[CallumAcorn]

Reviews all 61 upstream commits waiting since the last sync. Seven are taken, each is either security-positive or a correction with no feature impact, and every one of the 61 now has a ledger row. ./scripts/upstream-status.sh reports zero unreviewed.

Two test-suite defects, measured on the maintainer's machine

The test suite was rewriting the user's real usage cache. LocalUsageCache defaults to the real Application Support/PokeTokenBar/usage-cache.json and had no gate, so any test that ran real providers read and rewrote it. With the app quit, one full suite run changed the real file from 726,929 to 763,881 bytes, and a new checksum. Every test run in this fork had been modifying user data.

Path injection cannot catch this, because it only covers the test doing the injecting, not the whole test process. AppEnv.persistsToUserLocation now owns the rule: an injected path always persists, the default path only inside the app bundle. After the gate, I snapshotted every state file across a full run and none changed. The companion save was never at risk, since its tests all inject a path.

Tests could call Anthropic with the user's real token. UsageStore defaults its limits providers to the real ones, and about ten tests build a store without a stub. Whenever the Keychain grant happened to be live, a refresh in one of those spent the user's real rate limit, which the running app then backs off from. AppEnv.allowsLiveLimitsFetch now gates the real Claude and Antigravity fetches before any Keychain read, allowing them only in the app or with PTB_PARITY=1.

The gate had a side effect worth calling out: it made both Keychain-discipline tests hollow. Blocking before the provider runs makes "the automatic path never reads the Keychain" true for the wrong reason. Both now open the gate with KeychainReader stubbed, so the provider's real logic runs against a fake Keychain. The manual-path test had been querying the real Keychain, prompts allowed, during swift test.

A crash on corrupt Cursor data (chattymin#307)

LocalAdditionalUsageProvider had its own copy of intValue, separate from the LocalUsageReader one that got an upper bound after an earlier overflow crash. This copy had a floor but no ceiling, so parseCursorBubble's input + output trapped on a corrupt record. Verified: SIGTRAP with the old helper, clean parse with the clamp.

Pricing corrections (chattymin#304, chattymin#309, Opus 5.5)

This fork kept the model-family price fallback, so nothing showed as Unavailable, but the fallback was wrong for two models:

Model	Fallback charged	Correct	Error
claude-opus-5-5	Opus 5 rate	(4, 20, 5, 0.2)	25% high, 2.5x on cache reads
claude-sonnet-5	Sonnet 4 rate	(2, 10, 2.5, 0.2)	1.5x high

Cache reads dominate real usage, so the Opus 5.5 error mattered. claude-opus-5 happened to match the fallback and is now explicit so it cannot drift.

Declined on security grounds

chattymin#327 (track several Claude accounts, 3,419 lines) and the per-account session key are both built on the session key declined as chattymin#241, which stores a full account cookie in plaintext.

Deferred

Forty of the attempted commits conflicted, concentrated in Localization, CompanionStore, PopoverView and CompanionView: the files this fork has diverged most. Porting features into them is where existing behaviour breaks, so they are recorded as a new deferred disposition (wanted in principle, needs a deliberate port) rather than forced in. The most valuable of these is protecting legendary companions from accidental egg discard, which prevents data loss and is worth its own change.

Upstream's chattymin#334 independently arrived at exactly the Rare Candy re-arm design from #29, which is recorded as already present.

Verification

1072 tests, 0 failures, 90.27% coverage. All 24 hardening checks pass. Each fix verified by injection.

🤖 Generated with Claude Code