upstream: adopt the 2026-09-03 T3 batch, pass two (in progress)

[rynfar]

Pass two of the 2026-09-03 upstream adoption: the commits that conflicted in
pass one and need hand merges. This PR is still being worked — I am pushing as
I go so progress is visible. 70 of the approved 149 remain after this.

Each commit here was resolved by hand, typechecked, and verified with its own
tests before landing.

Resolutions worth review

• #9146 inline citations — Pylon has two messageText call sites where
  upstream has one. The citation flattening belongs only on title and branch
  generation; applying it to the second would have sent pre-expanded text to the
  provider and left ProviderService's own expansion with nothing to do. A
  follow-up commit fixes that and waits for the provider send, since Pylon
  admits a turn before starting it.
• #9154 Grok — upstream extracted sendInitialize for its new health probe
  and in doing so bypassed runStartupRpc, Pylon's startup RPC timeout. Kept
  upstream's shape with Pylon's guard inside, so the probe cannot hang.
• #9164 sticky model selections — upstream's migration 044 renumbered to
  Pylon's 053; Pylon holds 044 through 052. Its test lives inside
  016_CanonicalizeModelSelections.test.ts with hardcoded migration boundaries,
  which moved with it.
• #9147 shared preferences — merged Pylon's provider-instance mutation route
  with upstream's shared/local split. providerInstances is not a shared key,
  so it bypasses the split.
• #8910 file breadcrumbs — upstream's test assumes the first observed
  workspace mutation refreshes. Pylon deliberately seeds the first one without
  refreshing, because refreshing would cancel the atom's own mount read. Test
  adapted to Pylon's semantics rather than changing Pylon.
• #5302 / #6554 — Pylon naming kept, upstream behaviour taken.

Parked

#7941 (attachments held until commit) resolves cleanly but its new test never
reaches sendTurn. Pylon's reactor is 2401 lines to upstream's 1641 and admits
turns before starting them. The waitFor fix found while adopting #9146 looks
like the same shape and may unpark it.

Made with Opus 5 in Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.7 KiB	+87 B (+0.6%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+5 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+82 B (+1.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.5 KiB	57.3 KiB	+822 B (+1.4%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+1 B (+0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.2 KiB	58.2 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: bfe695f · PR result: 9c3618f · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.