fix(http-bridge): preserve goal-restart recovery across reconnects

[leventov]

Summary

This PR is the HTTP-bridge follow-up to #1679. It carries the verified,
request-scoped goal-restart capability from direct WebSocket routing through
bridge lookup, durable ownership, replacement, pre-dispatch reconnect, and
detached-generation retirement.

It is intentionally stacked on #1679. Until #1679 lands, GitHub's diff against
main also displays the parent commits; the object-level review range is:

cd554303..9881614e

Do not merge this PR before #1679.

No public wire format, setting, schema, or default timeout changes.

Linked issue: none exists for this incident-derived defect; regression coverage
exercises the externally failing /backend-api/codex/responses path.

Behavior and safety

• Force a verified self-contained goal restart through authoritative bridge
  selection instead of silently reusing or forwarding a bridge owned by the
  unavailable account.
• Keep restart authority request-scoped across pre-dispatch reconnect, without
  persisting it on a bridge for later ordinary requests.
• Preserve hard ownership for typed continuations, uploaded files, unresolved
  tool state, and every request that does not satisfy fix(proxy): recover goal restarts from unavailable owners #1679's proof gate.
• Keep a canonical replacement registered while the retiring bridge drains, and
  fence prior durable ownership during canonical takeover.
• Preserve an already reserved predecessor request's authority to submit on its
  detached lane after queue publication clears the mutable reservation marker.
• Track detached live generations until their close tasks complete, including
  them in session-cap accounting, drain status, and shutdown cleanup.
• Fence detached predecessors from publishing continuity aliases under the
  replacement generation's canonical key.
• Finalize detached ownership through one common close path, including direct
  terminal recovery, drained reservation cleanup, and account invalidation.
• Defer direct-close cancellation until owned resources are finalized, then
  re-raise it without dropping detached lifecycle tracking early.
• Advance same-replica replacement owner epochs so a late predecessor durable
  release cannot close the replacement generation lease.
• Make handoff settlement and detached-session retirement exactly once across
  prewarm, submit, send-failure, and post-handoff cleanup paths.
• Allow only the authorizing goal-restart reconnect to leave an owner that
  failed before response.create; account-neutral typed recovery remains
  owner-bound.

OpenSpec

• Extends the archived, verified change at
  openspec/changes/archive/2026-08-10-recover-restarted-conversation-affinity/.
• Keeps stable requirements and rationale synchronized in
  openspec/specs/sticky-session-operations/.
• Specifies bridge replacement, durable takeover, request-scoped authority,
  predecessor admission, detached-generation capacity, and shutdown ownership
  as externally testable requirements.

Origin and concurrent work

Landed lineage:

• fix(proxy): purge stale hard codex_session mappings pinned to a durably unavailable owner #1417 (b1d27bc6) introduced bounded stale hard-owner cleanup; this stack
  retains its fail-closed default and consumes only fix(proxy): recover goal restarts from unavailable owners #1679's proof-gated restart
  capability.
• fix(proxy): preserve developer-interleaved fresh resends #1537 (201281b5) established the account-neutral fresh-resend classifier
  reused by fix(proxy): recover goal restarts from unavailable owners #1679 and this bridge follow-up.
• fix(proxy): never inject a cross-account previous_response_id anchor (takeover of #1274) #1638 (68397054) enforced ownership of previous_response_id; this PR does
  not make typed continuations account-neutral.
• fix(proxy): fail over stuck HTTP bridge owner requests to a fresh account #1401 (f2f8f916) and fix(proxy): recover dead durable bridge anchors fast #1625 (85f1ee4b) established HTTP bridge recovery and
  dead-owner handling that this PR extends at replacement/reconnect boundaries.

Concurrent work reviewed for overlap:

• fix(proxy): durably recover hard HTTP bridge operations #1657 overlaps bridge registry, durable operation recovery, reconnect
  lifecycle, and bridge regression files. The second branch to land must retain
  both operation ownership and this request-scoped restart authority.
• fix(http-bridge): keep idle retirements out of retry circuit #1677 is independent circuit-evidence work but overlaps
  request_submit.py and HTTP bridge tests; circuit strikes must remain based on
  request events, not lifecycle cleanup alone.
• fix(proxy): make durable bridge claim_session a real compare-and-set #1643/fix(proxy): recover ownerless durable bridge leases (bridge_instance_mismatch regression) #1648 alter durable claim and ownerless-lease semantics. Their owner
  fencing must compose with canonical replacement takeover here.
• feat(proxy): add OpenAI-compatible fallback for exhausted subscriptions #1664/fix(compact): recover previous-response-pinned compaction when the owner account is unavailable #1490 add separate subscription-overflow and compact recovery paths;
  neither grants goal-restart authority to an ordinary bridge request.

Review

Persistent review 019feb89-9ebd-7960-8b26-32311834e948 found two concrete P1
lifecycle defects in the equivalent combined tree:

1. canonical replacement could revoke an already reserved predecessor submit
   after queue publication cleared its reservation marker;
2. detached live generations escaped the session cap and shutdown registry.

Both are addressed by e77afa9b, with production comments, focused
regressions, and normative OpenSpec scenarios.

Persistent exact-range review 019febb3-6aee-7e21-b66c-7449828f2a1f then
identified six concrete follow-up gaps: detached turn-state publication, two
unit tests crossing real durable boundaries, direct-close registry cleanup,
pre-submit reservation retirement, and account-level closure of detached
generations. All six are addressed by 0ff5443a with focused isolated
regressions, production comments, and synchronized OpenSpec requirements.

Persistent exact-range re-review 019febf0-f6cb-7071-9808-b62ee07540ec found one
additional P1: caller cancellation could remove detached lifecycle ownership
before direct close finished. That finding is fixed by 9881614e. The same
commit also fixes the recurring cloud bridge_instance_mismatch race seen on
both #1677 and #1680 by fencing each same-replica replacement generation with
a new durable owner epoch and adding deterministic routed synchronization.

A fresh non-ephemeral re-review is running against the corrected exact object
range cd554303..9881614e.

Reviewer conversation: 019fec0f-3308-7d41-b642-43d02e41ffc0

Validation

Current-head local validation:

HTTP bridge unit file: 521 passed
HTTP bridge integration: 128 passed
deterministic same-replica stale-release route variants: 4 passed
goal-restart integration subset: 3 passed
review reproductions in isolated processes: 8 passed
Ruff check/format: passed (901 files)
ty check: passed
proxy architecture check: passed
OpenSpec: 49 passed, 0 failed
git diff --check: passed

Fresh cloud CI and the exact-range persistent re-review are in progress at
9881614e.

Screenshots / output

No dashboard-visible change.

Simplicity

• Zero configuration; no setting or environment variable.
• No migration, setup step, README section, or dashboard surface.
• Reuses fix(proxy): recover goal restarts from unavailable owners #1679's classifier and request-scoped capability.
• No new retry budget or timeout.

Checklist

• Conventional Commit PR title.
• OpenSpec behavior is present, synced, verified, and archived.
• Public HTTP bridge, replacement, reconnect, and cleanup regressions are
  included.
• Simplicity gates P1-P5 reviewed.
• CHANGELOG.md was not edited.
• fix(proxy): recover goal restarts from unavailable owners #1679 merged before this PR.
• Persistent exact-range review clean or all concrete findings addressed.
• Current-head cloud CI green.

[Komzpa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: d4181232b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".