chore(upstream): sync marcode through 70cd258d

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Merges pingdotgg/t3code@70cd258d — 254 upstream commits past the f035a0f4 sync base.

Built on the unmergedb883fc06 sync branch (PR #68) rather than restarting from main, so that PR's hand resolution carries forward instead of being re-derived. This is a strict superset and supersedes #53, #55, #56, #58, #61, #63, #65 and #68 — all eight can be closed once this lands.

Conflict decisions (26 paths)

Retired right-panel file surfaces — Marcode's floating editor stays the only file-editing surface.

• files/{FileBrowserPanel,FilePreviewPanel,filePath,filePath.test}: kept deleted. Upstream's file breadcrumbs (fix(web): browse folders from file breadcrumbs pingdotgg/t3code#8910) and file-tree path reconciliation (fix(web): preserve panel state across workspace refreshes pingdotgg/t3code#8968) arrived as new modules imported only by those two panels, so they are dropped too and added to retired-right-panel-file-surfaces.test.ts.
• rightPanelStore / RightPanelTabs: kept the file/files union members out.
• ChatMarkdown: took upstream's panelPath refactor and its onOpenMedia fallback, but landed the open in the floating editor. Two auto-merged useRightPanelStore.getState().openFile(...) media actions were rerouted the same way — they would not have compiled.
• ChatView: took upstream's refreshVcsStatus / sidebarPrRefreshKeyRef (fix(web): sync sidebar PR state from open panel pingdotgg/t3code#9092), dropped its activeFileSurface derivation.
• Upstream's Oniguruma highlighter fix (fix(web): stop highlighter freezes and worker spin by using the Oniguruma WASM engine pingdotgg/t3code#8360) landed on the shared producer; verified every creation site in the merged tree passes PREFERRED_HIGHLIGHTER (the singleton is first-caller-wins).

Service and CLI identity

• cloud/bootService: kept marcode.service, MARCODE_HOME in both the systemd unit and the plist, and the "Marcode server" description; took upstream's downgrade refusal (fix(server): prevent accidental service downgrades pingdotgg/t3code#5302). Re-exported BOOT_SERVICE_UNIT_ENV (upstream un-exported it) because Marcode's test pins the unit name through it.
• cli/service: took upstream's --allow-downgrade flag and installedVersion reporting; kept the "Marcode service" label.

Persistence

• Migrations: upstream's 044_ClearAutomaticProjectModelDefaults renamed to 045 to preserve Marcode's 033 ProjectWorkspaceLayout offset; the pin test was updated.

Navigation shell

• AppSidebarLayout / SidebarChrome: kept the FloatingPillNav shell and no-sidebar-on-settings behavior. Removed the lazy SettingsSidebarNav binding upstream re-added (perf(web): halve the cold-start bundle by splitting Clerk and cold routes pingdotgg/t3code#9058) — Marcode never renders it, so it was dead.
• SidebarUpdatePill: took upstream's extraction into SidebarUpdateReleaseNotes (fix(desktop): show newest changes in nightly previews pingdotgg/t3code#9138) and re-applied Marcode's font-medium heading there.
• index.css: kept Marcode's absolute oklch dark palette. Upstream's relative darkening of its own palette (fix(web): darken neutral control surfaces pingdotgg/t3code#9064) is deliberately not ported, and the block now says so.

Other

• WorkspaceFileSystem: kept Marcode's mutation-target resolution and took upstream's resolveReadTarget — which also lets the floating editor read host files outside the workspace.
• commandInvariants, cloud/linkEnvironment, package.json build filters, GrokProvider test: took upstream's dead-code removals after confirming each symbol is unused in Marcode.
• contracts/settings.test: kept both describe blocks.
• ThreadTerminalDrawer (+ test): Marcode keeps xterm for its search, so upstream's Ghostty context-menu rewrite is not taken. Restored three declarations the auto-merge dropped from outside the conflict blocks (MULTI_CLICK_SELECTION_ACTION_DELAY_MS, selectionPointerRef, selectionGestureActiveRef).
• fileSaveCoordinator: both sides changed the same behavior. Upstream's confirmedRevision baseline (fix(web): avoid stale file writes on close pingdotgg/t3code#8630) met Marcode's cancel(), which zeroes latestRevision. A write resolving after a cancel no longer adopts its discarded revision as the baseline — otherwise it re-armed the entry guard, and once the user typed that many characters again the save was silently skipped. Pinned by a new test.

Fork-boundary breaks that merged with no conflict

The dangerous category: each merged cleanly, and nothing marked them. Seven in this sync — four found while resolving, three more that only CI caught.

Break	Effect if unfixed	Found by
cli/app (upstream's new t3 app) read T3CODE_HOME	The one CLI command ignoring an exported MARCODE_HOME, silently targeting the default install	review
cli/app fixtures hardcoded .t3	Marcode's default home is ~/.marcode; the fake desktop listened on a socket the command never dialed	review
updatesTestHarness (extracted by upstream) set T3CODE_* env names	DesktopConfig reads MARCODE_*, so every setting was dropped and the update tests asserted against defaults	review
bootService.test — two new upstream assertions hardcoded t3code.service	Unit-name assertions passing against the wrong service	review
thread-work-log imports mobile components/T3Wordmark	Marcode replaced it with MarcodeMark; mobile typecheck broke	CI Check
DesktopRemoteUpdates.test set T3CODE_DISABLE_AUTO_UPDATE	DesktopConfig reads MARCODE_*, so updates stayed on and no terminal report was produced	CI Test
016_CanonicalizeModelSelections seeds at 43, runs through 44	Marcode's ids sit one higher; the migration renumbered to 045 never ran	CI Test Server 2

Plus two non-identity breaks: ElectronProtocol.test (kept the marcode: scheme and took upstream's added http:/https: media-src sources) and scripts/package.json (upstream dropped yaml as unused, but Marcode's own upstream-sync-workflow.test.ts imports it). editor-pane now passes the workspaceRoot that openFileInPreview requires.

Both cli/app breaks, the migration offset, and the retired-surface removals are pinned by tests so a future sync fails loudly instead of silently reverting.

Why

Daily upstream sync. Hotspot paths were treated as mandatory-review, not automatic keep-Marcode: upstream's correctness and security work (service downgrade refusal, stale-write guard, host-file reads, the highlighter fix, PR sidebar refresh) is preserved even where it landed in customized files.

Coupled changes:pnpm-workspace.yaml and infra/relay/package.json differ from upstream only by Marcode's own renames, so neither vendored subtree moved — no sync:repos run needed. The lockfile was regenerated with pnpm, not hand-edited.

UI Changes

Not captured, and this is the one thing still owed. The sync container has no browser or simulator, so the integrated web (test-t3-app) and mobile (test-t3-mobile) verification passes in AGENTS.md were not run. Upstream touches a lot of user-visible surface here — inline assistant citations, the file viewer, the release-notes popover, media previews, mobile video — and the sync runbook also asks for a live pass at 390px and 820px when apps/web/** and apps/mobile/** hotspots change. That pass, not CI, is what this PR is waiting on.

Checklist

• This PR is small and focused — no: it is a 254-commit upstream sync, reviewed by conflict decision rather than by size
• I explained what changed and why
• I included before/after screenshots for any UI changes — not run, see above
• I included a video for animation/interaction changes — not run, see above

Verification

CI green on da25937: Check, Test, Mobile Native Static Analysis and Release Smoke — the four required checks — plus Test Server 1/2/3, Rust, Native fingerprint diff and claude-review. Thread transfer is within every ceiling (Codex total wire −2.3%, Claude −2.1%).

Locally: full vpr typecheck clean across all 14 packages, and the full vp run test suite clean apart from packages/shared/src/Net.test.ts — a findAvailablePort port-allocation artifact of the sync container. Both that test and its subject are byte-identical to main, and the check passes in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Fnpr83Gi1Wj7sgfMF4q6e

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.1 KiB	−318 B (−2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.2 KiB	−313 B (−4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	54.7 KiB	−352 B (−0.6%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−283 B (−2.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.3 KiB	−291 B (−4.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−352 B (−0.6%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: da25937 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.