botmux 3.12.1 → 3.13.0

package/dist/core/worker-pool.js

@@ -46,7 +46,7 @@ import { sandboxEnabled } from '../adapters/backend/sandbox.js';
 import { isStrongManagedHerdrAgentName, managedHerdrAgentName, } from '../adapters/backend/session-backend-selector.js';
 import { isRiffBackendSession, isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, persistentSessionName, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
 import { withBotTurnMutation } from './bot-turn-mutation-gate.js';
-import { getBot, getAllBots, resolveBrandLabel, getLoadedConfigPath, resolveUsageDisplay } from '../bot-registry.js';
+import { getBot, getAllBots, resolveBrandLabel, getLoadedConfigPath, getLoadedConfigProvenance, resolveUsageDisplay } from '../bot-registry.js';
 import { RestartCoordinator } from './restart-coordinator.js';
 import { runtimeBuildIdentity } from '../utils/runtime-build-id.js';
 import { scrubWorkflowWorkerEnv } from '../utils/child-env.js';
@@ -999,6 +999,108 @@ export function recallFrozenCards(ds) {
     }
     logger.info(`[${tag(ds)}] Recalled ${targets.length} previous streaming card(s)`);
 }
+/**
+ * Post the current turn's starting card as soon as the daemon accepts the
+ * inbound message. Terminal redraw is deliberately not part of this trigger:
+ * some CLIs consume a turn without emitting another screen_update, which used
+ * to leave streamCardPending stuck and suppress cards for every later turn.
+ *
+ * Only one POST may be in flight per session. If another turn arrives during
+ * the request, the generation check preserves that newer pending state and
+ * immediately follows with its card after the first POST settles.
+ */
+export async function postTurnStartingCard(ds, sessionReply, turnId) {
+    if (!ds.streamCardPending || ds.streamCardPendingTurnId !== turnId)
+        return false;
+    if (riffRetirementAdmissionPhase(ds))
+        return false;
+    if (ds.streamCardId === CARD_POSTING_SENTINEL)
+        return false;
+    if (ds.session.vcMeetingReceiver || streamingCardDisabled(ds, turnId))
+        return false;
+    if (!workerHasInitialized(ds))
+        return false;
+    if (!larkTransportEnabled({ chatId: ds.chatId, apiOnly: getBot(ds.larkAppId).config.apiOnly }))
+        return false;
+    const generation = ds.streamCardTurnGeneration ?? 0;
+    const sessionAtPost = ds.session;
+    const larkAppIdAtPost = ds.larkAppId;
+    const anchorAtPost = sessionAnchorId(ds);
+    const registryKeyAtPost = sessionKey(anchorAtPost, larkAppIdAtPost);
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    const previousCardId = ds.streamCardId;
+    const previousNonce = ds.streamCardNonce;
+    // A newer turn may have arrived while the previous turn's POST was still in
+    // flight, so beginNewTurn could not park that sentinel. Park the now-live
+    // predecessor here before replacing its identity.
+    parkStreamCard(ds);
+    const nonce = randomBytes(4).toString('hex');
+    const status = ds.usageLimit ? 'limited' : 'starting';
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readableTerminalUrlFor(ds), ds.currentTurnTitle || ds.session.title || sessionCliDisplayName(ds, botCfg), '', status, effectiveCliId, ds.displayMode ?? 'hidden', nonce, undefined, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), ds.usageLimit, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds, botCfg), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
+    ds.streamCardNonce = nonce;
+    ds.streamCardId = CARD_POSTING_SENTINEL;
+    const ownsPostIdentity = () => ds.session === sessionAtPost
+        && ds.session.status === 'active'
+        && ds.larkAppId === larkAppIdAtPost
+        && sessionAnchorId(ds) === anchorAtPost
+        && !isSessionTransferring(ds)
+        && ds.streamCardId === CARD_POSTING_SENTINEL
+        && ds.streamCardNonce === nonce
+        && (!activeSessionsRegistry || activeSessionsRegistry.get(registryKeyAtPost) === ds);
+    const stillOwnsPost = () => ownsPostIdentity() && riffRetirementAdmissionPhase(ds) === null;
+    const restorePrePostIdentityForRetirement = () => {
+        if (riffRetirementAdmissionPhase(ds) === null || !ownsPostIdentity())
+            return false;
+        ds.streamCardId = previousCardId;
+        ds.streamCardNonce = previousNonce;
+        persistStreamCardState(ds);
+        return true;
+    };
+    try {
+        const messageId = await sessionReply(anchorAtPost, cardJson, 'interactive', larkAppIdAtPost, turnId);
+        if (!stillOwnsPost()) {
+            void deleteMessage(larkAppIdAtPost, messageId).catch(() => { });
+            restorePrePostIdentityForRetirement();
+            logger.info(`[${tag(ds)}] Discarded stale starting card for turn ${turnId.substring(0, 12)}`);
+            return false;
+        }
+        ds.streamCardId = messageId;
+        ds.parkedStreamCardNonce = undefined;
+        const superseded = (ds.streamCardTurnGeneration ?? 0) !== generation;
+        if (!superseded) {
+            ds.streamCardPending = false;
+            ds.streamCardPendingTurnId = undefined;
+        }
+        persistStreamCardState(ds);
+        recallFrozenCards(ds);
+        flushPendingLocalCliOpenReadinessPatch(ds);
+        flushPendingRiffUrlPatch(ds);
+        flushPendingActiveRuntimePatch(ds);
+        flushPendingCodexServiceTierPatch(ds);
+        syncUsageRefreshTimer(ds);
+        logger.info(`[${tag(ds)}] Posted starting card for turn ${turnId.substring(0, 12)}`);
+        if (superseded && ds.streamCardPendingTurnId) {
+            void postTurnStartingCard(ds, sessionReply, ds.streamCardPendingTurnId);
+        }
+        return true;
+    }
+    catch (err) {
+        if (!stillOwnsPost()) {
+            restorePrePostIdentityForRetirement();
+            logger.info(`[${tag(ds)}] Ignored stale starting-card failure for turn ${turnId.substring(0, 12)}`);
+            return false;
+        }
+        ds.streamCardId = previousCardId;
+        ds.streamCardNonce = previousNonce;
+        persistStreamCardState(ds);
+        logger.warn(`[${tag(ds)}] Failed to post starting card for turn ${turnId.substring(0, 12)}: ${err}`);
+        if ((ds.streamCardTurnGeneration ?? 0) !== generation && ds.streamCardPendingTurnId) {
+            void postTurnStartingCard(ds, sessionReply, ds.streamCardPendingTurnId);
+        }
+        return false;
+    }
+}
 /**
  * Force-post a fresh streaming card for `ds`, bypassing the per-bot
  * `disableStreamingCard` opt-out. Backs the `/card` command: a user can
@@ -4171,6 +4273,137 @@ function rollbackAcceptedCodexAppDispatch(ds, dispatchId, turnId, dispatchAttemp
         ds.session.codexAppDispatchLedger = priorLedger;
     }
 }
+/**
+ * Recovery-seam at-most-once fence for a keyed follow-up turn (turnIdempotencyKey,
+ * PR #818). The turn-level idempotency lease terminalizes an interrupted keyed
+ * turn to a durable `failed(dispatch_unknown)` (worker-exit convergence / boot
+ * reconcile / same-key retry) and — unlike a fresh async-virtual session — LEAVES
+ * the shared session open and un-quarantined (P1-3). So a later refork of that
+ * session must NOT resurrect the interrupted turn: `noReplay` only lives on the
+ * transient input queues (pendingMessages / inflight), NOT on the durable Codex
+ * App dispatch ledger. Without this fence, the recovery path
+ * (codexAppRecoveredDispatches → worker init → recoveredAcceptedInputs, keyed on
+ * `state==='accepted'` alone) would re-issue `turn/start` for a turn the caller
+ * was already told is `failed` at-most-once — the ledger is the third replay
+ * channel the lease's noReplay does not reach (codex #818 recovery-seam finding).
+ *
+ * Fence: for each `accepted` (NEVER `prepared`) ledger entry whose OWNER-MATCHED
+ * async terminal is already `failed(dispatch_unknown)`, durably retire the entry
+ * via cancelCodexAppDispatch. The retirement is TRANSACTIONAL: if any candidate
+ * cannot be exact-cancelled (a prepared successor pins the FIFO, or the entry
+ * vanished), the whole batch is rolled back in-memory and the fence THROWS before
+ * any persist — never a partial retire, never a fork past a still-live
+ * terminalized `accepted`. Idempotent and re-run at EVERY recovery seam, so it
+ * also covers the window where the durable failed was written but a crash hit
+ * before the exit-time retirement (the durable async truth is authoritative,
+ * re-checked here). A `prepared` entry is never cancelled without proof — the
+ * runner may have crossed the write boundary; the fence only ever targets
+ * `accepted`, and a prepared frame blocking an accepted retirement aborts the
+ * fork (above). Owner-scoped: only THIS bot's failed evidence counts, so a
+ * foreign/unstamped async record never retires our accepted entry.
+ *
+ * FAIL-CLOSED (codex #818 recovery-seam round-2). At-most-once forbids replaying
+ * a turn the caller was already told is `failed`, so an ambiguous fence THROWS
+ * rather than proceeding to fork:
+ *   1. Read side uses `asyncTriggerStore.lookupStrict` — a present-but-unreadable
+ *      / corrupt terminal file must NOT fold into "no record" (soft `lookup`),
+ *      which would let the accepted entry re-enter the recovery snapshot and
+ *      replay. ENOENT / absent trigger is a genuine "no terminal" and is fine.
+ *   2. Retire persist failure (updateSession EIO): the in-memory ledger is rolled
+ *      back to `priorLedger` and the error is RETHROWN, aborting this fork before
+ *      the recovery snapshot is taken. `staggeredRecoveryFork` (the boot eager
+ *      re-attach caller) already try/catches each fork, isolates the row, and
+ *      retains it for a later retry — so the durable ledger + async truth stay
+ *      intact and the next seam re-attempts the retirement. Degrading to "replay
+ *      once" (the pre-fix behavior) would itself be the P1 we are closing.
+ * @throws when the authoritative async truth is unreadable, or the retirement
+ *  cannot be durably persisted — the caller (forkWorker) must abort this fork.
+ */
+function retireTerminalizedCodexAppLedgerEntriesForRecovery(ds) {
+    const ledger = ds.session.codexAppDispatchLedger;
+    if (!ledger || ledger.length === 0)
+        return;
+    const ownerLarkAppId = ds.larkAppId;
+    const toRetire = ledger.filter(entry => entry.state === 'accepted'
+        && (() => {
+            // STRICT read: a present-but-unreadable / corrupt terminal file THROWS
+            // (fail-closed) instead of folding into "no record" and replaying. ONLY
+            // our own durable dispatch_unknown failed counts (async-trigger-store is
+            // keyed by sessionId, so a foreign/unstamped terminal on the same
+            // sessionId/triggerId must not retire our accepted entry — mirrors the
+            // owner-positive-proof gate used everywhere else in the idempotency path).
+            const rec = asyncTriggerStore.lookupStrict(ds.session.sessionId, entry.turnId);
+            return !!rec
+                && rec.ownerLarkAppId === ownerLarkAppId
+                && rec.result.status === 'failed'
+                && rec.result.reason === 'dispatch_unknown';
+        })());
+    if (toRetire.length === 0)
+        return;
+    // TRANSACTIONAL retirement (codex #818 exact-retirement fail-open). All work is
+    // done against an in-memory working copy; nothing is persisted until EVERY
+    // owner-matched terminal candidate has been exact-cancelled. If ANY candidate
+    // cannot be cancelled — `prepared_successor_exists` (a later prepared frame
+    // pins the FIFO) or `dispatch_not_found` (the ledger changed under us) — we
+    // restore the in-memory ledger to `priorLedger` and THROW *before* any persist,
+    // aborting this fork fail-closed. A `continue`-and-fork would leave that
+    // terminalized `accepted` entry to be replayed as `recoveredAcceptedInputs`
+    // (the generation fence only constrains `prepared`, never re-adds noReplay to a
+    // surviving `accepted`), and a partial persist could retire some while forking
+    // the rest. All-or-nothing + fail-closed is the only safe shape.
+    const priorLedger = ds.session.codexAppDispatchLedger;
+    let workingLedger = [...(ds.session.codexAppDispatchLedger ?? [])];
+    const retiredTurnIds = [];
+    for (const entry of toRetire) {
+        const cancelled = cancelCodexAppDispatch(workingLedger, {
+            dispatchId: entry.dispatchId,
+            turnId: entry.turnId,
+            ...(entry.dispatchAttempt !== undefined ? { dispatchAttempt: entry.dispatchAttempt } : {}),
+        });
+        if (!cancelled.ok) {
+            // Cannot exact-cancel a terminalized accepted entry (prepared successor /
+            // vanished). Abort the whole retirement + fork fail-closed; a later seam
+            // re-attempts once the blocking prepared frame settles or the ledger
+            // stabilizes. NEVER fall through to fork with a live terminalized accepted.
+            ds.session.codexAppDispatchLedger = priorLedger;
+            throw new Error(`recovery fence could not exact-retire terminalized Codex App dispatch `
+                + `turn=${entry.turnId} (${cancelled.error}); aborting fork (fail-closed)`);
+        }
+        workingLedger = cancelled.ledger;
+        retiredTurnIds.push(entry.turnId);
+    }
+    // Every candidate retired on the working copy — commit ONCE.
+    ds.session.codexAppDispatchLedger = workingLedger;
+    try {
+        sessionStore.updateSession(ds.session);
+        for (const turnId of retiredTurnIds) {
+            logger.warn(`[${ds.session.sessionId.slice(0, 8)}] Recovery fence retired at-most-once terminalized `
+                + `Codex App dispatch turn=${turnId.slice(0, 12)} (durable failed:dispatch_unknown; not replayed)`);
+        }
+        if (!hasUnsettledCodexAppDispatch(ds.session.codexAppDispatchLedger)) {
+            void Promise.resolve(callbacks?.onCodexAppLedgerDrained?.(ds)).catch(err => {
+                logger.error(`[${ds.session.sessionId.slice(0, 8)}] post-recovery-fence ledger-drain cleanup failed: `
+                    + `${err instanceof Error ? err.message : String(err)}`);
+            });
+        }
+    }
+    catch (err) {
+        // Persist failed (EIO/ENOSPC). Roll back the in-memory ledger so the durable
+        // async truth + the on-disk ledger stay consistent, then RETHROW to ABORT
+        // this fork BEFORE the recovery snapshot is taken (fail-closed). Degrading to
+        // "let the accepted entry replay once" is exactly the at-most-once violation
+        // this fence exists to close, so we must NOT proceed to fork. The boot eager
+        // re-attach caller (staggeredRecoveryFork) try/catches each fork, isolates
+        // this row, and retains it for a later retry — so the next seam re-attempts
+        // the retirement against the intact durable state.
+        ds.session.codexAppDispatchLedger = priorLedger;
+        logger.error(`[${ds.session.sessionId.slice(0, 8)}] Recovery fence could not persist retired ledger; `
+            + `aborting fork (fail-closed), will retry next seam: ${err instanceof Error ? err.message : String(err)}`);
+        throw err instanceof Error
+            ? err
+            : new Error(`recovery-fence ledger retirement persist failed: ${String(err)}`);
+    }
+}
 function snapshotQueuedActivationJournal(session) {
     return {
         queuedActivationPending: session.queuedActivationPending,
@@ -4429,6 +4662,7 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
         ...(opts.dispatchAttempt !== undefined ? { dispatchAttempt: opts.dispatchAttempt } : {}),
         ...(codexAppDispatchId ? { codexAppDispatchId } : {}),
         ...(opts.codexAppSteerable ? { codexAppSteerable: true } : {}),
+        ...(opts.atMostOnce ? { atMostOnce: true } : {}),
         ...(vcMeetingImTurnOrigin
             ? { vcMeetingImTurnOrigin }
             : {}),
@@ -4718,6 +4952,9 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             const gatedDispatchAttempt = typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
                 ? resumeOrTurnId.dispatchAttempt
                 : undefined;
+            const gatedAtMostOnce = typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+                ? resumeOrTurnId.atMostOnce
+                : undefined;
             sendWorkerInput(ds, promptInput, gatedTurnId, {
                 ...(gatedDispatchAttempt !== undefined
                     ? { dispatchAttempt: gatedDispatchAttempt }
@@ -4727,6 +4964,12 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
                 // rerouted through the transfer gate must carry the flag here too, or it
                 // silently downgrades true → false like the direct-route branch did.
                 ...(gatedPrompt.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+                // At-most-once (codex #818 P1-5): a keyed follow-up fork rerouted through
+                // the transfer gate to sendWorkerInput must preserve atMostOnce, else the
+                // replacement CLI's input is replayable and a crash after the daemon
+                // terminalized the turn re-runs it. forkWorker's own init path sets this
+                // from resumeOrTurnId.atMostOnce; the reroute must forward it identically.
+                ...(gatedAtMostOnce ? { atMostOnce: true } : {}),
             });
         }
         else {
@@ -5102,6 +5345,28 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         // Snapshot the prior durable FIFO before accepting this fork's new prompt.
         // A pure reattach receives the full snapshot; a refork carrying N+1 restores
         // old N first and reserves N+1 through the normal worker write path.
+        // FIRST fence out any keyed turn already terminalized to a durable
+        // failed(dispatch_unknown): the turn-level idempotency lease (PR #818) leaves
+        // the shared session open, so without this the recovery path would replay an
+        // at-most-once turn the caller was already told failed (the ledger is the third
+        // replay channel `noReplay` does not reach). Idempotent + re-checked here.
+        //
+        // FAIL-CLOSED via THROW (codex #818 recovery-seam round-3): if the fence cannot
+        // PROVE it is safe to build the recovery snapshot — unreadable/corrupt
+        // authoritative async terminal, a terminalized accepted entry that cannot be
+        // exact-cancelled, or a retirement persist failure — it THROWS. We deliberately
+        // do NOT catch-and-`return false` here: `forkWorker`'s bool return is widely
+        // IGNORED by callers (the keyed `/api/trigger` dormant path forks and then
+        // unconditionally returns `queued`, so a swallowed false would strand the turn
+        // `running`), and a `return false` would also bypass the outer
+        // `rollbackWorkerForkPreInit` that restores the queued-activation journal
+        // mutated above. Letting it throw routes through forkWorker's existing outer
+        // catch (pre-init rollback + rethrow) and then the keyed trigger's post-barrier
+        // convergence, which durably terminalizes the turn to `failed` (observable,
+        // at-most-once) — the correct contract for every fork-failure path.
+        if (agentCfg.cliId === 'codex-app') {
+            retireTerminalizedCodexAppLedgerEntriesForRecovery(ds);
+        }
         const codexAppRecoveredDispatches = agentCfg.cliId === 'codex-app'
             ? (ds.session.codexAppDispatchLedger ?? []).map(entry => ({ ...entry }))
             : [];
@@ -5351,6 +5616,12 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             // rather than silently masking an arbitrary parent dir (codex P1). Omitted
             // from forkAdoptWorker below — its observe branch returns before fs-policy.
             loadedBotsConfigPath: getLoadedConfigPath(),
+            // PROVENANCE of that path: 'loaded' = the daemon actually parsed this exact
+            // file (a real registry authority, safe to pin onto CLI children);
+            // 'synthetic' = core-only placeholder that was never parsed. The worker must
+            // not guess this from the filesystem — existence and provenance are
+            // independent facts (see core/config-dir.ts BotsConfigProvenance).
+            loadedBotsConfigProvenance: getLoadedConfigProvenance(),
             brand: normalizeBrand(botCfg.brand),
             botName: bot.botName,
             botOpenId: bot.botOpenId,
@@ -6043,6 +6314,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // POST a second card; the in-flight POST becomes this turn's card.
                 if (ds.streamCardId === CARD_POSTING_SENTINEL)
                     break;
+                const postingGeneration = ds.streamCardTurnGeneration ?? 0;
                 ds.streamCardId = CARD_POSTING_SENTINEL;
                 try {
                     ds.streamCardNonce = randomBytes(4).toString('hex');
@@ -6071,7 +6343,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // this "starting" card is orphaned (never entered frozenCards, so
                     // recallFrozenCards can't withdraw it). Mirrors the screen_update POST
                     // branch which clears the flag after posting.
-                    ds.streamCardPending = false;
+                    const superseded = (ds.streamCardTurnGeneration ?? 0) !== postingGeneration;
+                    if (!superseded) {
+                        ds.streamCardPending = false;
+                        ds.streamCardPendingTurnId = undefined;
+                    }
                     ds.parkedStreamCardNonce = undefined;
                     persistStreamCardState(ds);
                     // Re-sync worker's display mode (it starts fresh in 'hidden')
@@ -6088,6 +6364,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // resume where the CLI kept running), arm here — same authorized arm
                     // point as the reuse branch, now that streamCardId is the real id.
                     syncUsageRefreshTimer(ds);
+                    if (superseded && ds.streamCardPendingTurnId) {
+                        void postTurnStartingCard(ds, cb.sessionReply, ds.streamCardPendingTurnId);
+                    }
                 }
                 catch (err) {
                     if (!ownsLifecycleMutation())
@@ -6404,6 +6683,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // New turn — create a fresh card, old card freezes at its last state.
                     // Generate new nonce so old card buttons are distinguishable.
                     const isNewTurn = !!ds.streamCardPending;
+                    const postingGeneration = ds.streamCardTurnGeneration ?? 0;
                     ds.streamCardNonce = randomBytes(4).toString('hex');
                     // New turn → image_key from previous turn no longer valid
                     if (isNewTurn)
@@ -6420,6 +6700,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                             return;
                         }
                         ds.streamCardId = msgId;
+                        const superseded = (ds.streamCardTurnGeneration ?? 0) !== postingGeneration;
+                        if (!superseded)
+                            ds.streamCardPendingTurnId = undefined;
                         ds.parkedStreamCardNonce = undefined;
                         persistStreamCardState(ds);
                         // New card live — recall any cards parked by previous turns
@@ -6437,6 +6720,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         // periodic usage refresh here (once the real card id exists, not
                         // the POSTING sentinel). syncUsageRefreshTimer re-checks state.
                         syncUsageRefreshTimer(ds);
+                        if (superseded && ds.streamCardPendingTurnId) {
+                            void postTurnStartingCard(ds, cb.sessionReply, ds.streamCardPendingTurnId);
+                        }
                     })
                         .catch(async (err) => {
                         if (!ownsLifecycleMutation())
@@ -6451,6 +6737,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         ds.pendingActiveRuntimeCardRefresh = undefined;
                         ds.pendingCodexTierCardRefresh = undefined;
                         persistStreamCardState(ds);
+                        if ((ds.streamCardTurnGeneration ?? 0) !== postingGeneration && ds.streamCardPendingTurnId) {
+                            void postTurnStartingCard(ds, cb.sessionReply, ds.streamCardPendingTurnId);
+                        }
                     });
                 }
                 else {
@@ -7194,9 +7483,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                             logger.error(`[${t}] Failed to persist async terminal-settle for ${msg.turnId.substring(0, 8)}: ${err.message}`);
                         }
                         // Cleared like the final_output path so worker-exit convergence does
-                        // not retro-fail this now-completed turn.
-                        if (ds.idempotentAsyncTurn?.triggerId === msg.turnId)
-                            ds.idempotentAsyncTurn = undefined;
+                        // not retro-fail this now-completed turn. Per-triggerId delete so a
+                        // concurrent sibling keyed turn's convergence entry is untouched.
+                        ds.idempotentAsyncTurns?.delete(msg.turnId);
                         logger.info(`[${t}] Settled async HTTP turn ${msg.turnId.substring(0, 8)} completed (empty output; nothing-to-send)`);
                     }
                 }
@@ -7860,11 +8149,12 @@ function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () =
         // (with content + usage) after a daemon restart drops the in-memory Map.
         // Stamp the owning bot for cross-bot isolation.
         asyncTriggerStore.recordCompleted(ds.session.sessionId, msg.turnId, msg.content, completedAt, ds.larkAppId, msg.usage);
-        // This idempotent async turn produced its terminal output — clear the
-        // worker-exit convergence stamp so a later graceful exit of this generation
-        // is not retro-failed (codex #776 round-6 finding #1).
-        if (ds.idempotentAsyncTurn?.triggerId === msg.turnId)
-            ds.idempotentAsyncTurn = undefined;
+        // This idempotent async turn produced its terminal output — drop its
+        // worker-exit convergence entry so a later graceful exit of this generation
+        // is not retro-failed (codex #776 round-6 finding #1). Per-triggerId delete so
+        // a concurrent sibling keyed turn on the same shared session is untouched
+        // (codex #818 P1-1).
+        ds.idempotentAsyncTurns?.delete(msg.turnId);
         ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
         logger.info(`[${t}] Captured final_output for Async HTTP request (turn ${msg.turnId.substring(0, 8)})`);
         onComplete?.(true);
@@ -8227,6 +8517,7 @@ export const __testOnly_setupWorkerHandlers = setupWorkerHandlers;
 export const __testOnly_reserveWorkerGeneration = reserveWorkerGeneration;
 export const __testOnly_finishTurnReactions = finishTurnReactions;
 export const __testOnly_finalOutputDedupeKey = finalOutputDedupeKey;
+export const __testOnly_retireTerminalizedCodexAppLedgerEntriesForRecovery = retireTerminalizedCodexAppLedgerEntriesForRecovery;
 // ─── Fork adopt worker ──────────────────────────────────────────────────────
 function reserveWorkerGeneration(ds) {
     const previousDaemonGeneration = ds.workerGeneration;