diff --git a/codex_context.yaml b/codex_context.yaml
index a4ba37d..ec8f31d 100644
--- a/codex_context.yaml
+++ b/codex_context.yaml
@@ -84,6 +84,9 @@ SESSION_STATE:
     D24: "Updated deploy_agent.py status validation: deployment success now requires status containing 'Up' and not containing 'unhealthy' case-insensitively."
     D25: "User reiterated file-only output expectation after status-validation request; no code change beyond D24."
     D26: "User requested git commit on 2026-04-22; commit scope includes ./deploy_agent.py and ./codex_context.yaml for log-analysis and status-validation updates."
+    D27: "Git commit created on 2026-04-22: 72290cd 'Improve deploy failure analysis'."
+    D28: "Updated deploy_agent.py second-failure path to return 'ESCALATE_TO_CODEX' with formatted debug block containing service, error, status, and logs instead of returning plain ERROR."
+    D29: "User requested git commit on 2026-04-22; commit scope includes ./deploy_agent.py and ./codex_context.yaml for Codex escalation-path update."
   todos:
     T1: "For all future meaningful changes/decisions, update and overwrite ./codex_context.yaml."
     T2: "DONE: Commit current changes."
@@ -103,6 +106,8 @@ SESSION_STATE:
     T16: "DONE: Commit LLM-assisted deploy retry changes."
     T17: "DONE: Add bounded container log analysis to deploy failure recovery."
     T18: "DONE: Tighten deploy status validation against unhealthy containers."
+    T19: "DONE: Commit deploy failure analysis and status validation updates."
+    T20: "DONE: Add Codex escalation output on second deployment failure."
   issues:
     I1: "Tailscale DNS health warning: configured DNS servers unreachable."
     I2: "Preferred gateway path unavailable: 100.108.208.3:8080 connection failed."
diff --git a/deploy_agent.py b/deploy_agent.py
index 17eb28f..09020dc 100644
--- a/deploy_agent.py
+++ b/deploy_agent.py
@@ -189,9 +189,22 @@ def deploy_service(service: str) -> str:
         ok, error = _run_compose_up(target_dir)
         if not ok:
             status = get_service_status(target_dir)
-            if status and not status.startswith("ERROR:"):
-                return f"ERROR: {error}\n{status}"
-            return f"ERROR: {error}"
+            logs = _get_compose_logs(target_dir)
+            debug = f"""
+ESCALATION REQUIRED
+
+SERVICE: {service}
+
+ERROR:
+{error}
+
+STATUS:
+{status}
+
+LOGS:
+{logs}
+"""
+            return f"ESCALATE_TO_CODEX\n{debug}"
 
     status = get_service_status(target_dir)
     if status.startswith("ERROR:"):