fix(server): a message sent during a rollback no longer undoes it

[t3dotgg]

Problem

If you send a message while a rollback is still running, the next turn can run on the conversation the rollback was supposed to remove.

The rollback service writes its result (for Pi, the new forked session file) outside the per-thread lock that thread commands use. A message.dispatch that read the provider thread before that write, and committed after it, wrote the old session back. The following turn then failed with "Pi turn requested for a different native session". With a real provider it would continue the old, un-rolled-back history.

In the event log of a failing run, seq 71 (rollback) writes session-2.jsonl, and seq 75 (message-3) writes session-1.jsonl back.

Fix

CheckpointRollbackService now builds and commits its events under ThreadCommandExecutor.withLock(threadId). ProviderEventIngestor already uses this pattern for the same reason. The provider call stays outside the lock, so a slow rollback does not block the thread's commands.

Proof

• The rewinds safely cases now assert that the thread lock is held when the rollback commits. 4 of them fail on main's service and pass with this change.
• While testing a worker-thread SQLite connection (not part of this PR), the timing window got wider and thread_rollback/pi, thread_rollback_after_stop/pi and thread_rollback/claudeAgent failed on every run. All three pass with this fix. The full replay fixture suite, the rollback, restore-safety and effect-worker tests, and the runtime layer tests pass on main's SQLite (240 tests).

Reviewed with sol-loop: 1 round with GPT-6.1 Sol on high.

Made with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at d75dd63

Macroscope's review found this PR approvable — This is a focused concurrency fix that serializes rollback commits with existing per-thread commands while keeping the slow provider operation outside the lock. The remaining changes only wire and test the existing lock, with no schema, default, security, or deployment impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 0bfd9dd · PR result: d75dd63 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: 8ea69486-738e-42fe-b04f-c5a5fb26e0c3

📥 Commits

Reviewing files that changed from the base of the PR and between 0bfd9dd and d75dd63.

📒 Files selected for processing (5)

• apps/server/src/orchestration-v2/CheckpointRestoreSafety.test.ts
• apps/server/src/orchestration-v2/CheckpointRollbackService.test.ts
• apps/server/src/orchestration-v2/CheckpointRollbackService.ts
• apps/server/src/orchestration-v2/runtimeLayer.ts
• apps/server/src/orchestration-v2/testkit/ProviderReplayHarness.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Checkpoint rollback now writes its rollback events under a per-thread command lock. The rollback service requires ThreadCommandExecutor, which is provided by the runtime, replay harness, and tests.

Changes

Checkpoint rollback locking

Layer / File(s)	Summary
Lock rollback event writes apps/server/src/orchestration-v2/CheckpointRollbackService.ts, apps/server/src/orchestration-v2/CheckpointRollbackService.test.ts	The rollback service moves rollback event construction and writing into a lock for the input thread. The safe-rewind test uses a lock-backed executor and checks that the thread is locked during the event write.
Provide the thread command executor apps/server/src/orchestration-v2/runtimeLayer.ts, apps/server/src/orchestration-v2/testkit/ProviderReplayHarness.ts, apps/server/src/orchestration-v2/CheckpointRollbackService.test.ts, apps/server/src/orchestration-v2/CheckpointRestoreSafety.test.ts	The runtime layer, replay harness, and rollback test setups provide the executor required by the service.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to d75dd

The rollback write and message dispatch share the intended thread lock in the inspected production setup. No actionable issue remains before merge.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main fix: preventing a message sent during rollback from undoing the rollback.
Description check	✅ Passed	The description explains the problem, expected failure, fix, locking behavior, and focused verification results. It uses equivalent headings for Change and Verification; the Scope and approval section…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}