[jayleaton]

Opening another of my devices from the app still needed a pairing code, even when the two servers were already linked as tailnet devices.

tailnetDevices.openDevice now asks the device over the device session this server already holds there (POST /api/tailnet-devices/client-credential). The device authenticates that session like sync does, so a revoked device or a caller without the session gets nothing minted. It returns a one-time pairing credential and its own tailnet addresses. The credential's scopes follow the caller's current access there: full access gets the standard client scopes. Anything lower opens read-only, because app sessions carry no agent mode ceiling. A 401 re-runs the handshake once, and the answer must name the device that was asked.

In client-runtime, ConnectionOnboarding.registerDevice spends the credential only at the first address whose descriptor answers as that device, and then pairs as usual.

The UI hookup belongs to Doug C's feat/linked-devices-rows, which already owns the tailnetDevices atoms.

Tests:

• credentials come from the device and follow a changed access level;
• revoked and session-less callers get nothing minted;
• onboarding skips an address that doesn't answer.

Opus 5.5 via Claude Code (Doug B)

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.1 KiB	5.0 KiB	−6 B (−0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.3 KiB	−6 B (−0.5%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: a74ab4f · PR result: 2d93f1a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.