Codex Security scan becomes uncloseable if temp artifacts disappear after completion

What version of the Codex App are you using (From “About Codex” dialog)?

Codex Desktop 26.715.31925 (build 5551); embedded Codex CLI 0.145.0-alpha.18

What subscription do you have?

Paid ChatGPT plan (local app diagnostics report plan type prolite)

What platform is your computer?

Darwin 25.5.0 arm64 arm

macOS 26.5.2 (build 25F84), Apple silicon

What issue are you seeing?

A Codex Security diff scan reached the product's completed state: every review row was closed, reporting completed, and the scan context reported complete. Before final indexing finished, the app-managed temporary artifact directory disappeared. Finalization then failed with:

Scan directory must be an existing canonical non-symlink directory.

The recovery path cannot terminate the scan either. Attempting the failure transition returns:

A completed scan cannot be marked failed.

This creates an uncloseable lifecycle state: the backend considers the scan complete, final indexing requires ephemeral artifacts that no longer exist, and the only available failure transition is forbidden because completion is already recorded. The Codex Security UI/workspace can remain stuck open with no legal terminal transition.

No repository data was lost, and this report intentionally omits repository paths, local usernames, scan/session IDs, and finding contents.

What steps can reproduce the bug?

Observed product sequence:

1. Open a local Git repository with a diff and start a Codex Security diff scan.
2. Complete the review worklist and reporting phase so the authoritative scan context reports complete.
3. Let the app-managed temporary scan artifact directory be cleaned up or otherwise become unavailable before final indexing finishes. In the observed run, the directory disappeared without the user deleting it.
4. Trigger final indexing/finalization.
5. Observe Scan directory must be an existing canonical non-symlink directory.
6. Attempt the available terminal failure transition.
7. Observe A completed scan cannot be marked failed. The Security workspace remains open and cannot be archived through the scan lifecycle.

For a deterministic integration test, persist a scan record in complete, remove or expire its temporary artifact directory, then invoke final indexing followed by the recovery/termination path.

What is the expected behavior?

Completion should be durable and finalization should be idempotent. Once a scan is complete, loss of an ephemeral artifact directory should not prevent the user from closing or archiving the Security workspace.

The product should either finish from a durable completion manifest, finish with an explicit "artifacts unavailable" warning, or permit a terminal archive/dismiss transition that preserves the completed state.

Additional information

State-transition matrix

| Recorded state | Artifact directory | Event | Actual result | Expected result |
|---|---|---|---|---|
| Reviewing/reporting | Present | Complete scan | Transitions to complete | Same |
| complete | Present | Final index | Normal terminal finalization | Same |
| complete | Missing | Final index | Canonical-directory validation error; UI remains nonterminal | Complete with durable manifest or a recoverable warning |
| complete | Missing | Fail/cancel recovery | Rejected because a completed scan cannot be failed | Preserve complete, but allow archive/dismiss/terminal cleanup |

User impact

• A successfully completed security review can remain permanently open or stale in the UI.
• Repeated finalization attempts cannot recreate the deleted artifact tree.
• The failure transition cannot recover the state because the completion invariant blocks it.
• Restarting or retrying does not provide a product-level terminal record or reliable archive path.

Suggested fixes

1. Atomically persist a durable final manifest before recording complete or allowing temporary artifact cleanup.
2. Keep required artifacts alive until indexing acknowledges them, or copy the final report/index inputs into durable app storage.
3. Treat a missing temporary artifact directory after complete as a degraded-but-terminal condition rather than a fatal canonical-path validation error.
4. Add an idempotent complete -> archived or complete -> completed_with_artifacts_unavailable recovery transition; do not require violating the invariant by marking the scan failed.
5. Always expose a UI archive/dismiss action for completed scans, even when optional indexing cannot be performed.

This is distinct from #32180 (duplicate uncloseable workspace tabs) and #33678 (Windows cannot write the app-managed temporary directory): here the scan completed successfully, the temporary directory later disappeared, and the completed state itself blocks recovery.