fix(server): preserve Claude rewind across fork history changes

[rynfar]

Claude native forks can retain the correct conversation while changing system-message history length. Rewind now validates retained conversation bodies and remaps their fork UUIDs, preserving Pylon’s session ownership and checkpoint guards.

Adopts upstream #11954, source eed974c122e192de45b54b7dac7ca1a51448c08f, with original author maria and coauthor provenance preserved. Part of #611; frozen upstream head 6d1d549441be84f19696ab59ed7e2fbf305280d4. The review cursor remains unchanged.

Validation:

• All 173 Claude adapter tests pass, covering system metadata changes, restored ancestry, missing/reordered/changed conversation, malformed targets, stopped sessions and subsequent rewind.
• Scoped server typecheck and lint passed in the implementation worktree.
• A separate Antigravity adversarial reviewer found nine existing startup-fencing fixtures changed message bodies during simulated forks. The fixtures now model the SDK correctly; production validation remains strict and all nine fencing assertions pass.
• No wire, persistence, migration or client contract changes. Backend behavior is shared by web, desktop and mobile, including remote connections. No live paid-provider session was required or claimed.

Implementation and adversarial review used Gemini 3.8 Flash High through Pylon’s Antigravity delegation; integration and verification used GPT-6 through Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 18, 2026 12:21am UTC

[rynfar]

Independent Antigravity adversarial review completed on author head 5498dfbac6ccd567991c7d9c7cd4bcad07451d30 (same implementation/test contents as this PR; integration commits only change hashes and add the decision index).

The reviewer found the nine startup-stamp fixture failures; these are resolved by preserving message bodies across simulated forks. The reviewer rechecked the final fixture correction and additional adversarial cases and reported no remaining blockers. Original and corrected validation runs confirm 9 failures / 164 passes before the fixture fix, then 173 / 173 passes after it. Production deep-content validation was not weakened.

Review covered suffix alignment, duplicate message bodies, metadata omission/insertion, tool results and steering, UUID remapping, reset-all, failed-fork state preservation, stop/replacement fencing, and account-scoped history workers. Server typecheck and targeted lint passed. Native paid-provider execution is not claimed.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	13.9 KiB	−23 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+9 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−32 B (−0.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	+20 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.8 KiB	+10 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 738b5ed · PR result: 67171d0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.