Feature request: durable terminal-turn events for app-server clients

Summary

turn/completed is a useful connection-scoped notification, but clients that coordinate delegated work need a durable, replayable terminal-turn event with the exact final result from the same immutable revision.

Requested generic capability

Add a versioned app-server capability providing:

• a durable terminal-event log keyed by thread, turn and execution epoch;
• an atomic snapshot containing terminal state and the exact persisted final result/items for that revision;
• opaque client binding bytes plus digest, stored without server interpretation;
• server-side wait/cursor and idempotent ACK;
• at-least-once redelivery, restart replay, retention and typed expiry;
• integrity checks, capability negotiation and transport-aware authorization.

The server should not interpret application-specific correlation, workflow or receiver semantics. Clients own their opaque binding and downstream idempotent reduction.

Current gap

The documented turn/completed notification is streamed on the active JSON-RPC connection. Its turn currently carries an empty items array even when item events were streamed. A client cannot use that notification alone as an atomic, durable receipt for the terminal cognitive result, nor replay it after a missed connection event.

Polling thread state after completion is not equivalent: mutable state can advance and the client has no atomic revision binding the terminal transition to the reconstructed result.

Proposed protocol shape

Names are illustrative and intentionally generic:

• capability: codex.threadTerminalEvents.v1;
• wait/read from a durable cursor;
• acknowledge event/revision under an authenticated session;
• closed terminal payload/envelope schemas;
• opaque clientBinding and clientBindingDigest;
• explicit timeout, cancellation, expiry and integrity errors.

Authentication must come from transport/session or a trusted proxy, never a caller-claimed principal field.

Acceptance cases

• duplicate delivery and idempotent ACK;
• crash before/after consumer commit;
• restart replay and cursor durability;
• two concurrent threads with no cross-delivery;
• unauthorized wait/ACK;
• benign timeout distinct from missing terminal evidence;
• retention expiry;
• execution-epoch resume after HOLD/interruption;
• terminal state and exact final result share one immutable revision;
• unsupported capability/schema version fails before delegation.

Baseline inspected: openai/codex@2e156cbe31212ccfa9173cb2679c1a201a940b18, including TurnCompletedNotification in codex-rs/app-server-protocol/src/protocol/v2/turn.rs and the app-server README.

This request contains no private task identifiers, account data or application-specific authority model.