Takeover of pingdotgg/t3code PR 19191, head 5ebb9aa198f9d91824f6cc723c649421520ede6b.
Bottom context layer 2503bd508df4fa5f827f6c23cef252fc65596134; pinned main 1451e7cb23034d29774338608368a15d8845df36.

Before / after behavioral proof:
- Main context tests: 44 passed / 3 failed, all missing repository; rebuilt bottom: 47 passed.
- Legacy URL precedence followup: existing row with unrelated explicit PR context failed 415; URL repository precedence restores 200 without adding a case.
- Before SSO fallback: 44 passed / 4 failed, all HTTP 415 instead of 200; rebuilt top: 48 server + 3 mobile passed.
- Service-layer runtime integration initially returned HTTP 500: GitHubMediaFetch was supplied at construction time but unavailable in request context. HttpRouter.provideRequest fixes the application wiring; no test-only compatibility layer.

Live full production dev-server proof (actual server.ts route composition) through the GET asset route, real RPC input schema decoding, signed capability minting and resolution:
- Explicit PR context enterprise/private survives a personal/unrelated checkout.
- Mock GitHub upload returns SSO HTML. Mock GitHub markdown POST uses enterprise/private.
- Full fetch returns HTTP 200, exactly 10 binary bytes.
- Next Range bytes=2-5 returns HTTP 206, exactly 4 bytes, Content-Range bytes 2-5/10.
- One Markdown render shared across both requests; no checkout identity lookup.
- Bearer appears only on original github.com upload, never on the signed target or range fetch.
- Also independently reproduced the same bytes/status/cache behavior in a disposable loopback route harness.

This is actual full production server/route/service execution over HTTP with only external GitHub fetch responses mocked. The dev server uses the worktree’s isolated .t3 home and a synthetic fixture token; no live credentials are used. It is not a live GitHub SAML/EMU account test or a full client UI/playback test.

Focused tests also cover old-client checkout fallback, legacy upload repository, account fingerprint changes, cached signed URL 403 refresh, TTL expiry, fresh service instances, and immediate private-media login. Related suites and scoped server/web/mobile/contracts types passed; targeted lint/format passed with one pre-existing test warning. Scoped Knip reports unrelated existing exports; no finding in changed files.

Not verified: real SAML/EMU organization and signed URL response, Electron desktop, macOS, Windows, iOS, Android, real native video playback, full app media UI, remote/relay/tunnel execution. Human approval of the authentication-sensitive external calls remains required before merging. No merge performed.