fix(mobile): fence rollback status to the current session

[rynfar]

On reconnect, mobile could display a cached completed rollback while a newer shell projection reported pending or manual recovery. Delayed native confirmations could also dispatch after the active RPC session changed. The UI now compares event sequence and session identity across detail and shell, keeps uncertain status visible while disabling mutating actions, and rechecks the current session before a queued command executes.

Manual recovery previously could not become actionable because the detail and shell contracts carried no shared rollback operation identity. The server now projects its server-generated saga UUID through the event, detail, shell, and persisted projection. Recovery requires that exact UUID and rechecks the durable phase after claim; older recovery callers that omit the ID fail closed. New mobile revert requests also carry the rollback operation they displayed (including an explicit null when none existed), so server admission rejects a delayed request if that operation has changed. Both revert and recovery bind their expected owner to the exact RPC session selected at dispatch, preventing a reconnect between the UI check and request binding from sending to a replacement connection. The UUID is distinct from private provider anchors, native sessions, paths, and receipts. Migration 066 adds a nullable projection column for existing databases.

Focused tests cover recovery identity and post-claim races, stale revert admission, projected status and migration, mobile reconciliation, and session-bound command execution, including a forced reconnect between the first guard and RPC binding. After reconciliation with current pylon, focused tests passed across the affected server, contracts, client-runtime, and mobile suites; contracts, client-runtime, server, and mobile typechecks passed. Scoped lint, formatting, and diff checks passed. Independent final-head adversarial review found and verified the fix for the mid-dispatch session race, with no remaining findings.

Isolated iPhone Simulator presentation check with synthetic projection data: before reconnect and manual recovery after reconnect. The thread history remained visible and Send was disabled. This fixture checks rendering and fail-closed presentation, not a real rollback saga. Full server admission, privacy, native-generation, and checkpoint-ref acceptance work tracked under #200 remains separate. Android device rendering was unavailable because this host has no Android SDK.

Implemented by GPT-6 Sol (low) through the Pylon Codex harness; supervised and device-checked by GPT-6 Codex.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pylon-marketing	Ignored	Preview	Sep 27, 2026 1:51am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	−11 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.3 KiB	7.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	+7 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.3 KiB	7.3 KiB	+9 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−2 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 080f5cd · PR result: dafe46e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.