contextmd serving: reconcile Codex pointer claims after checkpoint restore #310

What: Codex checkpoint restore needs to reconcile the Great Library pointer claim with the retained native history.
Why: A paginated thread revert can remove the pointer's turn while preserving the native session id and its settled ContextMD claim, so the next prompt receives no pointer.
So what: Track and reproduce this separate pointer-lifetime defect during implementation; the current fork-only correction and scoped Sol design check stay unchanged.

Parent and scope

Related to toolboxmd/contextmd#34. Found in the Opus native-fork addendum, section 8, and independently traced by the implementation parent. The planner restricted the current design correction to Codex forks; this Issue records the separate checkpoint-restore path. It contributes to the Objective by keeping stored knowledge available after a normal restored conversation.

Source-supported trigger

A short Codex session receives the configured pointer in its first turn. Restore its checkpoint to thread start, then send another user message. CheckpointRollbackService selects a thread_start target and calls rollbackThread when completed runs are removed. CodexAdapterV2 uses thread/revert for paginated history and retains the returned native thread id. Codex internally reloads that same thread from the reverted history as Resumed, queues SessionStart(resume), and preserves settings. V5 recognizes compact/clear as epoch signals, not resume, and has no restore transition for the old settled pointer claim. A removed first turn therefore leaves an empty native context with a delivered claim.

This is a source-level prospective finding: the #34 pointer is not implemented yet and no native reproduction is claimed. It is a normal supported paginated-history path rather than a timeout or concurrent-message edge. The fork-only addendum filters rolled-back source runs for inheritance; it does not reconcile the original restored session.

Acceptance criteria

• Restoring through the turn that holds the only current pointer makes the next real Codex request contain it once.
• Restoring to a boundary that still holds the pointer does not add a second copy.
• Thread identity, retained history and checkpoint behavior keep their existing semantics.
• Serving evidence states the restored session's actual pointer state and any charge; source inference is not logged as native proof.

Non-goals

Rewriting the fork-only design correction, generic provider history or checkpoint logic, other providers, capture, matcher, persona files, preferences, memory or deployment.

Blockers

The #34 pointer implementation is the prerequisite for the direct reproduction. This Issue is separate from the planner-requested scoped fork re-check; no implementation or successful outcome is claimed here.

Required proof

A real paginated Codex app-server against an isolated recording model, with zero external model calls: remove the pointer's first turn by checkpoint restore, record the next model input and serving state, and pair with a retained-pointer boundary. Use actual native history and the public Chromeria restore path rather than a fabricated claim reset. Record installed build/history mode; test source equivalence instead of assuming it.

Evidence

Chromeria e4b7ef2: CheckpointRollbackService.ts:203-265; CodexAdapterV2.ts:7176-7233. Exact cached Codex c1382380de69521303b416720a52f42d51af6248: thread_revert_response/reload_paginated_thread (thread_processor.rs:2218-2328), pending SessionStart source selection (session/session.rs:1938-1967). Frozen v5 22a28ffcde120dfa347d8f05009e91c998983cbc69727ceb0917c2838b13fcd1; Opus fork addendum 308cda879a3cf22c44bcf9ab7a607e29383fcf192178e88701bce4a89a53104c. No test or native model call ran for this finding.

Elon record

• Requirements and who asked: User feat(server): link GitHub Issues to threads (#28) #34 requires the pointer in the supported harness context; AgentsMD requires discovered problems to be tracked at their owner. Opus identified the restore path outside B1; the planner requires the current correction stay fork-only.
• Deleted: Expanding the scoped fork review, a full new design round, a generic history framework, silent suppression of the finding and claiming an unrun reproduction.
• Bottleneck: Native context can be replaced under the same session id while the pointer's delivered claim survives.
• Checked myself: Actual checkpoint target/caller, Codex paginated revert and same-id reload, Resume hook-source selection, v5 compact/clear epoch rule and frozen candidate identities; open searches for rollback/pointer found general parents and unrelated serving issues, not this cause.