feat(rollback): expose recovery controls and fence stale clients

[rynfar]

Problem

Absolute conversation rollback can stop at a safety fence when Pylon cannot prove the target or restore the source automatically. Clients need a durable way to see that state and invoke only the recovery action the server proves safe. Offline and stale clients must also not submit work composed against the pre-rollback source.

What changed

• Expose durable rollback progress and exact recovery actions on web, desktop-through-web, and mobile. Keep messaging, Git mutations, and provider-setting changes fenced while rollback is active.
• Add server-owned retry-verification and resume-compensation paths with phase validation, compare-and-swap ownership, idempotent multi-device admission, and safe lease cleanup.
• Add source epochs to thread projections, WebSocket admissions, and the mobile outbox. Stale queued turns are held for explicit review and reconfirmation instead of being sent or discarded.
• Preserve provider-shaped routing and current provider-instance ownership behavior while rejecting retired or mismatched rollback sources.
• Keep ProjectionThreadsSourceEpoch registered as migration 052 and document user recovery behavior plus the manual-recovery runbook.

Verification

• Exact rebase shape: two commits on 761e79f7dfe59156340b8a8571295d3557dafcce:
  • d97ce6a16 replayed as 27ddec5613 — expose exact recovery controls
  • 416acd3ff replayed as a9f5fc0e17 — fence stale clients and queued turns
• Focused rollback/source-epoch suite: 18 files, 468 tests passed.
• Full server suite: 316 files passed, 5 skipped; 4,081 tests passed, 14 skipped.
• Full contracts suite: 34 files, 399 tests passed.
• Full client-runtime suite: 73 files, 875 tests passed.
• Full mobile suite, including the current generated-theme fixture: 155 files, 1,189 tests passed.
• Full desktop suite: 59 files passed; 614 tests passed, 10 skipped.
• Web suite: 318 files and all 3,414 collected tests passed. One unrelated Ghostty ABI file did not collect because the local Vite runner could not import ghostty-vt.wasm?inline.
• Typecheck passed for server, web, mobile, contracts, and client-runtime.
• Lint passed on all 57 changed TypeScript files with 0 warnings and 0 errors.
• Format passed on all 64 changed files; git diff --check passed.
• Release smoke passed.
• Browser and simulator verification were intentionally not run per request.

Model: gpt-5.6-sol
Harness: Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.9 KiB	+543 B (+4.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.1 KiB	+129 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.9 KiB	+414 B (+6.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	58.9 KiB	+2.6 KiB (+4.7%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.5 KiB	14.0 KiB	+411 B (+3.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.1 KiB	+135 B (+1.9%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.9 KiB	+276 B (+4.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	59.8 KiB	+1.8 KiB (+3.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 761e79f · PR result: a9f5fc0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.