Thread session restore can drift when active and primary authority are treated as the same thing

Observed while reviewing downstream carry of recent tui_app_server thread/session restore changes.

Summary
The thread restore/refresh path is sensitive to whether a thread is the live active thread or only the primary fallback thread. Treating active/live authority and primary-only fallback authority as equivalent can cause restore/refresh to rebuild from the wrong source of truth and replay stale config state.

Why this matters

• active thread rebuilds should use live in-memory state
• primary-only fallback rebuilds should use authoritative cached session state instead
• mixing those paths can restore cwd / approval / sandbox / model state from the wrong thread during transition windows

Reference implementation
https://github.com/SednaLabs/codex/commit/ba21735004

The reference commit is a single downstream commit carrying the full finding and follow-up hardening in one place.