fix(proxy): retry missing response.created once

[mhooooo]

Summary

Recover Codex Responses streams without exposing the reconnect loop when either:

• an HTTP bridge response.create receives no response.created; or
• a reused HTTP/direct-WebSocket upstream is already closed before the next send begins.

Every replay stays bounded to one attempt, preserves the original request budget and required account, and remains fail-closed whenever dispatch may have begun.

Type of change

• fix: — bug fix
• feat: — new user-facing capability
• refactor: — internal refactor
• docs: — documentation only
• chore: / ci: / build: — tooling
• test: — test-only change
• Breaking change

Linked issue: Refs #1393

OpenSpec

• This PR includes / updates an OpenSpec change
• This PR touches a codex-faithful path and preserves upstream-equivalent request and response framing

Change directory: openspec/changes/retry-missing-response-created-once/

Changes

• Cap the eventless pre-response.created acknowledgement window at 30 seconds instead of 240 seconds.
• Cancel the stale HTTP receive and invoke the existing safe pre-created replay path only for a sole, pre-visible request.
• Add a sealed transport result proving a reused socket was closed before the send primitive was invoked.
• Reconnect and resend the exact HTTP or direct-WebSocket request once on the same required account when that proof exists, including compacted continuations.
• Keep mid-send failures terminal because their dispatch state is ambiguous.
• Refuse direct-WebSocket replay if the retired reader does not confirm cancellation; terminally settle the turn, close downstream, and retain cleanup ownership.

Root cause and impact

The existing bridge watchdog always failed after a missing acknowledgement, even when its guarded replay path could safely recover. Separately, both HTTP and direct-WebSocket clients could reuse a normally closed warm upstream and surface a client reconnect before the next send.

The proxy now distinguishes a provably undispatched request from an ambiguous send. Only the former receives one exact same-account resend. Existing lifecycle, visibility, sibling-request, continuation, file-ownership, admission, and one-replay guards remain authoritative.

Simplicity

• Works with zero configuration
• Adds no setting or required setup step
• Adds no dependency, endpoint, schema, migration, dashboard surface, or README section

Validation

Focused HTTP bridge + direct WebSocket suite
631 passed

Ruff check and format
passed (849 files)

Ty type checking
passed

Proxy architecture fitness checks
passed

Strict OpenSpec validation
48 specs passed
71 changes passed

Local Codex review at current head
No actionable correctness regressions identified

Live exact-revision verification also completed authenticated /models, HTTP Responses, and direct-WebSocket Responses requests through the locally deployed combined image.

Checklist

• Title uses Conventional Commits format
• Related issue referenced
• Externally failing HTTP and direct-WebSocket paths have regressions
• Relevant local gates passed
• Strict OpenSpec validation passed
• Simplicity gates reviewed
• CHANGELOG.md is unchanged

[mhooooo]

Superseded by #1484, stacked on #1481. The retry-only approach here shortens one acknowledgement wait but does not converge when durable bridge ownership and the broad legacy session row remain persistently contradictory. #1484 fixes that pre-dispatch ownership loop while preserving the durable owner and fail-closed specific ownership boundaries.