feat(context): add CPG-06 stateless recovery-priority loop

[Wibias]

Summary

• Stack CPG-06 on CPG-05.
• Add the minimum shared internal-tool event/loop machinery needed for context recovery.
• Context recovery uses recovery-priority semantics: any generation containing __ocx_context_v1 is entirely internal, including simultaneous assistant text or real client tool calls.
• Stale real actions are discarded and must be regenerated after exact recovery evidence is injected.
• Correctable lookup/protocol mistakes (not_found, stale cursor, invalid range/query) are returned as bounded hidden-tool errors so the model can repair its lookup without forcing a full restart.
• Hard recovery limits, cancellation, provider errors, or unsafe executor failures abandon the hidden trajectory and allow one canonical restart trajectory. Normal bounded transport retry/failover may operate only after that hidden trajectory is abandoned; the bound is one canonical restart, not one physical network send.
• Native OpenAI Responses passthrough now reaches the epoch resolver as an explicit representation boundary, so passthrough chains never start or resume CPG metadata.
• Media-loop behaviour remains separate and unchanged in this stage.

Deep-review hardening

• add a core-level regression for the native-passthrough epoch boundary;
• freeze the provider-visible recovery-tool JSON for the v1 policy epoch;
• identify duplicate receipts by source tool and occurrence when call ids repeat;
• make planner cancellation polling independent of UTF-16 code-unit alignment;
• cover a 10 MiB one-line result without canonical mutation;
• keep hard byte/call/scan budgets fail-open while returning correctable lookup errors to the hidden model.

TDD

The original first commit is intentionally RED. It pins mixed-call suppression, multiple recovery calls, round limits, canonical immutability, and hidden-usage aggregation before implementation lands.

The deep-review hardening also landed tests-first and was verified with the focused projector, recovery protocol/loop, passthrough-boundary, and hardening suites before the clean branch was pushed.

Stack

• Base: agent/context-projection-cp05 / PR feat(context): add CPG-05 bounded recovery protocol #20
• Do not merge before its parent.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 42c5dc1a-0669-46e3-8ec7-ba781bd69e57

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}