chore(upstream): sync marcode through f2d5fc91

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.

[maarco]

What Changed

Merges pingdotgg/t3code@f2d5fc91e3030e5c3956fdadc13e1eaa25bcabe3 (25 commits since 82b8a938) into main as a normal two-parent merge. Merge commit 8141f4d2; merge base 82b8a938.

Headline upstream work: macOS launchd support for the background service, browser tab mute, letter shortcuts on the right-panel surface dropdown, npx t3 triage, a settle-once rule for merged PRs, Clerk upgrades, and a batch of desktop fixes.

Conflicts resolved by hand (6)

Path	Decision
apps/server/src/cli/connect.ts	Took upstream's platform conditionals for the launchd flow; kept Marcode's product name in the strings.
apps/server/src/cli/service.ts	Same, plus upstream's Linux with systemd, macOS with launchd support line.
apps/web/src/components/ChatView.tsx	Kept Marcode's slim ChatHeader (the action cluster is portaled into FloatingPillNav, panelLayoutControls is mounted at the workspace root). Upstream's changeRequestState → changeRequest rename is taken where it matters — the settle memos. Seam comment added.
apps/web/src/components/chat/ChatHeader.tsx	Kept Marcode's slim cluster. The upstream hunks only add the thread action menu and inline rename Marcode deliberately does not mount here, so nothing upstream is dropped.
apps/web/src/components/RightPanelTabs.tsx	Took the tab mute feature and the whole data-driven surface dropdown with shortcuts. Dropped only what addresses the retired right-panel file surfaces: the Files entry, copy-path, the Files icon, PierreEntryIcon.
packages/client-runtime/src/state/threadSettled.ts	Both sides changed the same rule. Upstream added a settle-once anchor; Marcode has a one-hour warm window. They guard different things, so both now apply, pinned by a new test.

Fork-boundary breaks that merged cleanly, with no conflict

These are the dangerous ones — each would have shipped silently broken.

• bootService.ts — upstream's new launch agent exported T3CODE_HOME. resolveLauncherBaseDir only accepts MARCODE_HOME, so the macOS background service would have exited before starting a server. Also namespaced BOOT_SERVICE_LAUNCHD_LABEL to app.marcode.service for the same reason BOOT_SERVICE_UNIT_FILE is marcode.service: upstream's shared label would make a Marcode install and a T3 Code install fight over one LaunchAgent plist. T3_BOOT_SERVICE_UNIT stays upstream-shaped.
• cli/triage.ts — the new triage command read T3CODE_HOME, so it would have collected the wrong machine's state.
• bootService.test.ts — a new upstream assertion hardcoded systemctl --user disable --now t3code.service. Fixtures now derive from the exported constants.
• RightPanelTabs.tsx — upstream's new addSurfaceActions array referenced props.filesAvailable, props.onAddFiles, and SURFACE_DISABLED_REASONS.files, none of which exist in Marcode.
• .github/triage/PLAYBOOK.md + cli/triagePrompt.ts — the playbook told the agent to clone pingdotgg/t3codeat the user's release tag and file the issue there. Marcode tags do not exist upstream, so triage would have fetched the wrong source and misfiled every Marcode bug. Retargeted to maarco/marcode; the two copies stay byte-identical (a test enforces that). The t3 CLI name and npx t3 serve are unchanged.
• docs/user/background-service.md — corrected the unit and plist paths in the new platform-support section.

Tests added so the next sync fails loudly

• serviceLauncher.test.ts sweeps the whole server source for T3CODE_HOME reads.
• bootService.test.ts pins the plist's MARCODE_HOME, the Marcode launchd label, and T3_BOOT_SERVICE_UNIT staying upstream-shaped.
• threadSettled.test.ts pins that both the warm window and the settle-once anchor must clear before a terminal PR settles a thread.

Why

Scheduled upstream sync. It carries upstream's correctness, security, and platform work while preserving Marcode's product contracts — the floating pill nav, the slim chat header, the retired right-panel file surfaces, the service identity, and the MARCODE_* environment.

Two decisions worth a second look before this leaves draft:

1. BOOT_SERVICE_LAUNCHD_LABEL renamed to app.marcode.service. Nobody has upstream's label installed yet (Marcode never shipped macOS launchd support), so there is no migration cost — but it is a product call, not a mechanical fix.
2. Triage playbook retargeted to maarco/marcode. Leaving it would send Marcode users' bug reports to upstream and clone the wrong source; retargeting means the playbook prose is now Marcode-owned and future upstream edits to it will conflict. Both are one-commit reversible.

Coupled subtrees: pnpm-workspace.yaml moved only Clerk versions — effect and alchemy are unchanged, so no .repos sync is needed. infra/relay/package.json is untouched.

UI Changes

Two user-visible upstream surfaces land here — the browser tab mute control and the letter shortcuts on the right-panel surface dropdown — both taken as upstream wrote them. No screenshots yet: this sync was verified with focused tests and typechecks, not a live client pass. Worth driving the right panel at 390px and 820px before marking ready.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verification run

Focused tests for every touched area (server CLI, boot service, git, service launcher; client-runtime settle rules; web right panel, command palette, preview, thread status, git actions; desktop window, preview, lifecycle, app identity; mobile thread list; contracts settings; upstream-sync tooling) — all green. Typecheck clean on t3, @t3tools/web, @t3tools/contracts, @t3tools/shared, @t3tools/desktop. vp fmt --check and vp lint clean on the changed scope. The full suite is CI's job.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2ffb140 · PR result: 8141f4d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Test is blocked by the runner's apt mirror, not by this diff

Test was cancelled twice on 8141f4d2 — once on the original run, once on a re-run. Both died at the identical point, and neither ever started the suite.

Root cause. The test job carries timeout-minutes: 10 (.github/workflows/ci.yml:63). The step before the suite is:

- name: Install workspace search dependencyrun: sudo apt-get update && sudo apt-get install --yes ripgrep

apt-get update stalls on an unreachable azure.archive.ubuntu.com and burns the whole budget:

run	last apt line	cancelled	silent for
96130538128	15:47:51	15:56:33	8m42s
96134078019	15:59:04	16:07:46	8m42s

Ign:2 http://azure.archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
...
##[error]The operation was canceled.

vp run test never runs, which is also why the thread-transfer bot reported no result for 8141f4d.

Why it isn't this PR. The merge touches no workflow file (git diff HEAD^1 HEAD -- .github/workflows/ is empty); the apt step and the 10-minute timeout both predate it on main. main is green, including run 32219065865 on 2ffb1404 — this PR's exact merge base. The other three required checks (Check, Mobile Native Static Analysis, Release Smoke) are green on this head.

What I'm not doing. I've used my one re-run, and a workflow change is outside what this sync was asked to do — I'm not widening the PR to fix CI infrastructure. This is most likely a transient regional mirror outage that a later run clears on its own.

Proposed patch, if it recurs — belongs in its own PR, not this one:

- name: Install workspace search dependencyrun: | command -v rg >/dev/null && exit 0 sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=15 update sudo apt-get install --yes ripgrep

Skips apt entirely when rg is already on the image, and bounds the network wait so a dead mirror can't consume the job's timeout.

This PR stays draft regardless — it carries two fork-boundary decisions flagged in the description that want a human call before it goes ready.

---

Generated by Claude Code

[maarco]

Correction: Test is green — the mirror recovered

Superseding my previous comment. Test passed on a later run of the same head 8141f4d2 (06:39:11Z → 06:48:19Z, 9m08s). The transfer-budget report also updated in place with a real result for 8141f4d and no ceiling regressions.

That confirms the earlier diagnosis: a transient azure.archive.ubuntu.com outage, not the diff. Nothing was changed to fix it.

All four required checks are now green on 8141f4d2:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅

The proposed hardening of the ripgrep step still stands on its own merits — a nine-minute apt stall came within 52 seconds of the job timeout even on the run that succeeded — but it is not blocking anything here and belongs in its own PR.

Still deliberately draft. Two things want a human call before this goes ready:

1. The two fork-boundary decisions in the description (app.marcode.service label, triage playbook retargeted to maarco/marcode).
2. No live client pass was run. Browser tab mute and the surface-dropdown shortcuts are user-visible, so the right panel is worth driving at 390px and 820px.

---

Generated by Claude Code

[maarco]

Superseded by PR #51, the newer upstream sync through f035a0f4, which has now merged to main. Closing this older draft to keep the sync queue clean.