fix(server): reconcile Pi native session rewinds

[StiensWout]

Pi extensions can rewind the native session tree while T3 keeps displaying abandoned turns and captures rollback refs from append order.

Walk the active leaf’s ancestry, reconcile abandoned runs and checkpoints, and skip turns that left no native entry when reverting. Session replacement and corrupted ancestry do not trigger reconciliation. Rebased onto current main while preserving subagent model synchronization.

Addresses the in-session rewind behavior in #13507.

Validation: 93 focused adapter/ingestor tests, Pi package typecheck, and scoped lint.

Limits: detached rewinds rebaseline; extension forks are not tracked; returning to an abandoned branch does not restore retired runs; branch summaries can prevent rollback.

_{Prepared for Wout by gpt-6.1-sol in T3 Code via Codex.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This change adds substantial native-session ancestry reconciliation and can alter persisted run and checkpoint state when Pi rewinds a conversation. It spans the provider adapter, shared event contract, and server orchestration rather than remaining a small local fix.

^{You can add or adjust custom eligibility rules. Learn more.}

[StiensWout]

@juliusmarminge this can be merged into the OV2 PR, #2829. All checks are green on f524de5, and Macroscope's correctness and Effect conventions checks passed with no findings.

_{claude-opus-5-5[1m] via Claude Code in T3 Code, responding for Wout.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67b5297d-cb16-48c9-bb14-b85f40ecf2fc

📥 Commits

Reviewing files that changed from the base of the PR and between a240756 and 67f9a23.

📒 Files selected for processing (2)

• packages/provider-pi/src/server/adapter.test.ts
• packages/provider-pi/src/server/adapter.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The Pi adapter now identifies retained turns by walking the active session branch. Thread updates can report those turns, and event ingestion uses them to roll back off-branch runs and stale their ready checkpoints.

Changes

Pi Native Rewind Reconciliation

Layer / File(s)	Summary
Retained-turn event contract packages/provider-core/src/server/ProviderAdapter.ts	The provider_thread.updated event now optionally carries native turn IDs retained on the active branch.
Pi active-branch tracking packages/provider-pi/src/server/adapter.ts, packages/provider-pi/src/server/adapter.test.ts	The adapter validates session entries and walks parent ancestry to identify active-branch user turns. It reports retained IDs after confirmed in-session rewinds, updates turn references and conversation heads, and selects rollback boundaries. Tests cover rewinds, invalid ancestry, replacement sessions, and rollback boundaries.
Run and checkpoint reconciliation apps/server/src/orchestration-v2/ProviderEventIngestor.ts, apps/server/src/orchestration-v2/ProviderEventIngestor.test.ts	When retained turn IDs are present, ingestion selects settled off-branch runs, excluding the reporting run. It marks ready checkpoints stale and rolls back selected runs and existing root nodes. Tests verify retained and unrelated runs remain completed.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant PiSession
  participant PiAdapterV2
  participant ProviderEventIngestor
  participant RunAndCheckpointState
  PiSession->>PiAdapterV2: Provide session entries and active leaf
  PiAdapterV2->>PiAdapterV2: Walk active-leaf ancestry
  PiAdapterV2->>ProviderEventIngestor: Emit thread update with retainedNativeTurnIds
  ProviderEventIngestor->>RunAndCheckpointState: Roll back off-branch runs and stale ready checkpoints

Loading

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 67f9a

The reviewed in-session rewind behavior has no identified merge-blocking issue. The documented fork and session-replacement limits remain outside this change.

Architecture Summary

Architecture risk: 🔵 Low · up to 67f9a

The change affects 3 systems.

Changed systems: packages/provider-pi, apps/server, packages/provider-core

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — packages/provider-pi (library) was modified; 2 changed files map to changed impact.
• observed — apps/server (service) was modified; 2 changed files map to changed impact.
• observed — packages/provider-core (library) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in apps/server/src/orchestration-v2/ProviderEventIngestor.test.ts: Added CheckpointId, CheckpointRef, and CheckpointScopeId imports for the new checkpoint fixture.
• observed — Modified behavior in apps/server/src/orchestration-v2/ProviderEventIngestor.test.ts: Added ProviderThreadId and ProviderTurnId type imports for the new run-seeding fixture.
• observed — Modified behavior in apps/server/src/orchestration-v2/ProviderEventIngestor.test.ts: Added a regression test that seeds completed, interrupted, and running runs across two provider threads, including checkpoints for completed runs. It ingests an update for the rewound provider thread with kept-turn as its conversation head and retained turn, then asserts that the other-thread and retained runs stay completed, the abandoned completed run and weakly referenced unlocated run are rolled back, the active rewinding run stays running, the abandoned checkpoint is stale, and the provider thread’s last run ordinal remains 5.
• observed — Modified behavior in apps/server/src/orchestration-v2/ProviderEventIngestor.ts: Adds the OrchestrationV2ThreadProjection type import for the new internal rewind-selection helper.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #13507 requires T3 to follow external Pi session-tree rewinds, mark abandoned runs and checkpoints rolled back or stale, restore the provider head and ordinal, and preserve native turn reference…	Implement reconciliation for the remaining supported Pi fork, clone, and session-tree replacement flows, or narrow the linked issue requirements with an accepted follow-up. Ensure branch summaries do not leave T3 state on an abandoned branc…

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check		The adapter ancestry validation, retained-turn event contract, ingestor rollback logic, rollback-boundary change, and focused tests directly support issue #13507. Corrupted-ancestry and failed-read sa…
Title check		The title clearly and concisely identifies the main change: reconciling Pi native session rewinds in the server.
Description check		The description covers the problem, implementation approach, scope limits, linked issue, validation activities, and agent attribution. It provides enough detail for review, although it does not includ…

Full details: Linked Issues check

Explanation

Issue #13507 requires T3 to follow external Pi session-tree rewinds, mark abandoned runs and checkpoints rolled back or stale, restore the provider head and ordinal, and preserve native turn references. The adapter now walks validated ancestry and emits retained native turn IDs. The ingestor rolls back settled runs off the retained branch and skips turns without native entries. However, the PR explicitly leaves Pi fork/clone and session-replacement flows unsupported. It also documents limits for extension forks and some branch-summary cases. These are part of the linked issue's stated native rewind scope.

Resolution

Implement reconciliation for the remaining supported Pi fork, clone, and session-tree replacement flows, or narrow the linked issue requirements with an accepted follow-up. Ensure branch summaries do not leave T3 state on an abandoned branch. Add regression tests for each supported flow and verify run status, checkpoint status, provider head, lastRunOrdinal, and nativeTurnRef.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[StiensWout]

Fixed the malformed-ancestry concern in 67f9a23. Missing/non-string parent IDs and duplicate entry IDs previously produced an incomplete retained-turn set in three protocol-level reproductions. Such listings now take the existing failed-read fallback and never authorize run/checkpoint reconciliation. Explicit null roots remain valid.

All 93 focused adapter/ingestor tests, the Pi package typecheck, and scoped lint pass. The ancestry tests wait for the completed turn before inspecting its final thread update.

The PR description now says it addresses the in-session rewind portion of #13507. Fork/clone replacement flows remain documented limits, and the issue will stay open for them.

_{gpt-6.1-sol via Codex in T3 Code, responding for Wout.}