Restore Codex capacity recovery on the current runtime

[clintebbesen]

Upgrading the three T3 servers to upstream 0.0.45 removed the local capacity recovery patch, so terminal model capacity errors again leave chats waiting for a manual Continue. Restore a single 30-second recovery timer per Codex session, cancel on Stop/new requests/session closure, and resume the durable thread rather than repeat the original action request.

The release uses the current upstream 0.0.45 source and native installer. Point the fork's release lookup at this repository so subsequent supported updates keep the fix. Use GitHub-hosted CI runners for this fork because its upstream Blacksmith runner labels have no available runners.

Validation: focused Codex runtime/recovery tests55 passed; recovery, preserved update handoff, and release-index tests25 passed. Native Linux executable built. Server typecheck and full CI/review checked before release.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.1 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.5 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	56.3 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.1 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.5 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.1 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 928a98a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[clintebbesen]

Fixed demonstrated lifecycle defects: recovery retains the original logical turn, Stop settles waiting recovery and interrupts late accepted turns, capacity RPC rejection retries while ordinary failure settles, and terminal events reach orchestration. Added real app-server transport integration tests and cancellation/RPC tests, all 11 passing. Retargeted this PR to the deployed upstream 0.0.45 baseline so the review contains only the custom runtime change.

[clintebbesen]

The unchanged 2,000-value persistence property test exceeded its five-second limit twice on hosted runners. Gave that test a 30-second allowance while retaining every assertion and generated value. The focused property test passes; runtime recovery integration and all server CI shards passed.