[macOS][Desktop 26.818] Logout deterministically trips error boundary after AppServerManager teardown

What version of the Codex App are you using?

• Installed: ChatGPT/Codex Desktop 26.818.41509 (build 6962)
• The current signed production artifact 26.818.41705 (build 6971) was also inspected and contains the same failing renderer cleanup.
• Bundled Codex CLI: 0.149.0-alpha.4.1

What subscription do you have?

ChatGPT account. The specific plan does not affect this deterministic client-side teardown failure.

What platform is your computer?

Darwin 25.5.0 arm64 arm

macOS 26.5.2 (build 25F84).

What issue are you seeing?

Every explicit logout succeeds at the app-server protocol level, but the visible renderer enters the top-level error boundary about 144–233 ms later with:

AppServerManager RPC is not connected

The app process remains alive, but the UI is unusable until the app is fully quit and relaunched.

Sanitized local evidence:

• 10 of 10 observed logouts from August 20–23 reproduced the error.
• 13 of 13 observed logouts from August 9–15 completed without it.
• In each failing case, account/logout returns with errorCode=null before the renderer error.
• No matching macOS crash, hang, Crashpad, Keychain, or signature failure exists.
• The app-server transport remains connected until the user manually quits the app.

This is therefore a deterministic renderer lifecycle regression, not a failed logout, corrupt credentials, or native process crash.

What steps can reproduce the bug?

1. Launch the macOS desktop app and sign in normally.
2. Use the account menu to log out.
3. Observe that logout completes.
4. Within roughly 0.2 seconds, observe the full-page error boundary with AppServerManager RPC is not connected.
5. Attempt to recover without quitting the app; the normal login UI does not settle into a usable state.
6. Fully quit and relaunch; the signed-out UI then loads normally.

What is the expected behavior?

A successful logout should atomically transition to the signed-out route. RPC-dependent effects should unmount or become teardown-tolerant before the app-server manager is cleared. No error boundary or full app restart should be required.

Additional information

Inspection of the packaged renderer narrows the fault to the authenticated home subtree's review-pane metrics effect/cleanup:

• The helper used by the effect reads the AppServerManager atom and throws AppServerManager RPC is not connected when it is null.
• During logout, the manager is cleared while the local host remains in the registered-host list.
• The home component's effect or unmount cleanup sees the stale registered host, calls the throwing helper to set review-pane snapshot metrics, and trips the app-level React error boundary before the login route settles.
• The top renderer frame is the minified usl component in webview/assets/app-initial-*.js; both its effect and cleanup call setReviewPaneSnapshotMetrics through the throwing helper.

Suggested source fix:

1. Make this metrics effect and its cleanup explicitly tolerant of a missing manager/host client; cleanup must never throw during auth teardown.
2. Enter a logging-out state that unmounts RPC-dependent authenticated UI before clearing the app-server provider.
3. Do not weaken the throwing RPC accessor globally without auditing invariant callers.
4. Add one focused regression: keep the host registered, clear the manager, unmount the home subtree, and assert that no error boundary fires and the login view renders.

The post-logout remote-control authorization warning and unauthenticated analytics 401 are secondary cleanup noise, not the root renderer failure.

Related but not an exact duplicate: #39677 covers broader RPC lifecycle divergence after OAuth transitions on Windows. This report is a deterministic explicit-logout cleanup race on macOS with a localized renderer call site.

No raw logs, account identifiers, tokens, email addresses, thread identifiers, private paths, or session content are included.

Start with the authenticated home subtree and the minified usl component in webview/assets/app-initial-*.js, then trace the AppServerManager logout teardown and setReviewPaneSnapshotMetrics calls. Reproduce logout with the host still registered and the manager cleared. Done means the home subtree can unmount without an error boundary and the login view renders without requiring an app restart.