[Juliusolsson05]

Root cause

Codex queued follow-up prompts in runtime.queuedMessages are local UI placeholders. They normally clear when the matching committed rollout user row is ingested (the codexPromptsMatchForOwnership ownership filter). When the rollout tail stalls or drops that row, the queued item sticks forever — and the QueueStrip stays visible even after the session is fully idle (#241).

The existing shouldClearIdleCodexQueuedMessages invariant (queueInvariants.ts) already encodes the correct all-idle condition, but it was only ever evaluated at three edge sites: onSessionProcessState, onSessionSemanticEvent, and bootstrap_complete. Idle for Codex is assembled from multiple channels (process-state, semantic phase transitions, JSONL tail). When the last idle signal arrives through a channel that doesn't re-run the invariant, nothing reconciles the queue and it sticks.

Fix: edge-triggered → convergence-triggered

The three edge-site clears remain as the fast path. This PR adds a backstop in the existing ~1s GHOST_ORPHAN_SWEEP_MS sweep timer (useIpcSubscriptions.ts): after the ghost-GC pass, it re-evaluates the same queue invariant per session and clears a stale Codex queue when idle has converged. The two passes compose into a single setRuntimes patch per tick (no early continue between them).

Quiet-window safety gate

A timer backstop risks clearing during the sub-second gap between a turn_completed (everything momentarily looks idle) and the next queued follow-up's turn_started. To prevent that, the sweep only clears once idle has been STABLE past a new QUEUE_IDLE_RECONCILE_MS (2000ms) quiet window, measured from the newest of phaseChangedAt / lastJsonlEntryAt. This makes the clear convergence-triggered: wait for signals to quiesce, then reconcile.

Provider gate protecting Claude

shouldClearIdleCodexQueuedMessages gains an optional providerReportsPendingQueue?: boolean (default false, documented hook) that is AND-ed into the result. Codex emits no such signal today, so every caller passes the default. The existing provider === 'codex' clause keeps the whole mechanism Codex-scoped — Claude's provider-owned queue-operation queue is never touched by this lifecycle reconciler.

Invariant (must hold)

A Codex queued item is cleared ONLY when, after idle has been stable past the quiet window, ALL of: provider === 'codex', queuedMessages.length > 0, processActive === false, streamPhase === 'idle', awaitingAssistant === false, and no provider-reported pending queue. NEVER for Claude, never while any live signal is present, never before the quiet window elapses.

Verification

• npx tsc -p tsconfig.web.json --noEmit — zero new errors in touched files.
• Manual repro: queue a Codex follow-up while output is live, then induce a stalled/dropped rollout tail so the committed user row never reaches the renderer. Previously the QueueStrip stayed stuck after the session went idle; with this change the sweep clears it ~2s after the last activity signal quiesces (queue_idle_reconcile feed-debug entry confirms the clear).

🤖 Generated with Claude Code