feat(prime): add exact checkpoint rollback

[rynfar]

Problem

Prime can move its conversation tree to an exact checkpoint, but Pylon did not have a durable, fail-closed path that kept provider state, workspace state, and rollback ownership aligned across interruption or restart. Absolute rollback also needs to remain native-only: it must never fall back to synthetic replay or accept a result from a retired provider instance.

What changed

• Add durable rollback saga storage, admission, reconciliation, and recovery so an interrupted absolute rollback stays quarantined until it can finish or report an exact failure.
• Gate Prime absolute rollback on live native capability proof, capture source and target anchors through the public daemon SDK, and navigate with summarization disabled.
• Revalidate thread, session, instance, and provider generation ownership before and after native operations. Results from a generation retired mid-operation are rejected.
• Preserve the newer instance-ownership and recovery-ledger rules from PR feat(prime): isolate native instance ownership #256, including ownership-aware idle adoption and transactional fencing.
• Fail closed for missing, unsupported, stale, or unverifiable provider state. Other providers remain unsupported for absolute conversation rollback.

Verification

• Exact rebase shape: one commit on d1227e05ba17ba2fb34289daeac7ae7a294eb65b; only the original dd32ef3c4 rollback change was replayed.
• Focused rollback/Prime suite: 19 files, 723 tests passed.
• Ownership-focused suite: 3 files, 215 tests passed.
• Full server shards:
  • shard 1: 108 files passed, 1,127 tests passed, 6 skipped
  • shard 2: 108 files passed, 1,527 tests passed, 1 skipped
  • shard 3: 107 files passed, 1,464 tests passed, 8 skipped
• Typecheck passed for server, contracts, shared, desktop, and web.
• Lint passed on all 24 changed TypeScript files with 0 warnings and 0 errors.
• Format passed on all 26 changed files; git diff --check passed.
• Release smoke passed. The packaged-smoke seam passed 73/73 under a scrubbed environment.
• Real Prime Agent 0.8.1 process proof used the public getState and navigateTree APIs against distinct leaves created by real subprocess executions. It proved both source and target with summarize: false, matched native identities and production child receipts, drained the owned worker and supervisor exactly, and removed the isolated state only after drain.
• An earlier invalid inherited-environment diagnostic was excluded from proof. The final proof started from a minimal allowlist, rejected inherited worker/RLM/test/outer-agent controls, and passed from a short isolated home and temp root.

The native packaged Prime smoke is intentionally supported only on Linux and Windows. The hosted Linux and Windows packaged-smoke checks are required before merge.

Model: gpt-5.6-sol
Harness: Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.7 KiB	13.4 KiB	−329 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.4 KiB	−328 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.6 KiB	56.3 KiB	−2.3 KiB (−3.9%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.4 KiB	−9 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.2 KiB	57.2 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: d1227e0 · PR result: 937b301 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.