fix(settings): new threads stay in Full access unless you choose Auto

[incognitojam]

#928 made Auto the built-in default for new threads, which would switch every user who never picked a mode to Auto on update, with no notice. That is too broad a change to make silently. #928 has not shipped in a nightly or preview yet, so this lands before anyone gets it.

Change

• The built-in default for new threads goes back to Full access, the same as upstream. Settings that never chose a mode keep Full access.
• The rest of feat(settings): new threads default to Auto where the provider reviews actions #928 stays: choosing Auto as the default starts Claude, Codex and Grok threads in Auto and providers without their own reviewer in Full access, instead of asking about every action.
• docs/user/permission-modes.md, the styal differences entry and the fork ledger now describe Auto as an opt-in default. The ledger rationale notes that approval counts from opted-in users (feat(server): monitor Auto mode in the provider canary and turn analytics #930) are meant to inform whether Auto should become the default later.

Validation

• Contracts settings test is back to expecting Full access for configs that never chose a mode, and the per-provider resolver cases still pass; useHandleNewThread tests pass (193 total). Contracts typecheck clean; ledger validates.
• The per-provider behavior with Auto chosen is unchanged from feat(settings): new threads default to Auto where the provider reviews actions #928, where Claude and Codex drafts showing Auto and an OpenCode draft showing Full access were checked in the web app. I did not rerun the app for this constant change.

---

Written by an agent (Claude Code, claude-opus-5-5).

[github-actions]

Upstream divergence

Both sides are compared with upstream at the in-order tip 0ecb25a8d4. Excludes .repos/ and pnpm-lock.yaml.

Measure	Base	This PR	Change
Upstream files the fork changes	1,505	1,505	0
Lines changed in them	78,367	78,344	−23
Upstream files the fork removes	42	42	0
Fork-only files	549	549	0
Fork-only lines	101,106	101,104	−2

Upstream files whose difference changes (3)

File	Change	Now differs by
packages/contracts/src/settings.ts	−10	134 lines
packages/contracts/src/providerPolicy.ts	−7	14 lines
packages/contracts/src/settings.test.ts	−6	139 lines

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	4.9 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.8 KiB	20.8 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 503b919 · PR result: 73ab302 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.