feat(threads): preserve and dismiss asynchronous questions

[rynfar]

Codex can ask a question while continuing its work. Pylon must preserve that question across reconnects, deliver its answer as a normal message, and keep resolved requests closed across clients. Add asynchronous questions with explicit dismissal and manual settlement, while keeping native callback questions and Prime interactions blocking.

Adopts upstream #9512 (d76b24dd15a219666941ab1b4967d8f738adcda0), #10123 (e63ddb48e2fd23854a0b4a480b32cbf33e601981), #10400 (7ac93e300ee17a4ee5e92192264fcfd438805b6f) and #10431 (7112697e8be2d6f231726a91eb565e00ddbeebec). Includes only the native question-value/custom-answer prerequisites from #9348 (06336460c9988f29c71e839c4c9c840c4552e077); this does not adopt or claim the Antigravity provider.

Pylon adaptations preserve restart admission, provider instances, Prime interaction handling and rollback protections. A narrow persisted-request query makes settlement and snooze decisions survive startup's lightweight state and activity eviction. Final resolutions beat delayed request replays. Web and mobile share closed-request handling and retain their own layouts. Web dismissal is a separate native button, and question controls use the actual user-input submission state.

Validation: 423 focused tests across provider/engine/projection/schema, settlement/snooze/rollback and client request handling. The persisted restart regressions fail when the new engine lookup is removed. Server, web, mobile, contracts, client-runtime and Codex schema typechecks pass; scoped lint has zero errors and five existing schema-test warnings. A disposable real web client and iOS 26.3 simulator verify keyboard and mobile dismissal propagating in both directions, manual settle/unsettle, native callback protection, required choices and free-text questions. The database records one resolution and no message or turn for each dismissal and settlement. Browser checks confirm a separate native dismiss button and correct editor availability. No live provider, Android, or physical-device run is claimed. After rebasing onto current Pylon, 291 focused lifecycle and client tests and all six affected typechecks pass. The only rebase conflict was documentation; both runtime guidance and the async-question section are retained. Before/after evidence is attached below.

Client	Before	After
Web
Mobile

Model: GPT-6 Astra. Harness: Codex.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.8 KiB	+2 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−1 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.4 KiB	57.4 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	−14 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	0 B (0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−14 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.2 KiB	58.2 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: e99317f · PR result: 9aac8be · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.