Rebase fork on upstream #471 (RPC override) + cherry-pick shutdown hardening + #506/#480/#490

[axisrow]

Context

The fork (1.0.6-fork.1) implemented --model/--effort override via spawn -c (PR #2, branch fix-app-server-overrides). Upstream PR openai/codex-plugin-cc#471 ("Support GPT-5.6 models and refresh stale brokers", +1302/-161) solves the same problem better and more broadly — via RPC thread/start.config + runtime-identity respawn (plugin/codex version, not just model/effort) + broker-lock (serialization) + broker-probe + model-catalog.

Decision: replace our spawn--c mechanism with openai#471, while preserving the fork's generic shutdown-hardening that openai#471 does not include.

Branch: rebase-on-471 (pushed). Target install version: 1.0.6-fork.2 (based on the last real upstream release v1.0.6, NOT on openai#471's claimed 1.0.7 — that PR may never merge).

What's in the branch (5 layers, all merged)

Layer	Source	What
1	openai#471 (wholesale)	RPC thread/start.config override, broker-lock/probe/model-catalog, runtime-identity respawn. Replaces fork's spawn--c (ab75d49) + spawn-argv tests (eb3d78f, rewritten to RPC surface).
2	fork 8458741	Bounded sendBrokerShutdown (2s) — openai#471's rewrite is bool-returning but has NO timeout; re-applied the fork's settled/finish()/setTimeout-destroy on top.
3	fork 478be42	PID-reuse guard — existingReady gate in teardownExistingBroker (openai#471 unconditionally tree-kills by pid, risking killing a recycled pid on stale sessions).
4	openai#506 + openai#480	resolved model/effort/sandbox in job records (fixes openai openai#481) + reasoning-start logging. Conflict in codex.mjs resolved by hand (preserve openai#471's validateReasoningSelection + openai#506's resolved).
5	openai#490	Broker idle-timeout (15 min no clients → process.exit) + shutdown-path corrections.

Dropped: fork 09b3a41 (graceful sendBrokerShutdown before teardown) — openai#471 already does graceful shutdown before teardown in loadReusableBrokerSessionUnlocked, so it's a duplicate.

Verification (codex-cli 0.144.4, macOS)

• Tests: 119 total, 114 pass, 5 fail — all 5 pre-existing (status×2, result, resolveStateDir, task --background; reproduce identically on pure pr-471). 0 regressions. Typecheck clean.
• Empirical sweep (4/4 pass):
  • task --effort high → rollout turn_context reasoning_effort:"high" ×3 (RPC override reaches the model — spawn--c is gone).
  • job record resolved.reasoningEffort = "high" (Capture resolved model/effort/sandbox in job records openai/codex-plugin-cc#506).
  • SIGKILL worker mid-run → zombie running record retains resolved (forensics, Job records never capture the resolved model/effort/sandbox a job ran with openai/codex-plugin-cc#481 scenario).
  • broker self-exits after idle timeout (Stop orphaned Codex companion brokers openai/codex-plugin-cc#490, tested with CODEX_COMPANION_BROKER_IDLE_TIMEOUT_MS=5000).

Risks / notes

• Replacing the override mechanism drops the working spawn--c fallback. Rollback path: 1.0.6-fork.1 is preserved in git history (fix-app-server-overrides branch + tag).
• This is fork-internal — no upstream PR. Per [[upstream-effort-issue-map]], waiting for upstream reaction to Support GPT-5.6 models and refresh stale brokers openai/codex-plugin-cc#471.
• TODO before installing: claude plugin uninstall codex@openai-codex && claude plugin install codex@openai-codex (per install-local-plugin-repoint — install alone skips if the version record exists).