railmux 0.4.0.dev20__tar.gz → 0.4.0.dev22__tar.gz

{railmux-0.4.0.dev20/src/railmux.egg-info → railmux-0.4.0.dev22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: railmux
-Version: 0.4.0.dev20
+Version: 0.4.0.dev22
 Summary: Terminal UI to navigate, resume, and start Claude Code and Codex sessions
 Author-email: Rightglow <zhang.taian@foxmail.com>
 License-Expression: MIT
@@ -446,7 +446,9 @@ not interrupt it. To leave agents running when you quit Railmux, press `s` for
 soft quit in the confirmation popup; restarting the same Railmux instance then
 restores the usable workspace when those sessions are still available. A normal
 quit ends all running sessions instead and therefore requires a second
-confirmation; `y` and Enter keep their existing confirm meaning in both steps.
+confirmation. The first chooser has visible mouse buttons, but the final
+destructive confirmation remains keyboard-only; `y` and Enter keep their
+existing confirm meaning in both steps.
 
 All terminals attached to one managed Railmux window view the same UI process.
 Soft Quit therefore closes that shared UI for every attached view, although it

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/README.md

@@ -403,7 +403,9 @@ not interrupt it. To leave agents running when you quit Railmux, press `s` for
 soft quit in the confirmation popup; restarting the same Railmux instance then
 restores the usable workspace when those sessions are still available. A normal
 quit ends all running sessions instead and therefore requires a second
-confirmation; `y` and Enter keep their existing confirm meaning in both steps.
+confirmation. The first chooser has visible mouse buttons, but the final
+destructive confirmation remains keyboard-only; `y` and Enter keep their
+existing confirm meaning in both steps.
 
 All terminals attached to one managed Railmux window view the same UI process.
 Soft Quit therefore closes that shared UI for every attached view, although it

railmux-0.4.0.dev22/src/railmux/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.4.0.dev22"

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/src/railmux/codex_index.py

@@ -37,7 +37,7 @@ _TOOL_BLOCK_AGE_S = 120
 
 
 FileSignature = tuple[int, int]  # (mtime_ns, size)
-_PERSISTENT_CACHE_SCHEMA = 1
+_PERSISTENT_CACHE_SCHEMA = 2
 _PERSISTENT_CACHE_MAX_BYTES = 16 * 1024 * 1024
 _PERSISTENT_CACHE_MAX_RECORDS = 100_000
 
@@ -177,6 +177,7 @@ def _cache_session(meta: SessionMeta) -> dict:
         "pending_tool": meta.pending_tool,
         "attention": _cache_attention(meta.attention),
         "forked_from_id": meta.forked_from_id,
+        "codex_rollback_count": meta.codex_rollback_count,
     }
 
 
@@ -185,6 +186,7 @@ def _decode_cache_session(path: Path, raw: object) -> SessionMeta:
         "session_id", "cwd", "project_key", "title", "message_count", "token_total",
         "last_mtime", "size_bytes", "git_branch", "last_user_message",
         "status", "pending_tool", "attention", "forked_from_id",
+        "codex_rollback_count",
     })
     if not isinstance(raw, dict) or frozenset(raw) != keys:
         raise ValueError("invalid cached session")
@@ -213,7 +215,12 @@ def _decode_cache_session(path: Path, raw: object) -> SessionMeta:
         for value, limit, nullable in strings
     ):
         raise ValueError("invalid cached session string")
-    counts = (raw["message_count"], raw["token_total"], raw["size_bytes"])
+    counts = (
+        raw["message_count"],
+        raw["token_total"],
+        raw["size_bytes"],
+        raw["codex_rollback_count"],
+    )
     if any(
         not isinstance(value, int)
         or isinstance(value, bool)
@@ -262,6 +269,7 @@ def _decode_cache_session(path: Path, raw: object) -> SessionMeta:
         session_type="codex",
         attention=_decode_cache_attention(raw["attention"]),
         forked_from_id=forked_from_id,
+        codex_rollback_count=raw["codex_rollback_count"],
     )
 
 
@@ -1049,6 +1057,7 @@ def _parse_codex_session(
     # -- scan remaining lines for messages, events -------------------
     title: str | None = None
     message_count = 0
+    rollback_count = 0
     token_total = 0
     first_user_message: str | None = None
     last_user_message: str | None = None
@@ -1166,6 +1175,7 @@ def _parse_codex_session(
                     attention = _codex_abort_attention(rec, event_order)
                     current_turn_had_error = True
             elif et == "thread_rolled_back":
+                rollback_count += 1
                 # task_complete / turn_aborted / thread_rolled_back: the turn is
                 # over and any dangling tool calls are dead — clear them so an
                 # aborted/rolled-back session never reads as busy/blocked.
@@ -1243,6 +1253,7 @@ def _parse_codex_session(
         session_type="codex",
         attention=attention,
         forked_from_id=forked_from_id,
+        codex_rollback_count=rollback_count,
     )
     if hidden_subagent:
         return HiddenCodexStatus(

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/src/railmux/fast_display_client.py

@@ -39,7 +39,7 @@ from railmux.fast_display_history import (
     HistoryAction,
     LocalHistoryView,
     PeriodicPrefetchGate,
-    claim_batched_wheel,
+    claim_batched_forwarded_wheel,
     input_may_change_routes,
 )
 from railmux.fast_display_input import (
@@ -1423,6 +1423,73 @@ class TerminalSurface:
         self.interaction_active = False
 
 
+@dataclass
+class _DeferredHistoryPaint:
+    """Collapse one local-input batch into its final history viewport paint."""
+
+    render_history: bool = False
+    restore_live: bool = False
+
+    def defer(self, action: HistoryAction) -> None:
+        self.render_history = self.render_history or action.render_history
+        self.restore_live = self.restore_live or action.restore_live
+
+    def flush(
+        self,
+        surface: TerminalSurface,
+        screen: AppliedScreen | None,
+        overlays: tuple[tuple[HistorySnapshot, tuple[bytes, ...]], ...],
+        selection: tuple[SelectionSegment, ...],
+    ) -> None:
+        if screen is not None:
+            if self.restore_live:
+                # A viewport may have reached the live bottom and another may
+                # still be frozen. Restore the authoritative frame and compose
+                # only the final overlays in one terminal write.
+                surface.paint(full_repaint(screen), overlays, selection)
+            elif self.render_history:
+                surface.paint_overlays(screen, overlays, selection)
+        self.render_history = False
+        self.restore_live = False
+
+
+class _LocalInputBatch:
+    """Preserve local wheel distance while bounding forwarded wheel bursts."""
+
+    def __init__(self) -> None:
+        self._forwarded_wheel_directions: set[int] = set()
+        self._history_paint = _DeferredHistoryPaint()
+
+    def prepare(
+        self,
+        event: SgrMouseEvent,
+        action: HistoryAction,
+    ) -> tuple[HistoryAction | None, _DeferredHistoryPaint | None]:
+        if event.wheel_direction == 0:
+            return action, None
+        if action.forwarded_input:
+            if not claim_batched_forwarded_wheel(
+                event,
+                self._forwarded_wheel_directions,
+            ):
+                return None, None
+            return action, None
+        # Every locally owned history tick has already advanced the viewport.
+        # Defer only its terminal paint so a Windows/RDP read containing
+        # several SGR packets preserves the complete distance without issuing
+        # one synchronous pane repaint per packet.
+        return action, self._history_paint
+
+    def flush(
+        self,
+        surface: TerminalSurface,
+        screen: AppliedScreen | None,
+        overlays: tuple[tuple[HistorySnapshot, tuple[bytes, ...]], ...],
+        selection: tuple[SelectionSegment, ...],
+    ) -> None:
+        self._history_paint.flush(surface, screen, overlays, selection)
+
+
 def _remote_server_args(
     *,
     session: str,
@@ -2605,22 +2672,28 @@ def run(args: argparse.Namespace) -> int:
         if frame is not None:
             send_protocol_frame(frame)
 
-    def apply_history_action(action: HistoryAction) -> None:
+    def apply_history_action(
+        action: HistoryAction,
+        deferred_paint: _DeferredHistoryPaint | None = None,
+    ) -> None:
         nonlocal route_refresh_needed
         nonlocal history_info_until, claude_history_prompt_input
         overlays = history.overlays()
-        if action.restore_live and latest_screen is not None:
-            surface.paint(
-                full_repaint(latest_screen),
-                overlays,
-                selection.segments(),
-            )
-        elif action.render_history and latest_screen is not None:
-            surface.paint_overlays(
-                latest_screen,
-                overlays,
-                selection.segments(),
-            )
+        if deferred_paint is not None:
+            deferred_paint.defer(action)
+        else:
+            if action.restore_live and latest_screen is not None:
+                surface.paint(
+                    full_repaint(latest_screen),
+                    overlays,
+                    selection.segments(),
+                )
+            elif action.render_history and latest_screen is not None:
+                surface.paint_overlays(
+                    latest_screen,
+                    overlays,
+                    selection.segments(),
+                )
         if action.protocol_frame:
             send_protocol_frame(action.protocol_frame)
         if action.forwarded_input:
@@ -2637,7 +2710,7 @@ def run(args: argparse.Namespace) -> int:
 
     def handle_terminal_part(
         part: bytes | SgrMouseEvent,
-        handled_wheels: set[int],
+        input_batch: _LocalInputBatch,
     ) -> None:
         nonlocal route_refresh_needed
         nonlocal claude_history_prompt_input, claude_history_pending_choice
@@ -2900,15 +2973,18 @@ def run(args: argparse.Namespace) -> int:
                     selection_changed_rows(selection_before, selection_after),
                 )
             for replay_event in selection_action.replay_events:
-                if not claim_batched_wheel(replay_event, handled_wheels):
-                    continue
                 replay_action = history.pointer_event(
                     replay_event,
                     focused_pane_id,
                     status_row=status_row,
                     now=time.monotonic(),
                 )
-                apply_history_action(replay_action)
+                replay_action, deferred_paint = input_batch.prepare(
+                    replay_event,
+                    replay_action,
+                )
+                if replay_action is not None:
+                    apply_history_action(replay_action, deferred_paint)
             if selection_action.copy_data is not None:
                 surface.copy_to_clipboard(selection_action.copy_data)
                 character_count = len(
@@ -2944,15 +3020,15 @@ def run(args: argparse.Namespace) -> int:
                     begin_path_open(target)
             if selection_action.handled:
                 return
-            if not claim_batched_wheel(part, handled_wheels):
-                return
             action = history.pointer_event(
                 part,
                 focused_pane_id,
                 status_row=status_row,
                 now=time.monotonic(),
             )
-            apply_history_action(action)
+            action, deferred_paint = input_batch.prepare(part, action)
+            if action is not None:
+                apply_history_action(action, deferred_paint)
             return
         if not part:
             return
@@ -3327,19 +3403,32 @@ def run(args: argparse.Namespace) -> int:
                         data, emergency_exit = split_local_escape(data)
                         if emergency_exit:
                             local_exit = True
-                        handled_wheels: set[int] = set()
+                        input_batch = _LocalInputBatch()
                         for part in terminal_input.feed(data):
                             if isinstance(part, bytes):
                                 for key_part in split_page_key_input(part):
-                                    handle_terminal_part(key_part, handled_wheels)
+                                    handle_terminal_part(key_part, input_batch)
                             else:
-                                handle_terminal_part(part, handled_wheels)
+                                handle_terminal_part(part, input_batch)
+                        input_batch.flush(
+                            surface,
+                            latest_screen,
+                            history.overlays(),
+                            selection.segments(),
+                        )
                         if local_exit:
                             break
                 if not local_exit:
                     for part in terminal_input.flush_pending():
+                        input_batch = _LocalInputBatch()
                         for key_part in split_page_key_input(part):
-                            handle_terminal_part(key_part, set())
+                            handle_terminal_part(key_part, input_batch)
+                        input_batch.flush(
+                            surface,
+                            latest_screen,
+                            history.overlays(),
+                            selection.segments(),
+                        )
                 now = time.monotonic()
                 keyboard_projected = touch_keyboard.keyboard_projected
                 if touch_keyboard.expire(now):

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/src/railmux/fast_display_history.py

@@ -1021,18 +1021,15 @@ class LocalHistoryView:
         return was_active
 
 
-def claim_batched_wheel(
+def claim_batched_forwarded_wheel(
     event: SgrMouseEvent,
     handled_directions: set[int],
 ) -> bool:
-    """Admit at most one wheel tick per direction from one terminal read.
-
-    Trackpads commonly report several identical SGR wheel packets together.
-    If painting is briefly busy with fresh agent output, those packets can
-    accumulate in stdin and then move a frozen local-history viewport many
-    lines at once.  Bounding each read preserves the established one-line
-    local scroll feel without using a timing heuristic; a later read remains
-    immediately eligible.
+    """Admit at most one forwarded wheel tick per direction in one read.
+
+    Remote sidebar/modal owners need one bounded event rather than a stale
+    backlog. Locally owned agent history must not use this helper: it retains
+    the complete reported distance and coalesces only its terminal paint.
     """
     direction = event.wheel_direction
     if direction == 0:

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/src/railmux/models.py

@@ -70,11 +70,17 @@ class SessionMeta:
     # intentionally independent from ``status`` (conversation activity) and
     # from tmux/process liveness, which is owned by App's running registry.
     attention: AttentionState | None = None
-    # Codex creates a new rollout UUID when a conversation is rewound/forked.
-    # The parent link lets the Codex index present that chain as one logical
-    # conversation without changing the provider-owned UUID used for resume.
+    # Codex creates a new rollout UUID when a conversation is rewound/forked,
+    # resumed, continued, or compacted. The parent link lets the Codex index
+    # present that chain as one logical conversation without treating the link
+    # itself as proof of why the provider created it.
     # Always None for Claude sessions and older Codex rollouts.
     forked_from_id: str | None = None
+    # Number of provider-emitted ``thread_rolled_back`` lifecycle records in
+    # this Codex rollout.  Child rollouts can be ordinary continuation or
+    # compaction checkpoints, so the parent link alone is not rewind evidence.
+    # Always zero for Claude sessions and Codex versions without this signal.
+    codex_rollback_count: int = 0
     # A Railmux lease observed in the same shared provider history root. This
     # is a read-time UI overlay, never provider transcript metadata.
     remote_owner: str | None = None

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/src/railmux/tmux_ctl.py

@@ -1848,13 +1848,16 @@ RAILMUX_HISTORY_GENERATION_OPTION = "@railmux_history_generation_v1"
 # A confirmed branch transition prefixes the opaque SSH history cache epoch.
 # Plain generations use native pane history; only this explicit marker permits
 # the canonical transcript fallback that removes an abandoned rewind suffix.
-# Only the evidence-gated v2 marker authorizes transcript-backed Codex
-# scrolling.  The released v1 marker treated every live direct child rollout
-# as a rewind, but Codex can also create that shape while bootstrapping an
-# ordinary resume.  Keeping the prefix versioned makes existing over-broad
-# markers fail back to raw pane history on upgrade.
-RAILMUX_CANONICAL_HISTORY_PREFIX = "canonical-v2:"
-RAILMUX_LEGACY_CANONICAL_HISTORY_PREFIX = "canonical:"
+# Only the provider-rollback-gated v3 marker authorizes transcript-backed Codex
+# scrolling.  Released v1/v2 markers used rollout-shape heuristics, but Codex
+# also creates identical parent/child rollouts for ordinary continuation and
+# compaction.  Versioning makes both over-broad markers fail back to raw pane
+# history on upgrade without touching provider files.
+RAILMUX_CANONICAL_HISTORY_PREFIX = "canonical-v3:"
+RAILMUX_LEGACY_CANONICAL_HISTORY_PREFIXES = (
+    "canonical:",
+    "canonical-v2:",
+)
 # tmux names function keys only through F12. Private restore routes use
 # canonical xterm sequences in literal mode, so they cannot be confused with
 # user input forwarded to an agent pane.

{railmux-0.4.0.dev20 → railmux-0.4.0.dev22}/src/railmux/ui/app.py

@@ -389,11 +389,10 @@ class _Running:
     # provider generation lets the refresh path discard only that stale
     # presentation cache when the exact live writer advances to its child.
     codex_canonical_session_id: str | None = None
-    # A direct rollout child is a rewind only after its parent was proved to
-    # belong to this provider process generation.  An explicit Codex resume
-    # may create a child rollout during bootstrap without rewinding anything.
-    codex_rollout_proven_in_pane: bool = False
-    codex_baseline_message_count: int = 0
+    # Provider-emitted rollback count when the current rollout was adopted.
+    # Parent/child rollout shape is not sufficient: Codex also forks ordinary
+    # continuation and compaction checkpoints without a user rewind.
+    codex_baseline_rollback_count: int = 0
     codex_history_generation_stamped: bool = False
     lease_session_ids: frozenset[str] = frozenset()
     lease_warning: str | None = None
@@ -6855,8 +6854,7 @@ class App:
             )
 
         canonical_id = None
-        rollout_proven = False
-        baseline_count = 0
+        baseline_rollback_count = 0
         if session_type == "codex":
             canonical_id = (
                 raw.get("codex_canonical_session_id")
@@ -6875,24 +6873,19 @@ class App:
                     canonical_uuid = None
                 if canonical_uuid != canonical_id.lower():
                     canonical_id = None
-            rollout_proven = (
-                raw.get("codex_rollout_proven_in_pane", False)
-                if trust_codex_history_state else False
-            )
-            baseline_count = (
-                raw.get("codex_baseline_message_count", 0)
-                if trust_codex_history_state else 0
+            raw_rollback_count = (
+                raw.get("codex_baseline_rollback_count")
+                if trust_codex_history_state else None
             )
-            if (
-                not isinstance(rollout_proven, bool)
-                or not isinstance(baseline_count, int)
-                or isinstance(baseline_count, bool)
-                or baseline_count < 0
+            if raw_rollback_count is not None and (
+                not isinstance(raw_rollback_count, int)
+                or isinstance(raw_rollback_count, bool)
+                or raw_rollback_count < 0
             ):
                 return None
+            baseline_rollback_count = raw_rollback_count or 0
             if canonical_id is None:
-                rollout_proven = False
-                baseline_count = 0
+                baseline_rollback_count = 0
             meta = self._codex_index.get(key, refresh=False)
             if (
                 canonical_id is not None
@@ -6900,8 +6893,16 @@ class App:
                 and canonical_id not in self._codex_lineage_ids(key)
             ):
                 canonical_id = None
-                rollout_proven = False
-                baseline_count = 0
+                baseline_rollback_count = 0
+            if canonical_id is not None and raw_rollback_count is None:
+                # Released bindings predate the explicit rollback baseline.
+                # Seed it from that exact indexed generation so inherited old
+                # rollback records cannot authorize a later ordinary child.
+                canonical_meta = self._codex_index.get(
+                    canonical_id, refresh=False)
+                if canonical_meta is not None:
+                    baseline_rollback_count = (
+                        canonical_meta.codex_rollback_count)
             if (meta is not None
                     and self._path_key(meta.project.real_path)
                     != self._path_key(cwd)):
@@ -6958,8 +6959,7 @@ class App:
                     status="busy",
                     session_type=session_type,
                     codex_canonical_session_id=canonical_id,
-                    codex_rollout_proven_in_pane=rollout_proven,
-                    codex_baseline_message_count=baseline_count,
+                    codex_baseline_rollback_count=baseline_rollback_count,
                 )
             meta = self._codex_representative(key) or meta
         else:
@@ -6976,10 +6976,8 @@ class App:
             session_type=session_type,
             codex_canonical_session_id=(
                 canonical_id if session_type == "codex" else None),
-            codex_rollout_proven_in_pane=(
-                rollout_proven if session_type == "codex" else False),
-            codex_baseline_message_count=(
-                baseline_count if session_type == "codex" else 0),
+            codex_baseline_rollback_count=(
+                baseline_rollback_count if session_type == "codex" else 0),
         )
 
     def _running_binding_data(
@@ -7020,10 +7018,8 @@ class App:
             if running.codex_canonical_session_id is not None:
                 data["codex_canonical_session_id"] = (
                     running.codex_canonical_session_id)
-                data["codex_rollout_proven_in_pane"] = (
-                    running.codex_rollout_proven_in_pane)
-                data["codex_baseline_message_count"] = (
-                    running.codex_baseline_message_count)
+                data["codex_baseline_rollback_count"] = (
+                    running.codex_baseline_rollback_count)
         return data
 
     def _stamp_running(self, running: _Running) -> bool:
@@ -7502,9 +7498,8 @@ class App:
                 ):
                     exact = self._codex_exact_meta(marker.session_id)
                     running.codex_canonical_session_id = marker.session_id
-                    running.codex_rollout_proven_in_pane = True
-                    running.codex_baseline_message_count = (
-                        exact.message_count if exact is not None else 0)
+                    running.codex_baseline_rollback_count = (
+                        exact.codex_rollback_count if exact is not None else 0)
             if running is None:
                 pre_launch_ids: frozenset[str] = frozenset()
                 pre_launch_complete = False
@@ -9207,14 +9202,11 @@ class App:
         the same terminal pane after a rewind. Its abandoned suffix can remain
         in raw tmux scrollback even though the canonical JSONL is correct.
 
-        A direct child is not sufficient evidence: Codex may also create one
-        while bootstrapping an ordinary ``resume``. Explicit-resume generations
-        therefore begin unproved. A child becomes a confirmed rewind only when
-        its parent was born/adopted in this pane generation or gained real
-        conversation messages after Railmux baselined it. An unproved first
-        child is adopted as the resume bootstrap generation without resetting
-        the pane or changing raw history format; descendants of that exact open
-        child can subsequently be confirmed normally.
+        Parent/child shape is not rewind evidence: Codex uses the same shape
+        for ordinary continuation, context compaction, and resume bootstrap.
+        A child becomes canonical only when the provider's explicit
+        ``thread_rolled_back`` count advanced after Railmux baselined its
+        parent.  Missing or ambiguous evidence keeps raw pane history.
         """
         current_id = meta.session_id
         previous_id = running.codex_canonical_session_id
@@ -9227,25 +9219,17 @@ class App:
             ):
                 # The first coherent index generation may arrive after Codex
                 # has already published its ordinary resume-bootstrap child.
-                # Adopt that exact descendant directly; it is now the proved
-                # generation for any later branch transition.
+                # Adopt only that exact open descendant as a raw baseline.
                 if not self._codex_rollout_is_exact_open(
                     running, meta, server, codex_rollout_probes
                 ):
                     return
-                running.codex_rollout_proven_in_pane = True
             running.codex_canonical_session_id = current_id
-            running.codex_baseline_message_count = meta.message_count
+            running.codex_baseline_rollback_count = meta.codex_rollback_count
             self._stamp_codex_history_state(running, meta)
             self._stamp_running(running)
             return
         if current_id == previous_id:
-            if (
-                not running.codex_rollout_proven_in_pane
-                and meta.message_count > running.codex_baseline_message_count
-            ):
-                running.codex_rollout_proven_in_pane = True
-                self._stamp_running(running)
             if not running.codex_history_generation_stamped:
                 self._stamp_codex_history_state(running, meta)
             return
@@ -9259,22 +9243,19 @@ class App:
             return
 
         previous_meta = self._codex_exact_meta(previous_id)
-        parent_gained_conversation = bool(
-            previous_meta is not None
-            and previous_meta.message_count
-            > running.codex_baseline_message_count
-        )
-        if not (
-            running.codex_rollout_proven_in_pane
-            or parent_gained_conversation
-        ):
-            # Ordinary Codex resume bootstrap: the direct child is exact and
-            # open in this pane, but the dormant parent never participated in
-            # this process generation. Adopt it as the new raw-history baseline
-            # and deliberately overwrite any released v1 canonical marker.
+        rollback_count = max(
+            meta.codex_rollback_count,
+            (
+                previous_meta.codex_rollback_count
+                if previous_meta is not None else 0
+            ),
+        )
+        if rollback_count <= running.codex_baseline_rollback_count:
+            # Ordinary continuation/compaction/resume: adopt the exact open
+            # child as a new raw-history baseline. This also overwrites any
+            # released v1/v2 marker that could have misclassified the pane.
             running.codex_canonical_session_id = current_id
-            running.codex_baseline_message_count = meta.message_count
-            running.codex_rollout_proven_in_pane = True
+            running.codex_baseline_rollback_count = rollback_count
             self._stamp_codex_history_state(running, meta)
             self._stamp_running(running)
             return
@@ -9287,8 +9268,7 @@ class App:
         if self._codex_real_pane_identity(running) is None:
             return
         running.codex_canonical_session_id = current_id
-        running.codex_baseline_message_count = meta.message_count
-        running.codex_rollout_proven_in_pane = True
+        running.codex_baseline_rollback_count = rollback_count
         self._stamp_codex_history_state(running, meta, canonical=True)
         self._stamp_running(running)
 
@@ -9332,10 +9312,10 @@ class App:
         """Publish Preview source plus the SSH history-source cache epoch.
 
         A plain UUID keeps managed SSH history on raw pane capture. Only a
-        confirmed rewind transition writes ``canonical-v2:<uuid>`` and permits
-        a transcript projection. Preserve that exact v2 marker across app
-        restarts; the released over-broad ``canonical:<uuid>`` marker is
-        intentionally replaced with a plain UUID.
+        provider-confirmed rewind writes ``canonical-v3:<uuid>`` and permits a
+        transcript projection. Preserve only that v3 marker across app
+        restarts; released heuristic v1/v2 markers are intentionally replaced
+        with a plain UUID.
         """
         if running.is_legacy:
             return
@@ -9373,8 +9353,6 @@ class App:
             marker == canonical_generation
             for marker in existing_generations.values()
         )
-        if effective_canonical:
-            running.codex_rollout_proven_in_pane = True
         desired_generation = (
             canonical_generation if effective_canonical else meta.session_id)
         generation_results = [
@@ -9588,8 +9566,7 @@ class App:
                 # Placeholder exclusion plus exact rollout correlation proves
                 # this generation was born in the pane we launched.
                 r.codex_canonical_session_id = candidate.session_id
-                r.codex_rollout_proven_in_pane = True
-                r.codex_baseline_message_count = candidate.message_count
+                r.codex_baseline_rollback_count = candidate.codex_rollback_count
             self._running[candidate.session_id] = r
             self._stamp_running(r)
             # A new provider session has no UUID to reserve before launch.