fix(codex-plugin): recover missing server sessions

[ehz0ah]

Description

Recover a complete Codex transcript when the local capture cursor survives but its deterministic OpenViking session has been removed.

The batch message endpoint auto-creates missing sessions. Previously, the plugin sliced the transcript at capturedTurnCount before the write, so the new session could contain only the latest suffix while the local cursor advanced successfully. This change verifies continuity before an incremental append. A 404 or 410 resets the cursor durably and replays the complete readable transcript. Other lookup failures fail closed and preserve the cursor for a later retry.

The gap was reproduced independently after investigating OpenAI Codex issue #54973. No external code was copied.

Human Involvement

• A human participated in the implementation or review loop
• This PR was generated entirely by AI agents without human participation in the loop

Related Issue

Fixes #6231

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test update

Changes Made

• Verify that the deterministic server session exists before appending from a non-zero local cursor.
• Persist cursor zero before reconstructing a missing session from the complete readable transcript.
• Send nothing and preserve the cursor when continuity cannot be verified.
• Add direct and process-level regressions for missing-session recovery and transient lookup failure.
• Document the recovery contract and bump the Codex plugin patch version.

Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this on the following platforms:
  • Linux
  • macOS
  • Windows

Validation results:

• Full Codex plugin suite: 196 passed.
• Focused hook suites: 45 passed.
• Credential-free production-path recovery probe: 17 assertions passed in two byte-identical runs.
• Baseline probe: 10 assertions passed in two byte-identical runs.
• node --check: passed for all changed JavaScript files.
• git diff --check: passed.

Checklist

• My code follows the project's coding style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Screenshots (if applicable)

Not applicable.

Additional Notes

The continuity check runs under the existing per-session lock, so local capture writers remain serialized.

A server deletion between the successful continuity read and the append remains a narrow server-side race. Closing that race requires a conditional append or session-generation contract and is outside this focused plugin fix.

The Python server suite was not run. Its local environment began compiling the Rust storage extension and consumed about 1.5 GiB. That task-owned build output was removed. The unchanged server contract was verified from current source: GET uses auto_create=False, while the batch write uses auto_create=True.