Keep HTTP bridge missing-created watchdog armed after prelude - #1580

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

The gap is real: with response_event_count != 0 disarming the deadline (helpers.py:733), a lone owner that sees a reasoning prelude without response.created escapes both watchdogs — _http_bridge_pending_state_is_stale is waiter-triggered and silence-clocked, so the client hangs on heartbeats. Keeping the watchdog armed is the right direction, but as-is this has a regression and misses two chores:

1. Send-time anchoring now kills live streams. A reattached upstream whose response.created was dropped can stream deferred reasoning for >60s: deltas carry no response id, reasoning isn't downstream-visible, so at sent_at + 60s the timeout fires with fail_all_pending=True and force-retires the whole session (upstream_events.py:806-900). Because upstream_model_output_seen is set, _websocket_request_can_replay_before_visible_output (support.py:1210) refuses replay, so the client gets upstream_request_timeout even though response.completed would have carried the id and settled the request. The stale path already solves this exact case by re-anchoring to last_upstream_activity_at when response_event_count > 0 (helpers.py:709) — do the same here instead of dropping the check outright: keep the deadline armed but clock it from the most recent response-lifecycle event.

2. The comment directly below the edit (helpers.py:737-742, "intentionally anchored to the send time until a response-lifecycle event is observed") documents the behavior you just removed — update it.

3. This amends the accepted recover-codex-desktop-idle-bridge requirement, which scopes the owner-side deadline to a send that has "received no matched response.* lifecycle event" (openspec/changes/recover-codex-desktop-idle-bridge/specs/proxy-admission-control/spec.md:7). Needs an openspec delta.

Note overlap with #1543/#1555 (bounded-retry approaches to the same lost-created stall, both superseded by merged #1394) and #1563, which fixes the durable-anchor flavor of #1534 — reconcile anchoring semantics with whichever lands first.

Ping @Komzpa — the direction here is right and we want to land it, but the P1 from the review above is still open at 64e22bd and the fix is small. Rather than deleting the response_event_count != 0 guard outright in _http_bridge_eventless_precreated_deadline (app/modules/proxy/_service/http_bridge/helpers.py:647-658), keep the watchdog armed after the prelude but re-anchor the deadline once response events flow: when response_event_count > 0, clock it from the most recent response-lifecycle activity (last_upstream_activity_at, same re-anchor the stale path already applies) instead of returning sent_at + cap (helpers.py:660-663). As written, a reattached upstream streaming >60s of deferred reasoning — events but no response.created, nothing downstream-visible — hits sent_at + 60s, gets force-retired with fail_all_pending=True, and replay is refused because upstream_model_output_seen is set, so the client receives upstream_request_timeout on a stream that would have settled on response.completed. Two chores to fold into the same push: update the send-time-anchoring comment that documents the old behavior, and add the openspec delta for recover-codex-desktop-idle-bridge (the accepted spec scopes this deadline to sends with no matched response.* lifecycle event). Happy to pick this up with attribution if you're short on time — say the word.