What changed

• Settle a Command Center run as failed when provider startup records an orchestration session error before native provider events begin.
• Keep the failure transition idempotent and revoke the run's active MCP scope.
• Provide the orchestration runtime to the lifecycle layer so its new event subscription can resolve at server startup.
• Put the Codex Update or reinstall action beside the installed version when no newer-version advisory is present.
• Add regression coverage for startup errors that previously left a route receipt stuck on Working / Running.

Why

Command Center marks a run as running as soon as its provider turn is dispatched. A Codex startup failure can occur before the provider runtime emits the event normally used to close that run. The linked task therefore showed Failed while the routing receipt stayed Running.

The lifecycle change also introduced an OrchestrationEngineService dependency without providing OrchestrationLayerLive to RunLifecycleLayerLive. Packaged desktop backends then exited with Service not found, leaving Electron running without creating a window.

The provider repair action added in #12 was also available only inside expanded provider details when Codex was current, making it difficult to discover in the missing-Windows-sandbox-files case.

Impact

Failed Codex startup now appears consistently as failed in the task, sidebar, and route receipt. The desktop server resolves its lifecycle dependencies and launches normally. Windows users with a managed Codex installation can directly update or reinstall it from the provider row, even when it reports the latest version.

Validation

• 18 focused server and web tests passed for the original lifecycle and provider-card changes.
• Rebased focused RunLifecycle suite: 5 tests passed.
• Server and web TypeScript checks passed; the rebased server typecheck also passed.
• Focused ESLint, formatting, and diff checks passed.
• Gitleaks 8.30.1 reported no leaks; vp staged --concurrent 2 passed.
• Built the Windows x64 NSIS artifact, installed it, and verified a responding Command Center window, a listener on 127.0.0.1:3773, and HTTP 200 from the environment endpoint.
• The broader server test file passed 119 tests; two unrelated Windows-environment cases failed on a path-separator assertion and symlink EPERM.
• node scripts/public-leak-scan.ts --staged did not complete on this Windows checkout and timed out twice after ten minutes without reporting a finding.

Model: GPT-5 via Codex desktop app.