M7: Refuse a failed Codex control call without losing the Turn

[Sandstorm831]

Parent

Spec #276; implementation sub-issue of M7 #275.

What to build

A timed-out or natively erroring Codex turn/steer or turn/interrupt returns a rejected control receipt and no longer settles the Turn lost. The Turn then settles on its own native terminal: completion, interruption, connection loss, or close. A malformed control response stays protocol corruption, and a transport failure stays on the connection-loss path. This fits ADR 0035's rule that steer keeps its control receipt (stories 114–116).

Acceptance criteria

• Codex replayer conformance proves a stalled or natively erroring Steer or Interrupt returns a rejected receipt while the Turn settles on its native terminal.
• Conformance proves malformed responses stay protocol corruption and transport failure stays connection loss.
• The existing conformance tests that pin lost for timeouts and native errors are rewritten to the new outcome, not kept beside it.
• CI scenario: runtime conformance is green on Windows x64, macOS arm64, and Linux x64.

Blocked by

• M7: Report structural violations from one rule catalogue in a dedicated gate step #277
• M7: Report guidance-structure violations in the contract and check Module guidance shape #278
• M7: Report vendor-provenance violations in the contract #279
• M7: Report release-workflow violations in the contract #280
• M7: Enforce unused code and clear today's findings #281
• M7: Fail lint on any warning and add two OpenCode style rules #282

Implementation packet

Owner: Codex Harness Adapter, behind the Harness Seam

Ratchet: conformance for refused control calls that keep the Turn

Deletes: settling the Turn lost on a timed-out or natively erroring control call, and the conformance tests pinning it

Gate: ADR 0027 three-OS CI and recorded human evidence, with the slice scenario above.

Dependencies: no new runtime dependency