feat(settings): add scoped project overrides and agent permissions

[rynfar]

Pylon settings currently split project defaults between legacy aggregate fields and individual override maps. This ports generic project overrides and environment/project selectors, so connected checkouts can inherit defaults or override supported settings while retaining their environment identity.

The selected scope now drives new-thread model, workspace and permission defaults, background text generation, automatic settlement, restart continuation, and independent browser/device access. Provider settings gain shared rows and model bulk toggles; Usage opens on Limits; model defaults become Astra medium and Fable 5.1 medium.

Pylon adaptations preserve unavailable-provider admission, Prime maintenance/rollback and shutdown, typed provider mutation receipts, mobile runtime coercion, and legacy project-action writes. Legacy aggregate edits replay from the persisted journal with an atomic cursor so delayed events cannot undo a newer canonical reset. Mixed-version environments advertise supported capabilities, and partial saves identify skipped targets. Authenticated device tools honor project grants while retaining exact-thread authorization and global device support; helper setup continues targeting the selected environment.

Cycle #497; all nine sources below belong to the frozen upstream range 6c583620ff7ad3235b135af7107c0543467eecfa..4a4c6dd2adc350a68ba18bb28b24b5a7e4660dab. Based on merged #510 and #511 (a1f748bcca483289c708161c4e28d556106696f6).

Source	Outcome
e16b8b059c9f5ff6dfed1addecffb831c6aee043 feat(web): add provider model bulk toggle (#10947)	adopted with Pylon adaptations. Provider model enable-all/disable-all actions and tests adopted. Existing provider admission and Pylon provider-instance controls retained.
05d404210058d714cfef902517fc20ad66b82339 feat(web): open Usage on the Limits tab by default (#11261)	adopted with Pylon adaptations. Limits becomes the default tab on web/mobile. Retains Pylon local-storage schema and legacy preference compatibility.
2c0e891740f86205784506a974096cf110b64da7 feat(settings): add per-project overrides for scopable server settings (#11176)	adopted with Pylon adaptations. Generic sparse per-project server settings with migration and all affected server consumers adopted. Pylon additions preserve raw provider admission, Prime shutdown/fences, crash-safe legacy aggregate compatibility, and mixed-version gates. Browser/device grants resolve independently per project, pull-request access remains available, and authenticated device tools honor project grants while enforcing the exact thread and global device support.
8b2c0465def151f022e01dd04b1b6ba3859bd714 feat(web): pick settings environment and project as two selects (#10636)	adopted with Pylon adaptations. Environment and project selects plus settings routing/grouping adopted. Pylon scoped environment identity, disconnected target handling and project icon support retained.
e22040dfc190d04573238c5db2e69df72e5f1017 feat(settings): edit any scopable setting as a project override (#10639)	adopted with Pylon adaptations. Generic settings scope/provider shared rows and every consumer adopted with Pylon scope fanout, project actions legacy fallback, mobile continuation controls, independent permissions and font handling retained. Device permissions expose project inheritance; helper setup follows the header environment and retains Pylon diagnostics without showing the environment permission switch at project scope.
4a8ab1b720c41b035dc4b7c58030ed62fbe6bd7f feat(web): mark projects on another machine in project pickers (#11323)	adopted with Pylon adaptations. Other-machine badges in composer/sidebar/menu/project selectors adopted, retaining Pylon machine presentation and environment identity.
1f73a89fc4d5c8b3e188282aeb8173f8f8bf257b fix(models): default to astra medium and fable 5.1 medium (#11347)	adopted with Pylon adaptations. Astra medium/Fable 5.1 medium model defaults adopted. Uses the parent-owned qualified-model-id dependency already present on the current pylon base; the duplicate pick was dropped by rebase as patch-equivalent. Upstream updatedAt metadata omitted because Pylon manifest uses its own validation/cache schema; all functional model-default behavior ported.
4d16e6bc6f0be52c5d44b8864000c70c7825e4f7 fix(web): align provider settings with shared settings rows (#10571)	adopted with Pylon adaptations. Shared provider rows adopted while retaining Pylon Prime managed maintenance/rollback controls, unavailable-provider reasons, usage stats, Antigravity setup/authentication controls and per-instance secrets.
cf1ba3d7da98357243ee056d2fd358eed8171981 feat(settings): configure default permissions for new threads (#11346)	adopted with Pylon adaptations. Default new-thread permission mode adopted in contracts/server/web/mobile/restart consumers, preserving Pylon runtime-mode coercion and explicit model/interaction choices. Adds explicit defaultRuntimeMode capability to prevent mixed-version silent patch stripping.

Validation: 719 focused tests in 36 files and six affected package typechecks passed after combining the device and pull-request lanes. Scoped lint and workspace export analysis passed. The final license rebase retained all 16 reviewed patches; 122 tests in eight affected navigation/mobile/shared suites and web/mobile/shared typechecks pass on the final head. Formatting and scoped lint pass (existing React-effect warnings remain); all ten jobs in final-head CI passed, including Linux/Windows packaged smoke. Vercel’s optional marketing preview reported a build-quota limit before building; it is separate from the green Actions result.

Adversarial review: the PRs lane reviewed scope resolution, migration/replay, model admission, provider secrets/Prime ordering, and action compatibility. Root reviewed planner capability handling and fail-closed restart continuation. Device/settings owners independently reviewed the downstream permission fix and scoped UI fix. Findings were fixed and re-reviewed; the PRs owner independently approved the final license navigation/mobile/export overlap at d1409a322381cc0a3d8ddfca39b8099726d1c00c.

Visual evidence: component/logic rendering tests pass. Before/after images were not captured because the task brief excludes browser/computer use; no live visual verification is claimed.

Model: GPT-6. Harness: Codex.

[vercel]

Deployment failed for project pylon-marketing with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/pylon-code?upgradeToPro=build-rate-limit

[rynfar]

Final landing review verified exact head d1409a322381cc0a3d8ddfca39b8099726d1c00c. Independent review covered all nine sources, settings navigation and search, scoped inheritance/reset, legacy replay, unavailable model defaults, Stop/restart continuation, and device capability authorization. The final rebase preserved all 16 patches. All 10 Actions CI jobs passed in run 34680506388.

The exact settings and compaction heads were also composed at 7b07ec9e621c84d7c18d17b7c18bf6436cc70678: both owners approved the four automatic overlaps, with 266 focused tests and server/web typechecks passing. Vercel preview status is unavailable due to the account build-rate limit; branch protection has no required Vercel context. No quota, deployment configuration, or external plan was changed.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	14.1 KiB	−3 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	14.1 KiB	14.0 KiB	−54 B (−0.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.8 KiB	−55 B (−0.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	59.6 KiB	−88 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: a1f748b · PR result: d1409a3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.