ 1.4.0 and pnpm 12.14.0.

• Current vp run check:changed passed: format, lint, both knip lanes, server GraphQL generation check, all 32 affected package typechecks, and 182 tests across 7 test files. The gate selected 14 test paths. No hosted CI result is implied.
• Earlier partial-install checks failed on missing Astro/Expo and separate knip findings. Frozen-lock setup completed without tracked changes; both knip lanes subsequently passed with no suppressions or rule changes. A first complete-setup run hit OXC's 6 GiB raw-transfer buffer allocation failure. The successful gate used Knip's supported process-local KNIP_DISABLE_RAW_TRANSFER=1 normal-parser path and the existing Windows vp spawn adapter; check selection, rules, and exit status were preserved. The successful run was not cached because generated inputs changed during the run; tracked source remained clean.
• Independent exact-head source checkpoint: PASS_BOUNDED; the six recorded source hashes match this head. Lifecycle privacy regression passed (1 selected, 19 skipped). SonarJS S3776 4.2.2 measured the changed observability functions at 11 / 6 / 1, threshold 15, without suppression; existing whole-file legacy findings are separate.
• Privacy guard mutation failed the expected sentinel regression with exit 1; restoring the guard restored SHA256 9a9468b8b66bdc53bd55a33af94fffc34f4ae171a79d16a2f465e0ff6bd99f12. Synthetic spawn failure and an owned real child exiting 7 preserved typed caller failure, cancellation, and unrelated errors. Local trace and OTLP JSON serialization checks used in-memory sinks/HTTP, not hosted telemetry.
• Independent sustained source-manager exercise: PASS_BOUNDED, clean exact head at start and end, 2026-10-27T15:31:22.281Z–16:01:25.866Z (1,803,585 ms), six distinct completed native turns and three manager-owned replacements (idle / active / idle). It used the actual source ProviderSessionManager and CodexAdapter, an injected real client factory, and in-memory stores. Runtime receipt SHA256: a10307b144dd167260042c677849826fd56fa42c0bd8bba6b2698311d182e6df. The earlier interrupted duration window is excluded.

Current gate transcript:

pass  format
pass  lint
pass  knip 1/2
pass  knip 2/2
pass  graphql (apps/server)
pass  typecheck (32 packages)
pass  test (14 selected paths; 7 files, 182 tests passed)
exit 0

Still UNKNOWN: installed desktop acceptance, default-factory integration acceptance, hosted CI, actual PostHog delivery, and the original spontaneous Windows exit cause. This PR does not authorize merge, release, installation into the running app, or deployment.

Model and harness: OpenAI Codex for the frozen implementation in T3 Code (exact source model not independently verified); GPT-6 in Codex desktop for local setup, evidence inspection, and PR delivery.