Preserve messages during Codex thread recovery

PLAN.md

@@ -236,11 +236,16 @@ hide a later failure.
 A missing thread is recoverable (2026-09-14). Codex returns a thread id before
 its first turn creates a rollout, so restarting in between can leave ai-app
 holding an id that `thread/resume` rejects as either "thread not found" or "no
-rollout found". A rollout can disappear later too. Both mean the model context
-is gone but ai-app's common transcript is not: the driver forgets only that
-stale id, reports Codex's refusal, records a context-clear boundary, starts a
-fresh Codex thread and then delivers anything queued. The error stays visible
-because losing model context is material even when the process can heal it.
+rollout found" (other CLI versions say "invalid thread id", and malformed ids
+are "invalid session id"). A rollout can disappear later too, including between
+a successful resume and `turn/start`. Both mean the model context is gone but
+ai-app's common transcript is not: the driver forgets only that stale id,
+reports Codex's refusal, records a context-clear boundary, starts a fresh Codex
+thread and then delivers anything queued. A turn request that discovers the
+loss returns its in-flight message to that queue before recovery, so the message
+that triggered recovery is delivered to the replacement rather than
+disappearing. The error stays visible because losing model context is material
+even when the process can heal it.
 Other resume failures remain errors rather than silently discarding context.
 The replacement's `thread/started` notification is a new root despite not
 matching the translator's old root id; its null `parentThreadId` distinguishes