[Ingwannu]

Summary

Closes #7369.

A restored Responses conversation can carry native opaque reasoning without the process-local route-retention marker. Its HTTP-200 SSE ciphertext refusal bypasses zero-output recovery; an explicitly identified reasoning-only HTTP 502 also fails the current status gate.

Reuse actual outbound opaque-state detection for bounded stream preflight, retain the same explicit identity through flat/nested SSE failures, and admit an identified 502 through the existing one-shot outbound rebuild. The flat projector preserves the caller-validated 400 code/message instead of replacing it with a generic upstream failure. Keep the existing function-output-specific evidence requirement, ambiguity/send limits, non-replayable and text/tool commitment guards.

Native success retains its ciphertext. Rebuilds keep store:false and tool-call/result pairs; the original input is preserved. No conversation file is read/rewritten, no native ciphertext is decrypted, and no new plaintext reconstruction policy is introduced. Update the owning contract/ADR and both test maps.

Verification

• Base: dev 79fa97be6e6ae974ccd31d9aeedc2da96a0baa73.
• Before source changes: cold SSE/HTTP-502 recovery and repeated-rejection one-shot positives fail. An initial generic-502 fixture incorrectly expected one send; it now explicitly retains the existing three-send pre-header transient policy rather than weakening or hiding it.
• Final Linux/Bun 1.4.3, fresh private homes, sequential cgroup caps: bun test --isolate tests/responses/responses-cold-opaque-recovery.test.ts tests/responses/responses-opaque-blob-recovery.test.ts tests/responses/opaque-blob-wrapped-rejection.test.ts tests/responses/responses-azure-opaque-blob-recovery.test.ts tests/responses/reasoning-retention-routing.test.ts tests/routing/combo-stream-preflight.test.ts — 165 pass, 0 fail.
• New controls cover nested and flat coded/exact-wording SSE errors, cold native success, one sanitized rebuild, repeated refusal, generic 502, contradictory nested/flat errors, store:false, tool-pair preservation and no resend after text or tool commitment. The HTTP-502 fixture preserves three existing generic attempts followed by one sanitized rebuild; no claim of only two total sends is made for that path.
• Existing Azure negative was updated specifically for the intentionally admitted coded 502; ordinary 502/500/503 and rate/unrelated-request negatives remain. Flat-error tests caught and fixed the intermediate projection losing its code before retry classification.
• Structure SSOT, file-size ratchet, privacy and diff checks recorded for the staged candidate.
• Full local suite/root typecheck are deferred to required current-head hosted CI under the fixed local resource exception; the earlier root typecheck exceeded the 300s envelope. This stays Draft pending CI and independent replay-boundary review. No live native/provider request, Windows/Codex UI recovery, complete original conversation replay or deployed fix is certified.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

No merge, release or installed-service change is requested by publication.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Ingwannu]

Current-head hosted validation at bcefb120aa8d101fe6d2c2c973f966f404e608b2: run 39259283281, attempt 2 is successful. All four selected Ubuntu shards, gates/Typecheck/Privacy, structure and the other requested jobs pass; macOS/Windows remain unselected.

The original attempt's test 4/4 failed in the unchanged optional Desktop runtime fixture while binding its remembered loopback CONNECT port (desktop_compatibility_connection_unavailable). I retained that log and ran the entire file at this exact head and exact dev base independently: 62 pass / 0 fail each. That does not establish the exact hosted failure cause or prove a baseline failure. Only the failed job/aggregate was rerun once, without changing source, assertions, runner policy or caps; it then passed. The candidate's focused opaque-recovery/preflight run remains 165 pass / 0 fail.

Keep Draft for independent replay-boundary review. No live provider/Codex UI conversation, Windows runtime, deployment, merge or release is certified by these fixtures.

[lidge-jun]

Landed on dev as part of the replay/lifecycle bundle #7388 (squash c120eea), with your commits and Co-authored-by credit preserved. Closing as absorbed. Thank you!