fix: replace interrupted OpenAI responses safely

[danielkov]

Summary

Recovers interrupted OpenAI subscription response streams without relying on deterministic SSE-prefix replay. ACP v2 replaces partial output in place, while ACP v1 emits a non-terminal interruption warning before streaming a fresh response; only the successful response attempt enters the final transcript.

Motivation

OpenAI subscription streams can fail after visible text or reasoning has reached the client. Retrying by matching a regenerated response against the failed attempt assumes deterministic frames and model output, while failing the turn prevents recovery from transient interruptions.

Fixes #19.

Impact

ACP v2 clients receive a clean replacement response instead of stale or duplicated partial output. ACP v1 is append-only, so its partial output remains visible and is followed by Response interrupted; replacement follows before the replacement stream. Non-ACP recovery surfaces retain fatal post-output behavior.

This bumps Kit from 0.1.92 to 0.1.93.

Technical details

Retry contract

Each retry reuses the request context, idempotency key, credentials, retry budget, and turn state, but parses the fresh response from byte zero and discards parser, output, usage, and tool state from the failed attempt. Learned x-codex-turn-state routing metadata is propagated and contradictory routing state is rejected.

Tool calls remain withheld until response.completed. Response ingress is limited to 16 MiB per attempt and 64 MiB across all attempts.

ACP rendering

A reserved internal marker is emitted before retry backoff, authentication, or the next POST can fail. ACP v2 translates it into empty whole-message upserts for stale answer and reasoning content, then assigns fresh stable message IDs to replacement chunks; cancellation also clears tracked partial content if the marker is suppressed. ACP v1 translates the marker into a warning notice. The marker and notice do not enter output items or transcripts, and ACP v2 does not emit the notice.