fix(server): opt-in fail-closed policy for codex thread resume

[nullStack65]

Problem

When a Codex provider thread is requested for resume and the app-server returns a recoverable error (thread missing/not found), the runtime silently starts a fresh provider thread and marks the session ready with the replacement thread id. A failed resume is therefore accepted as successful continuity, and the replacement thread masquerades as the resumed one.

Source (stock v0.0.42, apps/server/src/provider/Layers/CodexSessionRuntime.ts): openCodexThread catches isRecoverableThreadResumeError and calls thread/start; the caller accepts opened.thread.id into resumeCursor + status: "ready" unconditionally.

Fix

Add an opt-in, typed resumeFailurePolicy for the Codex provider:

• fallback-to-new-thread (default, stock behavior) — unchanged.
• fail-closed — a recoverable resume failure is logged and propagated; thread/start is not called, so a replacement provider thread can never be accepted as continuity.

The policy is exposed per provider instance via CodexSettings.resumeFailurePolicy (hidden settings field, defaults to fallback-to-new-thread), propagated through CodexAdapter into CodexSessionRuntimeOptions and openCodexThread.

Scope

• packages/contracts/src/settings.ts — CodexSettings + CodexSettingsPatch field
• apps/server/src/provider/Layers/CodexAdapter.ts — pass policy into the runtime
• apps/server/src/provider/Layers/CodexSessionRuntime.ts — typed option + fail-closed branch
• apps/server/src/provider/Layers/CodexSessionRuntime.test.ts — focused tests
• two settings fixtures updated for the new defaulted field

Tests

vp test run src/provider/Layers/CodexSessionRuntime.test.ts src/serverSettings.test.ts src/provider/Layers/ProviderInstanceRegistryLive.test.ts src/provider/Layers/CodexAdapter.test.ts → 151 passed. New tests cover: no-resume start, valid resume, recoverable fallback (default), fail-closed refuses thread/start, fail-closed valid resume, fail-closed no-resume, explicit default equivalence. vp --filter t3 typecheck, @t3tools/contracts typecheck (427 passed), targeted lint/fmt all green.

Provenance

• Upstream base (tag v0.0.42): 719a76ca1dbf5490f1aa33ffb9966301e02be9a9
• Fork base (nullStack65/t3code main): e6ae764f47d678b96f4a1b2c8c76eedf1a342e26
• Head: a3s/v0042-strict-resume
• Verified to apply cleanly to current upstream main 8dd02470b1e7603b8d36a21ae27c510480351f18 (git apply --check --3way)

This is a Closura review carrier derived from stock T3 Code, not stock T3 Code itself. Draft; not for merge.

Model/harness: openrouter/deepseek/deepseek-v4.1-flash via opencode.

[nullStack65]

A3V independent composed review — T3 fork #2 (COMMENT, not approval)

Reviewed exact head f014905ed1c73600310accc6d2bc378c9d5c7840 against fork main e6ae764f47d678b96f4a1b2c8c76eedf1a342e26 (1 ahead / 0 behind).

Independently reproduced:

• Six-file scope exactly as required; all six blob SHAs identical to the pre-refresh A3 head 1ba1ee7… (patch-equivalent).
• Focused Vitest: 151 passed / 4 files (CodexSessionRuntime, serverSettings, ProviderInstanceRegistryLive, CodexAdapter).
• Contracts suites: 427 passed / 24 files.
• @t3tools/contracts and apps/server tsc --noEmit → EXIT 0, no errors.
• Targeted vp lint / vp fmt --check on changed files → PASS (2 pre-existing no-inline-schema-compile warnings in serverSettings.test.ts:1304-1305, not on A3-added lines).
• Equivalent git diff --check: reverse-apply with --whitespace=error-all → clean; no conflict markers.
• resumeFailurePolicy typed/bounded (Schema.Literals), defaulting fallback-to-new-thread; only path to thread/start after a resume request is the non-strict branch; verified no other thread/start producer in server source; strict failure exits makeCodexSessionRuntime.start before status:"ready", resumeCursor, and session/ready, closing the race.

Disposition for this repo: T3_STRICT_POLICY PASS, STOCK_DEFAULT_PRESERVED PASS, STRICT_NO_THREAD_START PASS, T3_SETTING_PROPAGATION PASS, T3_BASE_COMPOSITION PASS, CONTINUITY_ACCEPTANCE_ORDERING PASS.

Exact-head CI still QUEUED (Test, Test Server 1-3, Check, Rust, Release Smoke, Mobile Native Changes, Native fingerprint diff). No dispatch/rerun performed.

Cross-repo note (not a T3 defect): the agent-config successor contract currently cites the pre-refresh head 1ba1ee7…, not this head. See agent-config pingdotgg#227.

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for f014905.

This comment will update automatically after the next completed run.