[Bug]: OmO Native Claude continuity: repeated full resends and unsafe checkpoint recovery (beta.68)

Terminal monitors for this session are attached in another live process (pid <redacted>); nothing was restored here.

No message found with message.uuid: <redacted>

atUuid = binding.lastAssistantUuid
from   = commonPrefixLength

*** Begin Patch
*** Update File: <SENPI_ROOT>/dist/core/extensions/builtin/claude-sdk-oauth/session-binding.js
@@
     if (marker?.id !== stored.markerEntryId || !isBindingMarker(marker.data))
         return undefined;
     const assistantIndex = committedAssistantIndex(branch, markerIndex + 1);
-    if (assistantIndex < 0 || !branch.slice(assistantIndex + 1).every(isLedgerOnlyEntry))
+    // Startup notices, user input, and tool results extend the saved prefix;
+    // they are unsent deltas, not rewrites of its committed assistant. The
+    // continuity decision still verifies sentPrefixHash before SDK reattachment.
+    if (assistantIndex < 0 || !branch.slice(assistantIndex + 1).every((entry) => isLedgerOnlyEntry(entry) ||
+        entry.type === "custom_message" ||
+        (entry.type === "message" && (entry.message.role === "user" || entry.message.role === "toolResult"))))
         return undefined;
     const committedAssistant = branch[assistantIndex]?.message;
     if (!isAssistantMessage(committedAssistant))
*** Update File: <SENPI_ROOT>/dist/core/extensions/builtin/claude-sdk-oauth/session-continuity.js
@@
         : commonPrefixLength(binding.sentHashes, input.currentHashes) === binding.sentCount;
     if (!prefixMatches)
         return undefined;
-    if (!binding.lastAssistantUuid)
-        return { kind: "flatten", reason: "timeout_retry" };
-    return {
-        kind: "fork",
-        sdkSessionId: binding.sdkSessionId,
-        atUuid: binding.lastAssistantUuid,
-        from: binding.sentCount,
-        reason: "timeout_retry",
-    };
-}
-/**
- * A binding whose SDK id was minted locally and never acknowledged (no init, no
- * replay echo before the attempt failed) must not be resumed: Claude Code
- * answers "No conversation found with session ID" and every retry would mint
- * another dead id (oh-my-openagent#7562). Cold-seed instead.
- */
-function withoutUnconfirmedResume(decision, binding) {
-    if (binding.sdkSessionIdConfirmed !== false)
-        return decision;
-    if (decision.kind === "reattach" || decision.kind === "fork") {
-        return { kind: "flatten", reason: "session_unconfirmed" };
-    }
-    return decision;
-}
-function decideFromBinding(input, binding) {
-    if (!input.transcriptAvailable)
-        return { kind: "flatten", reason: "transcript_missing" };
-    const drift = identityDrift(input, binding);
-    // Model identity drift fails closed: the persisted identity no longer matches the turn.
-    // Account drift flattens only on the config-dir lane, whose per-account roots cannot
-    // share a transcript; on shared-root lanes it falls through like prompt/toolset drift
-    // (senpi#1432), so the retry checkpoint forks a same-turn failover at the pre-turn
-    // boundary and a matching prefix reattaches with reason account_changed.
-    if (drift === "model_changed")
-        return { kind: "flatten", reason: drift };
-    if (drift === "account_changed" && !input.crossAccountResumeSupported)
-        return { kind: "flatten", reason: "cross_root_unsupported" };
-    // Prompt/toolset drift instead reattaches like the live path
-    // (oh-my-openagent#7884) - a restart has no live query, so the resume builds a
-    // fresh query carrying the CURRENT options and hooks, and flattening would
-    // re-send the whole conversation for drift the SDK applies per-query anyway.
-    const retry = retryCheckpointDecision(input, binding);
-    if (retry)
-        return retry;
-    if (binding.sentPrefixHash !== undefined) {
-        const prefixMatches = input.currentHashes.length >= binding.sentCount &&
-            sentHashPrefixDigest(input.currentHashes, binding.sentCount) === binding.sentPrefixHash;
-        if (prefixMatches) {
-            return {
-                kind: "reattach",
-                sdkSessionId: binding.sdkSessionId,
-                from: binding.sentCount,
-                reason: drift ?? "registry_miss",
-            };
-        }
-        return {
-            kind: "flatten",
-            reason: input.currentHashes.length < binding.sentCount ? "history_rolled_back" : "sent_stream_diverged",
-        };
-    }
-    const shared = commonPrefixLength(binding.sentHashes, input.currentHashes);
-    if (shared === binding.sentCount) {
-        return {
-            kind: "reattach",
-            sdkSessionId: binding.sdkSessionId,
-            from: binding.sentCount,
-            reason: drift ?? "registry_miss",
-        };
-    }
-    if (!binding.lastAssistantUuid)
-        return { kind: "flatten", reason: "registry_miss" };
-    return {
-        kind: "fork",
-        sdkSessionId: binding.sdkSessionId,
-        atUuid: binding.lastAssistantUuid,
-        from: shared,
+    const boundary = binding.lastAssistantUuid
+        ? { index: binding.sentCount, uuid: binding.lastAssistantUuid }
+        : boundaryBefore({ assistantUuidByIndex: new Map(binding.assistantUuidByIndex ?? []) }, binding.sentCount + 1);
+    if (!boundary)
+        return { kind: "flatten", reason: "timeout_retry" };
+    return {
+        kind: "fork",
+        sdkSessionId: binding.sdkSessionId,
+        atUuid: boundary.uuid,
+        from: boundary.index,
+        reason: "timeout_retry",
+    };
+}
+/**
+ * A binding whose SDK id was minted locally and never acknowledged (no init, no
+ * replay echo before the attempt failed) must not be resumed: Claude Code
+ * answers "No conversation found with session ID" and every retry would mint
+ * another dead id (oh-my-openagent#7562). Cold-seed instead.
+ */
+function withoutUnconfirmedResume(decision, binding) {
+    if (binding.sdkSessionIdConfirmed !== false)
+        return decision;
+    if (decision.kind === "reattach" || decision.kind === "fork") {
+        return { kind: "flatten", reason: "session_unconfirmed" };
+    }
+    return decision;
+}
+function decideFromBinding(input, binding) {
+    if (!input.transcriptAvailable)
+        return { kind: "flatten", reason: "transcript_missing" };
+    const drift = identityDrift(input, binding);
+    // Model identity drift fails closed: the persisted identity no longer matches the turn.
+    // Account drift flattens only on the config-dir lane, whose per-account roots cannot
+    // share a transcript; on shared-root lanes it falls through like prompt/toolset drift
+    // (senpi#1432), so the retry checkpoint forks a same-turn failover at the pre-turn
+    // boundary and a matching prefix reattaches with reason account_changed.
+    if (drift === "model_changed")
+        return { kind: "flatten", reason: drift };
+    if (drift === "account_changed" && !input.crossAccountResumeSupported)
+        return { kind: "flatten", reason: "cross_root_unsupported" };
+    // Prompt/toolset drift instead reattaches like the live path
+    // (oh-my-openagent#7884) - a restart has no live query, so the resume builds a
+    // fresh query carrying the CURRENT options and hooks, and flattening would
+    // re-send the whole conversation for drift the SDK applies per-query anyway.
+    const retry = retryCheckpointDecision(input, binding);
+    if (retry)
+        return retry;
+    if (binding.sentPrefixHash !== undefined) {
+        const prefixMatches = input.currentHashes.length >= binding.sentCount &&
+            sentHashPrefixDigest(input.currentHashes, binding.sentCount) === binding.sentPrefixHash;
+        if (prefixMatches) {
+            return {
+                kind: "reattach",
+                sdkSessionId: binding.sdkSessionId,
+                from: binding.sentCount,
+                reason: drift ?? "registry_miss",
+            };
+        }
+        return {
+            kind: "flatten",
+            reason: input.currentHashes.length < binding.sentCount ? "history_rolled_back" : "sent_stream_diverged",
+        };
+    }
+    const shared = commonPrefixLength(binding.sentHashes, input.currentHashes);
+    if (shared === binding.sentCount) {
+        return {
+            kind: "reattach",
+            sdkSessionId: binding.sdkSessionId,
+            from: binding.sentCount,
+            reason: drift ?? "registry_miss",
+        };
+    }
+    // The SDK boundary and resend offset must describe the same proven prefix.
+    // The last assistant may belong to the divergent part of the old branch.
+    const boundary = boundaryBefore({ assistantUuidByIndex: new Map(binding.assistantUuidByIndex ?? []) }, shared + 1);
+    if (!boundary)
+        return { kind: "flatten", reason: "sent_stream_diverged" };
+    return {
+        kind: "fork",
+        sdkSessionId: binding.sdkSessionId,
+        atUuid: boundary.uuid,
+        from: boundary.index,
         reason: shared < binding.sentCount ? "history_rolled_back" : "sent_stream_diverged",
     };
 }
*** Update File: <SENPI_ROOT>/dist/core/extensions/builtin/claude-sdk-oauth/session-continuity.d.ts
@@
     sentPrefixHash?: string;
     lastAssistantUuid: string | null;
     accountName: string;
+    /** Known SDK boundaries paired with their transmitted-message prefix lengths. */
+    assistantUuidByIndex?: readonly (readonly [number, string])[];
     modelId: string;
     systemPromptHash: string;
     toolsetHash: string;
*** Update File: <SENPI_ROOT>/dist/core/extensions/builtin/claude-sdk-oauth/session-turn-attempt.js
@@
                     forgetBinding(entry.senpiSessionId);
                 }
                 else {
+                    // A rejected resume boundary must not be republished by
+                    // catch or discard. Keep earlier mapped checkpoints.
+                    if (error instanceof Error && /no message found with message\.uuid/i.test(error.message)) {
+                        entry.assistantUuidByIndex.delete(entry.sentCount);
+                    }
                     rememberRetryCheckpoint(entry, hashes);
                 }
                 throw error;
*** Update File: <SENPI_ROOT>/dist/core/extensions/builtin/claude-sdk-oauth/session-reattach.js
@@
         message.uuid === binding.lastAssistantUuid &&
         message.parent_tool_use_id === null);
 }
+/** Recover only a mapped, hash-proven prefix before a rejected SDK boundary. */
+export async function earlierVerifiedCheckpoint({ binding, currentHashes, cwd, authLane }) {
+    if (cwd === undefined || authLane === "config-dir")
+        return undefined;
+    const candidates = (binding.assistantUuidByIndex ?? [])
+        .filter(([index]) => index > 0 && index < binding.sentCount &&
+        index <= binding.sentHashes.length && index <= currentHashes.length &&
+        binding.sentHashes.slice(0, index).every((hash, offset) => hash =