fix(identity): stabilize idless message revisions (#3898)

[Sinity]

Summary

Repair the exact-head identity and attachment-owner findings for PR #3898. The branch remains non-draft and is not being merged.

Problem

The exact review identified remaining collision and stability gaps: same-role same-timestamp idless siblings could be treated as conflicting on edit; whitespace native IDs diverged from missing IDs; duplicate physical coordinates could silently select a last writer; Claude owner evidence could omit attachment identity; and synthetic parser IDs could leak into public identity. The review also identified that the annotation successor's inventory must include annotation-batch:<id> rows without destroying that provenance.

Solution

• Separate the timestamped idless revision axis from mutable message content and compare its multiplicity during membership classification.
• Normalize whitespace native IDs before choosing the native-ID axis.
• Make owner resolution fail closed for duplicate physical coordinates, including duplicate native IDs at one coordinate, instead of relying on map overwrite order.
• Keep Claude attachment evidence in the private reorder-stable owner key even when explicit position evidence exists.
• Keep synthetic public IDs empty on the exact Codex reasoning and compaction paths named by the review; native Codex IDs remain unchanged. Established synthetic conventions in other parser families were not changed after their existing public-contract tests rejected a provider-wide sweep.
• Expand the durable annotation-owner successor contract to inventory both unscoped rows and annotation-batch:<id> rows, preserve the original batch scope, and store session ownership separately. No production backfill is performed here.

Acceptance and review matrix

Finding	Disposition	Evidence
Timestamped idless sibling edits collide or become contradictory	satisfied	SessionRevisionProjection.mutable_message_identities, multiplicity-aware membership, and test_timestamped_idless_sibling_edit_is_not_a_membership_conflict
Attachment-owner evidence is unstable or incomplete	satisfied	Claude private owner key includes attachment IDs; parser-to-writer and repeated-position anti-vacuity tests cover ownership
Duplicate physical coordinates or duplicate native IDs last-win	satisfied	MessageOwnerResolution records ambiguous physical coordinates and raises MessageOwnerAmbiguityError; both duplicate-coordinate tests exercise hash-route failure
Whitespace native IDs diverge from missing IDs	satisfied	_message_revision_match_id strips before branching; whitespace/missing projection equivalence test and writer regression pass
Synthetic public IDs leak from parser messages	satisfied within named Codex scope	Codex reasoning and compaction messages now retain empty provider IDs; parser tests prove the public field is empty and active-leaf resolution stays native-only
Annotation-batch owner scope	partial, retained outside this PR	successor polylogue-message-owner-scope-backfill is updated in the branch state with batch-row inventory, provenance preservation, separate durable session ownership, backup, transaction, idempotency, and reindex-preparation acceptance criteria

Bead disposition matrix

Assigned Bead	Whole-Bead disposition	Named successor
polylogue-slshy	partial	polylogue-message-owner-scope-backfill, polylogue-93xe, polylogue-xselt

Verification

• direnv exec . devtools test tests/unit/pipeline/test_message_identity_position_fallback.py tests/unit/archive/test_session_revision_membership.py tests/unit/sources/test_claude_web_normalization.py tests/unit/sources/test_parsers_codex.py tests/unit/sources/parsers/test_grok.py tests/unit/sources/parsers/test_antigravity.py tests/unit/sources/test_parsers_claude_design.py tests/unit/pipeline/test_archive_write.py::test_whitespace_only_native_message_id_falls_back_and_writes_blocks tests/unit/pipeline/test_archive_write.py::test_duplicate_message_coordinates_raise_loud_value_error tests/unit/pipeline/test_archive_write.py::test_merge_append_duplicate_message_coordinates_also_guarded: 218 passed in 10.59s.
• direnv exec . devtools test tests/unit/pipeline/test_message_identity_position_fallback.py: 10 passed in 1.10s after the duplicate-native anti-vacuity addition.
• direnv exec . devtools test tests/unit/sources/test_parsers_codex.py tests/unit/sources/parsers/test_grok.py tests/unit/sources/parsers/test_antigravity.py tests/unit/sources/parsers/test_parsers_claude_design.py was run with the repository's actual path as tests/unit/sources/test_parsers_claude_design.py: 147 passed in 7.62s.
• direnv exec . devtools verify --quick: success at 1eb36fdb171210ce6fc5440e6fef621605f5a58c, 24 steps passed, including format, lint, mypy, render, layering, policy, schema, and promotion checks.
• direnv exec . devtools verify: attempted, but refused before tests because this aging worktree has no seeded testmon receipt and requested --seed-testmon.
• direnv exec . devtools verify --all --skip-slow: attempted as a diagnostic and stopped after broad inherited failures; the exact focused repair routes above are the completion evidence. The known untouched baseline failure is tests/unit/pipeline/test_archive_write.py::TestValidationService::test_validation_uses_all_record_samples_by_default.
• No Beads command, durable backfill, source/user-tier mutation, index reset, semantic reindex, or merge was performed.

Review status

All unresolved GitHub review threads were enumerated. Addressed threads are replied to with exact evidence; the annotation-batch threads retain the explicit partial successor scope. A fresh exact-head Codex review is requested after pushing this head. No merge is requested.

Structured exact-head carrier

Summary by CodeRabbit

• Bug Fixes

  • Preserved marks and annotations across session-index rebuilds and legacy data migrations.
  • Improved session alias matching, including provider-qualified and native identifiers, while safely rejecting ambiguous matches.
  • Ensured message-targeted marks do not appear as session-level marks.
  • Improved attachment ownership when messages are reordered, duplicated, or lack provider IDs.
  • Prevented stale authority decisions from being treated as current.

• Reliability

  • Improved handling of id-less and timestamped messages during reindexing and revision comparisons.