railmux 0.4.0.dev21__tar.gz → 0.4.0.dev23__tar.gz

{railmux-0.4.0.dev21/src/railmux.egg-info → railmux-0.4.0.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: railmux
-Version: 0.4.0.dev21
+Version: 0.4.0.dev23
 Summary: Terminal UI to navigate, resume, and start Claude Code and Codex sessions
 Author-email: Rightglow <zhang.taian@foxmail.com>
 License-Expression: MIT

railmux-0.4.0.dev23/src/railmux/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.4.0.dev23"

{railmux-0.4.0.dev21 → railmux-0.4.0.dev23}/src/railmux/codex_index.py

@@ -37,7 +37,7 @@ _TOOL_BLOCK_AGE_S = 120
 
 
 FileSignature = tuple[int, int]  # (mtime_ns, size)
-_PERSISTENT_CACHE_SCHEMA = 1
+_PERSISTENT_CACHE_SCHEMA = 2
 _PERSISTENT_CACHE_MAX_BYTES = 16 * 1024 * 1024
 _PERSISTENT_CACHE_MAX_RECORDS = 100_000
 
@@ -177,6 +177,7 @@ def _cache_session(meta: SessionMeta) -> dict:
         "pending_tool": meta.pending_tool,
         "attention": _cache_attention(meta.attention),
         "forked_from_id": meta.forked_from_id,
+        "codex_rollback_count": meta.codex_rollback_count,
     }
 
 
@@ -185,6 +186,7 @@ def _decode_cache_session(path: Path, raw: object) -> SessionMeta:
         "session_id", "cwd", "project_key", "title", "message_count", "token_total",
         "last_mtime", "size_bytes", "git_branch", "last_user_message",
         "status", "pending_tool", "attention", "forked_from_id",
+        "codex_rollback_count",
     })
     if not isinstance(raw, dict) or frozenset(raw) != keys:
         raise ValueError("invalid cached session")
@@ -213,7 +215,12 @@ def _decode_cache_session(path: Path, raw: object) -> SessionMeta:
         for value, limit, nullable in strings
     ):
         raise ValueError("invalid cached session string")
-    counts = (raw["message_count"], raw["token_total"], raw["size_bytes"])
+    counts = (
+        raw["message_count"],
+        raw["token_total"],
+        raw["size_bytes"],
+        raw["codex_rollback_count"],
+    )
     if any(
         not isinstance(value, int)
         or isinstance(value, bool)
@@ -262,6 +269,7 @@ def _decode_cache_session(path: Path, raw: object) -> SessionMeta:
         session_type="codex",
         attention=_decode_cache_attention(raw["attention"]),
         forked_from_id=forked_from_id,
+        codex_rollback_count=raw["codex_rollback_count"],
     )
 
 
@@ -1049,6 +1057,7 @@ def _parse_codex_session(
     # -- scan remaining lines for messages, events -------------------
     title: str | None = None
     message_count = 0
+    rollback_count = 0
     token_total = 0
     first_user_message: str | None = None
     last_user_message: str | None = None
@@ -1166,6 +1175,7 @@ def _parse_codex_session(
                     attention = _codex_abort_attention(rec, event_order)
                     current_turn_had_error = True
             elif et == "thread_rolled_back":
+                rollback_count += 1
                 # task_complete / turn_aborted / thread_rolled_back: the turn is
                 # over and any dangling tool calls are dead — clear them so an
                 # aborted/rolled-back session never reads as busy/blocked.
@@ -1243,6 +1253,7 @@ def _parse_codex_session(
         session_type="codex",
         attention=attention,
         forked_from_id=forked_from_id,
+        codex_rollback_count=rollback_count,
     )
     if hidden_subagent:
         return HiddenCodexStatus(

{railmux-0.4.0.dev21 → railmux-0.4.0.dev23}/src/railmux/fast_display_client.py

@@ -281,6 +281,7 @@ class RemoteHello:
     config_status: str = "valid"
     tmux_configured: bool = False
     config_protocol: int = 0
+    platform: str = "posix"
 
 
 @dataclass(frozen=True)
@@ -296,6 +297,11 @@ class RemoteStartKind(Enum):
     TIMEOUT = "timeout"
 
 
+class RemoteLaunchMode(Enum):
+    POSIX = "posix"
+    DIRECT = "direct"
+
+
 class RemoteAttachKind(Enum):
     ACCEPTED = "accepted"
     BUSY = "busy"
@@ -369,6 +375,7 @@ def parse_remote_hello(line: bytes) -> RemoteHello:
     config_status = value.get("config_status", "valid")
     tmux_configured = value.get("tmux_configured", False)
     config_protocol = value.get("config_protocol", 0)
+    platform = value.get("platform", "posix")
     if (
         not isinstance(version, str)
         or not version
@@ -383,6 +390,7 @@ def parse_remote_hello(line: bytes) -> RemoteHello:
         or not isinstance(config_protocol, int)
         or isinstance(config_protocol, bool)
         or not 0 <= config_protocol <= 65535
+        or platform not in {"posix", "windows-msys2"}
     ):
         raise ValueError("invalid Railmux remote hello")
     try:
@@ -397,6 +405,7 @@ def parse_remote_hello(line: bytes) -> RemoteHello:
         config_status,
         tmux_configured,
         config_protocol,
+        platform,
     )
 
 
@@ -1540,12 +1549,18 @@ def _remote_launch_command(server_args: Sequence[str]) -> str:
     return "; ".join(branches)
 
 
+def _remote_direct_launch_command(server_args: Sequence[str]) -> str:
+    """Build a shell-neutral command accepted by Windows OpenSSH PowerShell."""
+    return shlex.join(["railmux", *server_args])
+
+
 def build_remote_command_argv(
     destination: str,
     *,
     remote_args: Sequence[str],
     ssh_args: Sequence[str],
     force_tty: bool = False,
+    launch_mode: RemoteLaunchMode = RemoteLaunchMode.POSIX,
 ) -> list[str]:
     """Build SSH argv through the shared remote Railmux discovery ladder."""
     return [
@@ -1556,7 +1571,11 @@ def build_remote_command_argv(
         # user arguments so a copied -t/-T flag cannot invert the transport.
         "-tt" if force_tty else "-T",
         destination,
-        _remote_launch_command(remote_args),
+        (
+            _remote_direct_launch_command(remote_args)
+            if launch_mode is RemoteLaunchMode.DIRECT
+            else _remote_launch_command(remote_args)
+        ),
     ]
 
 
@@ -1570,6 +1589,7 @@ def build_ssh_argv(
     ssh_args: Sequence[str],
     replace_existing_client: bool = False,
     existing_session_only: bool = False,
+    launch_mode: RemoteLaunchMode = RemoteLaunchMode.POSIX,
 ) -> list[str]:
     server_args = _remote_server_args(
         session=session,
@@ -1592,6 +1612,7 @@ def build_ssh_argv(
             "-o",
             "ServerAliveCountMax=3",
         ),
+        launch_mode=launch_mode,
     )
 
 
@@ -1757,6 +1778,43 @@ def remote_install_help(destination: str, version: str) -> str:
     )
 
 
+def remote_windows_install_help(destination: str, version: str) -> str:
+    return (
+        f"Update the user-level Windows preview on {destination} from "
+        "PowerShell, then retry:\n"
+        f"  py -m pip install --upgrade railmux=={version}\n"
+        "  railmux runtime install --yes\n"
+        "The runtime command installs only the matching Railmux app layer and "
+        "reuses a verified managed MSYS2 base when its pinned version is "
+        "unchanged. It does not modify Codex or Claude session files. If 'py' "
+        "is unavailable, use the same Windows Python executable that installed "
+        "the Railmux command."
+    )
+
+
+def _remote_launch_mode(args: argparse.Namespace) -> RemoteLaunchMode:
+    selected = getattr(args, "_selected_remote_launch_mode", None)
+    if isinstance(selected, RemoteLaunchMode):
+        return selected
+    if getattr(args, "remote_platform", "auto") == "windows":
+        return RemoteLaunchMode.DIRECT
+    return RemoteLaunchMode.POSIX
+
+
+def _remember_remote_launch_mode(
+    args: argparse.Namespace, mode: RemoteLaunchMode
+) -> None:
+    args._selected_remote_launch_mode = mode
+
+
+def _remote_uses_windows_runtime(
+    args: argparse.Namespace, hello: RemoteHello | None = None
+) -> bool:
+    return _remote_launch_mode(args) is RemoteLaunchMode.DIRECT or (
+        hello is not None and hello.platform == "windows-msys2"
+    )
+
+
 def remote_tmux_help(destination: str) -> str:
     return (
         f"tmux is not installed or not on PATH on {destination}. Install it "
@@ -1989,6 +2047,7 @@ def _reconnect_remote_attach(
         ssh_args=ssh_args,
         replace_existing_client=replace_existing_client,
         existing_session_only=existing_session_only,
+        launch_mode=_remote_launch_mode(args),
     )
     process = (
         _spawn_remote(argv, suppress_stderr=True)
@@ -2215,6 +2274,7 @@ def prepare_remote_process(
         if before_interaction is not None:
             before_interaction()
 
+    launch_mode = _remote_launch_mode(args)
     argv = build_ssh_argv(
         args.destination,
         session=args.session,
@@ -2222,11 +2282,62 @@ def prepare_remote_process(
         height=current_size.lines,
         fps=args.fps,
         ssh_args=args.ssh_arg,
+        launch_mode=launch_mode,
     )
     if on_stage is not None:
         on_stage("Connecting to remote host…")
     process = _spawn_remote(argv)
     startup = await_remote_startup(process)
+    if (
+        getattr(args, "remote_platform", "auto") == "auto"
+        and launch_mode is RemoteLaunchMode.POSIX
+        and startup.kind is RemoteStartKind.FAILED
+        and startup.returncode != 255
+    ):
+        _stop_unstarted_remote(process)
+        direct_argv = build_ssh_argv(
+            args.destination,
+            session=args.session,
+            width=current_size.columns,
+            height=current_size.lines,
+            fps=args.fps,
+            ssh_args=args.ssh_arg,
+            launch_mode=RemoteLaunchMode.DIRECT,
+        )
+        process = _spawn_remote(direct_argv)
+        startup = await_remote_startup(process)
+        if startup.kind is RemoteStartKind.HELLO:
+            launch_mode = RemoteLaunchMode.DIRECT
+            _remember_remote_launch_mode(args, launch_mode)
+        else:
+            _stop_unstarted_remote(process)
+            if startup.returncode == 255:
+                raise ProbeError("ssh could not connect to the remote host")
+            if startup.kind is RemoteStartKind.TIMEOUT:
+                raise ProbeError(
+                    "timed out while checking the remote host's direct Railmux launcher"
+                )
+            raise ProbeError(
+                "the remote shell did not accept the POSIX discovery command, "
+                "and a direct Railmux launch did not complete. If this is a "
+                "Windows preview host:\n"
+                f"{remote_windows_install_help(args.destination, __version__)}"
+            )
+    elif startup.kind is RemoteStartKind.HELLO:
+        _remember_remote_launch_mode(args, launch_mode)
+
+    if (
+        getattr(args, "remote_platform", "auto") == "windows"
+        and startup.kind is not RemoteStartKind.HELLO
+    ):
+        _stop_unstarted_remote(process)
+        if startup.returncode == 255:
+            raise ProbeError("ssh could not connect to the remote host")
+        if startup.kind is RemoteStartKind.TIMEOUT:
+            raise ProbeError(
+                "timed out waiting for the Windows Railmux compatibility handshake"
+            )
+        raise ProbeError(remote_windows_install_help(args.destination, __version__))
     install_version = __version__
     install_reason: str | None = None
     if startup.kind is RemoteStartKind.MISSING:
@@ -2281,6 +2392,12 @@ def prepare_remote_process(
             if decision.action == "prompt" and decision.prompt == "remote_install":
                 assert decision.reason is not None
                 assert decision.install_version is not None
+                if _remote_uses_windows_runtime(args, hello):
+                    _stop_unstarted_remote(process)
+                    raise ProbeError(
+                        f"{decision.reason}\n"
+                        f"{remote_windows_install_help(args.destination, decision.install_version)}"
+                    )
                 consents["remote_install"] = _confirm_remote_install(
                     args,
                     decision.reason,
@@ -2295,9 +2412,14 @@ def prepare_remote_process(
                 _stop_unstarted_remote(process)
                 message = decision.reason or "incompatible remote Railmux"
                 if decision.install_version is not None:
+                    install_help = (
+                        remote_windows_install_help
+                        if _remote_uses_windows_runtime(args, hello)
+                        else remote_install_help
+                    )
                     message = (
                         f"{message}\n"
-                        f"{remote_install_help(args.destination, decision.install_version)}"
+                        f"{install_help(args.destination, decision.install_version)}"
                     )
                 raise ProbeError(message)
             if decision.warning is not None:
@@ -2320,6 +2442,14 @@ def prepare_remote_process(
             raise AssertionError(f"unknown compatibility action: {decision.action}")
 
     assert install_reason is not None
+    if _remote_uses_windows_runtime(
+        args, startup.hello if startup.kind is RemoteStartKind.HELLO else None
+    ):
+        _stop_unstarted_remote(process)
+        raise ProbeError(
+            f"{install_reason}\n"
+            f"{remote_windows_install_help(args.destination, install_version)}"
+        )
     if startup.kind is not RemoteStartKind.HELLO and not _confirm_remote_install(
         args,
         install_reason,
@@ -2430,6 +2560,16 @@ def parse_args(argv: Optional[Sequence[str]] = None) -> argparse.Namespace:
         default=20.0,
         help="maximum coalesced display update rate, 1-60 (default: 20)",
     )
+    parser.add_argument(
+        "--remote-platform",
+        choices=("auto", "posix", "windows"),
+        default="auto",
+        help=(
+            "remote shell family: auto tries POSIX discovery then direct "
+            "Windows launch; windows avoids the failed POSIX probe and an "
+            "extra password prompt (default: auto)"
+        ),
+    )
     parser.add_argument(
         "--no-mouse",
         action="store_true",

{railmux-0.4.0.dev21 → railmux-0.4.0.dev23}/src/railmux/fast_display_server.py

@@ -248,6 +248,11 @@ def _emit_remote_hello(
             "config_status": config_status,
             "tmux_configured": tmux_configured,
             "config_protocol": REMOTE_CONFIG_PROTOCOL,
+            "platform": (
+                "windows-msys2"
+                if os.environ.get("RAILMUX_WINDOWS_RUNTIME") == "msys2"
+                else "posix"
+            ),
             "version": __version__,
         },
         separators=(",", ":"),

{railmux-0.4.0.dev21 → railmux-0.4.0.dev23}/src/railmux/models.py

@@ -70,11 +70,17 @@ class SessionMeta:
     # intentionally independent from ``status`` (conversation activity) and
     # from tmux/process liveness, which is owned by App's running registry.
     attention: AttentionState | None = None
-    # Codex creates a new rollout UUID when a conversation is rewound/forked.
-    # The parent link lets the Codex index present that chain as one logical
-    # conversation without changing the provider-owned UUID used for resume.
+    # Codex creates a new rollout UUID when a conversation is rewound/forked,
+    # resumed, continued, or compacted. The parent link lets the Codex index
+    # present that chain as one logical conversation without treating the link
+    # itself as proof of why the provider created it.
     # Always None for Claude sessions and older Codex rollouts.
     forked_from_id: str | None = None
+    # Number of provider-emitted ``thread_rolled_back`` lifecycle records in
+    # this Codex rollout.  Child rollouts can be ordinary continuation or
+    # compaction checkpoints, so the parent link alone is not rewind evidence.
+    # Always zero for Claude sessions and Codex versions without this signal.
+    codex_rollback_count: int = 0
     # A Railmux lease observed in the same shared provider history root. This
     # is a read-time UI overlay, never provider transcript metadata.
     remote_owner: str | None = None

{railmux-0.4.0.dev21 → railmux-0.4.0.dev23}/src/railmux/tmux_ctl.py

@@ -1848,13 +1848,16 @@ RAILMUX_HISTORY_GENERATION_OPTION = "@railmux_history_generation_v1"
 # A confirmed branch transition prefixes the opaque SSH history cache epoch.
 # Plain generations use native pane history; only this explicit marker permits
 # the canonical transcript fallback that removes an abandoned rewind suffix.
-# Only the evidence-gated v2 marker authorizes transcript-backed Codex
-# scrolling.  The released v1 marker treated every live direct child rollout
-# as a rewind, but Codex can also create that shape while bootstrapping an
-# ordinary resume.  Keeping the prefix versioned makes existing over-broad
-# markers fail back to raw pane history on upgrade.
-RAILMUX_CANONICAL_HISTORY_PREFIX = "canonical-v2:"
-RAILMUX_LEGACY_CANONICAL_HISTORY_PREFIX = "canonical:"
+# Only the provider-rollback-gated v3 marker authorizes transcript-backed Codex
+# scrolling.  Released v1/v2 markers used rollout-shape heuristics, but Codex
+# also creates identical parent/child rollouts for ordinary continuation and
+# compaction.  Versioning makes both over-broad markers fail back to raw pane
+# history on upgrade without touching provider files.
+RAILMUX_CANONICAL_HISTORY_PREFIX = "canonical-v3:"
+RAILMUX_LEGACY_CANONICAL_HISTORY_PREFIXES = (
+    "canonical:",
+    "canonical-v2:",
+)
 # tmux names function keys only through F12. Private restore routes use
 # canonical xterm sequences in literal mode, so they cannot be confused with
 # user input forwarded to an agent pane.

{railmux-0.4.0.dev21 → railmux-0.4.0.dev23}/src/railmux/ui/app.py

@@ -389,11 +389,10 @@ class _Running:
     # provider generation lets the refresh path discard only that stale
     # presentation cache when the exact live writer advances to its child.
     codex_canonical_session_id: str | None = None
-    # A direct rollout child is a rewind only after its parent was proved to
-    # belong to this provider process generation.  An explicit Codex resume
-    # may create a child rollout during bootstrap without rewinding anything.
-    codex_rollout_proven_in_pane: bool = False
-    codex_baseline_message_count: int = 0
+    # Provider-emitted rollback count when the current rollout was adopted.
+    # Parent/child rollout shape is not sufficient: Codex also forks ordinary
+    # continuation and compaction checkpoints without a user rewind.
+    codex_baseline_rollback_count: int = 0
     codex_history_generation_stamped: bool = False
     lease_session_ids: frozenset[str] = frozenset()
     lease_warning: str | None = None
@@ -6855,8 +6854,7 @@ class App:
             )
 
         canonical_id = None
-        rollout_proven = False
-        baseline_count = 0
+        baseline_rollback_count = 0
         if session_type == "codex":
             canonical_id = (
                 raw.get("codex_canonical_session_id")
@@ -6875,24 +6873,19 @@ class App:
                     canonical_uuid = None
                 if canonical_uuid != canonical_id.lower():
                     canonical_id = None
-            rollout_proven = (
-                raw.get("codex_rollout_proven_in_pane", False)
-                if trust_codex_history_state else False
-            )
-            baseline_count = (
-                raw.get("codex_baseline_message_count", 0)
-                if trust_codex_history_state else 0
+            raw_rollback_count = (
+                raw.get("codex_baseline_rollback_count")
+                if trust_codex_history_state else None
             )
-            if (
-                not isinstance(rollout_proven, bool)
-                or not isinstance(baseline_count, int)
-                or isinstance(baseline_count, bool)
-                or baseline_count < 0
+            if raw_rollback_count is not None and (
+                not isinstance(raw_rollback_count, int)
+                or isinstance(raw_rollback_count, bool)
+                or raw_rollback_count < 0
             ):
                 return None
+            baseline_rollback_count = raw_rollback_count or 0
             if canonical_id is None:
-                rollout_proven = False
-                baseline_count = 0
+                baseline_rollback_count = 0
             meta = self._codex_index.get(key, refresh=False)
             if (
                 canonical_id is not None
@@ -6900,8 +6893,16 @@ class App:
                 and canonical_id not in self._codex_lineage_ids(key)
             ):
                 canonical_id = None
-                rollout_proven = False
-                baseline_count = 0
+                baseline_rollback_count = 0
+            if canonical_id is not None and raw_rollback_count is None:
+                # Released bindings predate the explicit rollback baseline.
+                # Seed it from that exact indexed generation so inherited old
+                # rollback records cannot authorize a later ordinary child.
+                canonical_meta = self._codex_index.get(
+                    canonical_id, refresh=False)
+                if canonical_meta is not None:
+                    baseline_rollback_count = (
+                        canonical_meta.codex_rollback_count)
             if (meta is not None
                     and self._path_key(meta.project.real_path)
                     != self._path_key(cwd)):
@@ -6958,8 +6959,7 @@ class App:
                     status="busy",
                     session_type=session_type,
                     codex_canonical_session_id=canonical_id,
-                    codex_rollout_proven_in_pane=rollout_proven,
-                    codex_baseline_message_count=baseline_count,
+                    codex_baseline_rollback_count=baseline_rollback_count,
                 )
             meta = self._codex_representative(key) or meta
         else:
@@ -6976,10 +6976,8 @@ class App:
             session_type=session_type,
             codex_canonical_session_id=(
                 canonical_id if session_type == "codex" else None),
-            codex_rollout_proven_in_pane=(
-                rollout_proven if session_type == "codex" else False),
-            codex_baseline_message_count=(
-                baseline_count if session_type == "codex" else 0),
+            codex_baseline_rollback_count=(
+                baseline_rollback_count if session_type == "codex" else 0),
         )
 
     def _running_binding_data(
@@ -7020,10 +7018,8 @@ class App:
             if running.codex_canonical_session_id is not None:
                 data["codex_canonical_session_id"] = (
                     running.codex_canonical_session_id)
-                data["codex_rollout_proven_in_pane"] = (
-                    running.codex_rollout_proven_in_pane)
-                data["codex_baseline_message_count"] = (
-                    running.codex_baseline_message_count)
+                data["codex_baseline_rollback_count"] = (
+                    running.codex_baseline_rollback_count)
         return data
 
     def _stamp_running(self, running: _Running) -> bool:
@@ -7502,9 +7498,8 @@ class App:
                 ):
                     exact = self._codex_exact_meta(marker.session_id)
                     running.codex_canonical_session_id = marker.session_id
-                    running.codex_rollout_proven_in_pane = True
-                    running.codex_baseline_message_count = (
-                        exact.message_count if exact is not None else 0)
+                    running.codex_baseline_rollback_count = (
+                        exact.codex_rollback_count if exact is not None else 0)
             if running is None:
                 pre_launch_ids: frozenset[str] = frozenset()
                 pre_launch_complete = False
@@ -9207,14 +9202,11 @@ class App:
         the same terminal pane after a rewind. Its abandoned suffix can remain
         in raw tmux scrollback even though the canonical JSONL is correct.
 
-        A direct child is not sufficient evidence: Codex may also create one
-        while bootstrapping an ordinary ``resume``. Explicit-resume generations
-        therefore begin unproved. A child becomes a confirmed rewind only when
-        its parent was born/adopted in this pane generation or gained real
-        conversation messages after Railmux baselined it. An unproved first
-        child is adopted as the resume bootstrap generation without resetting
-        the pane or changing raw history format; descendants of that exact open
-        child can subsequently be confirmed normally.
+        Parent/child shape is not rewind evidence: Codex uses the same shape
+        for ordinary continuation, context compaction, and resume bootstrap.
+        A child becomes canonical only when the provider's explicit
+        ``thread_rolled_back`` count advanced after Railmux baselined its
+        parent.  Missing or ambiguous evidence keeps raw pane history.
         """
         current_id = meta.session_id
         previous_id = running.codex_canonical_session_id
@@ -9227,25 +9219,17 @@ class App:
             ):
                 # The first coherent index generation may arrive after Codex
                 # has already published its ordinary resume-bootstrap child.
-                # Adopt that exact descendant directly; it is now the proved
-                # generation for any later branch transition.
+                # Adopt only that exact open descendant as a raw baseline.
                 if not self._codex_rollout_is_exact_open(
                     running, meta, server, codex_rollout_probes
                 ):
                     return
-                running.codex_rollout_proven_in_pane = True
             running.codex_canonical_session_id = current_id
-            running.codex_baseline_message_count = meta.message_count
+            running.codex_baseline_rollback_count = meta.codex_rollback_count
             self._stamp_codex_history_state(running, meta)
             self._stamp_running(running)
             return
         if current_id == previous_id:
-            if (
-                not running.codex_rollout_proven_in_pane
-                and meta.message_count > running.codex_baseline_message_count
-            ):
-                running.codex_rollout_proven_in_pane = True
-                self._stamp_running(running)
             if not running.codex_history_generation_stamped:
                 self._stamp_codex_history_state(running, meta)
             return
@@ -9259,22 +9243,19 @@ class App:
             return
 
         previous_meta = self._codex_exact_meta(previous_id)
-        parent_gained_conversation = bool(
-            previous_meta is not None
-            and previous_meta.message_count
-            > running.codex_baseline_message_count
-        )
-        if not (
-            running.codex_rollout_proven_in_pane
-            or parent_gained_conversation
-        ):
-            # Ordinary Codex resume bootstrap: the direct child is exact and
-            # open in this pane, but the dormant parent never participated in
-            # this process generation. Adopt it as the new raw-history baseline
-            # and deliberately overwrite any released v1 canonical marker.
+        rollback_count = max(
+            meta.codex_rollback_count,
+            (
+                previous_meta.codex_rollback_count
+                if previous_meta is not None else 0
+            ),
+        )
+        if rollback_count <= running.codex_baseline_rollback_count:
+            # Ordinary continuation/compaction/resume: adopt the exact open
+            # child as a new raw-history baseline. This also overwrites any
+            # released v1/v2 marker that could have misclassified the pane.
             running.codex_canonical_session_id = current_id
-            running.codex_baseline_message_count = meta.message_count
-            running.codex_rollout_proven_in_pane = True
+            running.codex_baseline_rollback_count = rollback_count
             self._stamp_codex_history_state(running, meta)
             self._stamp_running(running)
             return
@@ -9287,8 +9268,7 @@ class App:
         if self._codex_real_pane_identity(running) is None:
             return
         running.codex_canonical_session_id = current_id
-        running.codex_baseline_message_count = meta.message_count
-        running.codex_rollout_proven_in_pane = True
+        running.codex_baseline_rollback_count = rollback_count
         self._stamp_codex_history_state(running, meta, canonical=True)
         self._stamp_running(running)
 
@@ -9332,10 +9312,10 @@ class App:
         """Publish Preview source plus the SSH history-source cache epoch.
 
         A plain UUID keeps managed SSH history on raw pane capture. Only a
-        confirmed rewind transition writes ``canonical-v2:<uuid>`` and permits
-        a transcript projection. Preserve that exact v2 marker across app
-        restarts; the released over-broad ``canonical:<uuid>`` marker is
-        intentionally replaced with a plain UUID.
+        provider-confirmed rewind writes ``canonical-v3:<uuid>`` and permits a
+        transcript projection. Preserve only that v3 marker across app
+        restarts; released heuristic v1/v2 markers are intentionally replaced
+        with a plain UUID.
         """
         if running.is_legacy:
             return
@@ -9373,8 +9353,6 @@ class App:
             marker == canonical_generation
             for marker in existing_generations.values()
         )
-        if effective_canonical:
-            running.codex_rollout_proven_in_pane = True
         desired_generation = (
             canonical_generation if effective_canonical else meta.session_id)
         generation_results = [
@@ -9588,8 +9566,7 @@ class App:
                 # Placeholder exclusion plus exact rollout correlation proves
                 # this generation was born in the pane we launched.
                 r.codex_canonical_session_id = candidate.session_id
-                r.codex_rollout_proven_in_pane = True
-                r.codex_baseline_message_count = candidate.message_count
+                r.codex_baseline_rollback_count = candidate.codex_rollback_count
             self._running[candidate.session_id] = r
             self._stamp_running(r)
             # A new provider session has no UUID to reserve before launch.