Upstream integration cycle: catch-up through b1e223e2 (2026-09-12)

[rynfar]

Continue the maintainer-authorized upstream catch-up after completed cycle #497. Frozen range 4a4c6dd2adc350a68ba18bb28b24b5a7e4660dab..b1e223e2b0d87124883b1410ab52dd6a1338e40d contains exactly 4 upstream commits, compared against Pylon 6ea4ae45084fd00637bfd379d8edd728585a5d25. Keep this bound until all four have dispositions and final reviewed/green implementations land.

• ca6416ec2d1d194738bc78a81df4b82a75cb72e2 — perf(client): reduce repeated sorting and date formatting (#11019)
• 4fed6cfb3517ef9af9b2a361142152c079504530 — feat: add inline file previews and attachment chips across surfaces (#11265)
• 57b23a09f9dff15d57e3fa288c111381259a9a12 — fix(desktop): preserve long offscreen text in SnapShots (#11250)
• b1e223e2b0d87124883b1410ab52dd6a1338e40d — perf(server): avoid workspace scans when loading pull requests (#11299)

Port every upstream feature while retaining Pylon behavior, identity, Prime/provider ownership, exact rollback, queued compaction, scoped settings, remote authentication, and migration lineage. Reversible in-scope decisions and landing after adversarial review plus green CI remain authorized. Advance the ledger only after all source parts have dispositions. Never merge upstream ancestry or push directly to pylon.

The inline previews/context-chip commit spans 260 paths and will be integrated across contracts/server, web, and mobile before one combined review and CI run. Its accidentally tracked .pnpm-store/v11/index.db is a local package-cache artifact, not product functionality, and will not be imported. The other three commits are independent bounded units.

Opening trigger audit: upstream #8097 remains open/unmerged at 1e8276a76ff194d8b03bc65aa78750b4505ff036. DEF-7/WATCH-2/WATCH-3 retain their earliest 2026-11-01 checks; the four new sources do not add native Claude model-scoped overage identification, so DEF-16 remains unchanged. Preserve #479’s mobile Antigravity exception.

Previous cycle final relay deployment succeeded on 6ea4ae45084fd00637bfd379d8edd728585a5d25: https://github.com/pylon-code/pylon/actions/runs/34681853387 . Its post-merge CI remains watched separately. No manual deployment, desktop/mobile release, device installation, or local rendered/native visual evidence is claimed. Optional Vercel preview quota remains external.

[rynfar]

Verified against GitHub: #517 merged at 0400eb7496c2472bece4d5fa1da48f0e3f571359, #518 at 19d937b4e13d1ad07b17ab81d4d7511ceb9e2693, and #519 at 15e3648e43b3156a9b90271e2e14954c9751b0a6. All three final PR heads passed all 10 Actions CI jobs and independent adversarial review.

The only remaining source in this frozen four-commit cycle is 4fed6cfb3517ef9af9b2a361142152c079504530 (#11265). Its combined server/contracts/shared/web/mobile/desktop port is prepared in the existing context-previews task branch. Backend/package, native, non-composer web, and desktop/docs reviews are approved; final TS/composer review found a missing clipboard record ID collision on both clients, now being fixed with focused regressions. Current successful checks include 825 web and 392 mobile focused tests, affected package typechecks, scoped lint/format, and the combined export scan. Final integration commit, rebase onto the three landed ports, and exact-head CI remain. No cursor advancement or completion claim yet.

No local rendered/native visual verification, Android compilation, desktop/mobile release, or device installation is claimed. Native review used Swift parsing, Objective-C header checks, source/parser and plugin tests; no Android toolchain is available. Optional Vercel marketing preview remains externally quota-limited.

[rynfar]

Completed the exact four-source frozen range 4a4c6dd2adc350a68ba18bb28b24b5a7e4660dab..b1e223e2b0d87124883b1410ab52dd6a1338e40d. All four sources are adapted and merged; no functional scope remains.

Source	Implementation	Merge
57b23a09f9dff15d57e3fa288c111381259a9a12 SnapShot text	#517	0400eb7496c2472bece4d5fa1da48f0e3f571359
b1e223e2b0d87124883b1410ab52dd6a1338e40d project-only PR queries	#518	19d937b4e13d1ad07b17ab81d4d7511ceb9e2693
ca6416ec2d1d194738bc78a81df4b82a75cb72e2 sorting/date formatting	#519	15e3648e43b3156a9b90271e2e14954c9751b0a6
4fed6cfb3517ef9af9b2a361142152c079504530 inline context/attachment previews	#520	af6689799e064acd555e768536da981eeeb3458e

Every PR passed independent adversarial review and final-head Actions CI before landing. #520 additionally passed Mobile Native Static Analysis on its exact final head. Source accounting and repaired findings are recorded in the implementation review and CI repair evidence. The only excluded artifact is the accidentally tracked pnpm cache database; all functional portions of the 260-path source are accounted for.

The main ledger cursor is now b1e223e2b0d87124883b1410ab52dd6a1338e40d (2026-09-12); the deferred/watch registers are preserved. The final merge tree is byte-identical to reviewed/green PR head bf408706ac759f28e95a3e55581c0f5d75cc9cd4. Production relay deployment 34684731693 succeeded on the exact merge. Post-merge main CI and native CI are still watched separately.

The three completed small worktrees/branches and the previous final rewind worktree/branch were removed after ancestry/cleanliness checks; final #520 cleanup is in progress. Caller and unrelated worktrees remain intact. No desktop/mobile release, device installation or native/browser rendered verification is claimed. The optional Vercel marketing preview remains externally quota-limited. No external plan or quota was changed.

Closing this bounded cycle and refreshing upstream once to identify any arrivals after its frozen head.

[rynfar]

Final post-merge validation is complete on af6689799e064acd555e768536da981eeeb3458e: all 10 main CI jobs, native static analysis, and production relay deployment succeeded.

The fresh upstream fetch at 2026-09-12 09:04 UTC still returned b1e223e2b0d87124883b1410ab52dd6a1338e40d: zero commits remain past the reviewed cursor. No next cycle is needed. Cycles #414, #497 and #516 are closed. All completed cycle worktrees and local/remote task branches have been removed after clean-tree and ancestry checks; the caller and unrelated worktrees remain intact.

Existing recorded deferrals/watch conditions remain unchanged. Optional Vercel marketing previews remain quota-limited; no native rendered/device validation or desktop/mobile release/installation is claimed.