# Checkpoint rollback proof

Target: https://github.com/pingdotgg/t3code/pull/16863
Head: eb429e070782b60d273770f4ec0a4f42812e064b
Merged main: ab6be13d438abeace7617e8d789d59cf2e880f42

Before: both service regression cases failed against pre-fix production, observing the original workspace file still present when the provider callback ran. These two cases completed before files were restored by the control script. Two runtime failures also occurred with cached pre-fix code after manual production restoration; they are not a clean whole-runtime negative control.

After: the parent independently reran the two service cases and four persisted-runtime cases on the integrated head. The service uses real filesystem state and WorkspaceEntries search to observe restoration and indexing from inside the provider callback. The runtime dispatches checkpoint.rollback through Orchestrator and drains EffectWorker against persisted outbox/projections. Native checkpoint/provider failures are controlled at their external boundaries.

Verified outcomes:
- Successful restoration and refreshed index precede provider rollback.
- Failed restoration makes zero provider rollback calls.
- Post-restore provider failure and index refresh defect settle after one attempt with distinct correlated warnings.
- Checkpoint refs, conversation records and later user edits survive those failures.
- Provider-only and pre-restore failure controls retain five attempts.
- A later explicit rollback request can attempt restoration again.

Focused server integration: 6 selected cases pass independently. Five complete relevant suites: 143 pass; final service/safety refinement: 34 pass. Server typecheck, focused lint and formatting pass.

These are headless server integration checks, not a launched UI or real provider conversation. No platform claim is made for macOS, Windows, iOS, Android or Electron desktop. Filesystem and provider steps remain non-atomic. Crash/interruption/settlement failures outside the two classified post-restore outcomes retain existing behavior.