fix(prime): verify native transcript and compaction continuity

[rynfar]

Native Prime messages and compaction could make a valid session fail transcript continuity after synchronization. Preserve private identities for the known append-only native records, and accept a replaced compaction context only after the exact session tree proves its previous history, retained boundary, summary and current snapshot.

The tree read is bounded, tied to the active session/leaf/connection generation, and used only when ordinary reconciliation fails. Live compaction summaries remain invalid. Existing lifecycle, tool-cycle, ordering, duplicate and restart checks remain required; private contents never enter client projections.

Fixes #552. Includes ipython_state, emitted when Prime compacts kernel context. Automation (heartbeat_prompt, thread_goal_state, goal_context) remains explicitly unsupported pending Pylon-owned occurrence/turn semantics. Unknown types, changed fingerprints, missing/oversized trees (over 8,192 entries), and unproved compaction chains fail closed. Prime #77 preserves custom timestamps for future histories; existing timestamp mismatches are deliberately rejected, with an actual native regression fixture documenting that limit.

Validation: 578 focused tests across decoder, adapter, runtime, restart and compaction history passed; scoped lint and server typecheck passed (existing Effect suggestions remain). The positive and legacy-negative fixtures came from isolated Prime faux-provider sessions with real persisted compaction. Adapter coverage includes shorter-context recovery, duplicate snapshots, changed retained history and missing proof; runtime coverage rejects foreign leaves/sessions and retired connections. CI also includes #571's unrelated baseline expectation correction.

Delivery is tracked in #557; merging this PR alone does not update an installed application or Prime runtime. The developer authorized review, fixes and merging this batch.

Implemented and reviewed with GPT-6 Astra in Pylon/Codex.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 15, 2026 12:57am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.9 KiB	13.9 KiB	−5 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−3 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.9 KiB	13.9 KiB	−3 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−2 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.8 KiB	58.8 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 10b25f1 · PR result: 0131c9a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.