fix(proxy): reconcile durable full resend owner

[mhooooo]

Summary

Stop a deterministic pre-dispatch retry loop when a durable HTTP bridge owner and a broad legacy CODEX_SESSION sticky row disagree.

A verified complete resend now starts the fresh bridge on the durable owner without consulting or forwarding the stale broad alias. The proof supports both retained prior assistant output and the response-bound pending-tool-call manifest introduced by #1486.

Root cause

#1486 preserves verified unanchored full resends, but account selection still receives the broad session-header affinity. If the durable bridge row owns the task on account B while a legacy raw session row points at account A, selection returns retryable continuity_owner_conflict. Repeating the same request cannot change either persisted owner, so the client loops.

Changes

• Restack the change directly on current main; the obsolete fix(proxy): avoid stale anchor on durable full resend #1481 dependency commits are gone.
• Represent owner-reconciliation eligibility with an immutable request-local proof bound to the payload fingerprint, durable session, owner, latest response, stored count/fingerprint, and pending-tool-call manifest identity.
• Accept either retained prior assistant output or an exact responses_input_suffix_matches_pending_tool_calls settlement.
• For that proved fresh reattach only, remove the broad session-header selection source and downstream session/turn aliases.
• Keep the durable canonical bridge key and owner as hard constraints, preserve Codex session behavior for later incremental turns, and leave the legacy row unchanged.
• Preserve fail-closed behavior for incomplete resends and conflicting turn-state, previous-response, bridge, and file owners.

Impact

• Fixes the stale broad-owner conflict loop for both ordinary full resends and the tool-loop resend shape covered by fix(proxy): preserve fresh bridge full resends #1486.
• Adds no setting, dependency, endpoint, schema, migration, dashboard surface, or required setup step.
• No dashboard-visible change.

Refs #1393.

Test plan

python -m pytest tests/unit/test_proxy_http_bridge.py \
  tests/integration/test_http_responses_bridge.py -q
502 passed

make lint
passed

make typecheck
passed

npx --yes @fission-ai/openspec@1.6.0 validate \
  reconcile-durable-full-resend-owner --strict
valid

npx --yes @fission-ai/openspec@1.6.0 validate --specs --strict
48 passed, 0 failed

npx --yes @fission-ai/openspec@1.6.0 validate --changes --strict
71 passed, 0 failed

codex review --base origin/main
no actionable regression identified

Checklist

• Conventional Commit title.
• OpenSpec change included and strictly validated.
• Externally failing bridge path covered by integration regression.
• Pending-tool-call resend path covered.
• Lint and type checking pass.
• Simplicity gates reviewed.
• CHANGELOG.md is unchanged.

[Soju06]

Triage note: this attacks a real and distinct defect — #1486 preserves the unanchored full resend but leaves the broad session_header selection source intact, so a stale legacy raw CODEX_SESSION row on account A vs durable owner B can still yield a deterministic retryable continuity_owner_conflict loop. We want this fix.

Two changes before it leaves draft:

1. Restack onto main once fix(proxy): preserve fresh bridge full resends #1486 lands. Your base fix(proxy): avoid stale anchor on durable full resend #1481 is being closed as superseded by fix(proxy): preserve fresh bridge full resends #1486, so the three dependency commits currently in this PR will not merge; the change here is 91d8935c and it should sit directly on top of fix(proxy): preserve fresh bridge full resends #1486's classify_durable_full_resend structure rather than the fix(proxy): avoid stale anchor on durable full resend #1481-shape flags.
2. Extend _VerifiedDurableFullResend._verify to also accept the response-bound pending-tool-call manifest proof (responses_input_suffix_matches_pending_tool_calls) from fix(proxy): preserve fresh bridge full resends #1486, not only responses_input_suffix_retains_prior_output. As written, the owner reconciliation would skip exactly the tool-loop resends fix(proxy): preserve fresh bridge full resends #1486 unblocks — the production shape from HTTP bridge stale anchor loops client-unanchored tool resends #1485 — leaving them exposed to the same conflict loop.

Happy to run review gates once it is restacked, marked ready, and CI has run the test shards (they never started on this draft).

[Soju06]

@mhooooo friendly nudge — #1486 merged on 07-27, so this can now be restacked directly onto main. The two items from the earlier triage note still stand: (1) drop the three #1481-shape dependency commits and rebase 91d8935c onto #1486's classify_durable_full_resend structure; (2) extend _VerifiedDurableFullResend._verify to also accept the responses_input_suffix_matches_pending_tool_calls proof so the tool-loop resends #1486 unblocks are covered. This fix is wanted; once restacked and marked ready, review gates will run promptly. If you don't have bandwidth, say so and we can pick it up.

[Komzpa]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Soju06]

Per the 07-30 maintainer takeover notice (no response for two triage rounds), this has been taken over as #1599: your commit is preserved with original authorship, restacked onto current main (post-#1486/#1394), with the codex P1 addressed via bridge-level failover coverage on top. This PR will be closed when #1599 merges — thanks for the implementation, @mhooooo; happy to hand it back if you return before then.