fix(server): preserve queued messages after usage limits

[Yash-Singh1]

A provider usage limit could send queued messages into the same exhausted allowance, while the queue hid the failed turn. After a stop, an empty composer also offered no direct way to continue the interrupted work.

Hold queued runs until the stopped turn continues. Keep the failed run visible in thread summaries, preserve restart-held queues, and offer scheduled recovery at the provider's reset time. On web and desktop, an empty composer now shows a play button for interrupted or limited turns. A manual click starts a guarded continuation ahead of queued messages, and a stale click cannot start a second one. The same button releases a queue held after a server restart.

A Stop from the client also holds the queue, as does a provider failure when the next queued message targets the same provider. Validation failures and messages queued for another provider still start automatically.

Checks: Focused server, composer, and queue tests passed. Server, web, client runtime, contracts, and shared typechecks passed. Targeted lint passed.

Model: GPT-6
Harness: Codex

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a cross-layer runtime behavior change that alters automatic queue dispatch and Stop semantics, persists queue-hold state, and introduces a new manual continuation action across the server, client, and web UI. Because it adds a user-facing workflow and gates provider work based on usage and failure state, it warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.1 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.8 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: 258f994 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.