fix(prime): resolve managed build receipts for restart recovery

[rynfar]

A Prime build installed through Pylon appears verified in Settings but is treated as unmanaged when the driver decides whether it can recover sessions after restart. The two checks used different receipt locations, which also produced a contradictory unverified-build warning.

Use one selected-package receipt resolver for status and recovery. It locates the existing build-owned receipt inside this environment, then runs the unchanged authenticated distribution verifier. Manual copies and missing or corrupt receipts remain ineligible; native SDK negotiation, ownership quarantine, and the multiple-instance gate remain unchanged.

Validation: 57 focused store/driver tests pass; scoped lint and server typecheck pass (existing advisory warnings only). An offline read of the actual installed signed preview reproduces the old classification and verifies the correction. Checkpoint adversarial review passed. Browser evidence follows below.

Model: GPT-6. Harness: Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 12, 2026 1:02am UTC

[rynfar]

Actual installed immutable preview pylon-build-ga1ef2eca2ad0-r2 in an isolated Pylon environment, web client (also used by desktop).

Before: Native daemon / Authenticated / managed preview #15, but the capability reason incorrectly said “this instance is not a verified Pylon-managed Prime build.” The offline recovery lookup classified the selected managed package as unmanaged.

After: the same signed installation remains Native daemon / Authenticated / managed preview #15. The reason correctly explains that multiple instances await the separate N=1/2/4 proof. No UI alerts. The offline recovery lookup now authenticates the existing build-owned receipt. No multiple-instance capability was enabled.

Focused store/driver verification: 57 passed. Exact managed restart through web/mobile remains part of final acceptance after stable promotion.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	14.0 KiB	−50 B (−0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.9 KiB	6.8 KiB	−46 B (−0.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	14.1 KiB	13.9 KiB	−161 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+4 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.7 KiB	−165 B (−2.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	58.8 KiB	−928 B (−1.5%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: 054e9f5 · PR result: b2a7ba1 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.