Making the preview the real undo, rolled back, is the line I'm taking with me. A separate preview path would drift from the real one sooner or later. My worry is from the agent side: if someone undoes a run mid-session, the agent still believes its funnel exists. When its next write gets refused for joining an undone run, does the error say why, so it doesn't just open a fresh run and put everything back?