fix(desktop): isolate preview keys and finish hold-to-quit

[rynfar]

Background preview automation could send Enter to the desktop composer and submit an unfinished draft. Keyboard packets now target the preview guest, preserve nested-frame routing and editing shortcuts, and wait for bounded native delivery receipts with cleanup on interruption. Hold-to-quit also continues its quiet-period watchdog when Q remains held after the modifier is released.

Cycle #497, frozen range 6c583620ff7ad3235b135af7107c0543467eecfa..4a4c6dd2adc350a68ba18bb28b24b5a7e4660dab.

Sources adopted:

• 095d57552c4579ce33a6560a76b7c643b92f00f9
• e816064945144957b6eb9b268912a98b0555644b

Pylon adaptations: preserved existing preview control epochs, runtime/profile identity, and native boundaries. The clipboard constructor test mock has an explanatory lint suppression.

Validation: 137 focused QuitHold, PreviewKeyboard, and Manager tests; desktop typecheck; changed-file lint and formatting. Upstream runtime before/after evidence is in pingdotgg/t3code#11354 (including preview draft isolation, nested frames, editing, and clipboard behavior); this is upstream evidence, not a rendered Pylon verification. No browser/computer use or packaged native macOS run performed in this port.

Implemented with GPT-6 in Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 12, 2026 6:20am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	14.0 KiB	−39 B (−0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−8 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.9 KiB	6.8 KiB	−31 B (−0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	14.1 KiB	14.1 KiB	−2 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	59.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: f3402be · PR result: 07f9f6d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent adversarial review completed against 07f9f6d856c6ca68e741efc4954ee57d0e6d2847: no actionable findings. Checked guest-only keyboard targeting, bounded delivery receipts, finally key-up cleanup, same/cross-process iframe scopes, interruption guards, sanitized cancellable editing commands, and hold-to-quit completion. Focused tests and desktop types passed; native macOS runtime verification was not performed. Final-head CI is green; landing under standing maintainer approval.