Authorized host monitor repair, reviewed by the parent operator before integration and deployment. Scope: the existing pipeline monitor continuation mechanism; no model, approval, sandbox, session or credential permissions changed.
Gitea runs 4046 and 4051 succeeded, but watches 7 and 8 failed to continue thread 01a0ed9f-da52-7021-8a59-19fa47203ddf. journalctl -u codex-pipeline-resume-7.service -u codex-pipeline-resume-8.service records active-writer conflicts at 17:58:01 and 18:04:02 UTC on 2026-09-29. The monitor had unconditionally launched codex exec resume while the managed app server already owned the thread; it retained only exit status 1 in watch state.
PR ProfileBackups/ax_julian #21 merged as 708ebf1e9f8d1888577bdab3901f6d0d718d8c9d, reviewed head 1ac9d11f89852889120785e32fa5dd80a566624d (parent reviewed 8066a1c and requested the final bounded reconciliation-error handling).
The monitor now validates the existing managed daemon identity and Unix socket peer, defers observed active/other-writer threads durably, serializes watch dispatch, and submits the exact registered terminal event through that owner. It preserves Goal pauses on failed/deferred/uncertain delivery, restores only a still-matching monitor pause after accepted delivery, retains accepted turn IDs, and reconciles uncertain delivery from exact client ID and terminal-text evidence without replay. The additive schema migration is serialized. The daemon lacks an atomic idle-start precondition; an unavoidable race can append the registered event to a turn started after the idle read. It does not interrupt/cancel that turn or open another writer.
The canonical working tree was clean and fast-forwarded to the reviewed merge while the monitor timer/service were stopped; no resume units were active. /usr/local/sbin/codex-pipeline-monitor remains a symlink to /home/ax_julian/ProfileBackups/ax_julian/host/pipeline-monitor/codex_pipeline_monitor.py. Deployed SHA-256 135bc216b1ecf81f6da36a1ffecf31260099a7c092a6e29cc53186171a7aab96 matches the reviewed worktree source. The timer was restarted and reports active/waiting.
Source syntax review and whitespace checks passed. Deployed resume-watch 7 --dry-run identified daemon PID 3756153, the affected thread active, and would_deliver:false; watch 4 identified an idle thread and would_deliver:true. These inspections did not start a model turn or change any watch/Goal/session/lock. Historical failed watches 1–12 remain preserved and were not requeued. Only the nullable resume_turn_id column was added to the retained watch database.
Actual accepted idle continuation, ambiguous-send recovery and a concurrent delivery race were not exercised; no synthetic autonomous model call was launched. delivered means accepted terminal evidence with a returned/recovered turn ID, not completion of the owning task or its deployment/acceptance work.
The previous executable source is preserved at /var/lib/codex-pipeline-monitor/rollback-20260929-2c90e66.py, SHA-256 597ef99f16c635ac54becce6bd52f7a6fcc9f6b4829aaabf470afac0f4761f6e. For an authorized rollback, stop the monitor timer/service, verify no resume unit is active, point the executable at this retained revision or restore the prior source through the canonical repository, then restart the timer. Preserve the watch database, sessions, locks and held/deferred evidence; the previous source ignores the added column. The old mechanism still has the known active-writer defect, so rollback is containment evidence, not a functional repair.
PR ProfileBackups/ax_julian #24 merged to main as 09ae702e118a5f90456e37106b8abe1a5962aa00 at 21:16:36 UTC. Its reviewed change retains structured app-server RPC errors and defers only the exact pre-submit thread/resume active-writer rejection, or a fresh writer/status change, as resume_waiting. The monitor records current owner evidence and retries through its existing poll. Transport gaps, missing/stale daemon evidence, and errors after submission remain held; uncertain submission is not replayed. The change preserves queued history and a later user pause.
The installed /usr/local/sbin/codex-pipeline-monitor is a root-owned mode-0700 regular file with SHA-256 7c0ae241d5e938e68d5f52bca6ee3bf2404dec244e038ee30e52022c76cce1cf. The one-minute systemd timer is active; service runs at 21:19:55 and 21:20:56 UTC exited successfully. The retained read-only watch database still contains watches 1–12, watch 15 (run 4116, resume_failed from the prior pre-submit writer rejection), and canceled watches 18–19. No historical watch was retried or changed during this check.
PR #24 reports 12 isolated fixtures passing and two outcome checks distinguishing its behavior from the reviewed main version. These are source-level fixtures; no live daemon continuation, provider/model call, or systemd resume was used to test the race. The earlier section's deployed hash and limitation statement describe the previous monitor revision; this follow-up records its successor.
The installed source from PR24 delivered watch22 exactly once through the existing managed owner: Gitea candidate run4131, expected revision 64124b7be6c4aaf7a43568514015e5c04f9bd28c, result failed, accepted turn 01a0ef20-e0b8-7482-bcb2-f7710e109404. The owning turn read the stored watch record as delivered and inspected the exact failure logs. This is ordinary authorized repair work, not a fabricated test model invocation. No active Goal existed, so registration did not suspend or restore one.
The candidate failed a runtime-checkpoint database test; actual finalize/integrate/deploy tasks were skipped. The monitor's normalized skipped-job labels are not deployment evidence. Live production and TEST retain the previously verified 18e0be36d26a91f96878c63745088fbad458af03 candidate. Global, implementation and requirements automation pauses remain in place. Historical continuation failures and subsequent accepted delivery IDs remain retained.