chore(upstream): sync marcode through b883fc06

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f into main — 170 upstream commits over f035a0f4..b883fc06, 854 files. 45 conflicts, all resolved by hand. No whole-file ours/theirs, no force push, reset, restore, stash or clean.

Upstream SHA	b883fc066ea5c9bebbe1c3e9b4bc2471aab3685f
Merge base	f035a0f4cdf4abaa6704673af7b5a4a321149ba2
Target base	200e1491 (origin/main)
Merge commit	f1b2a407 (two parents)
Head	b119e211 — CI green, mergeable

Conflicts — combined both intents

• cloud/bootService.ts — keep Marcode's MARCODE_HOME plist key (the launcher's resolveLauncherBaseDir reads it and exits without it) and take upstream's new PATH export. Both now pinned by separate tests.
• persistence/Migrations.ts — upstream's 042/043 renumbered to Marcode's 043/044. Marcode's 033_ProjectWorkspaceLayout occupies 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs.
• ServerEnvironment / contracts/environment.ts — both capability flags (workspaceLayoutMutations, threadPullRequestLinking).
• ChatView.tsx — took upstream's ComposerSurface extraction (they moved the composer glass out of index.css) and re-applied Marcode's transparency through chat-composer-glass-shell-transparent, which still overrides the --glass-opacity variable their Shell reads. Also took feat: link pull requests to threads pingdotgg/t3code#8160's move of the git PR picker from thread- to project-scope, applied to the pill-nav cluster where Marcode renders that control.
• index.css — dropped upstream's retired .chat-composer-glass-* / -drawer-* / -context-strip / -shoulder-tab rules, kept only Marcode's own additions (composer transparency, ambient chat background).
• OpenInPicker — dropped Marcode's inline file-manager label, now supplied by upstream's editorLabelForPlatform (identical output); kept Marcode's filled icon.
• useHandleNewThread — Marcode's workspace placement plus upstream's project-default model resolution.
• mobile app.config.ts / package.json / authClientMetadata — Marcode's env var, schemes, release icon and label; upstream's runtimeVersionPolicy, reworked script set and tablet/phone device detection.
• vite.config.ts — upstream's new no-mobile-uniwind-theme-escape-hatches rule registered under Marcode's plugin namespace.
• Settings / Keybindings / PullRequestListFilters — took upstream's refactors (searchableSetting, WarningTooltipIcon, BrowserKeybindingNotice, the new filter control) and rebranded the copy at the shared producer.

Conflicts — kept Marcode's surface

• ChatHeader.tsx / SidebarChrome.tsx — thread actions and sidebar chrome live in FloatingPillNav. Upstream's fix(web): add back button to project settings pingdotgg/t3code#8168 back-button-on-project-settings fix has no surface to land on here; noted at the seam.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm for its search. Upstream's fix(web): make terminal links appear clickable only when clickable pingdotgg/t3code#7488 URL-activation fix is already covered by extractTerminalLinks' match.kind.
• components/files/ — right-panel file surfaces stay retired. Upstream's new fileTreeExpansion module only fed the deleted FileBrowserPanel.

Conflicts — took upstream

• threadSettled.test.ts deleted: its subject (effectiveSettled, canSettle, changeRequestAutoSettles) moved server-side in fix(server): settle threads server-side pingdotgg/t3code#8600.

Why

The dangerous part of a sync this size is not the conflicts — it is what merges cleanly and then quietly does not work on a fork. Nine such breaks were found and fixed. Seven were caught locally; the last two were caught by CI, and are called out as such.

Break	Effect if shipped
cli/theme.ts read T3CODE_HOME	t3 theme would ignore the user's Marcode home and write to the default install — every other Marcode CLI command reads MARCODE_HOME. Now pinned by a precedence test.
connection/clientMetadata.ts hardcoded "T3 Code Desktop" / "T3 Code Web"	Wrong user-visible client label on every paired session. Rebranded; its test asserts it.
3 oxlint suppressions named upstream's t3code/ plugin namespace	Inert on Marcode, so no-global-process-runtime fired as a lint error in preload.ts, verify-preload-bundle.mjs and externalLauncher.test.ts.
The new uniwind rule's test used the t3code/ rule id	Test asserts against a rule that does not exist here.
Migration 043's test carried upstream's toMigrationInclusive bounds (41/42)	Failed against Marcode's +1 numbering.
ThreadSettlementReactor.test.ts fixture lacked workspaceLayoutVersion / workspaceLayout	Typecheck failure — those are Marcode-only fields on OrchestrationProjectShell.
projectCommands.test.ts (Marcode-only) missed subscribeServerConfig	Typecheck failure — RpcSession was widened by pingdotgg#8367.
(caught by CI)useEnvironmentThemeSync.test.ts seeded t3code:theme	Upstream's brand-new test (pingdotgg#8569) uses their storage key; Marcode's is marcode:theme, so the stored selection was unreadable and no published theme drove the appearance — 4 assertions resolved dark instead of light. useTheme.ts and the new test came from opposite sides of the merge, so nothing marked the seam. Now also pins the key: a sync reverting it fails here instead of silently dropping every user's theme.
(caught by CI)Migrations.test.ts registry pin	The pin did its job — adding two migrations shifted its trailing window and it failed loudly. Updated, and re-anchored on migration 33 rather than slice(-10), which would slide off the Marcode-owned id as upstream keeps adding migrations.

Also restored the THREAD_SIDEBAR_DEFAULT_WIDTH export, which upstream un-exported when it deleted the test that used it — Marcode keeps that test.

Removal pins

Deletions are invisible to a merge, so upstream re-adds them silently every sync.

• Kept threadSidebarWidth.test.ts and mobileBranding.test.ts, both pruned upstream, both asserting Marcode-specific behavior.
• Added apps/web/src/editor/retired-right-panel-file-surfaces.test.ts so the next sync fails loudly when upstream re-adds the retired file panels. This sync is the worked example: upstream's expand/collapse-all control (feat(web): add expand/collapse all control to the files surface pingdotgg/t3code#8889) arrived as a brand-new module under a panel Marcode does not render, with no conflict.

Coupled subtrees

effect is unchanged in pnpm-workspace.yaml and infra/relay/package.json is byte-identical, so neither vendored subtree needs a sync. pnpm-workspace.yaml did move for Expo 56→57 and Clerk bumps; the lockfile was regenerated with pnpm (never hand-edited) and pnpm install --frozen-lockfile passes.

Notes for review

• Pre-existing, deliberately not touched:apps/mobile/app.config.ts still uses "T3 Code" for appName and its iOS permission strings on main. Upstream added two more in that style (photo library, microphone) and they were left matching the file's existing convention rather than half-rebranding it. Worth a separate decision.
• .github/workflows/desktop-macos-preview.yml is new from upstream and needs a blacksmith-12vcpu-macos-26 runner. It only fires on a preview:mac label, so it is inert by default.
• chat-composer-horizontal-inset is referenced in ChatView.tsx but defined in no stylesheet. Pre-existing on both sides of the merge, not introduced here.

Checklist

• Every conflict resolved by hand, combining both intents — no whole-file ours/theirs
• Zero conflict markers, zero unmerged paths, no .bak/.orig residue
• Fork-boundary audit for identity that merges without a conflict
• Compatibility identifiers left upstream-shaped: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, com.t3tools.t3code.service, and the t3code:* storage keys Marcode has not deliberately migrated
• Coupled vendored subtrees checked
• CI green on the current head
• UI screenshots — not applicable: no Marcode-authored UI change; the visual deltas are upstream's own

Verification

CI is green on b119e211 — all four required checks pass (Check, Test, Mobile Native Static Analysis, Release Smoke), plus Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff and claude-review. No review threads open. Thread-transfer ceilings all within budget.

Two commits sit on top of the merge, each fixing one real CI failure. Both were root-caused, not re-run: the failure was reproduced locally first, then shown passing.

• f38f3a83 — test(server): update the migration registry pin.
• b119e211 — test(web): seed Marcode's theme key in the published-theme sync test.

Local checks alongside CI: focused tests across the touched scope, typecheck clean for contracts, shared, client-runtime, web, t3 (server), desktop and mobile, vp fmt --check clean over all changed files, and vp lint with zero errors across the touched directories.

One local-only failure, environmental: four tests in apps/server/src/cli/theme.test.ts fail in the sync container. They inject write/read failures with chmod 000 and chmod 555, and that container runs as root, which bypasses those mode bits — verified directly (root reads a 000 file and writes into a 555 directory). They are upstream-authored, untouched by this merge, and pass in CI, as the green Test Server jobs above confirm.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−314 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−312 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−182 B (−1.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−192 B (−2.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	56.3 KiB	+488 B (+0.9%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: b119e21 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.