Codex Desktop: thread/resume can return a thread while Shutdown is pending, leaving a dead agent loop

Summary

Codex Desktop can acknowledge thread/resume for an existing thread while a Shutdown submission for that same thread is still pending. The agent loop then exits, but the UI keeps routing turn/start to the stale runtime, causing repeated message submission failures.

Environment

• Surface: Codex Desktop (Windows MSIX)
• Codex App version: 26.715.3651.0
• Platform: Windows 24H2, build 26100.7840, x64

User-visible error

Error creating task
failed to start turn: internal error; agent loop died unexpectedly

Subsequent attempts show:

Error submitting message

Sanitized lifecycle evidence

Local app-server logs show this ordering for the affected persisted thread:

11:43:25  Submission ... op: Shutdown
11:43:35  composing running thread resume response ... active_turn_present=false
11:43:52  Shutting down Codex instance
11:43:52  Agent loop exited
11:45:38  turn/start -> -32603: failed to start turn: internal error; agent loop died unexpectedly
11:45:40  turn/start -> same error
11:45:47  turn/start -> same error

The conversation remained present in the Desktop UI and on disk. There was no matching panic, worker-process exit, or OOM event around this sequence. Restarting only the Desktop codex.exe child backend restored operation.

This looks like a lifecycle race/state desynchronization: the resume path returns a handle to a runtime that is already committed to shutting down.

Steps to reproduce

The trigger is intermittent, but the observed flow is:

1. Open an existing Desktop thread and complete a turn.
2. A thread lifecycle transition submits Shutdown for the loaded runtime.
3. Resume/open the same persisted thread while that shutdown is still pending.
4. After the loop exits, submit another message.
5. Observe repeated agent loop died unexpectedly / Error submitting message.

Expected behavior

One of the following should happen:

• thread/resume waits for the in-flight shutdown and creates a fresh runtime;
• the shutdown is cancelled before resume succeeds; or
• turn/start detects the absent loop and transparently rehydrates the persisted thread.

A resume response should not expose a runtime that can exit immediately afterward while remaining registered as usable.

Actual behavior

The resume path reports the thread as running, the old agent loop exits, and later turn/start requests are routed to the dead instance until the backend is restarted.

Related reports

• #33206 reports the same user-visible error on Windows but does not include the shutdown/resume ordering.
• #23971 reports the same error after a different trigger involving subagent cleanup.

Privacy

Thread IDs, request IDs, local usernames, workspace paths, task titles, prompts, and unrelated log content have been omitted. Additional sanitized excerpts can be provided if useful.