fix(summarizer): keep Codex summaries on the Codex route

[HengYangDS]

Problem

When Codex app-server summarization fails, summarizeConversation currently falls through to the Claude Agent SDK's transcript-text path. A Codex exchange without a forkable session ID also takes that Claude path. This silently changes provider, authentication and potential cost instead of reporting a Codex summary failure.

Change

• Route every Codex exchange through the Codex branch only. Require a session ID for the existing ephemeral, read-only thread/fork mechanism.
• Propagate a Codex app-server error, or a missing session ID, rather than invoking Claude. Existing callers can record a retryable summary failure while indexing exchanges independently.
• Update current user guidance; the Claude fallback model remains relevant only for Claude summaries. This PR does not select or rewrite any Codex conversation model.

Verification

• Two regression tests failed on upstream main: an unavailable Codex binary and a Codex transcript without a session ID both incorrectly returned a Claude summary. Both pass after the change and assert the Claude SDK is never called.
• Full local suite: 352 tests passed across 64 files. npm run build, bundle syntax, and a redacted commit-range secret scan passed.
• Local tests reused pre-existing development dependencies and a local model cache; a fresh local npm install did not complete inside a 300-second bound. This is not a cold-install claim. The fork PR's Node 22/24 CI is the cold-install gate.

Scope and risk

No cross-provider fallback is attempted for Codex. A Codex transcript lacking a session ID remains indexable but has no generated summary until a safe Codex-native transcript path exists. Claude-session summarization behavior is unchanged. The unrelated generated MCP dependency drift is removed. Summary generation is not reachable from the MCP entrypoint; its bundle now remains byte-exact to the upstream base, with no dependency upgrade, host-specific code or personal policy.

Additional local Node matrix (2026-09-26)

On macOS arm64, this current PR head passed npm run build, node --check dist/mcp-server.js, and the complete test suite on Node 22.23.3 and Node 24.21.0 (352/352 tests on each). Each run used a fresh source snapshot and the corresponding per-Node native dependency tree, with a pre-seeded local embedding-model cache and an isolated OMP_HOME. The dependency trees were installed from PR #179 (all five PRs have the same package.json); this is not a separate empty-cache install for each PR, an Ubuntu result, or an upstream CI pass.

Minimal-scope revision (2026-10-11)

Exact follow-up head: 8e6d75bbd694727f7430e8017df46e44e0b3580a; parent: 2e44c81ab2db48c03897e17a6c621c59cd9bb5d4.

• Restored only dist/mcp-server.js to the exact upstream 7e06519357777badd7a115d2014a7ef845904310 blob. The submitted bundle's ten product-source sections were already identical to upstream; original esbuild reachability excludes src/summarizer.ts. This removes unrelated dependency behavior/layout changes, not Codex no-fallback behavior.
• All other 212 tracked files and executable modes remain exact parent bytes. The PR now consists of six focused source/dist/documentation/test files.
• On macOS arm64, existing workspace Node 24.19.0/npm 12.2.0, native npm run build, original bundle syntax and 352/352 across 64 files, zero skips, including three actual packaged MCP tests, pass. Fresh build output is qualified separately and the exact unchanged upstream bundle is retained afterward.
• Uses the same isolated native npm ci tree as fix(indexer): keep session indexing incremental on append #176/fix(verify): distinguish appended exchanges from archive refreshes #177, whose manifests are byte-identical, and the unchanged earlier resolver lock/model cache. It is not a separate install, an official committed lock, a cold-model claim, or a hosted/Windows result. Native allowScripts, trusted-isolated-dev-tool risk limits, providers, sessions and installed plugin stay unchanged; exact test temporary-state cleanup is verified.

Hosted workflow approval/CI, maintainer merge, stable release inclusion and installed-consumer adoption remain separate unverified gates. #180 overlaps Codex routing and must be integrated against the resulting upstream inputs; the unchanged parent evidence is not claimed for a different merged source. No duplicate approval ping accompanies this factual revision.

[HengYangDS]

Author follow-up for #178: the exact PR head is still mergeable, but its CI run remains action_required and has not executed. The consolidated current request on #180 covers this contribution as well: please approve the fork workflow and review its narrow source behavior for merge. I will address resulting failures and keep generated output, portability and generality qualified; no hosted pass or installation update is claimed.