Audit baseline: 0cc18b8, verified against current master on 2026-09-10.
The supervisor calls agent_install synchronously inside start_session. A first-use harness fetch can therefore delay lifecycle decisions for every other session of that user. Existing child processes keep running; the problem is delayed starts, restarts, and reconciliation.
Source evidence: start_session, install serialization, and 1800-second installation timeout. The install-lock wait defaults to 900 seconds. Bounded waiting avoids an infinite hang but still lets one download block unrelated work for a long time. No live installation was deliberately stalled in the audit.
Recommended direction: run at most one supervised installation per user/harness outside the reconciliation loop. Track a small explicit installing/failed/ready state, keep existing retry/cooldown and deduplication behavior, and retry the waiting session after installation succeeds. Do not add another registry mutation protocol.
Acceptance:
- A stub installer held pending for a bounded test interval does not prevent another ready shell session from starting/restarting.
- Concurrent requests for the same missing harness cause one installation.
- Failed installs honor cooldown and are visible; supervisor restart does not strand an installation permanently.
- Preserve the pinned package source and existing Codex installation-layout handling.
P2: narrower trigger with a real availability impact; existing running terminals are not killed by this condition.
Audit baseline: 0cc18b8, verified against current master on 2026-09-10.
The supervisor calls agent_install synchronously inside start_session. A first-use harness fetch can therefore delay lifecycle decisions for every other session of that user. Existing child processes keep running; the problem is delayed starts, restarts, and reconciliation.
Source evidence: start_session, install serialization, and 1800-second installation timeout. The install-lock wait defaults to 900 seconds. Bounded waiting avoids an infinite hang but still lets one download block unrelated work for a long time. No live installation was deliberately stalled in the audit.
Recommended direction: run at most one supervised installation per user/harness outside the reconciliation loop. Track a small explicit installing/failed/ready state, keep existing retry/cooldown and deduplication behavior, and retry the waiting session after installation succeeds. Do not add another registry mutation protocol.
Acceptance:
P2: narrower trigger with a real availability impact; existing running terminals are not killed by this condition.