fix(ghosts): supersede Codex ghosts by provider item id - #1383

Fixes #1231.

Plan: docs/plans/2026-09-27-codex-ghost-item-identity.md (first commit).

Problem

Codex text ghosts were never superseded.

• Ghost side. A Codex ghost is keyed by the proxy response id (resp_…).
• Committed side. The committed rollout entry carries only codexTurnId, the rollout's turn_context UUID. reconcileUpstream compared the two, which can never be equal.
• No fallback. Text blocks have no tool id to pair on.

So every Codex text ghost orphaned after 30 s. It stayed hidden only by render rules 3 and 4 in selectMergedEntries, as a latent identity weakness (P3 after #1235).

Root cause and evidence

The only id the live stream and the rollout share is the provider item id (msg_…, rs_…, fc_…, ctc_…):

• the codex proxy adapter already carries it on each live block (SemanticLiveBlock.itemId);
• the rollout has it on every response_item.

On six real Agent Code codex-cli 0.157.1 sessions (proxy dumps against their rollouts, 2026-09-27), all 45 msg_… ids seen on the proxy stream were present verbatim in their rollouts.

Change

• Mapper. mapCodexRolloutToFeedEntries stamps codexItemId (the item's payload.id) on every entry it maps from a response_item (stampCodexItemId).
• Ghost. ghostContextForBlock records the block's itemId in the ghost's context, atp's free-form slot. No package change.
• Match. reconcileUpstream supersedes a ghost when context.itemId === entry.codexItemId.
• Dead branch removed. The codexTurnId === ghost.turnId branch compared a rollout UUID with a response id and could never be true. The stale comments claiming the mapper stamped the response id are corrected in ghosts.ts, rollout.ts and Feed.tsx.
• Kept. codexTurnId stamping stays: the feed's committed-text keys (renderUnits.ts) use it.

Tests

ghosts.codexItemIdentity.test.ts uses one real 0.157.1 assistant message seen from both sides (testing/fixtures/ghosts/codex/message-item-identity.json): the proxy SSE frames and the rollout record for the same msg_…, verbatim. The text is a one-line reviewer commentary.

The chain, all real code:

1. The frames drive the real CodexResponsesAdapter (codex-headless adapter harness) and the real foldSemanticEvent.
2. The ghost is minted by ghostsFromSemanticTurn.
3. The rollout record goes through the real mapper and reconcileUpstream.

The ghost must be superseded by that entry. A message with a different id must not supersede it.

Fail-first. Red on main, where the ghost is not superseded. Each half of the fix is pinned by mutation: dropping the ghost's itemId, or the mapper stamp, turns it red.

Verification

• npx tsc -b clean (testing/fixtures/ghosts/**/*.json added to tsconfig.web.json).
• src/renderer/src/session-runtime, src/renderer/src/features/feed, src/providers/codex and src/renderer/src/workspace: 235 files, 1,721 tests.

Out of scope

• The token_usage_record route ({turn_id, response_id} after each response). The item id is exact per block and needs no lookahead; parser#38 tracks the record type itself.
• Tool ghosts (fc_…, ctc_…) get the same item-id match, and still also pair by tool_use_id / call_id.
• Reasoning ghosts are unchanged (residual, review a). A reasoning response_item maps to no feed entry, so a reasoning ghost (rs_…) has nothing to be superseded by. It still orphans after 30 s and stays hidden by the same render rules as before.
• Ordering corner (residual, review c). Reconcile runs once per appended entry. If a rollout line reaches the renderer before the proxy finishes the block that mints its ghost, that ghost is never matched. It was the behaviour for every Codex ghost on main and is now only this corner. The follow-up is to re-reconcile recent entries when minting.
• Blocks that mint no ghost (web search, image generation, local shell, tool search) are unaffected.
• Review a's P3: three stale WHY comments about the old turn-id match are corrected in 2609c3ac.

🤖 Generated with Claude Code