Rewind tracked files and fall back before the first token

Why: workspace writes had no checkpoint, and a 5xx before any output stopped the turn instead of trying the next configured model.
Evidence: GOWORK=off go test ./internal/runtime/ ./internal/runmgr/ ./internal/tools/ ./internal/settings/ ./internal/server/ ./internal/app/
Impact: models.chat.fallbacks defaults to empty, so existing runs keep their model. Rewind restores only tracked writes and appends a system note. Usage records the model that served.
Refs: feature/durable-rewind
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/server/rewind.go

@@ -0,0 +1,56 @@
+package server
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"agent-system-backend/internal/runmgr"
+)
+
+func (s *Server) listCheckpoints(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	owner := s.owner(r)
+	if _, err := s.st.GetConversation(owner, id); err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	messageID := r.URL.Query().Get("messageId")
+	plan, err := s.mgr.PlanRewind(owner, id, messageID)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"restored": plan.Restored, "skipped": plan.Skipped})
+}
+
+func (s *Server) rewindFiles(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	owner := s.owner(r)
+	if _, err := s.st.GetConversation(owner, id); err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	var req struct {
+		MessageID string `json:"messageId"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.MessageID == "" {
+		http.Error(w, "messageId required", http.StatusBadRequest)
+		return
+	}
+	if err := s.mgr.ClaimConversation(id); err != nil {
+		if errors.Is(err, runmgr.ErrConversationBusy) {
+			http.Error(w, "conversation busy", http.StatusConflict)
+			return
+		}
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	defer s.mgr.ReleaseConversation(id)
+	res, err := s.mgr.RewindFiles(owner, id, req.MessageID)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"restored": res.Restored, "skipped": res.Skipped})
+}

internal/server/server.go

@@ -165,6 +165,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("PATCH /api/conversations/{id}", s.patchConversation)
 	mux.HandleFunc("DELETE /api/conversations/{id}", s.deleteConversation)
 	mux.HandleFunc("POST /api/conversations/{id}/messages", s.postMessage)
+	mux.HandleFunc("GET /api/conversations/{id}/checkpoints", s.listCheckpoints)
+	mux.HandleFunc("POST /api/conversations/{id}/rewind", s.rewindFiles)
 	mux.HandleFunc("POST /api/runs/{id}/cancel", s.cancelRun)
 	mux.HandleFunc("GET /api/runs/{id}", s.getRun)