chore(upstream): adopt the 2026-08-23 T3 Code batch

[rynfar]

Reviews be7d35aae..30be31195 from pingdotgg/t3code: twenty-seven commits, twenty-six change sets, all adopted. git cherry reported every one absent from Pylon. A read-only git merge-tree probe predicted five conflicts before this branch existed; all five landed where predicted.

Full per-change-set reasoning is in .agents/upstream-review.md. The parts worth a reviewer's attention:

#7774 landed as plumbing only

#7774 ships two separable things: origin metadata (client surface + app version stamped onto auth sessions and orchestration event metadata) and three PostHog events — client.connected, client.thread.started, client.turn.requested.

Pylon's AnalyticsService still defaults T3CODE_POSTHOG_KEY to T3's project key with telemetry enabled, so taking the events as written would have reported every Pylon user's thread and turn activity into T3's analytics project. Per developer decision, the metadata is kept and the three analytics.record calls are dropped, along with the now-unused helper, service acquisition, and import. Upstream's analytics test is replaced with one covering what Pylon retains: that clientSurface/clientAppVersion on the /ws URL reach the dispatched command's origin, and that a client announcing nothing yields undefined rather than a manufactured empty origin.

The inherited PostHog key is a pre-existing condition this batch did not create and deliberately did not widen. It deserves its own PR.

Migration renumbered 041 → 045

Upstream's 041_AuthSessionClientConnection collides with Pylon's existing 041_ProjectionProjectsDefaultThreadEnvMode. Pylon runs 41–44, so it lands at 045, matching the 037–040 precedent. File, test file, and the test's layer(...) label all renamed.

Three defects upstream's CI could not have caught

They only exist where Pylon has diverged. All three are fixed in 4626ce462, and all three were found by reading verification output rather than trusting exit codes — tsgo reported the first while still exiting 0.

• #7821 inserts submissionIntent as onSend's second parameter. Pylon already had directAnnotation and delivery in positions 2 and 3, so Pylon's own onQueueFollowUp was passing "follow-up" into directAnnotation.
• #7897 reads props.selectedThreadQueueCount; Pylon calls that value localOutboxCount.
• #7774's migration test pinned upstream's ids (40 → 41), so under Pylon's renumbering it asserted against a table that never gained the columns.

#7794: upstream's version replaced a working Pylon fix

Pylon had already fixed the empty-composer hijack inline. Upstream's helper is strictly more precise — its :not([contenteditable="false"]) clause lets closest walk past a non-editable island to an editable host, where Pylon's would stop at the island and suppress the shortcut. Upstream's comment carries the same reasoning Pylon's did, so nothing was lost, and the shared helper reduces future divergence.

Worth a second opinion

• #7823 widens AssetAccess past workspace-root containment so a project icon can come from an absolute path. Gated by a signed claim and an extension allowlist that includes .svg. Not a privilege escalation — a paired client already has command execution through any provider — but it does widen the asset surface, and the setting crosses the wire rather than only coming from the native picker.
• #7893 narrows when a tool group reads as failed: last entry rather than any entry. A failure followed by a successful retry stops showing as failed. Defensible, but user-visible.
• #7906 adds 82 --contrast-* variables as an indirection over the theme tokens. Merges clean, but Pylon-specific tokens do not route through the contrast layer, so the slider's coverage is partial. Follow-up, not a blocker.

Conflicts

Six files, all resolved Pylon-first and detailed in the ledger. Two test files had unrelated tests interleaved by git; both were rebuilt from their sources rather than untangled, preserving every test on both sides. ChatComposer.tsx was edited byte-wise — it holds NUL bytes that make grep treat it as binary without -a.

Validation

• 2221 tests pass across the touched suites: 766 web, 1062 server, 393 across mobile, client-runtime, shared, contracts, ssh, tailscale. Zero failures in this worktree.
• Every run also globs nested worktrees under .claude/, .prime/, and .superconductor/, which fail to collect for want of their own node_modules. Every reported failure was confirmed to carry a worktrees path segment before the run was accepted — a pre-existing vitest discovery quirk, not a defect here.
• Typecheck clean across all seven touched packages, each confirmed to have actually run.
• vp check over all 139 changed TypeScript files: 0 errors, 3 warnings, none introduced here (two are upstream-verbatim or identical in both forks; one is a Pylon-only dead import that predates this batch).

Not done

No real-client pass in web or mobile. #6433/#7940 change iOS native markdown rendering and #7906 restyles the token layer; both warrant a look in a running client before release. No UI screenshots for the same reason.

---

Claude Opus 5 in Pylon.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.4 KiB	+3 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−5 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.5 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−6 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+15 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.8 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 35217db · PR result: b9728d7 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.0 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Follow-up on the review: fixed the AssetAccess symlink gap in b9728d767.

The image allowlist ran on the path we were handed, not the file we open, and assetResponseHeaders derives Content-Type from the resolved path — so icon.png symlinked to notes.html was served as text/html on the app's own origin. The workspace branch had the same hole bounded to inside the workspace: containment is re-checked after realPath, the extension never was.

Now enforced against the canonical path at all three resolution points (mint, serve-workspace, serve-external). Three tests, each verified to fail with only its own guard removed.

Two corrections to this PR's description:

• I wrote that upstream's #7794 helper is "strictly more precise" than the fix Pylon already had. That's overstated. In the nested case they behave identically; the real divergence is a standalone contenteditable="false" island with no editable ancestor, where Pylon suppressed the shortcut and upstream fires it. Defensible, but a behavior change rather than a pure improvement. The test's closest stub also matches by substring, so the :not(...) clause is not actually exercised.
• #7893 is half-applied — but it's upstream's own inconsistency, not a merge error here. Their head has at(-1)! at one work-toggle producer and .some(...) at the other, and our copy matches byte-for-byte.

The remaining review findings are going into a separate PR rather than this one.