Multi-pair: three default-global lifecycle leaks (state.ready error, detachClaudeWs reap, pair-exit not-ready cascade)

[Patrick647]

Identified by Codex during the cross-review of M01 probe fix on PR #81 (msg codex_msg_5753c73beafc_197). These are real but lifecycle-class improvements — out of scope for the M01 must-fix, filed per consensus.

Codex 在 PR #81 M01 fix cross-review (msg ..._197) 时识别的三处仍引用 default 全局变量、对 multi-pair 语义不正确的 lifecycle 漏点。

1. state.ready === false paired error wording uses default globals

daemon.ts:1465-1471 consults the module-level codex.isSessionRestoreInProgress and module-level proxyTuiSlot when formatting the "still provisioning" error message for paired-not-ready chats. For a chat paired with a non-default pair, these globals reflect the WRONG pair's state — the error text could read "Shared Codex TUI thread is still provisioning" when the user's pair is healthy and only the default's isn't, or vice versa.

Fix: look up pairs.get(state.homePairId) and read its CodexAdapter + proxyTuiSlot when generating the wording.

2. detachClaudeWs pair-reap uses default proxyTuiSlot

When a paired Claude's WS detaches and pair-reap timer fires, the cleanup code references the module-level proxyTuiSlot. For a chat homed on a non-default pair, the wrong slot gets cleared. Real symptom likely: pair-reap doesn't release the correct pair's slot, blocking re-pairing on that pair.

Fix: route through pairs.get(state.homePairId)?.proxyTuiSlot (or the PairState getter/setter pair already exposes for default).

3. Pair exit event marks ALL chats not-ready

When one pair's codex app-server exits (crash, kill, OOM), every ChatState — not just chats homed on that pair — gets state.ready = false. This is a cross-pair contamination of crash isolation, the opposite of v2.3's design goal.

Fix: in the pair-exit handler, filter chats by state.homePairId === pair.pairId before flipping ready.

Acceptance

• All three locations route through per-pair lookups (homePairId → pairs.get → that pair's globals)
• Multi-pair probe coverage: extend M02 (kill one pair's codex) to assert OTHER pair's chats stay ready
• Regression unit tests for each location
• Probe M01-M02 still pass after change

References

• M01 probe / fix commits: ebea1d3 + e929e12 on PR feat: STM v2.3 multi-pair vertical upgrade + perf + bootstrap-reap fix #81
• Codex review identifying these: codex_msg_5753c73beafc_197
• Multi-pair probe branch: feat/multi-pair-probes (Patrick647/agent-bridge)

[Patrick647]

Progress update

• Risk feat: add smart message filtering with marker protocol (v1.1) #3 (pair-exit cascade) — fixed in PR feat: STM v2.3 multi-pair vertical upgrade + perf + bootstrap-reap fix #81 commit 8531178 (cherry-picked from probe branch 3d55351). M02 probe verifies fix end-to-end with real Codex CLI: SIGKILL work's codex → side's chat stays ready + reply round-trips. Codex GO sign-off (msg ..._206).

• Risk --dangerously-load-development-channels in Claude cannot be used in third-party platform or api-key #1 (state.ready=false error wording uses default globals) — still open. M02 doesn't exercise this path; likely needs M06 (destroy_pair --force on paired-live pair mid-turn) or a probe variant where a chat hits the "still provisioning" path on a non-default pair.

• Risk feat: add dual-mode message transport (Channel Push + Tool Pull) #2 (detachClaudeWs reap uses default proxyTuiSlot) — still open. Likely needs M06 / M11 (rm --force while paired) to surface.

Additional risk #4 found during M02 fix review

Codex flagged (msg codex_msg_5753c73beafc_206): the pair-exit handler still sets module-level codexBootstrapped = false unconditionally. For a non-default pair crash, this flips the global which may make top-level status look wrong even though surviving pairs are healthy. Non-blocking but should be addressed in the same lifecycle/status cleanup pass as #1 and #2.

Suggested fix: only flip codexBootstrapped when the exiting pair IS default (or remove the global entirely if it's vestigial — the pair-level pair.isLive is the v2.3-correct source of truth).

Probe status

• M01 ✅ shipped + caught paired-inject bug (fixed in PR feat: STM v2.3 multi-pair vertical upgrade + perf + bootstrap-reap fix #81)
• M02 ✅ shipped + caught risk feat: add smart message filtering with marker protocol (v1.1) #3 (fixed in PR feat: STM v2.3 multi-pair vertical upgrade + perf + bootstrap-reap fix #81)
• M03 ✅ shipped (second-TUI WS rejection, no new bugs)
• M04-M12 待续

Multi-pair probes on feat/multi-pair-probes branch (Patrick647/agent-bridge).