feat(pull requests): track viewed files against displayed diff

[rynfar]

Readers can now mark files viewed in a pull request while keeping local marks tied to the displayed patch, host, and signed-in account. GitHub uses host-native viewed marks; GitLab, Bitbucket, Azure DevOps, and Forgejo retain per-environment marks. The web diff shows viewed counts and Changed state, and mobile consumes the updated neutral result.

The mark carries a SHA-256 digest of the complete file section the reader actually saw. GitHub presses preflight that displayed section against a fresh host read. Environment-backed marks retain the displayed digest so later changes show as Changed, and a stale untick cannot erase a newer environment mark. GitHub reads and writes use one pinned CLI credential per request, while the client echoes the verified viewer and hides cached marks if account verification fails. Host writes are serialized per pull request. The wire fields are optional for older peers, with capability-gated controls and a new Pylon migration 063 for stored digests.

Depends on #798 (including its #785 checkout prerequisite) and the focused provider event-worker fix #828; this branch contains both reviewed prerequisites and must land after them. Adapted from upstream source 03950089ffa5cecf0ce731227f58551f6437495f. The implementation keeps Pylon's server-environment credential routing and excludes upstream account-routing changes.

Validation: 303 focused server/web tests for the viewed-files implementation, plus 138 ProviderService tests and the previously timed-out native-compaction case after #828; t3 and web typechecks, scoped lint/format and diff checks. Independent backend, client/contracts, React ownership, and combined-prerequisite reviews passed. Final-head repository CI is pending. A scratch merge with #806 is clean and passes the combined web typecheck, viewed-files hook tests, and CodeTab format check. No browser images or live host-account verification were taken because browser use needs separate authorization under AGENTS.md.

Limits: only complete, unambiguous whole-PR file sections can be marked; commit-scope and truncated/binary sections are excluded. External CLI account switches may leave old marks visible until the next visible 15-second/focus read, but writes fail closed against the displayed viewer. GitHub has no atomic compare-and-set between the diff preflight and its native mark API, so a concurrent push after the preflight remains possible. A partial provider read reports truncation.

Implemented with GPT-6 Sol in the Pylon Codex harness.

[vercel]

Deployment failed for project pylon-marketing with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/pylon-code?upgradeToPro=build-rate-limit

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	13.9 KiB	−19 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−17 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	+4 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.8 KiB	+5 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 3868597 · PR result: 5cc7cb3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Readiness hold: independent integration review found a concurrent-render scope leak in viewed-file batching and a stale header-render path. I am correcting both on the feature branch with focused regressions, then will request independent re-review and final-head CI before marking this ready.

[rynfar]

Scope/render race fix pushed at e7e1c0f. Queued writes now use commit-owned callbacks and are flushed during layout cleanup before a PR switch; retained handlers are fenced across A→B→A and unmount. The viewed checkbox header now follows rendered state through Pierre’s callback identity. Independent review passed the exact staged diff (SHA256 9d8beee6c1827d1b63421ed460400f34b215ed87fdd60270e61d084133627a84). Focused verification: 12 hook/header tests, web typecheck, scoped lint and formatting. The portal test models Pierre’s memoized callback boundary; no live DOM/worker or account run was performed. Keeping Draft pending final-head CI.

[rynfar]

Reviewed worker-start prerequisite #828 is now included via merge commit 5cc7cb3 (parents: previous #815 e7e1c0f and #828 466267e). This addresses the final-head Server 3 native-compaction timeout caused by deferred event-stream subscription. The exact failing case passes locally in 36 ms; ProviderService 138/138, viewed hook 11/11, and server typecheck pass. Issues independently reviewed the two-file combined diff and ancestry. New-head CI is pending, so this PR remains draft; external Vercel quota remains a separate check limit.

[rynfar]

Final-head repository CI is green at 5cc7cb3, including Test Server 3 and the native-compaction case that timed out on the prior head. Independent reviews of the viewed-files implementation, React scope correction, and #828 combined prerequisite are complete. Marked ready for review; no merge performed. Browser/live-account proof remains unavailable under the task authorization and is documented in the PR body.