[ndr-ds]

Two defects found by reviewing the eight already-merged provider PRs (#67–#74) as unreviewed code. Both are silent: neither produces an error, a wrong-looking row, or a failing test.

1. codex -C/--cd <DIR> sessions were never discovered

scan_codex_sessions correlates rollouts to processes by cwd, reading the process side from /proc/<pid>/cwd.

But codex -C/--cd <DIR> moves the agent's working root, not the process's cwd (codex --help, codex-cli 0.148.0). So the rollout records <DIR> while /proc reports whatever directory the shell was in, the two never match, and the session simply never appears.

The failure mode is an absent row rather than a wrong one, which is the hardest kind to notice — the dashboard looks fine, it is just missing sessions.

Fixed by preferring the flag when present: working_root_override parses the command line agentctl already captures in LiveClaudeProc::args, accepting all three spellings clap accepts (-C dir, -Cdir, --cd=dir, --cd dir).

Writing the test caught a bug in the parser and in my own expectation: I asserted -C=x should yield None, and the parser returned Some("=x"). clap accepts -C=value for a short flag, so the right answer is Some("x") — both are corrected.

2. A registry round-trip silently converted Codex to Claude

SessionEntry had no provider, and AgentSession::from_registry_entry builds via from_raw, which stamps AgentProvider::Claude unconditionally. Any Codex session reaching the registry would come back as Claude — and be resumed with claude --resume <ULID>: wrong binary, wrong id format.

Not reachable today, and I checked rather than assumed: try_live_sessions — the registry mirror source — reads the Claude pointer directory directly and never calls scan_sessions, so Codex rows never enter the registry. It is a trap armed for whoever wires them in.

SessionEntry.provider is #[serde(default)], so every registry file already on disk keeps parsing and keeps meaning Claude. The file is shared between the laptop and every sandbox, so an older binary must still read a newer one — serde ignores unknown fields by default, which it does. Asserted directly: a legacy JSON entry with no provider key parses as Claude.

Every SessionEntry construction site was audited, not just the ones the compiler flagged. The only production site the compiler did not flag spreads ..entry.clone(), which preserves the field; the hook writer now sets Claude explicitly, correct because only Claude Code fires our hooks.

Coverage, stated honestly

a_registry_entry_keeps_its_provider_across_a_round_trip fails against the unfixed code.

the_working_root_override_is_read_from_the_command_line covers the parser but not its wiring into scan_codex_sessions — reverting that call site leaves the test green. That path needs a live codex process and a real ps, so it is not unit-testable here. This is the same gap class that #74's mutation test exposed in the terminal layer, and I would rather name it than imply coverage I do not have.

Process note

These eight PRs went out without the adversarial multi-agent review the repo's own conventions require. It ran on #66 and caught three defects invisible to tests, clippy and fmt; skipping it for #67–#74 is why both of the above shipped. The multi-agent pass is running now against the same cumulative diff; anything it surfaces beyond these two lands as a follow-up.

Verification

cargo fmt --check and cargo clippy --all-targets -- -D warnings clean. 754 lib tests plus 7 discovery tests.

perf_do_refresh_io_… and refresh_nonblocking_kicks_worker_under_runtime fail on a loaded box and pass in isolation — wall-clock assertions, untouched here.