[lukemaj]

What: Superseded by PR #322 at c382af92d82d8b905402da0ad1dc07aad5a5cbd7 on a fresh rebased branch.
Why: Main advanced, and the fork stack requires rebasing rather than a merge commit.
So what: The parent binds native proof, Sol/Grok reviews and CI to #322 before deciding merge and rollout.

This PR is closed as superseded. Its old branch remains unchanged at 45e7b22c494fcf681e95a099e533217b8fad7840; no force push occurred. Current base is da7034eb8a465303710bccd91d55ea2618da4110. The bounded Claude correction and the current 473-test/type/lint/fork proof are recorded in #322 and the canonical #311 handoff.

ships contextmd#34; no Chromeria map part

The following archived notes describe the earlier candidate and its historical evidence, before the Claude fork corrections and current-base rebase.

Closes #311. Implements the server half of contextmd#34 under its accepted design handoff, including the fork-only R2 correction. Companion: ContextMD PR #74, frozen at 1c47c08e6d6a27b899d68583ff8f8304a18da0f8.

ships contextmd#34; no Chromeria map part

Change

• Validate the optional path with the mirrored 23-vector Python corpus, preserve its spelling after home expansion, require a regular target, and version the exact shared/personal knowledge line.
• Own whole-pointer claims by harness/session/epoch inside the 8,000-byte run budget. Preserve ordinary Cue/carry headroom, disabled defaults, the existing matcher/Library loader, and Claude's whole startup cap.
• Give OpenCode pointer P its own delivery, candidate, bytes, and claim. The new pointer routes own applying/settle/release; generic D routes refuse P and retain legacy NULL-delivery behavior. Replay merges both bodies.
• Forward Grok per-call rules only to adopted session/new calls. Bind immutable creation receipts before ref adoption, then charge/fence attachment before running/prompt dispatch, including rollback, cold load, and expired stages.
• Record Codex fork evidence immediately after native fork. Preserve inherited ancestor-prefix evidence when its receiving local run rolls back, while filtering removed actual deliveries, boundaries, versions, and surviving compactions.
• Share one serving/SQLite owner through application layers. Transports decode, call, and map typed errors.

Focused proof

On bestia, Node 26.8.2, using npx -y pnpm@11.10.0:

npx -y pnpm@11.10.0 exec vp test run \
  apps/server/src/contextmd/Select.test.ts \
  apps/server/src/contextmd/ServingState.test.ts \
  apps/server/src/contextmd/GreatLibrary.test.ts \
  apps/server/src/contextmd/ContextmdRoute.test.ts \
  apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts \
  apps/server/src/orchestration-v2/ProviderTurnStartService.memory.test.ts \
  apps/server/src/orchestration-v2/ProviderSessionManager.test.ts \
  apps/server/src/orchestration-v2/CheckpointRollbackService.test.ts \
  apps/server/src/orchestration-v2/CheckpointRestoreSafety.test.ts \
  apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts \
  apps/server/src/provider/acp/AcpJsonRpcConnection.test.ts
npx -y pnpm@11.10.0 exec tsc --noEmit -p apps/server/tsconfig.json
git diff --name-only 366f2fff -- '*.ts' '*.mjs' | xargs npx -y pnpm@11.10.0 exec vp lint

At exact head 937cbc6430eead3e2abb165147dfada7311c1f73: 11 files, 448 tests pass (95.84 s); server typecheck exits 0; scoped lint exits 0 with four unchanged warnings verified in base 366f2fff (unused NodePath, two unused selfInvocation variables, and the existing filter(...).at(-1) warning in ACP tests). Retained logs: TEST-chromeria-937cbc6-focused.log, TEST-chromeria-937cbc6-typecheck.log, and TEST-chromeria-937cbc6-lint.log in task-owned /tmp.

The tests cover actual Route/Serving/SQL mixed Cue replies, scoped receipts/refunds/replay, strict UTF-8/epoch/budget behavior, persistent Grok attachments, ACP creation/fallback/rollback receipts, manager forwarding/cache behavior, dispatch and rollback fences, and Codex inherited-versus-emitted rollback and projection negatives. Full repository coverage belongs to CI.

Fork ownership correction

The Fork Stack Model CI failure on 937cbc6430eead3e2abb165147dfada7311c1f73 was my omitted ownership registration. The same local check reproduced all nine unallowlisted upstream edits, exit 1. Commit cde552474d74fed464dffec3687a5490cac61028 registers exactly those necessary start/rollback/ACP seams and their tests under the existing contextmd-serving owner. It also records the two new pointer test/corpus files and watches six already-owned shared seams without changing their primary owners. The correction touches only docs/fork-features.md and scripts/fork-upstream-edits.txt.

Fresh proof on the clean corrected commit:

bash scripts/fork-check.sh --base 12069eefd707f78eafc27812027c994eea0613cf
git diff --check HEAD^ HEAD
git diff --quiet 937cbc6430eead3e2abb165147dfada7311c1f73 cde552474d74fed464dffec3687a5490cac61028 -- apps packages docs/map.md

All exit 0. The fork check uses the exact upstream base from the failed CI run, checks the full 60-commit stack, and reports fork-features: OK (36 features) and fork-check: OK. Retained red/green logs: /tmp/TEST-chromeria-937cbc6-fork-stack.log and /tmp/TEST-chromeria-cde552474d-fork-stack.log. Both heads have the identical apps tree 6f4ac94acf76a5e529a6386b73869d03b3b1d047. The 448 tests, typecheck and lint above were executed on 937cbc6430, whose implementation remains unchanged; they were not rerun for this metadata-only correction. GitHub CI and implementation reviews on the new head remain separate gates.

Native evidence and remaining gates

Before the final test/parity refinements, an isolated OpenCode 1.19.0 subject used the real backend owner, real Cue client against a local stub, and the exact companion plugin with the native root SDK/save endpoint. Eleven controlled scenarios passed: normal mixed save, reversed application order, first PATCH 4xx, missing transport, lost save response, held/late commit with identical retry, lost applying acknowledgement followed by user/retry, two restart cases, and native overflow replay. The normal request held one pointer and storage held one marked part; a rejected save refunded P alone. Native replay changed the part id, kept the marker, and the continuation held one copy with an epoch-1 receipt. All subjects were isolated and stopped by their captured PIDs; external model calls: zero.

The restart-after-lost-applying/no-save case reproduces the accepted conservative charged miss. It is recorded as a miss, not first-input acceptance. These experiments are pre-commit evidence, not the remaining exact-candidate native gate. The parent's exclusive native jobs still own final mixed/native barrier and retained-tail/replay acceptance, Codex F1-F4 and the nested fork/rollback/refork recorder proof. No real Codex proof is claimed here. The twelve visible live cells, natural-pressure Grok compaction, supporting builds, CI, and both exact-head implementation statuses remain parent-owned gates.

Task base: 366f2fff6f25f47c14ca86163d8ee8e4dd6c0961. Candidate: cde552474d74fed464dffec3687a5490cac61028. Current main at refresh: d74c023f7816d12282e5cb22fed83db7bc1618b4; its later #304 change has no owned-source overlap. Upstream-first searches at 7ac952c630ef8a60d14ca8f6a0c7adce33db4bae found no pointer replacement, as recorded in #311. No package bump, production/config/database change, restart, merge, or deployment. Website impact: none; this is a server capability whose setup documentation ships with the companion PR. #310 and ContextMD #71/#72/#73 remain outside scope.

Elon record

• Requirements and who asked: User and accepted contextmd#34 require the optional accurate first-input/compaction pointer, owned receipts, budgets/logs, Grok installation fences, and fork-only R2 correction.
• Deleted: Shared OpenCode receipts, run-only pointer dedupe, generic frameworks, loader/matcher changes, source-session restore reconciliation, extra design rounds, version bumps, and a misleading map assignment.
• Bottleneck: The implemented server candidate now unblocks the parent's exact-head native owner proof and independent implementation reviews.
• Checked myself: Accepted design trio and source seams, upstream/base identities, complete owned diff, focused tests/type/lint feedback, reproduced fork failure and corrected exact-head ownership check, actual API/SQL/Cue transitions, and isolated native OpenCode save/replay/fault observations with disclosed limits.

Authored by gpt-6.1-sol at max reasoning effort through the Codex harness in T3 Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: d74c023 · PR result: 937cbc6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.