[barelyworkingcode]

Closes #537

Codex and pi sessions run under the file-channel runner, as Claude sessions do. A local codex session keeps its agent across a relay restart; a codex session on a Unix host keeps it across a dropped link. Pi runs under the runner and ends with relay-sessions, as before (its model key is bound to the launch).

Part of epic #525. Contract: the issue's ## Contract with Amendments 1 to 4.

What changed

• T1a runfollow.go: the provider-neutral half of the Claude runner code (follow, send with receipt, link loss, stop/release, replay, cursor). Claude's behaviour, error text, log keys and saved state are unchanged; the suite passed unedited after this commit.
• T1b codex and pi on runConn; codex attaches with no handshake and never answers a request twice; pi runners are killed at shutdown and stopped at startup; manager and relay-side restart checks cover codex.
• Amendment 3/4 runner.sh: the agent's stderr is an anonymous pipe copied to stderr.log. Found by the real-app check: a sandboxed pi (node) aborted at start because the profile refuses fstat on a file (or named FIFO) in the run directory. No profile change.
• T2 e2e tests for every criterion, plus TestRunnerAgentStderrIsPipe; the fake pi writes agent_settled, the fake agent records its stderr kind.
• T3 journey session-codex-host-runner (api phase): a codex session on a loopback host survives relay host disconnect. Codex gets a scratch config home whose only provider is the stack's local endpoint, and no login.

Notes

• Fix attempts: runner stderr fix took three (named FIFO also refused by the sandbox; a wrong descriptor dup; a TERM trap). Everything else first try.
• Tokens: about 1.8M across planner, dev, test, review and checks.
• First base-harness run had session-swap-back FAIL and session-adopt BLOCKED while a real-app check was rebuilding Relay.app on the same box; the rerun with nothing overlapping was green. Not seen again.
• Review minors, left as notes: a codex host start whose handshake fails leaves its run directory until the session is deleted; agent.code is written before the stderr copier drains (nothing reads it); no test covers a stale pi runner left by a crash (decision A12, not a criterion).
• Theoretical (not reproduced): a grandchild holding stderr keeps the runner up after the agent exits until stop; a link drop between a codex server request and its answer; a pi launch overlapping startup's stale-runner stop; a failed turn/start reads as an open turn after a restart.
• Feature map: G1.23, G1.48 and G1.01 rows name the new tests and the journey.

Review: no blocking findings (round 1, default model, at 29abde8; 0b3e44f then changed one test comment and two doc lines from its minors)
Journey: session-codex-host-runner PASS on a stack at 29abde8 (head harness pass=9 fail=0 notrun=2)
Harness weakening: none (one journey added, no journey, timeout or assertion changed)
Main harness vs head: epic-base harness (d26ab6b) against head 29abde8 on a stack: pass=8 fail=0 blocked=0 notrun=2
Break-and-restore: send initialize on codex attach -> TestCodexRunnerNoSecondInitialize red (3 initialize lines); host codex ignores Detach -> journey FAIL (no runner.json); stderr back on stderr.log -> TestRunnerAgentStderrIsPipe red; each restored, shared tree untouched
Real-app check: Relay.app from 29abde8: local codex kept runner pid and start time across quit and reopen, one initialize, send landed in sent/, loopback endpoint answered; stock pi session answered a turn, no runner after quit, dormant then resumed with history

🤖 Generated with Claude Code

[barelyworkingcode]

Weakening reviewed: stateNotRun in the new journey session-codex-host-runner, why: it is that journey's own NOTRUN when no stack local model endpoint exists; no existing journey gains a skip

[barelyworkingcode]

merge-check: merged. approved, target, contract, evidence, owner, weakening