Recover rejected Codex candidates and streamed tool diagnostics

[HTExplicit]

Live acceptance found that a new source cookie can complete successfully yet fail both target STATE checks. The gateway then kept reusing that rejected candidate until expiry, causing repeated local 503 responses. On a qualified candidate, the real public Sol endpoint already completed a native tool call and full-history continuation.

Retire a rejected candidate only when no other usable proof or validation depends on it, then permit one bounded replacement through the existing source and proxy configuration. A second rejection cools acquisition; identical rejected credentials cannot gain lease lifetime. There is no background renewal, exit rotation, ordinary-path fallback or business replay. Preserve strict two-shot qualification and request-scoped failure attribution.

Also rebuild diagnostic output from completed SSE item events when the final response envelope omits output. This prevents a completed tool call from being reported as missing while retaining the successful-terminal requirement.

Validation: targeted replacement success/exhaustion, unchanged-cookie lifetime, other-proof/waiter preservation, failure cooldown, original source lifetime and partial-success tests passed. Streamed tool reconstruction and missing/failed-terminal regressions passed. Public Sol on v0.2.15-codexrip.4 returned two HTTP 200 completed responses with borrowing applied; Astra and Sol rejected a later candidate, retained as failing evidence. Final live acceptance follows deployment of this repair.