fix(combo): auto-resume pinned native Codex turns (re-land of #13180)

[diegosouzapw]

Re-land of #13180 by @mdigitalbh81 — the fork does not accept maintainer pushes, so this PR carries their commits with authorship intact.

Follow-up to #12240. Supersedes #13180.

⚠️ base-red inherited: #13866 (unrelated: .env.example docs-sync gap opened by #13344; not touched by this PR).

Summary (original, by @mdigitalbh81)

Native Codex turns remain pinned to the same provider/model while eligible sibling connections for that model still exist.

If every target for the pinned provider/model becomes unusable for a model-scoped reason, such as quota exhaustion or model lockout, this change safely advances the logical turn generation and resumes the same Codex turn on another healthy model from the combo.

The resumed model is then pinned for the new logical generation, so subsequent requests for the same thread_id + turn_id continue consistently on that model.

Safety constraints

• Pin scope remains thread_id + turn_id; it is not global.
• Sibling connections for the same pinned provider/model are preferred before cross-model resume.
• Auto-resume is limited to model-scoped unavailability.
• Provider-wide circuit breaker/cooldown conditions do not trigger cross-model resume.
• Pending tool calls or opaque/provider-specific continuation state reject auto-resume.
• Partial-stream failure does not dispatch another model mid-stream.
• At most one auto-resume is allowed per logical turn.
• Failed auto-resume dispatch does not advance generation or cascade to a third model.

What this PR adds on top of #13180

The base branch moved from under this PR while it was parked: #13564 (merged today,
2026-09-18) independently changed the same code path — when a pinned native Codex turn's
model becomes model-scoped unusable, release the pin and fall through to full combo
routing instead of terminating with 400 NATIVE_CODEX_PINNED_MODEL_UNAVAILABLE.

Re-landing #13180 on top of #13564 needed two small follow-up commits, both under my own
authorship, on top of Felipe's unmodified commits:

1. releaseNativeCodexTurnPin renamed map — fix(providers): codex: long native sessions die with NATIVE_CODEX_PINNED_MODEL_UNAVAILABLE instead of falling back to a healthy combo model #13564 renamed the module-level pin map
   from pins to turns; one stray pins.delete(key) call needed the same rename.

2. Reconcile auto-resume's safety bounds with fix(providers): codex: long native sessions die with NATIVE_CODEX_PINNED_MODEL_UNAVAILABLE instead of falling back to a healthy combo model #13564's fallback — the merge conflict
   resolution had applied fix(providers): codex: long native sessions die with NATIVE_CODEX_PINNED_MODEL_UNAVAILABLE instead of falling back to a healthy combo model #13564's "release pin and fall through" behavior to fix(combo): auto-resume pinned native Codex turns #13180's
   auto-resume-not-eligible branch as well. That silently dropped two of fix(combo): auto-resume pinned native Codex turns #13180's explicit
   safety constraints:

   • "Pending tool calls or opaque/provider-specific continuation state reject auto-resume"
     was only supposed to reject the auto-resume mechanism — falling through to plain
     combo routing instead hands that same unsafe state to an untested alternate model,
     which is exactly what the check exists to prevent.
   • "At most one auto-resume is allowed per logical turn" was bypassed: once eligibility
     was rejected for max_resumes_exceeded, falling through let the request cascade to a
     third model instead of terminating.

   Fix: only the rejection reasons that mean unsafe state or an exhausted resume budget
   (pending_tool_call, unsafe_provider_state, no_alternate_target,
   no_healthy_alternate_target, max_resumes_exceeded) still terminate the turn with
   400. Every other reason (e.g. a request body that doesn't use the Responses-API
   input/messages shape fix(combo): auto-resume pinned native Codex turns #13180's eligibility check needs) keeps fix(providers): codex: long native sessions die with NATIVE_CODEX_PINNED_MODEL_UNAVAILABLE instead of falling back to a healthy combo model #13564's plain
   fallback, so non-native-turn-shaped Codex requests are unaffected.

Validation

• tests/unit/native-codex-auto-resume.test.ts: 15/15 passed (4 failed against the raw
  merge before the reconciliation fix above — opaque continuation state, pending tool
  call, no healthy alternate, and the max-resumes cascade all dispatched to an alternate
  model instead of terminating; TDD-verified per Hard Rule fix(ci): add environment for npm token access #18)
• tests/unit/native-codex-turn-pin-model-scoped-fallback.test.ts (fix(providers): codex: long native sessions die with NATIVE_CODEX_PINNED_MODEL_UNAVAILABLE instead of falling back to a healthy combo model #13564's own suite):
  7/7 passed
• Broader regression sweep: chatgpt-web-codex-turn-pin, chatgpt-web-codex,
  native-codex-turn-pin-10379, combo-context-overflow-compression-probe,
  combo-context-window-filter, combo-responses-sse-failure-fallback,
  perf-waterfall-elimination: 81/81 passed
• npm run typecheck:core: passed
• npx eslint --suppressions-location config/quality/eslint-suppressions.json on all
  touched files: clean
• node scripts/check/check-complexity-ratchets.mjs --base-ref origin/release/v3.8.51:
  flags a pre-existing new-code complexity regression in
  open-sse/services/combo/nativeCodexTurnPin.ts, entirely inside fix(combo): auto-resume pinned native Codex turns #13180's original
  ~500-line addition (not touched by either follow-up commit here). Not rebaselined or
  refactored in this PR — flagging for an owner decision rather than restructuring a
  contributor's logic without a failing test driving it.
• Live validation (from fix(combo): auto-resume pinned native Codex turns #13180, unchanged by this re-land): performed on ARM64 with a real
  Antigravity Opus 429/quota exhaustion — the pinned turn became eligible for auto-resume,
  routed to Gemini, completed with HTTP 200, and subsequent requests for the same turn
  remained pinned to Gemini.