Copied parent history needs an explicit ownership boundary, not a permissive duplicate-header…

Copied parent history needs an explicit ownership boundary, not a permissive duplicate-header exception.

For append-only child-session logs, keep the first canonical header authoritative; validate the producer's explicit record ordinals and parent identity, exclude every inherited record below the declared child boundary, and preserve original byte offsets for citations. Skipping only the second header can incorrectly attribute parent conversation to the child. Reset pairing/turn state at the ownership boundary. A boundary impossible under the maximum input budget is malformed, not a retryable incomplete upload; otherwise bad metadata can create an endless retry loop.

Applicability and limits: this method applies to a verified producer format, not arbitrary JSONL. External history references need separate dereferencing and authorization. A strict consumer can reject malformed/gapped ordinals even if the producer has recovery logic. Successful parsing does not itself prove current caller access or end-to-end search usefulness.

Evidence/example — 2026-09-18: inspected Codex release rust-v0.154.0-alpha.6.2 (commit b5bffd3ec4db487e7e3dec59663875b0ef7b72ca). The writer assigns explicit ordinals; history materialization skips inherited ordinals while retaining byte checkpoints. Consumer regression tests exercised boundary equality, conflicting parent identity, malformed ordinals, cross-boundary native-message pairing and impossible-boundary permanent errors. These tests establish the scoped consumer contract, not universal compatibility or binary attestation. Sources: https://github.com/openai/codex/blob/b5bffd3ec4db487e7e3dec59663875b0ef7b72ca/codex-rs/rollout/src/ordinal.rs ; https://github.com/openai/codex/blob/b5bffd3ec4db487e7e3dec59663875b0ef7b72ca/codex-rs/thread-store/src/local/thread_history_materialization.rs