fix(server): fail closed on relative rollback

[rynfar]

Problem

Pylon treated a missing rollback capability as supported, exposed rollback for production providers, restored workspace state before proving provider state could reach the same target, and called relative turn-count rollback as if it were absolute. That could leave the filesystem, provider conversation, hidden refs, and projected thread history disagreeing.

Refs #200. This is the narrow capability-truth gate only; it does not claim the coordinated recovery saga is implemented.

Fix

• Classify built-in adapters explicitly: Codex, Claude, and OpenCode are relative; Cursor, Grok, Prime ACP, and Prime daemon are unsupported. No production adapter is absolute.
• Make missing capability data fail closed and publish supportsConversationRollback: false from every built-in provider presentation.
• Hide the web rollback affordance when the capability is absent or false. Mobile has no rollback entry point.
• Reject every checkpoint-revert request, including a hypothetical absolute classification, before filesystem restore, workspace refresh, provider rollback, ref deletion, projection trimming, or thread.reverted.
• Preserve a public checkpoint.revert.failed activity and document that coordinated rollback stays disabled until exact immutable filesystem/provider anchors, canonical server-writer fencing, postcondition proof, and restart recovery exist. External terminals, editors, and processes remain outside server lease coverage.

Validation

• 46 focused server/contracts tests passed
• 17 CheckpointReactor tests passed
• orchestration integration: 11 passed, 1 existing skip
• web timeline and contracts follow-up: 55 tests passed
• contracts, server, web, and mobile targeted typechecks
• targeted lint: zero findings
• targeted formatting and git diff --check
• three independent adversarial reviews; final exact-head verdict: no P0, P1, or P2 findings

Visual evidence

Both captures use the same synthetic checkpoint-backed thread in isolated worktrees and disposable databases. No live runtime state or private conversation data was used.

Before — pylon at 9ade80dd66220831d1bbfb155405af35e0d818fc	After — PR head cea9e7b21e67ec41fa97c2c0e044d983b61275d4

The before capture hovers the rollback control so its tooltip is visible. The after capture hovers the same user message; the rollback control is absent. Browser assertions found exactly one Revert to this message button before and zero after. Full-resolution evidence and fixture notes.

Model: openai-codex/gpt-5.6-sol
Harness: Prime Agent RLM

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Hosted CI is green on exact head cea9e7b21e67ec41fa97c2c0e044d983b61275d4. All required check, server, client, desktop smoke, Prime background, Windows, Linux, Rust, and release-smoke jobs passed. Three independent reviews also report no remaining P0/P1/P2 finding.

The PR remains draft only for before/after visual evidence; disposable browser use is awaiting explicit permission.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.5 KiB	−52 B (−0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.6 KiB	−51 B (−0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.2 KiB	57.1 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.7 KiB	+177 B (+1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−9 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+186 B (+2.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.1 KiB	59.5 KiB	+1.5 KiB (+2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	11	+1 (+10.0%)	21	✅

Baseline: 9ade80d · PR result: cea9e7b · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.