fix(compression): make durable adoption proof-preserving across repair and restore

[andrexibiza]

Current disposition

Exact head: 2345516d852de091d5ac845287add95c2f1a322d.

Do not rebase or merge this branch as a standalone caller-only row-stamping change. Maintain it as one proof-preserving compression slice with #88740 and #88758.

Current topology: 3 commits ahead, 291 behind current main; merge base e02d1e41...; non-mergeable.

Proof-preserving rebase contract

1. Rebase the existing durable-parent adoption gate onto current main, preserving merged fix(gateway): stop Desktop edit-resend from truncating the wrong turn #87150’s restore stamping.
2. Stamp only the three genuinely remaining restore boundaries from compression: preserve durable row-ID watermarks across child, CLI, and ACP restores #88740.
3. Preserve exact surviving _row_id identity through repair/cleanup.
4. Stamp a separate projection-level greatest raw durable row consumed watermark from compression: preserve the raw durable watermark through replay cleanup and alternation repair #88758 on every surviving projected message.
5. Compare both live and durable candidates only after the same repair/projection transform.
6. Carry only the internal row identity and consumed watermark through gateway/internal replay.
7. Strip both from provider/display serialization and do not persist inherited proof metadata as new row identity.
8. Keep missing, malformed, bool, zero, negative, forged, or unpersisted proof fail-closed.
9. Run real append, merge, orphan-tool, background-review, replay-tail, child adoption, ACP, CLI fallback, gateway, /undo, and lease-reload witnesses on the composed SHA.
10. Remove unrelated attribution housekeeping from this PR:

• take current main’s canonical one-line contributors/emails/andrexibiza@gmail.com mapping instead of the branch’s comment-only variant;
• drop the two hostname-derived contributor-file deletions from this compression PR and handle them separately if still needed.

A caller-only stamp can make a restore eligible while losing proof that cleanup consumed a higher durable row. That would re-adopt malformed or intentionally stripped content and reopen the amplification class under a more convincing watermark.

Repository ref/Contents writes currently fail because the connector has no installed GitHub App account/repository principal; no rebase is claimed.

Original class closed by this branch

Follow-up to #88197: compress_context adopted a durable parent whenever len(durable_parent) > len(messages). Active-row count is not monotonic. Rotation can end a parent and publish a newer child with fewer rows but strictly newer AUTOINCREMENT identities. The length gate could therefore re-adopt a stale-but-larger snapshot after an aborted rotation or concurrent flush, resummarize the same content, and amplify stored rows.

This branch replaces the direction-blind length gate with a monotonic row-identity adoption check:

• load the durable parent with row IDs;
• adopt only a strict durable append beyond the snapshot’s known durable row proof;
• recheck parent liveness in the same decision window;
• fail closed when the anchor/session proof is unavailable;
• preserve BUG: Anti-thrashing protection permanently disables auto-compression with no recovery #14694’s no-wedge invariant by skipping adoption rather than aborting compression.

Existing implementation

• agent/conversation_compression.py: max-row-id append gate and liveness recheck.
• SessionStore.load_transcript: production row-ID retrieval chokepoint.
• main-loop replay and lease-wait reload carry existing row proof.
• regression coverage for stale larger snapshots, genuine concurrent appends, liveness TOCTOU, missing anchors, and the known content-blind higher-ID behavior.

Why #88740 and #88758 are prerequisites, not follow-ups

Repair transforms can merge or delete the message that carried the greatest raw _row_id:

• consecutive-user repair;
• orphan-tool cleanup;
• background-review stripping;
• replay-tail cleanup.

The repaired projection therefore needs two distinct facts:

surviving message identity: _row_id
projection consumption proof: _row_id_watermark

Every survivor receives the greatest valid raw durable row consumed by that projection. Durable reload and live comparison use the same projected representation. Projection metadata is internal-only and is not written back as provider content.

Prepared evidence

The stacked B2 patch/harness is useful design evidence only:

• patch compression-restore-row-ids-b2-robust.patch, SHA-256 f6d6d4406e1ef69e4604bbd4271a7090bb4d4b10c2f3bc1060c82a2c9fbd3f6c;
• 19 repository-integration regressions prepared;
• 26 dependency-free contract tests passed;
• structural apply/reverse-apply and diff checks passed against the frozen old head.

It was not rebased to current main, imported against a complete live repository, or run through Ruff/full CI. The newer packaged handoff is still a handoff, not a remote branch or commit.

Historical verification

• focused adoption/fork/watermark suites: 52 passed;
• new regressions demonstrated RED on the pinned parent and GREEN on the fix;
• compilation, attribution audit, and git diff --check: clean;
• full historical CI matrix: green at the old exact head.

Attribution and interlocks

• Fixes compression: TUI shutdown leaves dirty ended_at on live session → rotation aborts; abort loop duplicates messages until API 400 #88197 — reported by @mayqhw, including the 303→2,611 row amplification evidence.
• fix(compression): stop an aborted rotation from growing the parent it could not publish #88411 by @kshitijk4poor is the complementary merged flush guard and remains authoritative on its surface.
• fix(compression): stop an aborted rotation from growing the parent it could not publish #88227 by @jackulau is prior salvage/analysis provenance.
• compression: preserve durable row-ID watermarks across child, CLI, and ACP restores #88740 — remaining restore-boundary stamping.
• compression: preserve the raw durable watermark through replay cleanup and alternation repair #88758 — projection-level greatest-consumed watermark.
• fix(gateway): stop Desktop edit-resend from truncating the wrong turn #87150 — already merged restore stamping; do not duplicate.
• Composes with BUG: Anti-thrashing protection permanently disables auto-compression with no recovery #14694, ws_orphan_reap kills gateway-originated sessions, causing Groundhog Day routing loop #60609, fix(sessions): recover orphaned compression parents without continuations (#80337) #80487, and Context compression silently loses unflushed messages (end_session without flush) #47202.

[andrexibiza]

Rebased #88551 onto current main (e02d1e41) and pushed the rewritten branch.

• Old head 5ae1bb61 → new head 2345516d852 (clean 3-commit replay, no conflicts).
• Proof-preserving slice kept: no new restore stamps at _adopt_live_compression_child, the ACP process restore, or the CLI _init_agent() fallback — those remain fail-closed until compression: preserve the raw durable watermark through replay cleanup and alternation repair #88758 provides a projection-level consumed-row watermark. No acp_adapter/ change, no projection-watermark terminology in the diff.
• The diff also drops the two case-colliding contributors/emails/agent@…Mac-mini.local files and adds the andrexibiza@gmail.com mapping (repo attribution cleanup).
• Verification: focused compression tests 52 passed, py_compile clean, git diff --check clean, CI green (32 success / 0 failure), mergeState CLEAN.

This is the compression-slice rebase only — the #88740 restore boundaries remain intentionally unstamped pending #88758.

[andrexibiza]

Current interlock receipt on head 2345516d852de091d5ac845287add95c2f1a322d:

• Exact-head Docker 32138391385: success.
• Exact-head CI 32138392058: success.
• The branch is now 286 commits behind current main, so it does need maintenance before merge.

Do not do a standalone mechanical rebase and merge this head by itself. Its own body is correct that #88740 and #88758 form the proof-preserving follow-on boundary: caller stamping without the projection-level greatest-consumed watermark can turn today's safe fail-closed restore into a false-positive re-adoption of rows that cleanup already consumed/removed.

Maintenance order:

1. rebase the existing fix(compression): make durable adoption proof-preserving across repair and restore #88551 watermark gate onto current main;
2. in the same proof slice, add the three surviving restore stamps from compression: preserve durable row-ID watermarks across child, CLI, and ACP restores #88740;
3. carry a separate trusted projection watermark from compression: preserve the raw durable watermark through replay cleanup and alternation repair #88758 without overwriting surviving _row_id values;
4. load adoption candidates through the same repaired live-replay projection;
5. allow only _row_id + projection watermark through internal replay, strip both before provider/display serialization;
6. rerun the original fix(compression): make durable adoption proof-preserving across repair and restore #88551 focused suites plus consecutive-user/orphan-tool/background-harness false-positive and genuine-new-append false-negative witnesses.

Until that combined candidate exists, the current green head proves #88551's own first slice only. It does not prove the newly eligible restore surfaces.

[andrexibiza]

Architecture interlock — this stack is the durable-projection instance of #90145

Keep #88551 + #88740 + #88758 as one proof-preserving slice. The repository-level invariant is now explicit in #90145, but it should not replace the subsystem-specific row/watermark design here.

The important distinction remains:

surviving message identity:        _row_id
projection consumption authority: _row_id_watermark

A surviving row ID names one durable message generation. It does not reconstruct authority over rows that repair/cleanup already consumed. The greatest-raw-consumed watermark is therefore a separate generation/window proof, not redundant metadata.

Pattern 1 formulation for this stack:

Names may locate candidates; they do not confer mutation authority. Row count, list length, survivor position, or “latest visible row” may identify a plausible projection, but adoption/cleanup must consume the exact durable generation proof carried through the transform.

Keep the existing fail-closed treatment for missing/malformed/forged/unpersisted proof. In particular, do not allow legacy records lacking _row_id / watermark semantics to acquire current authority merely because they are the only or largest candidate.

Required ABA shape remains:

projection A observes durable generation/window N
pause A
new rows / cleanup / repair produce N+1
resume A with N proof
=> A cannot re-adopt, delete, advance, or certify N+1

This composes with #90144: survivor identity proves the surviving object; the projection watermark proves the wider consumed mutation window. Neither may be widened into the other.

[andrexibiza]

Coordination update: treat #88551 + #88740 + #88758 as one proof-preserving implementation model, not sequential independent fixes. _row_id is surviving durable object identity; _row_id_watermark is the greatest raw durable row consumed by the repaired projection. Cleanup may merge/drop the highest row, so neither fact substitutes for the other. Both live and durable candidates must pass the same repair/projection transform before freshness comparison; missing/malformed/unpersisted proof remains fail-closed; both fields remain internal and are stripped before provider/display serialization. This PR stays ready-for-review (draft: false) while the current branch is semantically compressed/rebased around that combined contract.

[andrexibiza]

Source-of-truth correction on the publication blocker: ref mutation is currently available through the connected GitHub surface, so the older PR-body sentence attributing this rebase solely to missing GitHub App repository authority is no longer current.

The real blocker is now the implementation state itself. Against upstream main 8794e5a21c980a0f26532cb4883284b786cb3f25, this branch is ahead_by: 3, behind_by: 673, merge base e02d1e41fc6104187e20af9eac8b2820566e3508, with the old caller-only/watermark precursor diff still mixed with contributor housekeeping. #88740 and #88758 remain issues, not published current-main implementation children.

I am not force-moving or mechanically rebasing this branch: unlike the empty #84963 placeholder branch, it carries three unique implementation commits and a proof-preserving semantic restack is required. Completion still requires the composed current-main slice described in this PR: surviving _row_id identity plus greatest-consumed _row_id_watermark, same projection on both comparison sides, the remaining restore-boundary stamps, internal-only replay propagation, attribution cleanup, and exact-head hosted verification. No completion is claimed.

[andrexibiza]

One-lane proof contract published in #91913

The authority-continuity manifest now makes this PR the single compression implementation owner and records #88740 / #88758 as interlocked specification nodes, not independent rebase lanes.

The conformance gate requires both proof dimensions:

_row_id            = exact durable row represented by a survivor
_row_id_watermark  = greatest raw durable row consumed by the projection

This prevents a caller-only row-stamping rebase from becoming merge-authorized without projection-consumption proof. Durable and live candidates must use the same repair/projection transform, and provider/display serialization must strip both internal fields.

Contract PR: #91913
Exact head: 170a3a0e67034abd7d6a2c69a16c292b4781720f.