"Which helper is current" is implemented twice, and neither copy checks process identity

[possibilities]

Follow-up from CodeRabbit review of #665; the code belongs to #664 rather than to that PR.

Two sites pick a live running helper by newest updatedAt, falling back to the freshest record, using isProcessAlive(pid) alone as the liveness test:

• lib/codex-manager/commands/rotation.ts:576-587 (liveAppRuntimeHelpers / selectAppRuntimeHelperStatus)
• lib/runtime/runtime-current-account.ts:168-188 (its own byRecency sort and live filter)

A single codex-multi-auth rotation status run executes both copies, so any drift between them produces a status line and an account marker that disagree.

The shared gap is identity: a stale legacy runtime-rotation-app-helper.json whose PID was recycled passes isProcessAlive, counts as live, and can be selected as the current helper — the exact trust that #664 removed from the helper's own idle reaper, still present in the readers. lib/runtime/app-bind.ts:1233-1236 already parses startedAt, so the identity check is available.

Suggested: one shared selector used by both call sites, with startedAt parsed in readAppRuntimeHelperStatusFile so liveness can be identity-checked. Regression case: two live per-PID status files plus one stale legacy file with a recycled PID, asserting both readers agree.

Credit: CodeRabbit, on #665.

[coderabbitai]

🔗 Related PRs

#648 - fix(codex): route resume/fork through the canonical home and bound helper shutdown (#647) [closed]
#658 - fix: resolve issues #652–#656 [merged]
#660 - fix(codex): route app-server through the canonical home (#659) [open]
#664 - fix(codex): stop runtime helpers from leaking past their idle timeout (#663) [open]
#665 - fix(codex): reap app helpers stranded by the detach grace [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[ndycode]

Fixed by #669, merged to main in 0e66b1f.

Left open by a syntax slip in the PR body: Closes #666, #667, #668 only registers the keyword against the first number, so #666 closed automatically and this one did not. Closing by hand.

• "Which helper is current" is implemented twice, and neither copy checks process identity #667 — both hand-rolled selectors replaced by selectRuntimeHelperStatus in lib/runtime/app-helper-selection.ts; printRotationStatus now selects once and threads one now through the status line, the live count and the account marker. Liveness is identity-checked via record freshness, and PIDs are validated as positive integers.
• Helper-lifecycle test hygiene: PID sentinels, process.ppid, an unexercised selector branch, and a shipped test hook #668 — PID sentinels and process.ppid replaced with processes the tests own; the recency sort exercised with two live candidates; all seven fault injectors in the published wrapper gated behind an explicit opt-in with a strict digits-only parse; the owner-path literal reuses resolveRuntimeHelperOwnerPath.

Covered by regression tests plus a stress suite at the scale of the original report, mutation-checked.