fix(server): stop the reaper cap from looping with durable recovery; keep Codex readers alive

[tusharbhardwaj-bk]

What broke

Three threads in four days (907d4c74 08-17, ed3fc9f4 and mcp:1e019f68 08-20) sat in Recovering for ~45 min and then held every later prompt in Queued until a human pressed Stop. The recovery attempts were exactly 5 minutes apart — the reaper's sweep interval.

A. Reaper cap ↔ durable recovery loop

1. ProviderSessionReaper.sweepOrphanedTurns fired the 2 h cap on turn age, ignoring that the agent had emitted an event seconds earlier, and only wrote thread.session.set interrupted. The provider turn kept running.
2. observeSession(interrupted) → recovering; the coordinator's recover found the same live provider turn → markAcknowledged → running. Next sweep: again. Ten "successful" recoveries.
3. With recovery_attempts == maximum, observeSession still parked the item in recovering: unclaimable, non-terminal → "Recovering" forever, and prior_work.phase IN (…'recovering'…) blocked every later prompt → "Queued".
4. The same sweep's inactivity pass then terminated the live agent mid tool call (17:33:50 and 19:29:17 today): the cap pass had just nulled activeTurnId, and lastSeenAt only moves on runtime operations.

B. Blind Codex session

The second "continue" on mcp:1e019f68 dispatched fine, then T3 saw nothing for 30 min while Codex's rollout kept growing, until the reaper killed it. CodexAdapter forked its event reader with Effect.forkChild (child of the calling fiber). Since #124 each reactor command runs in a detached, short-lived fiber; a thread.session-set command whose inline runDue won the claim started the session and took the reader with it when the command returned. (Trace parent chain: processDomainEvent → runClaimed → dispatchDurableOriginal → processTurnStartRequested → startSession.)

Fix

• Reaper: cap measures silence (lastActivityAt), not age; on a live session it dispatches thread.turn.interrupt (the Stop path) before settling, so intent, provider and projection agree and there is nothing to recover. Inactivity pass consults inspectSession().activeProviderTurnId before terminating.
• observeSession: interrupted/stopped with a spent budget → recovery-exhausted + terminal (Retry/Dismiss available; next prompt runs).
• CodexAdapter / GrokAdapter: reader forked with Effect.forkIn(sessionScope) like ClaudeAdapter.
• ProviderCommandReactor: session-set / session-restart-requested wake("") the coordinator instead of dispatching inline.

Tests

• Reaper: silent live turn → turn.interrupt, activity, session.set interrupted, no terminate; old-but-busy turn untouched; adapter-reported active turn not terminated.
• Repository: spent item exhausts terminally and unblocks the next prompt; item with budget still recovers.
• CodexAdapter: reader keeps delivering after the starting fiber ends (hangs on the old code).

Scoped locally: touched test files (125 tests), tsgo --noEmit for apps/server, vp lint/vp fmt on changed files, check-fork-markers.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	11.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	5.7 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	5.7 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	50.4 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	11	—	21	✅
Claude	Total thread wire	—	11.4 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	5.7 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	5.7 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	51.2 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 38075d3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 95.6 KiB
• Claude decoded thread snapshot: 96.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.