thinkpool-pair 0.7.331 → 0.7.333

package/bridge.mjs

@@ -92,7 +92,7 @@ function stopFlowPreviews (flowId, laneId = null) {
 }
 import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
-import { readReviewFile, runReviewCheck } from './review-check.mjs'
+import { IMMUTABLE_REVIEW_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
 import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
@@ -117,7 +117,7 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, readTerminalBudgetDecision, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneBusyOf, laneStatusOf, settleLaneBusy, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { formatPeek, PEEK, readTerminalTurnBudgetDecision, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneBusyOf, laneStatusOf, settleLaneBusy, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { createStandalonePairResponder, standalonePairIdentity } from './direct-pair-room.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
@@ -2596,13 +2596,16 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           if (args?.terminal && !target) {
             return { content: [{ type: 'text', text: formatPeek({ selfId: id, sessions, terms, names: termNames, terminal: args.terminal, lines: args?.lines }) }] }
           }
-          const budget = readTerminalBudgetDecision({
+          const budget = readTerminalTurnBudgetDecision({
             targeted: !!args?.terminal,
             targetedCount: entry.peekCount,
             rosterCount: entry.peekRosterCount,
+            budgetTurnRev: entry.peekBudgetTurnRev,
+            currentTurnRev: entry._turnRev,
           })
           entry.peekCount = budget.targetedCount
           entry.peekRosterCount = budget.rosterCount
+          entry.peekBudgetTurnRev = budget.budgetTurnRev
           if (!budget.ok) return { content: [{ type: 'text', text: budget.reason }] }
           const targetEntry = target?.kind === 'agent' ? sessions.get(target.id) : null
           const text = formatPeek({ selfId: id, sessions, terms, names: termNames, terminal: args?.terminal, lines: args?.lines })
@@ -3029,11 +3032,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         'Read one regular file from the declared immutable review target. This always reads the target’s pinned Git object, never a live worktree; target and path are validated and the response is byte-bounded.',
         { target: z.string(), path: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await readReviewFile({ target: args?.target, filePath: args?.path, snapshots: entry.flowReviewSnapshots })) }] }),
+        IMMUTABLE_REVIEW_TOOL_EXTRAS,
       ), tool(
         'run_review_check',
         'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id; it never accepts a shell command, cwd, environment, executable, or arguments. The check runs in a scratch archive, never in a builder worktree.',
         { target: z.string(), checkId: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await runReviewCheck({ target: args?.target, checkId: args?.checkId, snapshots: entry.flowReviewSnapshots })) }] }),
+        IMMUTABLE_REVIEW_TOOL_EXTRAS,
       )] : []),
     ],
   })

package/codex-session.mjs

@@ -34,6 +34,7 @@ import { CODEX_THINKPOOL_FIRST_TURN_PREAMBLE, buildThinkPoolTurnGuidance, create
 import { questionAnswerResponse } from './question-response.mjs'
 import { codexReviewTarget, isCodexCompactCommand } from './codex-commands.mjs'
 import { createCumulativeEventRelay } from './cumulative-event-relay.mjs'
+import { stallDecision, stallEvent } from './turn-stall.mjs'
 
 const DEFAULT_SANDBOX = 'workspace-write'
 const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
@@ -362,7 +363,7 @@ function appServerItemForMapper(item) {
  * @param {string} [o.providerConfig] optional -c overrides / provider block (M2: from the provider registry)
  * @returns {{ sendTurn(text, options?), abort(), end(), readonly sessionId }}
  */
-export function startCodexSession({ cwd, model, effort: initialEffort = 'high', resume, env, sandbox, mode = 'default', onEvent, providerConfig, terminalRolePrompt, rolePrompt, roomContext, mcpServers, prepareCwd = null, requestPermission, appServerGate = codexAppServerGate, appServerFactory = createCodexAppServer, mcpHttpFactory = startCodexMcpHttp, spawnImpl = spawn, admitStart = null }) {
+export function startCodexSession({ cwd, model, effort: initialEffort = 'high', resume, env, sandbox, mode = 'default', onEvent, providerConfig, terminalRolePrompt, rolePrompt, roomContext, mcpServers, prepareCwd = null, requestPermission, appServerGate = codexAppServerGate, appServerFactory = createCodexAppServer, mcpHttpFactory = startCodexMcpHttp, spawnImpl = spawn, admitStart = null, stallOptions = {} }) {
   let activeMode = CODEX_MODE_CONFIG[mode] ? mode : 'default'
   let modeConfig = codexConfigForMode(activeMode)
   sandbox = normalizeCodexSandbox(sandbox || modeConfig.sandbox)
@@ -381,6 +382,30 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   let aborted = false
   let ended = false
   let turnActive = false
+  // Codex can accept a room turn and then emit nothing while App Server is
+  // booting or an upstream model call is retrying. The room's generic roster
+  // clock can label that lane "stalled", but only the owning transport can
+  // surface an honest in-pane status and safely interrupt/replay the exact
+  // logical prompt. Keep this lifecycle parallel to Claude's shared watchdog.
+  const stallNow = typeof stallOptions.now === 'function' ? stallOptions.now : Date.now
+  const stallSetInterval = typeof stallOptions.setInterval === 'function' ? stallOptions.setInterval : setInterval
+  const stallClearInterval = typeof stallOptions.clearInterval === 'function' ? stallOptions.clearInterval : clearInterval
+  const STALL_MS = Number.isFinite(stallOptions.stallMs)
+    ? Math.max(1, Number(stallOptions.stallMs))
+    : Math.max(30000, parseInt(childEnv.TP_STALL_MS, 10) || 90000)
+  const FORCE_STOP_MS = Number.isFinite(stallOptions.forceStopMs)
+    ? Math.max(STALL_MS, Number(stallOptions.forceStopMs))
+    : Math.max(STALL_MS * 3, parseInt(childEnv.TP_FORCE_STOP_MS, 10) || 300000)
+  const STALL_INTERVAL_MS = Number.isFinite(stallOptions.intervalMs)
+    ? Math.max(1, Number(stallOptions.intervalMs))
+    : 5000
+  let lastEvtTs = stallNow()
+  let stalledSent = false
+  let stallRetried = false
+  let stallRetryRequested = false
+  let stallGiveupRequested = false
+  let awaitingUser = 0
+  let stallTimer = null
   let activeModel = model || null
   let activeEffort = EFFORT_LEVELS.has(initialEffort) ? initialEffort : 'high'
   let latestUsageSnapshot = sessionId ? readCodexThreadUsage(sessionId) : null
@@ -403,7 +428,14 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   let chain = Promise.resolve()
   const queue = []
 
-  const relayEvent = createCumulativeEventRelay((event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } })
+  // Synthetic watchdog chrome must not count as provider activity, otherwise
+  // its 90s status would reset the silence clock and postpone the 5m recovery.
+  // Everything on the normal relay path is real transport/session activity and
+  // immediately clears the one-shot stalled banner.
+  const emitRaw = createCumulativeEventRelay((event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } })
+  const touchActivity = () => { lastEvtTs = stallNow(); stalledSent = false }
+  const relayEvent = (event) => { touchActivity(); emitRaw(event) }
+  relayEvent.cancel = () => emitRaw.cancel()
   const mapper = new CodexEventMapper({
     onEvent: relayEvent,
     model: model || null,
@@ -430,6 +462,15 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     relayEvent(event)
   }
 
+  const armTurnLiveness = ({ retry = false } = {}) => {
+    turnActive = true
+    lastEvtTs = stallNow()
+    stalledSent = false
+    stallRetryRequested = false
+    stallGiveupRequested = false
+    if (!retry) stallRetried = false
+  }
+
   const note = (text) => relayEvent({ kind: 'note', text })
 
   const closeAppServerTurn = (turnId = activeTurnId) => {
@@ -462,12 +503,14 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       const turnId = String(params.turn.id)
       if (ended || aborted) { closeAppServerTurn(turnId); return }
       if (!activeTurnId) activeTurnId = turnId
+      touchActivity()
       return
     }
     // Every mapped App Server notification below is turn-scoped in the tested
     // protocol and carries turnId. Fail closed on missing, stale, completed, or
     // interrupted ids so a provider's buffered stdout cannot reopen a closed turn.
     if ((method === 'turn/plan/updated' || method === 'item/agentMessage/delta' || method === 'item/started' || method === 'item/completed' || method === 'error') && !appServerTurnIsCurrent(params)) return
+    touchActivity()
     if (method === 'turn/plan/updated') {
       const todos = (Array.isArray(params.plan) ? params.plan : []).map(({ step, status }) => ({
         content: step || '',
@@ -524,7 +567,14 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     // Missing/broken room permission plumbing denies safely. App Server expects
     // an ordinary response even for denial; an RPC error can strand the turn.
     let decision = 'deny'
+    awaitingUser++
     try { decision = await requestPermission?.(card) } catch { /* deny */ }
+    finally {
+      awaitingUser = Math.max(0, awaitingUser - 1)
+      // Give the resumed model call a fresh watchdog window. Human think time
+      // is intentionally excluded and must not force-stop the turn next tick.
+      touchActivity()
+    }
     if (method === 'item/tool/requestUserInput') return codexUserInputResponse(decision, card.questions)
     return codexApprovalResponse(decision)
   }
@@ -556,6 +606,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
           },
         })
         await appServer.start()
+        touchActivity()
       }
       sessionId = await appServer.startThread({
         threadId: turnNo > 0 ? sessionId : null,
@@ -568,12 +619,16 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         // independent ThinkPool sandbox / approval posture above.
         config: { 'features.default_mode_request_user_input': true },
       })
+      touchActivity()
       // App Server reports thread/start before its per-thread MCP clients finish
       // initializing. Starting the first turn in that gap snapshots a toolset
       // without ThinkPool even though the server becomes ready milliseconds later.
       // Hold the turn boundary until the room MCP is actually ready; a timeout or
       // startup failure drops into the required-MCP codex exec fallback below.
-      if (peer?.url) await appServer.waitForMcpServer({ threadId: sessionId, name: 'thinkpool' })
+      if (peer?.url) {
+        await appServer.waitForMcpServer({ threadId: sessionId, name: 'thinkpool' })
+        touchActivity()
+      }
       appServerThreadReady = true
       pushMappedEvent({ type: 'thread.started', thread_id: sessionId })
       return true
@@ -588,15 +643,101 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     }
   }
 
+  function stopStalledTransport({ force = false } = {}) {
+    const server = appServer
+    const turnId = activeTurnId
+
+    if (server && force) {
+      // A second stall is terminal. End the resident process, not merely its
+      // turn: an interrupt whose completion notification is itself wedged would
+      // otherwise leave `chain` unresolved and silently queue every later send.
+      closeAppServerTurn(turnId)
+      appServerDisabled = true
+      appServerThreadReady = false
+      try { server.end() } catch { /* noop */ }
+      if (appServer === server) appServer = null
+    } else if (server && turnId) {
+      // Fence the old native id before interrupting so buffered deltas/tool rows
+      // cannot cross into the retried logical turn.
+      closeAppServerTurn(turnId)
+      Promise.resolve(server.interrupt({ threadId: sessionId, turnId })).catch(() => {
+        // An interrupt rejected before delivery: tear down the uncertain control
+        // channel. The current pump will use the exec fallback for its one retry.
+        appServerDisabled = true
+        appServerThreadReady = false
+        try { server.end() } catch { /* noop */ }
+        if (appServer === server) appServer = null
+      })
+    } else if (server) {
+      // The stall happened during cold App Server / MCP bootstrap, before a
+      // native turn id existed. Closing that process makes the pending startup
+      // reject; ensureAppServer then returns false and the same prompt gets its
+      // bounded retry through codex exec.
+      appServerDisabled = true
+      appServerThreadReady = false
+      try { server.end() } catch { /* noop */ }
+      if (appServer === server) appServer = null
+    }
+
+    if (child) {
+      const stalledChild = child
+      try { stalledChild.kill('SIGTERM') } catch { /* noop */ }
+      setTimeout(() => {
+        if (child === stalledChild) { try { stalledChild.kill('SIGKILL') } catch { /* noop */ } }
+      }, 1500)
+    }
+  }
+
+  stallTimer = stallSetInterval(() => {
+    const quietMs = stallNow() - lastEvtTs
+    const action = stallDecision({
+      turnActive,
+      awaitingUser,
+      quietMs,
+      stallMs: STALL_MS,
+      forceStopMs: FORCE_STOP_MS,
+      stalledSent,
+      stallRetried,
+    })
+    if (action === 'none') return
+
+    const event = stallEvent(action, quietMs)
+    if (event) emitRaw(event)
+    if (action === 'status') {
+      stalledSent = true
+      return
+    }
+    if (action === 'retry') {
+      // Preserve the prompt and retry budget in pump(); do not use the public
+      // abort flag because that intentionally discards queued work and emits a
+      // terminal aborted boundary.
+      stallRetried = true
+      stallRetryRequested = true
+      lastEvtTs = stallNow()
+      stalledSent = false
+      stopStalledTransport()
+      return
+    }
+
+    // The retry also went silent. Surface the durable terminal boundary now so
+    // the lane cannot remain busy if the native interrupt itself is wedged.
+    stallGiveupRequested = true
+    stallRetryRequested = false
+    queue.length = 0
+    emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
+    stopStalledTransport({ force: true })
+  }, STALL_INTERVAL_MS)
+  stallTimer.unref?.()
+
   async function runAppServer(prompt, options = {}) {
     // Stop can win before the queued pump enters native startup. Do not launch a
     // fresh App Server merely to discover the accepted room turn was cancelled.
-    if (ended || aborted) return true
+    if (ended || aborted || stallGiveupRequested) return true
     if (!await ensureAppServer()) return false
     // Stop can land while the cold App Server / MCP bootstrap is still awaiting.
     // The accepted turn was already closed at the room boundary; never start it
     // after bootstrap finally resolves.
-    if (ended || aborted) return true
+    if (ended || aborted || stallGiveupRequested) return true
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
     turnActive = true
     try {
@@ -609,6 +750,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         approvalPolicy: modeConfig.approvalPolicy,
         collaborationMode: codexDefaultCollaborationMode(activeModel, activeEffort),
       })
+      touchActivity()
       // Stop may land after the RPC was written but before startTurn returns its
       // id. abort() already closed the room boundary; interrupt the now-known
       // native turn before waiting, and never let it continue invisibly.
@@ -620,11 +762,18 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       const completed = await appServer.waitForTurn(activeTurnId)
       closeAppServerTurn(completed?.turn?.id || activeTurnId)
       const status = completed?.turn?.status
-      if (aborted || status === 'interrupted') {
+      if (aborted) {
+        emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: completed?.turn?.durationMs, denials: 0, resultText: null })
+      } else if (status === 'interrupted' && (stallRetryRequested || stallGiveupRequested)) {
+        // The watchdog owns this lifecycle: retry is re-armed by pump(), while
+        // giveup already emitted the one terminal boundary synchronously.
+      } else if (status === 'interrupted') {
         emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: completed?.turn?.durationMs, denials: 0, resultText: null })
       } else if (status === 'failed') {
+        stallRetryRequested = false
         pushMappedEvent({ type: 'turn.failed', message: completed?.turn?.error?.message || 'codex turn failed' })
       } else {
+        stallRetryRequested = false
         pushMappedEvent({ type: 'turn.completed' })
       }
     } catch (error) {
@@ -636,7 +785,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       closeAppServerTurn(activeTurnId)
       try { appServer?.end() } catch { /* noop */ }
       appServer = null
-      if (!ended) pushMappedEvent({ type: 'turn.failed', message: `codex app-server turn failed: ${error?.message || error}` })
+      if (!ended && !stallRetryRequested && !stallGiveupRequested) pushMappedEvent({ type: 'turn.failed', message: `codex app-server turn failed: ${error?.message || error}` })
     } finally {
       // A transport failure or interrupt can land after prose deltas but before
       // item/completed. Preserve that partial prose as one durable row rather
@@ -654,15 +803,16 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
 
   async function runAppServerReview(commandText) {
-    if (ended || aborted) return true
+    if (ended || aborted || stallGiveupRequested) return true
     if (!await ensureAppServer()) return false
-    if (ended || aborted) return true
+    if (ended || aborted || stallGiveupRequested) return true
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
     turnActive = true
     try {
       const started = await appServer.startReview({ threadId: sessionId, target: codexReviewTarget(commandText) })
       activeTurnId = started?.turn?.id || started?.turnId
       if (!activeTurnId) throw new Error('Codex review/start returned no turn id')
+      touchActivity()
       if (aborted || ended) {
         closeAppServerTurn(activeTurnId)
         try { await appServer.interrupt({ threadId: sessionId, turnId: activeTurnId }) } catch { /* boundary is already closed */ }
@@ -671,11 +821,17 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       const completed = await appServer.waitForTurn(activeTurnId)
       closeAppServerTurn(completed?.turn?.id || activeTurnId)
       const status = completed?.turn?.status
-      if (aborted || status === 'interrupted') {
+      if (aborted) {
+        emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: completed?.turn?.durationMs, denials: 0, resultText: null })
+      } else if (status === 'interrupted' && (stallRetryRequested || stallGiveupRequested)) {
+        // Watchdog-owned interruption; pump decides retry vs terminal giveup.
+      } else if (status === 'interrupted') {
         emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: completed?.turn?.durationMs, denials: 0, resultText: null })
       } else if (status === 'failed') {
+        stallRetryRequested = false
         pushMappedEvent({ type: 'turn.failed', message: completed?.turn?.error?.message || 'codex review failed' })
       } else {
+        stallRetryRequested = false
         pushMappedEvent({ type: 'turn.completed' })
       }
     } catch (error) {
@@ -684,7 +840,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       closeAppServerTurn(activeTurnId)
       try { appServer?.end() } catch { /* noop */ }
       appServer = null
-      if (!ended) pushMappedEvent({ type: 'turn.failed', message: `codex review failed: ${error?.message || error}` })
+      if (!ended && !stallRetryRequested && !stallGiveupRequested) pushMappedEvent({ type: 'turn.failed', message: `codex review failed: ${error?.message || error}` })
     } finally {
       for (const state of streamedAgentItems.values()) {
         if (!state.text) continue
@@ -699,7 +855,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
 
   async function runExec(prompt, options = {}) {
-    if (ended || aborted) return
+    if (ended || aborted || stallGiveupRequested) return
     // First turn: fresh exec. Later turns: resume THIS lane's captured thread.
     // `--last` is process-global and can cross-wire two concurrently-active Codex
     // lanes, so it is never safe in a multi-lane bridge.
@@ -741,7 +897,10 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         try { ev = JSON.parse(line) } catch { return /* non-JSON progress line */
         }
         if (ev.type === 'thread.started' && ev.thread_id) sessionId = sessionId || ev.thread_id
-        if (ev.type === 'turn.completed' || ev.type === 'turn.failed') sawTerminalResult = true
+        if (ev.type === 'turn.completed' || ev.type === 'turn.failed') {
+          sawTerminalResult = true
+          stallRetryRequested = false
+        }
         pushMappedEvent(ev)
       })
       // stderr is codex's human progress channel; surface tail on failure only.
@@ -755,7 +914,10 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         settled = true
         child = null
         turnActive = false
-        if (aborted && !sawTerminalResult) {
+        if ((stallRetryRequested || stallGiveupRequested) && !sawTerminalResult && !aborted) {
+          // Watchdog interruption: pump either replays once or has already
+          // published the terminal giveup boundary.
+        } else if (aborted && !sawTerminalResult) {
           emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
         } else if (!aborted && !sawTerminalResult && code !== 0 && code != null) {
           emitTurnBoundary({ kind: 'error', message: `codex exec exited ${code}${stderrTail ? ': ' + stderrTail.trim().slice(-300) : ''}`, recoverable: true })
@@ -766,7 +928,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         if (settled) return
         settled = true
         child = null
-        emitTurnBoundary({ kind: 'error', message: `codex failed to start: ${e.message}`, recoverable: true })
+        if (!stallRetryRequested && !stallGiveupRequested) emitTurnBoundary({ kind: 'error', message: `codex failed to start: ${e.message}`, recoverable: true })
         resolve()
       })
       child.on('close', finish)
@@ -778,6 +940,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     const next = queue.shift()
     if (!next) return
     chain = chain.then(async () => {
+      armTurnLiveness()
       // runExec sees turnNo===0 on the FIRST turn (fresh exec); increment only
       // after, so subsequent turns resume this lane's captured thread id.
       // Claude receives these through the Agent SDK's system-reminder path.
@@ -794,13 +957,36 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         forceFullReminder: next.forceFullReminder,
       })
       const review = /^\s*\/review(?:\s|$)/i.test(String(next.text || ''))
-      const usedAppServer = review
-        ? await runAppServerReview(next.text)
-        : await runAppServer(prompt, next.options)
-      if (!usedAppServer) {
-        if (review) {
-          emitTurnBoundary({ kind: 'error', message: 'Codex review is unavailable without the tested App Server runtime.', recoverable: true })
-        } else await runExec(prompt, next.options)
+      let retryAttempt = false
+      while (!ended && !aborted && !stallGiveupRequested) {
+        const usedAppServer = review
+          ? await runAppServerReview(next.text)
+          : await runAppServer(prompt, next.options)
+        if (!usedAppServer) {
+          if (review) {
+            stallRetryRequested = false
+            emitTurnBoundary({ kind: 'error', message: 'Codex review is unavailable without the tested App Server runtime.', recoverable: true })
+          } else {
+            // A watchdog interruption during cold App Server startup has no
+            // native turn to wait on. Treat the exec fallback itself as the one
+            // retry rather than accidentally granting a third attempt.
+            if (stallRetryRequested) {
+              stallRetryRequested = false
+              retryAttempt = true
+              armTurnLiveness({ retry: true })
+              emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
+            }
+            await runExec(prompt, next.options)
+          }
+        }
+        if (stallRetryRequested && !retryAttempt && !stallGiveupRequested && !ended && !aborted) {
+          stallRetryRequested = false
+          retryAttempt = true
+          armTurnLiveness({ retry: true })
+          emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
+          continue
+        }
+        break
       }
       turnNo++
       pump()
@@ -833,6 +1019,9 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         try { cwd = prepareCwd() || cwd } catch { /* keep original cwd */ }
       }
       if (turnActive && appServer && activeTurnId) {
+        // A delivered human steer is new work for the active model call; give it
+        // a fresh quiet window before declaring the transport stalled.
+        touchActivity()
         const fullReminder = usesFullThinkPoolReminder({ promptIndex, forceFull: thisTurnForceFull })
         const prompt = buildCodexPrompt({
           text,
@@ -866,7 +1055,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // first provider event many seconds later.
       if (!turnActive) {
         aborted = false
-        turnActive = true
+        armTurnLiveness()
       }
       // start the pump if idle
       if (queue.length === 1) pump()
@@ -876,6 +1065,8 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       const activeChain = chain
       const bootstrapOnly = turnActive && !activeTurnId && !child
       aborted = true
+      stallRetryRequested = false
+      stallGiveupRequested = false
       queue.length = 0
       closeAppServerTurn(activeTurnId)
       let interrupt = Promise.resolve()
@@ -895,6 +1086,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     end() {
       ended = true
       turnActive = false
+      if (stallTimer) stallClearInterval(stallTimer)
       relayEvent.cancel()
       queue.length = 0
       closeAppServerTurn(activeTurnId)

package/cross-terminal.mjs

@@ -18,7 +18,7 @@ export const PEEK = {
   // explicitly when a diagnosis genuinely needs deeper sibling history.
   defaultLines: 20,
   maxLines: 200,
-  perTurnCap: 10,     // targeted transcript reads allowed per user turn (bridge resets it)
+  perTurnCap: 10,     // targeted transcript reads allowed per accepted room turn
   rosterPerTurnCap: 1, // no-argument roster reads use a separate allowance; ROOM NOW is default
   lineCap: 200,       // per-line truncation
   rosterPreview: 100, // last-line preview length in the roster listing
@@ -37,7 +37,7 @@ export const readTerminalBudgetDecision = ({ targeted = false, targetedCount = 0
       ok: false,
       targetedCount: nextTargeted,
       rosterCount: nextRoster,
-      reason: `Cross-terminal transcript read limit reached for this turn (${limits.perTurnCap}). Stop polling and continue with the worker results already collected; a new person-authored turn resets the allowance.`,
+      reason: `Cross-terminal transcript read limit reached for this turn (${limits.perTurnCap}). Stop polling and continue with the worker results already collected; a fresh accepted room turn resets the allowance.`,
     }
     return { ok: true, targetedCount: nextTargeted + 1, rosterCount: nextRoster }
   }
@@ -50,6 +50,34 @@ export const readTerminalBudgetDecision = ({ targeted = false, targetedCount = 0
   return { ok: true, targetedCount: nextTargeted, rosterCount: nextRoster + 1 }
 }
 
+// Provider/model reconstruction can deliver a fresh accepted agent turn without
+// another browser `code-turn` frame (context-carry and interrupted-resume paths).
+// Key read allowances to the bridge-owned turn revision as a second reset seam,
+// so a reconstructed runtime never inherits ten reads spent by the old model.
+// This intentionally resets only read allowances; hop/post/spawn loop breakers
+// remain tied to real person ingress and cannot be escaped by reconstruction.
+export const readTerminalTurnBudgetDecision = ({
+  targeted = false,
+  targetedCount = 0,
+  rosterCount = 0,
+  budgetTurnRev = null,
+  currentTurnRev = 0,
+} = {}, limits = PEEK) => {
+  const current = Math.max(0, Number(currentTurnRev) || 0)
+  const previous = budgetTurnRev == null
+    ? null
+    : Number.isFinite(Number(budgetTurnRev)) ? Number(budgetTurnRev) : null
+  const sameTurn = previous === current
+  return {
+    ...readTerminalBudgetDecision({
+      targeted,
+      targetedCount: sameTurn ? targetedCount : 0,
+      rosterCount: sameTurn ? rosterCount : 0,
+    }, limits),
+    budgetTurnRev: current,
+  }
+}
+
 // One shared lane-status classifier for every roster consumer: the bridge wire,
 // read_terminal, and ROOM NOW. Timestamps stay absolute on the wire so clients can
 // keep the displayed age current without a broadcast every second.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.331",
+  "version": "0.7.333",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/review-check.mjs

@@ -17,6 +17,21 @@ const CHECKS = Object.freeze({
 })
 const OUTPUT_CAP = 512 * 1024
 
+// Codex's native read-only/review mode never raises approval cards. MCP tools
+// without annotations are conservatively treated as approval-requiring, which
+// makes `approvalPolicy: never` auto-decline even our immutable readers before
+// their handlers run. Keep the policy next to the implementation and reuse it
+// for both source reads and fixed scratch checks: neither mutates the reviewed
+// target, neither reaches the open world, and repeating either is safe.
+export const IMMUTABLE_REVIEW_TOOL_EXTRAS = Object.freeze({
+  annotations: Object.freeze({
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+  }),
+})
+
 export function reviewCheckCommand(checkId) {
   if (!Object.hasOwn(CHECKS, checkId)) throw new Error('unapproved review check')
   const [command, args] = CHECKS[checkId]