fix(server): reject unsupported rollback before admission

[rynfar]

Fresh thread.checkpoint.revert and thread.conversation.revert requests previously received an accepted dispatch receipt when the provider exposed only relative or unsupported conversation rollback. The request event was persisted without a durable rollback operation, and the reactor reported failure later. Both commands now fail with a typed admission error before any revert-request event or saga is persisted when absolute rollback cannot be proved or the admission service is absent.

The production server wires the real admission layer. Existing accepted command receipts and matching active rollback sagas remain idempotent handoffs. Tests for historical persisted revert events now replay the exact stored event through a ready reactor subscription, preserving coverage of old-event recovery without pretending a new request was accepted.

Validation after reconciliation with current pylon: 74 focused tests passed, one skipped; server typecheck, changed-file lint/format, and diff check passed. The earlier source review passed, and the conflict resolution was reviewed against the current admission and idempotency paths. No live provider rollback was performed.

Related: #200. This closes the admission-receipt gap only; #200 has separate workspace ownership and mobile status requirements.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pylon-marketing	Ignored	Preview	Sep 26, 2026 5:39pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.3 KiB	7.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	−37 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.3 KiB	7.3 KiB	−10 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−27 B (−0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: affd261 · PR result: 82e9ce8 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.