Measure the whole launch frame, and run an oversized continuation cold

[ppXD]

Summary

Closes three gaps in how an agent launch carries large text after the goal moved to stdin (#2008). Each fix is its own commit.

• The deploy E2E's fake codex still read its goal from the last argv argument. backend/deploy/e2e/fake-codex is the static twin of FakeCodexCli, mounted into the real worker image. After the move to stdin the worker handed it -, it answered DONE: -, and the lane stayed green because run.sh only waited for Success. The fake reads stdin now, and run.sh asserts that the succeeded attempt's folded summary in agent_run.result_jsonb is DONE: Deploy E2E smoke task.
• The frame check only measured stdin. A continue carries the restored session transcript in ConfigHomeFiles (captured up to 32 MiB). WriteFrameAsync enforced the 16 MiB bound only after transmissionStarted = true, which deliberately skips the netns/cgroup teardown, so the failure surfaced as a generic, retried executor-error. The frame is now encoded first and refused before transmission as the terminal SandboxArgumentTooLongException. The catch tears the isolation down, and the broker releases its slot as rejected.
• A continuation too large for the frame runs cold instead of being refused. Refusing is right for a goal no attempt can carry, and wrong for a retry whose work can go on in a fresh conversation. The executor builds the spec, and it rebuilds the spec cold only when the spec carries a restored transcript and does not fit (NativeLaunchProtocol.FitsTheFrame). This covers the launch path and each revise round, and a model escalation already applied to the round stands.
  • The fit is measured the way the frame is built. It counts the spec, then the argv and environment the invocation carries a second time (a persona on --append-system-prompt is in both copies), plus a 64 KiB allowance for the rest. It is pinned against the invocation the runner really encodes, at the boundary.
  • So a transcript between 8 and ~16 MiB still resumes warm, as it did on main. A goal and a transcript that only overflow together run cold instead of failing.
  • The hint that tells the agent rides only the dispatched spec. Verification is graded on the goal the persisted envelope holds, because local acceptance hashes that goal against the envelope. Graded against a hinted goal, it read as a different contract and failed a locally graded run as local-context-mismatch before it launched. The same fix covers a bug already on main: the unreadable-checkpoint degrade amends the goal the same way and failed a locally graded retry identically.
  • A cold attempt leaves a durable trace once it has passed every check the executor makes before launch (local acceptance, spend). The persisted envelope drops its continuity claims, so the Room's "resumed" mark stops claiming a resume that did not happen, and the timeline says what happened, with separate wording for a launch and for a revise round (only a revise round keeps its workspace). The persisted goal is untouched.
  • The agent is told its conversation is gone, and that whatever the workspace already holds beyond the base is its own earlier work. A respawn can be checked out at the branch its earlier attempt pushed, with nothing else saying so.

Test plan

• Drift detector for the deploy fake (Rule 12.5): SubtaskAwareFakeCliDriftTests runs the real backend/deploy/e2e/fake-codex through the real CodexHarness invocation, with the goal on stdin, and asserts the summary run.sh expects. It was red on the old fake.
• Frame refusal, real runner host: stdin of 8 bytes plus a restored transcript that pushes the frame past 16 MiB gives sandbox_argument_too_long. The message names both carriers' sizes and never their contents, and the broker receipt settles on rejected, not indeterminate. It was red first (InvalidDataException from the late write).
• Cold degrade, launch path, executor level (AgentRunExecutorTests). Setup: the real executor, runner and frame check, and the real Claude adapter's spec (recorded with its real argv) with only the executable swapped. A transcript of 16 MiB + 1, restored by artifact reference, runs cold and succeeds. The warm spec carried the transcript and --resume (fixture checks); the launched one has neither. Stdin ends with the hint, the persisted envelope has no resume, and the timeline note is present. Red with the degrade disabled.
• Cold degrade on a locally graded continuation: a repo-less task with an acceptance command, whose transcript overflows, runs cold and passes acceptance. Red when the hint rides the run's own goal and verification does not use the contract.
• A cold continuation refused for spend before launch leaves no trace: no cold note, and the envelope is unchanged. It was red before the note moved below spend admission. The revise twin — a cold round refused for spend under a capped quick lane — leaves no "continued" note either. Red with the note moved back above the round's admission.
• Unreadable checkpoint on a locally graded task (the bug already on main): it degrades and is graded on its contract. Red without the contract-goal fix.
• Cold degrade, revise path, executor level (AgentRunReviseLoopFlowTests). Round 0 writes a session file past the whole frame at the path Claude keeps it, and the real capture reads it. Round 1 is rebuilt cold with the whole contract and passes. Red with the degrade disabled.
• Frame fit, pinned against the real encoded invocation (NativeLaunchFrameFitTests): with a 130,000-character persona, ASCII and < (six bytes each, in both copies), a spec exactly at the fit boundary encodes to a frame within 16 MiB, and within two allowances of it. Red when the second copy of argv and environment is not counted.
• Unit: a transcript past half the frame still revises warm, with a fixture check that the spec really carries it. A goal and a transcript each under half but over the whole overflow, and the cold attempt fits. A goal alone is never degraded (it is the frame check's to refuse).
• Full unit suite: 10955 passed, 0 failed. Integration (every AgentRun* suite, agent node, supervisor retry / cost cap, session resume, real harness, native launch, local acceptance, task launch, map, Room projector, supervisor decider): 807/807. Full solution build clean.
• Deploy compose E2E (deploy-e2e.yml): green on 639bf2f (the frame and cold-degrade code it exercises is unchanged since), including the new run.sh summary assertion on a real Linux worker.

Notes

• The stdin preflight keeps its half-frame share (LargeCarrierBudgetBytes). It is the early cut for a goal no attempt can carry, taken before a spool exists.
• The persisted agent_run.resumed_from_agent_run_id column still records that the attempt was created to resume its predecessor. That is creation provenance and remains true; the Room's mark reads the envelope.