fix(prime): recover active turns after Pylon restarts

[rynfar]

Problem

A full Pylon restart can lose the in-memory Prime owner and subscriber for an active turn. Recovery must not duplicate an ambiguous native request, accept stale authority, drop turn events, or signal a reused process ID.

Solution

• persist migration 050 as a durable recovery ledger with the request identity and authority recorded before native attachment
• retry the exact ambiguous adoption request and rotate both the ledger and ownership receipt before confirmation
• adopt active Prime turns after a full Pylon restart while preserving the logical turn, subscriber stream, runtime incarnation, MCP ownership, and terminal events
• require current post-attach proof and negotiated capabilities, fail closed on stale or unbound process identity, and retain Stop as the cleanup escape
• keep the single-account driver contract at supportsMultipleInstances: false

The four recovery patches rebased exactly onto 9aeaba9b86ea9c72269ca4edf03c1dde8f1f0e54. This retains the merged managed-install work and the server projection/coalescing performance pass.

Verification

• range-diff: all four old/new commits are patch-equivalent
• recovery, adoption, turn-event, performance, coalescing, and projection suites: 14 files, 615 tests passed
• full server suite: 148 tests passed, including thread transfer budgets
• Prime real-process suite under isolated HOME and TMPDIR: 20 passed, 9 expected skips
• real two-Pylon restart adoption proof: five consecutive passes against Prime f4754ec0702168b3d968698c95df345e3862a0af
• server, contracts, web, and desktop typechecks passed
• repository lint passed with 0 errors; repository format and diff checks passed
• release smoke passed

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.7 KiB	+326 B (+2.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.8 KiB	+329 B (+5.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	58.6 KiB	+2.3 KiB (+4.1%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.4 KiB	−3 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−2 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.2 KiB	57.2 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 9aeaba9 · PR result: 3a8d20f · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.