Upstream integration cycle: close remaining functional exceptions

[rynfar]

The maintainer explicitly reopened the four remaining functional exceptions after the completed catch-up cycle #516. Work through them while preserving Pylon capabilities, with independent adversarial review and green CI before landing. Existing approval covers routine adaptations, PR merges and the automatic relay deploy; it does not request a manual desktop/mobile release or installation.

Verified starting Pylon: 6e879c2b665a373b758b81ec28367b2f730fdab4. Reviewed cursor: b1e223e2b0d87124883b1410ab52dd6a1338e40d. Fresh upstream bound: d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3 (one newly arrived sidebar source after that cursor).

• DEF-7 anonymous macOS preview downloads: upstream 33b650a5b / #8243; reassess Pylon feat(ci): download macOS preview DMGs without signing in #111 plus 9d112329e, reverted in Revert "feat(ci): download macOS preview DMGs without signing in" #113. Build a scoped, opt-in workflow preserving Pylon release identity.
• DEF-16 live Claude model quotas: 19d8ab2ae9fc562ee7b216a0d72903fbfafa9572 / #9507. Obtain authoritative named quota updates without guessing the model from unscoped stream events or replacing Pylon cached OAuth/hub behavior.
• Mobile Antigravity marker/catalog parity: refactor(web): share one setup wizard and finish Antigravity setup from model pickers #479, sources 06336460c9988f29c71e839c4c9c840c4552e077, d487dfbf46be344e818725be70ee04be2436bfb4, 3faeee49ac67dfd9534369f1e1c627c0356b75ac. Resolve the default marker and preserve restart-safe admission/outbox recovery.
• Exact rollback for other provider adapters: feat(chat): restore prompts and preserve files during exact rewind #513, sources fd5553f1afcef4f410a067687faa991743b5034c, efccda9ac9230db22b36990cffabdad218fa41b0. Require immutable absolute anchors, idempotent apply and verifiable source/target recovery; preserve Prime exact rollback and its latest recovery fixes.
• New sidebar scope/search source d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3 / #11315.
• Final ledger dispositions, CI/automatic relay result and task worktree cleanup.

The explicit request reopens the named deferrals before their former revisit dates. Other deferred/watch entries are unchanged. Update this issue with verified PR heads and concrete remaining limits; do not equate the reviewed cursor with full feature parity.

[rynfar]

Verified progress:

• Sidebar source #11315 is PR feat(sidebar): fold project scope into the search row #527 at ee74ede17fbefb8242cfd512efd98ed5431bb75a; independent review fixed negative/stale ARIA indices and preserved environment identity in the collapsed scope control. 196 focused tests and web types/lint pass; final-head CI is running.
• DEF-7 implementation is in upstream/2026-09-12-public-previews; read-only PR build and separate trusted publisher/cleanup. No preview label, public release, or installation has been performed.
• DEF-16 implementation is in upstream/2026-09-12-claude-quotas; unscoped native events trigger authoritative cached OAuth reconciliation, preserving account-wide pushes.
• Mobile Antigravity is in upstream/2026-09-12-mobile-catalog; account-specific marker resolution and admission/outbox coverage in progress.
• Rollback research verified absolute native forks for OpenCode and Claude, plus Codex thread/fork.lastTurnId in the pinned protocol. Implementations are underway in upstream/2026-09-12-opencode-rollback and upstream/2026-09-12-codex-rollback; shared durable selection support is in upstream/2026-09-12-exact-rollback. Claude exact support follows quota work. These are unfinished implementations, not shipped capability claims.

The frozen upstream bound remains d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3. The ledger cursor stays unchanged until the bounded work is recorded. Caller and unrelated worktrees are preserved.

[rynfar]

Verified progress on the frozen d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3 cycle:

• feat(sidebar): fold project scope into the search row #527 merged as d6d2f8eb7d583c7f2661baa529812c3db684f90e: the new upstream sidebar scope/search row, reviewed and all 10 CI jobs green.
• feat(ci): restore anonymous macOS PR previews #528 merged as 8c9930c57490eb4690baf13c6f8d43f42821c6fc: DEF-7 anonymous opt-in macOS preview publication. All 10 final-head CI jobs passed. Automatic relay run 34705817168 succeeded. No preview label, public binary publication, desktop/mobile release or device installation was performed. Both merged task branches/worktrees are cleaned.
• fix(mobile): resolve Antigravity account catalogs before sending #529 mobile Antigravity catalog parity is independently reviewed at 26a20ef67dab442409f4f5c8fd6129ef1f2997fa; CI is finishing against the merged preview workflows. Account-specific marker/alias resolution, targeted discovery, unknown-auth saved sends and final post-attachment catalog admission are covered.
• fix(claude): reconcile live model quotas with verified account usage #530 Claude named model quota reconciliation is independently reviewed at e167d2eaec23de05b7151844b76c15805db156a4; CI is finishing. Review caught and fixed stale full-quota overlays surviving the existing 30-minute retention limit. Native unscoped hints trigger bounded cached OAuth reconciliation; no guessed model bucket.
• Exact rollback remains active for OpenCode, Codex and Claude. Shared selection persistence, checkpoint-write races and compaction success/failure recovery fixes pass 196 focused tests, server types and scoped lint. OpenCode's adapter has 132 focused passing tests and an isolated installed-CLI 1.18.29 import/fork/read smoke: full/truncated semantic equality, compaction-tail mapping and unchanged source/workspace all passed, without prompts, live credentials or live state. Independent review is completing checkpoint identity across compaction/restart. Codex is in independent review. Claude SDK experiments exposed filtered history and rewritten metadata, which must be accounted for before claiming exact proof.

No cursor advance or cycle closure is claimed yet. The original caller worktree and unrelated worktrees remain preserved. The final implementation PR will update the compact ledger dispositions; final merge CI and automatic relay deployment will be watched separately.

[rynfar]

Latest verified landing state:

• fix(mobile): resolve Antigravity account catalogs before sending #529 merged as 2c46cbc5917b9f8014e9ead0cc2a7babee6b3cb0. All ten final-head and merge CI jobs passed; relay34706287143 succeeded.
• fix(claude): reconcile live model quotas with verified account usage #530 merged as 032cfce27518162322f7a18ee6e3bae63a057a43. All ten final-head and merge CI jobs passed; relay34706300733 succeeded. Both task branches/worktrees are cleaned.
• feat(ci): restore anonymous macOS PR previews #528 post-merge publisher preparation failed in actions/checkout because a vendored nested gitlink has no root submodule metadata. No publish job ran and no preview release exists. Follow-up fix(ci): load preview publisher without Git checkout #532 at fd3f849b320b4b05e72536a8603d356cf4973636 loads and validates only the helper at the immutable workflow commit via the Contents API. Independent review,84 focused tests, Actionlint and actual read-only GitHub retrieval passed; CI34706687035 is running. DEF-7 closure depends on landing this fix and watching its actual closure workflow.
• feat(opencode): enable exact recoverable conversation rewind #531 OpenCode exact rollback at f9692bc46c61218226b036d699514103175f06a1 is open, independently reviewed, with329 focused tests/server types/lint and installed native fork smoke evidence. A further adversarial regression reproduced concurrent completion handlers replacing the first checkpoint snapshot and losing its revision; the owner is fixing it before merge. Final CI will run on the corrected head.
• Codex and Claude exact adapters remain under construction/review. Primary native-source and SDK experiments proved their public history views omit model context records, so both need bounded native history-file proof. A public turn-count or visible-message digest alone is not being treated as exact recovery authority.

Frozen upstream scope and cursor remain unchanged. No manual release, preview label, binary publication, browser/native UI operation or device installation has been performed. Final ledger closure and issue completion remain pending exact adapter work and the workflow repair.

[rynfar]

Paused at the maintainer’s request so they can switch out of Ultra. All existing agents finished their assigned implementation and review; no additional scope was started. The original worktrees are clean and retained, and committed work is backed up on GitHub. Local recovery snapshot location is recorded in the common Git directory’s agent-handoffs/t3-upstream/CURRENT.md, with verified file hashes, diffs, evidence and a Git bundle.

Current Pylon: d4e599ba869937b5a539c25643f402122969a214. Frozen upstream head: d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3; ledger cursor remains b1e223e2b0d87124883b1410ab52dd6a1338e40d. No newer upstream fetch was performed for this pause.

Merged and cleaned: #527 sidebar, #528 previews, #529 mobile Antigravity, #530 Claude quotas, and #532 preview checkout repair. Final merge CI 34707155825 and relay 34707155881 succeeded. The repaired preview workflow’s actual closure run 34707155674 passed both preparation and cleanup. No preview binary, preview label, manual release, browser/native UI operation or device installation was performed.

Remaining landing work, in order:

1. feat(opencode): enable exact recoverable conversation rewind #531 OpenCode plus shared exact recovery at 42e4959c5d83f0d3f13b9f8d189030b33c63a7c9. All ten final-head CI jobs passed in 34707513432, independent review passed, focused suites/types/lint passed, and installed OpenCode1.18.29 synthetic fork smoke passed. Not merged because of this pause. Worktree /tmp/pylon-upstream-exact-rollback; branch upstream/2026-09-12-exact-rollback. Default managed servers are supported; experimental native plan files and unobservable external-server flags remain exact-ineligible while ordinary use continues.
2. Codex native-only commit 08456d6d1e195e38d44916721f90ddf0d172f1ce, backed up on upstream/2026-09-12-codex-rollback; worktree /tmp/pylon-upstream-codex-rollback. 360 focused tests, server types/lint and independent review passed. No PR/integration CI yet. Cherry-pick only this native commit after feat(opencode): enable exact recoverable conversation rewind #531; its three parents duplicate feat(opencode): enable exact recoverable conversation rewind #531 shared work. Full native JSONL and inactive goal state are verified. Pinned paginated forks, active/uninspectable goals, unprovable old/root bindings and unsupported native file shapes remain explicit limits; ordinary resume remains intact.
3. Claude native-only commit 6f707352571e84a05fa512ade7af8e4242833c1c, backed up on upstream/2026-09-12-claude-rollback; worktree /tmp/pylon-upstream-claude-rollback. 160 focused tests, server types/lint and exact-head independent review passed. No PR/integration CI yet. Cherry-pick only this native commit after feat(opencode): enable exact recoverable conversation rewind #531/Codex, preserving other absolute capability constants. Full raw native history and actual pinned SDK synthetic forks are verified; source and delayed callbacks are quarantined. Empty root, uncaptured/previous-incarnation checkpoints and unprovable native history remain explicit limits; ordinary resume is preserved.

Codex and Claude evidence/precise limits are in their HANDOFF.md and independent-review receipts under /tmp/pylon-{codex,claude}-rollback-evidence, copied into the durable local snapshot. Their agent notes saying “no push” predate the verified backup pushes. No live model/account tests were performed.

After resuming: verify Git/GitHub, land #531 under existing standing approval, integrate the native-only commits with focused checks and PRs on latest pylon, require independent review and final-head green CI, then watch automatic merge CI/relay. Keep unsupported native cases explicit. Finish compact ledger/cursor accounting and close #526 only when pending landing work is complete; refresh upstream once at the end for any new arrivals. Do not restart completed cycles #414/#497/#516.

The caller worktree remains untouched and clean at 4fa8a964685005c155c8221aeed43c080daeb2af. Preserve all unrelated worktrees and live userdata. No owned test server remains running.

[rynfar]

Resumed under the maintainer's instruction to finish. Verified the saved heads, clean worktrees, review receipts and GitHub checks before acting.

• feat(opencode): enable exact recoverable conversation rewind #531 merged as 9764d77c7d5b5c66acb931280a196bed52beca85. Relay 34709507045 succeeded; merge CI is finishing.
• Codex feat(codex): enable verified native conversation rewind #533 is now open. Native code matches the saved independent review except for removing one unused export caught by CI. The size-limit behavior is unchanged; 85 helper tests and scoped lint passed after that fix. Prior 360-test evidence is retained, and integration capability test/server types passed. Final-head CI is running.
• Claude's reviewed native commit is integrated locally on the Codex branch's changes, retaining OpenCode and Codex absolute modes. All six native implementation/test files still match their reviewed hashes. 135 combined service/capability tests, server types and scoped lint passed. Documentation and frozen-cursor accounting are prepared for the final implementation PR; no premature cycle closure is claimed.

No new agents or native/live account tests were started. Final merges, CI/deploy verification, owned task cleanup and a single fresh upstream check remain.

Model: GPT-6. Harness: Codex.

[rynfar]

Completed the frozen cycle through d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3. The decision cursor and compact dispositions landed in #535; native compatibility exclusions remain explicit, so this is not a universal provider-history parity claim.

Final landing evidence:

• OpenCode/shared exact rollback feat(opencode): enable exact recoverable conversation rewind #531: merge 9764d77c7d5b5c66acb931280a196bed52beca85; all ten final-head CI jobs passed in34707513432; merge CI 34709507044 and relay 34709507045 succeeded.
• Codex feat(codex): enable verified native conversation rewind #533: final head f2b305d44da307304f47840ec8a187b4fc9b3158, merge 083a1720574c279982c3326eb090975e676d054d; all ten final-head CI jobs passed in 34709776527; merge CI 34710265069 and relay 34710265062 succeeded. CI's unused-export finding was fixed without changing the native size limit; 85 focused helper regressions and lint passed afterwards. Reviewed implementation evidence and integration capability/type checks are retained.
• Claude feat(claude): enable verified native conversation rewind #535: final head 76a75e996efdcc8042c7dcd15060fba96f022602, merge cf4be419b31a19eb7611e8a912c198899ecd65ff; all ten final-head CI jobs passed in 34710276215; all ten merge CI jobs 34710752946 and relay 34710752876 succeeded. Six native implementation/test files match the independent review receipt; integrated 135 service/capability tests, server types, scoped lint and server unused-export check passed.

Earlier #527 sidebar, #528 previews plus #532 workflow repair, #529 mobile Antigravity, and #530 Claude quotas were already merged and verified as recorded above. All existing agent implementation and adversarial review was reused; no new agents were started. Optional Vercel marketing previews on #533/#535 hit the daily deployment quota; repository CI and production relay deployment succeeded. No manual desktop/mobile release, preview binary publication, device install, browser/native UI action or live model/account test is claimed.

A single completion-time upstream fetch found three sources through a43f9b45ae85caf37e0be8270ad3d27365ece2bd; next cycle #536 records them. The Expo Audio pin is already covered by #523, and Pylon never tracked the deleted package cache. The one remaining new code change is #11429 snapshot-preview sizing. That new range is not included in this cycle's cursor.

The original caller and unrelated worktrees remain untouched. Completed task cleanup and the next-cycle pointer are maintained in the common Git handoff location; the original verified pause snapshot remains available as historical recovery evidence.

Model: GPT-6. Harness: Codex.

[rynfar]

Maintainer-requested follow-up tracking so the completed integration thread can be closed:

• OpenCode: address remaining exact rewind compatibility limits #538 — OpenCode remaining exact rewind compatibility: native plan files, external-server capability proof and uncaptured historical boundaries.
• Codex: address remaining exact rewind compatibility limits #539 — Codex remaining exact rewind compatibility: active goal admission, complete/paginated/large history proof and old checkpoint bindings.
• Claude: address remaining exact rewind compatibility limits #540 — Claude remaining exact rewind compatibility: empty root, old/incarnation boundaries, compaction and unsupported native history.
• Upstream integration cycle: snapshot preview sizing through a43f9b45 #536 — existing next upstream cycle; one remaining snapshot-preview sizing port, with the other two source commits already covered.

The three rewind implementation PRs are merged and verified; these issues track remaining limitations without weakening exact-recovery guarantees. Each includes existing evidence, acceptance criteria and concrete revisit triggers for native blockers. This follow-up does not reopen completed #526.