chore(upstream): adopt the 2026-08-15 T3 Code batch

.agents/upstream-review.md

@@ -1,8 +1,8 @@
 ---
 remote: t3code-upstream
 branch: main
-reviewed-through: "1add47b322ab1dfb5010bb363613650176b88088"
-reviewed-through-date: "2026-08-14"
+reviewed-through: "a5e29edeec34fdfab1d44e643b0d12bb924fd261"
+reviewed-through-date: "2026-08-15"
 ---
 
 # T3 upstream review log
@@ -1132,6 +1132,106 @@ identical to upstream, which rules out patch divergence as the cause.
 
 Deferred register: unchanged and still empty.
 
+## 2026-08-15 (full batch) — `1add47b322ab1dfb5010bb363613650176b88088..a5e29edeec34fdfab1d44e643b0d12bb924fd261`
+
+One hundred upstream commits. `277a7cb44` / `#4899` was already adopted out of band
+earlier the same day (the targeted review above), leaving 99 candidates. **93 adopted**
+onto `upstream/2026-08-15-batch`, **6 skipped**. The developer's decision was "everything
+except Tier C, Pylon branding wins any conflict", so the table below records the two
+Pylon-first departures from a mechanical adoption rather than a per-commit list.
+
+This is the largest batch adopted so far and it is overwhelmingly repair: **86 of the 99
+candidates are `fix`**. Upstream spent the day merging its backlog of old community pull
+requests, which is why so many #4xxx/#5xxx numbers land at once.
+
+Grouped decisions, by area rather than by commit — every candidate not named as skipped
+was adopted:
+
+- **Server and orchestration (12)** — bounded thread activity hydration, the wire
+  projection for streaming `tool.updated`, the provider title mirror no longer clobbering
+  real titles, receipt replay scoped to its own aggregate, snoozed threads settling
+  immediately, SQLite `busy_timeout` instead of `SQLITE_BUSY`, surviving a write to a dead
+  socket, valid MCP preview results, a raisable discovery probe budget, install scripts in
+  npm-global provider updates, long-running git pushes, and files named `HEAD`.
+- **Providers (11)** — six Claude fixes (session-scoped "Always allow", pending user-input
+  settling on stop, command lifecycle messages ignored, hooks skipped during capability
+  probes, repo-local `.agents/skills` discovery, hermetic Windows tests), two Codex, one
+  spanning Codex/Cursor/Grok, OpenCode config inheritance, and the Ultracode description.
+- **Web (38)** — the global styling refactor, panels, sidebar, theme, markdown, transcript,
+  and eight composer fixes.
+- **Desktop (7)**, **mobile (5)**, **source control and pull requests (7)**, **SSH (2)**,
+  **terminal (2)**, **marketing (1)**, **shared (1)**.
+
+Four Pylon-authored commits close the batch: `70fd3fa2b` rebrands what the batch dragged
+in, `46abbcf18` repairs three conflict resolutions, `d50270899` restores the lockfile, and
+`998848720` corrects two keep/drop calls.
+
+**The lockfile nearly shipped broken.** Resolving the styling-refactor conflict reverted
+`pnpm-lock.yaml` to its `origin/pylon` state, silently undoing what the Windows
+update-install pick had added one commit earlier. The branch was then requiring
+`msgpackr-extract` and `@electron/asar` without locking either, and recording the _old_
+`@ff-labs/fff-node` patch hash against the _new_ patch file — the one that fixes asar
+unpacking. `@t3tools/scripts` failed to typecheck and all 53 of its tests failed to load.
+Regenerated with Pylon's pinned pnpm in `d50270899`. **Whenever a conflict resolution runs
+`git add -A`, check `pnpm-lock.yaml` separately.**
+
+**Watch item for the next batch:** upstream `e58cbb9e7` / `#6663` amends `#6665`, which
+this batch adopted, tightening the theme selector to
+`html[data-theme-id]:not([data-theme-id=""])`. It sits just past this cursor. No Pylon code
+path was found that sets `data-theme-id` to the empty string, so this is drift-closing
+rather than a known defect.
+
+| Change set | Upstream                            | Decision | Pylon reference | Rationale or revisit condition                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| ---------- | ----------------------------------- | -------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| G1         | `d7abd7f3b` + `804cba430` / `#6657` | skipped  | `—`             | A feature and its own revert, both inside this range. Verified they cancel exactly (`git diff d7abd7f3b^ 804cba430` is empty), so adopting the pair is 32 conflicting files for a net no-op.                                                                                                                                                                                                                                                        |
+| G2         | `e25021af7` / `#4128`               | skipped  | `—`             | AUR packaging: `t3code-bin` / `t3code-nightly-bin` PKGBUILDs pointing at `pingdotgg/t3code` releases, plus a publish workflow needing T3's AUR SSH secrets. Entirely T3 distribution infrastructure. Revisit only as a Pylon-owned `pylon-bin`.                                                                                                                                                                                                     |
+| G3         | `e9ae134c5`                         | skipped  | `—`             | Routes feature requests to `pingdotgg/t3code` Discussions. T3 repository governance; Pylon's README and CONTRIBUTING are its own.                                                                                                                                                                                                                                                                                                                   |
+| G4         | `2fc676239` / `#3929`               | skipped  | `—`             | Strips a stray newline from the `CLAUDE.md` symlink target. Pylon's symlink is already 9 bytes (`AGENTS.md`, no trailing newline), so this is already true here.                                                                                                                                                                                                                                                                                    |
+| G5         | `db3278f97` / `#4542`               | skipped  | `—`             | **Pylon already fixed this.** Upstream lifts the mobile hero's Grok mark clear of the headline by moving it to `top: 44px` centred; Pylon did the same thing independently in `ad1693bb3` at `top: 150px` left-aligned, tuned against Pylon's own resized hero (`b732d74ed`). Taking upstream's coordinates would apply T3's geometry to different artwork. The cherry-pick reduced to empty and was dropped.                                       |
+| G6         | `ad117235b` (partial) / `#6201`     | adopted  | `dc7fcfafa`     | DMG installer backgrounds and the production macOS icon pipeline. **Mechanism adopted, artwork rebranded** in `70fd3fa2b`: upstream's SVGs carry a "T3 CODE" wordmark and "Drag T3 Code to Applications". The pipeline itself is correct for Pylon unchanged, because `assets/prod/black-macos-1024.png` is already Pylon artwork despite the compatibility-named file. Upstream's retirement of `apps/desktop/resources/icon.*` was taken with it. |
+
+Two further Pylon-first departures inside adopted commits, both recorded here because a
+future reader will otherwise read them as mistakes:
+
+- **`7afa184a9` / `#4781`** ("keep send reachable while a turn is running on mobile").
+  Upstream removes its early `if (isRunning) return stopButton` and shows the real send
+  button beside stop on mobile viewports. Pylon already solved the same problem
+  differently, with a dedicated queue-follow-up button shown on _every_ viewport — but
+  gated on `supportsSessionInputQueueFollowUp`, a **provider capability**, so providers
+  without a session input queue still had upstream's bug. The two were composed rather
+  than chosen between: the running branch now prefers Pylon's queue affordance and falls
+  back to upstream's plain send when the provider has no queue. Upstream's stop-button
+  sizing condition (`showSendWhileRunning && hasSendableContent`) was taken as-is; it now
+  also governs the queue case, so on a mobile viewport with a queue-capable provider and
+  an empty composer, stop renders 32px beside a disabled 36px queue button. Pre-existing
+  mismatch, narrowed rather than introduced — worth tidying if the row ever looks wrong.
+- **`d5465aebf` / `#4755`** ("retain terminal PR badges after checkout switch"). Upstream's
+  import of lucide's `TerminalIcon` was taken during conflict resolution and then removed:
+  Pylon renders that indicator as `DotMatrix state="terminal"`, not a lucide glyph with
+  `animate-status-pulse`, which Pylon's taste rules forbid.
+
+**Verification.** Typecheck clean across all nine packages (`t3`, web, contracts, shared,
+client-runtime, mobile, desktop, scripts, marketing). `vp lint` exits 0 with three warnings,
+all in upstream-authored code and none in a Pylon resolution. `vp fmt --check` clean over
+2,898 files. Tests: web 2,758 in 283 files; client-runtime 658; shared 355; contracts 342;
+scripts 53; server orchestration/provider/persistence/vcs/pullRequest/mcp/sourceControl.
+`node scripts/export-pylon-brand-icons.mjs --check` reports 39 files current.
+
+Two test notes for whoever runs these next:
+
+- **`apps/server/src/provider/accountDrainEndToEnd.test.ts` hangs for 120s and fails.** It
+  fails **identically on a clean `origin/pylon` worktree**, so it is pre-existing and not
+  batch fallout. Not investigated further here.
+- **`scripts/build-desktop-artifact.test.ts` fails when run from inside Pylon.** The
+  cross-architecture probe test asserts no spawned command carries
+  `ELECTRON_RUN_AS_NODE=1`, but an Electron host exports that variable and the code under
+  test spreads `process.env`. Run it with `env -u ELECTRON_RUN_AS_NODE`; 53/53 pass. CI is
+  unaffected.
+
+**No integration pass in a real client.** No browser, desktop, or mobile run — the batch
+touches the composer, sidebar, theme, DMG chrome, and the PWA manifest, so a web pass is
+the obvious next step.
+
 ## Deferred register
 
 _The register is currently empty. DEF-1 and DEF-2 were adopted on 2026-08-11

.macroscope/check-run-agents/ui-consistency.md

@@ -0,0 +1,82 @@
+---
+title: UI Consistency
+model: claude-opus-5
+effort: high
+input: full_diff
+tools:
+  - browse_code
+  - git_tools
+  - github_api_read_only
+  - modify_pr
+include:
+  - "apps/web/src/**/*.ts"
+  - "apps/web/src/**/*.tsx"
+  - "apps/web/src/**/*.css"
+conclusion: failure
+showToolCalls: true
+---
+
+# UI consistency review
+
+Review changed web UI code and directly affected call sites for consistency with the shared component system, Tailwind ownership, and the behavioral constraints below. Apply these rules when a pull request creates, moves, or modifies controls or styling. Do not demand unrelated repository-wide cleanup.
+
+The goal is not to minimize CSS or class counts at any cost. The goal is to put each behavior in the smallest correct owner while preserving interaction, theming, accessibility, layout, and browser behavior.
+
+## Shared controls and variants
+
+- Prefer the core UI primitives in `apps/web/src/components/ui` over native controls or locally reconstructed primitives. In ordinary product UI, a raw `<button>` that recreates `Button`, a raw input that recreates `Input` or `InputGroup`, or a local trigger that recreates `Select`, `Toggle`, or `Menu` is a concrete finding.
+- Do not flag raw elements that intentionally implement a semantic row, tab, resize handle, swatch, image target, editor surface, or another interaction whose behavior or geometry differs from the core primitive.
+- When multiple call sites repeat the same durable geometry or treatment, prefer a named primitive size or variant. Examples include compact controls, micro icon actions, muted ghost actions, and glass actions. Keep contextual layout, width, and color at the call site.
+- Flag large call-site class strings that override a primitive's core height, radius, padding, focus ring, cursor, hit target, or base state colors. Prefer extending the primitive contract when the same pattern is genuinely shared.
+- Preserve accessibility and interaction semantics during migrations: focus-visible rings, disabled behavior, loading state, keyboard behavior, pointer cursor, `aria-*`, Base UI or Radix render/close props, and coarse-pointer hit targets.
+- Do not require tests for a tiny visual-only class migration. Require focused tests when primitive composition changes behavior, prop forwarding, state transitions, keyboard handling, or width/defaulting logic.
+
+## CSS and Tailwind ownership
+
+- Ordinary one-owner presentation belongs in the owning TS or TSX module as static Tailwind classes or owner-level CSS variables. Examples include local geometry, spacing, typography, backgrounds, borders, simple vendor pseudo-elements, and component-only positioning.
+- Keep global CSS when it is genuinely reusable or behaviorally complex: generated markdown or imperative DOM, custom elements and shadow roots, masks, shared or complex pseudo-elements, animations, glass composition, runtime theme variables, safe-area calculations, scrollbar-lane preservation, Electron drag regions, and browser/vendor integration. Simple owner-local pseudo-elements may still belong in the owning module.
+- Before calling a selector dead, trace literal, dynamic, generated, imperative, test, custom-element, and shadow-root consumers. Search both the emitted class string and any class-valued field names through their final DOM sink. A helper returning a class is not proof that it is rendered, and a missed downstream property read can make a deletion unsafe.
+- Flag duplicate declarations only after comparing cascade layer, selector specificity, inheritance, runtime theme scope, media/variant scope, and the final owning element. Textually identical declarations are not necessarily behaviorally redundant.
+- When moving CSS into Tailwind, preserve selector scope and cascade ownership. A utility at the owner is preferable to a fragile global override that depends on stylesheet order.
+- Do not request moving complex global behavior into arbitrary Tailwind merely to reduce `index.css`. Do not preserve ordinary one-owner CSS merely because it already exists globally.
+
+## Themes and generated CSS
+
+- Use the project variants for theme-only declarations:
+  - dark-only declarations use `@variant dark`;
+  - light-only declarations use `@variant light`;
+  - raw `.dark` should remain only in the `dark` and `light` custom-variant definitions.
+- Preserve custom themes and runtime token bridges. Removing a variable or selector is safe only when all runtime, inspector, generated, and theme-palette consumers are accounted for.
+- Inspect emitted production CSS after unusual variants, arbitrary selectors, nested pseudo-elements, or attribute matching. Source syntax that looks valid is insufficient.
+- Flag malformed or empty emitted selectors such as empty `:is()` or `:not(:is())`, selector branches that can never match their own class attribute, and transformations that silently drop the intended rule.
+- Prefer source-level logic over clever selectors when behavior depends on consumer-provided class strings. Preserve `MenuPopup`'s current defaulting contract: a string `className` containing a `w-*`, `min-w-*`, or `max-w-*` utility after variant prefixes are stripped suppresses `min-w-32`; a string without one and a functional/non-string `className` keep the default. Arbitrary width values count as width utilities, and the consumer class must be merged last so it retains control. Do not replace this with a raw class-attribute substring selector.
+- Do not fail solely because a valid emitted selector is verbose or because a source rule uses an intentional custom property.
+
+## Scroll and virtualized lists
+
+- `ScrollArea` owns and masks its Base UI viewport. A virtualized list usually owns a native scrolling element and cannot automatically reuse viewport-specific `ScrollArea` behavior.
+- Repeated native or virtualized overflow fades should use the shared virtualized-scroll-fade contract rather than component-named mask selectors.
+- Preserve runtime top and bottom overflow state. Do not replace dynamic fades with an always-on static mask.
+- Preserve fade geometry and keep the native scrollbar lane opaque so the track and thumb stay visible and usable. A visually similar mask that fades the scrollbar is a regression.
+- Verify actual scroll behavior when changing virtualizers, masks, overflow ownership, or scrollbar selectors. Source-level class comparison is not enough.
+
+## Visual and layout preservation
+
+- Preserve responsive geometry, titlebar insets, panel and inline-preview modes, desktop Electron layout, light and dark contrast, clipping, radius, and composable shadows.
+- For meaningful visual changes, prefer available real-app evidence using the actual component and state. A mock recreation does not validate the real component. Light and dark evidence is useful when theme-sensitive styles change, but missing or inaccessible evidence alone is not a finding; report only a concrete regression supported by the diff, code, or available artifacts.
+- Do not treat a screenshot as proof of keyboard, overflow, scrollbar, responsive, or runtime-theme behavior. Pair visual evidence with source, computed-style, emitted-CSS, or interaction checks as appropriate.
+- Be alert to shared primitive color indirection. When a primitive routes icon color through a CSS variable, ensure migrated contextual icons retain their intended tone, including pressed and disabled states.
+
+## Change discipline
+
+- Review the pull request's changed scope and directly affected consumers. Do not turn a focused PR into a demand for unrelated legacy cleanup.
+- Prefer the smallest durable contract over a component-specific workaround or a broad abstraction with one consumer.
+- Preserve intentional exceptions and comments that explain browser, virtualizer, theme, or Electron constraints.
+- If a proposed cleanup cannot prove ownership or semantic equivalence, ask for evidence or leave it unchanged rather than guessing.
+- Select verification gates according to the changed behavior: typecheck or focused tests for typing and interaction contracts, production build and emitted-CSS inspection for Tailwind or selector transformations, and real-app evidence for meaningful visual behavior when available. These gates are complementary when applicable, but do not require every gate for tiny visual-only migrations or fail solely because an artifact the configured tools cannot produce is absent.
+
+## Reporting
+
+Report only concrete violations introduced by changed lines or behavior, plus pre-existing behavior that the patch directly makes relevant or worsens. Touching a large file does not make unrelated retained issues reportable. Prefer precise inline comments on the smallest relevant line range. Explain the broken behavior or ownership rule, not merely the preferred syntax, and state the smallest expected fix. A clear consistency or regression risk may fail the check. Do not fail for optional aesthetic preferences, harmless class ordering, or unrelated legacy code.
+
+This check defaults to failure. When there are no findings, stop immediately and make the entire final response exactly `All clear` on one line. Do not add a title, explanation, punctuation, Markdown, JSON, or trailing analysis, and do not continue reasoning after deciding the review is clean.