Add feature-gated session segmentation

[friel-openai]

Summary

• Add the disabled-by-default experimental session_segmentation feature.
• Serialize append, flush, shutdown, and rotation through one per-thread writer transaction.
• Publish immutable predecessor snapshots for compaction and forks without removing the canonical rollout path.
• Collect immutable segments after the last active or archived canonical rollout stops referencing them.

This is the writer follow-up to #27968. That prerequisite owns the unchanged RolloutReferenceItem wire format and all reference-aware readers. This PR adds no database migration and does not change the wire format.

Write contracts

• The canonical rollout path always names the complete predecessor or the complete successor. Rotation writes and closes a same-directory temporary successor, then commits it with one atomic replacement. There is no remove-then-rename sequence and no copy-over fallback.
• The per-thread writer guard places every accepted append entirely before or entirely after rotation. An append cannot be acknowledged and then overwritten by the successor.
• A compaction predecessor uses nth_user_message: None and consumes the bounded model-replay segment budget. A fork snapshot uses nth_user_message: Some(usize::MAX) and does not consume that budget.
• Newly created rollouts have a segment_id. A legacy rollout without one is copied to a dedicated immutable initial path before publication, so its live canonical path cannot later resolve as the captured predecessor.
• Immutable segment lifetime follows graph reachability, not the thread ID in the storage path. Deleting a parent retains segments referenced by a child; deleting the final referencing thread collects them.
• Reference-backed full-history subagent forks intentionally preserve the exact parent transcript prefix, including reasoning and tool items. Copied-history fallbacks and last-N forks retain the existing materialization and sanitizer behavior.

If a failure occurs before atomic replacement, the old canonical file and writer remain usable. If reopening the successor fails after replacement, rotation atomically restores the predecessor. A retry also removes an immutable collision left by a process crash only after confirming that no canonical rollout references it.

Test plan

• cargo test -p codex-thread-store (88 passed)
• cargo test -p codex-rollout (85 passed)
• cargo test -p codex-features (51 passed)
• Focused codex-core compaction, alternate context-window, full-history subagent, inactive mid-turn fork, and repeated explicit-fork tests passed with RUST_MIN_STACK=33554432
• bazel --batch test //codex-rs/thread-store:thread-store-unit-tests
• Scoped just fix for codex-thread-store, codex-rollout, codex-features, and codex-core
• just write-config-schema
• bazel --batch mod deps --lockfile_mode=error
• Argument-comment lint passed all 674 targets, including 127 manual Rust test targets, in Bazel batch mode
• just fmt
• git diff --check

The full codex-core --lib run passed 1,914 tests. Five unrelated tests failed because this sandbox exposes /tmp as a synthetic Git root; every changed core path passed independently.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f22825f9f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[friel-openai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1bf0db5f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jif-oai]

I don’t think we should land this as one PR. The goal—bounding live rollout files—is valid, but this introduces a graph of mutable file references before defining the core contracts: immutable snapshot identity, ownership/lifetime, deletion and GC, atomic rotation, failure behavior, and the distinction between bounded model replay and complete transcript history.

This would make the contract explicit and easier to reason about the PRs while reviewing.

My comments are still valid though and some probably need a refactor

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.