fix(prime): preserve turns through startup and restart snapshots

[rynfar]

Prime turns could fail during Python startup or immediately after restart. Pylon rejected attributed setWorkingMessage updates, and a fast completed prompt could put both the submitted user message and its answer in the authoritative snapshot before their message events arrived.

Recognize working-message progress and clears through the existing status presentation. Recover the exact submitted prompt plus one terminal answer only under the same delivered, completed lifecycle, verified replay and current proof generation. Retain prompt/image matching, transcript overlap, no queued inputs, no streaming message and no unfinished tool calls. Malformed attribution, altered history and unproved ownership still fail closed.

The signed-artifact acceptance proof also executes and consumes a real background-command result without a redundant completion notice or extra model turn, retaining instance isolation and reconnect checks.

Validation: 339 focused tests passed, including adversarial completed-snapshot cases. Targeted lint and server typecheck passed. The native two-instance proof and managed install/update/rollback proof passed against independently verified immutable preview pylon-build-g3694cfef31d2-r2. The complete sequential local graduation suite subsequently passed all 33 tests with zero skips, including both restart modes. Protected graduation runs at https://github.com/pylon-code/pylon/actions/runs/35371860196/attempts/2 and remains required before stable approval.

Existing wire presentations serve web, desktop and mobile; no contract or migration change. Scope is Prime native mode. Other providers are unaffected. Final signed promotion and installed Nightly app/runtime delivery remain tracked in #557.

Implemented and reviewed with GPT-6 Astra in Pylon/Codex.

Protected final evidence: graduation attempt 2 passed 33/33 with zero skips; exact artifact ID 10559453910. Prime stable sequence 3 (pylon-stable-000003-g3694cfef31d2-r2) was published from these same verified bytes. Installed Electron required the separate digest compatibility fix in #641.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 18, 2026 4:27pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	+19 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−11 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.8 KiB	+30 B (+0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	0 B (0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+1 B (+0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: a85762e · PR result: 1ff50ce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.