@rig-c/review 0.8.1 → 0.9.0

package/src/handoff.ts

@@ -9,6 +9,13 @@
  * package root; for the `../config.json` step, the folder that holds `out/`); a symlink that leaves it is refused by name.
  * The record (paths relative to the package root, hashes, how it was found) is part of `reviewedSource`, so changing a
  * handoff file's bytes starts a new pending session.
+ *
+ * A rig-parts build root (#149, {@link isBuildRoot}) opens as its `check/` package. For that package the producer's own
+ * config for the build is the regular file `config.json` in the build root, else in the folder that holds it — the two
+ * places `rig-parts build --config <dir>/config.json --out <dir>/out` leaves it. The build writes no record of its
+ * config, so this is a location rule bounded by the build's own files, not a proof: the session baseline (the producer
+ * rebuilding the inspected rig from that config) is the check. Discovered there, or declared with `--config` at exactly
+ * one of those two files, the handoff's root is that file's folder and the parts directory is the build root.
  */
 import { createHash } from 'node:crypto';
 import { lstat, readdir, readFile, realpath, stat } from 'node:fs/promises';
@@ -19,6 +26,9 @@ export const HANDOFF_SCHEMA = 'rig-review-handoff/1';
 export const DISCOVERY_PLACES = ['config.json', 'rig/config.json', '../config.json (beside an opened out/)'] as const;
 export const HANDOFF_DECLARATION = 'rig-review open <dir> --config <path> [--parts <dir>] or the review.json "producer" block';
 export const MODELING_INPUT_UNAVAILABLE = `MODELING_INPUT_UNAVAILABLE: config.json — looked at ${DISCOVERY_PLACES.join(', ')}; declare it with ${HANDOFF_DECLARATION}`;
+/** #149: the places looked at for the check package of a rig-parts build root, after the in-folder ones. */
+export const BUILD_DISCOVERY_PLACES = ['../config.json (in the build root)', '../../config.json (beside the build root)'] as const;
+export const BUILD_MODELING_INPUT_UNAVAILABLE = `MODELING_INPUT_UNAVAILABLE: config.json — looked at ${[...DISCOVERY_PLACES.slice(0, 2), ...BUILD_DISCOVERY_PLACES].join(', ')}; declare it with ${HANDOFF_DECLARATION}`;
 /** Files the producer reads by the config's own naming, resolved against the config's directory (rig-parts `relativeConfigPaths`). */
 export const CONFIG_NAMED_FILES = [['motion', 'animations_from'], ['generation', 'control', 'skeleton']] as const;
 /** What `rig-parts rig` writes into its --out and remesh reads from --rig: the rig spec, its motion, the mesh report and the part images. */
@@ -56,6 +66,33 @@ const inside = (base: string, path: string, allowSelf = false) => { const rel =
 const code = (e: unknown) => (e as NodeJS.ErrnoException).code ?? '';
 async function exists(path: string): Promise<boolean> { try { await lstat(path); return true; } catch (e) { if (code(e) === 'ENOENT' || code(e) === 'ENOTDIR') return false; throw e; } }
 
+/** A path's own entry (never followed) is of this kind; absent or another kind is false. */
+async function entryIs(path: string, kind: 'file' | 'dir'): Promise<boolean> {
+  try { const info = await lstat(path); return kind === 'file' ? info.isFile() : info.isDirectory(); } catch (e) { if (code(e) === 'ENOENT' || code(e) === 'ENOTDIR') return false; throw e; }
+}
+/**
+ * #149: a rig-parts build root — the folder `rig-parts build --out` wrote — recognised by fixed names the build owns, never
+ * by a search: regular `parts.json` and `rig/rig.json`, a real (not symlinked) `check/` directory, and an existing
+ * `check/build/skeleton.model.json` entry (its validity is the package adapter's to refuse). A folder lacking any of
+ * these is not a build root.
+ */
+export async function isBuildRoot(dir: string): Promise<boolean> {
+  if (!(await entryIs(join(dir, 'parts.json'), 'file')) || !(await entryIs(join(dir, 'rig'), 'dir')) || !(await entryIs(join(dir, 'rig', 'rig.json'), 'file')) || !(await entryIs(join(dir, 'check'), 'dir'))) return false;
+  return exists(join(dir, 'check', 'build', 'skeleton.model.json'));
+}
+/** The producer's own config places for the build whose check package is `root` (canonical), or null when `root` is not one. */
+interface BuildPlace { config: string; base: string; field: string }
+async function buildPlaces(root: string): Promise<{ build: string; places: BuildPlace[] } | null> {
+  if (basename(root) !== 'check' || !(await isBuildRoot(dirname(root)))) return null;
+  const build = dirname(root);
+  return { build, places: [{ config: join(build, 'config.json'), base: build, field: '../config.json' }, { config: join(dirname(build), 'config.json'), base: dirname(build), field: '../../config.json' }] };
+}
+/** The path as written with its parent chain canonicalized (so /tmp → /private/tmp is not an escape); null when the parent is missing. */
+async function writtenPath(value: string): Promise<string | null> {
+  const lexical = resolve(value);
+  try { return join(await realpath(dirname(lexical)), basename(lexical)); } catch (e) { if (code(e) === 'ENOENT' || code(e) === 'ENOTDIR') return null; throw e; }
+}
+
 /**
  * One handoff path: it must exist, its canonical location must stay inside `base`, and it must be the expected kind.
  * `lexicalInside` says whether the path as written was inside the root, so a canonical escape is named a symlink escape.
@@ -175,13 +212,17 @@ export async function resolveHandoff(root: string, declared: HandoffDeclaration
   if (flags) {
     const problem = checkHandoffFlags(flags);
     if (problem) throw new HandoffError('HANDOFF_FLAGS_INVALID', problem.split(':')[0]!, problem);
-    const config = await flagPath(root, flags.config, '--config', 'file');
-    const parts = flags.parts !== undefined ? await flagPath(root, flags.parts, '--parts', 'dir') : join(dirname(config), 'out');
-    const source = flags.source !== undefined ? await flagPath(root, flags.source, '--source', 'file') : undefined;
-    const full = flags.full !== undefined ? await flagPath(root, flags.full, '--full', 'dir') : undefined;
-    const head = flags.head !== undefined ? await flagPath(root, flags.head, '--head', 'dir') : undefined;
-    const keypoints = flags.keypoints !== undefined ? await flagPath(root, flags.keypoints, '--keypoints', 'file') : undefined;
-    const handoff = await record(root, root, 'declared', 'open --config', config, parts, { source, full, head, keypoints }, flags.parts !== undefined);
+    // #149: a --config written as exactly one of the build's own config places takes that place's folder as its root.
+    const build = await buildPlaces(root), written = build ? await writtenPath(flags.config) : null;
+    const place = build?.places.find(p => p.config === written) ?? null, base = place?.base ?? root;
+    const config = await flagPath(base, flags.config, '--config', 'file');
+    if (place && config !== place.config) throw new HandoffError('HANDOFF_SYMLINK_ESCAPE', '--config', `${flags.config} is a symlink; only the build's own ${place.field} is taken`);
+    const parts = flags.parts !== undefined ? await flagPath(base, flags.parts, '--parts', 'dir') : place ? build!.build : join(dirname(config), 'out');
+    const source = flags.source !== undefined ? await flagPath(base, flags.source, '--source', 'file') : undefined;
+    const full = flags.full !== undefined ? await flagPath(base, flags.full, '--full', 'dir') : undefined;
+    const head = flags.head !== undefined ? await flagPath(base, flags.head, '--head', 'dir') : undefined;
+    const keypoints = flags.keypoints !== undefined ? await flagPath(base, flags.keypoints, '--keypoints', 'file') : undefined;
+    const handoff = await record(root, base, 'declared', 'open --config', config, parts, { source, full, head, keypoints }, flags.parts !== undefined);
     // Canonical absolute flags: the background worker and later reloads read exactly these.
     handoff.flags = { config, ...(flags.parts !== undefined ? { parts } : {}), ...(source ? { source } : {}), ...(full ? { full } : {}), ...(head ? { head } : {}), ...(keypoints ? { keypoints } : {}) };
     return { handoff, reason: null };
@@ -202,6 +243,17 @@ export async function resolveHandoff(root: string, declared: HandoffDeclaration
     const config = await contained(root, path, name, 'file', true);
     return { handoff: await record(root, root, 'discovered', 'discovery', config, join(dirname(path), 'out'), {}, false), reason: null };
   }
+  // #149: the check package of a rig-parts build root — the build's own config, in the build root, else beside it.
+  const build = await buildPlaces(root);
+  if (build) {
+    for (const place of build.places) {
+      if (!(await exists(place.config))) continue;
+      const config = await contained(place.base, place.config, place.field, 'file', true);
+      if (config !== place.config) throw new HandoffError('HANDOFF_SYMLINK_ESCAPE', place.field, `${place.config} is a symlink; only the build's own config file is discovered`);
+      return { handoff: await record(root, place.base, 'discovered', 'discovery', config, build.build, {}, false), reason: null };
+    }
+    return { handoff: null, reason: BUILD_MODELING_INPUT_UNAVAILABLE };
+  }
   // The last step: an opened `out/` whose config sits beside it, one level up. Outside the folder, so named.
   if (basename(root) === 'out') {
     const parent = dirname(root), path = join(parent, 'config.json');

package/src/manifest.ts

@@ -6,7 +6,7 @@ import { parseReport, type ReportSeeds } from './report.ts';
 import { readFile, realpath, stat, lstat, readdir } from 'node:fs/promises';
 import { createReadStream } from 'node:fs';
 import { basename, dirname, isAbsolute, relative, resolve, posix } from 'node:path';
-import { parseHandoffDeclaration, resolveHandoff, type Handoff, type HandoffDeclaration, type HandoffFlags, type HandoffRecord } from './handoff.ts';
+import { isBuildRoot, parseHandoffDeclaration, resolveHandoff, type Handoff, type HandoffDeclaration, type HandoffFlags, type HandoffRecord } from './handoff.ts';
 
 export type Json = null | boolean | number | string | Json[] | { [key: string]: Json };
 export interface Reference { id: string; label: string; type: 'image' | 'video' | 'pose'; path: string; width?: number; height?: number }
@@ -74,7 +74,9 @@ export function parseManifest(input: unknown): ReviewManifest {
 /** `options.handoff` are the explicit `--config …` flags; they win over the manifest block and discovery. */
 export async function loadReview(input: string, options: { handoff?: HandoffFlags } = {}): Promise<ReviewPackage> {
   const inputPath=await realpath(resolve(input));const directory=(await stat(inputPath)).isDirectory();
-  if(directory){try{await stat(resolve(inputPath,'review.json'));return loadReview(resolve(inputPath,'review.json'),options);}catch(e){if((e as NodeJS.ErrnoException).code!=='ENOENT')throw e;}}
+  if(directory){try{await stat(resolve(inputPath,'review.json'));return loadReview(resolve(inputPath,'review.json'),options);}catch(e){if((e as NodeJS.ErrnoException).code!=='ENOENT')throw e;}
+    // #149: a rig-parts build root without a model of its own opens as its check package, exactly as opening check/ does.
+    const check=await buildCheckPackage(inputPath);if(check)return loadReview(check,options);}
   const manifestPath=inputPath;const root=directory?inputPath:await realpath(dirname(inputPath));
   const manifest=directory?await folderManifest(root):parseManifest(JSON.parse(await readFile(manifestPath,'utf8')));
   const files = new Set([...(directory?[]:[relative(root,manifestPath)]),...manifest.references.map(v=>v.path),...manifest.authoring.map(v=>v.path),...manifest.audio.clips.map(v=>v.path)]);
@@ -112,9 +114,17 @@ export async function loadReview(input: string, options: { handoff?: HandoffFlag
   return {root,manifestPath,manifest,sourceHash:hash.digest('hex'),reviewedSource,files,report,feedbackCatalog,handoff,handoffReason,...(handoff?.flags?{handoffInputs:handoff.flags}:{})};
 }
 
+/**
+ * #149: the `check/` package of a rig-parts build root ({@link isBuildRoot}), when the folder has neither of the two
+ * adapter model paths itself (a folder that does keeps opening as before). Fixed names, no search.
+ */
+export async function buildCheckPackage(dir:string):Promise<string|null>{
+  for(const candidate of ['skeleton.model.json','build/skeleton.model.json']){try{await lstat(resolve(dir,candidate));return null;}catch(e){if(!['ENOENT','ENOTDIR'].includes((e as NodeJS.ErrnoException).code??''))throw e;}}
+  return await isBuildRoot(dir)?resolve(dir,'check'):null;
+}
 /** Same text for every command; `root` lets the open launcher name the refused input. */
 export class UnrecognizedOutputError extends Error {
-  constructor(readonly root:string){super('Output folder: no recognized skeleton.*, build/skeleton.model.json, motion.json, report.json, source video, pose sequence or contact strip');}
+  constructor(readonly root:string){super('Output folder: no recognized skeleton.*, build/skeleton.model.json, rig-parts build root (check/build/skeleton.model.json), motion.json, report.json, source video, pose sequence or contact strip');}
 }
 /** An adapter over an existing output directory; never writes a manifest there. */
 async function folderManifest(root:string):Promise<ReviewManifest>{

package/src/open.ts

@@ -16,7 +16,14 @@ import {selectAnimation,AnimationSelectionError,type AnimationSelection} from '.
 import {capabilityHeader,capabilityPattern,type OpenIdentity} from './open-protocol.ts';
 import {ensureFront,frontPort} from './front.ts';
 import {playPackagePath} from './versions.ts';
-import {HandoffError,HANDOFF_FLAGS,type HandoffFlags} from './handoff.ts';
+import {HandoffError,HANDOFF_FLAGS,isBuildRoot,type HandoffFlags,type HandoffRecord} from './handoff.ts';
+/** #149: an opened rig-parts build check package — its canonical path and the handoff record (or the refusal line). */
+export interface BuildOpen {package:string;handoff:HandoffRecord|null;reason:string|null}
+/** The stderr diagnostic for {@link BuildOpen}: the package opened, then how the config was found, its package-relative path and full SHA-256. */
+export function buildOpenDiagnostic(build:BuildOpen):string{
+ const h=build.handoff,how=!h?'':h.how==='declared'?`declared (${h.via})`:h.outside?'discovered outside the opened folder':'discovered';
+ return `Package: rig-parts build check package ${build.package}\n${h?`Handoff ${how}: ${h.config.path} sha256 ${h.config.sha256}${h.parts?` · parts ${h.parts}`:''}`:`Handoff: ${build.reason??'none'}`}`;
+}
 /** `direct` chooses how the page is reached (own port instead of the managed front); it is not part of the instance identity. */
 export interface OpenInputs {input:string;compare?:string;reference?:string;animation?:string;control?:boolean;direct?:boolean;config?:string;parts?:string;source?:string;full?:string;head?:string;keypoints?:string}
 /** The producer handoff flags (#101) among the inputs, or undefined when none was given. */
@@ -97,7 +104,7 @@ async function openRefusal(error:unknown,inputs:OpenInputs):Promise<unknown>{
 }
 /** Managed is the default: the printed URL goes through the one loopback front (127.0.0.1:4318, or
  * RIG_REVIEW_FRONT_PORT) so browser storage keeps one origin across reopens. `direct` keeps the worker's own port. */
-export async function openReview(inputs:OpenInputs,options:{stateDir?:string;idleMs?:number;direct?:boolean;frontPort?:number;frontIdleMs?:number}={}):Promise<{url:string;reused:boolean;nonce:string;inputs:OpenInputs;selection:AnimationSelection|null;direct:boolean}>{
+export async function openReview(inputs:OpenInputs,options:{stateDir?:string;idleMs?:number;direct?:boolean;frontPort?:number;frontIdleMs?:number}={}):Promise<{url:string;reused:boolean;nonce:string;inputs:OpenInputs;selection:AnimationSelection|null;direct:boolean;build:BuildOpen|null}>{
  const direct=options.direct??inputs.direct??false,port=direct?0:frontPort(options.frontPort);
  for(const path of [inputs.input,...(inputs.compare!==undefined?[inputs.compare]:[])])await assertOpenInput(path);
  if(inputs.compare!==undefined&&!inputs.reference)throw new Error('OPEN_REFERENCE_REQUIRED: compare: explicit --reference required');
@@ -108,7 +115,9 @@ export async function openReview(inputs:OpenInputs,options:{stateDir?:string;idl
  const control=join(stateDir,'open');await mkdir(control,{recursive:true,mode:0o700});const canonicalControl=await realpath(control);if((await lstat(control)).isSymbolicLink())throw new Error('open.state: control directory cannot be a symlink');
  const worker=await ensureWorker(p,key,fingerprint,stateDir,canonicalControl,options.idleMs??30*60*1000);
  const url=direct?openUrl(worker.row):openUrl(worker.row,await ensureFront({control:canonicalControl,port,fingerprint,idleMs:options.frontIdleMs}));
- return {url,reused:worker.reused,nonce:worker.row.nonce,inputs:p.inputs,selection:p.selection,direct};
+ // #149: the check package of a rig-parts build root says which package it opened and which config the handoff took.
+ const build=p.mode==='single'&&basename(p.p.root)==='check'&&await isBuildRoot(dirname(p.p.root))?{package:p.p.root,handoff:p.p.reviewedSource.handoff??null,reason:p.p.handoffReason}:null;
+ return {url,reused:worker.reused,nonce:worker.row.nonce,inputs:p.inputs,selection:p.selection,direct,build};
 }
 async function ensureWorker(p:OpenPackage,key:string,fingerprint:string,stateDir:string,canonicalControl:string,idleMs:number):Promise<{row:RecordFile;reused:boolean}>{
  const registry=join(canonicalControl,key+'.json'),claim=join(canonicalControl,key+'.claim'),nonce=randomUUID(),deadline=performance.now()+20000;

package/src/rebuild.ts

@@ -10,7 +10,7 @@
  */
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { copyFile, mkdir, readFile, readdir, realpath, rm, writeFile, lstat } from 'node:fs/promises';
+import { copyFile, mkdir, readFile, readdir, realpath, rename, rm, writeFile, lstat } from 'node:fs/promises';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { object, packagePath, safeFile, type ReviewPackage } from './manifest.ts';
 import { compileArgs, firstRefusal, modelingProducerTooOld, REMESH_DELTA_SINCE, remeshArgs, remeshDeltaArgs, resolvePose, resolveProducer, runTool, versionAtLeast, type CompileRequest, type InstalledTool, type ProcessResult } from './producer.ts';
@@ -24,6 +24,7 @@ import { CHEST_REGIONS_MAX } from './chest-regions.ts';
 import { bustMeshEntry, deriveBust, parseBustSpec, BustSpecError, type BustSpec } from './chest-landmarks.ts';
 import { modelMeshTriangles, remeshCounts, type RemeshCounts } from './mesh-entry.ts';
 import { patchRoute } from './retune-route.ts';
+import { producerHint } from './baseline-reach.ts';
 import { carriedCheck, RETUNE_CHECK_SINCE, RETUNE_FILE, retuneCheckSummary, revisionBinding } from './retune-check.ts';
 import { absolutizeBuildFiles, buildLines, buildNamedFiles, buildReadout, MAX_BUILD_READOUT, needsBuild, newBuildFile, recompositeFigures, type RecompositeFigures } from './build-route.ts';
 import { jsonDiff } from './config-patch.ts';
@@ -201,6 +202,25 @@ export function designationId(input: { sourceHash: string; configHash: string; p
 }
 export const rebuildRoot = (stateDir: string, sourceHash: string) => join(stateDir, 'rebuild', sourceHash);
 export const rebuildDir = (stateDir: string, sourceHash: string, id: string) => join(rebuildRoot(stateDir, sourceHash), id);
+/**
+ * #166: where the applied records' earlier builds wait for an undo — outside the scratch root, so the scratch root still
+ * holds only the build on the stage. At most `MAX_KEPT_BUILDS` builds are on disk per package (the stage's included);
+ * an older record's build is evicted, and undoing to it re-runs its producer step from the record.
+ */
+export const keptRoot = (stateDir: string, sourceHash: string) => join(stateDir, 'rebuild-kept', sourceHash);
+export const MAX_KEPT_BUILDS = 8;
+/** The undo refusal: the predecessor cannot be restored byte for byte, and review does not guess. */
+export const UNDO_PREDECESSOR_CHANGED = 'UNDO_PREDECESSOR_CHANGED';
+/** One applied record of the session's stack (#166): the request as sent (to re-run it), its inputs and its build by hash. */
+export interface AppliedEntry {
+  id: string; body: unknown; configHash: string;
+  producer: { package: string; version: string }; compiler: { package: string; version: string };
+  files: Record<string, string>; modelHash: string;
+  /** The job as it settled, served back on undo. */
+  job: RebuildJob | PatchJob | DeltaJob | RetargetJob;
+}
+/** `GET /api/rebuild/history`: the applied records in order, the last one on the stage; `kept`: its build is still on disk. */
+export interface AppliedHistory { schema: 'rig-review-applied-history/1'; depth: number; records: { id: string; kind: 'regions' | 'patch' | 'delta' | 'retarget'; op: string; what: string; modelHash: string; kept: boolean }[] }
 
 export type RebuildStatus = 'running' | 'built' | 'refused' | 'failed';
 export interface RebuildBuild { model: string; modelUrl: string; modelHash: string; files: Record<string, string> }
@@ -210,6 +230,8 @@ export interface RebuildJob {
   producer: { package: string; version: string }; compiler: { package: string; version: string };
   lines: string[]; producerLine: string | null; exitCode: number | null; wallMs: { remesh: number | null; compile: number | null };
   build: RebuildBuild | null;
+  /** #148: review's reading of a producer refusal it can explain (`producerHint`), beside the producer's line; absent otherwise. */
+  hint?: string;
 }
 /**
  * A patch Apply (#102): the config patch, its hash and the config bytes it was made against; the op's, the compile's
@@ -223,6 +245,8 @@ export interface PatchJob {
   request: { patch: ConfigPatch; patchSha256: string; configHash: string };
   producer: { package: string; version: string }; compiler: { package: string; version: string };
   lines: string[]; producerLine: string | null; exitCode: number | null; wallMs: { op: number | null; compile: number | null; check: number | null };
+  /** #148: as `RebuildJob.hint`. */
+  hint?: string;
   check: CheckSummary | null; diff: { count: number; paths: string[] } | null;
   /** #125: the per-file diff of every producer document (`src/producer-files.ts`) and the images by hash. */
   files: FilesDiff | null;
@@ -340,6 +364,8 @@ export interface DeltaJob {
   request: { part: string; delta: Record<string, unknown>; deltaSha256: string; configHash: string };
   producer: { package: string; version: string }; compiler: { package: string; version: string };
   lines: string[]; producerLine: string | null; exitCode: number | null; wallMs: { op: number | null; compile: number | null };
+  /** #148: as `RebuildJob.hint`. */
+  hint?: string;
   files: FilesDiff | null;
   remesh: (RemeshCounts & { modelTriangles: number | null }) | null;
   build: RebuildBuild | null;
@@ -485,6 +511,11 @@ async function hashBuild(build: string, id: string): Promise<RebuildBuild> {
 export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
   const jobs = new Map<string, RebuildJob | PatchJob | DeltaJob | RetargetJob>();
   let running: string | null = null;
+  /** #166: the session's applied records, in order; the last is on the stage. The request bodies by job id. */
+  const stack: AppliedEntry[] = [];
+  const bodies = new Map<string, unknown>();
+  /** #166: an undo re-running an evicted predecessor: its id and the build files it must reproduce. */
+  let restoring: { id: string; files: Record<string, string> } | null = null;
   const snapshot = <J extends RebuildJob | PatchJob | DeltaJob | RetargetJob>(job: J): J => ({ ...job, lines: [...job.lines] });
 
   /** The state directory may not sit inside the package or the handoff's root (the parent of an opened out/). */
@@ -503,7 +534,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     try { assertStateOutside(); } catch { return null; }
     const handoff = p.handoff, key = baselineKey(p.sourceHash, handoff, resolved.producer, resolved.compiler), rig = handoff.rig ?? p.root;
     const show = (rel: string) => relative(p.root, join(rig, rel)).split(sep).join('/');
-    baseline = { schema: 'rig-review-baseline/1', key, status: 'running', producer: tool(resolved.producer), firstDifference: null, hashes: null, line: `baseline: running ${resolved.producer.package} ${resolved.producer.version} rig into scratch…`, exitCode: null, wallMs: null };
+    baseline = { schema: 'rig-review-baseline/1', key, status: 'running', producer: tool(resolved.producer), firstDifference: null, hashes: null, reach: null, line: `baseline: running ${resolved.producer.package} ${resolved.producer.version} rig into scratch…`, exitCode: null, wallMs: null };
     const started = baseline;
     baselineRun = runBaseline(baselineDir(options.stateDir, key), key, handoff, resolved.producer, show)
       .catch((error): BaselineResult => ({ ...started, status: 'failed', line: `baseline: failed — ${error instanceof Error ? error.message : String(error)}` }))
@@ -584,6 +615,121 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const dir = job ? rebuildDir(options.stateDir, p.sourceHash, job.id) : '';
     return job && job.status === 'built' && job.build ? { id: job.id, build: join(dir, 'build'), modelHash: job.build.modelHash, spec: join(dir, !('kind' in job) ? 'revision' : job.op === 'build' || (job.kind === 'patch' && job.cloth?.route === 'build') ? 'out/rig' : 'rig') } : null;
   }
+  /**
+   * #166: the line refusing an undo's re-run whose build is not the one its record names (the first differing file by
+   * hash), or null — also null for any job that is not an undo's re-run.
+   */
+  function restoredDifference(id: string, files: Record<string, string>): string | null {
+    if (restoring?.id !== id) return null;
+    const names = [...new Set([...Object.keys(restoring.files), ...Object.keys(files)])].sort();
+    const file = names.find(n => restoring!.files[n] !== files[n]);
+    if (!file) return null;
+    const side = (h: string | undefined) => (h ? `${h.slice(0, 12)}…` : 'absent'), recorded = restoring.files[file];
+    restoring = null;
+    return `${UNDO_PREDECESSOR_CHANGED}: ${file} — the record's build has sha256 ${side(recorded)}, the re-run wrote ${side(files[file])}; the predecessor cannot be restored byte for byte, so the stage stays on the last Apply`;
+  }
+  /** #166: an undo's re-run computed another build id than its record's — some input it hashes is not what it was. */
+  function guardRestore(id: string): void {
+    if (!restoring || restoring.id === id) return;
+    const was = restoring.id; restoring = null;
+    throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `build id ${was.slice(0, 12)}… → ${id.slice(0, 12)}… — an input the record's build id hashes (the package, the handoff config, the build's painting, runs or named files, the keypoints, the producer or the compiler) is not what it was; the stage stays on the last Apply`);
+  }
+  /** #166: a kept build asked for again moves back into the scratch root (where reuse reads it). */
+  async function unkeep(id: string): Promise<void> {
+    const from = join(keptRoot(options.stateDir, p.sourceHash), id), to = rebuildDir(options.stateDir, p.sourceHash, id);
+    if (!(await exists(from))) return;
+    if (await exists(to)) { await rm(from, { recursive: true, force: true }); return; }
+    await mkdir(rebuildRoot(options.stateDir, p.sourceHash), { recursive: true, mode: 0o700 });
+    await rename(from, to);
+  }
+  /**
+   * #166: a built (or reused) Apply lands on the stack — or, for an undo's re-run or reuse of the predecessor, the undone
+   * record leaves it — and the scratch tree is arranged: the stage's build in the scratch root, the other records' most
+   * recent `MAX_KEPT_BUILDS - 1` builds in keptRoot, every other build removed.
+   */
+  async function landed(job: RebuildJob | PatchJob | DeltaJob | RetargetJob): Promise<void> {
+    if (restoring?.id === job.id) { stack.pop(); restoring = null; }
+    else if (stack.at(-1)?.id !== job.id && job.build) stack.push({ id: job.id, body: bodies.get(job.id) ?? null, configHash: job.request.configHash, producer: { ...job.producer }, compiler: { ...job.compiler }, files: { ...job.build.files }, modelHash: job.build.modelHash, job: snapshot(job) });
+    latestId = stack.at(-1)?.id ?? null;
+    await arrange();
+  }
+  async function arrange(): Promise<void> {
+    const root = rebuildRoot(options.stateDir, p.sourceHash), kept = keptRoot(options.stateDir, p.sourceHash);
+    const top = stack.at(-1)?.id ?? null, order: string[] = [];
+    for (let i = stack.length - 2; i >= 0; i--) { const id = stack[i]!.id; if (id !== top && !order.includes(id)) order.push(id); }
+    const keep = new Set(order.slice(0, MAX_KEPT_BUILDS - 1));
+    const list = async (dir: string) => { try { return (await readdir(dir)).filter(n => /^[a-f0-9]{64}$/.test(n)); } catch (e) { if ((e as NodeJS.ErrnoException).code === 'ENOENT') return []; throw e; } };
+    if (top) await unkeep(top);
+    for (const id of await list(root)) {
+      if (id === top) continue;
+      if (keep.has(id) && !(await exists(join(kept, id)))) { await mkdir(kept, { recursive: true, mode: 0o700 }); await rename(join(root, id), join(kept, id)); }
+      else await rm(join(root, id), { recursive: true, force: true });
+      jobs.delete(id);
+    }
+    for (const id of await list(kept)) if (!keep.has(id)) await rm(join(kept, id), { recursive: true, force: true });
+  }
+  /** `GET /api/rebuild/history` (#166). */
+  async function history(): Promise<AppliedHistory> {
+    const records: AppliedHistory['records'] = [];
+    for (const [i, e] of stack.entries()) {
+      const job = e.job, last = i === stack.length - 1;
+      const kind = !('kind' in job) ? 'regions' as const : job.kind;
+      const what = !('kind' in job) ? `${job.request.bust ? 'contour.bust landmarks' : `${job.request.regions.length} region(s)`} on ${job.request.part}`
+        : job.kind === 'patch' ? job.request.patch.ops.map(o => `${o.op} ${o.path}`).slice(0, 3).join(', ') + (job.request.patch.ops.length > 3 ? `, +${job.request.patch.ops.length - 3}` : '')
+        : job.kind === 'delta' ? `mesh edit on ${job.request.part}` : `retarget "${job.request.record.flags.animation}"`;
+      const kept = await exists(join(last ? rebuildRoot(options.stateDir, p.sourceHash) : keptRoot(options.stateDir, p.sourceHash), e.id));
+      records.push({ id: e.id, kind, op: 'op' in job ? job.op : 'remesh', what, modelHash: e.modelHash, kept });
+    }
+    return { schema: 'rig-review-applied-history/1', depth: stack.length, records };
+  }
+  /**
+   * `POST /api/rebuild/undo` with `{from}` (#166): the last applied record leaves the stack and the stage returns to its
+   * predecessor's build, or to the inspected build when none is left. `from` is the record the page shows on the stage
+   * (`UNDO_STALE` otherwise). A kept predecessor is restored from disk after its files are re-hashed against its record;
+   * an evicted one re-runs its recorded request through the same runner, refused before anything runs when the handoff
+   * config or a tool version is not the record's, and refused after when the build is not byte-identical — either way
+   * `UNDO_PREDECESSOR_CHANGED: <what>`, the stage left on the last Apply. Undo writes nothing into the package.
+   */
+  async function undo(input: unknown): Promise<{ status: number; body: unknown }> {
+    const v = object(input, 'undo');
+    if (Object.keys(v).join(',') !== 'from' || typeof v.from !== 'string' || !/^[a-f0-9]{64}$/.test(v.from)) bad('expected exactly {from: <the build id on the stage>}');
+    assertStateOutside();
+    if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    const top = stack.at(-1);
+    if (!top) throw new RebuildError('UNDO_NOTHING_APPLIED', 'no Apply is on the stage; the inspected build is');
+    if (top.id !== v.from) throw new RebuildError('UNDO_STALE', `the stage's last Apply is ${top.id.slice(0, 12)}…, not ${String(v.from).slice(0, 12)}…; reload`);
+    const pred = stack.at(-2);
+    if (!pred) { stack.pop(); latestId = null; await arrange(); return { status: 200, body: { status: 'inspected', undone: top.id, history: await history() } }; }
+    // (i) the kept build: back into the scratch root, re-hashed against result.json and against the record.
+    await unkeep(pred.id);
+    const dir = rebuildDir(options.stateDir, p.sourceHash, pred.id);
+    const kept = await reuse<RebuildJob | PatchJob | DeltaJob | RetargetJob>(dir, pred.id);
+    if (kept && JSON.stringify(kept.build!.files) === JSON.stringify(pred.files)) {
+      jobs.set(pred.id, kept); stack.pop(); latestId = pred.id; await arrange();
+      return { status: 200, body: { status: 'built', undone: top.id, job: snapshot(kept), history: await history() } };
+    }
+    await rm(dir, { recursive: true, force: true });
+    // (ii) evicted (or not its record's bytes): re-run the record's request, only on the inputs it was built from.
+    if (pred.body === null) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${pred.id.slice(0, 12)}… — the record carries no request to re-run and its build is gone`);
+    const handoff = p.handoff;
+    if (handoff) {
+      let now = 'unreadable';
+      try { now = sha256(await readFile(handoff.config)); } catch { /* named below */ }
+      if (now !== pred.configHash) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${handoff.record.config.path} sha256 ${pred.configHash.slice(0, 12)}… → ${now === 'unreadable' ? now : `${now.slice(0, 12)}…`}; the evicted build was made from the config as it was`);
+    }
+    const retargeting = 'kind' in pred.job && pred.job.kind === 'retarget';
+    const resolved = retargeting ? resolvePose(options.starts) : resolveProducer(options.starts);
+    if (!resolved.ok) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${pred.producer.package} ${pred.producer.version} → ${resolved.error}`);
+    for (const [was, now] of [[pred.producer, resolved.producer], [pred.compiler, resolved.compiler]] as const) {
+      if (was.package !== now.package || was.version !== now.version) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${was.package} ${was.version} → ${now.package} ${now.version}; the evicted build was made with the version its record names`);
+    }
+    restoring = { id: pred.id, files: { ...pred.files } };
+    let started: { status: number; body: unknown };
+    try { started = await start(pred.body); } catch (e) { restoring = null; throw e; }
+    const body = started.body as { id?: string; status?: string };
+    if (body.id !== pred.id) { restoring = null; return started; }
+    return { status: started.status, body: { status: body.status === 'running' ? 'running' : body.status, undone: top.id, job: body, ...(body.status === 'running' ? {} : { history: await history() }) } };
+  }
   /** The baseline once it settles (tests, and the whole-rig ops of #102/#103 through assertWholeRigBaseline). */
   async function settledBaseline(): Promise<BaselineResult | null> { if (!baselineRun) ensureBaseline(resolveProducer(options.starts)); return baselineRun ? await baselineRun : baseline; }
 
@@ -609,7 +755,8 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
   /**
    * The tail every Apply shares (#121), once its producer op has written a rig spec into `<dir>/<op.spec>`: the per-file
    * diff when asked (#125), the compile with the revision's own pack flags, check when asked (#102), the build hashed,
-   * result.json written, the package's other scratch builds replaced; anything but a built job leaves nothing behind.
+   * result.json written, the package's other scratch builds replaced (#166: the applied records' earlier builds kept
+   * beside the scratch root for undo); anything but a built job leaves nothing behind.
    * Each runner passes only its producer op and the optional steps it records.
    */
   async function apply(job: RebuildJob | PatchJob | DeltaJob | RetargetJob, dir: string, inputs: ProducerInputs, resolved: Resolved, op: ProducerOp, steps: ApplySteps = {}): Promise<void> {
@@ -620,7 +767,13 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       await mkdir(dir, { recursive: true, mode: 0o700 });
       const run = await op.run(push);
       job.exitCode = run.exitCode; op.wallMs(run.wallMs);
-      if (run.exitCode !== 0) { job.producerLine = firstRefusal(run.lines) ?? `${op.tool ?? 'rig-parts'} ${op.cmd} exited ${run.exitCode} without a named refusal`; job.status = 'refused'; return; }
+      if (run.exitCode !== 0) {
+        job.producerLine = firstRefusal(run.lines) ?? `${op.tool ?? 'rig-parts'} ${op.cmd} exited ${run.exitCode} without a named refusal`;
+        // #148: the producer's line stays as printed; review adds what it means here, when it knows.
+        const hint = producerHint(job.producerLine);
+        if (hint && !('refusals' in job)) { (job as RebuildJob | PatchJob | DeltaJob).hint = hint; push(`review: ${hint}`); }
+        job.status = 'refused'; return;
+      }
       job.producerLine = run.stdout.filter(l => l.trim()).at(-1)?.trim() ?? null;
       const { pageEdges, packShape, note } = await op.flags(push);
       if (steps.diff) {
@@ -652,15 +805,20 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       try { await options.unchanged(); } catch { throw new RebuildError('REBUILD_INPUTS_CHANGED', 'the package or its producer handoff changed during the rebuild'); }
       job.build = await hashBuild(join(dir, 'build'), job.id);
       if (steps.hashed) await steps.hashed();
+      // #166: an undo's re-run must reproduce the build its record names, file for file; otherwise it is refused, not guessed.
+      const changed = restoredDifference(job.id, job.build.files);
+      if (changed) { job.producerLine = changed; job.status = 'refused'; push(`review: ${changed}`); return; }
       latestId = job.id;
       await writeFile(join(dir, 'result.json'), JSON.stringify({ ...job, status: 'built', reused: false }, null, 1) + '\n', { mode: 0o600 });
-      // Each Apply replaces the previous scratch build of this package.
-      for (const sibling of await readdir(rebuildRoot(options.stateDir, p.sourceHash))) if (sibling !== job.id && /^[a-f0-9]{64}$/.test(sibling)) { await rm(join(rebuildRoot(options.stateDir, p.sourceHash), sibling), { recursive: true, force: true }); jobs.delete(sibling); }
+      // Each Apply replaces the previous scratch build of this package in the scratch root; #166 keeps the applied records'
+      // earlier builds beside it (keptRoot) for undo.
+      await landed({ ...job, status: 'built' });
       // "built" is published last: a reader that sees it finds the scratch root already settled (no sibling mid-removal).
       job.status = 'built';
     } catch (error) {
       job.status = 'failed'; job.producerLine = error instanceof Error ? error.message : String(error); push(`review: ${job.producerLine}`);
     } finally {
+      if (restoring?.id === job.id && job.status !== 'built') restoring = null;
       // Only a built Apply keeps its scratch directory; a refusal or failure leaves nothing behind.
       if (job.status !== 'built') await rm(dir, { recursive: true, force: true }).catch(() => {});
     }
@@ -811,7 +969,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * on a producer that has it (#136, `src/retune-route.ts`); any other `rig` patch rebuilds the whole rig and first needs
    * the baseline to have reproduced the inspected rig (`EDIT_BASELINE_MISMATCH` naming the path). Refusals come before anything is run.
    */
-  async function startPatch(input: unknown, world: ApplyWorld | null = null): Promise<{ status: number; body: unknown }> {
+  async function startPatch(input: unknown, world: ApplyWorld | null = null, body: unknown = { patch: input }): Promise<{ status: number; body: unknown }> {
     let patch: ConfigPatch;
     try { patch = parseConfigPatch(input); } catch (e) { if (e instanceof ConfigPatchError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     assertStateOutside();
@@ -867,14 +1025,16 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
     if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await unkeep(id);
     const reused = await reuse<PatchJob>(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, body); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: PatchJob = { schema: REBUILD_SCHEMA, kind: 'patch', id, status: 'running', reused: false, op, request: { patch, patchSha256: patchSha256(patch), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { op: null, compile: null, check: null }, check: null, diff: null, files: null, remesh: null, build: null,
       ...(plan ? { assembled: { inputs: plan.inputs, refusals: [], checkFails: [], lines: [], seam: [], seamPairs: [], recomposite: { line: null, before: null, after: null, errorMap: null }, parts: null } } : {}),
       ...(world ? { environment: world.record } : {}),
       ...(clothPlan ? { cloth: { route: building ? 'build' as const : 'rig' as const, inputs: { source: p.handoff!.record.source?.path ?? '', keypoints: { ...p.handoff!.record.keypoints! } }, refusals: [], line: null, written: null, links: [], wallMs: { propose: null, build: null } } } : {}) };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, body);
     void executePatch(job, dir, inputs, resolved, patched, part, plan, world, clothPlan).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -927,11 +1087,13 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
     if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await unkeep(id);
     const reused = await reuse<DeltaJob>(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, input); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: DeltaJob = { schema: REBUILD_SCHEMA, kind: 'delta', id, status: 'running', reused: false, op: 'remesh', request: { part: request.part, delta: request.delta, deltaSha256: sha256(text), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { op: null, compile: null }, files: null, remesh: null, build: null };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, input);
     void executeDelta(job, dir, inputs, resolved, text).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -1018,7 +1180,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * still be the handoff's, the sequence a declared `rig-pose-sequence/1` reference, and `@rig-c/pose` installed. The
    * map's resolution against the rig, the flags' combinations and the pose are the producer's to judge, verbatim.
    */
-  async function startRetarget(input: unknown): Promise<{ status: number; body: unknown }> {
+  async function startRetarget(input: unknown, body: unknown = { retarget: input }): Promise<{ status: number; body: unknown }> {
     let request: ReturnType<typeof parseRetargetRequest>;
     try { request = parseRetargetRequest(input); } catch (e) { if (e instanceof RetargetError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     assertStateOutside();
@@ -1039,11 +1201,13 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
     if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await unkeep(id);
     const reused = await reuse<RetargetJob>(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, body); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: RetargetJob = { schema: REBUILD_SCHEMA, kind: 'retarget', id, status: 'running', reused: false, op: 'retarget', request: { record, recordSha256: sha256(retargetRecordText(record)), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, refusals: [], exitCode: null, wallMs: { clean: null, retarget: null, compile: null }, files: null, motion: null, readings: [], frameTimes: null, build: null };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, body);
     void executeRetarget(job, dir, inputs, resolved, sequence).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -1052,7 +1216,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
   async function start(input: unknown): Promise<{ status: number; body: unknown }> {
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'retarget')) {
       if (Object.keys(input).length !== 1) bad('expected exactly {retarget}');
-      return startRetarget((input as { retarget: unknown }).retarget);
+      return startRetarget((input as { retarget: unknown }).retarget, input);
     }
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'delta')) return startDelta(input);
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'patch')) {
@@ -1060,7 +1224,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       const keys = Object.keys(input).sort().join(',');
       if (keys !== 'patch' && keys !== 'environment,patch') bad('expected exactly {patch}, {patch, environment} or {part, regions, configHash}');
       const world = Object.hasOwn(input, 'environment') ? parseApplyWorld((input as { environment: unknown }).environment) : null;
-      return startPatch((input as { patch: unknown }).patch, world);
+      return startPatch((input as { patch: unknown }).patch, world, input);
     }
     const request = parseRebuildRequest(input, options.bones);
     assertStateOutside();
@@ -1074,11 +1238,13 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
     if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await unkeep(id);
     const reused = await reuse(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, input); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: RebuildJob = { schema: REBUILD_SCHEMA, id, status: 'running', reused: false, request: { ...request, entrySha256: sha256(entry) }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { remesh: null, compile: null }, build: null };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, input);
     void execute(job, dir, inputs, resolved, entry).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -1098,5 +1264,5 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     return safeFile(await realpath(join(rebuildDir(options.stateDir, p.sourceHash, id), 'build')), packagePath(name));
   }
 
-  return { describe, start, read, file, running: () => running, baseline: settledBaseline, inspectedCheck: settledInspectedCheck, latest };
+  return { describe, start, read, file, running: () => running, baseline: settledBaseline, inspectedCheck: settledInspectedCheck, latest, undo, history };
 }

package/src/server.ts

@@ -59,6 +59,12 @@ export async function startServer(p:ReviewPackage,options:{port?:number;stateDir
       // A refusal is an outcome the page shows verbatim (200), so the managed front passes its text through; only a malformed request is a 400.
       catch(e){if(e instanceof RebuildError)return json({status:'refused',error:e.message,producerLine:null},MALFORMED.has(e.code)?400:200);throw e;}
     }
+    // #166: undo the last Apply — {from: <the build id on the stage>}; nothing is read from the client but that id.
+    if(req.method==='POST'&&url.pathname==='/api/rebuild/undo'){
+      if(req.headers.get('origin')!==origin)return json({error:'Same-origin Origin required'},403);
+      try{const result=await rebuilds.undo(await bodyJson(req,1024,'REBUILD_BODY_LIMIT: maximum 1 KiB'));return json(result.body,result.status);}
+      catch(e){if(e instanceof RebuildError)return json({status:'refused',error:e.message,producerLine:null},MALFORMED.has(e.code)?400:200);throw e;}
+    }
     if(req.method==='POST'&&url.pathname==='/api/bones-check'){
       if(req.headers.get('origin')!==origin)return json({error:'Same-origin Origin required'},403);
       try{return json(await bonesCheck.run(await bodyJson(req,BONES_CHECK_LIMIT,'BONES_CHECK_BODY_LIMIT: maximum 64 KiB')));}
@@ -88,6 +94,7 @@ export async function startServer(p:ReviewPackage,options:{port?:number;stateDir
       if(url.pathname==='/api/review'){await unchanged();return json({manifest:p.manifest,initialAnimation:options.initialAnimation??null,sourceHash:p.sourceHash,reviewedSource:p.reviewedSource,...(referenceBinding(p)?{referenceBinding:referenceBinding(p),explicitReference:{...referenceBinding(p)!.reference,url:'/review-reference'}}:{}),report:p.report,feedbackCatalog:p.feedbackCatalog,assetsBase:'/assets/',capabilities:{playback:!!p.manifest.model,modeling:false,motion:false,feedback:true,audio:true}});}
       if(url.pathname==='/api/session'){await unchanged();return json(await readSession(p,options.stateDir));}
       if(url.pathname==='/api/rebuild')return json(await rebuilds.describe());
+      if(url.pathname==='/api/rebuild/history')return json(await rebuilds.history());
       const rebuildStatus=/^\/api\/rebuild\/([a-f0-9]{64})$/.exec(url.pathname);
       if(rebuildStatus){try{return json(rebuilds.read(rebuildStatus[1]!));}catch(e){if(e instanceof RebuildError)return json({error:e.message},404);throw e;}}
       if(url.pathname==='/api/requirements')return json(await requirements.describe());