v1.3.1 — Auto-recover policy preview (live recovery unavailable)

This Mac development preview adds the Auto-recover policy and Limits → Test logic. Live Auto-recover is not implemented or enabled. The switch is explicitly unavailable. The computer-use tool rejected inspection of Codex for safety reasons, so its live Retry, Fast, Stop, error and approval controls could not be verified.

The synthetic policy covers capacity-only recovery, progressive waits and Retry-After, Normal-first retry, temporary Fast with a 120-second deadline, verified Stop/Normal/Continue sequencing, four attempts at most, one Continue, burst limits, and manual Stop/cutoff/draft/approval overrides. Unconfirmed actions never repeat automatically.

The app adds no recovery polling, observers, resident worker, permissions or persisted enabled setting. Existing usage and private sync remain available. No global Codex configuration is changed. The policy is scoped to an explicitly armed episode; a supported live adapter, event scheduler and crash-restoration handling still need implementation and end-to-end testing. See AUTO_RECOVERY.md.

Validation: 78 synthetic recovery tests, 35 existing mock Stop tests, native model tests, 352 Python tests (3 skipped), package self-checks and synthetic external-collector checks passed. The installed native UI ran all 12 in-app simulations successfully and displayed real usage. None of these tests validates live Codex recovery.

Built locally on Apple silicon; no GitHub Actions or Codemagic minutes used. Mac app is ad-hoc signed, not notarized. The Python download retains the Qt interface and does not include this native Mac preview. This prerelease does not replace the stable 1.3.0 Mac download or the cross-platform latest release.