Keep resumed threads in their own provider sessions

[SawyerHood]

Human comments

What was wrong

After the runtime identity mix-up in #3461, the server could resume a thread into whichever provider session its newest event named. Ordinary completion events and contaminated identity history could therefore redirect messages into another conversation. Current main still has this selector.

The independent safety review also reproduced a second path: editing a message can delete the original owner's identity event, making a contaminated later claimant appear to own that session.

What changed

Third layer of #3502 → #3503 → #3512. Review this layer against #3503; it retains the lower layers' Stop and Codex correlation behavior.

• Resolve sessions only from identity events after the last completed context clear. Compare claims within the provider and host; unknown hosts are treated conservatively. An earlier foreign identity is skipped in favor of an owned identity. Earliest claims tied in the same millisecond are ambiguous, regardless of insertion order.
• Refuse foreign-only, ambiguous, and invalid (null or empty authoritative handle) resume attempts with 409 provider_session_unavailable. No turn is dispatched or history appended. Queued sends record the refusal. /clear or bb thread clear starts a fresh session on the next send while retaining history.
• Check ownership on edit checkpoints and anchored/tip fork sources. Refuse an edit that would erase the earliest shared ownership evidence, both before provider rewind preparation and atomically before suffix deletion. If another claimant arrives while a rewind is being staged, discard that staged session and retain the original history.
• Record identities for empty-input starts. Require start/fork identity announcements in the public conformance kit and document unique, durable provider session handles. Scripted multi-process fixtures mint unique handles.
• Regenerate the identity index migration after current main as 0125_silent_guardian. Preserve idempotent index creation for migration replay. Update pruning tests to keep their retention assertions while no longer treating ordinary event stamps as authoritative identities.
• Resolve the real-provider integration manifest after test TMPDIR isolation so setup and workers use the same manifest.

No daemon wire fields change in this layer. Existing stored history is not rewritten on upgrade.

How you verified

Independent review covered the complete layer, #3461 and original investigation history, current-main changes, ownership queries/index plans, context clear, provider/host isolation, tied claims, legacy checkpoint lineage, and fork/rewind paths.

A new migrated-SQLite regression failed before the edit guard: removing the owner's identity changed the other thread from foreign to owned. Additional regressions fail before and pass after for null/empty identity handles; these cannot silently replace the conversation. Guard tests cover tied/strictly ordered claims, provider/host/unknown-host scoping, retained duplicate claims, clear-context retention, pre-rewind refusal, and a competing claim arriving before the atomic edit commit. Server tests assert no history mutation or replacement start after refusal, and successful staged-session discard.

Final head: 55097953348f0d583e34317375ed693d4d130716, based on #3503 cd67ddbb5735e4153e506bceec1a8c6a665dc2ef. Its tree exactly matches the reviewed local tree. Fresh forced Turbo checks ran on integrated implementation head e23319817a80042971fcf1e40036dda9b11ae5e6; the final follow-up changes only fixtures and formatting:

• DB: 573 tests and typecheck passed, including the generated migration, replay, query plans, new edit guard and invalid-history regressions.
• Codex: 317 tests and typecheck passed. The unit run excludes inherited account-pool environment variables because one missing-variable test assumes they are absent.
• Server: typecheck passed. The full run passed 2,909 tests with one skipped; two failed. One new-main fork metadata fixture lacked an identity announcement and was corrected. The other, an unchanged machine-environment test, exceeded its five-second limit under full-suite load. All nine affected fixture tests then passed with default timeouts; the 57-test migration suite also passed after formatting. The final follow-up changes tests and formatting only.
• Other unchanged surfaces were freshly verified before final lower-layer integration: protocol 282, SDK 291, Claude Code 364, ACP 319, Pi 167 (one skipped), echo 15, scripted echo 1, bb-guide 5, and server/bridge integration 82. Corresponding typechecks passed.
• Real codex-cli 0.154.0: isolated session/workspace tests through the configured account pool. All 12 tests passed again with the final integrated implementation, serially: eight basic lifecycle and four cross-process resume tests. The final fixture-only commit does not change provider code. These are live provider calls, with no production BB process or imported store started.
• The SDK npm version guard passes for unpublished 0.4.99. Changed-file formatting passes under repository configuration; generated snapshots were not manually edited.

Commands:

pnpm exec turbo run test typecheck --filter=@bb/db --filter=@bb/server --filter=bb-plugin-provider-codex --force --continue=always
pnpm exec turbo run test --filter=@bb/integration-tests --force
pnpm exec turbo run test:integration --filter=@bb/agent-runtime --force -- integration.provider-basic.test.ts integration.resume.test.ts -t '^codex' --maxConcurrency 1

Local runs used a writable npm cache. Tests were forced rather than relying on prior CI or cache results. The full server run is not represented as wholly green; the two failures and focused confirmations are reported above. Final-head CI remains the landing gate.

Limits

• Ownership is inferred from retained records, not an independent durable ownership ledger. Purging all original-owner records still removes that protection.
• Existing legacy fork/rewind checkpoints whose session was never announced remain usable when no conflicting claim exists. Missing announcement history is not proof of cross-thread ownership.
• Falling back to an older owned session cannot recover context written into another rollout.
• A late edit refusal leaves the source session and stored history intact. Discarding an unused staged rewind is best-effort; a provider cleanup failure can leave an unused staged session.
• Third-party bridges must provide handles unique across that provider's sessions on a host.

Fixes #3461

AGENT GENERATED