Show recoverable task state when a parent error still has active descendants #34324

Severity: P2 — Warning
Type: Feature
Evidence state: Confirmed
Classification rationale: This is a P2 feature gap because the Codex App presents a terminal-looking task error even though delegated work remains active, creating material operator confusion and a risk of duplicate manual recovery.

Problem

The Codex App needs a recoverable or degraded-running task state. Today, when a parent response is hidden by the cybersecurity-content safeguard, the task can appear as systemError even while an active descendant continues the same durable workflow. The operator sees neither that progress nor whether intervention is safe.

Evidence

• User Report — The Codex App displayed 'This content can't be shown' with the cybersecurity/Trusted Access notice in the affected task. — User-provided Codex App screenshot, observed 2026-07-20
• Runtime — The App task inventory reported the parent as systemError while its latest turn was completed and its delegated campaign-manager task remained active with an in-progress turn and active descendants. — Read-only Codex App thread inventory, observed 2026-07-20

Impact

Operators of long-running delegated workflows cannot tell whether work is stopped, safely checkpointed, or continuing. This causes avoidable stress and can prompt manual retries that duplicate workers, consume additional compute, or create competing writers.

Root cause or gap

Confidence: Confirmed

The task-status UX lacks an aggregate recoverability state that incorporates active descendant execution when the parent response is suppressed or marked as a system error.

Expected behavior

When a parent task cannot display content but one or more descendants remain active, the App should show a non-terminal degraded/recovering state, identify that background work is continuing, and reserve terminal blocked/error presentation for cases where no execution path can progress.

Likely solution direction

Confidence: Likely

Add a derived degraded-running or recovering state based on descendant activity and durable task state. Preserve the safety-hidden content boundary, but expose safe operational facts: whether work continues, whether user action is needed, the last safe checkpoint, and whether resume would duplicate an active execution path.

Likely affected surface

Acceptance criteria

• A parent with a hidden or errored response and at least one active descendant is not presented as terminally blocked.
• The App visibly distinguishes degraded-but-running, paused/checkpointed, needs-user-action, and system-blocked states.
• The degraded state exposes only safe operational metadata and does not reveal content that the safeguard withheld.
• The operator can see whether background work is continuing and whether manual resume risks duplicate execution.
• When all descendants stop, the displayed state deterministically transitions to completed, recoverable, needs-user-action, or system-blocked.

Unknowns and non-goals

Unknowns

• Whether the parent systemError originates in the safety-response layer, task aggregation, or a separate transport error.
• Whether descendant activity is already available to every App status-rendering surface.

Non-goals

• Weakening, bypassing, or exposing content hidden by safety safeguards.
• Changing cybersecurity policy or Trusted Access eligibility.
• Automatically retrying arbitrary failed prompts without durable-state reconciliation.

Provenance and duplicates

• Provenance: Observed during an autonomous research workflow in the Codex App and confirmed through read-only parent/descendant task inventory.
• Duplicate search: no_exact_match — Open and closed issue searches found no report combining a safety-hidden parent response, terminal-looking systemError status, and continuing descendant execution.
• Canonical issue: None
• Prior resolution evidence: None
• Recurrence evidence: None
• Closure premise changed: false
• Related: https://learn.chatgpt.com/docs/cyber-safety
• Withheld evidence: Private task identifiers, absolute local paths, detailed private research prompts, and raw session logs were summarized rather than published.