fix(pi): fork and revert past turns whose session entry was never captured#20521

@@ -3123,26 +3157,82 @@ function walkPiBranch(
   return { entryCount: visited.size, userEntryIds, reachedStop: current === stopAt };
 }
 
+type PiForkBoundary =
+  | { readonly type: "entry"; readonly entryId: string }
+  | { readonly type: "nothing" }
+  | {
+      readonly type: "uncaptured";
+      readonly turn: OrchestrationV2ProviderTurn;
+      /** The target turn's own start entry when known; the boundary must follow it. */
+      readonly afterEntryId: string | null;
+      /** When the target turn finished; everything the branch gained after it is discarded. */
+      readonly afterCompletedAt: DateTime.Utc | null;
+    };
+
 /**
  * Turns without a ref left nothing on the active branch, so the boundary is the first discarded
- * turn that has one. Returns `null` when no such turn follows the target (nothing to discard) and
- * `undefined` when the boundary turn has no captured entry ref (only turn-boundary refs recorded
- * by `captureTurnTreeRefs` are strong).
+ * turn that has one. `nothing` means no such turn follows the target; `uncaptured` means the
+ * boundary turn still carries its synthetic ref (only turn-boundary refs recorded by
+ * `captureTurnTreeRefs` are strong) and has to be located in the session tree.
  */
 function piRollbackForkEntry(input: {
   readonly target:
     | { readonly type: "thread_start" }
     | { readonly type: "provider_turn"; readonly providerTurn: OrchestrationV2ProviderTurn };
   readonly providerThreadTurns: ReadonlyArray<OrchestrationV2ProviderTurn>;
-}): string | null | undefined {
-  const boundaryOrdinal =
-    input.target.type === "thread_start" ? 0 : input.target.providerTurn.ordinal;
-  const ref = input.providerThreadTurns
-    .filter((turn) => turn.ordinal > boundaryOrdinal && turn.nativeTurnRef !== null)
-    .sort((a, b) => a.ordinal - b.ordinal)[0]?.nativeTurnRef;
-  if (ref == null) return null;
-  if (ref.strength !== "strong" || ref.nativeId === null) return undefined;
-  return ref.nativeId;
+}): PiForkBoundary {
+  const target = input.target.type === "thread_start" ? null : input.target.providerTurn;
+  const boundary = input.providerThreadTurns
+    .filter((turn) => turn.ordinal > (target?.ordinal ?? 0) && turn.nativeTurnRef !== null)
+    .sort((a, b) => a.ordinal - b.ordinal)[0];
+  const ref = boundary?.nativeTurnRef;
+  if (boundary === undefined || ref == null) return { type: "nothing" };
+  if (ref.strength === "strong" && ref.nativeId !== null) {
+    return { type: "entry", entryId: ref.nativeId };
+  }
+  const targetRef = target?.nativeTurnRef;
+  return {
+    type: "uncaptured",
+    turn: boundary,
+    afterEntryId: targetRef?.strength === "strong" ? targetRef.nativeId : null,
+    afterCompletedAt: target?.completedAt ?? null,
+  };
+}
+
+/**
+ * A turn that never reached `finalizeTurn` (Pi or the server died mid-turn, recovery cancelled
+ * it) or whose `get_entries` failed keeps its synthetic ref, yet its prompt is in the session
+ * tree. Pi and the server share a clock, so it is the earliest user entry on the active branch
+ * stamped after the target turn finished (or after this turn started, when the target has no
+ * end) and before this turn ended, above the target's entry. An adopted native wake's prompt
+ * predates the turn T3 opened for it, which is why the target's end is the lower bound.
+ */
+function piUncapturedForkEntry(
+  listing: PiSessionListing,
+  boundary: Extract<PiForkBoundary, { type: "uncaptured" }>,
+): string | undefined {
+  const { startedAt, completedAt } = boundary.turn;
+  if (startedAt === null || completedAt === null) return undefined;
+  const from = DateTime.toEpochMillis(boundary.afterCompletedAt ?? startedAt);