fix(proxy): recover goal restarts from unavailable owners

[leventov]

Summary

A Codex conversation restart can resend a self-contained thread under the same
process-session identifier after its legacy owner exhausts quota. Raw legacy
codex_session rows are intentionally hard, so ordinary requests must fail
closed; before this change, that same row also trapped an explicit,
self-contained goal restart on an unavailable account.

This PR adds one proof-gated direct-routing exception. A request may retire an
unavailable raw legacy owner only when it carries Codex's recognized
goal-continuation marker and its canonical upstream Responses payload is
account-neutral and self-contained. Retirement is compare-and-set,
policy-scoped, and request-owned. Ordinary, incremental, file-pinned,
conversation-bound, and unresolved-tool requests remain fail-closed.

HTTP bridge reuse/replacement is deliberately split into the dependent #1680.
No public wire format, setting, schema, or default timeout changes.

Linked issue: none exists for this incident-derived defect; routed regression
coverage exercises the public Codex Responses and direct WebSocket paths.

Behavior and safety

• Recognize the existing goal-continuation context only after canonicalizing the
  request to the upstream Responses body.
• Permit guarded retirement only for a raw legacy process-session row whose
  owner is durably PAUSED, RATE_LIMITED, or QUOTA_EXCEEDED.
• Require the persisted owner to be inside the authenticated request's effective
  account-policy scope.
• Compare mapping owner and unavailable status atomically; a concurrent owner
  change or recovery wins.
• Exclude a successfully retired owner from the remainder of the same selection,
  even when selection loaded a stale ACTIVE account snapshot.
• Preserve request-scoped authority through direct WebSocket selection and strip
  only proxy-generated turn state when the restart changes accounts.
• Keep every unproved or account-dependent continuation hard owner-bound.

OpenSpec

• Behavior is specified by the archived, verified change at
  openspec/changes/archive/2026-08-10-recover-restarted-conversation-affinity/.
• Stable requirements and rationale are synchronized in
  openspec/specs/sticky-session-operations/.
• Parent requirements cover canonical classification, scoped CAS retirement,
  stale-selection exclusion, and direct WebSocket state provenance.
• HTTP bridge requirements are isolated in the stacked fix(http-bridge): preserve goal-restart recovery across reconnects #1680 delta.

Origin and concurrent work

Landed lineage:

• fix(proxy): purge stale hard codex_session mappings pinned to a durably unavailable owner #1417 (b1d27bc6) introduced bounded stale hard-owner cleanup while keeping
  hot-path requests hard. This PR preserves that default and adds only a
  proof-gated explicit-restart path.
• fix(proxy): preserve developer-interleaved fresh resends #1537 (201281b5) established the canonical account-neutral fresh-resend
  classifier. This PR reuses that boundary rather than defining another movable
  payload heuristic.
• fix(proxy): never inject a cross-account previous_response_id anchor (takeover of #1274) #1638 (68397054) enforced ownership of previous_response_id; requests with
  that anchor remain immovable here.
• fix(proxy): fail over stuck HTTP bridge owner requests to a fresh account #1401 (f2f8f916) and fix(proxy): recover dead durable bridge anchors fast #1625 (85f1ee4b) expanded bridge recovery and
  dead-owner handling. Their bridge lifecycle concerns are handled separately by
  fix(http-bridge): preserve goal-restart recovery across reconnects #1680, not hidden in this object.

Concurrent work reviewed for overlap:

• fix(http-bridge): preserve goal-restart recovery across reconnects #1680 is the dependent HTTP-bridge object. It consumes this request-scoped
  capability and must merge after this PR.
• fix(proxy): durably recover hard HTTP bridge operations #1657 overlaps bridge/durable operation recovery but not this PR's sticky CAS
  and direct-selection boundary; its overlap is documented in fix(http-bridge): preserve goal-restart recovery across reconnects #1680.
• fix(http-bridge): keep idle retirements out of retry circuit #1677 is independent retry-circuit evidence work and is not a parent of this
  PR.
• fix(proxy): make durable bridge claim_session a real compare-and-set #1643/fix(proxy): recover ownerless durable bridge leases (bridge_instance_mismatch regression) #1648 change durable bridge claim semantics but do not authorize legacy
  sticky-row retirement.
• feat(proxy): add OpenAI-compatible fallback for exhausted subscriptions #1664/fix(compact): recover previous-response-pinned compaction when the owner account is unavailable #1490 add separate subscription-overflow and compact recovery paths;
  neither may reinterpret an ordinary hard session request as a restart.

Review findings addressed

Concrete review findings incorporated in this object:

1. retirement must be limited to the authenticated account-policy scope;
2. successful retirement must override stale account-selection snapshots;
3. accepted compatibility and transport-envelope fields must classify through
   the canonical upstream request body;
4. proxy-generated direct-WebSocket turn state must not cross the account
   change, while client-supplied state remains hard.

Validation

relevant unit tests: 1,104 passed
focused Ruff check/format: passed
OpenSpec validation: 49 specs passed, 0 failed
git diff --check: passed

Fresh current-head cloud CI is in progress after the object-level history split.

Screenshots / output

No dashboard-visible change.

Before:

marked self-contained restart + unavailable raw owner -> hard-affinity failure

After:

verified marked restart -> guarded CAS retirement -> eligible replacement owner
ordinary/account-dependent request -> unchanged fail-closed ownership

Simplicity

• Zero configuration; no setting or environment variable.
• No migration, setup step, README section, or dashboard surface.
• Reuses existing replay classification, sticky tombstones, and selection.
• No new retry budget or timeout.

Checklist

• Conventional Commit PR title.
• OpenSpec behavior is present, synchronized, verified, and archived.
• Direct route, direct WebSocket, scoped-policy, and stale-snapshot
  regressions are included.
• Simplicity gates P1-P5 reviewed.
• CHANGELOG.md was not edited.
• Current-head cloud CI green.
• Current-head Codex review evidence clean or all findings addressed.

[Komzpa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd554303b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the provenance of legacy rows before tombstoning

When a client supplies a session_id equal to a raw row originally written from an explicit x-codex-turn-state, this condition treats the request as process-session provenance and later permits that row to be tombstoned if its owner is unavailable. The legacy namespace deliberately mixes both sources, and these client-controlled headers can collide within the same effective account-policy scope, so current-request provenance does not prove the persisted row's provenance; one session can consequently retire another session's hard turn-state ownership and break its later continuation. Store or migrate row provenance, or keep ambiguous raw rows fail-closed.

AGENTS.md reference: AGENTS.md:L105-L110

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Force goal restarts through selection on the HTTP bridge

This forced reselection covers only direct downstream WebSockets. With the default http_responses_session_bridge_enabled=True, a warm HTTP bridge session can be returned by _get_or_create_http_bridge_session before account selection runs; _http_bridge_session_account_active deliberately excludes RATE_LIMITED and QUOTA_EXCEEDED from its routing-unavailable snapshot, so when another request or replica persists either status after the socket opened, the cached session can still appear active. A marked restart is then submitted on the old account without invoking the new tombstone path or selecting a replacement—the added routed regression avoids this by disabling the bridge. Apply the same pre-dispatch retirement and reselection behavior to HTTP bridge reuse.

AGENTS.md reference: AGENTS.md:L105-L110

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Check mutation authority before model eligibility

When unavailable owner A is authorized by the caller but does not support the restart's requested model while replacement B does, _load_selection_inputs builds effective_continuity_owner_candidates by model-filtering scoped_accounts, so this test incorrectly treats A as outside the authenticated policy scope. The raw row therefore remains hard, A is absent from the selectable model pool, and the marked restart returns hard_affinity_saturated instead of moving to B. Derive retirement authority from the authenticated account-assignment/security scope before model and service-tier eligibility are applied; keep those latter filters only for replacement selection.

AGENTS.md reference: AGENTS.md:L105-L110

Useful? React with 👍 / 👎.