chore(upstream): sync marcode through 2daff8c2

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@2daff8c25adf701fddd062ae93b94cc57d420ec2 into main — 102 upstream commits since the last sync base f035a0f4. One two-parent merge commit (586dcfb2), plus two follow-up CI fixes. No rebase, no force push.

Headline upstream content: Expo SDK 57, turn file attachments (PDF/ZIP up to 50MB), thread↔pull-request linking, OpenCode child approvals and model catalogs, the macOS service PATH fix, and the Uniwind semantic-theme refactor for mobile.

34 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean.

Silent fork-boundary breaks caught (no conflict — these are the dangerous ones)

Break	Why it would have broken Marcode	Fix
New oxlint rule test hardcoded t3code/no-mobile-uniwind-theme-escape-hatches	Marcode's plugin meta name is marcode; the rule id would not resolve	Retargeted at marcode/, rule registered at error in vite.config.ts
Three oxlint-disable-next-line t3code/… comments	Suppress nothing against a plugin named marcode, so lint would fail	Retargeted at marcode/
New t3 theme CLI read T3CODE_HOME	Every other Marcode CLI command reads MARCODE_HOME; this one command would have silently targeted the default install	Switched to MARCODE_HOME, test renamed with it
New connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Merged cleanly and would have relabelled every connected client in the connections list	Both labels sourced from branding's APP_BASE_NAME; upstream's test now asserts the Marcode label
androidAdaptiveForeground auto-merged to upstream's white T3 wordmark on all three channels	Invisible on Marcode's white release background, and wrong branding on dev/nightly	Re-authored android-icon-foreground.svg with the black Marcode glyph in the adaptive safe zone; regenerated the 432×432 transparent PNG
(found by CI, 9eff59df)Migrations.test.ts pins the registry tail with slice(-10)	The two renumbered migrations pushed ProjectWorkspaceLayout (id 33) out of the window — the pin firing exactly as designed	Widened to slice(-12) and added both entries, keeping id 33 as the anchor
(found by CI, 4bfa609a) New useEnvironmentThemeSync.test.ts seeds localStorage with "t3code:theme"	Marcode renamed the selected-theme key to "marcode:theme" (useTheme.tsSTORAGE_KEY). No theme resolved, so the hook fell back to dark and all four light-appearance assertions failed	Seeded "marcode:theme", matching the literal useTheme.test.ts already uses

The last two were not caught by the pre-push audit and were found by CI. After fixing the second, every "t3code:*" literal this merge introduces was swept against the keys Marcode actually renamed; the only other one, "t3code:default-theme-applied:v2:", is entirely new upstream with no Marcode counterpart, so it correctly stays upstream-shaped.

Conflict decisions

Server

• cloud/bootService.ts — took upstream's PATH export in the launchd plist (fix(server): keep provider CLIs available in the macOS service pingdotgg/t3code#8173, keeps provider CLIs on the macOS service) and kept Marcode's MARCODE_HOME key. resolveLauncherBaseDir reads MARCODE_HOME and exits without it, so the plist must match the systemd unit.
• cloud/bootService.test.ts — kept both tests (Marcode's MARCODE_HOME pin, upstream's installer-PATH assertion), retargeting the Marcode one at the new macRenderOptions fixture.
• persistence/Migrations.ts — upstream's two new migrations renumbered to the next free Marcode ids: 042 → 043 ProjectionThreadLinkedPullRequest, 043 → 044 ProjectionThreadsUnsettledAt. Marcode's ProjectWorkspaceLayout holds 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Both the migration's own test and the registry pin were retargeted.
• ServerEnvironment{,.test}.ts, contracts/environment.ts — both capability flags kept (threadPullRequestLinking + workspaceLayoutMutations).
• server.test.ts — both imports kept.

Web

• connection/platform.ts — took upstream's clientPresentationMetadata refactor (feat(analytics): report connected client platforms pingdotgg/t3code#8481: device type, OS, browser family, hosted deployment).
• sidebar/SidebarChrome.tsx — kept Marcode's bare drag strip. Upstream's only change was fix(web): add back button to project settings pingdotgg/t3code#8168's project-settings Back button inside SidebarUtilityMenu, which Marcode moved to FloatingPillNav — whose "Back to Workspace" entry already covers every off-thread route, so the defect does not exist on this surface.
• ChatView.tsx — took upstream's useThreadActions destructuring (its consumers merged in cleanly) without the duplicate handleNewThread Marcode moved down; kept the one-prop ChatHeader; kept Marcode's composer insets and applied fix(web): four composer spacing defects pingdotgg/t3code#8090's shoulder-tab reduction at both breakpoints so sm:pb-10 does not shadow it.
• ChatMarkdown.tsx — took upstream's editorPreferences/editorLabels/remoteOpen/entities imports; dropped useRightPanelStore and the now-dead useActiveEnvironmentId. File links still open in the floating editor.
• ThreadTerminalDrawer.tsx — kept Marcode's xterm implementation. fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488's fix lands through the shared terminal-links producer, which Marcode already routes on via match.kind.
• settings/KeybindingsSettings.tsx — took upstream's extracted WarningTooltipIcon / BrowserKeybindingNotice, restoring Marcode's copy inside them.
• chat/OpenInPicker.tsx — took upstream's editorLabelForPlatform refactor (it subsumes Marcode's Finder/Explorer/Files ternary), kept Marcode's filled FolderOpenFilled glyph.
• hooks/useHandleNewThread.ts — kept Marcode's workspace placement registration, took upstream's fix(clients): honor project default models in new threads pingdotgg/t3code#6011 project-default model resolution.
• composerDraftStore.ts — kept the marcode: key, took the version bump to 9 (persisted draft shape changed with attachments).
• providerUpdateDismissal.ts — followed upstream's un-export, kept the Marcode key.
• files/FilePreviewPanel.tsx — kept Marcode's deletion. fix(web): render nested markdown images correctly pingdotgg/t3code#8501's nested-image fix still lands in ChatMarkdown, which Marcode uses for chat.

Mobile

• app.config.ts — kept MARCODE_IOS_PERSONAL_TEAM, took upstream's new runtimeVersionPolicy, adopted Fix Android adaptive launcher icon pingdotgg/t3code#4332's adaptive-icon fix with Marcode branding (see table above). Backgrounds are white on every channel, which preserves the rendered icon exactly — the old full-bleed white foreground already hid the per-channel tints.
• package.json — took fix(mobile): reduce dev-client reload and Metro startup cost pingdotgg/t3code#8694's dev-client startup fix (no --clear, new dev:client:reset), kept the marcode-* schemes.
• CompactBrandTitle.tsx + HomeHeader.tsx — adopted upstream's Uniwind semantic classes (required: useThemeColor.ts was deleted upstream and the new escape-hatch rule is an error), kept MarcodeMark and the conditional stage pill.
• lib/authClientMetadata.ts — kept the Marcode label, took upstream's tablet/phone device-type detection.

Tooling and docs — build-desktop-artifact.test.ts kept all imports from both sides plus Marcode's provisioning-profile fixture alongside upstream's sign assertion; AGENTS.md kept Marcode's sections and ported the one rule upstream added that they did not already cover; docs/README.md kept the unified-workspace entry and added OpenCode; pnpm-lock.yaml was regenerated with pnpm, not hand-resolved.

Removals pinned with tests

Upstream deleted two tests that were the only thing holding a Marcode removal in place. Both were replaced so the next sync conflicts loudly instead of silently reverting:

• apps/web/src/components/threadSidebarWidth.test.ts (deleted in test: prune trivial error and layout tests pingdotgg/t3code#8400) — kept for its "keeps the brand out of the sidebar header" case, retargeted off the constant upstream un-exported.
• apps/mobile/src/lib/mobileBranding.test.ts (deleted in test: remove low-signal test files pingdotgg/t3code#8397) — kept, and extended with a new pin asserting both mobile lockups render MarcodeMark and that T3Wordmark.tsx stays out of the tree.

Coupled subtrees

pnpm-workspace.yaml moved, so the effect-version-subtree coupling was checked: the effect catalog entry is unchanged at 4.0.0-beta.103, so .repos/effect-smol needs no sync. infra/relay/package.json did not move, so the alchemy coupling is not triggered.

Why

The daily scheduled sync hit a conflicted delta and filed #62 rather than pushing a branch. This is the hand resolution that unblocks it.

Hotspots are treated as mandatory-review paths, not keep-Marcode paths: every upstream correctness, security, and operational fix above survives even where it landed in a customized file.

UI Changes

Not captured — this container has no display, so the web and mobile surfaces were not driven. Verification below is tests, typecheck, format, and lint only. Before taking this out of draft, the runbook's runtime verification is still owed: apps/web/**, apps/mobile/** and assets/** all changed, so the affected surfaces need a real pass at 390px and 820px, plus vp run icons:check for the regenerated Android adaptive foreground.

The one visual change worth a specific look is the Android adaptive launcher icon on dev, nightly, and production — the rendered result should be unchanged (black Marcode glyph on white), now without Android double-masking the silhouette.

Verification

• Full apps/web suite — 297 files, 3263 tests, all pass locally via the package's own test script (vp run --filter ./apps/web test), matching CI's total exactly. Note: vp test run apps/web is not equivalent — it bypasses the package's vitest project config and six files fail to load on wasm/icon assets.
• Full apps/server/src/persistence — 21 files, 35 tests, all pass.
• Focused tests — oxlint-plugin-marcode uniwind rule, bootService, cli/theme, ServerEnvironment, serviceLauncher, migrations 042/043 + the registry pin, mobileBranding, threadSidebarWidth, clientMetadata, contracts/environment, Sidebar.logic, composerDraftStore, editorLabels, terminal-links, branding, ChatMarkdown.workspace-images, ComposerTasksBadge, ComposerStashBadge, build-desktop-artifact, upstream-sync-workflow.
• Typecheck — apps/web, apps/server, apps/mobile, apps/desktop, packages/contracts all exit 0.
• Format — vp fmt --check clean across all 568 changed source files.
• Lint — vp lint exits 0 across apps/*/src, packages, oxlint-plugin-marcode, scripts. Only pre-existing no-native-title-tooltip warnings (the documented Marcode seam kept at warn).

Known environment artifact: 4 tests in apps/server/src/cli/theme.test.ts fail in the authoring container and pass in CI (confirmed green there). They map 1:1 to the file's four chmodSync(…, 0o555 / 0o000) sites; that container runs as uid 0, and root can write into a 0555 directory, so those rollback paths structurally cannot trigger. Verified by probe, not assumed.

Checklist

• This PR is small and focused — no, and deliberately so: it is one upstream merge commit, which is the unit the sync policy defines. Splitting it would fabricate history.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this container; owed before undraft, see above
• I included a video for animation/interaction changes — as above

Closes#62.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.3 KiB	−118 B (−0.9%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−119 B (−1.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.6 KiB	+558 B (+1.0%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−103 B (−0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−111 B (−1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.4 KiB	+620 B (+1.1%)	66.4 KiB	✅
Claude	Live turn messages	16	11	−5 (−31.3%)	21	✅

Baseline: 133f3f7 · PR result: 4bfa609 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.