State resets or blank timelines if unknown `prevs` or origin's `/get_missing_events` omits auth events

### Description

#### Update 2026/08/25

Appears unknown `prev_events` IDs (e.g., ones from another room) are a possible major (or primary) factor here.

This is therefore related to spec issue: https://github.com/matrix-org/matrix-spec/issues/2434

So in this case I caused the bug, but it's a Rocks DB driver/cache bug that could affect any conduwuit-derivative if a person is rapidly sending multiple messages in different rooms.

```shell
$ rezzy -i /run/media/shane/shane4tb-ent/dags/local-dag-ylRY10DiOcgVxCi0W8f9ztanFl5wdBxYCWQqM45n_Kk-v12-nutra.tk-merged-WITH-OUTLIERS.jsonl -s v2-1 -f summary
[WARN] 1 event(s) reference prev_events absent from local set (backfill/backward extremity):
[WARN] $qhAFddgPWi4Yjg0OHnvO-qmO5xIkVpsbfDUWtV0XWLI (m.room.message @@gg:nutra.tk ts=1779894259603) -> missing prev $fPVTIbPz09MM3dd6C90uxa2YadiIVqtRITwbP4IVlwU
```

I thought I had emailed the DAG assets as `.jsonl` files to the security team, but seems it got stuck as a draft. So, I'll send that later.

---

#### Original notes

When Synapse calls `/get_missing_events` to fill topological gaps, it heavily assumes the origin server will return a fully accurate response.

If the origin has a bug in topological stitching or visibility checks (e.g., recent bug found in Continuwuity; see below), it can silently omit critical junction or auth events.

When Synapse receives this fragmented response, it can panic in various ways, such as requesting their state before orphaning them as outliers. This can result in dramatic state resets as well as truncated, pruned, or blank timelines.

Synapse should not rely exclusively on the origin server's integrity to fill in topological gaps; this can result in broken auth chains or severed edges. Synapse should instead fall back to querying other participating servers, whether randomly or via a peer scoring algorithm, before defaulting to a (potentially) hard state reset.

For reference on the origin-side traversal bugs that trigger this in Synapse, see the `TestInboundCanReturnMissingEvents` fix applied to Continuwuity here:

[Comparing 3b27ca2b6..569527e73 · `src/api/server/get_missing_events.rs` · gamesguru/continuwuity](https://github.com/gamesguru/continuwuity/compare/3b27ca2b6..569527e73#diff-12243b6d6be3aeefe55da2bc3740ffe068422344bfb66a0fffeacb7067ad9460)

### Homeserver

zirco/maunium/vel's

### Synapse Version

likely all 1.150+

Start by tracing Synapse's handling of origin `/get_missing_events` responses, focusing on cases where `prev_events` or authentication events are omitted. Compare the processing of fragmented responses with the reported state resets and blank timelines; done requires a decided recovery strategy and coverage for the missing-event scenario.

Written by the indexing model from the issue text.