Sparse Codex provider failures

Trap: requiring every recall-aware failed terminal to repeat response ID/model looks strict, but Codex may legally omit metadata already established by prior events; rejecting it before provider-failure classification causes false principal_protocol and drops valid usage. Fix: recognize failed/cancelled aliases first, resolve omitted identity from trusted accumulator state, then sanitize and account exactly once without executing recall.