fix(server): draft retry after failed bootstrap, and a Codex O(n²) buffering fix

[rynfar]

Two adopted from the f94a0d646..bcb855a63 upstream review.

#8226 — a draft can retry its first send after a failed bootstrap. Conflicted: the resolution takes upstream's threadDeletionReactor but drops the adjacent const analytics = yield* AnalyticsService.AnalyticsService;, which Pylon deliberately removed when #7774 landed as plumbing only. Same in server.test.ts. Verified no Analytics reference survives and threadDeletionReactor is genuinely used.

#8605 — the Codex app-server stdin reader did current + chunk per chunk, re-concatenating and re-splitting the whole buffer. Now keeps fragments in an array and joins at line boundaries. Clean cherry-pick.

Dropped from this group: #8610

#8610 ("stop querying Claude context usage after turns") was in the approved set, and I dropped it after review. It deletes normalizeClaudeContextUsageApiSnapshot, which is the only producer of compactsAutomatically. The chain: origin/pylon had compactsAutomatically: value.isAutoCompactEnabled; after the pick nothing supplies it; contextWindow.ts:92 defaults it to false; ContextWindowMeter.tsx:266 gates the "Compacts automatically at N tokens" indicator on it. Claude threads lose it while Codex keeps it.

The Claude SDK exposes isAutoCompactEnabled only on the getContextUsage response, so the round-trip and the indicator are mutually exclusive. Upstream shipped this unnoticed — no test asserts the field, and its own new test supplies isAutoCompactEnabled: true on a mock it then asserts is never called.

Known upstream design concerns, not addressed here

#8226 fences every thread.create on threadDeletionReactor.drainThrough, which ends in a shared worker.drain — so creating a thread waits on all in-flight deletions, not the one whose id is reused. drainThrough is also typed Effect<void> with no timeout. Both are upstream's shape and latent today; flagging rather than patching upstream's design mid-adoption.

Verification

Adversarial review found the #8610 regression and both design concerns. t3 typecheck clean. 127 focused tests pass across ThreadDeletionReactor, ProjectionPipeline, commandInvariants, protocol, and ClaudeAdapter. The reviewer fuzzed the new line splitter over 20,000 random chunk sequences against the old implementation — identical output including \r\n straddling chunk boundaries.

Model: Claude Opus 5. Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+33 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+7 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+26 B (+0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−29 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−35 B (−0.5%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 6a31ea8 · PR result: 8406ba5 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.