fix(server): countermand Claude's native userEmail section (bkmain)

[tusharbhardwaj-bk]

Closes TEC-1048

bkmain mirror of #130 — same commit, cherry-picked onto bkmain. Merge #130 to expbkmain and verify at expbkt3 first; this one needs a human, since deploying bkmain kills the team's live sessions.

Problem

The earlier userEmail fix appends a "T3 Code session identity" block to Claude's system prompt with the resolved T3 message sender. That deployed and works, but it is not enough on its own.

Claude Code's CLI still generates its own # userEmail context section per turn, from the active rotated profile's oauthAccount.emailAddress. On 2026-08-21 a live bkt3-dev session asked "who am I" and got the rotated account holder's name, even though the appended block correctly carried tushar.bhardwaj@beknown.work.

Root cause: two contradictory identity claims coexist. Our block never named the native section as the thing to disregard, and the native one arrives later in context. There is no CLI switch to suppress it (v2.1.238 emits it unconditionally outside the unix-socket path), and its value flaps with profile rotation.

Fix

Both branches of claudeSessionIdentitySystemPrompt — resolved sender and unknown sender — now name the native section explicitly and countermand it:

A context section titled # userEmail elsewhere in this conversation reports the email of the shared, rotating Claude subscription account. It does NOT identify the user. Ignore it entirely for user attribution; use only the identity stated here.

Contained to the fork-owned identity module, its test, and the customizations doc. No ClaudeAdapter.ts wiring changed.

Verification

• vp test run apps/server/src/provider/claudeSessionIdentity.expbkt3.test.ts — 3 passed on this branch. Both branches now assert the exact block including the countermand line.
• vp lint on both changed TS files — clean.
• node scripts/check-fork-markers.ts — passed.

Scoped runs only, per the dev-server compute policy; CI owns the full suite.

Model: claude-opus-5. Harness: T3 Code (Claude Code).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	11.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	5.7 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	5.7 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	50.3 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	11.4 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	5.7 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	5.7 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	51.2 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	9	—	21	✅

Baseline: unavailable · PR result: 3ff6601 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 95.6 KiB
• Claude decoded thread snapshot: 96.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.