Preserve reconciled resume rows in fallback recording

[ipo]

Outcome

Fix only the residual fallback/app-server recorder path that can discard a valid DB-only row when rollout JSONL is missing, stale, or incomplete. Preserve upstream main resume loading.

Governing evidence

Closed issue #20 and commits 3917342cb3 and c02a63b1f4; upstream 0.153.4 main TUI resume loading is already DB-first.

The issue and this evidence define required behavior. Port functional intent onto the current upstream architecture; patch identity is irrelevant.

Non-goals

Do not reintroduce the custom DB-first picker patch or change resume sorting/presentation.

Acceptance criteria and verification

Integration tests cover valid DB-only rows, valid JSONL, missing/malformed/stale JSONL, reconciliation without duplication, and app-server recording behavior. Run the smallest focused just test -p <crate> checks that cover the changed crates under the repository reduced-priority wrapper. Regenerate schemas or snapshots only when this ticket changes them. For a large Rust change run scoped just fix -p <crate>, then just fmt; do not rerun tests after fix/format. Remove disposable build artifacts afterward.

Likely areas

Rollout listing/reconciliation and app-server fallback recording tests.

Dependencies

Fully blocked by #81.

Do not begin ticket-owned mutation until every dependency is integrated; their landed contracts are authoritative.

Blocks #104.

Delivery

The accepted result must integrate as exactly one issue-linked commit with subject fix(rollout): preserve reconciled resume rows. Tests, snapshots, generated files, and fixes belong in that commit; adaptation or test-only follow-up commits are not permitted.

Agent routing

agent_level: 4

Agent signature

gpt-5.6-sol@high:01a07441-98af-75c1-9950-8af46deb76de

[ipo]

Implementation started in ticket/100-resume-rows from 1b41e227cd.

[ipo]

IMPLEMENTATION_READY

Implemented and pushed as cc8dd90a90 on ticket/100-resume-rows.

• Metadata-filtered scan-and-repair listings now return the reconciled SQLite page for all supported sort keys, preserving valid DB-only rows omitted by bounded JSONL scanning without merging or duplicating rows.
• Existing filesystem fallback remains unchanged for unavailable/erroring SQLite, and upstream DB-first picker/sorting behavior was not modified.
• Added rollout coverage for a valid row whose preview is beyond the bounded head scan; the existing focused set also covers missing JSONL retention and stale metadata reconciliation.
• Added public app-server thread/list coverage proving a valid paginated SQLite row survives malformed JSONL reconciliation unchanged and is returned once.

Checks:

• just test -p codex-rollout list_threads_: 10 passed, 0 failed.
• just test -p codex-app-server thread_list_scan_and_repair_preserves_db_row_for_malformed_rollout: 1 passed, 0 failed (45.6s under the reduced-priority scope).
• just fmt: passed.
• git diff --check: passed before commit.
• No schemas or snapshots changed; disposable build artifacts removed.

Caveat: the app-server regression uses a 60-second initialization timeout because reduced-priority cold initialization exceeded the suite helper default locally; the tested request path itself passed without retries after that harness-only adjustment.

Agent: gpt-5.6-sol@medium:01a0752e-2e20-7a01-baa6-252c3b9f54ab

[ipo]

ACCEPT

Candidate cc8dd90a9060f39a8d08230e4024282a62cfeadc satisfies issue #100 against base 1b41e227cdc405448014ab0c3cc9d9e978c0d23d.

Evidence:

• Independently read Preserve reconciled resume rows in fallback recording #100, closed TUI: render /resume from the State DB first and show estimated runtime #20, and historical commits 3917342cb3 / c02a63b1f4; the candidate ports the historical reconciled-DB-page behavior onto 0.153.4's current section / project_id listing signature.
• Complete diff is one issue-linked commit and only changes rollout/src/recorder.rs plus rollout/app-server regressions. No TUI picker, protocol, schema, snapshot, sorting-presentation, or custom DB-first picker code changed. The base's relevant local resume picker is already upstream DB-first.
• Static path audit: scan-and-repair warms/reconciles filesystem hits, fully reconciles DB-only metadata-filter hits, then re-queries and returns one SQLite page for every supported sort key. It does not merge filesystem and DB pages, so a row cannot be duplicated. DB-unavailable/error paths retain the pre-existing filesystem fallback.
• Existing and new rollout tests jointly exercise valid JSONL repair, a valid SQLite row omitted by the bounded JSONL head scan, physically missing JSONL metadata retention, stale cwd/search reconciliation, DB-only bypass, metadata overlay, pagination, and single-row/no-duplication outcomes.
• The public app-server regression seeds a paginated SQLite row beside malformed JSONL, requests thread/list with scan-and-repair, and proves the row is returned exactly once with its stored metadata unchanged.
• Independent reduced-priority checks in a disposable target: just test -p codex-rollout list_threads_ — 10 passed; just test -p codex-app-server thread_list_scan_and_repair_preserves_db_row_for_malformed_rollout — 1 passed. git diff --check passed. The 19 GB disposable target was removed and the ticket worktree is clean.
• Handoff commit, commands, outcomes, caveat, and artifact-cleanup claim match the inspected tree and independent results.

Agent: gpt-5.6-sol@high:e676fe83-c803-45df-8429-003de6f4e868

[ipo]

Integrated as cc8dd90a9060f39a8d08230e4024282a62cfeadc on patch-stack/rust-v0.153.4. Ten rollout reconciliation cases and the app-server malformed-rollout regression passed independently. The diff is limited to fallback recording/reconciliation and does not reintroduce custom TUI resume behavior.