Crash recovery budget proof

Base: 4d6ebbdba855c7941966c50d3749f4eecc533488
Head: 2432ccb54ed5380a506e348c8f040d15bbe54212

Surface: real source server, driven through its shipped project/thread CLI.
Each side has a fresh database and synthetic scratch git project.
The deterministic ACP replay agent starts an actual foreground sleep 400
and keeps its turn unfinished. It supports session/load after server loss.
No database rows, timestamps, recovery state, or production code were edited.

Three times: wait for a running turn, SIGKILL the captured server PID,
restart the same commit with the same home, and inspect thread show --json.
After the third automatic resume, wait 367 seconds with the turn unfinished.
SIGKILL and restart a fourth time; inspect thread show --json again.

The videos render timestamped process events and captured CLI response fields
at 12x speed; they are CLI timelines, not web screenshots. The PNGs show their
final frames. The JSON files contain all five raw CLI state snapshots.
The transcript's runCount comes from those responses. The driver's older
message-count diagnostic is excluded: thread show intentionally omits server
continuation prompts, so those prompts are not a count of resumed runs.

Only the fourth-loss budget behavior is exercised. Completed-turn and planned
shutdown resets, and continuation-start retry behavior, are not exercised.
This is a generic server recovery proof; it does not exercise a real Codex model.