feat(upstream): adopt T3 changes through bd9ed2b4

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

The Pylon upstream cursor stopped at f035a0f4, leaving twelve reviewed T3 commits unapplied. This adopts the complete approved range through bd9ed2b4 as one audited upstream batch.

What changed

• fixes nightly version-skew detection, usage-page loading layout/model sorting, terminal-link affordance, and Windows/HTML/XML file links;
• adds the configurable settle/restore shortcut, persisted pull-request linking across server/web/mobile, and guarded HEIC-to-JPEG attachments;
• avoids full-history shell-summary reads for routine provider events;
• batches signed macOS artifacts and trims packaged native dependencies;
• records the dependency-lock no-op and advances .agents/upstream-review.md through bd9ed2b4.

Pylon-first adaptations

• preserves Prime interaction.* pending-input refreshes in the optimized projection path;
• keeps Pylon app IDs, renderer protocols, products/artifacts, local signing, and passkey signing;
• renumbers upstream migration 042 to Pylon migration 046 because Pylon already owns 042–045;
• keeps Pylon wording and active-provider usage behavior.

Validation

• 516 focused changed-behavior tests passed across web, server, contracts/client runtime, mobile, and version skew;
• the focused macOS signing test passed;
• all seven affected package typechecks passed;
• targeted lint: 0 errors (2 pre-existing warnings in an untouched test section);
• formatting over all 70 changed source/doc/config files passed;
• production web build passed and emitted heic-to/csp as a separate lazy chunk;
• vp i passed the repository supply-chain policy.

build-desktop-artifact.test.ts retains one verified baseline failure on Apple Silicon: the test's arm64 fixture is the host architecture, so its alleged cross-architecture native probe runs. The same assertion fails on clean pylon; every new packaging assertion passes.

Separate post-integration review

After the batch was complete and rebased, I reviewed the resulting branch again rather than relying on cherry-pick success:

• fetched both remotes again; origin/pylon is the branch base and official T3 main still ends at bd9ed2b4;
• compared upstream file coverage; every touched path is represented except the two migration files intentionally renamed 042 → 046;
• scanned added lines for T3 product names, app IDs, protocols, artifact names, and hosted origins: no branding drift;
• checked migration uniqueness/order and upgrade semantics through 046;
• checked Pylon's Prime activity derivation against the projection refresh allowlist: complete;
• checked contracts, capability gating, persistence, reverse actions, web, desktop, mobile, provider neutrality, connection modes, and docs: no confirmed omission or regression;
• ran git diff --check and conflict-marker checks: clean.

Known follow-ups

• The maintainer approved keeping heic-to@1.5.2 to match upstream while Pylon remains private. Revisit its LGPL-3.0 notice and source-delivery requirements before any external web or desktop distribution.
• The decoder's first-use lazy chunk is 2.995 MB minified / 751 KB gzip. It does not affect initial load, but HEIC conversion pays that download once.
• Automated real-client verification is being added after the maintainer granted computer-use permission.

UI evidence

The visual patches are unchanged from their upstream PRs; inherited before/after evidence:

Usage loading layout

Before

After

Terminal link affordance

Before

After interaction video

Cap.2026-08-19.at.00.07.42.mp4

Upstream PRs: pingdotgg/t3code#8124, #8111, #7488, #8081, #8108, #8098, #8150, #8163, #8089, #8093, #8160, #8161.

Model: GPT-5.6 Sol
Harness: Prime Agent (RLM)

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−95 B (−0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−93 B (−1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+602 B (+1.1%)	66.4 KiB	✅
Codex	Live turn messages	16	11	−5 (−31.3%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+47 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+46 B (+0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.9 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 3fd9e00 · PR result: a55f608 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.