feat(server): make rollback recovery durable by rynfar · Pull Request #232 · pylon-code/pylon

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-09-01T08:53:20Z

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI or Prime navigation.

Verification

vp test run <14 focused files> — 14 files, 205 tests passed
vp run -F t3 typecheck
vp run -F @t3tools/contracts typecheck
vp run -F @t3tools/client-runtime typecheck
vp lint --report-unused-disable-directives <33 changed TypeScript files>
git diff HEAD^ --check

The focused coverage includes fault injection at persisted saga and side-effect boundaries, restart reconciliation, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 using the Prime Agent harness.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Refs #200

github-actions · 2026-09-01T09:03:15Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+13 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.8 KiB	+244 B (+1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+21 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+223 B (+3.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: c908bb2 · PR result: 67cda03 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.5 KiB
Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

feat(server): make rollback recovery durable
22d75f4
Refs #200