feat(chat): restore prompts and preserve files during exact rewind

[rynfar]

Web and desktop users can edit an earlier prompt after Pylon verifies the exact rewind: the prompt and fresh attachment copies return to the composer without losing an unsent draft. The confirmation offers Revert files too or Revert and keep changes; mobile adds the same file choice to its existing rollback action.

The separate thread.conversation.revert command prevents older servers from silently restoring files. Its persisted file choice survives crashes and recovery; history-only operations never apply or compensate workspace changes. Exact provider anchors, admission/workspace leases, source-revision checks, projection compare-and-set and provider compensation remain intact. Pylon continues to publish only proven exact targets (currently managed native Prime); upstream relative trimming cannot provide Pylon's durable retry and compensation guarantees.

Ports native Codex paginated history and revert boundaries, Claude validated history forks and isolated history worker, OpenCode forks that leave files untouched, and empty-checkpoint Git restore. Session replacement, Stop and cancellation remain authoritative throughout asynchronous history access and startup. Draft restoration waits for the matching durable source/target result and ignores another client's failure activity. Rewind admission also protects accepted compaction prompts in the same workspace while the durable FIFO drains.

Sources: fd5553f1afcef4f410a067687faa991743b5034c (#11338) and efccda9ac9230db22b36990cffabdad218fa41b0 (#11358), from the frozen #497 cycle.

Validation: independent adversarial reviews cover the durable keep-files backend, OpenCode/client/UI integration, and Claude lifecycle repairs. Focused provider, native-history, checkpoint, draft and command suites pass (including 152 Claude tests, 179 ProviderService/Cursor/Grok tests, 117 OpenCode/command tests, 129 composer logic tests, 74 Saga/admission/persistence tests and 47 provider snapshot tests). All seven directly affected package typechecks and scoped lint/format pass. Final integrated checks and CI are recorded below after rebase. Local rendered/native visual verification was not performed. No release or device installation is included.

Also completes the #497 decision index for all 98 sources in 6c583620ff7ad3235b135af7107c0543467eecfa..4a4c6dd2adc350a68ba18bb28b24b5a7e4660dab: 95 adopted/adapted, two superseded fix/revert sources, and one skipped T3-only marketing claim. Existing exclusions and revisit triggers remain explicit. The review cursor advances on landing this final implementation; it does not change upstream ancestry.

This branch is rebased onto Pylon 391cfe3b09ab19420219b8c5bcd5fedc5736db37, including the merged #512 and #515 heads. Its base tree exactly matches the reviewed combined integration. Both parent owners approved their automatic overlaps; 266 combined focused tests and server/web typechecks passed. Final rewind integration passed 511 focused tests and all seven affected package typechecks. A further 24 focused tests exercise compaction/rewind admission and its neighboring boundaries: both rewind commands preserve same-thread and sibling-workspace queues, and a separate worktree can continue independently. Server, web and mobile typechecks also pass after the admission repairs. Final adversarial review and exact-head CI are recorded in the landing comment.

Implemented and reviewed by GPT-6 agents in the Codex harness.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 12, 2026 7:06am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.9 KiB	13.9 KiB	+12 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+8 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	13.9 KiB	−68 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−71 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.6 KiB	58.8 KiB	−840 B (−1.4%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 391cfe3 · PR result: d4bb89c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[vercel]

Deployment failed for project pylon-marketing with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/pylon-code?upgradeToPro=build-rate-limit

[rynfar]

Final adversarial review is clear on d4bb89c595a2d4428285718d76a9c3a1fdc8f29c, rebased onto Pylon 391cfe3b09ab19420219b8c5bcd5fedc5736db37. The three original rewind patches are preserved, with only the combined test import requiring textual resolution. Independent reviews covered the exact rollback Saga, native provider history and lifecycle fences, prompt/draft restoration, shared settings/compaction behavior, and the full 98-source ledger.

Integration review found and fixed two queued-prompt hazards: a rewind could acquire a lease while its own compaction FIFO was draining, or while a sibling thread in the same workspace held that FIFO. Both rewind commands now reject before acquiring the lease. Six real-engine combinations cover both commands across target-thread, shared-workspace sibling, and independent-worktree queues. Rejection leaves the event sequence, projection, saga and lease unchanged; queued prompts resume in FIFO order, and independent worktrees remain usable.

Validation: 511 final combined focused tests and all seven affected package typechecks passed; the subsequent admission repairs passed 24 tests across four focused suites, server/web/mobile typechecks, and scoped lint/format. The CI-equivalent four-workspace export scan passed. Ledger review verified exactly 98 unique frozen sources and the 95 adopted/adapted, 2 superseded, 1 skipped outcomes, while preserving old registers and exclusions. Source mapping: #497 audit.

Final-head Actions CI is running; landing remains gated on its success. Local rendered/native visual checks, desktop/mobile release and device installation are not claimed. Optional Vercel marketing preview is limited by the account deployment quota; no external plan or quota was changed.

[rynfar]

All 10 final-head Actions CI jobs passed on d4bb89c595a2d4428285718d76a9c3a1fdc8f29c: https://github.com/pylon-code/pylon/actions/runs/34681537200 . Final adversarial review and the two compaction/rewind repairs are recorded above. Landing the final two sources and the 98-source decision index under the existing maintainer authorization.