From d77e5c937140d8913b9cb2f6c84f753a78bad663 Mon Sep 17 00:00:00 2001 From: Trevor Walker Date: Sat, 5 Sep 2026 19:51:22 -0600 Subject: [PATCH 1/3] docs(upstream): record first catch-up batch and refresh watch state --- .agents/upstream-review.md | 50 ++++++++++++++++++++++++++++++++++---- 1 file changed, 45 insertions(+), 5 deletions(-) diff --git a/.agents/upstream-review.md b/.agents/upstream-review.md index 49ae37c02..bbdb67b09 100644 --- a/.agents/upstream-review.md +++ b/.agents/upstream-review.md @@ -15,6 +15,46 @@ Two standing sections outlive any single batch and must be read on every review: ## Review batches +## 2026-09-05 — first catch-up batch and watch recheck (partial) + +The maintainer approved A1–A4 after reviewing the bounded upstream head +`f12d39359f0f76a64ff2d77959c5baf821df15be`. The range from +`beae2147a9487ec47ac992319f2216914b4cb62d` contains 555 commits: 44 have +patch-equivalence evidence and 50 additional commits have cherry-pick trailers. +Those are inventory signals, not proof that every port remains effective. +Only the following 10 upstream commits were selected in this first batch. +The full cursor stays unchanged; the remaining range is not silently deferred +or treated as reviewed. + +| Approved concern | Upstream PRs and commits | Pylon PR | +| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | +| A1 Claude failures and pauses | #9135 `560afffdea82000d757c98ea79678aee75f8648c`; #8853 `a5bbad910f78cc14eef8baa94fe6f46676f78d5a`; #7165 `940e8233c227a186044078e99e45e1933eb525e4` | #268 | +| A1 Codex rate-limit history | #8897 `75ab5ab3fb6ad35117da754644c404a31b2fed84` | #272 | +| A2 live subscription startup | #9521 `9c9ae3dc0e94a957d9c4a61bb211caf914828054` | #273 | +| A3 mobile saved work | #9710 `7839140e5e93d3f401d7eb45b86cf1a234eb3609` | #274 | +| A4 managed SSH runner | #9843 `f33fdc992488e36ccb70cbb71d55e630b5184cbd`; #10088 `39802c06117fae0b3da43624b0d54309c5437c72` | #276 | +| A4 relay binary validation | #9880 `2c301fd0c4fc58c1612be47c3856fa4ad547429d` | #277 | +| A4 LAN/Tailscale pairing | #9882 `60e1b73948debac845c3dc72aac35c9adbd4cd64` | #278 | + +Each implementation PR carries its own adaptations and verification record. +All are awaiting merge at the time of this ledger update. Separate Pylon release +repairs #271 (temporary signing-keychain password) and #275 (pin the existing +patched Expo versions for fresh resolution) address publication and CI blockers. + +Deferred register: DEF-7 remains **not yet**; its November 1 floor is unreached +and this range has no macOS-preview workflow changes. DEF-8 is **due**: Expo 57 +merged as #171 (`eff44d0cfa`) and September 5 has arrived. Keep its required split +between dev-loop work and product/shared-runtime changes; it was not included +in the approved first batch. Its original deferral date remains intact. + +Watch list: WATCH-1 is rewritten to stop watching closed upstream issue #5760; +Pylon #178 still owns the unfixed OpenCode task work. #8097 is open, no longer +a draft, and unmerged; the existing merge-and-divergence condition remains. +Owner #114 is updated with this state and the ledger PR reference. WATCH-2 and +WATCH-3 stay **not yet**: #6573 and #7986 remain closed unmerged, no replacement +landed in their watched paths (only #9129 dead-toolkit cleanup), and both retain +November 1 revisit floors. No new deferrals or watch entries were added. + ## 2026-09-04 (targeted) — `beae2147a9487ec47ac992319f2216914b4cb62d..95103905f5`, lifecycle reliability only **Cursor deliberately not advanced.** This was a targeted review, not a full @@ -3235,8 +3275,8 @@ an entry comes due, is rewritten, or is retired, update the owning issue in the same change. An owner that disagrees with this table is the failure this list exists to prevent. -| ID | Owner | Upstream | Added | Current signal | Revisit when | Response to evaluate | -| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| WATCH-1 | [`#114`](https://github.com/pylon-code/pylon/issues/114) — Prime provider parity | `#5760` (issue, open) OpenCode `todowrite` updates do not reach the task sidebar; `#8097` (PR, open draft) restore composer tasks after relaunch | 2026-08-29 | `#5760` is a real defect **present in Pylon**: `OpenCodeAdapter.ts` emits no `turn.plan.updated`, so the composer Tasks tab, inline plan chip, and sidebar working line are dead on OpenCode, and every `todowrite` is misclassified `file_change` and inflates the edit count. Pylon is fixing this itself against the v2 SDK's structured `todo.updated` event; there is no upstream patch to take. That Pylon-side fix is open as [`#178`](https://github.com/pylon-code/pylon/pull/178) (`fix/opencode-plan-parity`), so `#5760` stays listed only because the upstream issue is still open. **`#8097` is superseded** — Pylon shipped the same fix in `#137` (`8698a69e`) before the draft opened, via the `latest_plan_activity` CTE in `ProjectionSnapshotQuery.ts`, and with waiting-step retention the draft's settled-turn gate would regress. | For `#5760`: nothing to watch upstream — Pylon owns the fix. For `#8097`: only if it merges AND diverges from Pylon's approach. Check `gh pr view 8097 --repo pingdotgg/t3code --json state,mergedAt`. Its migration id 42 is unusable here (Pylon's 42 is `ProjectionProjectFaviconPath`; the manifest runs through 47, so any new migration is 048). Upstream's own trunk has a 42 collision between `#8097` and merged `#8160`. | Do not port `#8097`. Two fragments stand alone on their merits: its partial plan-activity index as a Pylon-numbered `048`, but only if `EXPLAIN QUERY PLAN` shows Pylon's CTE actually reverse-scans; and a Pylon-voiced Tasks section for `docs/user/composer.md`, which has none today. Its `turn.aborted` reducer hunks are an unrelated concern — investigate separately, do not smuggle them in. | -| WATCH-2 | [`#174`](https://github.com/pylon-code/pylon/issues/174) — cross-thread messaging design; context in [`#114`](https://github.com/pylon-code/pylon/issues/114) | `#6573` (PR) — authenticated cross-thread MCP tools | 2026-08-29 | **Premise gone.** Closed unmerged 2026-08-28 without adding permission splitting or bounded read-only tools. Nothing upstream to compare against today. | A replacement lands. Check `git log --oneline ..t3code-upstream/main -- apps/server/src/mcp/toolkits/` and `gh pr list --repo pingdotgg/t3code --search 'mcp thread tools' --state merged`. Not before 2026-11-01 — upstream abandoned this once and a rewrite is not a weekly event. | Compare with Pylon's scoped read-only context/checkpoint MCP design before adoption. Do not revive `#6573` itself. | -| WATCH-3 | [`#177`](https://github.com/pylon-code/pylon/issues/177) — scheduled-run safety contract; context in [`#114`](https://github.com/pylon-code/pylon/issues/114) | `#7966` (issue) / `#7986` (PR) — server-side scheduled agent runs | 2026-08-29 | **Premise gone.** Both closed 2026-08-28; `#7986` closed unmerged. The implementation Pylon declined to cherry-pick no longer exists upstream. | A replacement scheduling implementation merges. Check `git log --oneline ..t3code-upstream/main -- apps/server/src/orchestration/Layers/TaskFireReactor.ts apps/server/src/orchestration/Layers/OrchestrationReactor.ts`. Not before 2026-11-01. | Fresh review only. Pylon's own canonical scheduled-turn ownership question in `#114` is unblocked by upstream's retreat, not answered by it. | +| ID | Owner | Upstream | Added | Current signal | Revisit when | Response to evaluate | +| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| WATCH-1 | [#114](https://github.com/pylon-code/pylon/issues/114) — Prime provider parity | #8097 (PR, open and ready for review) — restore composer tasks after relaunch | 2026-08-29 | Rechecked 2026-09-05. Upstream #5760 closed on September 4 without an identified linked fix; closing it does not resolve Pylon's OpenCode task gap, still owned by open Pylon #178. Retire that closed issue as an upstream watch target. #8097 remains unmerged and is superseded in Pylon by #137, whose task restoration also retains waiting steps. | Revisit only if #8097 merges and diverges from Pylon's approach: `gh pr view 8097 --repo pingdotgg/t3code --json state,mergedAt`. Review any migration against Pylon's current manifest; never reuse upstream numbering. | Do not port #8097 wholesale. Consider a plan-activity index only if current query plans demonstrate a need. Review unrelated `turn.aborted` changes separately. | +| WATCH-2 | [`#174`](https://github.com/pylon-code/pylon/issues/174) — cross-thread messaging design; context in [`#114`](https://github.com/pylon-code/pylon/issues/114) | `#6573` (PR) — authenticated cross-thread MCP tools | 2026-08-29 | **Premise gone.** Closed unmerged 2026-08-28 without adding permission splitting or bounded read-only tools. Nothing upstream to compare against today. | A replacement lands. Check `git log --oneline ..t3code-upstream/main -- apps/server/src/mcp/toolkits/` and `gh pr list --repo pingdotgg/t3code --search 'mcp thread tools' --state merged`. Not before 2026-11-01 — upstream abandoned this once and a rewrite is not a weekly event. | Compare with Pylon's scoped read-only context/checkpoint MCP design before adoption. Do not revive `#6573` itself. | +| WATCH-3 | [`#177`](https://github.com/pylon-code/pylon/issues/177) — scheduled-run safety contract; context in [`#114`](https://github.com/pylon-code/pylon/issues/114) | `#7966` (issue) / `#7986` (PR) — server-side scheduled agent runs | 2026-08-29 | **Premise gone.** Both closed 2026-08-28; `#7986` closed unmerged. The implementation Pylon declined to cherry-pick no longer exists upstream. | A replacement scheduling implementation merges. Check `git log --oneline ..t3code-upstream/main -- apps/server/src/orchestration/Layers/TaskFireReactor.ts apps/server/src/orchestration/Layers/OrchestrationReactor.ts`. Not before 2026-11-01. | Fresh review only. Pylon's own canonical scheduled-turn ownership question in `#114` is unblocked by upstream's retreat, not answered by it. | From 84e852ef07c0d0f721024b3a6bf74fef1a6558b2 Mon Sep 17 00:00:00 2001 From: Trevor Walker Date: Sat, 5 Sep 2026 20:32:14 -0600 Subject: [PATCH 2/3] docs(upstream): consolidate catch-up implementation records --- .agents/upstream-review.md | 140 ++++++++++++++++++++++++++++++++++++- 1 file changed, 138 insertions(+), 2 deletions(-) diff --git a/.agents/upstream-review.md b/.agents/upstream-review.md index bbdb67b09..a462aee12 100644 --- a/.agents/upstream-review.md +++ b/.agents/upstream-review.md @@ -26,6 +26,12 @@ Only the following 10 upstream commits were selected in this first batch. The full cursor stays unchanged; the remaining range is not silently deferred or treated as reviewed. +A September 6 UTC refresh reached `b438447f67b6b61bbe6f564d8b78fd90702117c5`: +four further commits arrived after the selected head. All 10 selected commits +were unmatched in the original inventory, leaving 451 from that range plus +these four new commits (455 total) for later assessment. This is a review +backlog, not a count of changes Pylon must adopt. + | Approved concern | Upstream PRs and commits | Pylon PR | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | A1 Claude failures and pauses | #9135 `560afffdea82000d757c98ea79678aee75f8648c`; #8853 `a5bbad910f78cc14eef8baa94fe6f46676f78d5a`; #7165 `940e8233c227a186044078e99e45e1933eb525e4` | #268 | @@ -36,7 +42,9 @@ or treated as reviewed. | A4 relay binary validation | #9880 `2c301fd0c4fc58c1612be47c3856fa4ad547429d` | #277 | | A4 LAN/Tailscale pairing | #9882 `60e1b73948debac845c3dc72aac35c9adbd4cd64` | #278 | -Each implementation PR carries its own adaptations and verification record. +The implementation records below preserve each PR's adaptations and verification. +They are consolidated here so independent code PRs do not compete to insert at +the same ledger location. All are awaiting merge at the time of this ledger update. Separate Pylon release repairs #271 (temporary signing-keychain password) and #275 (pin the existing patched Expo versions for fresh resolution) address publication and CI blockers. @@ -50,11 +58,139 @@ in the approved first batch. Its original deferral date remains intact. Watch list: WATCH-1 is rewritten to stop watching closed upstream issue #5760; Pylon #178 still owns the unfixed OpenCode task work. #8097 is open, no longer a draft, and unmerged; the existing merge-and-divergence condition remains. -Owner #114 is updated with this state and the ledger PR reference. WATCH-2 and +Owner #114 is updated with this state and #279. WATCH-2 and WATCH-3 stay **not yet**: #6573 and #7986 remain closed unmerged, no replacement landed in their watched paths (only #9129 dead-toolkit cleanup), and both retain November 1 revisit floors. No new deferrals or watch entries were added. +## 2026-09-05 — approved Claude reliability follow-ups (A1, partial) + +Reviewed against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. +The maintainer approved the recommended A1–A4 catch-up batch. This PR completes +the Claude portion of A1; the cursor stays at `beae2147a9487ec47ac992319f2216914b4cb62d` +because the 555-commit inventory was only partly assessed and selected. + +| Upstream | Decision | Pylon reference | Adaptation and validation | +| -------------------------------------------------- | --------------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `560afffdea82000d757c98ea79678aee75f8648c` / #9135 | adopted, awaiting merge | #268, `742751694b` | Reused the existing SDK and terminal-failure fix. | +| `a5bbad910f78cc14eef8baa94fe6f46676f78d5a` / #8853 | adopted, awaiting merge | #268, `f29e17e851` | Show Claude model-fallback notices through Pylon's existing warning events. | +| `940e8233c227a186044078e99e45e1933eb525e4` / #7165 | adopted with adaptation, awaiting merge | #268, `1e7ca23109` | Announce rejected usage windows once per turn/window, retain raw telemetry and incarnation/admission metadata. Use the generic model bucket because Pylon has no probed scoped-limit names. Server clock supplies the wait. | + +Validation: 96 Claude adapter tests and 81 runtime-ingestion tests pass; server +typecheck and targeted lint pass. The mobile diff-highlighter test that failed +on the old PR run passes locally (4 tests); the new CI run must confirm it. +Existing warnings feed web, desktop, and mobile for local and remote servers. +No other provider's adapter or Prime recovery changes. + +Deferred/watch recheck: DEF-7 remains before its November 1 revisit date. +DEF-8 is due after Expo 57 adoption and needs a separate split review; it is +outside this approved first batch. WATCH-1's upstream #5760 issue is now closed, +while #8097 remains open; its owner #114 needs a corresponding watch rewrite. +WATCH-2 and WATCH-3 still await replacement work, with November 1 checks. +The register rows are retained until that separate review records their outcomes. + +## 2026-09-05 — Codex quota history (A1, partial) + +Approved by the maintainer as part of A1–A4 against upstream +`f12d39359f0f76a64ff2d77959c5baf821df15be`. Adopted #8897 +(`75ab5ab3fb6ad35117da754644c404a31b2fed84`) as `eaca53d47f` on +`upstream/2026-09-05-codex-rate-limit`, awaiting PR merge. + +Thread read, resume, and rollback now accept `rateLimitExceeded` in Codex +history. The generator retains the compatibility extension. Kept Pylon's +account-plan coverage and excluded unrelated upstream async-question fixtures. +Four schema tests, package typecheck, and targeted lint pass. This changes the +server's Codex protocol decoder; all clients and connection modes benefit, +with no Pylon wire-contract or other-provider changes. + +The full review cursor is unchanged: this is one selected item from the +555-commit inventory. Deferred/watch outcomes are recorded with the Claude +portion of this batch (#268); no register or watch row is changed here. + +## 2026-09-05 — thread subscription startup (A2, partial) + +The maintainer approved A2 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. +Adopted #9521 (`9c9ae3dc0e94a957d9c4a61bb211caf914828054`) as `10a7fc4113` +on `upstream/2026-09-05-thread-subscription`, awaiting merge. Clean port: +attach the live consumer immediately before reading the snapshot, preserving +events emitted during snapshot loading. Applies to all providers and clients, +including local, remote, relay, and tunnel WebSocket connections. + +All 154 server-router tests pass; server typecheck and targeted lint pass. +The legacy rollback-filter test now waits for the client synchronization receipt +before publishing live events, so it does not depend on fiber scheduling. The new regression fails deterministically with the old consumer +startup and passes with the fix, using the synchronized marker rather than sleeps. +No client contract or Prime admission/recovery change. + +The cursor is unchanged for this partial selection. Deferred/watch results +are recorded with #268; no register or watch row changes in this PR. + +## 2026-09-05 — mobile saved-work protection (A3, partial) + +The maintainer approved A3 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. +Adopted #9710 (`7839140e5e93d3f401d7eb45b86cf1a234eb3609`) as `3be71f7e54` +on `upstream/2026-09-05-mobile-storage`, awaiting merge. Failed draft or outbox +reads now stop overwrites and attachment cleanup. Final flush can retry a failed +debounced read while preserving both saved drafts and new in-memory edits. + +Clean port preserving Pylon's draft fields and environment ownership. Mobile +only (iOS and Android), all providers/environments; no native dependencies, +contracts, or web/desktop changes. Both focused files pass (103 tests), as do +mobile typecheck, targeted lint, and formatting. No simulator/UI was launched. + +The cursor is unchanged for this partial selection. Deferred/watch results +are recorded with #268; no register or watch row changes in this PR. + +## 2026-09-05 — managed SSH process ownership (A4, partial) + +The maintainer approved A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. +Adopted #9843 (`f33fdc992488e36ccb70cbb71d55e630b5184cbd`, `b1773679e6`) +and its diagnostic follow-up #10088 (`39802c06117fae0b3da43624b0d54309c5437c72`, +`cab00ec792`) on `upstream/2026-09-05-ssh-runner`, awaiting merge. +The installed CLI replaces the shell directly, preserving the recorded PID +and graceful shutdown. Failed package installs retain npm's actual diagnostic +and cannot run an executable path printed alongside a failure. + +Clean port preserving package selection and Pylon runtime-home/identity rules. +Affects SSH-managed environments for all providers and their connected clients; +local, relay, and tunnel launch paths are unchanged. 33 focused runner/tunnel +tests, SSH typecheck, targeted lint, and formatting pass. Tests cover real owned +fixture processes, graceful stop/rebind, both npm fallbacks, and seven installer +outcomes per fallback. Unix fixture tests are skipped on Windows. + +The cursor is unchanged for this partial selection. Deferred/watch results +are recorded with #268; no register or watch row changes in this PR. + +## 2026-09-05 — relay client validation (A4, partial) + +The maintainer approved A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. +Adopted #9880 (`2c301fd0c4fc58c1612be47c3856fa4ad547429d`) as `f6eb6d547a` +on `upstream/2026-09-05-cloudflared-validation`, awaiting merge. Validate the +downloaded cloudflared executable with `version`; the pinned Windows binary +rejects `--version`. Clean port affecting relay setup on server/desktop and the +clients connecting through it, independent of provider. Other modes are unchanged. +Focused relay tests, shared-package typecheck, lint, and formatting pass. + +The cursor is unchanged for this partial selection. Deferred/watch results +are recorded with #268; no register or watch row changes in this PR. + +## 2026-09-05 — LAN and Tailscale pairing (A4, partial) + +The maintainer approved A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. +Adopted #9882 (`60e1b73948debac845c3dc72aac35c9adbd4cd64`) as `c76159b31a` +on `upstream/2026-09-05-pairing-endpoints`, awaiting merge. Clean port: do not +advertise a Tailscale interface as LAN, retain network access on Tailscale-only +hosts, and preserve explicit host overrides. The bootstrap warning now reflects +an actual local-only fallback. Pylon identity and runtime-home boundaries remain. + +Focused exposure tests, desktop typecheck, targeted lint, and formatting pass. +Applies to desktop-hosted environments and web/mobile pairing over LAN/Tailscale, +independent of provider; local-only and explicit HTTPS endpoint behavior stay +covered. No UI layout, protocol, or other launcher changes. + +The cursor is unchanged for this partial selection. Deferred/watch results +are recorded with #268; no register or watch row changes in this PR. + ## 2026-09-04 (targeted) — `beae2147a9487ec47ac992319f2216914b4cb62d..95103905f5`, lifecycle reliability only **Cursor deliberately not advanced.** This was a targeted review, not a full From 26e4a77f0948f0757c5852e679fc343bb46df704 Mon Sep 17 00:00:00 2001 From: Trevor Walker Date: Sat, 5 Sep 2026 20:43:27 -0600 Subject: [PATCH 3/3] docs(upstream): record merged catch-up outcomes --- .agents/upstream-review.md | 79 ++++++++++++++------------------------ 1 file changed, 29 insertions(+), 50 deletions(-) diff --git a/.agents/upstream-review.md b/.agents/upstream-review.md index a462aee12..238201627 100644 --- a/.agents/upstream-review.md +++ b/.agents/upstream-review.md @@ -45,9 +45,13 @@ backlog, not a count of changes Pylon must adopt. The implementation records below preserve each PR's adaptations and verification. They are consolidated here so independent code PRs do not compete to insert at the same ledger location. -All are awaiting merge at the time of this ledger update. Separate Pylon release -repairs #271 (temporary signing-keychain password) and #275 (pin the existing -patched Expo versions for fresh resolution) address publication and CI blockers. +All seven implementation PRs merged with green checks after explicit maintainer +approval on September 5 (September 6 UTC). Separate Pylon release repairs #271 +(temporary signing-keychain password) and #275 (pin the existing patched Expo +versions for fresh resolution) also merged with green checks. The combined +product tree matches the locally verified integration branch: 342 focused tests, +server typecheck, frozen installation, and release smoke passed. The signed +Nightly workflow remains the final publication check. Deferred register: DEF-7 remains **not yet**; its November 1 floor is unreached and this range has no macOS-preview workflow changes. DEF-8 is **due**: Expo 57 @@ -66,35 +70,28 @@ November 1 revisit floors. No new deferrals or watch entries were added. ## 2026-09-05 — approved Claude reliability follow-ups (A1, partial) Reviewed against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. -The maintainer approved the recommended A1–A4 catch-up batch. This PR completes +The maintainer approved the recommended A1–A4 catch-up batch. PR #268 completes the Claude portion of A1; the cursor stays at `beae2147a9487ec47ac992319f2216914b4cb62d` because the 555-commit inventory was only partly assessed and selected. -| Upstream | Decision | Pylon reference | Adaptation and validation | -| -------------------------------------------------- | --------------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `560afffdea82000d757c98ea79678aee75f8648c` / #9135 | adopted, awaiting merge | #268, `742751694b` | Reused the existing SDK and terminal-failure fix. | -| `a5bbad910f78cc14eef8baa94fe6f46676f78d5a` / #8853 | adopted, awaiting merge | #268, `f29e17e851` | Show Claude model-fallback notices through Pylon's existing warning events. | -| `940e8233c227a186044078e99e45e1933eb525e4` / #7165 | adopted with adaptation, awaiting merge | #268, `1e7ca23109` | Announce rejected usage windows once per turn/window, retain raw telemetry and incarnation/admission metadata. Use the generic model bucket because Pylon has no probed scoped-limit names. Server clock supplies the wait. | +| Upstream | Decision | Pylon reference | Adaptation and validation | +| -------------------------------------------------- | ------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `560afffdea82000d757c98ea79678aee75f8648c` / #9135 | adopted, merged | #268, `d066551673` | Reused the existing SDK and terminal-failure fix. | +| `a5bbad910f78cc14eef8baa94fe6f46676f78d5a` / #8853 | adopted, merged | #268, `09040d3386` | Show Claude model-fallback notices through Pylon's existing warning events. | +| `940e8233c227a186044078e99e45e1933eb525e4` / #7165 | adopted with adaptation, merged | #268, `015f653538` | Announce rejected usage windows once per turn/window, retain raw telemetry and incarnation/admission metadata. Use the generic model bucket because Pylon has no probed scoped-limit names. Server clock supplies the wait. | Validation: 96 Claude adapter tests and 81 runtime-ingestion tests pass; server typecheck and targeted lint pass. The mobile diff-highlighter test that failed -on the old PR run passes locally (4 tests); the new CI run must confirm it. +on the old PR run passes locally (4 tests) and passed in the subsequent CI run. Existing warnings feed web, desktop, and mobile for local and remote servers. No other provider's adapter or Prime recovery changes. -Deferred/watch recheck: DEF-7 remains before its November 1 revisit date. -DEF-8 is due after Expo 57 adoption and needs a separate split review; it is -outside this approved first batch. WATCH-1's upstream #5760 issue is now closed, -while #8097 remains open; its owner #114 needs a corresponding watch rewrite. -WATCH-2 and WATCH-3 still await replacement work, with November 1 checks. -The register rows are retained until that separate review records their outcomes. - ## 2026-09-05 — Codex quota history (A1, partial) Approved by the maintainer as part of A1–A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. Adopted #8897 -(`75ab5ab3fb6ad35117da754644c404a31b2fed84`) as `eaca53d47f` on -`upstream/2026-09-05-codex-rate-limit`, awaiting PR merge. +(`75ab5ab3fb6ad35117da754644c404a31b2fed84`) as `aac9a2a098` on +`upstream/2026-09-05-codex-rate-limit`, merged in #272. Thread read, resume, and rollback now accept `rateLimitExceeded` in Codex history. The generator retains the compatibility extension. Kept Pylon's @@ -103,33 +100,27 @@ Four schema tests, package typecheck, and targeted lint pass. This changes the server's Codex protocol decoder; all clients and connection modes benefit, with no Pylon wire-contract or other-provider changes. -The full review cursor is unchanged: this is one selected item from the -555-commit inventory. Deferred/watch outcomes are recorded with the Claude -portion of this batch (#268); no register or watch row is changed here. - ## 2026-09-05 — thread subscription startup (A2, partial) The maintainer approved A2 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. -Adopted #9521 (`9c9ae3dc0e94a957d9c4a61bb211caf914828054`) as `10a7fc4113` -on `upstream/2026-09-05-thread-subscription`, awaiting merge. Clean port: +Adopted #9521 (`9c9ae3dc0e94a957d9c4a61bb211caf914828054`) as `c1ca02c6dd` +on `upstream/2026-09-05-thread-subscription`, merged in #273. Clean port: attach the live consumer immediately before reading the snapshot, preserving events emitted during snapshot loading. Applies to all providers and clients, including local, remote, relay, and tunnel WebSocket connections. All 154 server-router tests pass; server typecheck and targeted lint pass. The legacy rollback-filter test now waits for the client synchronization receipt -before publishing live events, so it does not depend on fiber scheduling. The new regression fails deterministically with the old consumer -startup and passes with the fix, using the synchronized marker rather than sleeps. +before publishing live events, so it does not depend on fiber scheduling. The new +regression fails deterministically with the old consumer startup and passes with +the fix, using the synchronized marker rather than sleeps. No client contract or Prime admission/recovery change. -The cursor is unchanged for this partial selection. Deferred/watch results -are recorded with #268; no register or watch row changes in this PR. - ## 2026-09-05 — mobile saved-work protection (A3, partial) The maintainer approved A3 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. -Adopted #9710 (`7839140e5e93d3f401d7eb45b86cf1a234eb3609`) as `3be71f7e54` -on `upstream/2026-09-05-mobile-storage`, awaiting merge. Failed draft or outbox +Adopted #9710 (`7839140e5e93d3f401d7eb45b86cf1a234eb3609`) as `75197386f0` +on `upstream/2026-09-05-mobile-storage`, merged in #274. Failed draft or outbox reads now stop overwrites and attachment cleanup. Final flush can retry a failed debounced read while preserving both saved drafts and new in-memory edits. @@ -138,15 +129,12 @@ only (iOS and Android), all providers/environments; no native dependencies, contracts, or web/desktop changes. Both focused files pass (103 tests), as do mobile typecheck, targeted lint, and formatting. No simulator/UI was launched. -The cursor is unchanged for this partial selection. Deferred/watch results -are recorded with #268; no register or watch row changes in this PR. - ## 2026-09-05 — managed SSH process ownership (A4, partial) The maintainer approved A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. -Adopted #9843 (`f33fdc992488e36ccb70cbb71d55e630b5184cbd`, `b1773679e6`) +Adopted #9843 (`f33fdc992488e36ccb70cbb71d55e630b5184cbd`, `e4b0b66e1e`) and its diagnostic follow-up #10088 (`39802c06117fae0b3da43624b0d54309c5437c72`, -`cab00ec792`) on `upstream/2026-09-05-ssh-runner`, awaiting merge. +`a346798f15`) on `upstream/2026-09-05-ssh-runner`, merged in #276. The installed CLI replaces the shell directly, preserving the recorded PID and graceful shutdown. Failed package installs retain npm's actual diagnostic and cannot run an executable path printed alongside a failure. @@ -158,27 +146,21 @@ tests, SSH typecheck, targeted lint, and formatting pass. Tests cover real owned fixture processes, graceful stop/rebind, both npm fallbacks, and seven installer outcomes per fallback. Unix fixture tests are skipped on Windows. -The cursor is unchanged for this partial selection. Deferred/watch results -are recorded with #268; no register or watch row changes in this PR. - ## 2026-09-05 — relay client validation (A4, partial) The maintainer approved A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. -Adopted #9880 (`2c301fd0c4fc58c1612be47c3856fa4ad547429d`) as `f6eb6d547a` -on `upstream/2026-09-05-cloudflared-validation`, awaiting merge. Validate the +Adopted #9880 (`2c301fd0c4fc58c1612be47c3856fa4ad547429d`) as `cc434b9de2` +on `upstream/2026-09-05-cloudflared-validation`, merged in #277. Validate the downloaded cloudflared executable with `version`; the pinned Windows binary rejects `--version`. Clean port affecting relay setup on server/desktop and the clients connecting through it, independent of provider. Other modes are unchanged. Focused relay tests, shared-package typecheck, lint, and formatting pass. -The cursor is unchanged for this partial selection. Deferred/watch results -are recorded with #268; no register or watch row changes in this PR. - ## 2026-09-05 — LAN and Tailscale pairing (A4, partial) The maintainer approved A4 against upstream `f12d39359f0f76a64ff2d77959c5baf821df15be`. -Adopted #9882 (`60e1b73948debac845c3dc72aac35c9adbd4cd64`) as `c76159b31a` -on `upstream/2026-09-05-pairing-endpoints`, awaiting merge. Clean port: do not +Adopted #9882 (`60e1b73948debac845c3dc72aac35c9adbd4cd64`) as `6de83796db` +on `upstream/2026-09-05-pairing-endpoints`, merged in #278. Clean port: do not advertise a Tailscale interface as LAN, retain network access on Tailscale-only hosts, and preserve explicit host overrides. The bootstrap warning now reflects an actual local-only fallback. Pylon identity and runtime-home boundaries remain. @@ -188,9 +170,6 @@ Applies to desktop-hosted environments and web/mobile pairing over LAN/Tailscale independent of provider; local-only and explicit HTTPS endpoint behavior stay covered. No UI layout, protocol, or other launcher changes. -The cursor is unchanged for this partial selection. Deferred/watch results -are recorded with #268; no register or watch row changes in this PR. - ## 2026-09-04 (targeted) — `beae2147a9487ec47ac992319f2216914b4cb62d..95103905f5`, lifecycle reliability only **Cursor deliberately not advanced.** This was a targeted review, not a full