fix(debug): a fresh session's debug bundle finds its own proxy run

[Juliusolsson05]

Part of #1336. It is the Agent Code side of Juliusolsson05/codex-headless#70, whose review a (P1) found this.

Problem

• Where the run lives. A proxy writer picks its run's session segment once, at process start: resume-<id> when the process was launched to resume a known conversation, else shell-<sessionId>. See codexSession.ts allocateProxyEventsFile and claudeSession.ts:352.
• What the bundle asks for. A fresh session learns its providerSessionId from its first turn, after the run dir already exists under shell-<sessionId>, and nothing renames it. assembleAndSaveDebugBundle then asked only for resume-<providerSessionId>.
• Result. The reader answered match: 'none', so every manual bundle of a fresh session that had taken a turn had no proxy section at all: no events tail, no latest-request-body.json. That holds for Codex and Claude alike.

Change

When resume-<id> finds nothing, the bundle retries with the pane's own shell-<sessionId> key.

• The fallback key is pane-keyed. shell-<sessionId> can only find this pane's own run. The IPC shape is unchanged.
• Known pre-existing gap (review a), bug(debug): a bundle picks the proxy run by conversation key, so it can bundle another pane's resumed run #1405. resume-<id> names a conversation, not a pane. A pane whose conversation was later resumed in another pane can bundle that other pane's run. Main already asked only for resume-, so this PR neither adds nor fixes that. The fix, recording each pane's launch-time proxy key, is filed as bug(debug): a bundle picks the proxy run by conversation key, so it can bundle another pane's resumed run #1405.
• resume- stays first, because a resumed process writes there.
• Manifest. The manifest records the segment that matched.

Tests (saveDebugBundle.renderer.test.ts, real bundle assembly, window.api stubbed as readProxyEventsForBundle answers)

• A fresh run under shell-pane-1, with provider id thread-1: the bundle asks for resume-thread-1 and then shell-pane-1, and carries the proxy file. Red on main.
• A resumed run: only resume-thread-1 is asked for.
• Review a: the manifest records the segment actually read. When neither key has a run, both are asked and nothing is bundled. With no provider id yet, the one key is asked once, even on a miss. Dropping the duplicate-key guard, or accepting a none fallback answer, now fails.

Verification

• npx tsc -b clean at edac9741.
• src/renderer/src/features/debug and proxyEventsReader.test.ts: 10 files, 63 tests.

Follow-up in this issue

Bumping packages/codex-headless to codex-headless#70, and updating proxyEventsReader.ts's sidecar comment for the Codex invariant, both wait until #1366 (which moves the same gitlink) and codex-headless#70 merge.

🤖 Generated with Claude Code

[Juliusolsson05]

Disposition for review a (head edac9741)

• P1: a fresh pane can bundle another pane's resumed run. Valid, but pre-existing. Filed as bug(debug): a bundle picks the proxy run by conversation key, so it can bundle another pane's resumed run #1405 and scoped out here.
  • On main, every bundle with a provider id asked only for resume-<id>, which is a conversation key, so the same mix-up already happens there. This PR only adds a pane-keyed fallback when resume- misses, and that fallback cannot find a foreign run.
  • The correct fix records each pane's launch-time proxy key, as the process chose it, and asks for exactly that. That spans sessionManager spawn, both provider sessions, the session meta and the Claude package (bug(debug): a bundle picks the proxy run by conversation key, so it can bundle another pane's resumed run #1405).
  • The false comment ("both keys name THIS pane's own runs") and the body are corrected.
• Manifest after two misses, and the untested branches. Fixed.
  • Tests now assert the manifest's matchedSessionSegment and requestedSessionKey on a fallback hit.
  • The both-miss case asks for both keys and bundles nothing.
  • With no provider id, one key is asked once, even on a miss.
  • The two surviving mutations (dropping the duplicate-key guard, accepting a none fallback) now fail.

[Juliusolsson05]

Status (W1): held and recommended to close in favour of #1405. Review b is FIX-BEFORE-MERGE, and its finding is structural:

• Stale runs. Recovery reuses the pane id while each process picks its proxy segment afresh. So the shell- fallback can bundle a run from a PREVIOUS backend lifetime, or even from another conversation after same-id recovery, and label it exact. Main would have omitted the proxy section there, so this is new risk, not only the pre-existing bug(debug): a bundle picks the proxy run by conversation key, so it can bundle another pane's resumed run #1405 cross-pane case.
• Name matching is not provenance. Neither key proves that the run belongs to this pane's current process.

The correct fix is #1405: record each process's proxy run (segment + run dir) at launch, keep it on the pane, and bundle exactly that run. That touches the spawn plumbing (sessionManager, useIpcSubscriptions), which other open PRs are changing. Awaiting the manager's call.

[Juliusolsson05]

Closed by B6 (manager, owner proxy) during the owner's PR freeze: the fix needs a launch-time run identity (tracked in #1405), which is new work under the freeze. Nothing is deleted. The branch stays on origin and the PR can be reopened. The linked issue stays open with this PR's findings as its starting point.