refactor(desktop): make the deep-truncate confirm explicit at every rewind site

Gate C18 r1 quality [Low]: runRewindSubmit defaulted confirmDeepTruncate
to true while truncateSubmitParams defaulted it to false, so regenerate
had to write `?? false` and restore/edit opted into a destructive server
bypass by omitting a trailing argument. An omitted flag now means not
confirmed; restore/edit and their stale-target retries pass true
explicitly, and ReloadPlan.confirmDeepTruncate is a plain boolean
(planReload false, planConfirmedReload true after the confirm).

The parameter stays optional rather than required: it trails other
optional parameters, which TypeScript forbids for a required one.

apps/desktop/src/app/chat/session-tile-actions.ts

@@ -581,7 +581,7 @@ export function useSessionTileActions({ requestGateway, runtimeId, scope, stored
             plan.truncateRowId,
             plan.sourceText,
             durableRowIdsForRebind(messages),
-            plan.confirmDeepTruncate ?? false
+            plan.confirmDeepTruncate
           )
         )
       } catch (err) {
@@ -627,7 +627,8 @@ export function useSessionTileActions({ requestGateway, runtimeId, scope, stored
             plan.truncateMessageId,
             plan.truncateRowId,
             plan.sourceText,
-            durableRowIdsForRebind(messages)
+            durableRowIdsForRebind(messages),
+            true
           )
         )
       } catch (err) {
@@ -662,7 +663,8 @@ export function useSessionTileActions({ requestGateway, runtimeId, scope, stored
                   retryPlan.truncateMessageId,
                   retryPlan.truncateRowId,
                   retryPlan.sourceText,
-                  durableRowIdsForRebind(freshMessages)
+                  durableRowIdsForRebind(freshMessages),
+                  true
                 )
               )
 
@@ -719,7 +721,8 @@ export function useSessionTileActions({ requestGateway, runtimeId, scope, stored
             plan.truncateMessageId,
             plan.truncateRowId,
             plan.sourceText,
-            durableRowIdsForRebind(messages)
+            durableRowIdsForRebind(messages),
+            true
           )
         )
       } catch (err) {

apps/desktop/src/app/session/hooks/use-prompt-actions/index.ts

@@ -1029,7 +1029,7 @@ export function usePromptActions({
           plan.truncateRowId,
           plan.sourceText,
           durableRowIdsForRebind(messages),
-          plan.confirmDeepTruncate ?? false
+          plan.confirmDeepTruncate
         )
 
         applySurvivorRowIds(sessionId, survivorRowIds)
@@ -1104,7 +1104,8 @@ export function usePromptActions({
           interruptFirst,
           plan.truncateRowId,
           plan.sourceText,
-          durableRowIdsForRebind(messages)
+          durableRowIdsForRebind(messages),
+          true
         )
 
         applySurvivorRowIds(sessionId, survivorRowIds)
@@ -1140,7 +1141,8 @@ export function usePromptActions({
                 false,
                 retryPlan.truncateRowId,
                 retryPlan.sourceText,
-                durableRowIdsForRebind(refreshed)
+                durableRowIdsForRebind(refreshed),
+                true
               )
 
               applySurvivorRowIds(sessionId, survivorRowIds)
@@ -1241,7 +1243,8 @@ export function usePromptActions({
           interruptFirst,
           plan.truncateRowId,
           plan.sourceText,
-          durableRowIdsForRebind(messages)
+          durableRowIdsForRebind(messages),
+          true
         )
 
         applySurvivorRowIds(sessionId, survivorRowIds)
@@ -1275,7 +1278,8 @@ export function usePromptActions({
                 false,
                 retryPlan.truncateRowId,
                 retryPlan.sourceText,
-                durableRowIdsForRebind(refreshed)
+                durableRowIdsForRebind(refreshed),
+                true
               )
 
               applySurvivorRowIds(sessionId, survivorRowIds)

apps/desktop/src/app/session/hooks/use-prompt-actions/rewind.test.ts

@@ -738,7 +738,7 @@ describe('planConfirmedReload (#133716)', () => {
         plan.truncateRowId,
         plan.sourceText,
         undefined,
-        plan.confirmDeepTruncate ?? false
+        plan.confirmDeepTruncate
       )
     }
 

apps/desktop/src/app/session/hooks/use-prompt-actions/rewind.ts

@@ -281,9 +281,9 @@ export async function runRewindSubmit(
   truncateRowId?: number,
   sourceText?: string,
   rebindRowIds?: readonly number[],
-  // Restore/edit name their target explicitly; only regenerate (implicit
-  // target) passes false unless the user confirmed a deep cut (#133716).
-  confirmDeepTruncate = true
+  // Omitted never means confirmed: restore/edit (explicit target) and a
+  // confirmed deep regenerate pass true; tail regenerate passes false (#133716).
+  confirmDeepTruncate?: boolean
 ): Promise<SurvivorUserRowIds | undefined> {
   // Recovery may rebind the live id mid-flight; interrupt/submit must both
   // follow it rather than pinning the dead one.
@@ -492,8 +492,8 @@ export function appendMidTurnUserMessage<
 
 export interface ReloadPlan {
   branchGroupId: string
-  /** Set only after the user confirmed a reload that archives later user turns. */
-  confirmDeepTruncate?: boolean
+  /** True only after the user confirmed a reload that archives later user turns. */
+  confirmDeepTruncate: boolean
   /** Original persisted text of the turn — the durable-row-id content key. */
   sourceText: string
   text: string
@@ -533,6 +533,7 @@ export function planReload(messages: ChatMessage[], parentId: null | string): nu
 
   return {
     branchGroupId: targetAssistant?.branchGroupId ?? branchGroupForUser(userMessage),
+    confirmDeepTruncate: false,
     sourceText: text,
     text,
     truncateOrdinal: isFailedTurn ? undefined : visibleUserOrdinal(messages, userIndex),